The National Fraud Initiative in Scotland
Making an impact
Prepared for the Auditor General for Scotland and the Accounts Commission 
May 2010

Audit Scotland is a statutory body set up in April 2000 under the Public Finance and Accountability (Scotland) Act 2000. It provides services to the Auditor General for Scotland and the Accounts Commission. Together they ensure that the Scottish Government and public sector bodies in Scotland are held to account for the proper, efficient and effective use of public funds.
 Key messages
•	The National Fraud Initiative (NFI) is a counter-fraud exercise currently undertaken in Scotland as part of statutory audits. In 2008/09, 74 public bodies took part in NFI.
•	Scottish public bodies have recorded a further £21.1 million of outcomes since we last reported on the NFI in May 2008.1 This has been the most successful period since NFI was introduced in Scotland.
•	The cumulative outcomes from the NFI in Scotland are now around £58 million.
•	The NFI, other anti-fraud work, and improving systems of control in bodies are helping to reduce the levels of housing benefit fraud and error reported under NFI. However, new areas of matching are helping bodies to identify fraud and error in other systems.
•	In the current economic climate, bodies must remain vigilant in their efforts to minimise losses from fraud and error.
•	The vast majority of bodies managed their involvement in NFI satisfactorily; but a minority need to do more.
•	Audit Scotland expects to increase the number of bodies that take part in the 2010/11 NFI once new powers for data matching are enacted in Scotland.
1. Audit Scotland, working with the Audit Commission, external auditors and a range of public bodies in Scotland, has undertaken another major counter-fraud exercise. These exercises, known as the National Fraud Initiative in Scotland (NFI), are undertaken every two years as part of the statutory audits of the participating bodies. The latest exercise (NFI 2008/09) commenced in October 2008 and is now well progressed or substantially complete. 
2. In 2008/09, 74 bodies took part in NFI. These were the same bodies that took part in 2006/07 and included councils, police authorities, fire and rescue authorities, Strathclyde Partnership for Transport, health boards, the Scottish Public Pensions Agency (SPPA) and the Student Awards Agency for Scotland (SAAS). Audit Scotland also includes data about its own employees. The 2008/09 exercise built on previous NFI exercises and pilots first carried out in 2000.
3. NFI uses computerised data matching to compare a range of information held on bodies’ systems (eg, housing benefits, public sector pay and pensions, council tax, students, disabled persons’ ‘blue badge’ parking permits and a government register of deceased persons) to identify potential inconsistencies or circumstances that could indicate fraud or error. We make these ‘matches’ available to the audited bodies to investigate via a secure website. 
4. Since we last reported on NFI  in May 2008, participating bodies have recorded outcomes valued at £21.1 million. This includes £7.8 million of outcomes from further follow-up work on NFI 2006/07 matches and £13.3 million of outcomes which have been recorded following the investigation of 2008/09 NFI matches. The 2008/09 outcomes will continue to increase in the months ahead. The main results, in non-financial terms, from the 2008/09 matches include:
•	179 occupational pensions stopped after it was confirmed that the pensioner was deceased.
•	1,042 housing or other benefit payments to public sector pensioners stopped or reduced.
•	405 housing or other benefit payments to public sector employees stopped or reduced.
•	4,322 council tax single person discounts withdrawn after investigation of NFI matches confirmed that these were being wrongly deducted from bills.
•	4,340 disabled blue badges cancelled, or flagged to be checked at any future attempted renewal, after NFI identified that the holder was deceased.
5. The cumulative outcomes from NFI in Scotland are now around £58 million; and this does not include the value that might be attributed to deterring individuals from committing fraud. 
6. No obvious trend can be assumed from the results of the last three NFI exercises because of changes in the scope of the exercise and in the approach by bodies to tackling fraud and error, except for housing and other social security benefit outcomes. Fraud and error outcomes are falling in this area most likely because:
•	previous NFI exercises helped councils to identify the longest running frauds and errors
•	the NFI, and other anti-fraud work by bodies, continues to have a positive impact in deterring fraud
•	bodies continue to make improvements to their systems of control, informed by the types of frauds and errors identified previously.
7. However, 2008/09 NFI matches were produced from information collected from bodies mainly in late 2008, before the recent recession took hold. It is widely recognised that an economic downturn is linked with a heightened risk of internal and external fraud and error. Bodies need to bear this in mind as they plan for the next NFI exercise and must remain vigilant in their efforts to keep losses to a minimum. 
8. Local auditors concluded that the vast majority of participating bodies made adequate arrangements overall for discharging their responsibilities under the exercise. However, a few showed scope for significant improvement. The Appendix to this report includes a checklist that we encourage all bodies to use to self-appraise their involvement in NFI prior to NFI 2010/11.
9. The 2010/11 exercise will commence in October 2010. We expect this to be carried out under new powers for data matching included in the Criminal Justice and Licensing (Scotland) Bill (the Bill), currently before the Scottish Parliament. Once enacted, these provisions will provide Audit Scotland with similar express data matching powers to those already available to the other UK public sector audit agencies.
10. As well as bringing more clarity to the legal framework in Scotland, these powers will provide the opportunity for more collaboration with the other UK audit agencies to tackle cross-border fraud. They will also help us to extend NFI to a wider range of public sector bodies in Scotland and allow data matching to be used to prevent and detect other crime, as well as fraud.
11. The Bill includes important data protection safeguards, including a formal requirement for Audit Scotland to prepare a Code of Data Matching Practice and to consult with the UK Information Commissioner and others before publication. We are well placed to revise our existing Code to reflect the new legislation and to ensure that NFI exercises continue to comply with data protection requirements and best practice in notifying individuals about the use of their information for NFI purposes.
12. Part 2 of this report contains case studies of the significant frauds and errors that the NFI helped bodies 
to detect, and the serious consequences that fraudsters have to face as a result.
1	The value of NFI to the public purse is measured by the amounts of overpayments (whether due to error or fraud) that are identified and stopped, estimates of amounts that bodies will save by stopping incorrect payments that would have continued if not identified by NFI and, in some cases, attaching an appropriate value to other significant findings. We refer collectively to these as ‘outcomes’.
Part 1. What is the National Fraud Initiative?

