Thank you, convener.
I think that this is the fourth time that I have come to a Public Audit Committee meeting to talk about the national fraud initiative, which you may recall is a biennial data-matching exercise, for which Audit Scotland acts as the co-ordinator. It involves matching various data sets from across the public sector, with the objective of trying to identify matches that may indicate the presence of fraud or error.
Public spending systems are quite complicated and there are high volumes of transactions. Using computer-based techniques is a very efficient way of looking through large volumes of data to identify matches that may indicate fraud or error, but the computer systems cannot be definitive about that because they do not know all the circumstances of the cases. For every match that is reported back to a body, we expect that body to do further work to identify whether it really is an indicator of fraud.
Since we last reported in May 2012, further outcomes with a value of about £16 million have been identified. That takes the total from the NFI in Scotland to around £94 million over the past eight to 10 years and the total in the UK as a whole to just over £1 billion. In the exercise, we work very closely with the Audit Commission and the other audit agencies so that we can get across geographic boundaries. Fraud does not recognise organisational or geographic boundaries, and data matching on a co-ordinated basis across the UK is one of the ways in which we can combat it.
This time round, 127 Scottish bodies took part, which is more than ever before. In particular, we brought in a significant number of central Government bodies and one of the new, larger further education colleges. Just under 600 data sets were used, and they generated about 380,000 matches. We do not expect the bodies to investigate all of those. We provide them with tools to filter those matches to identify the ones that are most likely to yield a result.
This time, we also tried to identify matches in cases in which the outcome was of benefit to the sector as a whole rather than to the body that was submitting the data. One of the issues that we have had in previous exercises is that some bodies have found that they have not got much out of the process, but their data has been extremely helpful to other bodies. For example, if it was discovered that an NHS employee was claiming housing benefit unduly, the NHS would not see the result of that but the local authority would. Therefore, we encouraged those bodies that might not benefit directly to recognise the wider benefit of the exercise.
As members may know, the Audit Commission, which has been co-ordinating the NFI since it started, is to be abolished from 1 April next year. Its data-matching powers are being transferred to the Cabinet Office, so the exercise that is just starting—the 2014 exercise—will continue pretty much as is. There will then be further reviews of how the NFI will continue. One of the big issues for us is that when universal credit finally comes in, housing benefit will be taken out of the NFI remit. As housing benefit is one of the areas with the biggest impact, that will challenge us to look at the value of the rest of the exercise. Having said that, depending on what happens with the final agreement on further devolution to Scotland, it may be that other data sets will come within our remit, which might make continuing the NFI an extremely worthwhile exercise.
I will be very happy to answer committee members’ questions.
Before I ask a couple of specific questions, I will ask one overarching question. I see in the report the figures for the savings achieved and so on, but there is a huge cost to the national fraud initiative, is there not? The operation is not cheap; it extends through a chunk of the public sector. Is it cost effective, other than as a deterrent?
Are the arm’s-length trusts that are established by local authorities covered by the initiative?
I do not have a list of those bodies with me. However, in general, I suspect that some of them are the smaller, simpler bodies for which fraud is not such a significant issue as it is for local authorities and health bodies.
A number of the smaller central Government bodies that have been taking part generally just have payrolls and administrative expenses. We brought them in largely to see whether they could contribute to the results for councils—particularly around housing benefit, because payroll to housing benefit matches are probably the most productive of all the matches. In a way, I am not entirely surprised by their slower reaction to taking part in the exercise because counter fraud is not a significant activity or risk in those more straightforward bodies.
We did not expect fraud at the National Library of Scotland and Bob Black, the previous Auditor General, did well in bringing that issue to us. When new bodies are being set up, is it not as important to ensure that they are adhering to all the principles rather than just doing that with existing bodies?
On who should come in, the principal criteria are to do with the value of the data sets, in terms of the potential to detect or prevent fraud. With some data sets, in which I would include our payroll and the Scottish Parliament’s payroll, the public assurance of knowing that there are no issues could be an equally valid outcome. Using us an example, it would be unreasonable for us to match other bodies’ data, particularly public sector payrolls, if we were not prepared to put our staff through the same level of scrutiny. That gives us the added assurance that when we talk to audited bodies about fraud, we do not have any skeletons in the cupboard in that respect.
