Social Security Committee

Meeting date: Thursday, January 14, 2021

Official Report 497KB pdf

---

“The 2019/20 audit of Social Security Scotland”

Item 2 is an evidence session on the section 22 report, “The 2019/20 audit of Social Security Scotland”. I welcome our witnesses from Audit Scotland: Stephen Boyle, the Auditor General for Scotland; and Carole Grant, the audit director. I thank them for their attendance. I know that this is a brief visit, because they must attend a 10 am committee meeting elsewhere in the virtual Parliament, so to speak.

I invite Stephen Boyle to make a short opening statement.

I am delighted to be able to join the committee this morning.

The report brings to the Parliament’s attention the appointed auditor’s qualified opinion—[Inaudible.]. It also provides an update on the progress that Social Security Scotland has made on establishing its error and fraud management arrangements.

The auditor of Social Security Scotland has qualified his opinion on the estimated levels of fraud and error of £14.8 million in carers allowance expenditure, which is around 5.2 per cent of the total benefit. That expenditure was not in line with the relevant legislation. The auditor also qualified his regularity opinion in relation to that expenditure in the 2018-19 accounts.

It is important to say that that does not affect any other aspects of Social Security Scotland’s annual report and accounts. The auditor has given an unqualified opinion on the information reported—[Inaudible.]—which means that he is content that they show a true and fair view and follow all relevant accounting standards.

Carers allowance is being delivered by the United Kingdom Department for Work and Pensions on the Scottish Government’s behalf, through an agency agreement. Due to that delivery arrangement, Social Security Scotland is reliant on the DWP’s estimates of error and fraud.

Other benefits that Social Security Scotland was accountable for in 2019-20 are not affected by the same regularity issue. It is, nonetheless, important for Social Security Scotland to understand the levels of error and fraud in those benefits. With further benefits devolved from 1 April 2020, the impact of error and fraud will remain—[Inaudible.].

Social Security Scotland has strengthened its arrangements for the prevention and detection of error and fraud over the past year and has increased staffing in line with workforce plans. Continued development is needed in some key areas, including on-going development of digital systems; guidance on determining residency; and the establishment of its arrangements for estimating and reporting on error and fraud in the Scottish system.

Our report also looks ahead to issues and challenges for Social Security Scotland due to the Covid-19 pandemic. It is now responsible for a range of complex and high-value benefits. The continuing impact of the pandemic increases uncertainty and financial risk in an already challenging environment. The implications of changes to delivery timelines, arrangements for benefit delivery, and benefit eligibility and uptake rates will be complex to manage.

Social Security Scotland has adapted quickly to the immediate operational challenges of the pandemic, allowing it to maintain the administration of benefits while addressing the safe working of its staff. It has continued to recruit staff in preparation for the delivery of new benefits, using digital approaches. We will assess the detail of those arrangements through our audit work.

Carole Grant and I are happy to answer the committee’s questions.

Thank you. The volume on your connection is fluctuating, so we missed a little bit of what you said. However, we have received a written copy of your statement and were able to get the core meaning of your words.

I want to ask a couple of questions around error and fraud. However, when we have such discussions, it is important to issue the caveat that the vast majority of people claiming benefits do so because they are in absolute need, and fraud is minimal. It is important to ensure that we have appropriate error and fraud mitigation in place, but I just wanted to get that on the record.

You state that there is an agency agreement, and that the level of fraud and error for carers allowance is 5.2 per cent. That seems a relatively small number, but I have nothing to compare it with. Is it higher or lower than you would have anticipated? How does it compare with rates for similar UK benefits—I will come to Scottish ones later—including benefits that operate under an agency agreement? Can you bring that number to life for me?

With regard to the carers allowance, we have a reliable number for the extent of error and fraud in the Scottish system this year, which is the 5.2 per cent that you mention. In last year’s report, when the auditor also qualified his regularity opinion, we said that the number was not yet reliable, because the estimates that the DWP used to arrive at the number dated back to work that it had undertaken in the mid-1990s and which was quite out of date and no longer reliable. The number that we now have is a good starting point and enables the DWP and Social Security Scotland to have more of an idea of the parameters in relation to any associated activity that is undertaken to tackle error and fraud.

