© National Audit Office 2023

Tackling fraud and corruption against government

HM Treasury, Cabinet Office

Session 2022-23
30 March 2023
HC 1199

The National Audit Office (NAO) scrutinises public spending for Parliament and is independent of government and the civil service. We help Parliament hold government to account and we use our insights to help people who manage and govern public bodies improve public services.

The Comptroller and Auditor General (C&AG), Gareth Davies, is an Officer of the House of Commons and leads the NAO. We audit the financial accounts of departments and other public bodies. We also examine and report on the value for money of how public money has been spent.

In 2021, the NAO’s work led to a positive financial impact through reduced costs, improved service delivery, or other benefits to citizens, of £874 million.

We are the UK’s independent public spending watchdog.

We support Parliament in holding government to account and we help improve public services through our high-quality audits.

Report by the Comptroller and Auditor General

Ordered by the House of Commons
to be printed on 29 March 2023

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Gareth Davies
Comptroller and Auditor General
National Audit Office

24 March 2023

Value for money reports

Our value for money reports examine government expenditure in order to form a judgement on whether value for money has been achieved. We also make recommendations to public bodies on how to improve public services.

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.org.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

012234 03/23 NAO

This report can be found on the National Audit Office website at www.nao.org.uk

If you need a version of this report in an alternative format for accessibility reasons, or any of the figures in a different format, contact the NAO at enquiries@nao.org.uk

The National Audit Office study team consisted of:

James Ball, Heather Boal, Araz Enayati Rad, Sam Haithcock, Robyn Hepton, Jacob Hopkins, Tosin Omole, Mark Parrett and Katie Sargeant, under the direction of Joshua Reddaway.

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

020 7798 7400

www.nao.org.uk

@NAOorguk

Key facts

Post publication this page was found to contain an error which has been corrected (Please find Published Correction Slip)

Summary

1 Since the start of the COVID-19 pandemic, government has recorded a higher level of fraud in the accounts we audit. This reflects the nature of the government’s response to the pandemic, including the rapid implementation of large new spending and loan programmes that came with an unusually high risk of fraud. This report sets out the recent trends from our audits and reports, reviews how well-placed government is to understand and tackle fraud and corruption across government and sets out insights from our work and engagement with experts on what more government can do to better prevent fraud and corruption.

2 This report follows our previous work which found government did not have a good understanding of fraud before the pandemic. In our 2016 Fraud landscape review, we found a large disparity between the level of fraud and error that the UK government reports and the level reported in other countries and the private sector.1 We also found there were few incentives for departments to record and report the true scale of potential fraud; a lack of data or metrics to evaluate performance in detecting and preventing fraud; and mixed capability across departments to tackle fraud.

3 In part, the growing level of fraud against government reflects wider social trends that we have separately reported on. The Home Office is responsible for policy on preventing and reducing crime, including fraud against individuals and businesses. It works alongside bodies with responsibilities to tackle fraud and corruption including the: National Crime Agency, which hosts the multi-agency National Economic Crime Centre; Serious Fraud Office; and police forces. Our recent report on the Home Office’s Progress combatting fraud found that fraud made up 41% of all recorded crime, but less than 1% of police resources were devoted to tackling it.2

4 While some fraud and corruption against the taxpayer is inevitable, all public bodies have a responsibility to minimise it. The accounting officer, the lead official in each public body, is responsible for managing their organisation’s response to fraud and error risks as part of their overall control environment. In 2018, Cabinet Office set up the Government Counter Fraud Function (GCFF) to provide a structure for those working in counter-fraud, with a functional centre in the Cabinet Office, and the Government Counter Fraud Profession (GCFP) with membership across the public sector. In 2022, in response to concerns over the level of fraud during the COVID-19 pandemic and the lack of a coordinated response, government established the Public Sector Fraud Authority (PSFA). PSFA acts as its centre of expertise for the management of fraud against the public sector, leads the GCFF and GCFP, and reports to both HM Treasury and the Cabinet Office.

Scope of this report

5 This report focuses on fraud and corruption against government and therefore the taxpayer. Fraud is an act of deception carried out for personal gain or to cause a loss to another party. It may be committed internally by staff or externally by suppliers, contractors or members of the public. For the purpose of this report, corruption, which includes bribery, is the abuse of a public or private office for financial gain or the avoidance of personal loss. Both can lead to the loss of taxpayer money (such as benefit or tax fraud) or an inefficient allocation of resources (such as falsely claiming a loan even if intending to pay it back). We also include regulatory fraud – the abuse of government systems and processes where the victim may be a member of the public (such as fraudulently claiming probate) or the public at large (such as environmental crimes or falsely claiming a licence).

6 As auditors, our role in respect to fraud and corruption is to obtain reasonable assurance that the financial statements are free of material misstatement or irregularity, whether caused by fraud or error, and to report on the extent to which the audit was considered capable of detecting fraud. In our value-for-money audits we may also consider whether bodies we audit have appropriate controls in place to prevent, detect and investigate fraud and corruption. We do not investigate individual cases ourselves. The bodies we audit are responsible for detecting and investigating fraud and corruption cases, which they may do in collaboration with the police.

7 Our access to the entirety of government gives us insight into how well government manages the risks of fraud and corruption. In this report, based on those insights and discussions with counter-fraud and corruption experts across government, we set out:

Part One: Government’s understanding of the scale of fraud and corruption;

Part Two: Government’s counter-fraud and corruption capabilities; and

Part Three: What government needs to do: a summary of the insights from our work on what government can do to better tackle fraud and corruption.

8 We plan to use the themes raised by this report to structure our future work on government’s efforts to prevent and detect fraud and corruption.

9 The report does not cover fraud against individuals or businesses that does not involve abuse of government processes or systems and does not examine the effectiveness of individual departments’ activities to counter-fraud and corruption.

10 We conducted our fieldwork between September 2022 and March 2023. It is based on our audits of central government bodies; interviews with officials responsible for countering fraud and corruption across government and experts from counter-fraud and corruption specialist bodies; and data collected by the Cabinet Office and PSFA. Further details are set out in Appendix One.

Key findings

The impact of the pandemic

11 Government’s annual reports and accounts estimate fraud against the taxpayer rose from £5.5 billion in total over the two years before the pandemic (2018-19 and 2019-20) to £21 billion in total over the two years since the start of the pandemic (2020-21 and 2021-22). Of the £21 billion, £7.3 billion relates to temporary COVID-19 schemes. These estimates are in addition to around £10 billion a year lost from tax evasion and other tax crimes, which are not accounting estimates but are also set out in the annual reports and accounts. These estimates are inherently uncertain but are most likely to be underestimates. They exclude some types of fraud that are likely to have occurred. They also exclude any amounts that are too small to estimate in the context of any one set of accounts, but which collectively may still sum to a large amount. The estimates in the annual report and accounts focus on the potential loss to the taxpayer and exclude the wider cost of fraud and corruption. There are no specific estimates of the levels of corruption, insider fraud or of the total level of regulatory fraud (paragraphs 1.19 and 1.20 and Figure 6).

12 Departments are attempting to recover some of the money lost to fraud, but it is very unlikely that most will be recovered. For example, HM Revenue & Customs (HMRC) has recovered £762 million out of an estimated £4.5 billion of fraud and error in its COVID-19 support schemes as at 31 March 2022. HMRC expects to have recovered only £1.1 billion by the time it winds down its Taxpayer Protection Taskforce, which is dedicated to pursuing this type of fraud. Similarly, the Department for Work & Pensions (DWP) generated fraud and error savings of £500 million through its retrospective review of Universal Credit claims made over the height of the pandemic, but at least £1.5 billion of fraudulent claims that started during that period were still being paid in 2021-22. DWP is now planning targeted case reviews to detect and recover as much of the rest as it can (paragraph 1.24).

13 Government’s vulnerability to fraud and corruption rose during the pandemic as a result of its response. Government spent more on areas that are inherently vulnerable to fraud and corruption, such as buying medical equipment in a time of high demand and giving grants and loans direct to individuals and businesses. Government needed to respond quickly to the unfolding pandemic. It often did so by prioritising speed when setting up these new initiatives over reducing the risk of fraud and corruption and diverted compliance and counter-fraud staff away from their normal roles. Our previous reports have identified several ways in which public bodies could have better managed the fraud risk without impairing the emergency response including faster transparency, better management of conflicts of interest, addressing known vulnerabilities sooner and timely financial reporting (paragraphs 1.21 to 1.23 and Figure 7).

14 Some research suggests that the UK is seen as more corrupt than it was. The latest Transparency International survey of public and business perception of corruption shows that the UK, while still ranking highly for trust, fell from 8th out of 180 countries in 2017 to 18th in 2022 for the perceived level of corruption. Historical experience shows that it takes a long time to rebuild trust when it is diminished (paragraph 1.4).