The cost of providing the data is very low—it is a computer file of the most recent payroll. It does not take long for information technology departments to put that together.
We think that it is at the moment, hence my references to the future of housing benefit. In pure cash costs, it costs us just under £250,000 for the matching exercise to take place. There is then an element of staff cost in Audit Scotland—particularly Owen Smith’s time—but, probably, the biggest resource cost is the cost of the various public bodies investigating the matches. I could not tell you the actual cost of that, but as long as we get outcomes in the sort of range that we get, the initiative certainly more than pays for itself. In fact, it pays for itself many times over.
Paragraph 106 on page 32 refers to that very point about social landlords. I realise that the provision is voluntary, but do you think that you will make progress on that? It is clear that that is a large area. It is a big piece of database.
In most cases, I do not think that they are, unless the employees of those trusts are already on the main council payroll system, in which case they may be.
Indeed it is.
Does that £250,000 come from Audit Scotland?
Indeed it is. As Owen Smith said, the provision will be entirely voluntary. We have the legal power to accept data from bodies that are outside the public sector, but we do not have the power to mandate it. If social landlords start to see potential benefits for themselves, that will encourage some of them to take part.
Colin Beattie took one of my questions so I will ask a supplementary to it.
Paragraph 11 says that Angus Council and Perth and Kinross Council did not participate in data matching. There was 97 per cent voter registration for the referendum, which I think we all welcome. I have heard recently in the media that high voter registration is leading to council tax payments from the past being pursued. Will Angus and Perth and Kinross be less able to pursue those payments from the past than other councils that we have heard about in recent days? Are those councils at a disadvantage?
So you use a quality standard mark of some sort to ensure that people in the Scottish Parliament are not caught in such circumstances. Thank you very much.
Yes. It comes out of our overall budget.
Are you in discussion with any social landlords? Are there any hints that they might be amenable to the approach?
I do not think so. From what I have heard in the media, the intention was that the councils would use the data from their own electoral registers to pursue people directly. Angus and Perth and Kinross will have exactly the same data available to them as the other councils.
Mr Frith, you mentioned the transfer of the NFI to the Cabinet Office, and you spoke about some of the issues involved in that. Can you give us an assurance about whether the scope of the activity that Audit Scotland has carried out hitherto will remain? Is there any lack of clarity about that? Do you expect the scope of your interest in data to extend as a result, or is the picture not particularly clear?
Okay.
The report says that 832 cases of housing benefit fraud have been identified, yet there have been only 92 housing benefit prosecutions. If we are talking about a deterrent, that is a very low level of prosecutions. Why is that?
I refer you to key message 8 on page 6, in which you say that some organisations
“could act more promptly to investigate matches”.
What sort of delays are we talking about?
Agenda item 3 is on the Audit Scotland report on the national fraud initiative. I welcome the assistant Auditor General, Russell Frith, and Owen Smith, senior manager at Audit Scotland. I invite Mr Frith to brief the committee.
We will be planning for the next exercise, so I hope that discussions will take place in the next year. There is a two-year reporting programme, but trying to identify new data sets to bring in is a continual exercise. I will meet the English, Welsh and Irish audit agencies next Tuesday to discuss what we will bring in for the next two-year exercise in the future. Things are evolving, and the registered social landlords are one of the big areas that we think we could get something from, but we will have to make contact and discuss the matter with them. We cannot make them do it; there has to be a voluntary arrangement.
I expect the scope to continue to be, certainly in the short-to-medium term, at least the same as it is now.
The Cabinet Office might be interested in more real-time data matching. The same computer facilities that do this one-off exercise every two years are capable of matching data on a more frequent or indeed real-time basis. There is some thought in Government about encouraging bodies to use the data more routinely, almost to the point of using it before the transaction takes place rather than retrospectively. If that can be done, it will be much more effective in reducing fraud levels, because people will not have to go back and recover amounts; rather, it will stop the fraud at source. However, there are cost and logistical issues with doing that sort of thing.
