Public Audit Committee

Meeting date: Wednesday, June 6, 2012

Official Report 354KB pdf

---

“The National Fraud Initiative in Scotland”

Item 2 is on the Audit Scotland report “The National Fraud Initiative in Scotland”. The report is not formally laid before Parliament, so the nature of our business this morning is a briefing from Robert Black and Russell Frith.

Thank you, convener, and good morning, ladies and gentlemen. The national fraud initiative is a major data-matching exercise that has been running now for almost 10 years, having started with a pilot back in 2003. This is the fourth time that this major exercise has been undertaken and reported on to Parliament.

The project is overseen in Scotland by Russell Frith, the assistant auditor general, and his team. With your agreement, convener, I will pass over to Russell to give you a brief outline of the key features of the project this time round.

By all means.

Thank you. As Bob Black said, the national fraud initiative is a biennial data-matching exercise that Audit Scotland runs and co-ordinates in Scotland. It mirrors similar exercises that are conducted in England, Wales and Northern Ireland by the audit agencies there. In England it is run by the Audit Commission, which also oversees and co-ordinates the exercise as a whole and arranges for the data matching to take place.

Eighty-one Scottish bodies took part in the 2010-11 exercise, which is all local authorities, health boards and a number of central Government bodies. Previous exercises have taken place using auditors’ implied powers to access information at audited bodies, but that proved a stumbling block to getting as much information as we would like.

The Criminal Justice and Licensing (Scotland) Act 2010 gave Audit Scotland explicit data-matching powers to obtain the information to run exercises such as this. It is the first one under the new powers, which is why we have been able to bring in a number of central Government bodies this time, including the Scottish Government. We would have brought in more central Government bodies, but the act came in only a few days before the data collection date, so we were able to go for only the biggest bodies this time. We hope to involve a larger number of central Government bodies for the next exercise.

The exercise works by the bodies providing data to a central data-collection point. They provide payroll, pension and benefits data, which is then matched by running various computer programmes, and a list of matches is then made available to all the participating bodies on a secure website.

The committee may remember that there were a number of issues around secure public sector data being lost a few years ago. The NFI overcomes that by not transmitting any data in any form but providing access to it on a secure website.

The audited bodies get their list of gross matches, and they also get some filters and some recommended matches. What that means is that we provide tools by which they can identify the matches that are most likely to yield results. We ask the bodies to concentrate on those matches and investigate them to see whether fraud or error has taken place.

Just because there is a match does not mean that there is a presumption of fraud. In several cases, there can be perfectly valid reasons for matches taking place. For example, students are generally not entitled to claim housing benefit, but if you are a student with dependants, there are circumstances in which you could be eligible for housing benefit. That is an example of something that would come up on a match initially but is not likely to be fraud or error.

The bodies follow those through and record their results. We gather that information together and that is what forms the basis of the report to Parliament.

Various matches can take place. Housing benefit is matched against public sector payrolls and pensioner records. What we are looking for there is benefit claims that are made without income being declared. In the history of the national fraud initiative, that is one of the matches that have yielded the most by way of outcomes.

We compare pensioner records with the Department for Work and Pensions records of deceased persons. It is quite common for pension payments to continue when someone has died if the pension scheme has not been notified.

We compare blue badge records against deceased persons. In that case, we are looking to stop the abuse of blue badges. In certain circumstances, blue badges can be quite valuable, particularly in London where they get you exemption from the congestion charge. They are also valuable in enabling people to park where they should not. What we are doing there is ensuring that only those blue badges that pertain to people who are still living are valid and in existence.

We compare records of employees, particularly against things such as information about failed asylum seekers or expired visas. That tends to yield a small number of matches.

As you can see from the report, the outcomes are many and varied. More than 4,000 blue badges were stopped and 1,500 housing benefit payments were stopped or reduced. We think that 318 housing benefit frauds were stopped, and 45 cases will be prosecuted. Ten employees were dismissed or resigned.

Apart from those sorts of outcomes, the initiative provides positive assurance to bodies that their records on employees and pensioners are good. If an organisation does not have a lot of matches, we do not see that as a bad outcome. Where there are no matches, it provides a level of assurance.

I will say a bit about the future of the exercise. As Bob Black said, we have run it four times. The 2012 exercise will start in the coming months and continue very much in the same line as the previous four.

