Author: Shirley James
Company: Audit Scotland

The National Fraud Initiative in Scotland
Prepared by Audit Scotland
June 2014

Audit Scotland is a statutory body set up in April 2000 under the Public Finance and Accountability (Scotland) Act 2000. We help the Auditor General for Scotland and the Accounts Commission check that organisations spending public money use it properly, efficiently and effectively.

Summary
Key facts
£16 million 
Overall outcomes^1,2
127
Public bodies took part
832
Housing benefit frauds identified
3,851
Overpayments are being recovered
81 per cent
Bodies managed their NFI roles satisfactorily 

1.	For national reporting purposes, outcomes are collated as at 31 March 2014. Outcomes recorded by participants after this date are included in subsequent reports.
2.	Outcome figures referred to cover detected fraud, overpayments and error and include those already delivered as well as those that have been estimated where this is appropriate.

Key messages
1.	Public bodies spend billions of pounds of taxpayers’ money on the Scottish population, providing services and financial assistance to all citizens including those that need them the most. Systems underpinning public spending can be complex and errors can happen. Unfortunately, there are also some individuals who seek to exploit the systems and fraudulently obtain services and benefits to which they are not entitled. 
2.	Fraud does not recognise organisational or geographic boundaries. Data sharing enables bodies to match data internally and externally. Technology provides an efficient way to connect discrete data sets and therefore can limit gaps available for fraudsters to manipulate and help identify those that have. It also helps bodies to identify process improvements that can reduce future errors and the costs of correcting these errors. 
3.	Audit Scotland, working closely with public bodies, external auditors and the Audit Commission, has completed another major data sharing and matching exercise. The National Fraud Initiative (NFI) exercises make a significant contribution to the security and transparency of public sector finances by confirming that services are provided to the correct people and by reducing fraud and error. 
4.	Since we last reported on The National Fraud Initiative in Scotland in May 2012, outcomes valued at £16 million have been recorded and the cumulative outcomes from the NFI in Scotland are now at £94 million. These outcomes are a significant return to the public finances of Scotland at a time when public finances continue to be under pressure. Across the UK the cumulative total is now £1.17 billion. What cannot be measured, but is important, is the deterrent effect that undertaking regular data sharing and matching exercises has, such as the NFI. 
5.	The NFI 2012/13 involved 127 Scottish bodies across four sectors making this the largest and most diverse data sharing exercise since the NFI began. Scottish bodies submitted 599 data sets and these generated 382,137 data matches for further investigation. 
6.	There are 4,447 investigations still in progress and action is being taken to recover £4.5 million of overpayments.
7.	The benefits of data sharing and matching enabled bodies external to those who submitted the data to identify outcomes of £1.5 million.
8.	Most organisations take advantage of the opportunities provided by the NFI but some could act more promptly to investigate matches and therefore stop frauds and correct errors more quickly.
9.	The introduction of the Single Fraud Investigation Service (SFIS) has major implications for the resourcing of non housing benefits counter- fraud work. Councils should review their counter-fraud resources in light of this change and whether they are sufficient to deal with corporate fraud.
10.	The Cabinet Office will take over responsibility for the NFI team and web application from April 2015. Audit Scotland expects no impact of this change for the NFI 2014/15 exercise which is due to start in summer 2014. 
Recommendations
All participants
•	Audit Committees, or equivalent, should review the self-appraisal checklist at Appendix 2, Part A to ensure that they are fully informed of the planning and the progress being made by their officers investigating the NFI 2014/15 exercise.
•	All public audited bodies participating in the NFI should ensure that they maximise the benefits of their participation in the NFI. In particular, they should consider: 
	whether it is possible to work smarter on the NFI matches; reviewing the suggestions at Appendix 3 should help 
	using the NFI matches in conjunction with alternative matching services from other providers. 

Local authorities
•	Local authorities should take steps to retain or invest in sufficient capability, in the short and long term, to investigate non housing benefit fraud or corporate fraud, including relevant NFI matches, after the SFIS is introduced.
•	Local authorities that administer pension schemes and are not already using more regular data matching to deceased records should consider doing this.

Part 1
Background
the NFI supports the public sector in taking action to prevent and detect fraud and error

Key messages
1.	The NFI is linked to the statutory audit of participating bodies and the results are reported every two years by Audit Scotland.
2.	Data matching is an effective and efficient method to identify areas for further investigation by connecting discrepancies between different data sets. The powers to undertake data matching given to Audit Scotland enable it to cross entity boundaries and national borders.
3.	The success of the NFI comes primarily from the public servants who investigate the data matches and the external auditors who review their arrangements.

