We consider that additional publicity around the NFI could help to maximise its deterrent effect and therefore further reduce the cost of fraud to the public purse. We call on the Scottish Government and Audit Scotland to work with participating bodies to consider how best to raise public awareness of the NFI and how its successful outcomes could best be publicised. This should involve a review of current practice and consideration of a more proactive and comprehensive advertising strategy. We stress that this work should be proportionate as we do not wish to focus unfairly on particular groups of people.
We believe that public bodies, in publicising the outcomes of the NFI, could also use this opportunity to report on any other successful anti-fraud measures. This would help to reassure the public that credible allegations of fraud are taken seriously.
We were disappointed to hear that work is still required to ensure the effective follow up of matches. The Scottish Government should consider extending Audit Scotland’s powers to enable it to place specific requirements on mandatory bodies where it appears they have been ineffective in investigating matches and therefore potentially allowing existing fraud or error to continue. Again, it is important that any such power be used proportionately.
It is important to the continued success of the NFI that local authorities have access to all the data they require and we heard a clear case that access to HMRC data would help. The Scottish Government should therefore determine whether a legal remedy is required on this issue and, if so, make representations to the Cabinet Office.
In general, we agree that any measures to increase the effectiveness of the NFI should be encouraged. We therefore call on the Scottish Government to consider whether there is evidence to show that any approaches adopted elsewhere in the UK have been successful and, if so, to revise Scottish legislation accordingly.
We call on the Scottish Government to clarify this issue (the legal position on accessing data from the electoral roll).
We believe all public bodies and private organisations in receipt of public money should participate in the NFI, where this would deliver clear benefits to the public purse.
Should the Scottish Government consider that further legislative change is not required to widen the scope of the NFI, we invite Audit Scotland to consider whether it could take further steps to encourage relevant organisations to participate voluntarily.
We also invite Audit Scotland to consider whether, in reporting on future NFI results, it could provide further information on the overall cost-benefit ratio to the public sector. Further, where there has been a significant drop in fraud associated with a particular programme, we would welcome an assurance that this is due to more effective anti-fraud measures, rather than, for example, public bodies being unable to investigate fully.
We believe it is important to extend the NFI’s scope where this would clearly help to tackle fraud in any spending areas not currently covered. We also ask the Scottish Government to confirm that, where relevant, it takes the NFI into account when considering setting up new spending programmes. Given the scale of the new social security powers, we also seek confirmation of how much it will cost to align these new powers with the NFI.
We believe it is important to tackle those who repeatedly commit fraud in order to provide reassurance that systems are effective and that public money is not being wasted. We note the Cabinet Office is considering how to address the issue and we expect the Scottish Government to work with the Cabinet Office and Audit Scotland on this as a matter of urgency. We request an update on how the problem is being tackled.
We ask the Scottish Government, working with Audit Scotland, to provide an estimate of how much could potentially be saved by AppCheck, and to confirm how much its roll out in Scotland would cost and how it would be funded.
This is our first post-legislative scrutiny inquiry and we were pleased to hear the general consensus, with which we concur, is that the NFI is effective at protecting public money from fraud and error. We thank all those who provided suggestions as to how it could be made even more effective and look forward to receiving the Scottish Government’s response.
We call on the Scottish Government to confirm whether it is clearly able to distinguish the NFI’s success from other anti-fraud measures, and for how long the NFI can usefully continue as a stand-alone measure.
At our meeting on 1 December 2016 we agreed to consider the legislation underpinning the National Fraud Initiative (NFI) as our first ever post-legislative scrutiny inquiry. 1 Specifically, we agreed to examine Section 97 of the Criminal Justice and Licensing (Scotland) Act 2010 (the 2010 Act), which put the NFI on a statutory footing.2
On 1 February 2017 we issued a call for written submissions, seeking responses to three key questions:3
What have been the benefits, financial and otherwise, of putting the NFI on a statutory footing?
Could the legislation be strengthened in any way?
Should participation in the NFI be improved? Are there any bodies who do not participate in the NFI who should do so?
The call for evidence ran until 31 March 2017 and 25 responses4 were received. We also took oral evidence, from stakeholders on 1 June 20175 and from the Cabinet Secretary for Finance and the Constitution (the Cabinet Secretary) on 15 June 2017.6
The NFI is an exercise carried out every two years across the UK to help those public bodies subject to audit to minimise fraud and error. It also helps auditors to assess the arrangements that public bodies have put in place to deal with error and fraud.