Key messages
•	The NFI is a counter-fraud exercise currently undertaken in Scotland as part of statutory audits. In 2008/09, 74 public bodies took part in NFI.
•	Participating bodies mostly supplied data for NFI 2008/09 in October 2008. An encrypted upload facility ensures secure transfer and avoids data having to be physically sent for processing. 
•	Data was processed and matches were made available to bodies from early February 2009.
•	Matches identify circumstances that may represent an inconsistency which, after further investigation by bodies, could indicate fraud or error. There is no presumption that fraud or error has taken place.
•	Bodies access matches via the encrypted website, which offers high levels of security. The application is designed to help bodies prioritise the matches to be followed up.
13. Fraud is a crime. Citizens rightly expect that public bodies will safeguard the taxes that are paid to them. They expect that the local and national taxes they pay into the public purse are used to provide the services they were meant for, including that housing and other benefits are paid to those that need the help, in accordance with the rules that are in place. Regrettably, the honest majority of citizens pay for the activities of the minority who cheat the system. Tackling fraud should be a priority for all organisations. A zero tolerance approach is essential.
14. The National Fraud Initiative (NFI) is a counter-fraud exercise. It uses computerised techniques to compare information about individuals held by different public bodies and on different financial systems to identify potential inconsistencies or circumstances (matches) which require further enquiries by bodies. Neither Audit Scotland nor any participating body presumes that an NFI match is a fraud – most are not. Conclusions are only reached about whether or not there has been a fraud or error after bodies have completed their investigations.
15. The NFI helps:
•	public bodies – to investigate these matches and, if fraud or error has taken place, to stop payments; to attempt to recover the amounts involved; and strengthen controls for the future. If no fraud or error is found, bodies should be able to take assurances about their internal controls
•	auditors – to assess the arrangements that public bodies have put in place to prevent and detect fraud and error, including how they approach the NFI exercise.
16. The NFI and other data matching exercises can also deter fraud. Individuals receive a ‘fair processing notice’ explaining that their data is provided to auditors for the purpose of preventing and detecting fraud.
17. Audit Scotland initially became involved in NFI pilots in 2000. The Audit Commission, our sister organisation in England, had undertaken data matching exercises previously and had substantial expertise and systems already in place. Audit Scotland has now benefited from that infrastructure for a decade. The Audit Commission continues to match Scottish data on behalf of Audit Scotland and appointed auditors.
18. The NFI has gradually expanded in Scotland since the first relatively full roll-out of the exercise in 2004/05, by involving more audited bodies and new areas of data matching. For example, we made it mandatory from 2008/09 for all councils to submit data about blue badge parking permits issued to disabled persons.
19. Like the other UK audit agencies, Audit Scotland has a Code of Data Matching Practice (the Code) aimed at ensuring compliance with data protection requirements during NFI exercises. We consulted with the UK Information Commissioner’s Office (ICO) and the bodies that participate in NFI prior to publishing our Code in 2006.
20. We improved the Code for NFI 2008/09 by extending the guidance about fair processing notices. Individuals are provided with a summary notice containing basic information about the use of their personal data for the purpose of preventing and detecting fraud. This summary notice (eg, included on an employee’s payslip) includes web links and contact details to help individuals access more detail from the participating body or Audit Scotland. The ICO considers this approach to be good practice. The Code also requires, among other things, that data matches are handled only by authorised persons (such as investigators and auditors) and that data are destroyed when they are no longer needed. All bodies and auditors involved in NFI in Scotland are expected to follow the Code.
21. We asked participating bodies to provide the data for the 2008/09 exercise in October 2008. The bodies uploaded the data via the Audit Commission’s secure website. Data are encrypted during the transfer. The Audit Commission then matched the data on our behalf.
22. For NFI 2008/09, Audit Scotland made it mandatory for bodies to provide the data sets described in Exhibit 1.
23. In addition to the data sets in Exhibit 1, the NFI benefits from the inclusion of other information, such as deceased persons, failed asylum seekers and visas refused, expired or granted where there is no entitlement to work, provided by other government departments.
24. For the 2008/09 exercise we also invited local authorities, in the main, to submit information from a menu of ‘risk-based’ data sets where, in conjunction with their auditors, they considered that there were special risks or that they were likely to benefit from the matching. This included data about taxi licences, insurance claims and trade creditor payments.
25. We also asked councils to provide a copy of the electoral register, in effect, as a risk-based data set. Although Audit Scotland is satisfied that it is legitimate for councils to supply the register for NFI purposes, some councils chose to obtain alternative advice, and we did not insist on submission in these cases. We did not enforce submission either where councils insisted that they had alternative arrangements for checking the validity of council tax ‘single person discounts’, such as commissioning their own data matching exercises from commercial organisations. 
26. Exhibit 2 (overleaf) includes examples of the types of data matches undertaken during NFI 2008/09 and the types of frauds and errors that can be found.
27. Audit Scotland has provided guidance and held NFI training events for Scottish participating bodies and their auditors, in conjunction with colleagues in the Audit Commission. This included demonstrations of the secure web-based NFI application. Bodies access the application via the internet using password access and encryption controls similar to internet banking. The secure website is the means of providing the data matches to bodies without the need to send matches on a physical storage device, such as a CD, eliminating the risk of loss or poor security once delivered. The Audit Commission regularly reviews the application and implements developments to improve its functionality, ease of use and security.
28. The 2008/09 NFI application included:
•	New online interactive training modules for users to access as often as they wish and at times that suit them best – avoiding the financial and environmental costs of travelling to training events.
•	New ‘recommended’ match reports for most match types. These identify the matches that bodies should investigate first (eg, due to value or other criteria, such as where an occupational pensioner or employee’s housing benefit record suggests that they failed to declare their income). Bodies can also apply their own filters and sort matches to suit local decisions and circumstances, if they prefer.
•	The ability to tailor the disclosure of matches so that individual approved officers can access only the matches they need to discharge their own responsibilities. Controls were also introduced to prevent matches being downloaded or printed without the authority of the director of Finance. System restrictions prevent auditors from downloading or printing matches in any circumstances.
•	An improved case management system. Bodies can annotate reports or individual matches with comments about their approach to investigations and their progress, and update the status of matches (eg, opened; closed – fraud; closed – error; closed – already known). Financial outcomes and other actions about individual investigations can also be recorded and the aggregate outcomes identified at a glance.
•	A new suite of management information reports to help bodies and auditors identify ‘exceptions’ more easily. These include key match reports that have not been opened, or show no activity for a period of time, and users that have not accessed the training modules.
•	The ability to monitor for improper use of the application, including failed login attempts and ‘out of hours’ access.
29. In 2009, the whole of the Audit Commission’s NFI system was subjected to a stringent security review. This covered infrastructure, information storage, handling and processing when under the control of the Audit Commission’s data processing contractor and the NFI team. The review was undertaken by a consultant from the National Computing Centre (NCC) who confirmed compliance with government information standards. This accreditation involved demonstrating to key government departments that NFI is suitably secured and that information risks are managed to government standards. The NCC also undertook independent penetration testing of the NFI systems and concluded that NFI was ‘ …well implemented and robust from a security perspective’.
30. As well as regular internal reviews by the Audit Commission, the other UK audit agencies (ie, Audit Scotland, the Wales Audit Office, the Northern Ireland Audit Office and the National Audit Office) now also share a programme of independent audits of the different aspects of NFI data security. The Information Commissioner’s Office has also conducted an NFI data security audit at the invitation of the Audit Commission.
31. All of these measures provide current and future NFI participants with assurances that data is processed according to rigorous government security standards.
32. The 2008/09 NFI matches were available to bodies from early February 2009. Councils that participated in the initial matching of council tax data and the electoral register, which we have been unable to report on until now, had access to these matches from April or July 2008, depending on how soon they supplied their data.
33. Since then, participating bodies have been investigating the NFI matches that are most likely to result in the identification of significant fraud or error. Local external auditors monitored bodies’ participation, including their progress with following up the matches. Almost all auditors mentioned NFI in their 2008/09 annual audit reports and all provided assessments of bodies’ arrangements for managing NFI for this report.
Exhibit 1
The information that bodies were required to provide for NFI 2008/09