Understanding the full scale of fraud and corruption

15 Government has tried to improve its understanding of the extent of fraud. Since our 2016 report, government has established the GCFF; produced regular estimates of the extent of fraud and error across government; produced reporting standards; strengthened departmental Fraud Measurement and Assurance (FMA) assessments of the risk of fraud in specific spending areas; and improved reporting on detected, prevented and recovered fraud (paragraphs 1.6 and 1.7).

16 Government does not have a good understanding of the extent of corruption. It includes corruption within its reported levels of internal fraud but does not produce any separate estimate of the extent of corruption across government (paragraphs 1.10 and 1.18).

17 PSFA estimates that in 2020-21 there was between £33.2 billion and £58.8 billion of combined fraud and error across government excluding expenditure specific to the pandemic. This is out of £1,106.1 billion of expenditure and £608.8 billion tax revenue. It covers both fraud and error because it can be difficult to differentiate between the two without a resource-intensive full assessment of at least a sample of cases. Preventing fraud and error also often requires the same approach. However, combining the two can obscure the cause of the problem and whether it is due to administrative issues or criminal attacks (paragraphs 1.8 to 1.10 and Figure 1).

18 PSFA’s estimate remains wide due to the inherent uncertainty over the extent of fraud and error and is largely not specific about which areas of government spending are vulnerable to fraud outside of tax and welfare. Some £29.7 billion (89%) of the £33.2 billion lower end of PSFA’s estimate relates to estimates on tax and welfare set out in the annual reports and accounts and £0.6 billion from other specific departmental estimates. The balance of £2.9 billion to £28.5 billion is the PSFA’s assessment, using historical FMAs, that fraud and error is likely to be in the range 0.5% to 5% of government expenditure in the areas that have not been assessed. PSFA believes it is likely to be towards the lower end of this range (paragraphs 1.11, 1.12 and 1.16, Figure 1 and Figure 2).

19 Few parts of government outside of tax and welfare have undertaken robust assessments of the level or types of fraud and corruption affecting their business. HMRC and DWP have developed sophisticated measurements of the level of fraud using sampling and estimation techniques that they estimate between them cost approximately £22 million each year in staff time.3 The NHS Counter Fraud Authority (NHSCFA) and Ministry of Defence (MoD) provide annual estimates that combine some limited measurement of fraud with benchmarking. These produce estimates with a lower level of confidence. Elsewhere, only half of other central government bodies report that they had conducted any FMA measurement exercise for specific spending areas since 2014 and the GCFF rated just over half of those exercises as unreliable. Most of the largest spending areas with the potential for fraud and corruption risks have not been formally assessed for the risk of fraud and corruption. Officials working in counter-fraud told us that methodological concerns and resource constraints are the main barriers to undertaking proper fraud measurement exercises (paragraphs 1.13 to 1.15, 1.17, and 2.19, and Figures 3 and 4, and Appendix Two).

Government’s counter-fraud and corruption capabilities

20 Government has also sought to improve its counter-fraud and corruption capability. Cabinet Office launched the GCFF and established functional standards to set minimum expectations on public bodies. In 2018, it also launched the Government Counter Fraud Profession (GCFP) and established professional standards by which to assess and train people. The GCFF, GCFP, functional and professional standards cover both fraud and corruption against government, where it leads to financial gain or the avoidance of loss (paragraph 2.5).

21 Government has mapped its counter-fraud and corruption resources. In 2021, HM Treasury commissioned the GCFF to undertake a Workforce and Performance Review (WPR) to map the counter-fraud resources and delivery outcomes of 70 central government organisations, including all the main departments, the larger arm’s-length bodies, and smaller bodies with specific counter-fraud risks or teams (paragraphs 2.11 to 2.16, and Figures 10 and 11).

22 The vast majority of government’s counter-fraud capability sits within DWP and HMRC, where the largest known risks exist. Some 11,200 (84%) of government’s counter-fraud staff (full-time equivalents) work for DWP or HMRC. These departments have their own fraud investigation and enforcement legal powers. They also have counter-fraud activities embedded within operations and have other counter-fraud expertise not available to other departments. For example, DWP’s Integrated Risk and Intelligence Service is using advanced analytics and machine learning to identify risky transactions for additional human review before payments are made. The rest of government’s counter-fraud workforce are mostly in teams specialising in tightly focused areas of expenditure such as the specialist NHSCFA, which supports NHS Trusts. Most departments have small teams responsible for promoting best practice across their organisation. Government bodies may also receive counter-fraud and investigation support from the Government Internal Audit Agency (paragraphs 2.12 to 2.14, and Figure 10).

23 Most departments have only limited counter-fraud and corruption capability and cannot demonstrate that it is proportionate to their risk. PSFA used the WPR to perform a preliminary baseline assessment of 70 public bodies, the investment in fraud against the outcomes they delivered and how well they understood their risk of fraud. Using data collected in April 2022 and performance information from 2020-21, the PSFA came to a preliminary conclusion that it rated only 14% of public bodies as having both identified and sought to measure the fraud and error risks they face; 27% have clear indications of mismatch between their counter-fraud resources and the risks they face; and 6% as having set a counter-fraud target and being able to demonstrate that their counter-fraud activity was delivering effective outcomes. PSFA told us that it was trying to establish a baseline initial understanding in order to enable it to offer more tailored support to departments to enhance the effectiveness of their efforts. PSFA’s general conclusions match our understanding from conversations and work across government. Many counter-fraud staff who spoke to us for this study told us managing fraud and corruption risks is rarely a priority for senior leaders in their organisations, mainly due to competing priorities, and is not sufficiently embedded in operations (paragraphs 2.17 to 2.19 and Figure 12).

24 With most counter-fraud and corruption activity being focused on known large risks, government has lacked capacity to adapt to new and unknown risks. For example, the Department for Business, Energy & Industrial Strategy (BEIS) recognised that there was a risk of fraud in the Bounce Back Loan Scheme when it set it up and asked for a ministerial direction (a written direction from ministers to proceed).4 However, its counter-fraud function at the time was two full-time staff and, to provide better oversight of the fraud risk and the lenders that participated in the scheme, it decided to bring in more staff and restructure its counter-fraud capability. By contrast, BEIS used its learning from the Bounce Back Loan Scheme and newly enhanced counter-fraud capability to work with the PSFA to improve its design of counter-fraud controls for the new energy schemes (paragraph 2.20).

25 Government is only at an early stage of using intelligence, data-matching and data analytics to prevent fraud and corruption. There have been 20 agreements under the Digital Economy Act 2017 for the purposes of preventing or disrupting fraud. PSFA also intends to improve the use of intelligence across government. However, officials working in counter-fraud told us that the processes in place for sharing data, both between and within departmental groups, are often slow and burdensome, often resulting in incomplete or time-lagged data being shared. In our 2022 publication Improving government data: a guide for senior leaders, we said that the benefits of better data are not simple to achieve in practice: they will require focussed effort, funding and prioritisation to achieve; and legacy systems and ageing data present a barrier as they create complex practical issues for data-sharing and the challenges involved in using these data is not well understood (paragraphs 2.21 to 2.24).5

26 The creation of the PSFA provides an opportunity for government to improve both its understanding of fraud and the action it takes to prevent it. PSFA intends to map out the strategic fraud risks across government in a global risk assessment, to set standards and to support and develop the profession, to hold departments to account for their management of fraud and corruption, and to provide services to support them in doing so. The PSFA has been in operation for eight months during which time it has agreed and published its mandate, appointed its interim leadership team and set out plans for developing central services across government. PSFA has also introduced Initial Fraud Impact Assessments to provide a rapid initial assessment of the likely fraud risks in new major spending initiatives. It has trialled this approach of deploying PSFA experts into the design stage for government’s new energy schemes. We found those working in counter-fraud are supportive of the new authority but do worry about whether it can tailor its demands on smaller teams and broaden its focus from fraud threats to cover the risk of corruption (paragraphs 2.5, 2.8 to 2.10 and Figure 9).

