The aim of our Assurance Review is to independently assess the state, effectiveness and efficiency of Police Scotland’s Counter Corruption Unit (CCU). The background to this review is outlined within our terms of reference, which were published on 11 January 2016.
This HMICS review was requested by the Scottish Police Authority (SPA) in response to a finding by the Interception of Communications Commissioner that there had been contraventions of the Acquisition and Disclosure of Communications Data, Code of Practice 2015 in respect of five applications for communications data submitted by Police Scotland. These related to one investigation being undertaken by Police Scotland’s CCU. Although our review has not re-examined this finding by the Commissioner, we have taken the opportunity to examine the wider investigation conducted by the CCU into the circumstances which initially gave rise to these applications. The intention behind our review was to independently determine the facts and to identify practical lessons that will assist in improving police counter corruption practices in Scotland.
Our report has been separated into two parts:
- Part one – This case study comprised a detailed review and assessment of the initial referral to the CCU relative to the alleged disclosure of sensitive information to a journalist. This included the subsequent investigation into the circumstances which gave rise to the applications for communications data that were found by the Interception of Communications Commissioner’s Office (IOCCO) to have contravened the statutory Code of Practice (2015).
- Part two – Using our Inspection Framework, as shown in our methodology we have concluded a thorough Assurance Review, testing the operational practice of the CCU and compliance with relevant legislation, codes of practice, policies, procedures and recognised best practice.
During our review we have accessed sensitive operational information and risk assessed the potential for compromise of individuals and roles. In order to determine whether the CCU investigation was necessary, proportionate and objective, we examined restricted intelligence files and interviewed key individuals. We have respected the anonymity and confidentiality of those individuals who have provided information to the CCU, and where appropriate we have protected the identity of such sources and the identity of operational police officers and members of police staff.
Our review was undertaken across five stages with a number of activities carried out concurrently. We examined relevant strategies, policies, policing plans and analytical products that are designed specifically to address the threat from corruption. We also researched media reports and websites to determine how the CCU is perceived by the public.
In accordance with our duty of user focus, we gained a user perspective from key stakeholders, including staff associations and relevant partners. We held a focus group with police officers who had been subject to CCU investigations, which was facilitated by a solicitor acting on their behalf. We also carried out benchmarking activity with Merseyside Police to compare and contrast Police Scotland’s approach to tackling corruption with that deployed by Merseyside Police.
Chief officers and senior managers within the CCU have co-operated fully throughout our review and the senior leadership within Police Scotland are committed to preventing corruption and investigating wrongdoing in a professional and ethical manner.
As a consequence of our review, Police Scotland will be asked to create an action plan in order that our recommendations are taken forward. We will monitor progress against this plan and publish our findings as part of our annual reporting process. We welcome the commitment from the Chief Constable and the Chair of the SPA to implement all our recommendations.
Number | Recommendation |
|---|---|
1 | Police Scotland should ensure that the Counter Corruption Unit intelligence processes are reviewed and that information including the source of that information is subject of a process of evaluation, risk assessment and validation to produce a product that provides added value and supports the decision making process. |
2 | Police Scotland should reconsider the decision not to seek an explanation from the serving officers regarding information collected during the Counter Corruption Unit enquiry. |
3 | Police Scotland should investigate the circumstances which led to the loss of CCTV disc footage seized by the Counter Corruption Unit Intelligence Section and establish whether the loss of the disc and any data is a notifiable data security breach. |
4 | Police Scotland should introduce robust and effective scrutiny arrangements for Counter Corruption Unit operations, including greater oversight from chief officers. |
5 | Police Scotland should introduce a more structured approach to communicating changes in legislation, practice and process to police officers and members of police staff involved in applications under the Regulation of Investigatory Powers (RIPA) 2000 and by extension the Regulation of Investigatory Powers (Scotland) Act (RIPSA) 2000. |
6 | Police Scotland should take the opportunity to articulate a clear vision for tackling corruption and develop an overall strategy that involves engagement with key stakeholders. |
7 | Police Scotland should urgently review its approach to tackling corruption, and develop both the capability and capacity to undertake effective pro-active anti-corruption investigations that are underpinned by a robust intelligence function. This should include a review of its existing structures and give consideration to transferring the burden away from the Counter Corruption Unit of high volume administrative background checks, notifiable associations and those data protection offences which do not infer corruption. |
8 | Police Scotland should develop a refreshed communications plan to increase the awareness of the Code of Ethics and promote a positive culture where police officers and members of police staff at all levels are familiar with each of the behaviours and are conscious of applying them. |
9 | Police Scotland should improve its co-ordination of internal self-assessment reviews to ensure they receive greater executive visibility and where accepted, any recommendations or improvement actions are supported by a delivery plan detailing SMART objectives and outcome measures. |
10 | Police Scotland should introduce a process of formal peer review of counter corruption investigations. |
11 | Police Scotland should engage with the Crown Office and Procurator Fiscal Service, Police Investigations and Review Commissioner, the Scottish Government and other stakeholders to review and strengthen the overall approach to the independent scrutiny and oversight of investigations into allegations of serious corruption by police officers and members of police staff. |