Dataset	Bodies that submit this data	
Housing and council tax benefits	Councils	
Disabled persons’ parking permits (‘blue badges’)	Councils	
Residents in supported care home accommodation	Councils	
Council tax data	Councils	
Payroll	Councils, police and fire and rescue authorities, Strathclyde Partnership for Transport, health bodies, Audit Scotland	
Student data	Student Awards Agency for Scotland	
Occupational pensioners (former local government, police, fire, teachers and NHS employees)	Councils that administer the local government pension scheme, police and fire and rescue authorities, Scottish Public Pensions Agency	

Source: Audit Scotland
Exhibit 2
Examples of the types of data matches undertaken

Type of data match	Potential fraud or error	
Housing benefit claimants 
to
students	Improper claims for benefit. Students can only claim housing benefit in limited circumstances.	
Housing benefit claimants
to
employees and public sector occupational pensions	Employees or occupational pensioners may claim benefit without declaring 
their income or by under-declaring 
the amounts.	
Council tax
to
electoral register	There may be more than one qualifying adult resident at a property where a single person discount is being deducted from the household’s council tax bill. Subject to checking for residents that are ‘disregarded’ for council tax purposes, the discount may not be valid.	
Employees
to
employees	An employee may be on long-term sick leave while working at another body.	
Public sector pensions
to
deceased persons records held by the Department for Work and Pensions	A pensioner’s death may not have been reported to the pension authority. The pension continues to be paid to a bank account or may be collected by a relative.	
Public sector pensions 
to 
employees	A public sector employee may have retired but returned to work, and not told the pension authority. Pensions sometimes need to be reduced because of a return to work.	
Employees
to
failed asylum seekers or expired visas	It is unlawful for any body to employ persons who are not entitled to reside or work in the UK.	
Blue badges
to
deceased persons records	The permit holder’s death may not have been reported to the council. The permit may continue to be used fraudulently or be sold for improper use.	
Source: Audit Scotland
Part 2. Outcomes and impact

