Home Decisions

Decision 250/2026

Decision 250/2026:  Specified risk assessments


Authority:  Scottish Borders Council
Case Ref:  202501340
 

Summary

The Applicant asked the Authority for two specified risk assessments.  The Authority withheld the requested information because it considered that disclosure would be prejudicial to the effective conduct of public affairs. 

The Commissioner investigated and found that the Authority was entitled to withhold some information, but that it had wrongly withheld other information.  He required the Authority to disclose the wrongly withheld information.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1), (2) and (6) (General entitlement); 2(1)(a) and (b) (Effect of exemptions); 30(b)(ii) and (c) (Prejudice to the effective conduct of public affairs); 47(1) and (2) (Application for decision by Commissioner).

Background

  1. On 8 April 2025, the Applicant made a request for information to the Authority.  She asked for the following documents:
    1. Risk Management Annual Report 2023/24 (including all appendices)
    2. Risk Management Policy and Strategy 2025-2027 (including appendices and the associated background papers - appropriate Risk Management files)
    3. Risk Assessment titled H&S Compliance (Code CMT008)
    4. Risk Assessment titled C&YP/Learners Placements (Deep Dive Underway) (Code CMT019)
  2. The Authority responded on 23 April 2025.  It disclosed information in response to requests (i) and (ii) but withheld the risk assessments sought in request (iii) and (iv) under section 30 of FOISA.  The Authority withheld this information on the grounds that the risk review process involved free and frank discussions with the relevant risk owner and captured sensitive information relating to the Authority's internal controls and mitigation actions.
  3. On 2 May 2025, the Applicant wrote to the Authority requesting a review of its decision. The Applicant stated that she was dissatisfied with the response because the Authority had failed to identify the specific subsection of section 30 of FOISA it was relying on, it had not provided sufficient reasoning for applying the exemption nor had it carried out an assessment of the public interest.
  4. The Authority notified the Applicant of the outcome of its review on 29 May 2025.  The Authority recognised the deficiencies in its initial response and explained that it was relying on section 30(b) of FOISA.  The Authority expanded on its reasons for applying the exemption and explained how the public interest test had been carried out.
  5. On 11 August 2025, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  The Applicant stated she was dissatisfied with the outcome of the Authority’s review because she considered that the Authority had failed to properly consider or justify its use of the exemption in withholding the risk assessments requested. She also considered that the public interest favoured disclosure of the risk assessments.

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation. 
  2. On 15 September 2025, the Authority was notified in writing that the Applicant had made a valid application.  The Authority was asked to send the Commissioner the information withheld from the Applicant. The Authority provided the information and the case was allocated to an investigating officer. 
  3. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions.  These related to the Authority’s reasons for withholding the risk assessments captured by requests (iii) and (iv).

Commissioner’s analysis and findings

  1. The Commissioner has considered all of the submissions made to him by the Applicant and the Authority.

Information captured by requests (iii) and (iv)

  1. The Authority explained that risk management was a continuous process.  

    Circumstances and business priorities could, and did, change, and as such risks (both threats and opportunities) and their internal controls and mitigation actions were regularly reviewed, in line with the business planning and performance management processes and business continuity arrangements, to ensure that the management of risks was aligned with corporate and service objectives.
  2. The documents captured by the request relate to the risk assessment CMT008 Health and safety compliance (request (iii)) and the risk assessment CMT019 Children and young people/learners placements (request (iv).  There are eleven documents comprising the information captured by request (iii) and nine documents captured by request (iv).

The Authority’s change of position

  1. During the investigation, the Authority changed its position and explained that in addition to section 30(b), it was also relying on section 30(c) of FOISA to withhold all of the information in the risk assessments.  It confirmed that the subsection of section 30(b) it was relying on was section 30(b)(ii). Furthermore, the Authority informed the Commissioner that it was applying section 38(1)(b) of FOISA to third party personal data contained within the risk assessments.
  2. The Applicant was notified of this change of position and was asked for her comments on the Authority’s new reliance on section 30(c) and 38(1)(b) of FOISA.  The Applicant provided her views over several emails.

