Pwyllgor y Llywydd

Llywydd's Committee


Aelodau'r Pwyllgor a oedd yn bresennol

Committee Members in Attendance

David Rees Cadeirydd y Pwyllgor
Committee Chair
Janet Finch-Saunders
Joyce Watson
Llyr Gruffydd
Peredur Owen Griffiths

Y rhai eraill a oedd yn bresennol

Others in Attendance

David Moran Y Comisiwn Etholiadol
The Electoral Commission
Elan Closs Stephens Y Comisiwn Etholiadol
The Electoral Commission
Rhydian Thomas Y Comisiwn Etholiadol
The Electoral Commission
Rob Vincent Y Comisiwn Etholiadol
The Electoral Commission

Swyddogion y Senedd a oedd yn bresennol

Senedd Officials in Attendance

Bethan Garwood Dirprwy Glerc
Deputy Clerk
Meriel Singleton Clerc

Cofnodir y trafodion yn yr iaith y llefarwyd hwy ynddi yn y pwyllgor. Yn ogystal, cynhwysir trawsgrifiad o’r cyfieithu ar y pryd. Lle mae cyfranwyr wedi darparu cywiriadau i’w tystiolaeth, nodir y rheini yn y trawsgrifiad.

The proceedings are reported in the language in which they were spoken in the committee. In addition, a transcription of the simultaneous interpretation is included. Where contributors have supplied corrections to their evidence, these are noted in the transcript.

Cyfarfu’r pwyllgor drwy gynhadledd fideo.

Dechreuodd y cyfarfod am 11:52.

The committee met by video-conference.

The meeting began at 11:52. 

1. Cyflwyniad, ymddiheuriadau a dirprwyon
1. Introductions, apologies and substitutions

Good morning, and can I welcome Members and our witnesses to this morning's evidence session of the Llywydd's Committee? Just a few housekeeping items: we are virtual today, so if you require to speak, please raise your hand. The microphones will be controlled by the technical teams at the Senedd. There are no declarations of interest, I don't think—no-one's made any—and there have been no apologies received today. Can I please remind everyone to make sure their mobile phones and other devices are switched off, as they may interfere with the broadcasting and definitely could cause an echo as well?

2. Craffu ar amcangyfrif atodol y Comisiwn Etholiadol ar gyfer 2023/24
2. Scrutiny of the Electoral Commission supplementary estimate 2023/24

This morning's session, therefore, is an evidence session looking at the supplementary budget from the Electoral Commission. Can I welcome to the meeting Dame Elan Closs Stephens, the electoral commissioner for Wales; Rob Vincent, who is the interim chief executive of the Electoral Commission; David Moran, who's the director of finance and corporate services at the Electoral Commission; and Rhydian Thomas, who's head of the Electoral Commission, Wales at the Electoral Commission? Thank you all for coming along this morning. We've got a very's short session, but we need to go through this, because, clearly, there's a deadline for the supplementary budget. We'll go straight into questions, if that's okay, for yourselves. The first question will be from Llyr Gruffydd.

Bore da, bawb. Roeddwn i eisiau edrych, os caf i, i gychwyn, ar yr elfen o gyflog staff sydd yn yr amcangyfrif atodol, ac nid yn unig i gwrdd â'r codiad cyflog, ond hefyd yr un taliad yma o £1,500 i staff ar draws y comisiwn. Jest i ddechrau, efallai, allwch chi ein hysbysu ni o pam eich bod chi heb hysbysu'r pwyllgor yma o'ch bwriad chi i gyflwyno amcangyfrif atodol, na chyfathrebu â'r pwyllgor y ffaith eich bod chi wedi penderfynu gwneud y taliad yma o £1,500 i'ch staff? Achos, yn amlwg, wrth wneud y penderfyniad, roeddech chi'n gwybod y byddai angen gwneud amcangyfrif atodol.

