Risk Management
Our Risk Management Framework aligns with Scottish Public Finance Manual (SPFM) and Scottish Government risk management guidance. The framework sets out the process for identifying and documenting risk, assigning ownership of risk, scoring risk, determining responses to risk and monitoring and reporting on progress in managing risk.
To achieve our strategic ambitions, outcomes and objectives it is essential that we understand, manage and communicate the full range of threats and opportunities facing our organisation.
We ensure risk is assessed and managed prior to taking action to mitigate it or to take opportunities resulting from it. Explicit reference to “risk appetite” - the agreed amount of risk we are willing to accept in pursuit of our objectives - allows us to adopt a common understanding across our organisation. It also provides a framework for the risk owner and managers to confidently make risk-based decisions.
During the year our Corporate Risk Register was presented to the Audit and Risk Committee (ARC) several times for review and to give assurance to our Board and Accountable Officer that risk is being effectively managed. A detailed review of the register was also taken during the year and was considered by the ARC at its annual strategy session. The risks inform Board strategy sessions and are regularly reported to the Board.
Key Risks
As of 31 March 2026, we have 12 risks on our Corporate Risk Register which are:
Risk 1 – Protecting the integrity of the tax system
Risk 2 – Legislative and policy change
Risk 3 – Delivery of new taxes
Risk 4 - Comms and stakeholder engagement
Risk 5 – Health, safety and wellbeing
Risk 6 – Organisational change
Risk 7 – Budgeting and finance
Risk 8 – Data optimisation
Risk 9 – Information and cyber security
Risk 10 – Digital systems performance and adaptability
Risk 11 – Replacement of the Scottish Electronic Tax System (SETS)
Risk 12 – Resilience
Each risk is discussed in the Performance Analysis section in accordance with the strategic outcome to which they most closely relate.
Values and Behaviours
Our staff are civil servants who adhere to the Civil Service Code. Our Induction programme outlines the expectations of staff. They are expected to carry out their duties with a commitment to the civil service core values of integrity, honesty, objectivity and impartiality. Staff must not misuse their official position to further their private interest or those of others or accept gifts, hospitality or other benefits from anyone which might reasonably be seen to compromise their personal judgement or integrity. All staff undertake annual mandatory training on counter fraud, bribery and corruption to remind them of their responsibilities in this area. We have introduced mandatory training on building better relationships which includes the following; power of kindness, bystander apathy and psychological safety. This training seeks to promote our values, boost our culture and eliminate and harassment, discrimination or bullying.
Records Management & GDPR
Freedom of Information (FoI) and Environmental Information Regulation (EIR) Requests
The current period has seen significant growth in the number of Freedom of Information enquiries received, with the numbers processed almost double that seen during the previous period. No EIR requests were received during the period.
Our statistics for the 2025–26 period were as follows:
| FOI and EIR Requests | 2025–26 | 2024–25 |
|---|---|---|
| Requests Received | 40 | 19 |
| Requests Withdrawn | 1 | 0 |
| Requests Answered Within Statutory Timescales | 36 | 18 |
Data Protection
Protecting information remains at the heart of our work, as it remains vital that taxpayers retain confidence in the tax system and us as a public body.
We manage, maintain and protect all information according to the requirements of relevant legislation, information policies and best practice. Our Information Governance structure prioritises and manages information risks. All of our staff complete annual data protection training, reporting mechanisms for incidents are clear and data protection issues are raised regularly at team meetings.
Our statistics for the 2025–26 period were as follows:
| 2025–26 | 2024–25 | ||
|---|---|---|---|
| Data Incidents | Reported in Period | 9 | 4 |
| Reported to ICO | 0 | 0 | |
| Data Losses | Reported in Period | 4 | 10 |
| Reported to ICO | 0 | 1 | |
| Total | 13 | 14 |
Data losses are where the information lost includes personal data and data incidents are where no personal information is involved. Any incident and loss we have is thoroughly investigated internally. They tend to be only of a minor nature which do not require reporting to the Information Commissioner’s Office (ICO). We are pleased to report that no incidents this year met the threshold which would have required us to report them to ICO.
Whistleblowing Report
Revenue Scotland is a ‘prescribed person’ under the Public Interest Disclosure Act 1998. This means that we are authorised to receive disclosures from workers about malpractice, wrongdoing or risks relating to the administration of the devolved taxes in Scotland. Prescribed persons provide a safe alternative for whistleblowers who cannot report concerns directly to their employers or where employer action has been insufficient.
The Act provides protection for employees who pass on information concerning wrongdoing in certain circumstances. The protection only applies where the person who makes the disclosure reasonably believes:
- that they are acting in the public interest, which means that protection is not normally given for personal grievances
- that the disclosure is about one of the following
- criminal offences (this includes financial improprieties, such as fraud)
- failure to comply with duties set out in law
- miscarriages of justice
- endangering someone’s health and safety
- damage to the environment
- covering up wrongdoing in any of the above categories.
The Prescribed Persons (Reports on Disclosures of Information) Regulations 2017 came into force on 1 April 2017. Prescribed persons are required to report annually on whistleblowing disclosures made to them.
We have a Whistleblowing policy and procedure in place to ensure issues can be raised. During the reporting periods 1 April 2025 to 31 March 2026 and 1 April 2024 to 31 March 2025 we received no whistleblowing disclosures.
No investigations were carried out within this reporting period.
No actions were required during this period.
We have updated our contact us page on our website with details of how to raise a whistleblowing concern or disclosure.
Sustainability
Under the Climate Change (Duties of Public Bodies: Reporting Requirements) (Scotland) Order 2015 (made under Section 46 of the Climate Change (Scotland) Act 2009) we are required to report annually on climate change duties compliance.
Our Climate Change reports can be accessed via the Sustainable Scotland Network website.
We are committed to supporting Scotland’s net zero ambitions by actively reducing our carbon footprint and improving the sustainability of our operations where possible.
We operate from a shared Scottish Government building and are limited in how we can make improvements on energy efficiencies in the office space.
However, we will continue to adopt sustainable practices, improve efficiency in our operations and remind staff of best energy practices whilst working remotely and within the office.
In the latest Climate Change emissions report published in November 2025, our 2024-25 total reported emissions amounted to 55.30 tCO2e, representing a 7.34% increase compared to the previous year’s total of 51.52 tCO2e as a result of an increased headcount and increase car usage for travel to the office. Figures for 2025-26 are due to be submitted to Sustainable Scotland Network by 30 November 2026.
Signed by:
Chief Executive Officer
9 October 2026