What government can do

27 We spoke to 46 officials working in or with the counter-fraud function, including all the heads of counter-fraud across all the main government departments and some of the larger arm’s-length bodies. We found a broad consensus on the challenges government faces and the things that PSFA and departments need to tackle. Using this, and our experience as the auditor of central government bodies, we have produced the following nine insights on things PSFA can help departments to do to both reduce and tackle the perception of fraud and corruption (paragraphs 3.1 and 3.2 and Figure 13). These include:

a Demonstrate best practice financial control and transparency. Tackling the risk that the public come to perceive fraud and corruption as normal requires government to demonstrate that committing fraud and corruption is difficult. Public bodies must demonstrate that they have put in place the basics of good governance and financial management, are transparent, and have assurance that their controls are working effectively (paragraph 3.3).

b Act as ‘one government’ in tackling fraud. Public bodies can better protect themselves from fraud and corruption by sharing data and intelligence with other public bodies and working together. The PSFA can help to better coordinate government efforts and to provide services that fill some of the capacity gaps across government. But many central services and functions fail because they do not achieve buy-in from departments. PSFA will need to work in partnership with departments such as HMRC and DWP, which contain most of government’s counter-fraud capability, and win the support of departments with less capability. It also needs to set out clear business cases for each of its services to demonstrate to others why they should use them (paragraph 3.4).

c Set an anti-fraud and corruption culture. Leaders establishing the right tone from the top on tackling fraud and corruption helps to set the culture of government, encourages ethical practice, acts as a deterrent to commit fraud and corruption and encourages whistle-blowers to report fraud and corruption. Leaders also need to celebrate the detection of fraud and corruption to encourage people to speak up and to learn lessons. This can be helped by embedding discussions of fraud and corruption measures in risk management across the organisation (paragraph 3.5).

d Develop robust assessments of the level of fraud and corruption. PSFA aims to produce a global fraud risk assessment that summarises the risk of fraud across government and highlights areas where more action is needed. But undertaking a robust assessment of fraud and corruption risks, and measuring the levels that exist, is currently beyond most public bodies’ capability. As a result, most do not know they are managing fraud and corruption properly and do not have return on investment metrics they can use to justify further investment. PSFA needs to develop a methodology to assess the levels of fraud and corruption that can be deployed in a proportionate way and which provides both sufficient information and coverage to inform decision-making (paragraph 3.6).

e Embrace a preventive approach, tailored to the risks of each area. It is normally far harder to detect and pursue fraud and corruption after the act has been committed than to prevent it taking place. Public bodies should aim to demonstrate cost-effective controls that minimise the risk of fraud and corruption as much as possible while also securing their other objectives (for example, ensuring people can access the payments and services to which they are entitled). But departments are at different stages of maturity towards achieving this and none have fully demonstrated it. Taking a fully preventive approach will require effort beyond the counter-fraud function, and the PSFA will need to be influential across government specialisms (paragraph 3.7).

f Develop the counter-fraud and corruption profession. PSFA needs to encourage the professionalisation of those working in the counter-fraud function. Those working in counter-fraud have traditionally focused more on the detection, investigation and pursuit of fraudsters and corrupt officials than on prevention. Adopting more preventive approaches will require a new cadre of counter-fraud and corruption professionals capable of working with other professions to assess risks and develop digital and operational means to tackle fraud. GCFP has set professional standards on investigation and risk assessment, is working on a standard on prevention, and works with training providers to train people to the standards. However, many of those working in the counter-fraud function are not members of the profession and have not been trained or assessed against the professional standards (paragraph 3.8).

g Harness and use data to prevent fraud and corruption. Cost-effective prevention approaches require far better use of data and information for governance, intelligence and best-practice sharing, data on detected frauds, and data-matching for both detection and prevention purposes. But government efforts to use data are hindered by both technical and legal challenges. Government also needs to do more to improve public confidence in the use of data analytics to detect and prevent crime and the impact that this can have on different user groups. PSFA can play a useful role in developing a strategy for the use of data to counter fraud and corruption that individual public bodies can build towards (paragraph 3.9).

h Design out fraud and corruption from new initiatives and systems. One of the key lessons from the level of fraud in government’s COVID-19 response is the need to design counter-fraud measures, including controls, reporting and recovery, into new initiatives at an early stage of the policy cycle. Departments and the PSFA now need to demonstrate that Initial Fraud Impact Assessments lead to fraud management and measurement that delivers a substantial impact and reduction in fraud. Government also needs to build in preventive measures such as data-matching and investigation tools into its new systems and processes (paragraph 3.10).

i Use its investigative powers and capabilities as an effective preventive deterrent. Detecting and pursuing fraudsters and corrupt officials is important for the provision of justice, to provide intelligence on what frauds and corruption are occurring and to act as deterrent for others. However, most money lost to fraud and corruption is not recovered and government has neither the ability or capacity to detect all fraud and corruption or to gather sufficient evidence to prosecute all that it detects. Civil penalties or agreements without penalties can offer a more cost-effective route to recover funds but may not offer the same deterrent effect. Public bodies need a means of judging the appropriate balance between criminal prosecution and civil recovery, the means and powers to pursue crime and to clearly communicate their enforcement activities to act as a deterrent (paragraph 3.11).

Conclusion

28 Fraud and corruption have for many years diverted billions of pounds a year from public finances to criminals. Government’s vulnerability to fraud inevitably rose as a result of its response to the COVID-19 pandemic, as it spent more on things inherently at risk of fraud and set up new programmes quickly. But there were ways in which public bodies could have better managed the fraud risk without impairing their emergency response. There is a risk that people come to perceive higher levels of fraud against taxpayers as normal and tolerated. There is also a risk that the UK is becoming perceived as more corrupt than it was before the pandemic. Such perceptions could affect public confidence in the integrity of public services.

29 Government has made some progress since we last reported in 2016. It has established the GCFF and the GCFP, and more recently the PSFA to improve its understanding of fraud attacks against government and to improve the standards of the counter-fraud function and profession. However, outside of tax and welfare, it still lacks robust assessments of where and what its fraud risks are and most public bodies cannot demonstrate that they have counter-fraud resources commensurate with the risk. The creation of the PSFA presents the opportunity for a renewed focus on fraud and corruption. PSFA will need to be influential across government if it is to achieve the required changes in culture, preventive approach and robust assessment of risks.

Recommendation

30 We recommend that the PSFA draws up an implementation plan for how it will work across government to help address the nine insights we set out above and in Part Three of this report.

1 Comptroller and Auditor General, Fraud landscape review, Session 2015-16, HC 850, National Audit Office, February 2016.

2 Comptroller and Auditor General, Progress combatting fraud, Session 2022-23, HC 654, National Audit Office, November 2022.

3 This is an approximation of the cost of staff who work directly in fraud and error measurement. For HM Revenue & Customs this excludes the one-off costs of measuring fraud and error in COVID-19 support schemes.

4 In February 2023, the government announced machinery of government changes covering what were the responsibilities for the Department for Business, Energy and Industrial Strategy, the Department for International Trade and the Department for Culture, Media & Sport. This report generally refers to the Departments and their areas of responsibilities as they were prior to these planned changes.

5 National Audit Office, Good practice guide, Improving government data: A guide for senior leaders, July 2022.

Part One

The scale of fraud and corruption

1.1 In this part we set out:

definitions of fraud and corruption against government;

government’s estimates of the scale of fraud and corruption and the limitations of these estimates; and

the level of fraud and corruption detected during the COVID-19 pandemic.

What is fraud and corruption?

1.2 Fraud, as set out in the Fraud Act 2006, is to dishonestly make a false representation, fail to disclose information that is legally required to be disclosed, or abuse a position for financial gain or to cause loss to another. It may be committed internally by staff or externally by suppliers, contractors or members of the public. For the purposes of this report, we use fraud to mean any dishonest act that leads to gain where it looks like the legal definition might apply. Corruption does not have a single definition. For the purposes of our report, corruption is the abuse of a public or private office for personal financial gain or avoidance of loss. This includes bribery.

1.3 Fraud and corruption against government can lead to the loss of taxpayer money (such as benefit or tax fraud) or inefficient allocation of resources (such as falsely claiming a loan that you intend to repay). It also includes regulatory fraud – the abuse of government systems and processes where the victim may be a member of the public (such as fraudulently claiming probate) or the public at large (such as environmental crimes or falsely claiming a licence).

1.4 The impact of fraud and corruption, however, is more far-reaching than just its financial impact. It also impacts on people more broadly, for example, where it impacts the ability of government to deliver services and where the proceeds of fraud are used to fund crime.6 It also affects perceptions and levels of trust in government, markets, public services and the country. The latest Transparency International survey of public and business perception of corruption shows that the UK, while still ranking highly for trust, fell from 8th out of 180 countries in 2017 to 18th in 2022 for the perceived level of corruption. Historical data show that it takes a long time to rebuild trust when it is diminished. For example, the Organisation for Economic Co-operation and Development (OECD) survey on drivers of trust in public institutions reports that it took about a decade for trust in governments to recover after the 2008 global financial crisis.7

1.5 We have identified six types of fraud and corruption risk inherent in the nature of government’s activities, each requiring a different approach to deal with them (Appendix Two).

Grant fraud. Misappropriation (for example, through being ineligible) or misuse (not for the defined purpose) of grant money by an individual or entity.

Service-user fraud. Using false information dishonestly with the intention of obtaining money, goods or services from government to which the individual or entity is not eligible or for use other than for the intended purposes.

Procurement and commercial fraud. Fraudulent activity specifically related to supplying goods or services to government, or illegal practices which occur between government and the private sector.

Income evasion. An intentional attempt to avoid payment for goods, services or other financial obligations owed to the government.

Internal fraud and corruption. When an internal party to the government organisation defrauds, circumvents regulations, the law or policy, whether alone or in collusion with any other person, with intent to cause government to sustain a loss or obtain an improper gain for the employee or any other acting in collusion.

Regulatory fraud. Abuse of a government owned process through false representation or a dishonest act, with the intention of making a gain or causing a loss to individual(s) independent of government. Regulatory fraud is harder to quantify and prevent as there may be no monetary trail within government. Often requires the use of intelligence and disruption, but public bodies may lack incentives to invest in counter-fraud and corruption measures as there is no direct loss to government.