Good morning, all. I wanted to look, if I may, to begin with, at the element of staff salary that's in the supplementary estimate, not only to meet the salary increase, but also this £1,500 payment to staff across the commission. Just to start, perhaps, could you tell us why you hadn't informed this committee of your intention to present the supplementary estimate, nor communicated with the committee the fact that you had decided to make this payment of £1,500 to your staff? Because, in making the decision, obviously you knew that you would have to submit another supplementary estimate.

Diolch. Gwnaf i ddechrau, Llyr. Diolch yn fawr iawn ichi am y gofal a'r—

Thanks. I'll start, Llyr. Thank you very much to you for the care and—

Sorry. Sorry to interrupt, Elan. The translation isn't working, yet I've got it set on English. Can anybody else hear the translation?

Can we hold on a second? Yes, most people did, Janet. Can we try the translation again, please?


Whilst you are waiting, Janet, I'll just carry on—

In that case, can you just lower the hand as well then, Janet, please? I apologise for that, folks. We just needed to make sure that every Member can hear clearly. Then over to you, Elan.

Diolch yn fawr iawn, Llyr, a diolch am y gofal a'r craffu. Dwi'n meddwl ei bod hi'n eithaf amlwg i chi fod y comisiwn wedi bod trwy gyfnod nad oedd ddim yn gweithio mor effeithiol a pherffaith ag y dylai o fod. Ac mae'n amlwg i chi hefyd fod gennym ni ddau gyda ni heddiw sydd yn interim, ac mae hynny'n amlygu rhywbeth am stad y gorfforaeth. Cyn i mi roi drosodd i Rob Vincent ac i David, hoffwn i jest ddweud ein bod ni'n ddiolchgar iawn fel comisiwn i Rob am gymryd y swydd o brif weithredwr. Mae o wedi bod yn gomisiynydd am wyth mlynedd, ac mae o hefyd wedi bod yn brif weithredwr cyngor sir a hefyd yn swyddog canlyniadau yn ei hawl ei hunan. Felly, mae ganddo fo brofiad yn y maes, ac rydyn ni i gyd yn ddiolchgar iawn iddo fo, ei fod o wedi camu i mewn.

Ond mae'n amlwg, o hyn ymlaen, y bydd yn rhaid i ni gyfathrebu'n gliriach â chi, ac, yn amlwg, cyfathrebu hynny hanner ffordd trwy'r flwyddyn, nid dod atoch chi ar ddiwedd y flwyddyn efo fait accompli, ac mi rydyn ni siŵr o fod yn ymddiheuro am hynny. Ac felly, mi wnaf i adael i Rob ac i David fanylu.

Thank you very much, Llyr, and thank you for the care and the scrutiny. I think that it's quite clear to you that the commission has been through a period when it wasn't working as efficiently and as perfectly as it should have been. And it is clear to you also that we have two with us today who are in interim positions, and that highlights something about the state of the body. Before I hand over to Rob Vincent and to David, I'd like to just say that we are very grateful as a commission to Rob for taking on the post of chief executive. He has been a commissioner for eight years, and he has also been a chief executive at a county council and also a returning officer in his own right. So, he has experience in the area, and we are very grateful to him for stepping in.

But it's clear that, from now on, we will have to communicate more clearly with you, and, obviously, communicate that halfway through the year, not come to you at the end of the year with a fait accompli, and we surely apologise for that. And so, I'll let Rob and David go into more detail.

Thanks, Elan. Shall I carry on? If everybody can hear me. So, I'm Rob Vincent; I'm the interim chief exec. In a sense, I just want to start by echoing what Elan's just said, actually. Llyr's question was politely put, but it was: why did we not inform you at the point where we were making a further pay settlement beyond what we'd allowed for in the budget, and why are we coming much later, seeking absolution rather than bringing you into the discussion at the right stage? I think we should have done, and I can only really apologise in retrospect that that's what occurred.

Just a little bit of circumstantial defence, I guess—it's not to get away from the fact that we should have done so. Everybody will know that it was a very volatile year for inflation and for pay awards, and we're obliged to keep our pay awards in line with the civil service. The civil service didn't reach the end of its negotiation with the unions, and, to some extent, I guess, with the Treasury, until August. We actually made our pay award shortly after that, in September, after further discussion with our unions—largely, the Public and Commercial Services Union.