1.	Audit Scotland has coordinated another major counter-fraud exercise working together with a range of Scottish public bodies, external auditors and the Audit Commission to identify fraud and error. These exercises, known as the NFI, are undertaken every two years and are linked to the statutory audits of the participating bodies. The latest exercise (the NFI 2012/13) started in October 2012 and is now nearing completion. 
2.	The success of the NFI comes primarily from the public servants who:
•	investigate the NFI data matches 
•	identify and stop frauds and errors
•	recover overpayments
•	hold fraudsters accountable
•	improve their systems.
3.	The role of external auditors in the NFI is vital. They review and conclude on the effectiveness of local arrangements in terms of how well the NFI is integrated into counter-fraud polices. They also provide assurance on the progress being made on the NFI investigations. Auditor conclusions provide the evidence for Part 3. Helping to improve, holding to account.
4.	Exhibit 1 summarises the relationships and responsibilities within the NFI in Scotland.
5.	The NFI in Scotland is now well established and has been operating for over a decade since it was first piloted. The NFI enables public bodies to take advantage of computer data matching techniques to detect fraud and error. The NFI remains the largest national fraud detection and prevention scheme that can provide data matches within and between public bodies. Its key features are that it:
•	acts as a deterrent to potential fraudsters
•	identifies errors and fraud thus enabling appropriate action to recover money and/or press criminal charges
•	can provide assurances, similar to a regular health check, that systems are operating well and can also identify where improvements are required 
•	operates across boundaries between public bodies in different sectors and countries
•	represents value for money in terms of the efficiencies deliverable through centralised data processing and identifying targeted high-priority matches.
6.	The NFI works by using data matching to compare a range of information held on bodies’ systems to identify potential inconsistencies or circumstances that could indicate fraud or error which are called ‘matches’. A match does not automatically mean that there is a fraud or error and investigations are required to enable the correct conclusion to be drawn for each match. Bodies investigate these and record appropriate outcomes on a secure web application based on their investigations.
7.	For the NFI 2012/13 exercise Audit Scotland increased the number of bodies involved to 127, including a large further education college and a greater number of central government bodies. All data sets were mandated.
8.	Audit Scotland also includes data about its own employees and those of audit firms carrying out external audit work for the Auditor General for Scotland and the Accounts Commission.
9.	In total 599 data sets were submitted for data matching. These returned 382,137 matches and of these, 62,172 were identified as recommended matches, being matches with a higher risk of fraud or error. It is up to individual bodies to determine which and how many matches to investigate. Exhibit 2 provides some examples of the types of data set matches undertaken.
10.	In addition to the main matching exercise, a separate exercise has been undertaken to match electoral registers against those households where council tax single person discounts are being claimed. The data uploads took place in October 2011 and the results were provided to councils in January 2012 to investigate. 
11.	Across the UK only two councils, Angus and Perth and Kinross, decided not to upload data for this particular data match. The NFI is one of the proven ways by which councils can address fraud and error in this area. A number of councils also employ credit reference agencies to match single-person details against a wider range of data sets such as credit and utility records. 
12.	Audit Scotland carries out the NFI process under powers in the Criminal Justice and Licensing (Scotland) Act 2010. It is important for all parties involved that this exercise is properly controlled and data handled in accordance with the law. The governance arrangements for the NFI are summarised at Appendix 1.
13.	The NFI is important in the context of the economic climate and fiscal projections for future public sector expenditure. The NFI exercises make a significant contribution to the security and transparency of public sector finances by ensuring that services and benefits are paid only to the correct people and by identifying and reducing fraud and error.

Part 2
Impact and outcomes
Key messages
1.	Outcomes from the NFI 2012/13 are £16 million.
2.	£10.5 million have been identified directly from the NFI 2012/13 investigations.
3.	£5.5 million are further savings from the NFI 2010/11.
4.	4,447 investigations are still in progress.
5.	66 per cent (£4.5 million) of overpayments are being recovered.
6.	Cumulative NFI outcomes are now at £94 million.
7.	Across the UK £1.17 billion of NFI outcomes have now been recorded.