Estimates of the scale of fraud and corruption

1.6 Fraud and corruption are hidden, involve deception and may be highly organised and are therefore inherently difficult to detect. In our 2016 Fraud landscape review, we found a large disparity between the level of fraud and error that was being reported and the level that other available estimates suggested might be occurring.8 The then UK figure of 0.02% fraud detected in government expenditure, excluding tax and welfare, compared with estimates of 3% to 5% fraud and error in the European Union and United States.9 While these comparisons need to be treated with caution, they suggested that there could be significant fraud and error that was unreported or undetected and losses that were not being adequately addressed. We also found few incentives for departments to record and report the true scale of potential fraud and a lack of data and absence of metrics to evaluate performance in detecting and preventing fraud.

1.7 Since 2016, government has attempted to strengthen its understanding of the level of fraud against government by:

establishing the Government Counter Fraud Function (GCFF) to bring together expertise across government to provide standards and advice, with a centre of expertise in the Cabinet Office, for the whole of government;

producing a Fraud Measurement Standard with clear definitions and reporting requirements;

strengthening Fraud Measurement and Assurance (FMA) assessments, to assess fraud risks in specific areas of spending;

producing regular fraud landscape reports with overall estimates of the extent of fraud and error across government;

improved reporting on the level of detected frauds and how much of this money is recovered; and

producing a global fraud risk assessment for the government’s COVID-19 response, setting out the areas most vulnerable to fraud attacks.

We discuss progress made by government to develop its counter-fraud capability, including how it assesses and measures fraud risk, in Part Two.

Overall estimates of the extent of fraud and error across government

1.8 Cabinet Office convened the Fraud Measurement and Assurance Programme Oversight Board to assess fraud measurement exercises across government and to estimate the overall level of fraud and error. Cabinet Office published a fraud landscape report for every year from 2017 to 2022. Its latest estimate, published in March 2023, is that the public sector lost between £33.2 billion and £58.8 billion to fraud and error in 2020-21, out of £1,106.1 billion expenditure and £608.8 billion tax revenue, excluding schemes specific to COVID-19 (Figure 1).10 The Oversight Board judged that the “true scale of fraud and error loss lies towards the lower end of this range”.

1.9 GCFF estimates include both fraud and error because it can be difficult and resource-intensive to differentiate between fraud and error and often they require the same preventive approach. Differentiating between fraud and error requires an assessment of likely intent, which requires a more thorough examination of each case in the sample. Less robust estimates are less likely to be able to make this distinction.

1.10 The Public Sector Fraud Authority (PSFA) told us that it in its view these estimates were the best available and that the methodology compared favourably with those used by other governments internationally. However, it acknowledged that the estimates have limitations. The estimates are based primarily on the few estimates used for departmental annual reports and accounts. The remaining part of GCFF’s estimate is based on estimates by the Oversight Board, who used their professional judgement and the outcomes of the limited number of robust FMAs to assess the potential range of losses across all areas of government spending where there is no specific estimate of fraud and error. There are no specific estimates for the levels of corruption or regulatory fraud. We discuss the various parts of the PSFA estimate below.

Department-specific annual estimates of fraud and error

1.11 Of GCFF’s £33.2 billion lower bound estimate of fraud and error in 2020-21, some £30.3 billion relates to departmental specific estimates. These are normally set out in the department’s annual reports and accounts, including non-accounting estimates such as the tax gap (Figure 1 overleaf). Of this, £29.7 billion (89% of the lower bound estimate) relates to tax and welfare.

Tax and welfare

1.12 The National Audit Office has qualified the accounts of the Department for Work & Pensions (DWP) since 1988 and HM Revenue & Customs (HMRC) since 2003 because of material levels of fraud and error in the welfare and tax systems. We also report on the tax gap as part of our report accompanying the HMRC Annual Report and Accounts. The latest published estimates are:

DWP benefits. DWP’s estimated fraud and error in DWP benefit expenditure in 2021-22 led to £8.6 billion of overpayments, of which £6.5 billion was fraud (3% of DWP’s benefit expenditure);

HMRC tax gap. HMRC’s estimated difference between total theoretical tax liabilities and those actually collected in 2020-21 was £32 billion (5.1% of total theoretical tax liabilities). Of this, GCFF includes £20.2 billion in its estimate of government’s total fraud and error, and of that £10 billion was due specifically to tax evasion or criminal attack; and

HMRC benefits and credits. HMRC’s most recent estimates suggest: the level of overpayment due to fraud and error in Tax Credits was £780 million in 2020-21, of which £20 million was fraud (0.13% of HMRC’s tax credit expenditure); that abuse of tax reliefs for research and development cost the taxpayer £469 million in 2021-22 (4.9% of the cost of these reliefs); and that there is a further £105 million of fraud and error in relation to Child Benefit (0.9% of HMRC’s Child Benefit expenditure).

1.13 Both HMRC and DWP have developed sophisticated measures of the level of fraud in tax and welfare using sampling and estimation techniques that they estimate cost them approximately £16.5 million and £5.6 million in staff time respectively each year:11

In Tackling the tax gap, in 2020, we found that HMRC’s analysis is one of the most comprehensive studies available internationally, but the precise scale of the tax gap remains inherently uncertain.12 Tax evasion and the hidden economy are particularly difficult to estimate because taxpayers conceal them from HMRC. Moreover, HMRC updates its methodology each year to improve accuracy, which can lead to significant revisions to past trends.

Similarly, both HMRC and DWP have measurement exercises that are robust enough to give a good indication of the levels of fraud and error in benefit expenditure. We use these to assess the level of irregularity in the accounts. However, they also have limitations, such as the difficulty of detecting and measuring non-declared income that claimants receive cash in hand or from the hidden economy, and, to keep costs proportionate, they do not measure every benefit every year.

Other annual estimates

1.14 Outside of welfare and taxation, few departments produce annual assessments of their level of fraud. For example:

Legal Aid Agency. Until 2011-12, we qualified the accounts of the Legal Aid Commission for material levels of fraud and error. Its successor body, the Legal Aid Agency, continues to produce a robust annual assessment of the level of fraud and error using sampling exercises which, in 2021-22, it estimated at £18.6 million (1.04% of relevant expenditure).13 This is included in the GCFF estimate.

NHS vulnerability to fraud. The NHS Counter Fraud Authority (NHSCFA) produces an annual Strategic Intelligence Assessment, which includes an estimate of vulnerability to fraud in NHS spending. In 2021-22, it estimated that £1,198 million of NHS spend was vulnerable to fraud. It bases this on separate estimates over 11 areas of NHS spending and risk, such as procurement fraud and data manipulation fraud, using data from the previous year. NHSCFA undertakes an in-depth analysis and measurement exercise to provide a statistically robust estimate of the level of fraud for some of these specific areas. However, it does not directly measure all areas and instead applies either a comparative benchmark or a baseline assumption of 1% fraud in NHS spending. As a result, it has varying levels of confidence for different parts of the estimate depending on the method used. The GCFF includes £345 million of NHS fraud in its estimate of the overall level of government fraud and error, being those elements that are more reliable.

Potential exposure to fraud loss in Ministry of Defence (MoD) spending. The MoD Fraud Defence team estimates that the MoD was exposed to between £1,295 million and £1,376 million of fraud loss in 2021-22. For its two highest fraud risk areas, it uses benchmarks from academic research to assume 4.8% of its annual procurement spend and 1.7% of its staff costs are fraudulent. It also multiplies its five-year average of detected fraud within MoD by 10, based on the assumption that 10% is a common detection rate in the public and private sectors. GCFF does not include the MoD estimate in its estimate of the overall level of fraud and error.

Fraud Measurement and Assurance Assessments

1.15 The remainder of the GCFF estimate of fraud and error is based on the GCFF’s FMA programme. PSFA and its predecessors have run an FMA programme since 2014 to assess the level of fraud and error outside of those areas with an annual exercise. Under this programme, PSFA encourages central government public bodies to undertake and then reviews their assessments of the level of fraud and error. Each FMA exercise covers a specific area of spend and estimates the level of fraud and error in that spending. Since 2014, the FMA programme comprised 62 assessments covering £224 billion of spending (Figure 4).

1.16 The GCFF estimate includes the most recent FMA exercises that it rates as robust enough to use. The FMA Oversight Board also use historical FMA exercises that were assessed as meeting the standard to judge that fraud and error is likely to be in the range of 0.5% to 5% for the £571 billion (two-thirds) of government expenditure where fraud and error is not measured. The PSFA based its 0.5% to 5% estimate for the level of fraud and error across government principally on the results of FMA exercises considered high quality because of the depth of testing. The FMA Oversight Board then verified this range against international and cross-sector comparators (Figure 2).