I suppose the additional point I wanted to makes was that it wasn't entirely clear at that stage how much further finance we would need in the form of a supplementary estimate. We did search earnestly for internal savings. I don't know if you recall, but the Treasury's advice across the civil service—we're not the civil service, but we are affected by the advice, second-hand, in a way—was that certainly large ministries should look for offsetting savings within the rest of their budgets to meet the additional cost of the pay settlement. That advice goes across the whole system, and it affects us in a way. I have to say that the Treasury understand though that we are a pretty small organisation, with very few overheads, and, as it turned out, an insufficient contingency to absorb the further pay award. But it wasn't clear immediately precisely how much that was the case, particularly over the contingency. We did look for further savings internally, although I do have to admit that it was pretty clear that there would be some form of supplementary estimate in order to be able to afford the pay settlement, so we should have come to you—I can't disguise that.

Okay. So, you should have come to us, that's one thing. But also, what does it tell us about the way that those decisions are made—that that decision was made without any assurance that you could actually meet the demand? Because there's no guarantee around—. If you're saying now that you knew that there would be a supplementary estimate, then, clearly, you made the decision without knowing whether you could pay it or not.


If I can come back on that, there's a stark challenge. I don't quite see it quite as starkly as that. We did look for the internal savings. We were conscious that if a supplementary estimate was not in the end approved we would have to make reductions in our services, and that is the fallback position even now. It's very late in the year; if a supplementary estimate is not approved, then we will have to cut quite a bit of our support to, in particular, communications with the public and with returning officers, effectively, and electoral administrations. 

You probably know all this already but, just to make you aware, we now have reached the position where a supplementary estimate has been agreed in Scotland, with similar lessons for us to learn. And we had a session with the Westminster's Speaker's Committee on the Electoral Commission earlier in January. The outcome of that was also to agree it, but with much the same point—almost exactly the same point—that we should have asked permission rather than simply come late in the year, and we accept that.  

Okay, because I see from correspondence—I think it's from David Moran, isn't it, dated 12 December, when the Chair of this committee wrote previously to ask about clarity around the regularity and propriety of making these kinds of payments in advance of a supplementary budget—the letter says that payments were made with a clear understanding that it might entail a combination of measures to balance the overall budget, which is something that Mr Vincent has just touched on now, including curtailment of specific activities, and the pursuit of a supplementary estimate. But then it goes on to say with the decision to make the £1,500 payments made, the commission considered that the only alternative, really, was to ask for a supplementary estimate or budget. 

So, whilst you initially made the decision based on the need for cuts and a supplementary budget, you then, having made the decision, decided only on a supplementary budget. Should not that assessment have happened as to whether cuts were feasible before making those additional payments? 

It was going at much the same time. In a sense, I just want to, again, push back on context. Not to duck the point, but it was important to us that we completed our negotiation with our own local staff, largely through the Public and Commercial Services Union, and made the payment fairly smartly. We were beginning to lose staff. There were certainly effects on morale. And actually, there was just attrition on colleagues because of the cost-of-living increases since the beginning of the year. So, it was important to us to come to a final decision over the pay settlement quickly. As it happens, I'm not entirely sort of—.[Inaudible.]—said that I've only come in after this as an interim, but I was actually chairing the remuneration committee at this stage. It's perhaps worth me just saying that we had two really quite full discussions at that committee, and then between the two, actually, we had an open session with the union, so they were directly coming through to the governance structure. It was clear to us that we had to agree the remit with a final negotiation, which was led by the then chief exec, fairly smartly, and there would not have been time at that stage to fully understand the rest of the pressures on our budget, which were still emerging, some of the rest of which you see in the rest of the supplementary estimate calculations, including the cyber costs. So, it's not quite as clear as you're making it sound, but the general point I fully accept, that we should have got agreement before we made the payment.