Key messages
•	The NFI outcomes since we last reported in May 2008 are £21.1 million and will increase in the coming months. Cumulative outcomes are now around £58 million.
•	The main outcomes in 2008/09 have been in matches involving housing benefits, pension payments, invalid council tax single person discounts and disabled persons’ parking permits (‘blue badges’) that are no longer valid. 
•	179 public pensions were stopped after NFI identified that the individual was deceased, and councils have so far stopped or reduced 1,447 housing benefit payments to public sector employees and pensioners.
•	4,322 council tax single person discounts were cancelled after investigation of NFI matches confirmed that these were being invalidly deducted from council tax bills.
•	4,340 blue badge records were corrected after NFI identified that the holder was deceased.
•	Re-allocating outcomes to the NFI cycle to which they strictly relate shows that housing and other benefit outcomes continue to fall. This is encouraging and, among other things, suggests that NFI continues to help deter fraud as well as detect it, and that system controls are being strengthened.
34. Based on the outcomes recorded by bodies in the secure website at the end of March 2010, the outcomes from NFI since we last reported in May 2008 are around £21.1 million (Exhibit 3). This is another substantial result to add to the £37 million identified from previous NFI exercises in Scotland. 
“The approach and commitment to NFI adopted by Audit Scotland, together with the enthusiasm and expertise of investigators in participating bodies and their auditors, has resulted in some outstanding outcomes at a number of Scottish authorities. The frauds and overpayments detected in NFI 2008/09, including some of major significance, reflect the importance of prompt and rigorous investigation of key matches.”
Peter Yetzes, associate director and head of NFI, Audit Commission
35. More than a third of the £21.1 million is further outcomesthat relate strictly to the 2006/07 exercise, but had not been recorded when we last reported. These are mainly:
•	Further housing and council tax benefit outcomes in councils.
•	Outcomes from benefit matches involving income support, jobseeker’s allowance and pension credit that were followed up by Job Centre Plus and the Pension Service in 2006/07.
•	Outcomes from cancelled single person discounts from the first tranche of that exercise.
•	Further outcomes from 2006/07 pension matches (deceased persons) investigated by the Scottish Public Pensions Agency. 
•	Outcomes recorded by the Student Awards Agency for Scotland for support payments to students who were not entitled to reside or study in the UK.
36. It is normal for us to add further outcomes from the last NFI cycle to the outcomes from the current exercise. However, on this occasion this distorts the overall trend in the outcomes from the last three NFI cycles in Scotland. For reporting purposes, the outcomes have been £15.1 million (2004/05), £9.7 million (2006/07) and £21.1 million (2008/09). But, if we ‘add back’ the further outcomes to the NFI cycle that they strictly relate to, the trend is closer to that shown in Exhibit 4.
37. NFI 2004/05 was the first exercise to include data from all councils in Scotland and it represents a reasonable baseline against which to compare later exercises. Given that subsequent NFI cycles (ie, 2006/07 and 2008/09) added new bodies (eg, health bodies from 2006/07) and new data sets (eg, blue badges and council tax matches) it is evident that outcomes in the areas that have been NFI ‘constants’ (such as housing benefits and occupational pensions) show diminishing amounts of recorded fraud and error. This is encouraging. Previous NFI exercises have likely detected the most significant and longest running frauds and errors and the trend may also demonstrate both the exercise’s impact in deterring fraud and the efforts of bodies to continuously improve their systems.
38. In absolute terms, NFI outcomes continue to be substantial; £13.3 million for NFI 2008/09 matches to the end of March 2010 only and, as explained previously, this will continue to increase for some time.
39. Exhibit 5 (page 12) summarises in non-financial terms the main outcomes from NFI 2008/09 matches in Scotland. 
40. Of the 220 2008/09 cases where sanctions were applied, 89 have been reported to the Procurator Fiscal (PF). While this is low, compared to the number of overpayments detected, there are many reasons for this. Overpayments may not have resulted from deliberate actions or omissions or there may be insufficient evidence of intent to defraud. Councils may not refer a case to the PF if experience suggests that it will not be accepted for prosecution or if an individual is very elderly or in poor health. 
41. Significantly, based on past experience, we expect that the number of 2008/09 cases reported to the PF, or subject to other sanctions, will increase significantly in the months ahead. Audit Scotland’s report on the 2006/07 NFI identified that 49 cases had been referred to the PF by early April 2008. Having recently contacted councils to refresh this information we now know that at least 193 cases were ultimately reported to the PF. Of these, 80 successful prosecutions have been secured and a further 48 proceedings are ongoing.
42. Our NFI 2006/07 report set out a number of case studies (examples of alleged frauds detected through NFI) where criminal proceedings were ongoing. Examples of the verdicts and sentences passed in these and other 2006/07 NFI cases that have now been heard by the courts include the following:
•	An individual found guilty of fraudulently obtaining £32,000 in benefits by failing to disclose an occupational pension was sentenced to 11 months in prison.
•	A council employee who fraudulently obtained £14,000 sick pay while at the same time working for a health board was successfully prosecuted. After agreeing to repay the amount, plus interest and court fees, from her pension fund she was sentenced to 200 hours community service. 
•	A married student who was found guilty of obtaining £8,900 by falsely claiming single parent status for student support purposes was sentenced to three years probation and ordered to pay £5,000 compensation to 
the Student Awards Agency for Scotland. 
•	A retired police officer who obtained housing benefit of £17,000 after failing to declare an occupational pension for at least ten years, pleaded guilty to the offence but died before sentence was passed.
•	An individual who fraudulently obtained £6,000 in benefits by concealing a partner’s pension in a bank account opened after previously being convicted of a similar offence was again found guilty and sentenced to 100 hours community service. The council is also recovering the sum involved.
Pension outcomes
43. The NFI provides pensions administering councils and the Scottish Public Pensions Agency (SPPA) with an efficient and effective means of checking that payments are only being made to living persons. NFI 2008/09 helped these bodies identify 179 pensioners whose deaths had not been reported to them. Including other pension-related outcomes (eg, cases where early retirees have returned to work but not reported circumstances that require their pension to be reduced) and forward savings the amounts for NFI 2008/09 are, so far, about £5.6 million.2 
44. As in previous NFI exercises the majority of the outcomes in local government are in the Strathclyde Pension Fund (SPF) administered by Glasgow City Council (£3.4 million). This is unsurprising given that SPF administers 192,000 pensions (about 42 per cent of the local government pensions in Scotland). The Lothian Pension Fund, administered by 
City of Edinburgh Council, (65,000 members) achieved pension outcomes of £1.3 million.
45. The Scottish Public Pension Agency recorded outcomes of £565,000 from its 2008/09 matches. This compares with £5.3 million in 2004/05 and £2.3 million in 2006/07. The Agency undertook an exercise with information about deaths obtained from the General Registers Office for Scotland (GROS) between the 2006/07 and 2008/09 NFI exercises. This significantly reduced the number of unknown deceased pensioners that remained to be detected from their 2008/09 NFI matches. The use of GROS data will now be a routine feature of the Agency’s control system.
Housing benefit outcomes
46. Benefit outcomes from the 2004/05 and 2006/07 NFI cycles ultimately reached £5.8 million and £5.4 million respectively. NFI 2008/09 has so far helped councils to identify HB and other benefit outcomes of around £4.3 million. Although the 2008/09 outcomes will increase for some time, we do not expect them to reach the level of 2006/07.
47. A total of 408 HB overpayments (about a quarter of the number and half of the value of the 2008/09 outcomes) were recorded by councils as frauds. 
48. Where other benefits such as income support and jobseeker’s allowance are also in payment, councils liaise with the Department for Work and Pensions and joint investigations may be carried out. The amounts in this report include these other benefits, where relevant.
49. The NFI provides councils with the opportunity to identify a wide range of benefit frauds and errors. The most common are caused by undeclared occupational pensions and undeclared earnings from public sector employment. By the end of March 2010, councils had identified benefit overpayments from their 2008/09 NFI matches relating to 1,042 public sector pensioners, 331 local government employees and 74 persons working in the NHS in Scotland.
50. North Lanarkshire and Glasgow City Councils have so far achieved the highest levels of outcomes from their 2008/09 NFI benefits investigations (£375,000 and £368,000 respectively). A further four councils have HB outcomes in excess of £300,000. Overall, relative to size (measured by total annual benefit expenditure), East Dunbartonshire Council has the highest yield from HB investigations for the second successive NFI exercise (£350,000). East Dunbartonshire’s chief internal auditor and fraud investigation team leader have demonstrated significant enthusiasm for NFI and, in Audit Scotland’s view, this is a vital ingredient for any successful body.
“East Dunbartonshire has again obtained outstanding results from the NFI. To continually achieve such results, a systematic approach is taken to reviewing matches, allowing our highly committed and experienced investigators to target the suspected fraudsters. A holistic multi-agency approach ensures that those committing fraud against other public bodies, in particular the Department for Work and Pensions, are also identified and appropriate action taken.” 