Section 38(1)(b) - third party personal data

  1. Section 38(1)(b) of FOISA, read in conjunction with section 38(2A)(a) or (b), exempts information from disclosure if it is “personal data” (as defined in section 3(2) of the DPA 2018) and its disclosure would contravene one or more of the data protection principles set out in Article 5(1) of the UK GDPR or (where relevant) in the DPA 2018.
  2. The exemption in section 38(1)(b) of FOISA, applied on the basis set out in the preceding paragraph, is an absolute exemption.  This means that it is not subject to the public interest test contained in section 2(1)(b) of FOISA.
  3. To rely on this exemption, the Authority must show that the information withheld is personal data for the purposes of the DPA 2018 and that disclosure of the information into the public domain (which is the effect of disclosure under FOISA) would contravene one or more of the data protection principles to be found in Article 5(1) of the UK GDPR.

The Applicants comments

  1. The Applicant commented that she was content for section 38(1)(b) of FOISA to be applied where appropriate, provided the Commissioner was satisfied that only personal data had been redacted.

The Authority’s comments

  1. The Authority confirmed that it was relying on section 38(1)(b) to withhold personal data in the risk assessment documents, namely the names and initials of individual officers.

The Commissioner’s view

  1. The Commissioner has considered the content of the withheld information and he notes that the only information that the Authority has withheld under section 38(1)(b) of FOISA, is the names and initials of individuals. He is satisfied that this information is personal data.
  2. As the Applicant has not challenged the Authority’s reliance on section 38(1)(b) of FOSA, provided the Commissioner is satisfied that it comprises personal data, and as the Commissioner is satisfied that the Authority has only withheld personal data under section 38(1)(b) of FOISA, he will not consider this information any further in this decision.

Section 30(b)(ii) - substantial inhibition to free and frank exchange of views

  1. Section 30(b)(ii) of FOISA provides that information is exempt information if its disclosure would, or would be likely to, inhibit substantially the free and frank exchange of views for the purposes of deliberation.  This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
  2. In applying the exemption in section 30(b)(ii), the chief consideration is not whether the information constitutes opinion or views, but whether the disclosure of that information would, or would be likely to, inhibit substantially the free and frank exchange of views.  The inhibition must be substantial and therefore of real and demonstrable significance.
  3. Each request must be considered on a case-by-case basis, taking into account the effect (or likely effect) of disclosure of that particular information on the future exchange of views.  The content of the withheld information will require to be considered, taking into account factors such as its nature, subject matter, manner of expression, and also whether the timing of disclosure would have any bearing.
  4. As with other exemptions involving a similar test, the Commissioner expects authorities to demonstrate a real risk or likelihood that actual inhibition will occur at some time in the near (certainly the foreseeable) future, not simply a remote or hypothetical possibility.

The Applicant’s comments

  1. The Applicant was dissatisfied that the exemption being applied by the Authority had not been properly specified in the review and lacked sufficient reasoning without demonstrating real and substantial likelihood of harm specific to the information being withheld.  She considered the arguments presented by the Authority were hypothetical.  In her view, this was an indication that the exemption had been applied without proper consideration.

The Authority’s comments

  1. The Authority explained, in detail, the role of the Corporate Risk Officer, stating that the key purpose of the role was to challenge, monitor and support Corporate and Senior Management in their delivery of the continuous and systematic management of risks (identification, analysis, evaluation, control, and monitoring) in accordance with the Authority’s risk management policy and strategy.  Integral to this process was constructive challenge and influencing risk owners.
  2. The Authority commented that risk discussions by their very nature involved robust, open, and frank discussions and exchanges of views.  It argued that if staff knew that risk registers could be made public, this would significantly prejudice the risk management process by creating an atmosphere which was far less open than it currently was.  This could lead to the sanitisation or downplaying of risks, underreporting of emerging threats, loss of early warning signs and ineffective risk mitigation.
  3. The Authority submitted that the overall effect of this would significantly undermine the purpose of the corporate risk registers and their development.  
    The Authority considered that the effectiveness and value of the corporate risk registers relied entirely on the open and honest provision of advice alongside free and open discussion and the sharing of opinions between the risk professionals and the risk owners.
  4. The Authority argued that if officers believed that their views, opinions or advice might be disclosed publicly, they might withhold honest opinions, avoid raising controversial or dissenting perspectives or soften criticism or concerns which would, in turn, reduce the quality and effectiveness of internal risk management deliberations and lead to weaker decision-making.  The Authority argued that, if this occurred, it would inhibit its ability to operate responsively and transparently internally and so undermine its operational effectiveness as a local authority.
  5. The Authority gave examples of the consequences it anticipated if the information requested was disclosed.

