Decision 193/2013 Mr H and the Risk Management Authority

Risk management tools

Reference No: 201300603
Decision Date: 4 September 2013


On 12 October 2012, Mr H asked the Risk Management Authority (the RMA) for information as to forms, guidance, training materials, evaluation materials and other documentation relating to the risk management of offenders. The RMA responded by providing some information to Mr H. It notified him that it did not hold other information, withholding the remaining information on the basis of substantial prejudice to the effective conduct of public affairs. Following an investigation, the Commissioner accepted the RMA's arguments.

Relevant statutory provisions

Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 2(1)(b) (Effect of exemptions) and 30(c) (Prejudice to effective conduct of public affairs)

The full text of each of the statutory provisions cited above is reproduced in the Appendix to this decision. The Appendix forms part of this decision.


1. On 12 October 2012, Mr H wrote to the RMA requesting the following information:

a) A copy of the LS/CMI form;

b) Information on how to complete an LS/CMI form;

c) LS/CMI training materials;

d) LS/CMI learning evaluation reports;

e) Copies of the presentations of the SAPROF (Structured Assessment of Protective Factors for violence) seminar;

f) A copy of the SAPROF tool and any instruction/training documentation;

g) Any documentation, communications etc., on the application of the tool to a OLR (Order for Lifelong Restriction) Risk Management Plan

h) Standards and Guidelines and Guidance documentation relating to the OLR post-release process.

2. The RMA responded on 9 November 2012 and provided Mr H with information which would fulfil part d) of his request. It notified Mr H that it did not hold information falling within the scope of part g) of the request. With regard to part h) of his request, the RMA informed Mr H that the Standards and Guidelines and Guidance would not be ready for publication until March/April 2013.

3. The RMA withheld the information it held falling within the scope of the remaining parts of Mr H's request under section 30(c) of FOISA, as it considered disclosure would (or would be likely to) prejudice substantially the effective conduct of public affairs.

4. On 3 December 2012, Mr H wrote to the RMA requesting a review of its decision. In particular, he questioned the RMA's application of the exemption in section 30(c) of FOISA to the information covered by parts a), b), c), e) and f) of his request.

5. Having received no response to his requirement for review, Mr H applied to the Commissioner for a decision on 28 January 2013. This led to an investigation, with the result that Mr H was provided with a response from the authority (upholding the authority's earlier application of section 30(c)) on 22 February 2013, enclosing the response they originally sent on 6 December 2012.

6. On 26 February 2013, Mr H wrote to the Commissioner's office again, stating that he was dissatisfied with the outcome of the RMA's review and applying to the Commissioner for a decision in terms of section 47(1) of FOISA.

7. The application was validated by establishing that Mr H made a request for information to a Scottish public authority and applied to the Commissioner for a decision only after asking the authority to review its response to that request.


8. On 14 March 2013, the RMA was notified in writing that an application had been received from Mr H and was asked to provide the Commissioner with any information withheld from him. The RMA responded with the information requested and the case was then allocated to an investigating officer.

9. The investigating officer subsequently contacted the RMA, giving it an opportunity to provide comments on the application (as required by section 49(3)(a) of FOISA) and asking it to respond to specific questions. In particular, the RMA was asked to justify its reliance on the exemption in section 30(c) of FOISA.

10. In addition to those on section 30(c), the RMA provided submissions on section 36(2) of FOISA.

Commissioner's analysis and findings

11. In coming to a decision on this matter, the Commissioner has considered all of the withheld information and the relevant submissions, or parts of submissions, made to her by both Mr H and the RMA. She is satisfied that no matter of relevance has been overlooked.

Section 30(c) - prejudice to the effective conduct of public affairs

12. Section 30(c) exempts information if its disclosure "would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs." "Otherwise" is used to differentiate this exemption from the other varieties of substantial prejudice covered in other parts of section 30, such as substantial inhibition to the free and frank provision of advice or exchange of views.

