Section 40: Audit functions

When disclosure would prejudice the exercise of a public authority's audit functions.

Audit functions#

Section 40 of FOISA protects information whose disclosure would substantially prejudice the ability of public bodies to carry out audits and value-for-money examinations. This is a narrow exemption that most requesters will never encounter. It exists mainly for the benefit of Audit Scotland and similar inspectorate bodies.

In plain terms#

The authority is saying: releasing this information would seriously damage our ability to audit other public bodies or examine whether they’re spending public money effectively.

You ask Audit Scotland for background working papers from a financial audit of a council. Audit Scotland refuses under section 40, arguing that disclosing the papers would make other councils less willing to cooperate openly with future audits.

The legal detail#

Section 40 exempts information whose disclosure would, or would be likely to, substantially prejudice the exercise of a Scottish public authority’s functions in relation to:

Section 40(a) - the audit of the accounts of other Scottish public authorities
Section 40(b) - the examination of the economy, efficiency, and effectiveness with which other authorities use their resources in discharging their functions

The word “substantially” sets a high bar. The authority must show real and demonstrable harm to its audit functions, not just a vague concern that disclosure might be unhelpful. The prejudice must be of real significance.

Absolute or qualified?#

Section 40 is qualified. The public interest test applies. Even where the authority can demonstrate substantial prejudice to its audit functions, it must weigh the public interest in disclosure against the interest in maintaining the exemption. See What can they refuse? for more on the public interest test.

How it’s used in practice#

This exemption is mainly relevant to bodies carrying out external audits under statute - principally Audit Scotland, the Auditor General for Scotland, and the Accounts Commission. It could also apply to other inspectorate bodies with statutory audit functions, such as HM Chief Inspector of Prisons for Scotland or HM Inspectors of Constabulary.

Section 40 does not cover internal audits. A public authority’s own internal audit team reviewing its own operations cannot rely on this exemption. The audit must be of “other” Scottish public authorities.

The exemption protects the audit function, not the audit results. Once an audit is complete and the report has been published, the case for withholding background papers and supporting data weakens significantly. The passage of time is relevant - the Commissioner has noted that the risk of prejudice to audit functions is likely to diminish once the findings have been made public.

At the time of writing, the Commissioner had not issued any decisions on section 40 under FOISA, which reflects how rarely it is used. Bodies being audited may also be able to claim the exemption, but only if disclosure of the information they hold would substantially prejudice the auditing body’s functions.

How to challenge it#

Check whether the audit has been completed and the report published. If so, argue that the risk of prejudice has passed and the working papers should now be disclosed.

Ask the authority to explain how disclosure would cause substantial prejudice. The authority should identify the specific harm to its ability to conduct audits, not rely on a general argument that transparency might discourage cooperation. Given that auditing bodies usually have statutory powers to compel participation, the argument that bodies would cooperate less willingly is not always persuasive.

See What to do if refused for the full process.

You can also use our interactive challenge tool for this exemption to work through these questions step by step and draft a review request.

Good to know: Section 40 generally cannot apply to information more than 15 years old. Section 40 is not one of the exemptions that can support a “neither confirm nor deny” response - if the authority refuses to say whether it holds audit information, it cannot rely on section 40 to do that. Before the final audit report is published, section 27 (information intended for future publication) might also apply - but section 27 only covers information that will be in the published report, not wider working papers.