Public Audit and Post-legislative Scrutiny Committee

Meeting date: Thursday, December 1, 2016

Official Report 577KB pdf

---

“The National Fraud Initiative in Scotland”

Item 3 is an evidence-taking session on the Audit Scotland report, “The National Fraud Initiative in Scotland”. I welcome to the meeting Russell Frith, assistant auditor general, and Owen Smith, senior manager, Audit Scotland, and I invite Mr Frith to make some brief opening comments before I open it up to questions from members.

Thank you, convener, and thank you for the opportunity to brief the committee on the national fraud initiative.

The exercise, which is carried out every two years across the UK, helps public bodies minimise fraud and error in their organisations. It works by matching large volumes of data across the public sector in order to identify matches for further consideration by participating bodies. Those data sets include payrolls, pension information, creditor information, housing benefit data and information on deceased persons and failed asylum seekers. Audit Scotland’s payroll is included in the exercise, and payroll data generally includes both staff and elected representatives at all levels.

It is important to note that matches do not necessarily mean that fraud or error has taken place. The data sets contain limited information, and it is always essential that the participating bodies properly investigate any matches to establish whether fraud or error does or does not exist.

The NFI was started by the Audit Commission in 1996 using implied auditor powers. The devolved nations’ audit agencies joined in the early 2000s, and the power to conduct the exercise was put on a statutory footing in Scotland through the Criminal Justice and Licensing (Scotland) Act 2010. The initiative itself is a tool that forms part of the overall arrangements to help public bodies prevent and detect fraud and error; it is not the only part of those arrangements. Audit Scotland’s role is to facilitate the exercise using its statutory powers to obtain data, and we prepare reports on the outcome of each exercise. In the 2014-15 exercise, 104 Scottish bodies took part and £16.8 million of outcomes were identified, taking the total that has been identified in Scotland to £110.6 million out of about £1.3 billion across the UK.

The value of such outcomes is only one aspect of the exercise’s impact—there are others. The deterrent effect of people knowing that this data matching exercise takes place is quite important, and there are other outcomes that are not as easily measurable in monetary terms. For example, ensuring the validity of blue badges helps to keep the relevant parking spaces available to those who really need them and are entitled to them. Moreover, even where no or very few outcomes have been identified for a body, the exercise provides that body with a positive assurance on the absence of fraud and error in those areas.

We have now commenced NFI 2016-17. There has been a small increase in the number of bodies taking part, which now include the larger further education colleges in Scotland. The Cabinet Office, which took over responsibility for the NFI in England following the Audit Commission’s abolition, is looking to extend the range of tools available to participating bodies, including flexible matching to allow bodies to request more frequent matching at times convenient to them and something called appcheck, which is a fraud prevention service that allows bodies to check against the NFI databases before payments are made instead of having to do things retrospectively as part of the full once-every-two-years NFI exercise. In Scotland, we are also keeping an eye on the development of the new tax and social security powers to ensure that those data sets are available for inclusion in the NFI exercise and that those devolved benefits reach the right people.

In summary, we believe that the NFI continues to be a useful tool in helping public bodies minimise fraud and error. We are happy to answer any questions that the committee might have.

Thank you very much, Mr Frith. Colin Beattie will open the questioning.

10:45  

I want to start by looking at the outcomes. In the report, you estimate that, in the previous exercise there were £16.8 million of actual and notional savings. In paragraph 81, you estimate that the

“cash savings ... for the public purse are”

about

“half of the total outcomes”.

You have also rightly highlighted the notional benefit with regard to blue badges, but there is also a cost to the council. After all, fraudulent or not, people were paying for those badges, so there has been a slight loss of revenue.

Looking at the bigger picture—and I am not decrying the deterrent effect that you have referred to—do you think that the outcomes are commensurate with the overall effort that is being put in?

I believe that they are. One of the things that we do to help minimise effort is provide a number of software tools to participating bodies so that they can refine the matches that they receive and identify those most likely to give rise to an impact. We expect them to look at the higher-risk matches first and, if they are not demonstrating much value, we do not expect them to continue through all the lower-risk matches.

You say that there are 2,522 investigations under way to recover £4.2 million. Is that not a lot of expensive investigations for a relatively small return?