13. Section 30(c) applies where the harm caused, or likely to be caused, by disclosure is at the level of substantial prejudice. Although the term "substantial prejudice" is not defined in FOISA, the Commissioner looks for public authorities to demonstrate a real risk or likelihood that actual harm will occur in the near (certainly foreseeable) future, not simply that harm is a remote possibility.

14. The RMA was established under the Criminal Justice (Scotland) Act 2003 for the purpose of ensuring the effective assessment, management and minimisation of risk of serious harm posed by serious violent and sexual offenders. Statutory functions carried out by the RMA to fulfil that purpose include work on

policy and research

guidelines and standards

accreditation, education and training.

The RMA asserted that if the withheld information was disclosed in response to Mr H's request, its ability to fulfil these functions would be substantially prejudiced. This would impact on the actual assessment and management of risk (which it does not carry out itself).

15. The RMA noted that it would be difficult to justify withholding further risk assessment tools if those requested by Mr H were to be disclosed, so the impact of disclosure would be broader than just these tools.

Policy and Research

16. In relation to its policy and research role, the RMA explained that it held information regarding a number of risk assessment tools, including LS/CMI and SAPROF. It went on to explain that it produced guidance on these tools for assessors, including background information on each tool and information on their strengths and limitations.

17. The RMA argued that if it was required to release information on the LS/CMI and SAPROF tools, which would reveal to the general public how to complete and score risk tools, then it would be undermining effective practice and not promoting it. This, it submitted, was the opposite of what it was set up to do. It emphasised the importance of these tools being applied in a structured manner, by qualified individuals, if they were to be effective.

18. The RMA works in partnership with other bodies, such as the Scottish Prison Service. It submitted that disclosure would compromise these arrangements, as those other bodies (and tool authors) would have serious reservations about providing it with information if there was a real prospect that the RMA would have to release that information to the public. This, in turn, would lead to reluctance to provide such information. The RMA provided evidence in support of these claims.

Guidelines and Standards

19. Under the terms of the Criminal Justice (Scotland) Act 2003, the RMA has specific responsibility for administering and overseeing the standard setting, accreditation and approval processes which support the OLR. The RMA explained that this sentence pertains to individuals posing the highest levels of risk, that is convicted persons demonstrating that if at liberty they would seriously endanger the lives, physical or psychological well-being of members of the public. The sentence involves imprisonment or detention for an indeterminate period, and supervision in the community on release.

20. Where the High Court considers that an offender may meet the set "risk criteria" for an OLR, it will make a Risk Assessment Order. Under a Risk Assessment Order, an assessor (accredited by the RMA) is appointed to produce a Risk Assessment Report, which will assist the High Court in deciding whether to impose an OLR.

21. The RMA contended that its ability to set and publish standards and guidelines would be damaged if it were required to disclose information relating to risk tools such as LS/CMI and SAPROF. It underlined the importance of risk assessment tools in the structured, professional judgement approach which was central to effective assessment. Unrestricted knowledge of how to complete and score risk tools would compromise its standards: the accuracy of assessments would be undermined if such knowledge were available to offenders subject to assessment. The use of risk tools would become an unreliable factor, rendering compliance with its standards to be seriously flawed and leaving a significant gap in its ability to write standards or give guidance.

22. RMA accredited assessors, being compromised in their ability to undertake risk assessments effectively, would in turn (the RMA submitted) be compromised in their ability to report accurately to the High Court on whether an offender was a high, medium or low risk. It also submitted that inaccurate assessments would affect other bodies across the criminal justice system which used and relied on assessments, such as the Scottish Prison Service. There would be a loss of confidence in assessment tools, with the likelihood that their use would diminish and the system would thus be limited in its ability to conduct its business effectively.

Accreditation, Education and Training

23. The RMA argued that releasing the information it had gathered on risk tools such as LS/CMI and SAPROF would damage its ability to accredit persons or the manner in which they assessed risk. A fundamental element of these processes, it submitted, was the application of risk assessment tools.

24. The RMA also argued that disclosure would damage its ability to provide training. Tool authors and training providers it commissioned would, it submitted, have serious misgivings about working with the RMA if its training material had to be released to the public.