As I recall, there is a range of error and fraud levels across benefits in the UK, so you are right to ask for a comparison. I think that I am right in saying that some of those levels extend towards 10 per cent—I believe that that is the case for universal credit. Many of those numbers are set out in the National Audit Office’s audit of the DWP and the range of benefits that it provides. You were right to suggest that there is a range of error and fraud levels and that there is not a uniform pattern across benefits in Scotland and the UK.

Carole Grant might wish to make more detailed comments

I point to a couple of paragraphs in our section 22 report. At paragraph 20, we talk about some of the qualifying benefits, such as income support and universal credit. The range of error and fraud for those benefits goes from 3.9 to 9.4 per cent, as Stephen Boyle said.

As the new benefits come on stream, there will be even greater focus on that area. In paragraph 40, we talk about the overpayment rates in some of the new benefit streams. For us, it is key that Social Security Scotland builds its understanding of the rates that exist within the different benefit streams and uses that to inform its decision making around the control environment for the various processes. That should help to inform the agency about what arrangements are in place in the benefit streams.

That is helpful. I note what paragraph 20 says about the qualifying benefits for carers allowance and the range of error and fraud levels.

I turn to the Scottish Social Security system. In the report, and in your opening statement, Auditor General, you say that it is welcome that things have improved in the past year, and you mention that there has been an increase in staffing, which has gone from 17 full-time equivalent employees to 40. I assume that that has made a significant difference. I am keen to know more about not only the benefit of having those employees available but what they have done specifically to improve systems.

Also, to go back to comparisons with the figure of 5.2 per cent, how are we getting on in relation to error and fraud in the delivery of standalone benefits in Scotland? If those figures are in the report, I am sorry that I missed them.

I will say a bit more about the fraud and error team, and then ask Carole Grant to come in on how carers allowance compares with the other Scotland-only benefits that you are asking about.

We say a bit more in paragraph 23 of the report on the welcome progress that Social Security Scotland has made with the expansion of its error and fraud team, as you note, from 17 to more than 40 full-time equivalents during the 2019-20 financial year. That is welcome as an indication of the agency’s ability and capacity to tackle fraud and error in its system. We know that some of the additional responsibilities of the team around risk analysis—[Inaudible.]—its ability to conduct investigations—[Inaudible.]—bring its attention to planning for any recovery activity that it needs to do. It is an important area of work for Social Security Scotland, particularly as it moves to the point where its reliance on the DWP, as currently set out in its agency arrangement, ebbs and it becomes responsible for undertaking its own activity in that area. There are signs of progress as the team expands its operations.

I will stop there and ask Carole Grant to come in on those error rates relative to the rates for the other Scottish benefits.

That will be helpful. One figure that I got from the report—no doubt Carole was going to mention it anyway, but I will ask about it just so that I understand—reflects the importance of identifying not so much the level of error as where the errors are.

Paragraph 25 says that

“Targeted sampling indicated that around 75 per cent of errors had already been identified”.

I am flying a bit blind here, as I do not always understand the relevance of the numbers. Is it not the case that it is not always about the level of fraud and error in the system, but about identifying the error so that you know that it exists in the first place? What does 75 per cent mean in that context? That would be helpful to know.

I am happy to pick that up. Taking a step back, as well as noting the increase in the resourcing of the team, it is worth reflecting on the strategies and policies that are now in place and how they support the ability of the team to conduct its work. It can now conduct interviews and investigations and do other things that it was slightly constrained in doing in the past.

I was going to talk about paragraph 25. Having additional resources in the team has allowed it to establish what it is calling an interventions team. That team has collected a sample that will help it understand what is going on in the system.