We have seen some evidence of such an approach already in Scotland. Instead of just using the NFI once every two years to check against deceased persons, some pension funds are now doing that more frequently, of their own volition, as part of their management checks. We entirely encourage that.
Finally, paragraph 11 on page 10 says:
“two councils, Angus and Perth and Kinross, decided not to upload data”.
Why was that?
Because of the transfer of the NFI to the Cabinet Office, do you expect any duplication of what it might wish to do and what you currently do on our behalf?
We are talking about delays from a number of months to anything up to a year. That is one of the reasons why we have the recommendation to bring that to the attention of bodies. It is also why we have the appendix at the back with the checklist for people to complete. We are bringing forward by at least six months the reporting that we expect to get from the local auditors so that we can identify much more quickly than we have done in previous exercises when bodies are taking longer than we think they should. That will enable us to prompt them more readily than we have done in the past.
The main reason is that local authorities working under Department for Work and Pensions rules have a whole host of sanctions available to them, from administrative penalties to purely stopping the benefit. There are various levels of administrative penalty short of prosecution. In many cases, particularly the smaller ones, or when there is some doubt about people’s motivation—in other words, about how deliberate the fraud was—local authorities will use the other sanctions that are available to them. Those sanctions are used quite widely.
So the number of prosecutions does not reflect the full action that is taken once cases of fraud have been identified.
In paragraph 91, you say:
“The biggest change from the last exercise is that central government bodies have, overall, weakened arrangements in comparison with NHS (improved) and local government (stayed the same) sectors”.
If the initiative is to be successful, I would have hoped that central Government would lead the way. However, you state clearly that it has weakened its arrangements. Will you explain that further? What can be done about it? In what way have central Government bodies weakened their fraud initiative arrangements?
In paragraph 7 on page 9 you say that you have
“increased the number of bodies involved to 127”.
What is the significance of that? How many were there before? Are any significant bodies now being captured?
You talk about a
“further education college and a greater number of central government bodies.”
How does that affect the college trusts that were set up? Will they be captured by the initiative or do they remain outside it?
Those councils had internal legal advice that the provisions of the Representation of the People Act 2000 that restrict the extent to which electoral roll information can be shared took precedence over the legislation that we are working under. We are not entirely convinced about that, and it is clear that neither are the other bodies that take part.
For me, the most important thing is that something is done to look at the types of fraud that could be happening. In the case of the electoral roll, in essence we are looking at single person discount frauds, and there are other ways in which local authorities can tackle that. I am more interested to know that local authorities are using techniques to tackle that area rather than necessarily using the NFI. We have therefore looked at those councils to see that they are doing something alternative to the NFI to look at that area.
No.
And they are. They have just tendered for other people to use data matching to identify issues with their council tax single person discounts against the electoral register. They are therefore using data to try to identify efficiencies and errors or fraud. We do not want to make them use the NFI if they have another way of doing things. As long as they use the data efficiently and effectively to try to stop errors or fraud, we are quite happy with that. It is a fact that they did not do that two years ago, but they are doing it now. We have engaged with the local auditors to try to push the issue to members in the councils, and they have taken cognisance of the matter and are now data matching on those data sets, but not within the NFI.
I have read that again and it comes back to an earlier point. The biggest new bodies were central Government bodies. If I could rewrite that now, I would strip out the new bodies, leaving the existing ones that were in the previous exercise. The biggest problem has been that the new bodies take a lot of time to get up to speed with what is asked of them. It is quite daunting getting 1,000, 2,000 or 10,000 data matches back to investigate. We provide self-assessment guidance and checklists to help people through the process. This time, because we have kept the number of bodies constant apart from the new further education college, I expect that the central Government bodies will do better because they have had experience from the previous exercise. I hope that that answers your question.
I will answer on the last point and then ask Owen Smith to comment on the rest.
As far as I understand it, most of the college trusts do not have employees of their own. They mainly rely at the moment on college staff, who would be picked up for the colleges that we include. Therefore, at the moment, the trusts would be outside the scope of the initiative.