After that, though, there will need to be some changes to the NFI. As you may know, the Audit Commission, which administers the exercise centrally and provides the key support, will be abolished at some point and is already slimming down its organisation substantially.

Also, housing benefit, which is one of the key data sources and indeed was the origin of the NFI, is due to be phased out over a four-year period starting next year. After the next exercise, we will need to look carefully at how the exercise continues in future.

I am happy to take questions.

Thank you very much. I will start by asking a couple of questions about not so much the scale of the exercise, which I will come on to, but the scale of the results.

Russell Frith said that one of the positive outcomes of the NFI was assurance that data sets were working properly and as they should. The report suggests that the total estimated fraud in the UK in central Government departments—the departments that the initiative is concerned with—is £6.3 billion per annum. A calculation made using the normal proportion would indicate that there is estimated to be £0.75 billion of fraud in Scotland. The return from the NFI is £19.8 million, so the implication is that the exercise only scratches the surface. Is that a fair comment?

In terms of total fraud, yes. However, I should say that the NFI looks only at certain limited areas. For example, it does not look at the tax credit system or at the big benefit areas such as income support, which are centrally administered from Westminster. It can look only at the data sets that originate in Scotland and are managed by Scottish public bodies.

The return from the NFI is a relatively small amount but, given that it costs about £200,000 to run, that is still a pretty good return on the investment. As I say, some of the largest areas of expenditure, which give rise to a significant element of the £6.3 billion of central Government fraud, are ones that are not administered by Scottish bodies.

You said that your intention in the fifth NFI—the next one—is to extend the areas and the data sets that would be included. You also said that that exercise essentially starts now. Can you provide a little more detail about where you want to go that you have not been before?

Predominantly, we intend to extend the number of central Government bodies in Scotland that are involved this year. Only six bodies in Scotland took part this time and we envisage putting the figure up to somewhere in the 20 to 30 range. It is not cost effective to include the very tiniest bodies, but we expect to bring in the majority of agencies and non-departmental public bodies this time.

What are examples of the bodies that you might expect to be brought in?

An example of such a body is the National Library of Scotland, which the committee discussed not so long ago.

Like many others, when I read the report, I was a wee bit shocked that the highest figure for fraud, 4,403, is for blue badges for disabled people. Those cases account for almost half the results—9,279 cases. I was also surprised that blue badges can be sold for £500.

Paragraph 45 states:

“The use of a blue badge by an unauthorised person is an offence.”

Given that 4,403 blue badges have been stopped or flagged up, why have only 45 cases been prosecuted? That is the figure for the total number of prosecutions, and not just prosecutions relating to blue badges. I am amazed by the low number of prosecutions.

The important thing for most local authorities is to stop the blue badges and flag them up once they realise that they are no longer valid. In the majority of cases, I suspect that those badges have not been abused but belonged to people who have died and the badge has been thrown away or left in a drawer. We are not trying to suggest that every outcome from this exercise is automatically a fraud or abuse; we are trying to improve the data sets. I would therefore not expect there to be a huge number of prosecutions in relation to the total number of outcomes.

Having said that, I agree that 45 is a relatively small number. However, local authorities have many other sanctions short of prosecution that they can apply. In benefit cases, they can levy administrative penalties and concentrate on recovering the money, particularly where there might be some doubt about whether fraud would be successfully prosecuted. It is not an easy offence to prosecute successfully and, for relatively small amounts, there are often more cost-effective ways of recovering the money for the public purse.

10:15

Exhibit 4 shows the total number of cases. I do not have a legal background, but it seems to me that surely some of the 9,279 are illegal, yet there have been only 45 prosecutions. It seems to me as an outside person looking at the figures that people think that they can use granny’s blue badge for a few years because not much is going to happen to them. That does not send out a signal that it is a bad thing to do and that measures will be taken against people who do it.

That oversimplifies the situation. As I have said, councils and prosecutors will take other issues into account. I do not doubt that more cases than that—although I do not know how many—are referred to the prosecutors, but the final decision about whether to instigate a prosecution is for the prosecutor to take.

I will leave that point there, convener.