You picked up on the 75 per cent figure, and I will work back from that. The team identified a sample of high-risk cases from the sample that it had picked, and it found an error rate of 43 per cent. When it looked into that further, the team saw that the system, the processes and the staff had already picked up 75 per cent of those cases and sought to address them through normal processes. That shows that the system that is in place is preventing and mitigating the risks around error and fraud.

However, we recognise that Social Security Scotland absolutely has to focus on increasing its understanding of error and fraud in the benefit streams that it administers. The report mentions the early part of the work that Social Security Scotland started with the Cabinet Office, which had to be paused because of the Covid-19 pandemic. We recognise the importance of that work being picked up as we move forward.

Thank you. Some members want to ask supplementary questions on that theme.

Residency was one of the things that was picked up as an issue for error, and Jeremy Balfour pursued that issue vigorously when we were looking at the Social Security Act (Scotland) 2018 and regulations. Can you say more about why residency is a particular problem for the agency?

09:15  

Members might recall that much of the interest in that was about interpretation and application of eligibility for benefits, so you are right that that theme is not new to the report. We have tracked that issue and, like other aspects, we think that Covid has got in the way of some of the progress that we would have expected to be able to report to the committee 12 months on.

We have not yet seen clear guidance on how social security staff should interpret or apply the term “ordinarily resident”. In effect, we are reporting a holding position to the committee and we expect to report further progress on that during the current year and potentially into 2021-22.

We cannot say much more than that at the moment, other than that it is work in progress for the agency.

That is helpful. I apologise if I have missed it, but what is the balance between error and fraud? Obviously, there is a big difference if an internal error has been made. As you have been reporting, part of that is in relation to the development of something that is completely new, along with new teams; we understand that. We also have to revise fraud provisions in order to catch the new benefits, and we did that fairly recently. Is there a balance between the percentages of fraud and error?

Because consideration of that balance was so relevant to our audit during 2019-20, I will focus my comments on the carers allowance, although I am happy to say more about our other work. We have analysed that balance: of the £14.8 million of irregular overpayments of carers allowance in 2019-20, which represented around 5 per cent of the total benefit, 3 per cent was related to fraud and 2 per cent was related to error. That all matters, particularly in the context that led the auditor to judge that that was irregular expenditure and not in line with the legislation. The committee will be interested in what that means for the steps that the DWP and Social Security Scotland might take to recover those balances at the appropriate point. That is the analysis that we have seen; Carole Grant can add whether there is additional analysis of the other benefits that might be helpful.

Because Social Security Scotland is still developing its arrangements for understanding the error and fraud within the benefit streams that it administers, we have not seen the details in relation to the split between error and fraud. The agency is focused on getting a better understanding of that, particularly with the new benefit streams that are now coming online.

Carole, am I right in saying that the money that was lost through error or fraud has to be swallowed by the Scottish budget and that we cannot go anywhere to get that money back?

Yes; as you know, the underlying funding arrangements are complicated, but Social Security Scotland’s arrangements fall within the Scottish budget.

Thank you.

I welcome Stephen Boyle and Carole Grant. I congratulate Stephen on his appointment, as I have not seen him since the interviews some months ago.

I know that this is a horrible phrase, although it is often used nowadays, but what might success—or acceptable levels of fraud and error—look like? I note that the accounts for the UK’s activities in the area have now been qualified for 31 years. Is the level of error and fraud related to the fact that there is an agency agreement? Is it linked to the other qualifying benefits? Is it possible for Social Security Scotland, if it moves forward in the way that it has done in relation to growing the number of staff who look at these things, to start to get error and fraud down to what you would consider to be a manageable level or, if not to an acceptable level, to a level such that you would not qualify the accounts?

Many thanks for your introductory remark, Mr Brown.

It is a difficult question, because a risk of fraud and error is inherent in a benefits system. There is a balance to be struck. Social Security Scotland wants to strike the right balance by getting the necessary benefits to those who are most in need while having an appropriate system of review and checks and balances to minimise the risk of fraud and error in the system.

