Public Audit and Post-legislative Scrutiny Committee

Meeting date: Thursday, September 20, 2018

Official Report 713KB pdf

---

“The National Fraud Initiative in Scotland”

Item 3 is evidence on Audit Scotland’s report “The National Fraud Initiative in Scotland”. I welcome our witnesses today from Audit Scotland: Fiona Kordiak, who is the director of audit services; Angela Canning, who is an audit director; and Anne Cairns, who is a manager who covers the technical side of benefits.

I invite Fiona Kordiak to make an opening statement.

Thank you for the opportunity to brief the committee today on our latest report on the national fraud initiative.

Public bodies spend billions of pounds of taxpayers’ money for the benefit of the Scottish population. Spending systems are complex, and mistakes can happen. Some people also try to fraudulently obtain services and benefits to which they are not entitled.

The national fraud initiative aims to help public bodies to minimise fraud and error in their organisations. The NFI exercise is undertaken across the United Kingdom public sector every two years, and is led by the Cabinet Office. Audit Scotland is responsible for co-ordinating the exercise in Scotland, and 113 Scottish public sector bodies participated in the previous exercise.

The NFI involves comparing large volumes of electronic data that are held by a public body about individuals, such as payroll or benefits records, against other records that are held by the same organisation and those that are held by other public bodies to see whether there is a match. Where a match is identified, that might indicate there is an inconsistency that needs to be investigated further.

All bodies that participate in the exercise receive a report on the matches that they may choose to investigate. They investigate to determine whether a match is down to fraud, error or a perfectly acceptable reason. The body can then take remedial action, which might involve correcting a benefit award or recovering any creditor duplicate overpayments. They would also update their records. Exhibit 2 on page 9 of our report illustrates how the NFI exercise works.

The outcomes from the NFI include amounts for fraud and error that are detected by the data-matching exercises and an estimate for those future losses that have been prevented. Our most recent NFI report highlights that outcomes valued at £18.6 million have been recorded since our previous NFI report in June 2016. Exhibit 3 on page 12 of our report shows that eight areas generated about 95 per cent of those outcomes. Since 2006-07, the cumulative outcomes from the NFI in Scotland stand at £129.2 million. Those results highlight the value of data matching to Scotland’s public finances at a time when budgets are under pressure.

This committee carried out post-legislative scrutiny of the NFI last year and produced a report on its findings in September 2017. Your report noted that the NFI had helped to improve the transparency of public finances and clawed back millions of pounds to the Scottish public sector that would otherwise have been lost to fraud and error. The committee’s report made several recommendations for Audit Scotland, the Scottish Government and the Cabinet Office. All three bodies have been taking action against the recommendations over the past few months. We have provided a brief update on the actions in our report; we have also prepared a separate briefing paper for you for today’s meeting.

My colleagues and I are happy to answer any questions that you may have on our NFI report or the actions that we have been taking in response to the committee’s report.

Thank you.

In 2016, the committee discussed a number of concerns that were taken on by Audit Scotland, not least of which was about the level of participation in the exercise by public bodies that receive public funding. The concerns mostly related to arm’s-length external organisation and housing associations; there was also concern that some councils were less than good at participating. What progress has been made in that regard?

Audit Scotland can mandate to participate in the NFI only those bodies that the Auditor General or the Accounts Commission appoints the auditors to. Other bodies can choose to volunteer to apply to be part of the exercise, and some have done so. We have a number of initiatives in place to encourage participation. Over the years since we started the NFI in 2006, we have seen a general increase and improvement in the level of participation of public bodies. That is a good thing.

Audit Scotland was going to engage with the Scottish Government on that very issue.

Yes.

What progress has been made on that?

I will ask Anne Cairns to go into detail on that question.

We have been engaging with the Scottish Government. It has been proactively engaging with the housing association sector. A number of housing associations have volunteered to come into the NFI. We are taking that forward with the Cabinet Office to get them trained so that they can participate, have access to the data and bring in their data during the next six months or so.

They will be included in the next exercise.

They will not be included so much in the batch matching every two years. They will be included in what is known as the AppCheck, whereby, if someone applies for a house in a council of housing association’s area, it will be able to go into the NFI system and access the data to check that what the person says in their application is true, and verify that they do not have another house in another part of the country, for example.