1.17 However, limitations in the extent and quality of the FMA exercises mean that the range of uncertainty over GCFF’s estimate of the level of fraud and error remains very high. We found that:

the assessments cover a minority of government expenditure (Appendix Two). They have been spread over the past decade and some areas assessed no longer operate. Most departments are exposed to more than one area of fraud risk, while all have exposure to internal fraud and corruption risk. Government’s core departments have identified internal fraud and corruption, grant fraud and procurement and contacting fraud as the main fraud and corruption risks that they face. We have mapped out the larger areas of these activities across government to show how each department is exposed to the risk of fraud and corruption, and which of these has robust fraud measurement in place (Figure 3);

the areas covered are not necessarily the highest risks. Departments chose which areas to assess and did not always focus either on high-risk areas or a sample that could be extrapolated. For example, FMAs include 14 assessments of payroll and travel expenses, which are relatively easy to assess but are only vulnerable to low levels of fraud by value compared with higher spending areas. Of the nine assessments rated as of high quality, the one with the highest level of spend (£755 million) was on the European Regional Development Fund (ERDF). The Department for Levelling Up, Housing & Communities chose the ERDF for an FMA due to the level of spend, the need to improve controls around project change requests and a lack of counter-fraud processes on the programme. However, this fund already had relatively high levels of assurance in place as part of the reporting mechanism to the European Commission, so was less likely to have unknown fraud and error than other unassessed grants;

many assessments have been of poor quality (Figure 4). The GCFF’s FMA Oversight Board concluded that 32 of the assessments, representing more than half (57%) of assessed expenditure, produced outcomes that are not reliable. Most of these unreliable assessments were conducted earlier in the FMA programme lifetime. Of the 31 assessments that met the standard, the Oversight Board rated only nine assessments representing 1% of assessed expenditure as “comprehensive” and 22 (42% by value of expenditure) as a “thorough attempt at measuring losses with a few limitations”. PSFA told us the most common reasons some did not meet the standard included not conducting testing in enough depth; missing whole categories of fraud or error risk; not testing the highest-rated fraud risks; using a sample that is not representative of the whole population; and not making demonstrably consistent decisions when determining whether fraud or error has happened; and

the quality of assessments improved until the start of the COVID-19 pandemic. The quality of assessments had improved between 2016 and 2020 when Cabinet Office provided more support and guidance to teams on how to meet the standards. However, the nature of this support was changed during the pandemic. The usual gated review process was stopped and Cabinet Office staff focused on producing the global fraud risk assessment to provide an overview of fraud risk in COVID-19 schemes across the whole of government, and supporting wider Post Event Assurance work (paragraph 1.24) concentrating on fraud risk assessment activity. The Oversight Board rated all of the COVID-19 assessments as unreliable, including those for the Department for Business, Energy & Industrial Strategy’s (BEIS’s) business support loan and grant schemes and the Department of Health & Social Care’s (DHSC’s) Personal Protective Equipment (PPE) procurement.

Detected levels of fraud elsewhere

1.18 Cabinet Office also reports that departments have detected an increasing amount of fraud and error outside of tax and welfare expenditure. These are actual cases of fraud where both the suspect and amount have been identified. Outside of tax and welfare, since 2014-15, departments and their arm’s-length bodies have reported Cabinet Office that they detected £0.9 billion of fraud (Figure 5). This includes reported internal fraud and corruption. The Cabinet Office only started reporting on fraud-specific recoveries (rather than fraud and error) in 2017-18, but it is clear that departments only recover a minority of the fraud they detect. It is not possible to tell whether the increase in detected fraud and error relates to better detection or increased occurrence of fraud. The most recent year (2020-21) includes increased spending by government through COVID-19 schemes.

Fraud and corruption during the COVID-19 pandemic

The level of fraud recorded in the annual report and accounts

1.19 Fraud against government increased during the COVID-19 pandemic. PSFA has yet to update its estimates of fraud and error to take account of the pandemic. However, the amount of fraud in government expenditure that was reported in the accounts audited by the NAO rose from £5.5 billion in total in the two years before the pandemic (2018-19 and 2019-20) to £21 billion in total in the following two years. Of the £21 billion, £7.3 billion relates to temporary COVID-19 schemes. This is in addition to lost tax revenue of around £10 billion a year due to tax evasion and criminal attacks and the NHS Counter Fraud Authority’s estimate that the NHS was vulnerable to £1.2 billion of fraud reported in 2021-22 (Figure 6).

1.20 These accounting estimates are inherently uncertain but almost certainly underestimate the level of fraud and corruption during the pandemic because:

DHSC did not produce accounting estimates for the level of fraud in its COVID-19 spending. The Comptroller and Auditor General (C&AG) placed a limitation of scope on his audit opinion over the regularity of DHSC’s accounts in 2020-21 because the department did not have an assessment of the level of fraud within its procurement of PPE.14 DHSC conducted an FMA assessment of the level of fraud in its procurement of PPE in March 2022 that focused on the highest risk cases so that it could best identify and tackle specific cases of fraud. The PSFA said this was of a high quality and robust nature, but was unreliable as an estimate of the overall level of fraud because it was not a random sample and could not be extrapolated. DHSC told us it has since conducted a compliance audit of all contracts which, although it provides less confidence than a full FMA, suggests that as at November 2022 1.8% of its expenditure on PPE was fraudulent after its mitigations and recoveries. This has not been independently verified. DHSC also identified further risks of fraud in Test and Trace. Much of the spending for Test and Trace formed part of the accounts of the UK Health Security Agency, which did not have proper governance or financial controls in place to support the accounts for 2021-22, leading the C&AG to produce a disclaimer that he was unable to audit them and did not know if they contained material irregularity;15

accounting estimates normally exclude amounts that are not material in the context of each set of accounts – where material means so large that we as auditors would conclude it affected the understanding of each set of accounts as a whole. These amounts could still sum to a large amount across government;

estimates exclude certain categories of fraud. For example, BEIS’s estimate on the level of fraud in the Bounce Back Loans Scheme excluded fraud where the loan was not used for the purposes stated or the business had misstated their turnover; and estimates of benefit fraud are likely to underreport fraud due to undisclosed income from the cash in hand or hidden economy;

fraud estimates were based on incomplete data. For example, the data BEIS used for the Bounce Back Loan Scheme were collected in November 2020, while the scheme did not close for new applicants until March 2021; and

methods used to prepare estimates were inherently uncertain. For example, HMRC used a Monte Carlo simulation to determine the fraud and error ranges for its employment support schemes.16 However, HMRC acknowledged that the results of this analysis may not capture all reasonable outcomes, and it is possible that actual fraud and error values exceed its estimate.

The increased risk of fraud during the pandemic

1.21 The risk of fraud and error rose significantly as a result of government’s response to the pandemic. This was for a number of reasons including that government:

spent more on things that are prone to fraud and error, such as welfare, business support and grants;

often prioritised the need for speed when setting up new initiatives over reducing the risk of fraud and error;

provided support to people and businesses that it did not have a prior relationship with (and therefore lacked information to verify claims);

quickly introduced new supply chains to procure goods and services;

relaxed or modified normal controls to enable remote working and remote access to services by citizens;

prioritised its COVID-19 response over normal compliance activity; and

increased its risk appetite for fraud and error, as shown by ministerial directions accepting risks identified by the civil service.17

Together these factors led to control weaknesses and increased opportunities to commit fraud and corruption across government (Figure 7).

1.22 In 2020-21, Cabinet Office developed a global fraud risk assessment. In 2021, we reported that it listed 206 of government’s COVID-19 response schemes, representing £387 billion of announced expenditure, and its assessment of the potential risk of fraud in each.18 It risk-assessed 16 of these schemes as having a high or very high fraud risk, accounting for 57% (£219 billion) of the £387 billion. The risk assessments were shared with each department but were not based on a review of the controls in each scheme. Cabinet Office used these risk assessments to inform its deployment of resources and engagement with departments. The PSFA has accepted but not yet implemented a recommendation by the Committee of Public Accounts (PAC) to produce a global risk assessment for the whole of government.