You are right that the National Audit Office has qualified the accounts of the DWP and its predecessors for 31 years in respect of the error and fraud levels for a range of benefits. Clearly, that is not a set of circumstances that we, as the auditors of Social Security Scotland wish to replicate. Indeed, we take any audit qualification very seriously.

We do not foresee that the qualification will extend in perpetuity. We anticipate that Social Security Scotland will assert its own fraud and error level review activity and get to a place where it is satisfied that the controls that are in place are sufficient to mitigate some of the audit risks.

It is a really important question, and I know that Social Security Scotland will be giving considerable thought and attention to how to manage the situation. As I said, it wants to strike the appropriate balance between paying benefits to those who are most in need and having an appropriate system of checks and balances. It is a real test for the management of the organisation to have those parameters and to—[Inaudible.]

Thank you.

Rachael Hamilton has a supplementary question.

It was interesting to hear what Stephen Boyle said about how Social Security Scotland can improve the situation and reduce fraud. If we look at what has happened at the DWP, we can see that there have been cases of stolen identities during the increase in the uptake of universal credit. This is obviously something that is going to happen consistently.

I note that, in the report, you do not really say anything about security measures or indeed the skills that the increased number of full-time equivalent staff at Social Security Scotland need to have. I wonder whether that is just something that has to be factored into the bottom line, given that the cyberattacks and other security issues that we have in our digital world are going to continue to happen and indeed get worse.

That is a really interesting line of inquiry. There are a number of points to be made. First, as we look to capture in the report, it is welcome that Social Security Scotland has increased the resources in its fraud and error team, the number of people who are employed and the scale of its activity and ambition, but I think that it is clear that it is not there yet.

Carole Grant mentioned a few moments ago that some of the agency’s planned activity to bring itself up to the level that it wants to reach has involved some interaction and training with the Cabinet Office to tap into expertise about the types and nature of error and fraud that take place. In particular, as you rightly mention, digital activities may bring exposure in the payment of benefits.

Some of that work has unfortunately been interrupted by the pandemic, but it is important that, as the team asserts itself—[Inaudible.]

—reliant as the agency assumes full executive competency for all the benefits, its fraud and error arrangements mirror that growth, asserting its ability to do so.

Undoubtedly, there is risk around that and that is the key point—[Inaudible.]

—during the pandemic, within—[Inaudible.]—claims for universal credit and the passported nature of some of those benefits will bring additional risk to the level of fraud and error that Social Security Scotland is responsible for. We will continue to track that through our audit work and we know that the agency is alert to those risks, too, but it will be some time yet before we are able to comment definitively on the extent to which Social Security Scotland’s error and fraud arrangements are where it wants them to be and where it can assert all those arrangements in its own right.

I call Jeremy Balfour. You might be on mute, Jeremy. We will give it a few seconds. If we cannot get Jeremy in, we will take Shona Robison next. Information technology has just said that the problem is not with Jeremy’s mute button, so we will go to Shona Robison and maybe IT can get the sound back for Jeremy.

I add my comments to those of Keith Brown in welcoming Stephen Boyle. I will touch on paragraphs 45 to 48, which are about the impact of Covid-19 on benefit eligibility and uptake. It is really a forward look and not something that we can get into in any detail today, but the final sentence of paragraph 48 states:

“At this point, the relative impact of the pandemic on benefit expenditure in Scotland compared to the rest of GB remains uncertain.”

I want to understand your timeline in relation to being able to assess more fully the impacts of the pandemic more generally but also specifically the impact on universal credit. Some numbers have come through on the increase in claimants from a chunk of the pandemic period but not all of it, so in terms of your work schedule for this year, when will you be getting into the detail of that specific work?

You are right; like many organisations, we are tracking the impact of the pandemic daily, along with what that means for the bodies that we are responsible for auditing. There are a couple of areas that are worth touching on. We will continue to track that through the audit, which Carole Grant leads, of Social Security Scotland; we will monitor and track its performance and what that means for its expenditure levels, and we will report to the agency and to Parliament during the course of 2021 on what that means for its performance in financial and delivery terms.