I am looking at exhibit 12 on page 15. I know that we are not quite sure about the future and whether the NFI is going to continue, as discussed in paragraph 84. However, exhibit 12 does not really give me a lot of confidence that the issue is being examined and scrutinised as well as it should be. For example, 41 per cent of bodies have no internal audit monitoring of the NFI approach and outcomes to ensure that weaknesses are addressed. Almost half of the bodies that Audit Scotland is looking at do not have any internal monitoring. That does not give me a lot of confidence in the system.

That is why we have the external auditors monitor what bodies are doing and, when they come up with findings like that, they can keep putting the pressure on the audited bodies to make sure that they are, at least, investigating the most high probability matches. I agree that some bodies could take a more positive attitude to fraud prevention and detection.

To build on the point that Russell Frith is making, one of the key findings is that the auditors are reporting to us that 85 per cent of the bodies that are covered have satisfactory systems in place. In any individual body, internal audit is a scarce resource, and a well-managed body will be looking at relative risk across all its activities, which are, of course, very extensive in local government, for example. It might therefore be that if systems are sound, there is no need for internal audit to be involved. It is also correct that external audit and Audit Scotland remind people of the importance of looking at their situation from time to time. Our finding is that one should not read too much into the statistic about lack of internal audit coverage, given the bigger picture, which is that most bodies are managing the process relatively well.

Okay. I am surprised that the fraud and error policies are not integrated.

My final point concerns paragraph 84, which says:

“There are on-going discussions about which organisation is best placed to enable the NFI to be most effectively delivered once the Audit Commission is wound up. There is every indication from government that it will continue and be expanded in the future.”

That does not sound like there is a stable, concise and secure path. There seems to be a bit of uncertainty. I would have thought that it would be important to have a level of certainty. Can you clarify the situation?

I entirely agree. We have been making representations to the other UK bodies, as have some of the other audit agencies, because we all see a need to get a secure future for the NFI as quickly as possible.

It appears that the Audit Commission is not going to disappear quite as quickly as was first thought, which perhaps gives us a little more time. However, the key issue is the future involvement of the DWP, in that access to benefit information has been one of the key data sources for the NFI since it started. The abolition of housing benefit and the devolution across the UK of the replacement for council tax benefit mean that that issue must be fixed before we can see whether a body such as the DWP might be the best home for the NFI in future or whether that might be something like, for example, the National Fraud Authority.

I want to follow that up with regard to scale. Obviously, we have here the proper figures for the NFI in Scotland but, just for comparison, what are the equivalent figures in terms of outcomes across the UK?

The value of outcomes was £6 million in Wales and £225 million in England, I think.

The outcomes in England are quite significant.

The figure that I have for the national fraud initiative in England is £229 million. Is that correct, Russell?

Yes.

Are you satisfied that the Audit Commission is still in a position to deliver on the next NFI—the fifth—although, as you indicated, it has been slimming down as it moves towards disappearing altogether?

Yes, the team is in place for the next exercise.

My question has been partly answered in reply to Mary Scanlon. In a previous role, I dealt with licensing issues in the City of Edinburgh Council, although those did not necessarily involve liquor-licensed premises, which I assume are what we are talking about in this context. At the time, I was frustrated by the fact that when some people applied for private-hire taxi licences and so on, the fact that they were ineligible to work for whatever reason—their visa had run out or whatever—came up only after a police check, at which time they would be dealt with.

Are we considering the issue in such general terms that we forget that we are talking about only 15 per cent of the overall figure, and that there is a massive amount that is not being cross-referenced and cannot be checked terribly easily, even within the local authority realm? If so, do we need to consider the complete integration of how we check up on public sector financing in relation to licensing and benefits? Is there any way in which that can be done?

It would certainly make public administration much easier if all forms of contact with public authorities on matters such as licensing could be cross-checked in real time when the licence application was first submitted.

There are some moves towards that approach. One of the areas that the Audit Commission team is looking at is whether it can offer some of the data matches in real time. We will have to see whether that is technologically and economically possible, but that is certainly the direction that we would like to go in.

There are examples of moves in that direction, such as the good practice example in the report from Perth and Kinross Council. Following some good results from previous NFI exercises, the council has introduced processes that involve cross-checking the registrar’s records of people who have died each week with its blue badge records. In that way, it is making what was a cold check that took place after the event into something that is much closer to a real-time part of its management processes. I would encourage all audited bodies to move in that direction.