Outcomes 
14.	Since we last reported on The National Fraud Initiative in Scotland in May 2012 outcomes valued at £16 million have been recorded. Cumulative outcomes from the NFI in Scotland are now at £94 million and represent a significant return to the public finances of Scotland.
15.	The 2012/13 outcomes are split:
•	£10.5 million of outcomes from the NFI 2012/13 matches 
•	£5.5 million of outcomes from further follow-up work on the NFI 2010/11 matches.
16.	Exhibit 3 provides more detail of key outcome areas recorded by bodies as at 31 March 2014.
17.	Investigations from the NFI 2012/13 are ongoing. As at 31 March 2014, there were 4,447 investigations for this exercise still in progress. The evidence from previous exercises is that between reports, significant outcomes continue to be delivered. The last two NFI reports showed that:
•	39 per cent of 2010/11 outcomes arose after March 2012
•	30 per cent of 2008/09 outcomes arose after March 2010 
•	45 per cent of 2006/07 outcomes arose after March 2008.
18.	If this pattern is continued we could expect to see further outcomes in the region of £3 to £4.5 million from the NFI 2012/13. 
19.	Importantly, once overpayments have been identified, recovery action can be taken. As at 31 March 2014 there was £4.5 million of recovery action being taken in 3,851 cases.
20.	The NFI is more than the value of the financial outcomes recorded. Exhibit 4 sets out the main results from the 2012/13 matches.
21.	What cannot be measured directly is the value of the deterrent effect that the planned biennial NFI data matching has on potential fraudsters. Its significance should not be overlooked and is a key benefit to the Scottish public and taxpayers. 
22.	Overall outcomes are down on the last NFI exercise by 19 per cent in Scotland and 17 per cent across the UK. Late savings are consistent between exercises at £5.7 million for 2010/11 and £5.5 million for 2012/13. However, no obvious national trend can be assumed from the results of the last five NFI exercises because of changes in the scope of the NFI exercises, the number and variety of bodies participating and in the approach taken by bodies to tackling fraud and error.
23.	The most successful matches from the current exercise, excluding late savings, in terms of financial outcomes accounting for 78 per cent (£8.1 million) of the total (£10.5 million), are:
•	pensions – 36 per cent
•	housing benefits – 29 per cent
•	blue badges – 13 per cent.
24.	For this exercise Audit Scotland mandated creditor data from all participants which were previously optional. This has resulted in 105 creditor outcomes of £1.1 million for this exercise compared to 13 outcomes worth £15,000 in 2010/11. Recovery action is taking place for 54 of these overpayments. In other cases overpayments have already been returned or credit notes provided. 
25.	The largest drop is in the area of pension outcomes which are discussed in paragraphs 48–54. 
Matches benefiting other bodies
26.	One of the key benefits in undertaking a UK-wide data matching exercise is that it enables matches to be made between bodies and across national borders. Exhibit 5 summarises these for the NFI 2012/13 exercise for Scottish data submitted.
27.	The cross-sector scope of the NFI enabled 46 bodies to identify and take action on 717 outcomes worth £1.5 million. The majority are from cross-body housing benefits to other data sources such as student funding, payroll or pensions.
28.	In the main these related to other Scottish bodies but there were also 26 English councils and the Northern Ireland Housing Executive able to identify outcomes from Scottish data. For example, one London borough removed six housing applications from their waiting lists as they were found to be in receipt of housing benefit at five Scottish councils. 
29.	For those participating bodies or sectors taking part in the NFI who may not always identify significant outcomes from their own matches, it is important to appreciate that other bodies and sectors may. If we look at the payroll and pension data submitted by central government and the NHS we see:
•	central government bodies recorded direct outcomes of £1.7 million but also enabled £670,983 of outcomes to be identified at other bodies
•	the NHS has recorded direct outcomes of £211,865 but also enabled £195,999 of outcomes to be identified at other bodies.
Benefit outcomes
30.	The NFI provides councils with the opportunity to identify a wide range of benefit frauds and errors. The most common are caused by undeclared occupational pensions and undeclared earnings from public sector employment.
31.	Where other benefits such as income support and jobseeker's allowance are also in payment, councils liaise with the Department for Work and Pensions (DWP) and joint investigations may be carried out. The amounts in this report include these other benefits, where relevant.
32.	Exhibit 6 summarises the benefit outcomes from all the NFI exercises to date.
33.	This would indicate that there has been a decline in benefit outcomes in the last exercise. The possible reasons are:
•	previous NFI exercises have detected the most significant and longest-running frauds and errors 
•	the trend may demonstrate the exercise’s impact and local measures in deterring fraud 
•	the efforts of bodies to continuously improve their systems
•	that less resources are being used to follow up the NFI matches in councils.
34.	However, £2 million of the 2010/11 figure were recorded after the last NFI report in May 2012. If this trend is repeated then we would expect to see benefit outcomes at similar levels to the last exercise. 
35.	What is interesting is that the number of cases recorded with overpayments at 1,862 is slightly up on the previous exercise of 1,792. The individual value of overpayments has fallen from £3,303 to £2,694. This would indicate that resources are still being applied in line with previous NFI exercises and that it is the other three bullets outlined in paragraph 33 that are impacting on outcome levels. 
36.	Despite expected reductions, the continuing high levels of benefit outcomes are best explained by the increased number of bodies participating and supplying data in the 2012/13 NFI and the impact of the economic recession resulting in increased numbers of benefit claims. 
Student funding to housing benefit claims
37.	One of the most successful matches in terms of numbers and coverage is student funding to housing benefits. With a few exceptions, mainly lone parents and disabled students, students are not eligible for housing benefits. This match takes council data and matches against the Student Awards Agency for Scotland (SAAS) student funding data. 
38.	The match enabled 25 councils to stop 302 housing benefits payments worth £0.7 million to ineligible students. Given the prevalence of this, it is hoped that councils make use of the more regular NFI data matching available for this area.
Public sector workers and pensioners to housing benefit claims
39.	It is critical that the public has trust in its public servants. This match identifies errors and frauds that have taken place between public sector payrolls and pensions. By the end of March 2014 councils had identified benefit overpayments from their NFI 2012/13 matches relating to (2010/11 figures are in brackets):
•	1,089 (997) public sector pensioners
•	290 (322) local government employees 
•	131 (100) persons working in the NHS in Scotland
•	8 central government employees.
40.	While no overpayments are desirable, Exhibit 7 puts some of these figures into context in relation to the populations involved and it does provide some overall assurance that these areas do not have high levels of fraud and error.
41.	This exercise also included a further education college for the first time. While no outcomes were identified by the college there were five housing benefit overpayment outcomes identified by a council following up matches of their housing benefit (HB) data to the college payroll. 
42.	In terms of value, Glasgow City Council and East Dunbartonshire have so far achieved the highest levels of outcomes from their NFI 2012/13 benefits investigations (£454,256 and £299,610 respectively). A further eight councils recorded benefits outcomes in excess of £100,000. Only Shetland Islands Council recorded no benefit outcomes. 
43.	Another measure of success is the yield in terms of benefit outcomes to total housing benefit expenditure. Exhibit 8 provides details of the top three councils in terms of yield ranking. 
44.	East Dunbartonshire Council consistently performs well by this measure across all of the NFI exercises that have been undertaken. The DWP estimates that for HB payments made in 2012/13, 5.1 per cent was overpaid in 2012/13. 
45.	However, care must be taken when analysing these yield rankings as there are a number of factors that can influence movement. These factors are discussed later in this section. Generally councils need to consider whether finding significant outcomes indicate effective detection of fraud and error or whether improvements to controls within systems could be made to reduce errors. 
Housing benefits to licences
46.	These matches compare housing benefits data to council-approved licences granted to individuals to identify potential undeclared income. This has again proved to be a successful area for the NFI. Exhibit 9 summarises the results from this exercise.
47.	In our 2010/11 The National Fraud Initiative in Scotland report, the personal alcohol match generated the largest outcome, estimated at £536,995. Case study 2 further demonstrates how important cross-body data matching is in identifying the full extent of frauds being committed. The investigation was again initiated based on a match between personal alcohol licence and housing benefits payments. 
Pension outcomes
48.	The NFI provides pensions administering councils and the Scottish Public Pensions Agency (SPPA) with an efficient and effective means of checking that payments are only being made to living persons. The NFI 2012/13 helped these bodies identify 96 pensioners whose deaths had not been reported to them. Including other pension-related outcomes (for example, cases where early retirees have returned to work but not reported circumstances that require their pension to be reduced) and forward savings, the amounts for the NFI 2012/13 total £3.8 million. 
Scottish Public Pensions Agency
49.	The SPPA recorded outcomes of £0.85 million from its 2012/13 matches where 23 outcomes were identified which is a drop from 2010/11 outcomes of £4.4 million. In 22 of these cases recovery is in progress. Exhibit 10 summarises SPPA pension outcomes since the NFI started. 
50.	Obtaining up-to-date information on pensioners returning to work is a very difficult area, particularly on deceased data when one considers that the SPPA has members living in over 50 countries around the world.
51.	However, the SPPA is to be commended for embracing more regular data matching opportunities that have almost certainly led to a reduction in overpayments. It continues to work closely with the National Records of Scotland to reduce the number and in particular the length of pension overpayments through quarterly checks. It has also made use of the additional mortality screening available from the NFI outside the two-yearly cycles to identify further matches.
Local government 