In relation to key milestones, we are awaiting the Parliament’s consideration of the budget at the end of this month. As has been touched on in the previous panel, we will draw on the Scottish Fiscal Commission’s assumptions about benefit uptake. There are a couple of strands to that. We mentioned the Social Security Scotland activity and we are looking at that area in our forward work programme and considering options to supplement what we will do through the audit of the agency with some additional reporting. We are also looking at the impact of inequalities in the round through our forward work programme—in particular, we are looking at the Government’s progress and the impact that Covid has had on child poverty targets, which we referred to as well.

There will be a range of strands, and I have mentioned a couple of them. In essence, in our programme of activity during 2021, there will be very little that does not touch on or consider the implications of the pandemic, but it is worth highlighting those two points.

09:30  

It would be useful if, once you are in a position to do so, you could provide us—and, I presume, other committees—with the timelines for that work.

I would be happy to do so.

With fingers crossed, we will go to Jeremy Balfour.

Can you hear me now, convener?

Yes.

Excellent.

Stephen Boyle has dealt with part of my question. As the larger benefits, such as child and adult disability payments, are devolved, a 1.5 per cent overpayment rate is forecast. If the rate reaches the same level as that for carers allowance, that will obviously have a fairly big effect on the Scottish budget. What advice are you giving the agency to get that figure down, and how—[Inaudible.]—in the next couple of years?

I apologise, Mr Balfour, but I missed the very end of your question. You mentioned our interaction with the agency and the advice that we are giving it, but would you mind repeating that last point?

It was about how you will look at that issue in the next couple of years. How should the agency be improving, so that we do not have that differential?

I will say a bit and will then ask Carole Grant to update the committee further on her understanding from the conversations that she has had with Social Security Scotland.

Exhibit 2 in the report sets out what was the expected timeline of flow of benefit responsibility from the DWP to Social Security Scotland and the impact that the pandemic has had on the take-up of executive competence. As you rightly point out, and as paragraph 40 mentions, risk remains in the system for Social Security Scotland from the levels of potential overpayment rates that the DWP has highlighted in some of the benefits that are still to be devolved, such as personal independence payment, disability living allowance and attendance allowance. As is the case with many benefits, the rates of fraud and error in the system vary. It matters that Social Security Scotland is able to get the level of fraud and error down to the lowest possible level.

The report touches on the importance of Social Security Scotland continuing its work to establish the error and fraud team and improving its competence and effectiveness. There has undoubtedly been progress on the growth of the team. You touched on the policies that have come online—[Inaudible.]—but it is undoubtedly important that the agency is able to take the steps that it needs to take to get the levels of fraud and error down as low as possible.

I ask Carole Grant whether she wishes to add anything.

Our 2020-21 audit of Social Security Scotland is under way. We are planning it at the moment, and we will continue to report our findings in public.

It is also worth sharing with the committee that, through our engagement with Social Security Scotland, it is clear that the engagement with the DWP is in a good place. There are good discussions and good work is on-going between the two bodies to support Social Security Scotland in developing the understanding that it needs, particularly for the new benefits that have come in this year. That engagement is under way, and we consider it in our audit work.

I do not see any other bids from members for questions.

I will give our witnesses the opportunity to make any final comments, although they should not feel that they need to do so. Before long, the Parliament will move into recess and dissolution. Later in the year, a new social security committee—whatever that looks like—will pick up the cudgels on some of this stuff.

There appears to have been strong progress on increasing capacity and staff in Social Security Scotland to best identify and manage error and fraud. Although we have not really mentioned it, I can see that there has also been some progress on IT capacity, as well as dialogue between Social Security Scotland and Scottish Government officials. Although things seem to be progressing fine—or okay, or relatively well—what should our successor committee look at? What would continued progress and success look like? I ask so that whoever is on the social security committee at this time next year can try to benchmark some of that and see whether things have progressed as we would like.

That is a really interesting theme. We would be delighted to return and update your successor committee on the progress of our work both on the audit of Social Security Scotland and, more widely, on the impact of Covid. As the year progresses, it will be interesting to see the impact of the pandemic and what that means both for the impact of inequalities, which we will pick up through our work programme, and for the agency itself.