There are no other questions, so I thank you for your evidence, which we will look at later on.
Surely we should clarify that particular legal point. If two councils are not participating because they believe that, legally, they should not share the data, either they are right or all the other councils and bodies that are involved are right. How can we clarify that?
In the previous exercise, 89 bodies took part. By far the majority of the new bodies are central Government bodies. In Scotland, we are in the unique position that we can bring in many Scottish bodies because Audit Scotland audits them. That is not so much the case in England, but the move to the Cabinet Office will, we hope, bring in more central Government bodies from Westminster.
There are two data sets that apply to central Government bodies: payroll and creditors. We reviewed the bodies that we were not including on a materiality level to ensure that it was worth while bringing in the data sets. That was our process to bring in the additional 30 or 40 bodies.
I cannot see many more bodies or data sets that we could bring in, because we are almost full with what is worth bringing in. Whatever comes with the new devolved powers will be a new area to consider. The colleges are merged. They are getting a bit bigger, are being made more weighty and have bigger payrolls, which is why we are trying to bring them in.
We do not have any direct powers to mandate other areas. For instance, we cannot mandate data from registered social landlords; they would have to volunteer it. We will try and work with them in the next two years to determine whether we can bring in some of their data sets to match against our existing ones.
11:45
There must be a significant lack of attention to the fraud initiative by new bodies if the older ones are up to scratch on the issue and the newer ones are pulling them down. Can you identify some of the newer bodies that have, overall, led to the weakening of arrangements for central Government?
We have not moved to do that. That would involve our incurring legal costs. The two councils are the only ones in Scotland, England and Wales that are not taking part on that data set, although they take part on all the other data sets. As I have said, my priority is that they do something to prevent fraud, not necessarily that they use the NFI for each individual type of data.
My gut feeling is that there is still an issue. Those councils are out of step with everyone else, and they create a gap. You say that they work around that in other ways, but that is not readily evident—certainly not to the Public Audit Committee.
That is correct. Yes.
This whole area is incredibly important—I ask my questions in that context.
Some individuals and organisations will be concerned about the security of the transfer of their data and information to other sources. I have looked at your “Code of data matching practice 2010”—that shows how sad I can be—because I was genuinely concerned about security issues.
On page 11, under part 2, the code refers to
“Audit Scotland, the Audit Commission (including any successor body) and any firm undertaking matching as its agent”.
Are any firms in Scotland involved in the process?
Yes. We employ seven private firms to undertake audit work. With the exception of three of those firms, which do only a very little amount of work in the further education sector, we have all their payroll data—and Audit Scotland’s data—as part of the NFI data washing or processing. The big firms that take part in the NFI and Audit Scotland submit their payroll data.
Will you give me a flavour of which firms are involved?
The big firms are PricewaterhouseCoopers, Deloitte, KPMG and Scott-Moncrieff.
What checks and validation are undertaken by you with regard to the security of their facilities?
I am sorry, but we may have gone down a cul de sac. If I recall your question correctly, you were referring to the Audit Commission and firms that are—
Firms that are “undertaking matching”, effectively as your agents.
That particular paragraph refers, I think, to the private sector company that is used by all the agencies collectively to undertake the matching. We use our computer auditors to verify its security. Its security levels for the exercise are up to the same levels as those of the banks. In fact, it keeps a separate room for the data matching work. Its security levels are very high indeed; that is one of the primary criteria for employing that company in the first place.
That is good. What is it called?
The firm is called Synectics Solutions.
Synectis?
Synectics.
Okay. How do you spell that? Apologies. You do not need to answer that question—it is just that I might want to look at it.
I will move on to a separate area. I know that you have just asked the Scottish Parliament to provide you with data for a data matching exercise—all MSPs have been given a notice from the Scottish Parliament about that. When you are deciding who to bring in, how do you judge the value of the information that you will get, and how much might it cost that organisation to provide the information? I use the Scottish Parliament as an example because that request has just happened, but the same issue will arise for all other organisations.
12:00Previous
Section 23 ReportNext
Section 23 Report