52.	While SPPA outcomes are down, there has been an increase in local government-run pension scheme outcomes and these account for £2.9 million pension outcomes across 73 cases.
53.	There are 11 local government-administered pension bodies in Scotland and five returned outcomes. As in previous NFI exercises the majority of the outcomes from local government are in the:
•	Strathclyde Pension Fund (SPF) administered by Glasgow City Council which has a membership of over 197,000 and which recorded outcomes of £2.2 million. SPF administers about 42 per cent of all the local government pensions in Scotland. These outcomes were from 52 cases of which recovery action is taking place in 45.
•	Lothian Pension Fund administered by City of Edinburgh Council with over 65,000 members and which achieved outcomes of £0.3 million from three cases all of which are being recovered.
54.	Given the success in reducing outcomes that the SPPA has demonstrated, there is an opportunity for local government pension schemes to undertake more regular data matching either through the NFI and/or the National Records of Scotland. 
Blue badges
55.	The ‘blue badge’ scheme allows individuals with mobility problems, and who may have difficulty using public transport, to park free at on-street parking meters and pay-and-display machines. Holders are also allowed to park in designated blue badge spaces and may also be permitted to park on single or double yellow lines in certain circumstances. 
56.	Badges are sometimes used or renewed improperly by people after the death of the badge holder. The use of a blue badge by an unauthorised person is an offence. Importantly, by using a blue badge to park without need, the space is denied to people with real mobility issues. This is the true social cost of this type of fraud.
57.	Councils do not always attempt to recover a badge relating to a deceased person to avoid causing distress but, by ‘flagging’ the relevant records, they can at least ensure that badges are not improperly renewed in the future. By sharing information with other departments, councils can also recover valuable equipment and aids if they have not been informed of a person’s death.
58.	Scottish councils have reported correcting 2,876 (4,403 in 2010/11) blue badge records where the NFI helped them to identify that the holder was deceased. Edinburgh (992) and Scottish Borders Councils (338) collectively corrected over 1,328 records. Seventeen councils did not record any blue badge corrections compared to only ten in the 2010/11 exercise. 
59.	The Audit Commission first identified the problem of blue badge fraud in a report published in September 2009 and also in their subsequent annual Protecting the Public Purse reports. They identified how criminals falsify blue badges or steal genuine ones from cars, and how a blue badge can be sold on the black market for as much as £500.
60.	On 1 January 2012, the new Blue Badge Improvement Scheme (BBIS), procured by the Department of Transport as part of the Blue Badge Reform Programme, was made available to local authorities. The BBIS, which is being phased in over the next three years, is designed to help to prevent fraud and enable more effective monitoring of cancelled, lost or stolen badges. 
61.	These new arrangements are welcomed and the NFI will continue to undertake the deceased data matching to assist in identifying potential abuse of the badge scheme until these are fully in place. 
Council tax single person discounts
62.	People living on their own or with no countable^1 adults in the household are eligible for a 25 per cent Single Person Discount (SPD) off their annual council tax bill. The National Records of Scotland estimates that just under 38 per cent of households are entitled to a single person discount.^2
63.	Exhibit 11 provides an indicator of the scale of the discount value across Scotland when applied to average band D charge. This demonstrates that this discount is of considerable value and therefore it is of particular importance to ensure that awards are properly made.
64.	This NFI match is very simple in that it matches council tax records to the electoral register and a match is returned where a single person discount has been awarded but the electoral register indicates that another countable adult is living there. A letter can then be issued by council staff seeking clarification of household composition and initiate further investigations if required.
65.	There were 48,089 matches returned to the 30 Scottish councils that submitted data. Of these, 20 councils have processed 15,813 matches and recorded £2.5 million outcomes with 573 still being investigated. Some councils use additional data matching options to undertake this review and some do not record results on the NFI system. The average return of the 15,813 matches processed is £158 per match.
Other matches
Payroll
66.	The NFI matches data to identify cases of potential payroll fraud. But investigations can also lead, for example, to the discovery that employees are in breach of conditions of service or EU working time limits. Apart from other consequences, excessive working hours may pose public safety risks. 
67.	The NFI also matches payroll data to Home Office immigration data. It is unlawful to seek employment if you are not entitled to reside or work in the UK and the NFI provides bodies with a means of supplementing their recruitment checks.
68.	As a result of the 2012/13 matches, three public sector employees in Scotland have so far been dismissed or resigned after bodies confirmed that they did not have permission to reside or work in the UK. 
Student immigration checks
69.	Since the NFI 2006/07 the SAAS has been provided with its own matches, identifying cases where students may not hold valid permissions to reside or study in the UK. 
70.	SAAS has recorded ten cases of students that were found, after investigating the NFI matches with the Home Office, not to be entitled to receive support. This was because either these individuals were not entitled to be in the UK or they had lied about their personal circumstances. These students had received student support amounting to about £163,451.
Payments to private residential care homes
71.	The NFI matches information about private residential care home payments to data about deceased persons. This can identify where payments may be continuing for people who have died.
72.	The NFI helped councils identify 120 cases from these data matches and overpayments worth £22,150. The majority (99 per cent) of these overpayments are being recovered.
Right to Buy
73.	The NFI matches data relating to tenants that have bought, or are in the process of buying, their council property at a discount as part of the Right to Buy (RTB) scheme. The match, to housing benefit and other tenancy records, enables councils to identify potential cases where they may have been acting on false information provided in support of the RTB application. It also identifies change of circumstances such as the former tenant selling the property within the discount period. This means that some, or all, of the discount amount could be owed to the council. 
74.	The Audit Commission Protecting the Public Purse 2013 report identified a 168 per cent increase in detected RTB cases in England. In Scotland two councils have identified three RTB cases, for the first time, where applications for RTB have been withdrawn following investigations following the NFI matches. Had these ineligible applications been successful these valuable social housing lets would have been unavailable to eligible tenants and councils might have incurred considerable additional housing costs to rehouse these people. 
75.	The Housing (Scotland) Bill currently going through the Scottish Parliament intends to end RTB in Scotland. Until this happens, the NFI RTB matches will continue to highlight potential cases where ineligible applications are being made.
What bodies actually save or recover because of the NFI
76.	The estimated value of the NFI to the public purse since we last reported in May 2012 is £16 million. However, some of this represents overpayments that will never be recovered and estimated values that have been attached, for example, to cancelling a blue badge. These amounts may not translate into cash savings, but they are valuable outcomes nonetheless.
77.	Audit Scotland previously canvassed bodies and established from those that responded that the NFI overpayments are usually subject to the same recovery processes that apply to other debt. Most bodies do not keep separate records of the NFI recoveries. Indeed, Audit Scotland would prefer that bodies devoted their resources to investigation work, rather than require them to record the NFI amounts that are often recovered by frequent small payments over long periods of time.
78.	Based on the current NFI exercise the recovery rate is 66 per cent, excluding estimates. If we add the estimated forward savings from areas such as benefits and pensions, being public money which has been prevented from being paid out in fraud or error following investigations, we can reasonably estimate that the actual cash savings or recoveries for the public purse are at least half of the total outcomes of £16 million. 
79.	This then is an identified direct cost to public bodies and taxpayers where fraud and errors have taken place. There are also other costs that are incurred where frauds and errors are identified. These include:
•	the cost of investigating, correcting and recovering frauds and errors
•	the opportunity cost of investigating, correcting and recovering frauds and errors instead of providing services
•	the social cost of awarding incorrect benefits or proving ineligible services
•	the reputational cost of failing to prevent frauds or in making errors.
What does the level of outcomes tell us?
80.	The NFI impacts on a number of levels and across a number of bodies. These levels are summarised in Exhibit 12.
81.	A key benefit of the NFI is the fact that by identifying fraud and error the opportunity is provided to bodies to establish why they occurred and then improve their systems. This can be done by:
•	simplifying system processes 
•	reviewing and strengthening the internal controls that failed to stop or capture errors or fraud. 
82.	While it would be difficult to eliminate all errors and prevent all frauds the NFI can provide the focus for such reviews to take place. Exhibit 13 summarises the circumstances where fraud and error are most likely to be found.
83.	System complexity can result in errors made by either the individual wishing to obtain a service or by the public servant processing the data. Where an individual knowingly exploits systems and controls by providing incorrect information, this is fraud.
84.	The most effective approach to reduce the overall cost of fraud and error is to prevent it occurring in the first place. Both fraud and error can be reduced by public bodies establishing and maintaining sound systems of internal controls.
85.	Audit Scotland does not take a view on whether high levels of the NFI outcomes are a good result or not. High levels of outcomes could be due to increased fraud and error in the system or to poor internal controls in operation. 
86.	Equally important is the assurance given to these bodies with few matches that in the areas covered by the NFI, there do not appear to be significant problems and the deterrent effect created by the NFI exercise taking place and being communicated to those whose data is included.