Yes. So, fundamentally, the central point of what I'm proposing here is that your—. All public sector organisations would like to conclude those discussions swiftly for morale purposes, retention et cetera, but not all bodies would actually make that decision without knowing whether or where that money comes from, I suppose. That's the central point of my argument. 

And I accept the point. Were it not to be funded through supplementary estimate, we would take action to bring our budget back, which would be an unwelcome action, I have to say, but—.

Indeed, indeed, and we might get on to what the consequences of having to do that might be later on. Can I therefore ask about how the £1,500 non-consolidated payment was structured and when exactly it was made? 

Well, it was straightforwardly structured, in that it was paid to every member of staff. It is, as you say, a non-consolidated one-off payment, so it has no impact beyond this financial year. 

It was paid in one lump sum, and from memory—I'd have to double-check, I'm afraid, but—I think it was paid in September. Well, it was finally agreed in September—it may have actually been October before it was finally paid, I suspect. But I would have to check. 


So, that payment was made and the funding for that actual payment was taken from your account or—

It left a deficit, therefore, that needs to be backfilled, effectively, then. 

Well, at that stage—. It won't be a deficit until later in the year. But it put a pressure that was way beyond our provision for pay. To that extent you're right, yes. 

Okay. And can you just—? So, it's every single employee within the commission.

Yes. Well, there was coming and going during the year, of course. There were some who were affected by how long they'd been with us. But, yes, in principle, every person was treated the same way. 

Yes. And on the £1,500, yes, but, just on the context of that, the fundamental pay award, the 4.5 per cent plus a further 0.5 per cent, was quite significantly skewed towards the lower paid, and that, of course, is the one that goes into future years. So, in fact the higher paid have done less well out of this than our lower paid staff. 

So, that's the additional 0.5 per cent that could be given to lower earners. 

Yes, my memory was that the civil service was skewing that to some extent. Our negotiations with our union led to that being skewed rather more, actually, towards our lower paid—for good reason, but that was the outcome. 

Before you ask, Llyr, David wants to come in. He raised his hand—he wants to come in with some point. 

Yes, it was only matters of clarity. So, the £1,500 would have paid to all staff, whether fixed term or permanent, that were in post as at the very end of March and were still in post at, I believe, the end of September. So, anybody who was new, or anybody who left at that time, wouldn't have got it, but everybody would have received it, or a pro rata, if they work part time. So, I just wanted to make that absolutely clear. And the reference to the full breadth of staff getting £1,500 is something that we are very aware of, that, at the same time we were trying to agree a pay award as closely aligned to the civil service as possible, we had four staff who were, effectively, senior civil service grades. Now, the standard settlement within the civil service was 5.5 per cent, and we wanted to try and make sure that this wasn't a divisive measure, so we aligned those four people in the same way as we aligned all the other staff with the £1,500, rather than that extra 1 per cent that was for the senior civil service. And the last point is that that 4.5 per cent to 5 per cent gave us a fund that allowed us to look at the lower paid, which were the lowest three ranks, and they would have received a 6.5 per cent increase rather than a 5 per cent. I just want to make that clear for the percentages, that's all.

Okay, that's useful to know. So, can you quantify the total cost, then, of the £1,500 payment?

Yes. So, for the Welsh supplementary estimate, if I give three figures: the total is the £38,500, and, of that, £26,800 or 70 per cent was related to the £1,500. The remainder, the £11,700, was effectively split equally between that that took us from 4 per cent, which was our provision, to 4.5 per cent for all staff, and the remaining £5,800 would have been for the lower paid to have been given 6.5 per cent rather than what was 4.5 per cent. So, that was it.

Thank you. Before I go on to Peredur, clearly you recognise that you should have come back to the committees—not just ourselves, but to Scotland and Westminster—with the figures as soon as you had them. Can we therefore assume that—? You've given us your budget for next year, you've estimated an increase; if the same happens, we will be expecting to be informed. And prior to that—because I think Llyr highlighted the point—are you planning for what cuts could come if you have to increase it by a per cent, say, so you already, in advance, know the implications of a 1 per cent award if there is no supplementary budget?