That anticipated the question that I was going ask about AppCheck. Has that now been rolled out to all the councils? I know that you were discussing who would pay for that with the Government, and I think that the cost was going to be £1,850 per local authority area.

A number of the councils have undertaken a free trial. The Cabinet Office offered free trials of AppCheck because it is a fairly new product. Next week, we are having an engagement session with the Cabinet Office and the information technology supplier of AppCheck and all the participants in the NFI to promote it and have live trials that they can see. As part of that, a couple of our participants are going to do presentations on how they use AppCheck, so that local authorities do not hear about it just from auditors or the Cabinet Office but hear about it from their peers in other local authorities who are using it to their advantage.

My concern is that we are two years on from when AppCheck was first raised and we seem to be just at the point of having a few trials. That does not seem to be very fast.

It is worth saying that, as auditors, we cannot mandate what a particular body might use as part of its internal control framework. We can only report and encourage, and we have been doing that through our engagement events.

You were going to engage with the Scottish Government to see whether it could apply a bit of pressure and, if necessary, make a change to legislation to make it mandatory. None of the participants has to follow up on anything, because there is no penalty.

Local auditors would report about any body that they did not think was following up its matches satisfactorily. It would be reported in the public audit report for that organisation.

It is not really a smack on the wrist, is it?

I am looking at the number of cases that were identified in 2016-17, and they have doubled since 2014-15. However, the value that is attached to that potential recovery has gone only from £16.8 million to £18.6 million. The next step on that is that we are trying to recover £4.8 million. Given the effort that has to go into investigating those cases, is that value for money? If auditors have 656,000 cases to investigate and the potential amount that might be recovered has gone up such a small amount, what is the cost of the exercise?

The definitive cost of the exercise is quite hard to estimate. Many public bodies do not differentiate between investigating the NFI and following up matches from some of their other counter-fraud activities, and nor would we necessarily expect them to isolate the cost of the NFI.

In, I think, paragraph 68, we try to give a broad estimate of the cost of undertaking the NFI exercise. We are clear that the cost is outweighed by the benefits that are received.

10:00  

Year-on-year comparison between the 2016-17 exercise and the previous one is difficult, because new bodies have come along and were involved in the exercise and new data sets were used compared to the last time that we did the exercise.

The recovery rate of £4.8 million should not be compared against the £18.6 million, because that includes prevented potential overpayments as well as actual overpayments. The £4.8 million needs to be compared against the £5.5 million of actual overpayments that were detected through the exercise.

I just look at the figure of 656,000 matches and think that somebody has had to look at each of those. Is there not a cost?

It is worth stressing that bodies do not have to investigate every single match. They risk assess the matches to determine which areas are worth investigating and which are probably not worth their effort in investigating.

So, if it is a small amount of fraud, they do not bother.

That is not necessarily the case, because not every match is indicative of fraud or error. Sometimes, there can be a perfectly reasonable explanation.

But somebody has to assess that, and there is a cost in that.

I will pass you over to Anne Cairns, who will mention some of the guidance that is available on the NFI process.

We have spent a bit of time on this point. I ask Anne Cairns to summarise briefly, please. That would be helpful.

The Cabinet Office system has inbuilt risk scoring so, when the matches are released and councils or health boards receive them, some are shown as high risk—they are highlighted in red—and others are a sort of gold colour. Those are the ones that, from the IT analysis of previous exercises, the Cabinet Office thinks are most likely to indicate fraud and error. Some of the other matches might be for perfectly legitimate reasons or are perhaps because the data in the system is not as good as it could be. Especially when a match comes up for the first time, that might be because the data in the underlying systems is not as accurate as we would like.

Case study 3, which is on page 15, mentions Moray Council’s tell-us-once approach, under which, when a death is registered, the registrar informs the relevant council and Government departments so that the bereaved relative has to tell the authorities about it only once. I have personal experience of that system, and it was very effective, but that was not in Moray; it was in Edinburgh. Are not all councils doing that and, if not, why not?