According to Audit Scotland—
The NFI works by using data matching to compare a range of information held on each of the bodies’ systems to identify potential inconsistencies or circumstances that could indicate fraud or error, these are called ‘matches’. A match does not automatically mean that there is a fraud or error and investigations are required to enable the correct conclusion to be drawn for each match. Bodies investigate these matches and record the outcomes, on a secure web application, based on their investigations
Audit Scotland. (2016, June). The National Fraud Initiative in Scotland (paragraph 9). Retrieved from http://www.audit-scotland.gov.uk/uploads/docs/report/2016/nr_160630_national_fraud_initiative.pdf
The deadline for bodies to upload data to the secure NFI website is the beginning of October for each exercise. Matches are processed by Audit Scotland between then and the following January, with matches returned to the bodies for investigation between January to May.
The NFI compares sets of data such as the payroll or benefits records of one body against other records held by the same or a different body to see how closely they match. For example:
matching council tax records against the latest electoral register can help identify where a single person-discounted council tax rate has been applied where two adults are recorded living in the property.
comparing the records of bodies paying public sector pensions against deceased persons’ records to ensure the pension is not continuing to be paid into the deceased person’s bank account either by error or fraudulent activity.
The NFI has been operating in England since 1996, in conjunction with the then Audit Commission and the Cabinet Office. The Cabinet Office now oversees the NFI across the UK and is responsible for the effectiveness of the data matching processes. The NFI has been introduced in Scotland in stages by Audit Scotland since 2000.
The 2010 Act provided a statutory basis for Audit Scotland to conduct data matching exercises. It also provided for clearer powers, created a unified system across the public sector and facilitated cross-border data matching. Further information on how Audit Scotland carries out its data matching work can be found in its Code of data matching practice 2010.1
Audit Scotland may require all audited bodies in Scotland, and other specified persons, to provide data for data matching exercises. Other relevant bodies may participate voluntarily in the NFI.
The NFI is linked to the statutory audit of participating bodies and the results are reported every two years by Audit Scotland. The first full NFI exercise was undertaken in 2004/5 and, in June 2016, Audit Scotland published its latest report covering 2014/15.1 We considered this report in November 2016 and noted some very encouraging resultsi. However, the report also highlighted some deterioration in quality compared with the last exercise and made a number of recommendations as to how participating organisations could work more efficiently. This persuaded us to consider the underpinning legislation in more detail and to determine whether any further improvements could be made to the NFI.
There was a general consensus in the evidence we received about the benefits of putting the NFI on a statutory footing, for example—
Increased participation: participation has been increased; this in turn has led to an increase in the number of data sets for comparison to produce matches for investigation. Overall it was felt this produced better results and made the exercise more successful and worthwhile.
Data protection: participants have confidence data protection and the sharing of personal information have been fully considered in the framing of the legislation.
Ensuring robust internal processes: wider participation and an increased pool of data means internal control measures are tested and results either provide assurance they are working or enable corrective action to be taken where it is found they are not.
Deterrent to fraud: a statutory NFI helps send a clear message to everyone that the public sector in Scotland will not tolerate fraud.
Having set out the background to the NFI, the rest of this report considers possible improvements (statutory and non-statutory) that could deliver even greater benefits. Overall, we welcome the Cabinet Secretary’s willingness to work with Audit Scotland and the Cabinet Office to explore and take forward any recommendations we make to help improve the NFI. We believe that any changes made to the scope or coverage of the NFI should be proportionate, with the possible benefits being carefully balanced against the increased work involved. We heard from some stakeholders that the amount of fraud detected by the NFI is diminishing but we agree with the view that without the NFI we may be in a worse position in relation to fraud than we are now.1
As noted, a key benefit of the NFI is that it acts as a deterrent to committing fraud, although the value of this can be hard to quantify. Some stakeholders considered that more could be done to improve the public’s awareness of the NFI and therefore increase its potential deterrent effect.
In oral evidence, some councils explained the varied steps they take to publicise their role in the NFI. For example, some local authorities share the outcome of the exercise only with their own internal committees, while others include information in public documents or in tenant newsletters. While we did not investigate such measures in detail, we are concerned that best practice may not always be shared across the country.
Audit Scotland is responsible for the NFI in Scotland and, as part of its work, reports on each NFI and highlights the outcomes to the media. The Cabinet Secretary confirmed that raising awareness of the NFI is a matter for each organisation to determine. However, he agreed to consider any recommendations made by us to help raise public awareness.
We consider that additional publicity around the NFI could help to maximise its deterrent effect and therefore further reduce the cost of fraud to the public purse. We call on the Scottish Government and Audit Scotland to work with participating bodies to consider how best to raise public awareness of the NFI and how its successful outcomes could best be publicised. This should involve a review of current practice and consideration of a more proactive and comprehensive advertising strategy. We stress that this work should be proportionate as we do not wish to focus unfairly on particular groups of people.