It seems that information is being brought into the centre for discussion. Has a stronger way been found of checking out whether somebody who drives a private-hire car, for instance—I am rather paranoid about the subject, I have to say—is entitled to be in the country or to work here, or, beyond that, to claim housing benefit? Rather like colleagues, I think that we are only scratching the surface.

I agree. However, when we are devising initiatives such as the NFI we have to be quite careful of the data protection legislation and ensure that we work within that at all times.

Good morning. My question largely follows on from Colin Keir’s and has probably also been answered in part by the reply to Mary Scanlon’s questions.

To return to exhibit 4, does the disparity in results reflect the relationship that the NFI has with various partners? The result that I am looking at in particular is the 16 invalid student UK visas. As an MSP, I find the UK Border Agency notoriously difficult to work with, although that is perhaps part and parcel of the situation. Does the NFI also have difficulty working with such bodies, or do we just accept that we have a low number of invalid student UK visas?

The NFI is, of course, only one part of the control mechanism for invalid student visas—the Student Awards Agency has its own processes that it goes through when it receives an application. The NFI is trying to act almost as a sweeper and pick up anything that might have been missed in that area, comparing information against a probably more up-to-date data set than was available at the time of application. However, that is one of the areas where getting firm data is the most difficult because it keeps moving.

In answer to a previous question, you said that the big outstanding issue was to secure a closer relationship with the DWP and to see how you can work together. Where are you with the discussions on that?

All that I can say is that discussions are on-going between the DWP and, in particular the Department for Communities and Local Government, but also, I believe, with some of the devolved Administrations. Access to DWP information is becoming critical to the design of the replacement for council tax benefit, and that is an issue that affects all the Administrations.

Precisely, and it would be a bit disconcerting if progress was not being made in the discussions given that I imagine that you have been having them for a while. It would be most helpful if you could comment on whether progress was being made.

I cannot comment, other than to say that discussions are taking place.

I would like to clarify what is meant by the language that you used in the report. The report refers to £19.8 million in “Outcomes from NFI”. Does that mean savings to the public purse?

Essentially, yes.

Essentially?

Both past and future.

So the savings are not over one financial year; they may be over a number of financial years.

Yes.

To what period of time does the cumulative figure of £78 million apply?

A large number of years. Where a pension is cancelled, for example, we assume the value of savings a number of years into the future.

10:30

So the figure is cumulative, but there is no timescale. I am simply trying to understand how much we are saving, year on year, through the exercise, but it is not possible to clarify that. Perhaps the question is unfair.

It is not possible from the way that we calculate.

My understanding is that the estimated financial outcome from the previous exercise contains an element of projection of what is expected to come through once the follow-up has taken place. In a sense, there is a bit of a projection as well as a look back to get the figure. Is that fair?

There is a projection for some future savings, but they are all from cases that we know about.

Thank you.

On the convener’s point about scratching the surface, I think that you said earlier that the overall projected figure for public sector fraud for Scotland is approximately £630 million, if we Barnett the total figure for the UK. I appreciate that there are lots of ups and downs in that regard. You rightly made the point that that covers all public sector expenditure in Scotland, including by UK-wide bodies. What is the split in respect of that £630 million? Is it possible to split out the responsibilities of the UK bodies and Scottish bodies in that assessment?

I do not think that that is possible from the source that the figure came from. It is a National Fraud Authority estimate.

Has any work been done on that? In other words, do we know what the projected fraud is per year in areas for which the Scottish Parliament has responsibility?

I am not aware of that work, if it exists.

Would it be useful to know that? Would it help you to know that? To judge from the look on your face, the answer is “not particularly”.

It would be marginally useful, but I suspect that the cost of producing a reliable estimate would probably outweigh its usefulness.

But do you get my point? I find it interesting that, as an MSP, I do not know what your projected fraud figure is for the devolved bodies for which the Scottish Parliament has responsibility and therefore what we should do about it. Am I simply barking up completely the wrong tree?

It is fair to say that the national fraud initiative covers most of the devolved bodies in Scotland, and as Russell Frith indicated earlier, the number of bodies that will be covered will increase as a result of the legislation that the Parliament passed a couple of years ago. The main areas that are not covered are DWP expenditure and matters to do with taxation and customs and excise. Inappropriate payments of receipts might occur in those areas in Scotland, but they are administered centrally and the Parliament has no jurisdiction over them. The message that we would like to give you is that the exercise has validity for most of the devolved functions for which the Parliament has responsibility, and we have been able to extend coverage progressively.