Case study 1
An individual was sentenced to nine months in jail after being convicted for £70,000 benefit fraud. This fraud was identified from a NFI 2010/11 match between housing benefits and payroll. 
Investigators identified that the person had failed to inform the council and the DWP (as required by law) about earnings from a partner who moved in with them in 2005. For seven years, until March 2012, over £10,000 was stolen annually from public funds by this individual.
This type of outcome demonstrates the effectiveness and efficiency of using data matching to identify potential frauds. By linking benefits payments with payroll income to the same address it could be established that there was undeclared income requiring further investigation. Trained fraud officers can be used effectively to investigate and build cases before referral to procurator fiscal for prosecution.
Without data matching it would have been very difficult and expensive to identify this undeclared change of circumstance.
Source: Local Authority 

Case study 2
The NFI outcome for this case is £164,850.
An individual had a housing tenancy from Council A for which they also received housing and council tax benefit. The NFI data matches identified that they were also in receipt of a personal alcohol licence from Council B. This indicated that they were potentially working in the Council B area but not declaring any income. 
Following up this match the investigators confirmed that the individual was working but not declaring income and had also been living in the Council B area since 2006 but their daughter and grandchild were living in the Council A tenancy. 
The subject cancelled the tenancy and has since been reported to the Procurator Fiscal Service for benefit fraud totalling £38,850.78. The remaining element of the outcome is based on seven years' tenancy fraud at £18,000 per annum.1 
Note: 1. Based on the average cost of housing a family in temporary accommodation for a year (Protecting the Public Purse 2012, Audit Commission, November 2012).
Source: Local Authority

Case study 3
An overseas worker continued working after the expiry of their right to work visa in 2009 (they had been working at the health board legally since 2007). The value of the employee’s salary since 2009 was £77,290. Their contract was terminated in 2013.
Source: NHS