Some of those investigations will be very short.

With council tax, for instance, you might find that someone who is claiming the single-person discount is actually living with someone else. All you need to do is cancel that, change the council tax bill and recover the money. That kind of very simple match does not take too much time and is well worth doing, given that it means real revenue going back to the council. Indeed, in this exercise, the biggest outcome area was not fraud but errors in claims for single-person discount for council tax and people not disclosing that they were living together.

I agree that the NFI has a deterrent effect, but I do not believe that it is well known to the public. Given, then, that the effect is on those who are immediately caught out and perhaps their immediate circle, how big a deterrent is it?

It is always difficult to measure something that you cannot see, but I point out that in some areas that were of high value in the very early exercises, the value of fraud and error has declined over the life of the NFI, including housing benefit and payrolls. Certainly, the value of pensions being paid after the people in question had died has definitely fallen away.

You have highlighted some issues with the quality of effort being put into this. In paragraph 94, for example, you state that, although

“central government bodies have, overall, significantly improved”,

the national health service and local government have not. Is there any significant reason for that? You have mentioned one or two reasons with regard to local government, but you have said nothing about the NHS.

You are right. For local government, the timing of the exercise, with the transfer of many of its existing fraud staff to the Department for Work and Pensions national fraud and error service, probably did not help the prioritising of investigations.

As for the NHS, I would say that the level of participation is still very good, but it is a bit lower than that in the previous exercise. The fact is that it is more difficult to obtain buy-in in that area, because the nature of NHS activity and the data sets being used is such that the outcomes for the NHS bodies themselves tend to be very much lower than for local government bodies. The importance of keeping NHS data relates as much to how it helps other bodies to establish a match and whether fraud or error has taken place.

There is clearly an issue with local government, which you have highlighted by mentioning a number of the councils that have been a problem, but you have also mentioned the Scottish Police Authority, which is a bit of a surprise.

The most likely explanation is systems that were still developing. At the time when the data was being collected, back in October 2014, the Police Authority was still very much developing its systems.

Let us hope that it will be a bit better this time round.

I certainly hope so.

Looking at the quality of what is being produced, you are talking about late submissions and all sorts of issues around that. Is it not made clear to the participants what the deadlines are?

Yes, it is.

There is no penalty, of course, is there?

No, there is no penalty. In most cases, we do get the data, albeit a bit later. If that data is taken at a later point, it is still useful, but it means that the subsequent investigations are slightly more complicated because there is data coming from different audits at different times. The ideal for us is that all the data comes in as at the same date.

At paragraph 96, you state:

“NHS bodies’ arrangements for NFI have weakened.”

You are still saying that they are good, but the fact that they have weakened is worrying. Where are you taking that?

We will be monitoring all bodies’ participation in the exercise, not only the provision of data in the first place but when bodies access the matches that are provided, when they look at them, when they investigate them and when they mark them up. We will then work with the local auditors of each of those bodies to keep the pressure on, to ensure that they are actively participating.

So you take it to the local auditor. That is your escalation point.

Yes.

Would you not think that, if the arrangements have weakened, it is a significant issue that should be escalated to the Scottish Government?

In most of the NHS cases, the arrangements have weakened from a high position to being satisfactory. The report is a two-year exercise, and every year we encourage and assist local auditors to review arrangements in each body, and they produce an annual audit report that goes to those charged with governance and to the Auditor General and the Accounts Commission so that they can discuss areas of governance, including how well they engaged with and participated in the national fraud initiative.

We do see success at local level, and sometimes this sort of exercise is just as much about getting momentum up to encourage bodies to engage properly and to produce self-help guides and identify areas on which they can improve. For us, the best area to identify for improvement would be getting the audit committees to have greater involvement in looking at how the NFI exercises are progressing in terms of delivering the materials and the data sets on time, having a resource plan, and knowing how to go in and investigate and what the results are, so that they have a full view of what has been found locally. That is the best way to engage.