The Commissioner’s view

  1. The Commissioner recognises that risk registers are important and valuable tools that enable organisations to identify potential risks and to evaluate their approach to those risks, highlighting areas where further action may be required to mitigate identified risks.
  2. Such analysis contributes significantly to the effective conduct of public affairs, by making public authorities better able to avoid situations which would disrupt or harm their operations.  The Commissioner acknowledges that, for risk registers to be effective, they must be based on an honest assessment of the challenges faced by an organisation and how they can be overcome.
  3. However, the Commissioner is not persuaded by the Authority’s arguments that professional officers involved in risk management would be deterred from exchanging views or opinions on risks or raising issues to any significant degree if information contained in the risk assessments being discussed was disclosed.  Indeed, the Authority noted in its submissions that its officers (as well as having their own professional integrity) are duty bound by the roles and responsibilities set out in the Authority’s Risk Management Policy.
  4. In all the circumstances of this case, the Commissioner is not persuaded that disclosure of the specified risk assessments would, or would be likely to, inhibit substantially the free and frank exchange of views to any significant degree.  Given this, he is not satisfied that section 30(b)(ii) can be engaged in this case.
  5. As the Commissioner does not agree that the exemption in section 30(b)(ii) of FOISA was engaged, he has not gone on to consider the public interest.
  6. The Commissioner will now go on to examine the Authority’s application of section 30(c) of FOISA to the same information.

Section 30(c) - Prejudice to effective conduct of public affairs

  1. Section 30(c) of FOISA exempts information if its disclosure "would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs."  The use of the word "otherwise" distinguishes the harm required from that envisaged by the exemptions in sections 30(a) and (b).  This is a broad exemption, and the Commissioner expects any public authority citing it to show what specific harm would (or would be likely to) be caused to the conduct of public affairs by disclosure of the information, and how that harm would be expected to follow from disclosure.  This exemption is subject to the public interest test in section 2(1)(b) of FOISA.
  2. In order for the exemption in section 30(c) to apply, the prejudice caused by disclosure must be substantial and therefore of real and demonstrable significance.  The Commissioner expects authorities to demonstrate a real risk or likelihood of substantial prejudice at some time in the near (certainly foreseeable) future, not simply that such prejudice is a remote or hypothetical possibility.  Each request should be considered on a case-by-case basis, taking into consideration the content of the information and all other relevant circumstances.

The Applicant’s comments

  1. The Applicant argued that the Authority’s reasoning for applying exemptions remained generic and unsubstantiated. She noted that the Authority described the documents as “highly personal and sensitive”, citing potential misuse by “bad actors” or causing “unnecessary fear and alarm” if disclosed, without linking these claims to the specific documents or providing evidence of actual harm.
  2. The Applicant acknowledged the Authority’s concerns about misinterpretation of the information if it was placed in the public domain.  However, she disagreed that it was for the Authority to determine, in advance, that the public was incapable of understanding the information and therefore should be denied access to it.  She cited previous decisions 214/2014, 065/2005 and 193/2013 in support of her view and reiterated her concern that the Authority had provided no evidence that disclosure of the risk assessments would cause substantial prejudice.
  3. The Applicant considered that the Authority’s retrospective reliance on section 30(c) of FOISA, and the generic reasoning given undermined transparency, public confidence, and accountability.