Case study 4
A student applied for funding to undertake a Diploma in Nursing. In their application, they stated that they had been born in South Africa and that their nationality was South African. They stated that they had been ordinarily resident in the UK for three years and had indefinite leave to enter or remain in the UK. 
The SAAS received a copy of the student’s residence permit showing that there was no time limit on their stay in the UK and processed the award accordingly.
The student’s data was matched against Home Office data as part of the NFI 2012/13 exercise. A full visa history from the Home Office stated that the student had no legal status in the UK. It also confirmed that the United Kingdom resident permit provided to SAAS to support their eligibility for funding was a false document (a photocopy).
The student has been paid a total of £8,832 to date. However, had the fraud not been picked up through the NFI, the total funding package would have been £26,372.
As part of the investigation into this student, it was discovered that the student’s partner had also provided false documentation to support their own application for student support. They had received a total of £17,138 to date.
SAAS officers interviewed both individuals under caution and submitted a case to the procurator fiscal. A trial date has been set for later this year. 
The Home Office is currently taking separate action against both parties. 
Source: Audit Commission NFI secure web application and SAAS

Case study 5
A student’s data was matched against Home Office data as part of the NFI 2012/13 exercise. A full visa history was received from the Home Office stating that they had a valid student visa between 1998–2002 but have had no legal status in the UK since 2002. This student has received a total of £53,806 student funding.
SAAS officers interviewed the individual under caution and submitted a case to the procurator fiscal. A trial date has been set for later this year. 
Source: Audit Commission NFI secure web application and SAAS

Case study 6
A Right to Buy to housing tenancy match highlighted a case where a person had lodged a Right to Buy application with one council despite them also holding a tenancy in a different council. The investigation confirmed that the tenant was also claiming housing benefit at the second address. 
The tenancy fraud officer confirmed with the tenant that they did indeed hold two tenancies. The tenant had not felt they had done anything wrong providing they paid the rent. They have since ended their tenancy with the council where they were not actually residing but their son was. The Right to Buy application has also been revoked and the council is preparing the case for prosecution. 
Source: Audit Commission

Part 3
Helping to improve, holding to account
Key messages
1.	81 per cent of participating bodies managed their roles in the NFI 2012/13 exercise satisfactorily.
2.	29 per cent of bodies need to follow up their matches more promptly.
3.	Over a third of participating bodies need to integrate the NFI into their corporate policies and strategies for preventing and detecting fraud and error.
4.	17 per cent of bodies reviewed were considered not to have deployed sufficient resources for managing the NFI.

Overall findings
87.	Local auditors concluded that 81 per cent of participating bodies had managed their role in the NFI 2012/13 exercise satisfactorily. However, a few showed scope for significant improvement. 
88.	Appendix 2 includes a two-part checklist that we encourage all bodies to use to self-appraise their involvement in the NFI prior to and during the NFI 2014/15 exercise. Part A is designed to assist audit committee members when reviewing, seeking assurance over or challenging the effectiveness of their body’s participation in the NFI. Part B is for officers involved in planning and managing the NFI exercise.
89.	Auditors also provided up-to-date information about each body’s NFI performance and progress at the end of December 2013. In reaching their conclusions, auditors do not attach significant weight to the value of the NFI outcomes achieved by bodies but do look to see that bodies have approached the exercise proportionately and effectively.
90.	While 81 per cent is slightly down on the 2010/11 exercise ratings, it continues to indicate a high degree of commitment to the NFI. Local auditors are providing strong assurance that all sectors are taking the NFI seriously by putting adequate arrangements in place. 
91.	The biggest change from the last exercise is that central government bodies have, overall, weakened arrangements in comparison with NHS (improved) and local government (stayed the same) sectors (Exhibit 14). 
92.	The central government sector had the greatest number of new bodies participating in the NFI 2012/13 and this, together with the diversity and size of new bodies, perhaps explains the weaker results and opportunity for improvement.
93.	Local government has the largest range of data sets and number of matches returned. It is not entirely unexpected, therefore, that they have been identified as having some scope to improve. 
94.	The NHS has improved its arrangements based on auditor returns and this is to be commended. 
95.	The majority of the officers directly involved in preparing for the NFI and following up matches demonstrate commitment, while 90 per cent of the officers nominated to coordinate the exercise were considered suitable for the role. 
Other key aspects of auditor reviews: 
•	89 per cent of bodies submitted their data on time
•	91 per cent of bodies gave priority to following up recommended matches
•	15 bodies were considered not to have deployed sufficient or appropriate resources for managing the NFI exercise.
Areas that need improvement
96.	Exhibit 15 summarises the key areas where local auditors indicated that there was room for improvement.
97.	Auditors will follow up these findings in those bodies where improvements were required as part of the 2014/15 NFI exercise. 
98.	Auditors confirmed that appropriate arrangements had been made for issuing fair processing notices to those individuals whose data was submitted for the exercise.
99.	Auditors reported that 11 per cent of bodies submitted data for the NFI 2012/13 after the specified processing deadline. This creates a need for another processing run at a future date, and thereby unnecessarily increases the cost of processing data. These bodies fell several months behind the other participants while waiting for their matches as well as causing other bodies to receive further matches. 
100.	Auditors reported that 21 per cent of bodies did not record their outcomes fully on the NFI secure website. Many could also improve the way they record their investigations and conclusions on the NFI application. Audit Scotland will work with colleagues in the Audit Commission to improve the clarity of recording requirements. Appendix 3 provides some help in this area. However, the likely effect is that the value of the outcomes referred to in this report is understated in some areas.

Part 4
Future of the NFI
Key messages
5.	The Cabinet Office is the new home of the NFI from 2015 and regards the use of data matching as an important tool in the prevention and detection of fraud.
6.	The 2014/15 NFI exercise is due to start in June 2014 and Audit Scotland expects a smooth transition.
7.	The next exercise will again look to expand the range of participating bodies and data sets.
8.	The NFI is increasing its opportunities for flexible and real time data matching options aimed at fraud prevention.
9.	The introduction of the Single Fraud Investigation Service (SFIS) has major implications for resourcing of council counter-fraud work. 