I can come back on both those, I think, Chair. Yes, an absolute commitment to come back to, effectively, the three Speakers' committees, or Presiding Officers' committees, if the same circumstances occur. Perhaps more reassuring than just an assurance from me is that I understand that Rhydian and colleagues have already set out a quarterly rhythm of meetings with yourselves, and, within that, we would place the discussion at the point when it turns up next year. I don't quite know when the pay award will be next year, but we will come back at that stage. So, yes, the mechanism is there, the intention is there. I'm here until the end of March. When a permanent CEO is in post, we'll make absolutely sure that they're very clear about the lessons to be learnt from this last year.

I'm sorry, I've forgotten your second point now. 


The second part was: are you, therefore, preparing an analysis of what would need to be cut? 

Yes, well, in as far as we can. What's happening at the moment is that we're finishing off the main budget estimate, and David may want to come in on this, because he's more across the detail than I am, but we are building a larger contingency into that, having learnt some of the lessons of this last year. We've agreed the estimate with yourselves; we've yet to finally agree the rest of it with the Westminster Speaker's committee. But I think we're going in to next year with a much—. And I ought to pay tribute, actually, to David. I introduced David as director of finance; David is also an interim. He came in after this process reached the rather difficult position it reached this last year. We've a much strengthened finance team. I think our grip on our finances has improved enormously with David's team since the summer of last year. 

Diolch. Diolch yn fawr. Just following on a little bit from what David was saying there, and the Chair was saying there, the statement of principles for directly funded bodies says that you should continually seek to improve processes and accrue efficiencies before asking for supplementaries. Could you talk me through the process of what did you think about doing in drawing up this supplementary budget and were there efficiencies that you were able to find, or have you just passed on the figure directly into the supplementary? 

Again, I'll come in, and David, who was more involved with this than I was—. I didn't actually take up this role until most of this work was done. But, yes, we did pursue efficiencies, but, no, we didn't find anything like sufficient to offset the additional cost. The actions we did take—and there were some savings—were delaying the filling of posts; we also tightened the negotiation of some of our external contracts in order to make savings.

Standing slightly further back from it, it is clear that this organisation needed some things with more money spent on them, actually. I've just mentioned the financial team. We had too small a financial team for the purposes that we were facing. We also had an accounts system that was not working effectively. So we've, actually, had to invest more in that area, I'm afraid; similarly, on our procurement of systems, which goes back in part to the point I've just made about the finance system. We've also had to spend quite a lot of money, and this is the other item in the supplementary estimate, on our cyber security. So, there are quite a few of quite core operational systems where we found ourselves spending more money and adding to the supplementary estimate, rather than being able to find significant savings. But some were made, and they've been allowed for in the calculation of the final net figure.

Thank you very much. You mentioned the cyber security there, and I think there's an additional £15,400 towards the IT security due to a sophisticated cyber attack. Why was this committee not informed of the cyber attack at the time, and could the commission clarify how hostile actors were able to circumvent its security?

Again, I'll come in, though David was possibly more involved than I was. We had quite a tense period when the attack had occurred, before we went public with the fact that we'd been attacked, and that, I have to say, was on the advice of those who were investigating the attack. We worked very closely with the state cyber security committee, who are the experts in protecting the whole of the civil service from such things, and it was clear to us that we had to delay announcing the impact of the attack, including to our own staff, and that caused a little tension, when we finally did announce the position. Perhaps it's also worth me saying that my understanding is that we—well, I know—had got, from about a year earlier, a strategy for increasing our cyber security. In the event, it turned out to be too slow to make us less vulnerable to the attack that occurred. Part of what we've done is to bring forward that strategy, and also, I have to say, to invest in other things that came out of the advice from the cyber security committee. David, you'll be able to add more detail on the costs of that.