Gerry Cornes, chief executive, 
East Dunbartonshire Council
51. Again taking size into account, the following councils have also achieved significant outcomes from their 2008/09 benefits investigations:
•	Dumfries & Galloway
•	Inverclyde
•	Midlothian
•	Moray
•	Stirling.
“The 2008/09 NFI has proved very beneficial in highlighting fraudulent benefit claims in Midlothian. In the past year some 60 per cent of the £349,000 that has been uncovered in benefit fraud is attributable to NFI. When viewed against annual benefit payments of around £22 million, the total fraud uncovered is under two per cent and gives the council some assurance that its benefit gateway is robust.”
Ian Jackson, director, corporate services, Midlothian Council
Payroll outcomes
52. The NFI matches data to identify cases of potential payroll fraud. But investigations can also lead, for example, to the discovery that employees are in breach of conditions of service or EU working time limits. Apart from other consequences, excessive working hours may pose public safety risks. 
53. The NFI also matches payroll data to Home Office information about failed asylum seekers and expired and granted visas where there is no entitlement to work in the UK. It is unlawful to employ anyone who is not entitled to reside or work in the UK and the NFI provides bodies with a means of supplementing their recruitment checks.
54. Case study 6 represents, by value, the most significant payroll irregularity since we made these matches available in 2004/05.
55. Payroll matches are the main area where NHS bodies may require to lead in conducting investigations. One health board dismissed an employee after enquiries confirmed that they had no right to work in the UK. Another health board has referred a case to NHS Counter Fraud Services for investigation where an employee is alleged to have been working for the board while claiming sick pay from another health board.
56. As a result of 2008/09 NFI matches, 12 public sector employees in Scotland have so far been dismissed or resigned after bodies confirmed that they did not have permission to reside or work in the UK.
Council tax single person discounts
57. A 25 per cent ‘single person discount’ is deducted from a council tax bill where there is only one qualifying adult resident in a property. There can be more than one adult, but the others need to be ‘disregarded’ persons as specified in legislation (eg, students and the severely mentally impaired) for a deduction to be valid. Council taxpayers are required to inform councils if they are no longer eligible for a discount but it is evident across the UK that significant numbers of discounts are deducted incorrectly.
58. The NFI matches council tax records with the electoral register to identify households where there is more than one adult registered and where a discount may therefore be invalid. NFI matches also identify where a resident is about to reach the age of 18, at which time an additional adult may mean that a discount is no longer deductible. There is no presumption of fraud or error in any case until councils have made further enquiries.
59. These matches were mostly released to participating Scottish councils in April and July 2008. Several councils submitted data later than others and had matches to review from April 2009.
60. Ultimately, only half of Scottish councils took part in this area of NFI but a number recorded worthwhile outcomes after following up their matches. These councils cancelled 4,322 discounts amounting to almost £1.4 million in over-deductions which they are now recovering. Dumfries & Galloway Council corrected more than 450 discounts. The council is recovering £435,000 of invalid discounts and £44,000 of benefit overpayments also identified from the matches, going back several years. Unsurprisingly, in view of its size, Glasgow City Council cancelled the most discounts, although it now prefers to use a credit reference agency because of the wider range of data that is accessible in the private sector for this type of exercise.
61. These councils also increased the amount of council tax that will be collected from the affected households in the future. If they retain the improvement in collectable income for a further three years, the total value of these single person discount outcomes in Scotland can be estimated at around £4.5 million.
62. The councils that declined to take part relied on their own procedures, paid credit reference agencies to undertake similar data matching exercises, or had reservations about providing the electoral register to Audit Scotland for legal reasons. While we respect the position of most of these councils, we were disappointed that some did not adequately engage with us about 
their reasons.
63. We again requested council tax data and the electoral register from councils in late 2009 – with the aim of providing further matches in March 2010. Again, a few councils did not contact us about delays in data submission or explain unambiguously why they had not provided data. The vast majority of councils across the UK (and almost all English councils) now take part in this type of NFI data matching. Audit Scotland will take a firmer stance in future with any audited body that fails to submit data without explaining its reasons and allowing us to discuss the position.
64. NFI data matching is inexpensive. It costs only £500 per council to match council tax data with the electoral register. We would urge councils that have yet to make full use of these matches to review their strategy and consider whether there are savings to be made or further outcomes to be achieved by first using the NFI council tax matches,  or using these alongside their other arrangements.
Blue badges
65. The ‘blue badge’ scheme allows individuals with mobility problems to park free at on-street parking meters and pay and display machines. Holders may also be permitted to park on single or double yellow lines in certain circumstances. However, badges are sometimes used or renewed improperly by people after the death of the badge holder. The use of a blue badge by an unauthorised person is an offence.
66. Glasgow City Council was the first in the UK to ask the NFI team to pilot the matching of information about blue badges with records of deceased persons. In view of the successes achieved at the last NFI cycle, we requested that all councils submit blue badge data for NFI 2008/09.
67. Scottish councils have reported correcting 4,340 blue badge records where NFI helped them to identify that the holder was deceased. Perth & Kinross and Fife Councils each corrected more than a thousand records.
68. These outcomes have more value to citizens and councils than just correcting records. They help to ensure that badges are not used to evade parking charges or fines, and that those with genuine mobility problems have access to the parking spaces that are provided for them. Councils do not always attempt to recover a badge relating to a deceased person to avoid causing distress but, by ‘flagging’ the relevant records, they can at least ensure that badges are not improperly renewed in the future. By sharing information with other departments councils can also recover valuable equipment and aids if they have not been informed of a person’s death.
69. The Audit Commission identified the problem of blue badge fraud in a report published in September 2009. Their report also identified how criminals forge badges or steal genuine ones from cars, and how a badge can be sold on the black market for as much as £500.
Student matches
70. Information about full-time students was initially used by the NFI to help councils check for invalid awards of housing benefit. Except in limited circumstances, full-time students are not entitled to housing benefit. Over the last three exercises, NFI matches have helped councils identify hundreds of cases where housing benefit was being paid improperly to students.
71. Since NFI 2006/07, the Student Awards Agency for Scotland (SAAS) has been provided with its own matches, identifying cases where students may be failed asylum seekers or may not hold valid permissions to reside or study in the UK. Since we reported on NFI 2006/07 in May 2008, SAAS has recorded 15 cases of students that were found, after enquiries with the UK Border Agency, to be not entitled to be in the UK. These students had received student support for up to four years prior to the launch of NFI, amounting to around £286,000.
72. The Agency also advised Audit Scotland that through its liaison with councils they had obtained information about students who had continued to receive funding but had withdrawn from college without advising SAAS, resulting in overpayments of around £10,000.
Other matches
73. Bodies are required to submit data in other areas, such as tenancy information. They may also submit information, after discussion with their auditors, from a range of ‘risk-based’ areas. For example, bodies may submit data about trade creditor payments to allow checks for duplicate payments. Employees’ details can also be checked against information about registered company directors and payments to trade creditors, to identify potential conflicts or undeclared interests and procurement fraud.
What do bodies actually save or recover because of NFI?
74. As indicated previously, the estimated value of NFI to the public purse since we last reported in May 2008 is £21.1 million. However, some of this represents overpayments that will never be recovered and values that have been attached, for example, to cancelling a blue badge. These amounts may not translate into savings, but they are valuable outcomes nonetheless.
75. During 2009, we canvassed bodies and established from those that responded that NFI overpayments are usually subject to the same recovery processes that apply to other debt. Most bodies do not keep separate records of NFI recoveries. Indeed, Audit Scotland would prefer that bodies devoted their resources to investigation work, rather than require them to record NFI amounts that are often recovered by frequent small amounts over long periods of time.
76. However, the average level of housing benefit overpayment recovery in Scottish councils is around 31 per cent. Assuming, very conservatively, that this is typical of all NFI recoveries, and if we add the estimated forward savings from areas such as benefits and pensions, we can reasonably estimate that the actual cash savings or recoveries for the public purse are at least half of the total outcomes of £21.1 million.
Exhibit 5
NFI in Scotland 2008/09 matches – summary of main outcomes