More councils than Moray have the tell-us-once system, as you have found out. However, it is not happening everywhere. I will pass you over to Angela Canning to talk a bit more about that.

I had a similar experience last year when, unfortunately, my mother died. However, I was fortunate that, when I contacted the registrar at one council, it had the tell-us-once approach and the registrar informed another council as well. I know from personal experience that the system is more widespread than just Moray Council. We highlighted that example because it has an important impact on a council’s ability to manage its systems well, but it also has a positive impact for bereaved families, in that they need to tell the council only once for the various services that it provides. We were highlighting good practice.

Are Audit Scotland and the Accounts Commission—I guess that it would be its responsibility—doing anything to encourage the roll-out of the system everywhere, or is there anything that you could do?

The very fact that the system is mentioned in the report highlights it as good practice. We are working with our communications team in Audit Scotland to develop a hub on our website where we capture the work that goes on across the piece on counter-fraud activity that Audit Scotland does, supported by our local external auditors.

It is an area that we are developing and in which we are hoping to highlight good practice and case studies as they come through and as auditors notify us of examples of fraud in councils and other bodies. That will allow us to highlight good practice in a more immediate way.

Sticking with the blue badges, can you clarify something for us? When the registrar informs Moray Council, say, that a death has been registered, do they—or can they—include information on council tax, benefits and pensions at the same time? Is it just blue badges that they provide information on?

When the tell-us-once system works well, it should typically cover a whole range of services provided by the council, including not only blue badges but social care, benefits and council tax. It should cover the piece. We have identified Moray as an example where the system works well; it is also working in other councils but, as we understand it, it is not working totally effectively in all areas. The ideal is that it should cover all council services.

In paragraph 26 on page 13, you conclude that

“council tax discount incorrectly awarded across Scottish councils totalled £4.4 million”.

That is lower than last year’s figure by about £1.2 million, which sounds good. However, it is still a very significant amount. Is there more that councils can do to address that issue?

In general, there is always more that councils and bodies can do to help prevent error and overpayment.

Such as?

One of the recommendations in our report encourages councils to do more about the council tax single person discount.

Could you point me to that recommendation in the report?

It is on page 6. It says:

“Local authorities should ... investigate the council tax single person discount ... matches, in conjunction with other data-matching suppliers as they determine appropriate, to ensure that their awarded discounts are valid”.

Just for clarity on the £4.4 million of incorrectly awarded council tax discount, I know that the figure has come down from last year, but what I cannot see in the report is whether the same councils are still involved. Did the councils that incorrectly awarded the £5.6 million the previous year sort out the issue, so that what we are talking about here is a new set of councils?

Anne Cairns might know the detail of that.

I do not have with me the list that identifies particular amounts, but it is an issue that goes across the 32 councils. They have all worked on this area, and they have identified more incorrectly awarded discounts.

The problem sounds fairly endemic. Following on from Iain Gray’s earlier question, do you get the sense that the councils are talking to one another to share best practice and ensure that they are doing as much as they can together instead of trying to find solutions individually?

An engagement event that we are having with NFI participants next week will provide us with an opportunity to facilitate some of that discussion on the sharing of best practice.

Anne Cairns and I quite recently attended a meeting of fraud investigators who work in the 32 councils. We know that there are forums out there for staff who are involved in counter-fraud and looking at fraudulent activity to get together, and they very much share their learning and examples and hear from one another about how they have tackled things.

That is great. Thank you.

That brings me on to the point that I would like to raise. We have touched on council tax and blue badges, and I think that Audit Scotland must possess the data for each council on those. Can you publish it?

Do you mean the details of overpayments for each council?

The section on blue badges begins on page 14 of the report. Paragraph 32 states:

“Scottish councils have reported correcting 4,505 blue badge records ... Where the NFI helped them to identify that the holder had died.”

In answer to Liam Kerr’s question, Anne Cairns said that fraud is spread equally across all councils, but would there be any harm in Audit Scotland publishing the data, so that we might be able to identify whether Aberdeen, for example, has a particular problem with blue badge fraud? I am not suggesting that Aberdeen has such a problem, or that any council is particularly good at dealing with it, but if we have the data, is there any reason why it cannot be in the public domain so that it can be scrutinised local authority by local authority?