Just in terms of context, I think Rob has already covered it, but there was an incident discovered, and because of the nature and sensitivity and because of the very complicated and sophisticated approach used, there was a considerable amount of expectation on us not to say or speak openly of what had happened for some months. That did change, and as soon as it did change, we were much more open about it. I think, if the question is, 'Could we have, in confidence, shared with one or more people on the committee?', I think it's a distinct possibility that it would've perhaps been appropriate, but I think we were also working to other parties who had an interest in making sure that this didn't enter the public domain at the time. So, we were caught, really—. If you're asking what we actually did, there's a lot of sophisticated technology now applied to pick up more detection and more responses to that detection and we have advanced some of the more standard software to allow it to better identify potential attacks and thwart more attacks. So, there will never be a perfect solution, but there are some clear step changes that have been with the full support of the National Cyber Security Centre.

Thank you. Maybe Peredur wants to ask another question and then I'll come in after that one.

Diolch, Joyce. It's the timing element and then what investment has happened. My understanding is that the attack was in October 2022. What investment was required in 2022-23 and where did the money come from to cover that investment? It's more about the transparency of where the funding happened and what we've been paying for that we might not have known that we've been paying for.

Shall I come in? First of all, when it was identified, you then enter a period where you're looking for the expert advice to be given on what steps to be taken. I think there may have been specific changes over those last few months of 2022-23, but they were, in a way, a progression. It was also, as Rob has said, handled in a very sensitive way, which meant that many of those people on the periphery, including those making forecasts and those managing finances, were not privy to the fact that these contracts were going through, unless it was on a need-to-know basis, because of the sensitivity of the fact that we have a major investigation going on, not just within the organisation but outside the organisation, to identify what techniques were used and by whom. And in that sensitive environment, it tends not to be commonplace for people to be thinking, 'Oh, I must be adjusting forecasts', and so on. So, there was a little bit of creep coming through in terms of the financial effects, but it was handled in a sensitive way. I do know, from my conversations with the finance staff, that they were not aware of what had happened. They were only aware, often, of a new contract coming through, or a more expensive contract coming through. So, it was most definitely treated with the confidentiality it required within the organisation. So, that would explain it.

And finally from me, you don't seem to be aware what data was copied or downloaded. Is there a reason for that, or do you know more now than you did back then? And do we know if any voters or constituents in Wales were affected by that data breach at all?

I think we do now know. I'm not quite sure when we did, to be honest, but we do know what data was accessed through the attack. And on the second question, the answer is that there was no impact on anybody on the electoral registers in Wales or elsewhere, actually, to our relief, I have to say. That's the situation.

Sorry, but I was just thinking of one more thing. In terms of future running costs, then, are there knock-on effects into future years? Is there a heightened baseline, or—?

Again, David will have the detail. My understanding is that some of the additional expenditure was actually to buy new software, essentially, but there is some further running cost oversight provision that has gone into the estimate for 2024-25. David, is that right? I think that's where we are.


Nearly all of the items that are on the list that make up the £308,000, of which a proportion, 5 per cent, is charged to, or is sought through supplementary to Wales, will have a year-on-year effect, rather than a one-off. There is some that's emphasised more in the first year, for example some of the bringing specific IT staff up to a level of training, which will be less in future years, although, clearly, there's a bit of churn that goes on. But most of the costs are associated with new technologies to identify and thwart attempts to break into the systems, so that'll be a year-on-year cost, which is included in the main estimate already sought, by the way.

Thank you. It's just, really, an assurance that we have to give and you have to give to people in what looks like an election year. It becomes more essential that people feel that their data is being managed in the way that they would expect. You did mention, David, about training staff. I'm just wondering what sort of expertise you've brought in, as well, to help you, because you're not the only people subject to cyber attacks. All public bodies are subject to that, it's not unique to you. So, there's an awful lot of expertise out there, and I'm sure that people would appreciate knowing that you're working with those experts, not only in software, but also on the hands-on expertise, if you like, to identify, because this clearly slipped through all the systems that were there before. But I ask this particularly in an election year.