1.23 There are several basic standards of public accountability that we think government could have maintained – even during the height of the COVID-19 emergency. We have identified specific examples where government failed to do this, leading to increased opportunities for fraud and corruption and risking loss of public trust:

Increasing transparency to Parliament and the public. In response to the pandemic government awarded around £18 billion of contracts using emergency procurement regulations that permit options including the use of direct award to suppliers without competition. We identified instances of significant delays in the publication of the details of some very large contracts that had been awarded in this manner.19

Management of potential conflicts of interest. In our review of a sample of COVID-19 contracts we did not find enough evidence that this risk was being adequately managed. It is even more important to have a clear approach to managing conflicts of interest when contracts are awarded directly to suppliers without competition.20

Promptly addressing known vulnerabilities to fraud. BEIS launched the Bounce Back Loan Scheme fully expecting a heightened risk of fraud as it suspended standard lending practices to provide support quickly. In December 2021, we reported that BEIS implemented subsequent counter-fraud measures too slowly to be effective.21

Timely financial reporting. The pandemic resulted in delays in government accounting, as departments needed to account for unprecedented expenditure and financial guarantees. The audits of these accounts also required significantly greater effort, given the risks involved. We reported in January 2023 that only 9% of local government bodies received audited accounts for 2020-21 by the extended statutory publication deadline of 30 September 2021 and 12% received audited accounts for 2021-22 by the statutory deadline of 30 November 2022.22

Recovery of public money lost to fraud and corruption

1.24 It is highly unlikely that most of the money that has been paid out to fraud and corruption will be recovered. In 2020, GCFF, central government bodies and the Government Internal Audit Agency, having identified the increased risk of fraud in government’s response to the pandemic, set up a ‘Post-event Assurance’ working group to measure and pursue fraud. This led to activity across government, including:

HMRC and the Taxpayer Protection Taskforce. HMRC estimates that total error and fraud across the lifetime of the COVID-19 support schemes is £4.5 billion, representing 4.6% of the £98.2 billion total support provided. Of this, around £2.1 billion was lost to opportunistic fraud, £367 million to organised crime and £2.1 billion to error. In Budget 2021 the government allocated more than £100 million for a Taxpayer Protection Taskforce to combat fraud and error in COVID-19 support schemes administered by HMRC. As at 31 March 2022, HMRC had recovered £762 million, including £536 million, which HMRC had recovered before the taskforce was set up. So far the majority of losses identified by the Taskforce have been a result of error. HMRC expects that by the time the taskforce winds down it will have recovered around £1.1 billion, one-quarter of the overall fraud and error losses. It expects to continue to recover some money after the Taskforce has ended, through its normal collection activity;

BEIS and the Bounce Back Loans Scheme. Based on early evidence BEIS expects 47.1% of fraudulent loans to be repaid without any further intervention. It is also working with the National Investigation Service (NATIS) and other law enforcement agencies to pursue fraud investigations. By 31 March 2022, NATIS had recovered £3.8 million against a target of £6 million, which represents less than 0.5% of estimated irregular payments through the scheme.23 BEIS has not made the progress it planned to and, as a result, its additional recovery action is not starting until up to three years after businesses received the irregular payments. This delay is likely to result in a lower rate of recovery; and

DWP and retrospective review. DWP retrospectively reviewed more than one million claims made at the height of the pandemic when it had relaxed its payment controls to process claims quickly. This generated savings of £500 million and focused mainly on the highest risk cases still in payment. It still left £1.5 billion of Universal Credit overpayments being paid in 2021-22 for claims that started between March and June 2020. It is starting to undertake more extensive targeted case reviews of more than two million open claims, which DWP expects will prevent £2 billion of losses to fraud and error over the Spending Review period.

1.25 The PSFA has promised to update PAC on the recovery and levels of fraud and error across other departments, following post-event assurance, in its spring 2023 bulletin.

6 See, for example, International Public Sector Fraud Forum, Guide to Understanding the Total Impact of Fraud, February 2020.

7 Organisation for Economic Co-operation and Development (OECD), Building Trust to Reinforce Democracy: Main Findings from the 2021 OECD Survey on Drivers of Trust in Public Institutions, July 2022.

8 Comptroller and Auditor General, Fraud landscape review, Session 2015-16, HC 850, National Audit Office, February 2016.

9 The Cabinet Office estimated ‘true’ detected fraud to be £72.9 million from a spend of £306 billion (0.02%) in 2014-15 excluding the Department for Work & Pensions, HM Revenue & Customs and local government.

10 Public Sector Fraud Authority, Cross-Government Fraud Landscape Annual Report 2022, March 2023. Available at:
www.gov.uk/government/publications/cross-government-fraud-landscape-annual-report-2022

11 These are an approximation of the cost of staff who work directly in fraud and error measurement. For HM Revenue & Customs this excludes the one-off costs of measuring fraud and error in COVID-19 schemes.

12 Comptroller and Auditor General, Tackling the tax gap, Session 2019–2021, HC 372, National Audit Office, July 2020.

13 The Legal Aid Agency estimates the net level of fraud and error in it expenditure was 0.77% (£13.7 million) after recoveries. We use this measure for the purposes of our audit of the regularity of its expenditure.

14 Department of Health & Social Care, Annual Report and Accounts 2020-21, Session 2021-22, HC 1053.

15 Department of Health & Social Care, Annual Report and Accounts 2021-22, Session 2022-23, HC 1043.

16 A Monte Carlo simulation is a computerised analytical technique to calculate likely outcomes by running multiple scenarios based on probability.

17 National Audit Office, Good practice guidance, Fraud and error, March 2021.

18 National Audit Office, Good practice guidance, Fraud and error, March 2021.

19 Comptroller and Auditor General, Investigation into government procurement during the COVID-19 pandemic, Session 2019–21, HC 959, National Audit Office, November 2020.

20 Comptroller and Auditor General, Investigation into government procurement during the COVID-19 pandemic, Session 2019–21, HC 959, National Audit Office, November 2020.

21 Comptroller and Auditor General, The Bounce Back Loan Scheme: an update, Session 2021-22, HC 861, National Audit Office, December 2021.

22 Comptroller and Auditor General, Progress update: Timeliness of local auditor reporting on local government in England, Session 2022-23, HC 1026, National Audit Office, January 2023.

23 A further £4.2 million has been recovered relating to payments by local authorities for support schemes.

Part Two

Government’s counter-fraud and corruption capability

2.1 In this part we set out:

efforts to improve government’s counter-fraud and corruption capability;

the setup of the Public Sector Fraud Authority (PSFA); and

the capacity of government to tackle fraud and corruption.

Efforts to improve government’s counter-fraud and corruption capability

2.2 There are several organisations involved in tackling fraud both within government and outside (Figure 8). Over the past six years government has sought to strengthen its counter-fraud capabilities (Figure 9).

2.3 Until 2014, the National Fraud Authority was the lead counter-fraud body in government, covering both threats against government and the wider public. The government dissolved the National Fraud Authority in March 2014 and transferred its functions to the National Crime Agency, City of London Police, Home Office and Cabinet Office. These organisations have mostly focused on economic crime in the wider economy. We recently published a report on their Progress combatting fraud.24

2.4 Our 2016 Fraud Landscape review found that departments’ capacity and capability to manage fraud was mixed.25 There was a small Cabinet Office team with policy responsibility for combatting fraud against government but it did not have any powers to require departments to take action. It tried to improve aspects of governmental capability through influence, and to promote collaboration between departments. This team aimed to raise the profile of counter-fraud activity and improve understanding of the cross-government picture by collecting data and surveying departments’ counter-fraud capacity.

2.5 Since our 2016 report, government has strengthened counter-fraud capability across the public sector (Figure 9) by:

establishing the Government Counter Fraud Function (GCFF) and standards for organisations. In 2018 Cabinet Office established the GCFF, which brings together some 13,000 people working on counter-fraud activity across the public sector. The newly established GCFF launched a set of Counter Fraud Functional Standards to set out minimum expectations for how government organisations should manage their fraud and corruption risks.

establishing the Government Counter Fraud Profession and standards for professionals. In October 2018, government launched the Government Counter Fraud Profession (GCFP), with leadership from across 18 public bodies, to support the development of capability for counter-fraud professionals across government. The GCFP grants membership to the profession based the evaluation of the knowledge and skills codified by GCFP standards. GCFP has produced professional standards in six counter-fraud disciplines, including leadership; intelligence; risk assessment; investigation; sanctions, redress and punishment; and fraud loss measurement. Since its launch the GCFP has grown to over 7,000 members from 56 organisations, including central and local government and policing. Alongside these standards, GCFP has developed bespoke training in fraud risk assessment and fraud loss measurement to increase capability across government, and has trained around 150 individuals to date.

establishing a process for Initial Fraud Impact Assessments (IFIA). Following publication of our 2021 fraud and error good practice guidance, PSFA introduced new requirements for departments to undertake IFIAs for major new initiatives. These are rapid assessments of potential fraud and corruption risks in policies so that appropriate controls can be designed and put in place before implementation. Those with a higher risk require a full fraud risk assessment, supported by PSFA, including an assessment of the effectiveness of those controls. This has been consolidated into HM Treasury’s Managing Public Money guidance and is already being adopted on new schemes.26 PSFA piloted a cross-government ‘tiger team’ of experts to undertake IFIAs, fraud risk assessments and initial prevention advice on the Department for Business, Energy & Industrial Strategy’s (BEIS’s) new energy schemes.

trying to make progress in the use of data and intelligence to detect and prevent fraud. Government introduced the Digital Economy Act in 2017, which aims to make it easier for public bodies to share data to find and prevent fraud. The Cabinet Office has also run the National Fraud Initiative, which uses data matching to help public bodies detect fraud and reported that between April 2020 and March 2022 that it had recovered and prevented £442.6 million of fraud. Cabinet Office also produced best practice guidance for public bodies on how to use data to find and prevent fraud. During the pandemic, it set up a data analytics service to support the detection of fraud relating to COVID-19 expenditure.