That is something that we are considering for our next NFI report in two years. We are thinking about producing a shorter overall report but with more interrogative data sitting underneath it, so that anyone who is particularly interested in an area could drill down into some of the detail.

What currently happens for each individual body is that the external audit team will look at that particular body’s arrangements for following up matches, and they report some of that information in the annual audit report for the body, so for each individual body’s report you may get some of the detail about how many blue badge matches have been followed up. However, Scotland-wide data is something that we are looking at and will be reporting differently next time round, partly in order to freshen up our approach to the NFI.

Do you agree that even the process of publishing the data is an incentive for each local authority to get a grip on that? If all the data is collated on one website to show how each of the 32 local authorities is doing on blue badge fraud, council tax discounts or whatever, surely that transparency in itself creates an incentive.

Yes, we think that that would be positive thing.

Could Audit Scotland write to the committee providing all the data, local authority by local authority, so that we can publish it on our committee website.

I look to Anne Cairns to say how onerous that might be.

We have the data but, as Fiona Kordiak said, we have the actual outcomes and the overpayments that have been recovered, and we also have the estimates: those are collated and added together. We would need to provide a bit of explanation, but it would be possible to provide that.

Perhaps the committee could write to the Auditor General to ask for that information and she will respond to say whether it is possible. Thank you.

In the paper that you gave us, there is an appendix with recommendations from the post-legislative scrutiny review of the national fraud initiative, which lists recommendations and actions that have been taken. The recommendations ask for the Scottish Government and Audit Scotland to do certain things, and under the list of actions there are loads of statements telling us that Audit Scotland delivered this and that or arranged this and that, but when I look at the Scottish Government’s actions I see that it uses phrases such as:

“The Scottish Government has advised that it will consider whether there is a need to ... The Scottish Government has advised that it will look to possibly fund ... The Scottish Government has advised that it is considering this.”

“The Scottish Government” is a very broad term. Is it just embarrassed about what it has done and is summarising it in a few words, or has it really taken the recommendations on board, and is it delivering actions?

We have had on-going engagement with the Scottish Government on the issue, and Anne Cairns has been in active discussions with it.

As Fiona Kordiak says, we have been in regular discussion with the Scottish Government and I know that Mr Mackay wrote to the committee around last Christmas about the actions that the Government was going to undertake. It has been engaging with housing associations, a number of which have volunteered to participate in the NFI.

More recently, it has worked on business rates and has looked to see whether there is more that the NFI can do in respect to getting a new data set and getting new bodies in to look at fraud and error in business rates. At the events that Angela Canning mentioned, there was engagement with local authorities, and it looks as though the activity will be undertaken towards the end of this year.

10:15  

The Government has also been looking at legislation. For example, a bit of clarity was required on electoral roll and council tax legislation, because there had been questions from some councils that were uncertain of whether they had the powers to release electoral roll information. The Government recently clarified that their doing so is fine. It has been undertaking various activities.

Are you reasonably confident that there is action underlying those very general terms?

Yes.

The biggest outcome involves pensions—there have been overpayments of pensions, and payments that have not been stopped after people have died. Where the NFI has identified cases in which a pension has been overpaid, or continued to be paid when it should have been stopped, is the Scottish Public Pensions Agency able to claim those sums back?

The decision about whether it is worth recovering overpayments comes down to the individual public body and the pensions agency. The SPPA can recover some of the payments, but not all of them.

Why not all of them? Can you help me with the distinction?

In any recovery decision, a body considers the likelihood and cost of recovery, and whether the cost of recovery outweighs what can be claimed back. Hence, of the total £5.5 million of overpayments that were detected, recovery action has been taken only on £4.8 million.

Right. So, somebody has taken a decision that it would be inefficient use of public funds to recover the balance.

Yes. The situation is no different from that of any other overpayment.

Ms Kordiak, do you describe what is happening in the national health service with general practitioners who have retired going back to work on a locum or out-of-hours basis as being a problem, too?

I am not sure that we have any information on that issue. I will pass that over to Anne Cairns.

No information on that has come through any of the NFI matches. That is not to say that there is no issue, but nothing has come on to our radar through the NFI.