I totally accept that. However, although we understand that a wider number of bodies are covered—you illustrated in your opening remarks that the number will get bigger again—we do not know what the quantum is.

We do not know a total for Scotland across all Government functions. That is correct.

But should we?

It might be useful to have an indication of that, but I caution you about even the “Annual Fraud Indicator” that the National Fraud Authority produces. If you read the footnotes to all the estimates, you will see that most of them are very broadbrush estimates. The NFA is trying to refine that.

Right. I am suitably cautioned, convener.

Paragraph 8 of the report says that 81 bodies took part in the 2010/11 NFI. Can I assume that 32 local authorities and 15 health boards took part? I assume that all the main public bodies in Scotland take part in the exercise, but we have many other public organisations in Scotland. Can you give me any indication of how many are not included in the exercise?

In total, we audit just over 200 public bodies.

So 81 out of the 200 are in it.

Yes. However, that said, those that are in it have the vast majority of employees and spend the vast majority of the money.

Sorry to interrupt, Mr Scott, but two local authorities refuse to take part in the exercise—is that correct, Mr Frith?

They do not take part in one aspect of the exercise—the single person discount matching for council tax. They take part in the housing benefit and employee aspect.

Do you want all 200 bodies to be in the exercise or are some of them simply too small for it to be worth the candle, as it were?

Yes, some of the bodies are too small.

So what would Audit Scotland aim for overall?

Probably we would want to get somewhere around 110 bodies involved—120 at the outside.

Exhibit 4 was mentioned earlier. There is a £200 million budget—or however much it is now—for the concessionary fares scheme. It is a large area of public expenditure in Scotland, as I well remember.

Exhibit 4 states that 2,731 concessionary travel fares were stopped. Have some trends or reasons for that come to light as the exercise has been undertaken?

We have not become aware of any particular trends in that area. It is a bit like blue badges—an element of data set cleansing is coming out of the exercise rather than there necessarily being abuse.

Tell me what data set cleansing is, because I would love to hear a definition of that.

It is about making sure that the records of local authorities and other public bodies are up to date and accurate.

Thank you.

Does the concessionary fares issue that Tavish Scott mentioned simply relate to people claiming concessionary travel fraudulently or does it relate to fraudulent claims by the bus companies?

It does not relate to claims by the bus companies at all. It relates entirely to the issue and operation of passes.

I am glad that you said that—I thought that that was the case but I wanted to check with you.

My question relates to how we get to where we want to be with this. You have said all along that this is all a result of data matching—that it is entirely a data-matching exercise.

Over the past five years the committee has had long and weary discussions about poor data management in Scotland’s public services, which prevents us from drawing conclusions about this, that or the other. Can we say that poor data collection across Scotland impacts on your ability or on the NFI’s ability to seek redress for fraudulent claims on the public purse?

By and large, I do not think that that is something that has impacted on the NFI. That is partly because before a data set is brought into the NFI it is pilot tested in a small number of local authorities somewhere in the United Kingdom to ensure that we can do it right across the piece. As yet, I am not aware of any instance of the accuracy level of a data set being found to be so poor—that it was throwing up so many false matches—that we could not continue with trying to bring it in.

Nothing within the NFI processes would identify concessionary fares fraud. They are usually discovered when an elderly person comes to a local member with a ticket that is overstaged, for example. The systems, including data-matching systems, would never pick up such frauds.

How do we extend the scope of the NFI’s work? Should we broaden its scope beyond what seem to be simple data-matching exercises, to look at the wider issue of how fraud occurs in society and to consider where further savings can be made?

You mentioned—the convener commented on this, too—that this is the tip of the iceberg. That tells me as an elected member that there is potential to widen the scope of the activity to try to recover some of the sums that have been fraudulently claimed from the public purse.

That may well be a perfectly valid objective, but it would not be one that necessarily sat very well within the NFI. Its strength is very much the collection and matching of large data sets—the sort of thing that is difficult for people to do manually. As an objective, it could be looked at in parallel to the NFI, perhaps, but not as part of it.

Okay.

As no other members wish to comment, I thank Mr Frith and Mr Black. We will consider later how to take forward the report.

10:40 Meeting continued in private until 11:06.