On a related point we heard how some local authorities, while considering NFI matches, may also undertake other inquiry work such as investigating reports of fraud made by members of the public. Due to data protection requirements, councils may not be able to provide an update on an investigation to the person making the report. This may give the impression that no action is being taken and dissuade members of the public from reporting suspected fraud.
We believe that public bodies, in publicising the outcomes of the NFI, could also use this opportunity to report on any other successful anti-fraud measures. This would help to reassure the public that credible allegations of fraud are taken seriously.
We heard in oral evidence from local authorities that when NFI matches arrive they are risk assessed and prioritised. Often, many of the matches can be dispensed with quickly, for example, an individual who legitimately appears on the payroll of two neighbouring local authorities.
We were concerned to note, in Audit Scotland’s most recent NFI report, that 41% of bodies participating in the NFI were either not following up matches promptly or not focusing on recommended matches.1 This was in spite of the fact that Audit Scotland provides a number of software tools to help bodies identify those deemed to be at ‘higher’ risk. The report also stated that 69% of audit committees did not review the self-appraisal checklist issued as part of the NFI, which specifically covers the effective follow up of matches. Further, Audit Scotland also recommended that some organisations should ensure appropriate officers were in place and given sufficient time to investigate matches.2
While Audit Scotland can require public bodies to participate in the NFI exercise by providing data, it has no power to require them to then investigate the data matches that are subsequently returned. The Cabinet Office’s written submission identified this as an area where the NFI could be strengthened, although it acknowledged that this weakness was partially offset by linking the NFI in Scotland to the audit regime.
The local authorities we heard from were strongly against the introduction of a power to compel the investigation of matches. They felt it may be problematic in cases where they were reliant on input from other organisations, such as the Department for Work and Pension who investigate housing benefit matches.3 It would also impact on the local authorities’ ability to adopt a flexible and proportionate approach to tackling fraud.4
We were disappointed to hear that work is still required to ensure the effective follow up of matches. The Scottish Government should consider extending Audit Scotland’s powers to enable it to place specific requirements on mandatory bodies where it appears they have been ineffective in investigating matches and therefore potentially allowing existing fraud or error to continue. Again, it is important that any such power be used proportionately.
COSLA’s written submission highlighted that resources previously available to local authorities for fraud prevention and investigation work had transferred to central UK government to form the Single Fraud Investigation Service. We heard that this meant that the powers available to local authority housing benefit investigation staff under the Social Security Administration Act 1992, which enabled access to data from HMRC and other financial institutions such as banks and credit reference agencies, were no longer available to them.1 Therefore, the local authority staff responsible for carrying out investigations into matches are only able to request information under the Data Protection Act 1998. Data holders can refuse to provide the information and local authorities cannot compel them to provide it.
The Northern Ireland Audit Office said that being able to access HMRC data would be of ‘tremendous value’ in preventing and detecting fraud. Audit Scotland agreed that access to full HMRC data “would significantly increase the benefit of the exercise”. 2
We raised this issue with the Cabinet Secretary who said the Scottish Government would need to work with the Cabinet Office and Audit Scotland to determine whether or not any additional legislation was required, or whether improvements could be made through more effective communication and engagement.
It is important to the continued success of the NFI that local authorities have access to all the data they require and we heard a clear case that access to HMRC data would help. The Scottish Government should therefore determine whether a legal remedy is required on this issue and, if so, make representations to the Cabinet Office.
Audit Scotland’s written submission explained that UK legislation permits ministers to add to the list of public bodies required to take part in the NFI. In England, Ministers can also use secondary legislation to add to the purposes for which data matching can be carried out.3 Examples include assisting in the prevention and detection of errors and inaccuracies, and assisting in the recovery of debt owing to public bodies.
In general, we agree that any measures to increase the effectiveness of the NFI should be encouraged. We therefore call on the Scottish Government to consider whether there is evidence to show that any approaches adopted elsewhere in the UK have been successful and, if so, to revise Scottish legislation accordingly.
Audit Scotland said there had been doubt about its right to request data from the electoral roll for the NFI as there are differing legal views on whether electoral law allows electronic copies of the register to be provided for data matching purposes. 3
We call on the Scottish Government to clarify this issue.
Some stakeholders considered it should be compulsory for all public bodies – and private sector bodies in receipt of public money – to participate in the NFI. Suggestions for inclusion included housing associations, as this could help improve the effectiveness of tackling social housing fraud, and arm’s length external organisations that deliver services on behalf of local authorities.
However, some stakeholders, such as the Royal Botanic Gardens and Scottish Natural Heritage, called for smaller public bodies to be excluded from the exercise on the grounds that it involves a considerable amount of work for very little benefit.