We have had other successes. Two councils, Perth and Kinross Council and Angus Council, disagreed with an interpretation of the legislation on giving us the electoral registration data. We accepted that, but we asked what they were doing instead to use single-person discount information to prevent fraud and encourage more income into the council, and they are now using that data, so it is a win for us. It does not come through the national fraud initiative, but it is still a way in which we can encourage such matching. We did that through the local auditor as well, so we work closely with the auditors and the bodies to encourage them to make use of data and the NFI exercise to deliver the best for their taxpayers and for the public.

Can bodies opt out and choose not to participate?

We have the statutory power to demand data from the bodies that are within the remit of the Auditor General or the Accounts Commission.

What is the penalty if they do not?

There is not one.

There is not one?

No, not in the legislation. However, there are things that can be done, such as naming bodies in the report and local auditors including it in their annual audit reports, which are also public documents and are considered by those who are charged with governance in the organisations. Peer pressure and publicity are the main tools that we have available to us.

I am interested in the outcome figure of £16.8 million that has been recorded. Is that £16.8 million either fraudulently or erroneously being taken out of the system?

That is the estimated value of the outcomes from the exercise expressed in a way that tries to put all the outcomes into the same currency—in this case, pounds. Some of it will be value that has been taken out of the system. A single-person discount that has been claimed for the past few years is clearly a value that has been taken out of the system. However, for pensions that are being paid to people who are deceased, for example, the value that is recorded in this exercise is the value not only of any pension that has already been lost but an estimate of the future value that would have been lost had the match not occurred.

Why is that an estimate? Why can we not be more certain in the instances that you have cited?

Because, in some cases, we are looking forward. How long a pension would have been claimed had it not been picked up through the exercise is very much an estimate. We use the remaining expected average life of a pensioner for that particular purpose. In the case of council tax discounts, two years’ worth of discount is used consistently across all the agencies that undertake the work.

Does the data go down to the level of the individual transaction, or is any element of extrapolation involved?

It all goes down to the level of the individual transaction.

How much of the £16.8 million that has been identified as an outcome of items being either fraudulently or erroneously taken out of the system has been returned to the public purse?

Just under £5 million has been recovered. That is the value of the cash that has been recovered; what cannot be recovered is what has been prevented from being paid out by the pension or single-person discount being stopped.

By taking action to stop an on-going fraud, for example, you are stopping an on-going exercise. You have identified £16.8 million in transactions, of which around £5 million has been recovered.

Yes.

I have a quick question. In paragraph 70, you make the point that SAAS generally has quite a good record on uncovering any student support that has been claimed erroneously. Am I right in thinking that the figure is very low and that, therefore, there are no major concerns about fraudulent claims?

SAAS is on that—for want of a better expression—and works well in reducing that type of fraud. The NFI has proved an effective way to double check, but if people have fraudulent passports it is difficult and SAAS has to rely on the Home Office data as a second check.

From memory, I think that the figure has come down—

That was going to be my next question. Is that an improved figure?

Yes, in the sense that less fraud has been found, but SAAS is trying to find more.

I understand what you mean. Thank you.

Correct me if I have misunderstood this. The committee’s job is to follow the public pound, and you have asked 104 public bodies to participate in the national fraud initiative. How do arm’s-length external organisations and contractors play into that? Is there any investigation of fraud within those organisations?

11:00  

We do not have the power to demand the data from bodies that are outside the remits of the Auditor General and the Accounts Commission, but we have the power to accept voluntary participation by other bodies. For the exercise that has just started, we are getting data voluntarily from some of the ALEOs that are linked to councils, for example.

As was said earlier, the NFI is only one part of a public body’s fraud and error prevention.

Paragraph 11 on page 9 says that 104 bodies participated, but it adds:

“Two further education colleges were invited but didn’t submit any data.”

Can you tell me which FE colleges those were, please?

They were the City of Glasgow College and Edinburgh College.

Did they give reasons for not submitting data?

No.

No reasons at all?

It is often an organic process of trying to encourage folk to see the benefits of using data matching. As Russell Frith indicated, 10 colleges are now taking part or have been invited to take part, six of which have already submitted their data. We still do not have data from Edinburgh or Glasgow. We will check again with them. The law lets us mandate it, but I do not think that we would ever go to court over it. That would not be a very good use of public money. We will ask the colleges again why they have not provided the data.