The Authority’s comments

  1. The Authority accepted that some of the information within the risk assessments appeared to be factual in nature or similar to other information already in the public domain.  However, it considered that when taken as a whole, these iterative, agile risk documents represented a structured and strategic internal ongoing assessment of internal risks, which incorporated evaluations of potential impact, likelihood, internal controls, mitigation planning and prioritisation.  The Authority considered that disclosure of such information would therefore reveal its internal judgements, basis of strategic thinking and level of concern regarding identified specific risks – regardless of whether elements of those risks were already in the public domain or whether some could already be “obvious risks” to someone who was perhaps an informed person or observer.
  2. The Authority also accepted that some of the information contained within the corporate risk documents might appear to be of a high level administrative nature, but it argued that disclosure of information of this nature could reveal the Authority’s strategic priorities or concerns and would lay bare its weaknesses, which would then be open to substantial prejudice or damage by those with malicious intent who would wish to exploit its vulnerabilities.  The Authority argued that this would be a significant and real, anticipated and demonstrable harm for the organisation.
  3. The Authority argued that it could not underplay the above arguments.  While individual entries might seem relatively innocuous by themselves, corporate risk registers provided an overall comprehensive picture of the Authority’s risk landscape and, therefore, indubitably its resilience.  The Authority submitted that its overall view was that the information captured by the request was inherently sensitive due to the detailed nature and discussion of specific risks.  It argued that the contents could be misinterpreted or misunderstood if taken out of its intended internal governance context.  The Authority took the view that that documents of this nature should be safeguarded from disclosure in their entirety.

The Commissioner’s view

  1. The Commissioner has considered the content of the risk assessments being withheld by the Authority in detail.  As stated earlier, the Commissioner recognises the importance of risk assessment and risk registers in the safe operation of organisations.  He accepts that a private space is necessary to discuss and debate risks and risk minimisation.
  2. The Commissioner considers that a lot of the content in the risk assessment, other than that in the Latest Note and Linked Action boxes, is indeed factual in nature or administrative. The Commissioner is not satisfied that this particular information would, in any significant way, give rise to harm of the type anticipated by the Authority.
  3. He is not satisfied that the Authority has demonstrated why disclosure of all of the information contained in the specified risk assessments would, or would be likely to, prejudice substantially the effective conduct of public affairs (i.e. why it would be capable of disrupting the effective operation of the Authority).  On the contrary, the Commissioner considers that disclosure of the factual and administrative information contained in the risk assessments would demonstrate to the wider public that the Authority takes its obligations seriously in relation to the identification of risks and that actions are being taken by the Authority to minimise those risks.
  4. In the circumstances, having carefully reviewed the Authority’s submissions (and while acknowledging that not all of the decisions cited by the Applicant are of direct relevance), the Commissioner does not consider that disclosure of the factual and administrative information in the risk assessments would, or would be likely to, substantially prejudice the Authority’s ability to identify, evaluate and manage risks.  He finds that the exemption cannot be upheld in relation to this type of information, and he requires the Authority to disclose the information to the Applicant.
  5. However, the Commissioner does accept that disclosure of some of the withheld information would, or would be likely to, substantially prejudice the Authority’s risk management processes.
  6. The Commissioner acknowledges that, for risk registers to be effective, they must be based on an honest assessment of the challenges faced by an organisation and how they can be overcome. 
  7. The Commissioner has considered the information contained in the Latest Note and Linked Action boxes (and some small areas of discussion elsewhere in the documents) in which regular review of the assessments is discussed.  He is satisfied that the Authority is entitled to a safe space for discussion, debate and the finalising of views.
    In his view, any disclosure which had, or would have been likely to have, the effect of undermining the effective operation of the Authority (including the consideration of risks) would also be likely to prejudice substantially the effective conduct of public affairs for the purposes of the exemption in section 30(c) of FOISA.
  8. Given this, the Commissioner is satisfied that section 30(c) of FOISA is engaged for this particular information and he will go on to consider the public interest test in section 2(1)(b) of FOISA.

The public interest test - section 30(c)

  1. The public interest is not defined in FOISA but has been described in previous decisions as "something which is of serious concern and benefit to the public", not merely something of individual interest.  It has also been held that the public interest does not mean "of interest to the public" but "in the interests of the public", i.e. disclosure must serve the interests of the public.