I do not want to ask you to divulge your secrets about scanning and checking, but if a retired person starts working again, it must surely be flagged up fairly early in the systems of Her Majesty’s Revenue and Customs that the person is earning and is also in receipt of a pension.

It is worth noting that some pension rules have changed, particularly for some occupational pensions. With flexible retirement, it is now perfectly possible to receive an occupational pension and work.

Surely one cannot receive the same amount as was previously enjoyed; otherwise, why would we be looking at this £6 million overpayment of pensions?

Anne—do you have any detail on that?

When the committee undertook a review of the NFI, one of the issues that was raised—I think that it was in one of the evidence sessions—was that HMRC is not in the NFI. Over the past year or so, we have been working really hard with the Cabinet Office to get access to HMRC data to allow us to do some data matching. In the report, we reflected some early success in that we now use HMRC data to verify some student awards in Scotland. That is under way, as we speak.

However, it is an issue and, with the engagement that we now have with HMRC, and with the Digital Economy Act 2017, we hope that HMRC will be more amenable to allowing us to access its information in the future.

It is fundamental that the initiative can have access to up-to-date data from HMRC.

How often do you get the data? Is it every week or every six months? How does the process for getting access to current data work?

The data match happens every two years. The data would be collected at a point in time and the individual bodies would follow it up. As part of the pilot activity and our work on future developments, we are speaking to the Cabinet Office and the information technology suppliers that do the data matching for us, with a view to getting the data much more frequently. They have increased the frequency of some matches—for example, we are getting matches on immigration and deceased persons much more frequently—but in some other areas we get the data only on a two-year cycle.

All the bodies can use the application checker tool, and they do so as and when they need to. All the councils have access to HMRC real-time information data on the benefits side of things—they have daily access to that.

When I was on the committee previously, I asked whether the data matches that were obtained in a particular year were checked again in subsequent years. I think that they were not, and that different areas were moved on to. Can you update me on that? If you get 1,000 matches this year that yield £5 million, will you check that people do not attempt to repeat their behaviour?

The decision about which matches to investigate is down to the individual bodies. At the moment, the NFI exercise does not focus on individuals.

When a body such as a council or a national health service board gets matches—as part of the current exercise, the next batch of matches are due in January—the IT system behind the NFI will highlight matches that have come up previously. If there was a match on me, for example, it would be colour coded to say that the same match had come up previously.

So, habitual offenders are flagged up for further investigation.

Yes—if the same match had come up previously.

I refer you to exhibit 6 on page 23. Note 1 says:

“Only two colleges took part in the 2014/15 NFI.”

That explains why there is no information in the graph for colleges in 2014-15. Did all the colleges take part in the 2016-17 exercise?

Nine colleges took part in the 2016-17 exercise, but all colleges will participate in the exercise that we are about to start. In 2016-17, the nine largest colleges took part. Under the legislation, we have to prove that, when we request data for data matching, it is worth while and that outcomes will be identified. That is why we requested the data for the nine largest colleges, and we got outcomes.

Can you remind me how many colleges we have in Scotland?

There are about 20 colleges.

I think that there are about 23.

Is the figure not 26?

It is in the 20s. The graph shows that, in 2016-17, the NFI arrangements were mainly satisfactory, and there is a yellow bit at the top that indicates “Mostly adequate”. If only a third of the colleges participated, surely that is unsatisfactory. Why is there no representation of that?

That is because the graph represents only the results for the colleges that we asked to participate.

You asked only nine colleges to participate. Why did you not ask all colleges to participate?

That was because, as Anne Cairns said, the process was new and we wanted to make sure that it was worth while before mandating it for all the colleges.

Okay. How many NHS boards participated in the 2016-17 audit?

All the NHS boards participated, except the Mental Welfare Commission for Scotland.

Right. In local government, did all 32 local authorities take part?

Yes.

I am sorry, but why were only nine colleges asked to take part?

That was because their participation was a new area for the NFI and we wanted to prove that it was worth while before we mandated it for all the colleges.

I see—I understand.

I thank all three of our witnesses very much for their evidence.

10:25 Meeting continued in private until 10:39.