The Wales Audit Office said that while current legislation makes it possible to mandate smaller organisations to participate it does not mean that they should always be asked to do so. Some housing associations are extremely small and proportionality was important.1
We believe all public bodies and private organisations in receipt of public money should participate in the NFI, where this would deliver clear benefits to the public purse.
Audit Scotland stated that some organisations, such as universities and private sector suppliers of public services, e.g. prisons, are not required to take part in the NFI although they could choose to participate voluntarily.2
Should the Scottish Government consider that further legislative change is not required to widen the scope of the NFI, we invite Audit Scotland to consider whether it could take further steps to encourage relevant organisations to participate voluntarily.
We also invite Audit Scotland to consider whether, in reporting on future NFI results, it could provide further information on the overall cost-benefit ratio to the public sector. Further, where there has been a significant drop in fraud associated with a particular programme, we would welcome an assurance that this is due to more effective anti-fraud measures, rather than, for example, public bodies being unable to investigate fully.
We explored with the Cabinet Secretary the extent to which the NFI’s scope could be extended to cover other spending areas where fraud may occur, for example, student tuition fees.1
Given the very large sums of public money involved, we also discussed the Scottish Government’s new social security powers. The Scottish Government expects that, through the new social security agency, it will be processing more transactions in one week than it currently does in a year.2 We note that counter-fraud will be a “key aspect” of the new agency’s programme of work and that comprehensive data matching will be built in. Officials said there should not be significant cost implications for the NFI in relation to social security, but this would have to be clarified.
In general, the Scottish Government agreed that extending the NFI’s scope should be considered but made it clear that:
any extension should not just be about adding more and more data but about adding data that will bring about good value and high-risk matches that will be of use to the organisations that participate.
Public Audit and Post-legislative Scrutiny Committee. (2017, June 15). Official Report col 26. Retrieved from http://www.parliament.scot/parliamentarybusiness/report.aspx?r=11018&mode=pdf
We believe it is important to extend the NFI’s scope where this would clearly help to tackle fraud in any spending areas not currently covered. We also ask the Scottish Government to confirm that, where relevant, it takes the NFI into account when considering setting up new spending programmes. Given the scale of the new social security powers, we also seek confirmation of how much it will cost to align these new powers with the NFI.
We explored the potential for the NFI to track and identify repeat offenders who commit fraud. The Cabinet Office explained that each NFI is conducted as a stand-alone exercise as required by the relevant statutory powers and code.1 The restrictions around the data allowed to be kept means there is no ability to gather intelligence on repeat offenders over time. However, the Cabinet Secretary confirmed that the Cabinet Office was considering how to address this issue.2
We believe it is important to tackle those who repeatedly commit fraud in order to provide reassurance that systems are effective and that public money is not being wasted. We note the Cabinet Office is considering how to address the issue and we expect the Scottish Government to work with the Cabinet Office and Audit Scotland on this as a matter of urgency. We request an update on how the problem is being tackled.
We agree with Audit Scotland that “the most effective approach to reduce the overall cost of fraud and error is to stop it occurring in the first place”.1 We also agree with the Scottish Government’s preventative approach to fraud, as set out in its written submission.
We were therefore interested to hear of a measure currently available to public bodies (‘AppCheck')i that may help to prevent fraud occurring; while we heard the many clear benefits of the NFI, it can only detect fraud and error after they have occurred.
Some stakeholders considered that while AppCheck may help to prevent fraud, the costs faced may be prohibitive in some casesii. We heard that the Auditor General for Wales provides the service to all NFI participants with the cost being funded through the Welsh consolidated fund.2 We were pleased to hear that discussions are underway between the Cabinet Secretary and the Cabinet Office to rollout the AppCheck service in Scotland.3
We ask the Scottish Government, working with Audit Scotland, to provide an estimate of how much could potentially be saved by AppCheck, and to confirm how much its roll out in Scotland would cost and how it would be funded.
This is our first post-legislative scrutiny inquiry and we were pleased to hear the general consensus, with which we concur, is that the NFI is effective at protecting public money from fraud and error. We thank all those who provided suggestions as to how it could be made even more effective and look forward to receiving the Scottish Government’s response.
The NFI is one part of a wider set of initiatives designed to tackle fraud in the public sector, as described in the Scottish Government’s written submission.1Consideration of these wider measures was outwith the scope of our review but it is relevant to note some indicators to suggest that the NFI may not be fully comprehensive in its scopei.
Without overstating such factors, we call on the Scottish Government to confirm whether it is clearly able to distinguish the NFI’s success from other anti-fraud measures, and for how long the NFI can usefully continue as a stand-alone measure.