The Applicant's comments on the public interest

  1. The Applicant noted that the subject of her request concerned access to specified internal risk assessments undertaken by the Authority.  She commented that the content of external risk assessments, previously available to the public online, prompted her request for the internal council risk assessments.  She explained that when reviewing the external risk assessments, a group of parents noticed a serious flaw in one school’s risk assessment and that this flaw was replicated in external assessments for other schools.  In the parents’ view, the level of risk attributed by the Authority had been significantly underestimated.
  2. The Applicant commented that the Authority had since removed the publicly available external risk assessments from its website.  The Applicant explained that she considered the withdrawal of the external risk assessments, in their entirety, to be disproportionate and indicative of poor governance.  Given this, she considered the removal of the external risk assessments to be intrinsically linked to the refusal to disclose, wholly or partially, the internal risk assessments specified in her request.
  3. The Applicant explained that she sought disclosure of the requested information as part of a broader effort to understand how the Authority assessed and managed safeguarding risks within the region, particularly in relation to violence in schools.  She noted that the prevalence of violence in schools affecting both children and staff was well-documented nationally and reported in the Scottish Government’s research report of Behaviour in Scottish Schools.
  4. The Applicant also referred to responses from the Authority’s staff to the EIS Teachers’ Union survey in 2023,and to the wider national survey carried out by the same union, which revealed serious risks to staff and children from violent behaviour in schools.  She submitted that the national trend heightened the public interest in understanding how risk was being assessed locally, and whether appropriate measures were in place to protect children and staff.  For this reason, she considered there was a clear and pressing public interest in disclosure.
  5. The Applicant argued that the Authority’s own Corporate Risk Register publicly identified major risks within the Authority’s education department, including overspend and reliance on high-cost external placements for looked-after children, and she noted that the Authority had adopted a strategy which had the intention of returning vulnerable young people to local provision.  However, she also noted that, simultaneously, specialist local provision for vulnerable children had been closed, at times contrary to the outcomes of public consultations.  It was her view that disclosure would enable public scrutiny of whether such decisions were justified, evidence-based, and aligned with the Authority’s safeguarding duties.  Given the scale of these risks and the impact on children, she argued that transparency in how the Authority assessed and managed risks was firmly in the public interest.
  6. The Applicant explained that she had concerns that there were significant gaps and inconsistencies in the Authority’s safeguarding policies and practices and she considered that disclosure was necessary to deepen understanding of how risks were identified, addressed and monitored.
  7. The Applicant considered that, at a local level, risk assessments had been found not to meet professional standards in that serious risks to children were left unidentified and parents were denied any information on the safeguarding measures in place to protect their children.  She noted that the Authority’s risk register identified that both of the requested risk assessments that were the subject of her request were at high risk of failing and she argued that where risk controls were known to be at risk of failure, public scrutiny was essential to ensure corrective action and accountability.
  8. In terms of inclusion, the Applicant considered it a matter of public interest to understand whether the needs of children with complex behaviours were being met and whether other children sharing their learning environments were being exposed to unmanaged or unacceptable risks.  The Applicant considered that disclosure of the requested risk assessments may assist in understanding how these responsibilities were being balanced in practice.
  9. It was the Applicant’s view that there was no realistic benefit in withholding the information she had requested.  She submitted that the risks were already publicly known.  For this reason, the Applicant argued that disclosure of the information would promote trust, improve risk management, and demonstrate that the Authority was addressing significant safety concerns.
  10. The Applicant commented that fully withholding these documents was not proportionate.  She argued that sensitive personal data could be redacted and the procedural and strategic information in these documents could be released without compromising safety.  She considered that this would support informed public debate on safeguarding and operational safety.