The Public Sector Fraud Authority

2.6 The level of fraud in the government’s COVID-19 schemes has increased the profile and awareness of fraud attacks against government. The Bounce Back Loan Scheme, in particular, led to large losses in BEIS, a body that had little counter-fraud capacity of its own. This led to calls for greater central support for counter-fraud capabilities. In January 2022, the minister responsible for the GCFF resigned citing a lack of prioritisation of tackling fraud. In the summer of 2022, the government launched the PSFA.

2.7 PSFA is now government’s centre of expertise for the management of public sector fraud and associated error against the public sector. It is part of the Cabinet Office and incorporates the former Cabinet Office policy team. It reports to both Cabinet Office and HM Treasury so that it can integrate with both. It now leads the GCFF, which includes some 13,000 people across the whole of central government and provides the secretariat to the GCFP.

2.8 PSFA is at an early stage. In the eight months since its inception, it has agreed its mandate with departments, appointed its interim leadership and started to set up its teams. PSFA has three core roles to support the profession and function:

Practice, Standard and Capability: developing the profession through the provision of professional standards for people and training.

Performance, Assurance and Evidence: assessing the quality of departmental approaches.

Counter-fraud policy: leading on cross-government counter-fraud policy issues.

2.9 PSFA has also set out plans for its central services for 2023 including plans for:

enforcement: a central unit to investigate frauds that departments do not have capacity to investigate;

data and Intelligence: a central data-matching and intelligence function, building on existing data matching initiatives such as the National Fraud Initiative; and

risk threat and prevention: providing risk assessments of new initiatives.

2.10 The departments’ counter-fraud teams that we spoke to were broadly supportive of the establishment of the PSFA and its ambitions. They told us they are looking to PSFA for support and guidance, particularly in increasing counter-fraud capability within departments and developing best practice. However, they raised concerns about the way both Cabinet Office and the PSFA made demands of the small counter-fraud teams in departments to provide information without considering the resources available. They also wondered if PSFA would be able to expand its brief to adequately cover corruption given the GCFF’s historical focus on fraud. PSFA told us that it understood why some staff in the function would feel like this, but that it believed that their perception would change once PSFA rolled out its new services.

Departments’ counter-fraud capability

2.11 In 2021, HM Treasury commissioned GCFF to undertake a Workforce and Performance Review (WPR) to map the counter-fraud resources and delivery outcomes of 70 central government organisations, including all the main departments and the larger arm’s-length bodies. The WPR was delayed due to the diversion of PSFA’s resources to supporting the fraud risk assessment for the BEIS energy schemes. PSFA concluded the WPR in March 2023. We set out a summary of the data it collected below and set out PSFA’s conclusions on pages 39 to 40.

2.12 Counter-fraud staff and capability are unevenly spread across government (Figure 10). Some 11,200 (84%) work for the Department for Work & Pensions (DWP) or HM Revenue & Customs (HMRC), which have the most fraud and therefore the most counter-fraud capability. They also have their own enforcement powers; are more likely to have counter-fraud activities embedded within operations; and have other counter-fraud expertise not available to other departments. For example, DWP’s Integrated Risk and Intelligence Service is developing machine-learning approaches to risk-assess transactions before payments are made.

2.13 The remaining 16% of counter-fraud staff are spread across the rest of government including within:

centres of good practice. Most departments have a small central teams of one to five people who coordinate counter-fraud risk assessment and activity, distribute good practice and interface with PSFA;

dedicated investigation units. Some departments have their own investigation units. For example, the Department for Environment, Food & Rural Affairs’ (Defra’s) Investigation Service has around 20 staff and covers both regulatory and criminal investigations. The NHS Counter Fraud Authority (NHSCFA) has 156 staff focused on tackling fraud and corruption across the NHS including internal and service user fraud. HM Prison & Probation Service has a unit of around 150 staff focused on corruption among prison and probation officers; and

specialist teams with counter-fraud and corruption professionals. These focus on managing specific risks in their department. For example, the Department for Levelling-Up, Housing & Communities has set up a Grants Centre of Excellence of seven staff to manage its risk of grant fraud.

Government bodies may also receive counter-fraud and investigation support from the Government Internal Audit Agency.

2.14 Some organisations play an important role in government’s wider fraud prevention efforts, even though they report limited fraud and corruption staff. For example, Defra has people working on waste crime who are not reported in the counter-fraud function, but do investigate fraud among other crimes.

2.15 Not all counter-fraud staff are counter-fraud professionals. Despite GCFF efforts to promote the profession, set standards and train people to them, there are 6,971 members of the profession, 6,073 of whom work in central government, compared with 13,368 full-time equivalent staff in the function.

2.16 The majority of counter-fraud staff as at 2021-22 were investigators (Figure 11). The GCFP has attempted to train and professionalise counter-fraud staff in risk assessment and measurement disciplines. For example, PSFA reports that 99 fraud risk assessors were trained across government by the end of 2020-21, up from 41 in 2019-20.

PSFA Workforce and Performance Review assessments

2.17 As part of its WPR, PSFA performed a baseline assessment of each of the 70 public bodies counter-fraud understanding, resourcing and outcomes (Figure 12). It collected data in April 2022 and used performance data from 2020-21. In making these assessments, PSFA noted that the COVID-19 pandemic led to a significant increase in vulnerability to fraud risk across government and that its assessments aimed to determine how well-placed central government bodies were to meet the challenge presented by this heightened risk environment. PSFA told us that it was trying to establish a baseline initial understanding in order to enable it to offer more tailored support to departments to enhance the effectiveness of their efforts. The WPR assessed organisations against three criteria:

Understanding fraud risk. This assesses whether the organisation has demonstrated an understanding of the fraud and error risks they face. This includes whether the organisation has an up-to-date organisational fraud risk assessment, undertaken by trained counter-fraud staff, that measures and quantifies the extent of fraud. It also looks at whether recent fraud measurement exercises had been undertaken to estimate the level of fraud and error with a high level of confidence. It also considers whether the appropriate ‘tone from the top’ is set by a senior officer accountable with counter-fraud objectives.

Counter-fraud resourcing. This assesses whether the organisation is able to demonstrate that its counter-fraud resources are aligned to its expenditure and fraud risk profile. This takes into account all the resources that were reported as being invested in counter-fraud, including staffing and investments such as data, analytics and third-party services. PSFA told us this was often a subjective assessment based on the organisation’s inherent risks because most of the public bodies being assessed lacked robust quantitative assessments of the extent of fraud.

Counter-fraud outcomes. This assesses whether the organisation can demonstrate that its counter-fraud activity was delivering effective outcomes. This includes the outcomes being delivered against an organisation’s counter-fraud investment, particularly in relation to the value of fraud and error being prevented and recovered. It also includes how the organisation tracks and reports the outcome delivery, including its use of targets, and how it uses these data to drive future outcome improvements.

2.18 PSFA’s preliminary conclusions are that most public bodies could do more to understand and manage their fraud risks. Using data collected in April 2022 and performance information from 2020-21, the PSFA came to a preliminary conclusion that only 14% of the organisations assessed have mechanisms in place to understand and measure the fraud risks that they face; 27% of organisations had clear indicators of a mismatch between their resources and the risk; and 6% of organisations assessed were delivering a strong return on their counter-fraud investment against an agreed target. The majority of the rest were making progress towards improving their understanding of fraud risk and resourcing and PSFA wants more to show that they are achieving a return on investment of at least £3 for every £1 spent on counter-fraud. PSFA intends to further engage with departments rated red under the WPR.

2.19 These results match our understanding from conversations and work across government. Many officials with responsibility for counter-fraud told us that managing fraud and corruption risks is rarely a top priority for senior leaders in their organisations, mainly due to competing priorities, and is not sufficiently embedded in operations. Officials also told us that methodological concerns and resource constraints are the main barriers to undertaking proper fraud measurement exercises.

2.20 The lack of prioritisation by some departments leaves government particularly exposed to both emerging and unknown risks. With most counter-fraud and corruption activity being focused on specific risks, government has lacked capacity to adapt to new risks. For example, BEIS recognised that there was a risk of fraud in the Bounce Back Loan Scheme when it set it up and requested a ministerial direction (a written instruction from the minister to proceed). It recognised that, to provide better oversight of the fraud risk and the lenders that participated in the scheme, it needed to restructure its counter-fraud function and bring in more capacity to supplement its existing team of two full-time staff. The GCFF placed a senior civil servant into BEIS to aid the counter-fraud response. BEIS has since increased its central counter-fraud team to 15 full-time staff. By contrast, BEIS used its learning from the Bounce Back Loan Scheme and newly enhanced counter-fraud capability to work with the PSFA to improve its design of counter-fraud controls for the new energy schemes.27

2.21 However, the BEIS counter-fraud function at the time was two full-time staff and it decided to bring in more staff and restructure its counter-fraud capability.