Shall I come in with a general comment on the risks of the election year, and then perhaps David can come back on the training point, if that's okay? I think we all share a sense that this is going to be a very tense year for running an election process, in part because of the risk of cyber attacks on data held, but also for all sorts of other issues affecting campaigning, as much as, actually, running elections themselves. I'm in a slightly odd position, because I speak as an ex-returning officer. I was always rather keen on using the best, most carefully applied IT to improve the efficiency of the election process, both registration and voting, although in current circumstances there is a counterargument that I begin to see more, which is that, actually, our current systems, which are not particularly sophisticated—the data is largely held locally and voting is largely done, but not exclusively, by pencils on pieces of paper, as you well know, and the counting is manual—make it very difficult to attack them using cyber skills. So, we have to take some comfort in the fact that we are antiquated in our approach to running elections, unlike some countries that are much further on. And some of those countries have run into trouble because their systems have been hacked in some sort of way. This is a long-winded way of saying I don't think there's a major vulnerability over the coming election periods because of the potential for people attacking the held data about those registered and those voting. I do think there are all sorts of other potential cyber problems, but that's perhaps a story for another day.

Elan, I know you have to go, and you had your hand up earlier.

Thank you, David. I just wanted to re-emphasise something that both Rob and David have said. We have been remiss in actually not asking for enough money in previous years. It's not so much running around and trying to find money now. We were not putting forward a budget that allowed for sufficient contingency for when things were going wrong, in particular within our finances and our IT services. It's something we've had to address as a board, and I think that we are rectifying it.

It's very, very difficult when you're looking for immediate savings, because basically, we do a few things, namely providing guidance and communicating with the public on things like ID, and investigations, and there’s very little there that you can cut or should be cutting, especially in an election year. So, again, I think we are learning the very substantial lesson that we should provide for better infrastructure within our systems. Definitely in terms of savings, especially in an election year, it’s very, very difficult to see what we can do.

We’re already doing small things. Next month, we were due to be in Scotland as a board, because we believe—as we did in Wales in November—in trying to go somewhere, rather than always meeting in London or always meeting on Zoom, and we’ve cancelled that, for example. We’re trying to shave off as much as we can, but in a year like this, I think we have to provide communication, we have to provide guidance, and we have to investigate. Sorry, I was just hoping to say that before I have to leave. Thank you, David.


On Joyce’s point, and to add to what Rob has said in terms of reassurance to the wider electoral community in relation to the cyber issue, we are having one-to-one meetings with the chief executive returning officers at the moment, with the Wales Electoral Coordination Board, and with the leads of the political parties in Wales in what is going to be a crucial year. And so those discussions around reassurance in terms of what we’re providing are taking place, definitely. So, just to give you the reassurance on that point.

Can I come in now with a question, then? Because I understand what Rob said regarding the sensitivity and the inability to put the estimates correctly to reflect this because of that sensitivity. We now know, it’s clear now, and we know there’s a figure in the estimate we have for this year. Are you confident that you have put in all the required needs to address the cyber attack agenda for this coming estimate, and that we wouldn’t necessarily be expecting a supplementary on cyber attack in particular in this coming year?

I think I can give you that assurance, though I’d express it this way, if I may, David: that we are confident that we’ve put into the budget provision for next year all the costs of the responses to the advice from the cyber security committee. I can give you no guarantee that we won’t have further cyber challenges that we are not anticipating and have not been advised over by the cyber security committee. So, you can never, I’m afraid, give a total guarantee that new challenges will not arise that require further interventions, but in terms of interventions that come from this past quite significant attack, yes, we have made provision for those in the main budget.

Whilst I understand the confidentiality and the sensitivity, I’m sure this committee would meet in confidence to be updated if there is any further cyber attack, so we are aware of what might come down the line in future. 

Okay. Do any other Members wish to ask questions at this point? Because we are focusing on the supplementary budget, which were the two figures that we’ve discussed this morning. I see none, so Elan, I think you’ll be able to go and catch your transportation without disruption—. Llyr has put his hand up. 