•	179 occupational pensions stopped (deceased pensioners)

•	1,042 housing benefit (HB) payments to public sector pensioners stopped or reduced

•	331 HB payments to local authority employees stopped or reduced

•	74 HB payments to NHS employees stopped or reduced

•	208 HB payments to students stopped

•	4,322 invalid council tax single person discounts withdrawn

•	4,340 blue badges cancelled after NFI helped identify that the holder was deceased

•	18 employees dismissed or resigned

•	220 alleged frauds reported to the Procurator Fiscal, administrative penalties imposed or official cautions issued

At least 80 successful prosecutions secured as result of 2006/07 NFI investigations; and a further 48 proceedings still in progress Source: Audit Commission/Audit Scotland NFI application log and NFI participants

Case study 1

SPPA suspended a pension in order to recover an overpayment of £24,000 identified from an NFI match. The overpayment was attributed to a misunderstanding on the part of the pensioner who had re-entered employment and exceeded the amount they were entitled to earn without a reduction in the level of their pension.
Source: SPPA
2	A forward saving assumes that a pension would have continued to be paid to age 90 had NFI not identified the death. Where the deceased person is already 90 one year’s forward saving is counted. This calculation is common in the pensions industry. 

Case study 2

An NFI match in a Scottish council led to the identification of a £70,000 benefit overpayment after the claimant allegedly failed to disclose a partner’s earnings for a number of years. Enquiries continue in respect of other significant alleged irregularities identified during the initial investigation. This may yet be the most significant individual case identified through the NFI.
Source: Local authority
Case study 3

A benefit claimant pleaded guilty in court to fraudulently obtaining housing and other benefits of around £37,000 over the best part of 20 years. He failed to disclose to the council and the Department for Work and Pensions that he had a partner living with him who was the main earner in the household. The judge considered sending the defaulter to prison, but ultimately decided to sentence him to three years probation and 300 hours unpaid work for the community. He was also given a tagging order for 12 months, confining him to home between the hours of 7pm and 7am.
Source: Local authority
Case study 4

A local authority elected member has been charged after allegedly failing to declare his income from his council duties when claiming housing and council tax benefits and pension credit. The councillor is further alleged to have failed to disclose an improvement in his health which could impact on other benefits such as disability living allowance. Court proceedings were ongoing at the time of preparing this report.
Source: Local authority
Case study 5

The NFI helped a council identify a benefit claimant who allegedly failed for more than a decade to disclose a pension and the bank account it was paid into. The benefits that were improperly claimed amounted to over £45,000. The claimant has repaid some £7,000 and made an arrangement to repay the balance. Court proceedings are pending.
Source: Local authority
Case study 6

An NFI match identified a salaried professional who had been paid by two councils at the same time for almost two years. One of the councils discovered that the employee had not been removed from the payroll when they moved to the new job with the other council. The employee did not inform the council and incorrectly received around £98,000. The council is taking measures to recover the overpayment and a report has been sent to the Procurator Fiscal.
Source: Local authority
Case study 7

A council discovered through an NFI payroll match that an employee in its works department who was also a retained fire-fighter had failed to notify his employer when called away to carry out fire-fighting duties. This resulted in him being overpaid from his main job. The employee was dismissed.
Source: Local authority
Case study 8

A student identified from 2006/07 NFI matches who was not entitled to be in the UK was arrested and deported after the Student Awards Agency for Scotland was able to provide information about their whereabouts to the Home Office. 
Source: SAAS
Case study 9

After we had reported on NFI 2006/07, we were informed that three employees had resigned from a Scottish council following enquiries into their interests in a company providing services to other local authorities. No criminal activity is alleged but there were breaches of council policies, including failing to notify secondary employment.
Source: Local authority
Part 3. Holding to account – how well did bodies perform?