Cabinet Office
101.	Following the abolition of the Audit Commission it was recognised that certain key activities and services needed to be maintained. The NFI was recognised as one of these key areas and the Local Audit and Accountability Act (England) 2014 will transfer data matching powers and the Audit Commission’s NFI team to the Cabinet Office on 1 April 2015.
102.	These changes should have no direct impact in Scotland. Audit Scotland expects the same continuity of service for those taking part based on:
•	Audit Scotland having its own data matching powers conferred to it by the Scottish Parliament (Appendix 1)
•	the core NFI team with all its experience and support is being transferred
•	the third party contract for running the NFI web application will also transfer to the Cabinet Office
•	the positive talks held with the Cabinet Office and other national audit agencies on the future of the NFI.
Participating bodies and data sets
103.	Audit Scotland will continue to look at which bodies should be asked to submit data and which data sets. This exercise mandated the majority of data sets for the first time and expanded the number of bodies participating so it is unlikely that the number of bodies will increase significantly. It also brought in the further education sector for the first time and, given the housing benefit outcomes identified based on the payroll data from this one college, the participation for this sector may be expanded.
104.	In terms of data sets the direct payments made to eligible people for long-term social care support have been successfully piloted by the Audit Commission in England and will be considered for inclusion in the 2014/15 NFI exercise in Scotland for Scottish councils.
105.	The draft data specifications are available on the Audit Commission’s website and key contacts have been notified of these.
106.	There are some very large registered social landlords' tenancy databases that Audit Scotland would like to work with to ensure the eligible and most vulnerable are being housed. This would have to be provided on a voluntary basis but Audit Scotland sees it as an area where a positive impact can be made.
Single Fraud Investigation Service (SFIS)
107.	The introduction of the SFIS has major implications for resourcing of council counter-fraud work. In the near future many experienced and trained counter-fraud experts will move to the SFIS who will then investigate all welfare benefits. 
108.	The risk for local government bodies is that they do not adequately address this resource loss to ensure that sufficient capacity remains to counter other types of corporate frauds.
The NFI 2014/15 aims
109.	The overall aims of the NFI are to serve the public interest by: 
•	safeguarding public money against losses from fraud or misappropriation
•	contributing effectively to the fight against fraud. 
110.	To meet these aims the NFI 2014/15, which will be launched in June 2014, will involve work under three broad themes: 
•	Continuing with successful batch data matches and developing the service to offer more flexibility and meet new risks.
•	Putting more emphasis on fraud prevention through the development of real time data matching services.
•	Extending data matching for fraud purposes to a broader range of organisations and sectors.
111.	Audit Scotland looks forward to the next NFI exercise and continuing to work with the Audit Commission and Cabinet Office, other UK audit agencies and participating bodies to successfully deliver these aims.
112.	In the longer term the roll-out of Universal Credit is expected to have an impact on the data sets contributing to the NFI. The future direction of the exercise will be assessed at that time.

Endnotes

1.	For NFI data matching, individuals recorded as qualifying for council tax single person discount on the basis that they live with other disregarded adults are excluded. 
2.	Estimates of Households and Dwellings in Scotland, National Records of Scotland, 2012.

Appendix 1
Governance arrangements
Background
The following summarises the key legislation and controls governing the NFI data matching exercise.
Legislation
The NFI 2012/13 exercise was carried out under powers given to Audit Scotland for data matching included in the Criminal Justice and Licensing (Scotland) Act 2010 passed by the Scottish Parliament. Under this legislation:
•	Audit Scotland may carry out data matching exercises for the purpose of assisting in the prevention and detection of fraud or other crime and in the apprehension and prosecution of offenders 
•	Audit Scotland may require specified persons to provide data for data matching exercises. These include all the bodies to which the Auditor General for Scotland or the Accounts Commission appoints auditors, licensing boards, and officers, office holders and members of these bodies or boards
•	other persons or bodies may participate in Audit Scotland’s data matching exercises on a voluntary basis. Where they do so, the statute states that there is no breach of confidentiality and generally removes other restrictions in providing the data to Audit Scotland
•	the requirements of the Data Protection Act 1998 continue to apply
•	Audit Scotland may disclose the results of data matching exercises where this assists the purpose of the matching, including disclosure to bodies that have provided the data and to the auditors appointed by the Auditor General for Scotland and the Accounts Commission
•	Audit Scotland may disclose both data provided for data matching and the results of data matching to the Auditor General for Scotland, the Accounts Commission, the Audit Commission, or any of the other UK public sector audit agencies specified in Section 26D of the Public Finance and Accountability (Scotland) Act 2000, for the purposes described above
•	wrongful disclosure of data obtained for the purposes of data matching by any person is a criminal offence
•	Audit Scotland must prepare and publish a Code of Practice with respect to data matching exercises. All bodies conducting or participating in its data matching exercises, including Audit Scotland itself, must have regard to this code
•	Audit Scotland may report publicly on its data matching activities.
Code of data matching practice
The Criminal Justice and Licensing (Scotland) Act 2010 includes important data-protection safeguards such as a requirement for Audit Scotland to prepare a Code of data matching practice, and to consult with the UK Information Commissioner and others before publication. Our code, The Code of data matching practice 2010, was updated in November 2010 to reflect the new legislation and to ensure that the NFI exercises continue to comply with data protection requirements and best practice in notifying individuals about the use of their information for the NFI purposes. 
The NFI web application
Bodies access the application via the internet using password access and encryption controls similar to internet banking. The secure website is the safest method of providing the data matches to bodies. The Audit Commission regularly reviews the application and implements developments to improve its functionality, ease of use, and security.
Interactive training was available to participating bodies and auditors via the web application to support the Audit Commission and Audit Scotland Guidance.
Security review and accreditation
The Audit Commission’s NFI system is accredited to government standards1 and is subjected to regular stringent security review. This covers infrastructure, information storage, handling and processing when under the control of the Audit Commission’s data processing contractor and the NFI team. The review was undertaken by a consultant from the National Computing Centre (NCC) who confirmed compliance with government information standards. 
This accreditation involved demonstrating to key government departments that the NFI is suitably secured and that information risks are managed to government standards. The NCC also undertook independent penetration testing of the NFI systems and concluded that the NFI was ‘…well implemented and robust from a security perspective’.
As well as regular internal reviews by the Audit Commission, the other UK audit agencies (ie, Audit Scotland, the Wales Audit Office, the Northern Ireland Audit Office and the National Audit Office) now also share a programme of independent audits of the different aspects of the NFI data security. The Information Commissioner’s Office has also conducted an NFI data security audit at the invitation of the Audit Commission.
All of these measures provide current and future NFI participants with assurances that data is processed according to rigorous government security standards.
The National Fraud Initiative (NFI) system has undergone accreditation against HMG Information Assurance Standard No.1&2.