I thought you were still on the cyber security. Just an overarching reflection, maybe, if I may. We’ve spoken about you not informing the committee of a likely supplementary estimate as an oversight, maybe, on your part. You explained maybe how you found yourselves in a situation where salary and payment commitments were made without any security or assurances around potential additional resource for yourselves through a supplementary budget. You touched, Mr Vincent, on the fact that you spent money on improving your accountancy systems, which maybe wasn’t what it should have been. We’ve spoken about the need to fix the cyber security, because maybe that wasn’t as advanced or as strong as it should have been. I mean, these are some core operational matters that have been found wanting, aren't they? So, does that hint at a degree of discombobulation within the commission? Where are we in terms of your internal processes and systems? I just get the feeling that things aren't as efficient or as tight as they should be.


Well, in a sense, I have to accept that reflection of what you've heard. I find myself in a difficult position. It's clear that we did have significant weaknesses in some of our central teams, our central systems—Elan's already said as much. That was the case. Inferred is a question as to whether we are now back on top of that and whether we're in a more secure position. My view is 90 per cent yes. We are still completing the recruitment into permanent teams in our finance and procurement teams, and I don't think we'll be absolutely secure until we've done that. We're relying a bit too much on interims at the minute, but we will get there. We know what we need, provision is made for those posts and they're being filled. So, I think we should go into 2024-25 in a secure position. 

I'm sorry, I have to leave, David, but I just want to thank Rob for taking the reins and leading us into, hopefully, a more secure and efficient future, especially with the new chief executive coming in. Thank you for your care. Thanks.

And on that final point that Elan has highlighted, you've said, Rob, that you expect the new chief executive to be in post at the end of March, because you said you'd be here until the end of March.

I'm here until the end of March. I hope we will be able to announce, probably next week, I'm afraid, who the new permanent chief exec will be. I'm not involved in a detailed discussion about precisely when that person will start, but, if not April, it should not be much beyond April that that person will be taking over from me. And it's possible that it may be before that. In which case, I shall quietly fade away and somebody else will pick up the reins.

So, is there any indication as to what is the situation in your role?

My role has a fixed-term contract to the end of September. We will be looking through the summer for a permanent person in that role. There are a number of roles within finance we've identified as part of me coming in that need also to be filled, and, for me, the priority is to get the team up to the correct strength, with the appropriate controls, and awareness and capabilities there, and then hopefully I will leave the role in a good place for the permanent person.

So, you'll also be responsible for next year's estimate—the next estimate that comes to us, then.

Yes, the main estimate, definitely.

Okay. Well, we look forward to strengthening the estimates and making sure that the issues we saw this year are not repeated. I'm sure you've given us your assurances that that will be the situation, and we will keep a close eye on it. Rhydian, do you want to say anything before we go?

Very briefly. We will let you know as soon as we can on the new chief executive. And you'll have seen from the draft comms programme that we sent through to you in the paper that we will schedule a meeting with the new chief executive with this committee as soon as is practicable so that you can have a chat with them. 

Lovely. Thank you. And, Rob, I didn't take the opportunity at the beginning to welcome you to your temporary role. I'm sure it's quite a challenging one as well. 

Thank you, all, very much. Thank you for your forbearance.

Thank you very much.

3. Cynnig o dan Reol Sefydlog 17.42(vi) i benderfynu gwahardd y cyhoedd o weddill y cyfarfod
3. Motion under Standing Order 17.42(vi) to resolve to exclude the public from the remainder of the meeting


bod y pwyllgor yn penderfynu gwahardd y cyhoedd o weddill y cyfarfod yn unol â Rheol Sefydlog 17.42(vi).


that the committee resolves to exclude the public from the remainder of the meeting in accordance with Standing Order 17.42(vi).

Cynigiwyd y cynnig.

Motion moved.

I now suggest to Members that we move into private session, under Standing Order 17.42, for the remainder of the meeting. Are Members content to do so? May I ask that we now move into private session?

Derbyniwyd y cynnig.

Daeth rhan gyhoeddus y cyfarfod i ben am 12:34.

Motion agreed.

The public part of the meeting ended at 12:34.