12 | Police Scotland should develop formal joint working arrangements between the Counter Corruption Unit and those areas of the service that provide specialist assets in support of counter corruption investigations. This should be supported by agreed governance structures that allow informed decisions to be made against competing operational priorities. |
13 | Police Scotland should maintain functional separation between the Counter Corruption Unit and Professional Standards Department and where possible, Counter Corruption Unit police officers should not be used to investigate cases that would ordinarily be conducted by Professional Standards Department police officers. |
14 | Police Scotland should consider adopting the Authorised Professional Practice on counter corruption, subject to any modification or extension to cover Scotland. This should be applied to the review and development of key policies and procedures. |
15 | Police Scotland should finalise its Strategic Assessment on Corruption and thereafter produce a control strategy that will deliver the intelligence, service integrity, enforcement and the communication and engagement priorities for the next 12 months. |
16 | Police Scotland should develop a balanced performance management framework to reflect Counter Corruption Unit activity and provide regular management information to those charged with the internal and external governance and oversight. |
17 | Police Scotland should develop the Counter Corruption Unit Tactical Assessment to focus more on intelligence, operational and preventative activity. |
18 | Police Scotland should expedite the review and development of those standard operating procedures that are used to promote integrity and consider relevant Authorised Professional Practice. |
19 | Police Scotland should introduce a system that enables the analysis and cross-referencing of notifiable associations across relevant ethical registers. This should identify potential conflicts of interest and provide an informed assessment of trends, threats and vulnerabilities to inform preventative activity. |
20 | Police Scotland, through engagement with staff associations, should progress development of its “whistleblowing” policy, which informs relevant standard operating procedures that support those who report wrongdoing. |
21 | Police Scotland should review the Integrity Matters Confidential Reporting System with a view to implementing further technical safeguards for audit. |
22 | Police Scotland should engage with the Police Investigations and Review Commissioner to consider establishing a confidential reporting function. |
23 | Police Scotland should engage with Crown Office and Procurator Fiscal Service to examine alternative and more expeditious approaches to the reporting of minor offences against the data protection act in cases where the individual police officer or member of police staff has admitted the offence and there is no evidence of corruption. |
24 | Police Scotland should urgently review the circumstances of all police officers and members of police staff who are on restricted duties to ensure that those restrictions remain proportionate and necessary to the current risk. |
25 | Police Scotland should engage with Crown Office and Procurator Fiscal Service to expedite decisions around outstanding data protection cases. In addition to this, Police Scotland should review those cases which have been returned from Crown Office and Procurator Fiscal Service with no criminal proceedings being taken, with a view to expediting decisions around ongoing internal misconduct. |
26 | Police Scotland should engage with the Scottish Police Authority to finalise its standard operating procedure for Advice and Guidance Briefings by the Counter Corruption Unit. This should also include a process to ensure that the offer/option to audio record the briefing is documented for audit purposes. |
27 | Police Scotland should progress development of a business case for workforce monitoring software. |
28 | Police Scotland should review its Counter Corruption Unit production handling procedures to ensure they maintain the operational security of corruption investigations and are consistent across all areas. |
29 | Police Scotland should develop a workforce planning model that supports the current and future demands on the Counter Corruption Unit and provides an evidence based assessment of required staffing levels, including supervisory ratios. |
30 | Police Scotland should commission a Training Capacity and Capability Review to map current and future skills and identify gaps within the Counter Corruption Unit which can be filled through recruitment, training and professional development. |
31 | Police Scotland should review its Counter Corruption Unit Risk Assessment Processes to ensure a consistency of approach. |
32 | Police Scotland should maintain iBase as its primary Counter Corruption Unit case management system and commission a comprehensive review of the design, structure and management of the system. This should also include the development of operating procedures, guidance and training for staff. |
33 | Police Scotland should ensure that the Counter Corruption Unit prioritises its workload around the threat posed by serious organised crime groups. |
34 | Police Scotland should introduce a process that enables Counter Corruption Unit police officers and members of police staff to debrief intelligence and operational activity in a structured manner to support organisational and operational learning. |
35 | Police Scotland should consult with its public sector partners and refresh the remit of the Counter Corruption Unit Public Sector Section. |
36 | Police Scotland should monitor the progress of the vetting section to reduce and, if possible, eliminate the backlog of vetting applications and provide regular updates to the Scottish Police Authority. |
37 | Police Scotland should expedite its review of police officers and members of police staff who are considered to be “super users” with administrative access to Force ICT systems. It should ensure these staff are appropriately vetted, with safeguards put in place to ensure access to information is for a legitimate policing purpose. |
38 | Police Scotland and the Scottish Police Authority should engage with the Crown Office and Procurator Fiscal Service, Police Investigations and Review Commissioner and other stakeholders to review and strengthen the overall approach to the independent scrutiny and oversight of complaints made against Counter Corruption Unit police officers and members of police staff. |
39 | Police Scotland should ensure that in the interests of transparency and service confidence, any review into outstanding complaints against the CCU should include independent scrutiny. |