In the report, we touched on a number of points about the pandemic having interrupted some of the steps that the agency had planned to take in assuming responsibility for the payment of some of the benefits and in further developing its activity on error and fraud. That makes it difficult to have a linear timeline of comparability of progress, but it is nonetheless important that it is still able to do that and that the committee is similarly able to track that progress. It is undoubtedly a key plank of our work and of the interaction that Carole Grant and the team have with the agency.

The committee should be reassured that it is entirely on our radar. We will continue to report during the year, and we will be delighted to stay in touch with the committee on our progress. I am more than happy to do that in person.

I have just seen that Keith Brown has put in a wee sneaky last-minute request. We have time for him to ask that question before we close this section of the meeting.

Thanks, convener. It goes back to the levels of error and fraud that have led to the qualification of the accounts. Are those intrinsic to the fact that there is an agency agreement, to the fact of the link to a bigger set of qualifying benefits or to the fact of a demand-led budget, to which you have referred in your report? For example, I know that one of the schemes that was lodged by the UK Government—either business support or furlough payments—has had over 21,000 apparently fraudulent claims. Demand-led budgets are like that.

I am sure that we all hope to be back on the Social Security Committee in a few months’ time. The important question is whether the committee will get the assistance of Audit Scotland in providing targets for which we should be aiming. We should not accept that we are locked into historically high levels of error and fraud just because of an agency agreement. What targets would be useful? I know that Social Security Scotland will have its own targets, but it might be helpful for Audit Scotland to say what level of error or fraud would be acceptable, so that we could work towards that.

That is an interesting point. As the committee would expect, we have given it a lot of consideration. I know that Carole Grant and the audit team have thought carefully about the nature of the qualification.

If I might digress briefly, the existence of error and fraud in our benefits system does not automatically trigger such a qualification. I appreciate that the committee will already have a fair degree of insight on such matters, but I point out that the nature of the determinations and the level of compliance with legislation influence that. The fact that error and fraud exist in that system, or in relation to a particular type of benefit, does not automatically result in an audit qualification. However, the construction of the legislation in relation to carers allowance does lead to that level.

It is always a matter of judgment. We touched on the fact that around 5 per cent of the balance of carers allowance that the DWP has paid in Scotland was a sufficiently high level to warrant the auditor’s drawing attention to it in his audit opinion. As ever, we base our judgments on materiality. A lower level—we would hesitate to say exactly what that might be—would cause our judgment to swing the other way, so that we would consider it not to be a material balance.

The key point that I would make to Mr Brown is that we expect to see progress, particularly as the agency makes progress in detecting error and fraud and its arrangements for doing so expand. We anticipate that we will not be in the same situation as the DWP has been in for so many years, in perpetually having such a qualification. Carole Grant and the team have an on-going conversation with the agency, but its focus will move slightly.

I will pause for a second to check whether Carole wishes to add anything to what I have said. However, I assure the committee that we do not have ambitions to replicate that level of qualification indefinitely.

As the Auditor General has said, the way in which the legislation is established for certain benefit streams means that it might not have an impact on our regularity opinion. However, that does not mean that understanding the levels of error and fraud in those benefit streams is not important. The issue is not just the impact on our opinion; it concerns the overall levels of error and fraud in all the benefit streams, as well as the arrangements that Social Security Scotland is developing and must put in place. We must understand those and report on them. It will then be for the agency to take the best steps that it can on the basis of what it has learned.

It was remiss of me not to have welcomed Stephen Boyle to his post earlier, so I will do so now. I congratulate him. I also thank him, Carole Grant and the wider team that I am sure deals with such matters for their work in what have been pretty difficult circumstances. The committee gives you our best wishes for the coming year’s work. If we are lucky and privileged enough, it might be the same committee members who will see you again this time next year. Who knows? We will wait and see what happens.

That ends our consideration of agenda item 2.