Key messages
•	The vast majority of participating bodies managed their role in the 2008/09 NFI exercise satisfactorily.
•	About eight per cent of bodies need to plan better for NFI and show more commitment to the exercise.
•	A few bodies submitted data long after the requested deadline.
•	About one in five bodies need to follow up their NFI matches more promptly.
•	Local auditors concluded that seven councils in particular need to do more.
77. The appointed external auditors monitored bodies’ participation in NFI 2008/09. Almost all included a reference to the body’s involvement in NFI in their 2008/09 annual audit reports issued last summer or autumn.
78. Auditors also provided up-to-date information about each body’s NFI performance and progress at the end of February 2010. In reaching their conclusions, auditors do not attach significant weight to the NFI outcomes achieved by bodies. While Audit Scotland views high levels of NFI outcomes as a good result, and we commend bodies for this, it could be that a body’s systems are not preventing enough fraud and error in the first place. Consideration of bodies’ wider systems of control is not part of NFI. These are matters for local auditors to review, if necessary, as part of their wider risk assessments in audited bodies.
79. Local auditors reported that 90 per cent of participating bodies performed their role in NFI 2008/09 satisfactorily.
80. Almost all of the officers nominated to coordinate the exercise in each body (referred to as the ‘key contact’) were considered to be suitable for the role and to have discharged their responsibilities adequately. Further, the vast majority of bodies were considered to be committed to the NFI exercise, prioritised their investigations and made sufficient progress 
with reviewing matches and conducting investigations.
81. Auditors confirmed that appropriate arrangements had been made for issuing fair processing notices to those individuals whose data is submitted for the exercise.
82. Reported performance was not as good in the following areas:
•	Eight per cent of participants could have planned better and about one in five failed to make a prompt start to the follow-up of the matches once they were available on the NFI secure website. In eight per cent of bodies, auditors concluded that insufficient progress had been made with the investigation of matches.
•	One in ten participants need to demonstrate more commitment to the NFI. Commonly in these cases, progress with investigations and outcomes is not reported regularly to senior management, elected members, audit committees or boards. The proper tone needs to be set by senior management to ensure that the right attitude to tackling fraud exists throughout a body.
•	A few bodies submitted data for NFI 2008/09 long after the specified processing deadline. This creates a need for another processing run at a later date, and thereby increases the cost of processing data. These bodies fell several months behind the other participants while waiting on their matches, as well as causing other bodies to receive late matches. 
83. Only one body was considered to have devoted excessive resources to a particular match report before deciding to suspend its enquiries. Despite that, several bodies complain about the time spent following up matches compared to the amounts of fraud and error detected. It is encouraging that most bodies appreciate that they are responsible themselves for deciding on the resources to devote to following up NFI matches and when to ‘draw a line’ if no fraud or error is being found.
84. Twelve per cent of bodies did not record their outcomes fully on the NFI secure website. Many could also improve the way they record their investigations and conclusions on the NFI application. Audit Scotland will work with colleagues in the Audit Commission to improve the clarity of recording requirements. However, the likely effect is that the value of the outcomes referred to in this report are understated in some areas.
85. Ultimately, auditors concluded that seven councils in particular need to do more. All of these bodies have indicated that they have or will make improvements in the areas identified by their auditors before NFI 2010/11.
86. Public bodies have a duty to prevent and detect fraud and error. The ‘proper officer’ in local authorities, usually the chief finance officer, is required in statute to make arrangements for the proper administration of the organisation’s financial affairs. These include arrangements for preventing, detecting and deterring fraud. Accountable officers in other sectors have similar responsibilities.
87. However, we note a tendency in some bodies, especially smaller bodies where NFI outcomes can be low, to attach less value to the assurances that can be taken from the exercise. Bodies sometimes assume that because they have found little or no fraud or error from previous NFI exercises, or because they do not have a history of detected fraud in general, that the exercise should be given less priority. Bodies need to guard against complacency. This and previous reports published about NFI amply demonstrate the potential for significant fraud and error to be uncovered in any body.
 Exhibit 6
Bodies that need to improve their arrangements

Council	Key issue(s)	
Argyll & Bute	Commitment – senior management are committed to NFI, but the council has further work to do in order to fully integrate the departments and services that process the matches into the exercise.
Prompt follow-up – apart from housing benefits, there were delays in following up matches.	
Comhairle nan Eilean Siar	Insufficient planning – mandatory data was submitted late.
Prompt follow-up – substantive work did not commence until several months after matches were available.
Progress with matches – the comhairle followed up a relatively low number of matches.	
East Renfrewshire	Progress with matches – a number of match reports were not adequately followed up, including council tax SPD matches.
Prioritisation – available filters were not well used. Certain match reports got extensive coverage while others received little attention.
The council had a structured plan but it was not followed.	
Moray	The council made good progress with HB matches and achieved significant outcomes. But other areas, including payroll matches, were not considered for a long time.
The NFI is being treated mainly as an HB fraud exercise, but it now has a much wider scope.	
Orkney	Coordination – the key contact responsible for marshalling NFI arrangements changed during the course of the exercise.
Planning and commitment – most of the mandatory data sets were submitted late; no separate reporting of NFI 2008/09 progress or outcomes took place, including to members. 
The council’s approach has been influenced by low outcomes from previous NFI exercises.	
Shetland	Planning and commitment – no planned, structured approach and no reporting of NFI progress or outcomes to senior management or members.
Progress with matches – follow-up work was late in starting and progress slow.
The council viewed the NFI exercise as low priority alongside other demands on resources.	
Stirling	Planning and coordination – insufficient planning; affected by not clarifying promptly where responsibility for marshalling the exercise should lie (ie, the key contact role). Some mandatory data was submitted late.
Commitment – HB investigation staff are committed and significant outcomes have been achieved. However, progress and results are not reported regularly to senior management or members.	
Source: Auditors
Part 4. Helping to improve – self-appraisal

