Author: Shirley James
Company: Audit Scotland

Supplement
The National Fraud Initiative in Scotland
Self-appraisal checklist
Prepared by Audit Scotland
June 2014

Part A:
for those charged with governance

Yes/No/Partly

Is action required?

Who by and when?

Leadership, commitment and communication
1.	Are we committed to NFI? Has the council/board, audit committee and senior management expressed support for the exercise and has this been communicated to relevant staff? | | |
2.	Is the NFI an integral part of our corporate policies and strategies for preventing and detecting fraud and error? | | |
3.	Are the NFI progress and outcomes reported regularly to senior management and elected/board members (eg, the audit committee or equivalent)? | | |
4.	Where we have not submitted data or used the matches returned to us, eg council tax single person discounts, are we satisfied that alternative fraud detection arrangements are in place and that we know how successful they are? | | |
5.	Does internal audit, or equivalent, monitor our approach to NFI and our main outcomes, ensuring that any weaknesses are addressed in relevant cases? | | |
6.	Do we review how frauds and errors arose and use this information to improve our internal controls? | | |
7.	Do we publish, as a deterrent, internally and externally the achievements of our fraud investigators (eg, successful prosecutions)? | | |

Part B:
for the NFI key contacts and users

Yes/No/Partly

Is action required?

Who by and when?

Planning and preparation | | |
1.	Are we investing sufficient resources in the NFI exercise? | | |
2.	Do we plan properly for NFI exercises, both before submitting data and prior to matches becoming available? This includes considering the quality of data. | | |
3.	Is our NFI key contact (KC) the appropriate officer for that role and do they oversee the exercise properly? | | |
4.	Do KCs have the time to devote to the exercise and sufficient authority to seek action across the organisation? | | |
5.	Where NFI outcomes have been low in the past, do we recognise that this may not be the case the next time, that NFI can deter fraud and that there is value in the assurances that we can take from low outcomes? | | |
6.	Do we confirm promptly (using the online facility on the secure website) that we have met the fair processing notice requirements? | | |
7.	Do we plan to provide all NFI data on time using the secure data file upload facility properly? | | |
8.	Do we adequately consider the submission of any ‘risk-based’ data-sets in conjunction with our auditors? | | |
9.	Have we considered using the real-time matching (Flexible Matching Service) facility offered by the NFI team to enhance assurances over internal controls and improve our approach to risk management? | | |
Effective follow up of matches | | |
10.	Do all departments involved in NFI start the follow-up of matches promptly after they become available? | | |
11.	Do we give priority to following up recommended matches, high-quality matches, those that become quickly out of date and those that could cause reputational damage if a fraud is not stopped quickly? | | |
12.	Do we recognise that NFI is no longer predominantly about preventing and detecting benefit fraud? Have we recognised the wider scope of NFI and are we ensuring that all types of matches are followed up? | | |
13.	Are we investigating the circumstances of matches adequately before reaching a ‘no issue’ outcome, in particular? | | |
14.	(In health bodies) are we drawing appropriately on the help and expertise available from NHS Scotland Counter Fraud Services? | | |
15.	Are we taking appropriate action in cases where fraud is alleged (whether disciplinary action, penalties/cautions or reporting to the procurator fiscal)? Are we recovering funds effectively? | | |
16.	Do we avoid deploying excessive resources on match reports where early work (eg, on recommended matches) has not found any fraud or error? | | |
17.	Where the number of recommended matches is very low, are we adequately considering the related ‘all matches’ report before we cease our follow-up work? | | |
18.	Overall, are we deploying appropriate resources on managing the NFI exercise? | | |
Recording and reporting | | |
19.	Are we recording outcomes properly in the secure website and keeping it up to date? | | |
20.	Do staff use the online training modules and guidance on the secure website and do they consult the NFI team if they are unsure about how to record outcomes (to be encouraged)? | | |
21.	If, out of preference, we record some or all outcomes outside the secure website have we made arrangements to inform the NFI team about these outcomes? | | |