Submissions from Mr H

25. Mr H questioned whether the RMA had demonstrated a link between disclosure and harm, submitting that this harm required to be to its own business rather than that of other authorities operating within the criminal justice system (on whose interests he did not believe the RMA was in a position to comment). The Commissioner thinks it fair to note at this point (as the RMA has pointed out) that there is no reason in principle why the scope of the effective conduct of public affairs should be confined to the precise business of the authority claiming the section 30(c) exemption, or why that authority should be prevented from presenting arguments which apply to other authorities with which it shares a common interest.

26. More specifically, Mr H referred to the lectures given at the SAPROF conference, noting that these were mentioned in the RMA's annual report and therefore were not secret or confidential: the information was already in the public domain. Furthermore, he submitted that the SAPROF tool was not currently an approved risk assessment tool and so no concerns could currently exist regarding any use of it.

27. Mr H also referred to two documents produced by the RMA and relating to its Standards and Guidelines. He questioned why the RMA produced these documents if it believed that substantial prejudice would result to the risk assessment process if information were available.

28. In response to these more specific points from Mr H, the RMA explained that the seminar on SAPROF was not open to the public, but was an event held for criminal justice practitioners. As a public body, it was required to publish annual reports and accounts on its activities. It did not believe that just because it reported to the public that an event took place, or an activity was undertaken, all information associated with these events or activities should be made available to the public.

29. In relation to Mr H's assertion that SAPROF was not an approved risk management tool, the RMA explained that all risk assessment tools had strengths and limitations that an assessor should take into account when applying a tool as part of a holistic risk assessment process: assessors had to use their professional judgement. The RMA indicated that SAPROF was designed as a positive addition to other structured professional judgement risk assessment tools, creating a more balanced and efficient risk assessment for future violence.

30. Finally, the RMA submitted, the two Standards and Guidelines documents referred to by Mr H were just that - standards and guidelines. They were not training manuals on how to complete individual risk assessments and therefore had no relevance to consideration of Mr H's request.

Commissioner's conclusions

31. Having considered the submissions from both Mr H and the RMA, the Commissioner accepts the comments made by the RMA in relation to the points raised by Mr H.

32. It is apparent to the Commissioner that the assessment and management of risks presented by offenders are key public functions, carried out in the public interest. The oversight provided by the RMA is an important element of that process and the Commissioner acknowledges the importance of all of those involved in risk assessment having confidence in the tools used and the eventual results. Disclosure of the information requested by Mr H would, the Commissioner accepts, undermine the effectiveness of these tools, which would, in turn, undermine the role of the RMA in promoting effective practice and setting effective standards.

33. The Commissioner also accepts, for the reasons advanced by the RMA, that disclosure of this information would have a substantially prejudicial effect on the ability of the RMA to share information with partner agencies, obtain useful information from tool providers and provide training on the use of these tools in future. In all the circumstances of this particular case, therefore, the Commissioner is satisfied that disclosure of the requested information would substantially prejudice the effective conduct of public affairs, and so the exemption in section 30(c) applies.

Public interest test

34. Section 30(c) of FOISA is a qualified exemption, which means that its application is subject to the public interest test set out in section 2(1)(b) of FOISA. Therefore, having decided that the information is exempt under section 30(c), the Commissioner must go on to consider whether, in all the circumstances of the case, the public interest in disclosing the information is outweighed by the public interest in maintaining the exemption.

35. The RMA recognised the public interest in knowing that risk assessment tools were being applied correctly, diligently, accurately, consistently and without being open to manipulation, with a view to ensuring protection of the public. The authority did not believe disclosure of the withheld information would further this public interest, given the technical nature of the information and the skill and expertise required to apply it (or judge whether it was being applied) correctly. The RMA also noted that the use of risk assessments was already evaluated for quality assurance purposes, a process in which it was directly involved.

36. The RMA believed it was in the public interest for it to be able to carry out its functions effectively, in terms of being able to promote best practice, set standards and organise high quality training. It explained that it had legitimate reasons for holding information on risk assessment tools, as many of its functions related to their use.