The Authority’s comments on the public interest

  1. The Authority recognised that there was a substantial public interest in transparency and in public scrutiny of risk issues such as those covered by the agile and iterative risk assessment documents, including areas of policy decision making and operational decisions and strategy.  It further recognised that making information about its risk management processes available, wherever possible, might help to reassure members of the community.
  2. The Authority also recognised that there was a public interest in reassuring the public in terms of how the risk decision making process was conducted.
  3. The Authority acknowledged the Applicant’s views on partial disclosure.  However, the Authority argued that a partial disclosure which would satisfy the Applicant’s request had already been made in the publication of the Authority’s annual report and accounts which (on page 30-32) contained information on the risk management practices in place and a summary of the Corporate Risk Register (including a summary of the requested risk assessments, CMT008 and CMT019).
  4. The Authority noted the research by trade unions, mentioned by the Applicant in her application to the Commissioner, which discussed significant risks to staff and children arising from violent behaviour in schools within the Authority.  The Authority commented that the Applicant had not previously indicated an intention to seek documentation concerning risk registers for schools which, in any event, were not covered by the risk assessments that had been requested.
  5. It was the Authority’s view that documents of this nature should be safeguarded from disclosure in their entirety because, despite appearing generic, administrative or benign, disclosure could expose strategic or operational weaknesses and organisational security risks.
  6. The Authority argued that full disclosure of the risk assessments might inadvertently assist those with harmful intentions in compromising the resources the corporate risk register aimed to protect, by identifying risks and establishing mitigation measures, including internal controls and scoring systems designed to reduce those risks.
  7. For this reason, the Authority submitted that the effective conduct of its business would be substantially prejudiced by disclosure of the risk assessments and that this would not be in the public interest.

The Commissioner's view on the public interest

  1. The Commissioner recognises the general public interest in transparency and accountability, particularly where this might contribute to understanding how the Authority identifies and manages risks.
  2. He accepts that disclosing the information would make it clear which risks are the biggest risks to the Authority’s ability to execute its functions and would demonstrate the internal dialogue within the Authority in relation to how it might control those risks.  However, he considers that disclosure of the information that was wrongly withheld (in addition to the information already disclosed by the Authority) would go some way towards satisfying that public interest.
  3. The Commissioner has already accepted that disclosure of the some of the withheld information (Latest Note and Linked Action boxes and some small areas of discussion elsewhere in the documents) would or would be likely to cause substantial prejudice to the effective conduct of public affairs in this case.  He does not accept that disclosure of this information, which he considers would compromise the ability of the Authority to identify, evaluate, manage and record risks, would be in the public interest.
  4. The Commissioner accepts that disclosure of the detailed discussion contained in these elements of the risk assessments could enable bad actors to identify particular risks with a view to exploiting perceived weaknesses of the Authority.  
    If this occurred, the Commissioner considers that it could negatively impact on the Authority’s ability to carry out its statutory duties and that would not be in the public interest.
  5. Given this, the Commissioner is content that the balance of the public interest lies in permitting the Authority a private space to carry out its deliberations and discussion of its assessment of risks.  He accepts that greater weight should be attached to the arguments which would favour withholding the information in the public interest.  Having reached this conclusion, the Commissioner finds that the public interest in disclosing the remaining information is outweighed by that in maintaining the exemption in section 30(c) of FOISA.  He therefore finds that Authority was entitled to withhold the information in question under that exemption.
  6. The Commissioner will provide the Authority with a marked-up version of the risk assessments, showing the information to which the exemption in section 30(c) of FOISA was wrongly applied and which should now be disclosed.

Decision 

The Commissioner finds that the Authority partially complied with Part 1 of the Freedom of Information (Scotland) Act 2002 in responding to the information request made by the Applicant. 

The Commissioner finds that the Authority was not entitled to withhold some of the information requested by the Applicant under section 30(b)(ii) and 30(c) of FOISA.

However, he finds that the Authority was entitled to withhold some of the information in the risk assessments under section 30(c) of FOISA.

The Commissioner requires the Authority to provide the Applicant with the information that was wrongly withheld by 16 November 2026.

To aid compliance with his decision, the Commissioner will provide the Authority with marked up copies of the risk assessments showing the information which should be disclosed.

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

 

 

Euan McCulloch 

Head of Enforcement 

 

1 October 2026

  1. ^

  2. ^

  3. ^

  4. ^

  5. ^

  6. ^

  7. ^