Key messages
•	The current economic climate is likely to have increased the risk of fraud and error in public bodies, and this may be reflected in the outcomes from future NFI exercises.
•	Bodies should not let down their guard because of falling or historically low levels of outcomes from their previous involvement in NFI.
•	Before NFI 2010/11, we recommend that all participating bodies review their arrangements for NFI and consider for themselves whether they could, or should, improve their approach.
88. While auditors monitor NFI participation in the bodies they audit, this is not an ‘in-depth’ review and it is undertaken from existing audit resources. Recognising this, we only ask auditors to assess whether bodies perform adequately, and not to make finer judgements or assess whether bodies comply with best practice. In future, we may ask auditors to assess bodies, for example, on a ‘traffic light’ scale of risk and scope for improvement.
89. In the current economic downturn, it is important that bodies strive to ensure that every pound of taxpayers’ money is spent on the purpose for which it was intended. Most of the data for NFI 2008/09 was extracted from financial systems in late 2008, before the recession took hold. Since then, most commentators suggest that the risk of error and fraud has increased, as individuals are tempted to consider less honest means of alleviating the impact on their finances. Financial constraints may also place a strain on bodies maintaining high standards of internal checks and controls. 
90. Before data is collected again for NFI later this year, we recommend that all bodies reflect on their performance at past NFI exercises, and any recommendations made by their auditors, and undertake an honest self-appraisal of their approach. This should help to ensure that bodies get the best outcomes from NFI, whether from the amounts of fraud and error that are detected, or the assurances that can be taken if fraud and error is low.
91. The Appendix to this report contains a checklist including a number of key questions that bodies should ask themselves. These are based in part on the content of the questionnaires that we provided to auditors for local audit assessments and our experiences from the central coordination of the exercise.
92. For some questions, bodies may need to complete a separate appraisal for each department or section responsible for the different areas of matching (eg, benefits section, pensions, social work, insurance, etc).
Part 5. Next steps

Key messages
•	The NFI 2010/11 exercise will commence later this year, with data being collected in October 2010.
•	The inclusion of explicit provisions for data matching in the Criminal Justice and Licensing (Scotland) Bill should enable Audit Scotland to expand the number of bodies included in the NFI and to share data with the other UK audit agencies.
•	Further outcomes from NFI 2008/09 data matches will continue to be monitored. We will report on these with the next NFI exercise in spring 2012.
93. The 2006/07 NFI exercise showed that significant outcomes are likely to materialise from NFI 2008/09 for some time yet, not least because of the introduction of ‘mid-cycle matching’ (eg, council tax matching). We will continue to monitor these outcomes and report on them as part of the 2010/11 NFI in spring 2012.
94. The 2010/11 NFI exercise will commence in October 2010. The exact scope of the exercise has yet to be decided although we are minded to retain the concept of ‘risk-based’ datasets, which allows bodies some flexibility to agree with their auditors whether or not local risks and likely rewards merit the submission of certain data sets. We will also seek to increase the number of public bodies that take part in NFI in Scotland and request that external auditors do more to promote the NFI at the bodies they audit.
95. Aside from NHS employees that were linked to housing benefit overpayments in councils, NFI outcomes in health bodies have been low, even though the NHS arguably carries a higher risk of:
•	payroll fraud – due to the scope for individuals to be employed by more than one body
•	public safety issues – if working hours are excessive
•	employing individuals who are not entitled to work in the UK.
We are pleased that the Scottish Government Health Directorates and NHSScotland Counter Fraud Services (CFS) support the continued participation of health bodies. CFS made its expertise available to health bodies to assist with assessing their 2008/09 NFI matches and with any subsequent further investigation work. However, few boards took up the offer. We recommend that boards re-appraise their use of CFS before NFI 2010/11.
96. Our partnership with the Audit Commission is central to the development of NFI in Scotland. The Audit Commission will further develop the web-based application and ensure that the highest standards of data security continue to be applied. NFI systems are accredited to handle, store and process information to the required government classification levels. Arrangements are also in place for all of the UK audit agencies that take part in NFI to undertake security reviews on a shared basis.
97. So far as possible, we will continue to develop our exercise in line with the matches that are available in England, subject to the enactment of the Criminal Justice and Licensing (Scotland) Bill currently before the Scottish Parliament.
98. The data matching provisions in the Bill, once enacted, would bring Scotland into line with the explicit powers that are already available to the other public sector audit agencies in the UK, and among other things:
•	help to allay any residual concerns that may remain about data matching in Scotland and avoid any future issues about the provision of information to Audit Scotland for the data matching purposes set out in the Bill
•	allow Audit Scotland to add to the public bodies that require to take part in NFI (eg, large central government bodies) and to consider including other organisations that volunteer to submit data
•	allow Scotland to take part in ‘cross-border’ data matching which is already undertaken by the other UK audit agencies
•	ensure that Scotland is equipped to prevent and detect fraud as effectively as the rest of the UK and avoid any false perception that we are any less determined to tackle the problem.
99. The NFI team in the Audit Commission provides Audit Scotland and Scottish participating bodies with significant help and support. Its contribution to the NFI in Scotland is gratefully acknowledged.
100. We are also grateful for the efforts of the investigators and other officers in the audited bodies, and the auditors who monitor their participation in NFI.
If you require this publication in an alternative format and/or language, please contact us to discuss your needs. It is also available
on our website: www.audit-scotland.gov.uk

Audit Scotland 
110 George Street 
Edinburgh EH2 4LH 
Telephone 
0845 146 1010 
Fax 
0845 146 1009 
www.audit-scotland.gov.uk 
ISBN 978 1 906752 85 9