37. As indicated above, the RMA submitted that disclosure of restricted information on how to use and score risk assessment tools would damage the ability of accredited assessors in undertaking their role. It emphasised the importance of these tools being applied professionally, in a structured manner, if they were to be effective. The RMA considered there to be no public interest in curtailing its ability to undertake its role in imparting information on how to use and score risk assessment tools.

38. Apart from general risk tool application, the RMA highlighted that particular functions in relation to the OLR sentence had major implications for public safety.

39. Mr H referred to the maxim within all reasonable justice systems that justice should not only be done but be seen to be done. He therefore considered the public interest to be served when disclosure enabled scrutiny of decision-making processes and ensured the accountability of those involved in these processes. Mr H believed this contributed to the fair and open prosecution of potential offenders.

40. Having considered the submissions from Mr H and the RMA, the Commissioner accepts that there is a general public interest in ensuring that public authorities are both transparent in their actions and accountable for them. She also recognises the public interest in ensuring that the justice system is fair, both in principle and in practice. While recognising the RMA's concerns as to the limitations of this approach, the Commissioner accepts that disclosure of the withheld information would go some way towards addressing these aspects of the public interest.

41. Having considered the public interest arguments advanced by the RMA, the Commissioner also accepts that there is no public interest in disclosing information which would have major implications for the protection of the public.

42. The Commissioner recognises that there is substantial public interest in ensuring that the RMA is able to perform its functions fully and effectively, particularly where these contribute substantially to the protection and maintenance of public safety. In addition, as indicated above, the Commissioner acknowledges the risks presented by disclosure to the effective functioning of the assessors, whose work is of clearly considerable significance in the public interest, and by extension to the criminal justice system more widely.

43. In all the circumstances of this case, the Commissioner has concluded that the public interest in disclosing the withheld information is outweighed by that in maintaining the exemption in section 30(c) of FOISA. Therefore, the Commissioner finds that the RMA was entitled to withhold the information in line with section 30(c) of FOISA.

44. As the Commissioner is satisfied that the information was properly withheld under section 30(c) of FOISA, she is not required to go on to consider the application of the exemption in section 36(2) of FOISA.

Other issues

45. In his application to the Commissioner, Mr H expressed dissatisfaction with the lack of signatures on the letters he had received from the RMA. Mr H commented that because of this he did not know who replied to his request for information and his requirement for review.

46. The RMA explained that as its work concerned the risk assessment and management of serious sexual and violent offenders, its practice was not to provide the identities of individual staff members to those offenders.

47. The Commissioner notes that while employees of the RMA have not signed the letters of response sent to Mr H, their job titles are present. This identifies to Mr H who responded to his request and requirement for review.

48. There is no strict requirement, or specific recommendation of good practice, on this point for the purposes of FOISA. Since the lack of any employee's name or signature has not hindered Mr H in exercising his rights under FOISA, and having considered the authority's submissions, the Commissioner does not find any failing on the part of the RMA in relation to this. As a matter of general good practice, the Commissioner would encourage the RMA to make it clear in responding to information requests not only that there is a right to a review, but also to where requests for review should be sent.


The Commissioner finds that the Risk Management Authority complied with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by Mr H.


Should either Mr H or the Risk Management Authority wish to appeal against this decision, there is an appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.

Rosemary Agnew
Scottish Information Commissioner
4 September 2013


Relevant statutory provisions

Freedom of Information (Scotland) Act 2002

1 General entitlement

(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.

(6) This section is subject to sections 2, 9, 12 and 14.

2 Effect of exemptions

(1) To information which is exempt information by virtue of any provision of Part 2, section 1 applies only to the extent that -

(b) in all the circumstances of the case, the public interest in disclosing the information is not outweighed by that in maintaining the exemption.

30 Prejudice to effective conduct of public affairs

Information is exempt information if its disclosure under this Act-

(c) would otherwise prejudice substantially, or be likely to prejudice substantially, the effective conduct of public affairs.

Link to PDF of Decision 193/2013 (102 KB)

Back to Top