The Information Commissioner has ordered Bristol City Council to disclose an internal audit report into Stepping Up, a Community Interest Company, after finding that the council's reliance on section 36 of the Freedom of Information Act was based on a qualified person's opinion that was too generic to be reasonable.
In a decision notice dated 20 May 2026 (IC-415528-V6Y5), the Commissioner found that neither limb of section 36(2)(b) was engaged and gave the council 30 calendar days to communicate the report to the complainant, redacting personal data (including the names and job titles of the key witnesses listed in the report) under section 40(2). Failure to comply may be certified to the High Court and dealt with as contempt of court under section 54.
The request, made in June 2025, sought a full copy of a report produced by the council's internal audit team and referred to in local press coverage. The Stepping Up programme had attracted sustained media and external auditor scrutiny: the complainant pointed to reporting that the council had failed to follow its own procurement rules over contracts worth £600,000, that the business concerned was part-owned by a former councillor, and that auditors had found no evidence of criminal activity by former deputy mayor Asher Craig. The report itself was dated 26 April 2023, more than two years before the request. Its key findings had already been published.
Section 36(2)(b) of FOIA exempts information if, in the reasonable opinion of a qualified person, disclosure would or would be likely to inhibit the free and frank provision of advice or the free and frank exchange of views for the purposes of deliberation. The council's qualified person, Tim O'Gara, its Director of Legal and Democratic Services, gave his opinion in June 2025 that internal audit reports rely on full and frank disclosure and the freedom to express opinions on sensitive matters, and that making audit reports public "would compromise that process of investigation and advice".
The Commissioner found that opinion generic. It referred to reports in general rather than the specific report at issue, and did not explain which parts of the report were sensitive or how disclosure of this particular document would cause inhibition two years after it was produced and when its key findings were already in the public domain. A reasonable opinion in 2025, the Commissioner said, would have focused on what additional harm would be likely to arise from disclosing the report given what was already known, rather than assuming confidentiality as if the report were entirely private and making no distinction between high-level findings already public and any genuinely sensitive internal material.
The council's fuller arguments emphasised the importance of confidentiality to internal audit processes, including assertions of a chilling effect on the candour and cooperation of interviewees, who had taken part voluntarily. The Commissioner noted that a generic or flawed opinion cannot be treated as reasonable merely because the authority later produces stronger arguments. In any event, the Commissioner considered that the later submissions failed to identify the particular features of the report or explain with any specificity what additional, real and substantive prejudice would flow from disclosure beyond the information already public.
In the absence of a clear, evidence-based and context-specific explanation of harm, the Commissioner was not satisfied that the opinion was one a reasonable person could hold, and found no causal link between disclosure and any real and substantial inhibition.
The complainant had argued that a partially redacted version protecting contributor identities would have been a more reasonable approach than blanket refusal, and the Commissioner agreed that protecting contributors was appropriate, holding that disclosure of the names of individuals would be unfair and that section 40(2) applied to that information.
The decision notice is available at https://ico.org.uk/media2/d2ojd3ju/ic-415528-v6y5.pdf
The council did not appeal the ICO's decision and published the report audit report here: Stepping Up CIC - Internal audit report