The exercise is complete, is it not?

That exercise is complete. We do the exercise every two years, so we have started another one. The date for submission of data for that was two days ago and another report will be coming in 2018.

Has Edinburgh College submitted data to that?

It had not when I checked on Tuesday.

It did not submit for the last exercise and it has not submitted for the forthcoming one.

So far.

Okay. You said that you have the power to demand the information. Have you done so?

We wrote to the colleges. In effect, we mandate the data from the bodies. However, as has already been raised, what do we do if we do not get it? There is no penalty. Personally, I would not want that, because the exercise is trying to add benefit to the public sector, and it should be seen as that.

There is no penalty, but you said that, under the 2010 act, you have the legal power to demand the information. Hypothetically, if you were to take the next step, what would it be?

As Owen Smith said, the date for submitting data has only just passed. We will now be looking at any organisation that has not submitted data, and we will follow up directly with each of them to find out why they have not submitted it and whether it will be coming in the near future. We will consider what level of escalation we can apply depending on their answers.

Okay, but to return to the report that we are discussing, you wrote to the colleges and asked for the data, but it was not taken any further.

Yes.

Okay. Were there any other invited organisations that did not participate? The report says that 104 bodies participated but it adds:

“Two further education colleges were invited but didn’t submit any data.”

How many bodies did you invite all together? If 104 participated, what number were invited?

I cannot remember. It gets complicated with the Scottish Government because so many different bodies, payrolls and creditor systems are covered.

I am sure.

As far as I am aware, we got data from every other organisation.

We got everything bar the two colleges.

Out of the whole public sector in Scotland, it was just the two colleges that did not submit data.

Yes.

That is interesting.

They have submitted data in previous exercises. Four years ago, the City of Glasgow College took part.

Is there something to be said for making the initiative compulsory?

I sit on the Scottish Government’s counter-fraud forum with many other bodies such as SAAS, the Scottish Public Pensions Agency, Police Scotland and the Convention of Scottish Local Authorities. The Scottish Government issued a new counter-fraud strategy last year, and within that we are all trying to work together to push this. The NFI is a useful tool, but it is not the only tool for data matching.

What we and the Scottish Information Commissioner want to see is bodies using their data—legally—to ensure that they are doing all that they can do to prevent fraud and error in the system. For me, it is a governance issue as well. It is really up to those who are charged with governance to ensure that they are taking care of this. Audit has been filling a gap—

Those in charge of governance at the individual institutions.

I would ask questions of a council, a college or a central Government body, for example, if they were not taking part in the NFI or doing something as an alternative. There are examples of councils doing alternative data matching for council tax very successfully, which is good. We do not get too upset about it not being the NFI, as long as they are doing something. I do not know what we would get by making the NFI compulsory.

You might get data from the Edinburgh and Glasgow colleges.

You make a good point, but the colleges would have to investigate in order to provide the data. We do not do the investigations; they are done by the bodies involved.

You have been able to quantify the sums recovered through the national fraud initiative. Can Audit Scotland quantify the money that it has saved the taxpayer through other work? Is that a question for the Auditor General?

I think that it is a question for the Auditor General. However, in principle, estimating the impact of our work is a continuing area for us to look at. However, we have to bear it in mind that the impact of a lot of our work is not necessarily wholly financial.

Can you offset the cost of that work against the money recovered?

Yes.

No, in the sense that the cost of the initial exercise is met from Audit Scotland’s funding, which is provided by the Parliament. For the individual bodies the answer is yes; the cost of their investigation exercise is offset against anything that they recover.

So in a way it is a split cost. Your initiative is underpinned by the Criminal Justice and Licensing (Scotland) Act 2010. Does the fact that some bodies are not participating in the NFI suggest that there is a fault with the 2010 act?

I am usually in two minds as to whether penalties or sanctions should be included in each piece of legislation. For something like the NFI, I think that it is preferable if we are able to persuade organisations to participate willingly, because that will also improve the quality of their investigations and is likely to lead to a better overall impact than if they feel that they are being dragged to do the minimum that they can.

Thank you for your evidence this morning. The committee will now go into private session.

11:08 Meeting continued in private until 11:31.