Appendix 2
Self-appraisal checklist

Part A:
for those charged with governance

Yes/No/Partly

Is action required?

Who by and when?

Leadership, commitment and communication
1.	Are we committed to NFI? Has the council/board, audit committee and senior management expressed support for the exercise and has this been communicated to relevant staff? | | |
2.	Is the NFI an integral part of our corporate policies and strategies for preventing and detecting fraud and error? | | |
3.	Are the NFI progress and outcomes reported regularly to senior management and elected/board members (eg, the audit committee or equivalent)? | | |
4.	Where we have not submitted data or used the matches returned to us, eg council tax single person discounts, are we satisfied that alternative fraud detection arrangements are in place and that we know how successful they are? | | |
5.	Does internal audit, or equivalent, monitor our approach to NFI and our main outcomes, ensuring that any weaknesses are addressed in relevant cases? | | |
6.	Do we review how frauds and errors arose and use this information to improve our internal controls? | | |
7.	Do we publish, as a deterrent, internally and externally the achievements of our fraud investigators (eg, successful prosecutions)? | | |

Part B:
for the NFI key contacts and users

Yes/No/Partly

Is action required?

Who by and when?

Planning and preparation | | |
1.	Are we investing sufficient resources in the NFI exercise? | | |
2.	Do we plan properly for NFI exercises, both before submitting data and prior to matches becoming available? This includes considering the quality of data. | | |
3.	Is our NFI key contact (KC) the appropriate officer for that role and do they oversee the exercise properly? | | |
4.	Do KCs have the time to devote to the exercise and sufficient authority to seek action across the organisation? | | |
5.	Where NFI outcomes have been low in the past, do we recognise that this may not be the case the next time, that NFI can deter fraud and that there is value in the assurances that we can take from low outcomes? | | |
6.	Do we confirm promptly (using the online facility on the secure website) that we have met the fair processing notice requirements? | | |
7.	Do we plan to provide all NFI data on time using the secure data file upload facility properly? | | |
8.	Do we adequately consider the submission of any ‘risk-based’ data-sets in conjunction with our auditors? | | |
9.	Have we considered using the real-time matching (Flexible Matching Service) facility offered by the NFI team to enhance assurances over internal controls and improve our approach to risk management? | | |
Effective follow up of matches | | |
10.	Do all departments involved in NFI start the follow-up of matches promptly after they become available? | | |
11.	Do we give priority to following up recommended matches, high-quality matches, those that become quickly out of date and those that could cause reputational damage if a fraud is not stopped quickly? | | |
12.	Do we recognise that NFI is no longer predominantly about preventing and detecting benefit fraud? Have we recognised the wider scope of NFI and are we ensuring that all types of matches are followed up? | | |
13.	Are we investigating the circumstances of matches adequately before reaching a ‘no issue’ outcome, in particular? | | |
14.	(In health bodies) are we drawing appropriately on the help and expertise available from NHS Scotland Counter Fraud Services? | | |
15.	Are we taking appropriate action in cases where fraud is alleged (whether disciplinary action, penalties/cautions or reporting to the procurator fiscal)? Are we recovering funds effectively? | | |
16.	Do we avoid deploying excessive resources on match reports where early work (eg, on recommended matches) has not found any fraud or error? | | |
17.	Where the number of recommended matches is very low, are we adequately considering the related ‘all matches’ report before we cease our follow-up work? | | |
18.	Overall, are we deploying appropriate resources on managing the NFI exercise? | | |
Recording and reporting | | |
19.	Are we recording outcomes properly in the secure website and keeping it up to date? | | |
20.	Do staff use the online training modules and guidance on the secure website and do they consult the NFI team if they are unsure about how to record outcomes (to be encouraged)? | | |
21.	If, out of preference, we record some or all outcomes outside the secure website have we made arrangements to inform the NFI team about these outcomes? | | |

Appendix 3
How to work more efficiently
Concerns | How to work more efficiently
Many participants are not using the latest time-saving enhancements to the NFI software. | Ensure staff within the organisations that take part in the NFI keep up to date with new features of the web application and good practice by reading the guidance notes and watching the online training modules before they begin work on the matches.
Matches that are time critical and could identify an overpayment are not acted on first. | Key contacts should schedule staff resources so that time-critical matches, such as housing benefit to students and payroll to immigration, can be dealt with as soon as they are received.
Investigations across internal departments are not coordinated resulting in duplication of effort or delays in identifying overpayments. | Key contacts should coordinate investigations across internal departments and, for example, organise joint investigation of single person discount matches involving housing benefit, to ensure all relevant issues are actioned.
Disproportionate time is spent looking into every match in every report. | Use the tools within the web application, such as the filter and sort options or data analysis software, to help prioritise matches that are the highest risk. This will save time and free up staff for the most important investigations.
Enquiries from other organisations that take part in the NFI are not always responded to promptly. | Prioritise responses to enquiries from other organisations so investigations can be progressed.
Data quality issues that are highlighted within the web application are not addressed before the next NFI exercise. | Review the quality of the data supplied before the next exercise as external providers normally have to phase in changes to extraction processes. Better data quality will improve the quality of resulting matches.