Data and intelligence sharing

Intelligence sharing

2.22 There are several fraud intelligence bodies, most notably Action Fraud and the National Crime Agency’s National Assessment Centre, who share intelligence on types of fraud and specific data on individuals and organisations associated with fraud. The counter-fraud staff that we spoke to said that they received intelligence on the types of fraud. However, several (particularly among the smaller teams) said they received limited information that they could share and act on. In part this may be due to the lack of capacity and capability within those departments to use intelligence.

2.23 Government does not have a specific operational capability to share intelligence and data about attacks against it. Such a capability could help prevent those who are detected attacking one part of government from successfully attacking other parts. As part of its response to fraud against COVID-19 schemes, Cabinet Office set up a temporary hotline to receive intelligence from the public about fraud against the government. It received some 7,000 reports from May 2020 to date. Around 75% of these related to the Bounce Back Loan Scheme. PSFA believes this showed the value of routinely sharing intelligence to prevent fraud and it is now considering how best to improve the sharing of intelligence across government.

Data-matching to prevent fraud

2.24 Good preventive controls require effective use of government data to verify information against information already provided and to detect anomalies that can be investigated. The Digital Economy Act 2017 provides a legal framework for establishing data-sharing arrangements, in England and Wales, to deal with fraud including data for: governance; intelligence and best practice; detecting fraud; and data-matching for detention and prevention. There have been 20 pilots under the Act focused on the prevention of fraud and some examples of data-matching before payments are made.

2.25 Technology provides the opportunity for real-time risk assessment of transactions. This could support due diligence on specific payments before they are made. For example, DWP uses HMRC real-time payroll data to verify benefit payments. However, most public bodies using data approaches to detect fraud use time-lagged data, which has to be manually formatted. To use real-time data, systems need to be integrated. Department counter-fraud staff told us that the processes in place for sharing data, both between and within departmental groups, are often slow and burdensome, often resulting in incomplete or time-lagged data being shared. There is also variability in the quality and format of data as there are no standards across government.

2.26 In our 2022 guide on improving data, we said that the benefits of better data are not simple to achieve in practice. They will require focused effort, funding and prioritisation to achieve. Legacy systems and ageing data also present a barrier as they create complex practical issues for data-sharing and the challenges involved in using this data are not well understood. The Cabinet Office’s Central Digital and Data Office (CDDO) has taken early steps to improve the use of data across government but acknowledges that significant technical and cultural barriers remain.

24 Comptroller and Auditor General, Progress combatting fraud, Session 2022-23, HC 654, National Audit Office, November 2022.

25 Comptroller and Auditor General, Fraud Landscape review, Session 2015-16, HC 850, National Audit Office, February 2016.

26 HM Treasury, Managing Public Money, March 2022. Annex 4.9 “A4.9.5 For any new major area of spend, departments shall assess the risk of and impact from fraud at the outset when the spending is being proposed. This should identify the potential for fraud and the different impacts that fraud could have for this spend area. Once spending is approved this should result in the development and continued maintenance of a detailed fraud risk assessment”.

27 Comptroller and Auditor General, Energy bills support, Session 2022-23, HC 1025, National Audit Office, February 2023.

Part Three

What needs to be done

3.1 In this part we set out the insights from our work on what government can do to both protect itself from fraud and corruption and to improve public confidence in its ability to do so.

3.2 We spoke to 46 officials working in or with the counter-fraud function. This included all the heads of counter-fraud across all the main government departments and some of the larger arm’s-length bodies and a selection of senior officials with a perspective on how fraud and corruption prevention is managed operationally. We found a broad consensus on the challenges government faces and the things that the Public Sector Fraud Authority (PSFA) and departments need to tackle. Using this, and our experience as the auditor of central government bodies, we have produced nine insights for PSFA and departments to put into practice (Figure 13).

a) Demonstrate best-practice financial control and transparency

Why is this important?

3.3 The level of fraud and identified shortcomings in standards of public accountability during the COVID-19 pandemic heighten the risk that the public perceives fraud and corruption as normal and government controls as weak. As set out in Part One, our audits of government’s response to the COVID-19 pandemic found examples of departments consciously prioritising speed of response over basic controls in welfare, business support, and procurement. As the country comes out of the pandemic, departments need to both focus on basic controls and promote awareness of their efforts to do so, so that they are seen to role-model best practice.

What are the challenges?

Putting best practice in place. Departments need to renew their focus on best practice. We have listed a range of good practice guides on effective governance and financial management relevant to tackling fraud and corruption in Appendix Three.

Being transparent. Transparency by government can act both to deter fraud and corruption and to stimulate whistleblower and public reports to identify when it does occur. Departments need to be transparent in how decisions are made and where money is spent. This includes the need to report procurement, contract awards, spending above £25,000 and grants.

Developing minimum standards for emergencies. Standard processes are designed to provide proportionate cost-effective control over risks. It is natural for leaders to want to act faster in times of emergency than standard processes sometimes allow. But they then need alternative ways of providing both transparency and assurance over the risks. For example, formal bid processes would not have worked well during the height of the COVID-19 pandemic to acquire emergency medical equipment, but it would have been possible to publish contracts in a timely way, to document how they managed conflicts of interest and to properly document decisions, to avoid perceptions of unfair treatment of suppliers.

b) Act as ‘one government’ in tackling fraud

Why is this important?

3.4 Government’s counter-fraud and corruption efforts need to be led by each public body so that they can embed a preventive approach into their operations. However, public bodies can better protect themselves by sharing data and intelligence with other public bodies and working together. For example, people and organisations that attack one part of government are likely to attack another part. Many do not have the capability for data-led counter-fraud approaches or the expertise to embed cutting-edge counter-fraud practice in policy and system design. Establishing the PSFA presents the opportunity to better coordinate government efforts and to provide services that fill some of the capability gaps.

What are the challenges?

Win the buy-in of departments. Our previous work has found that it can be difficult to establish effective central services and many shared services fail if they do not win the buy-in of departments to their approach. PSFA has an inherent tension between its assurance role assessing departmental capability and its service role supporting those departments. PSFA must balance these aspects of its role in a way that harnesses departments’ support. PSFA should establish a functional user board to bring a user perspective to its governance.

Sharing leadership of the function across bodies. PSFA now has responsibility for leading the cross-government approach to fraud and corruption. However, with most of government’s counter-fraud and corruption capability in two departments, PSFA will need the Department for Work & Pensions’ (DWP’s) and HM Revenue & Customs’ (HMRC’s) support to supply expertise, staff and development of standards. PSFA is considering developing communities of practice across departments to develop and share technical expertise on specific issues.

Establishing a business case for each service. PSFA has not yet set out business cases for its services. Our work has shown government can find it difficult to present business cases for shared and central services because it lacks proper costing and benefits data. This can make it difficult to convince departments to use the new services. PSFA needs to establish operational plans that define services and responsibilities so they can integrate with other services.

Developing central policy and providing strategic intelligence reviews. Some experts told us they want PSFA to provide horizon-scanning to identify future risks that government can plan for and increase its resilience against fraud and corruption. For example, departments are concerned about the increasing use of cryptocurrency to obscure the movement of proceeds of crime and what future challenges technology would bring.

c) Set an anti-fraud and corruption culture

Why is this important?

3.5 Leaders need to set the right ‘tone from the top’ on tackling fraud and corruption. This helps to set the culture of government, encourages ethical practice, acts as a deterrent to commit fraud and corruption and encourages whistleblowers to report fraud and corruption. A strong focus on fraud and corruption through an organisation’s governance, controls and risk management can help not only to detect and prevent fraud and corruption but also to establish a counter-fraud and corruption culture.

What are the challenges?

Prioritising fraud and corruption even though they are hidden crimes. Because fraud and corruption are hidden crimes, it can be too easy for senior leaders to assume that there is little risk without proper assessment. On the other hand, without reliable risk assessments, government may over-react to the risks of fraud and corruption in ways that may not be value for money. Leaders need to make clear statements about the prioritisation of fraud and corruption based on robust assessments of the risk.

Celebrating tackling fraud and corruption. Some counter-fraud professionals told us that senior officials can be reluctant to prioritise the detection and pursuit of fraud and corruption because of the risk to the organisation’s reputation. Government should promote a culture that celebrates the detection and tackling of fraud and corruption in the same way as a safety culture promotes the reporting of accidents and near misses – so that lessons can be learned.

Embedding tackling fraud and corruption as part of robust risk management. All professions and parts of the organisation have a role in stopping fraud and corruption. Public bodies should have in place robust risk management that collates and assesses risks to objectives across their organisations and leads to action to mitigate those risks. Discussing counter-fraud and corruption controls as part of risk management can help embed them through middle management and across an organisation.

d) Develop robust assessments of the level of fraud and corruption

Why is this important?

3.6 Best practice requires departments to undertake an assessment of fraud and corruption in the same way as any other risk so that effective controls can be put in place. However, undertaking a robust assessment of fraud and corruption risks is very challenging, particularly if it is to include quantification of the likely extent of fraud and corruption, so that the assessment can be used to prioritise resources.

What are the challenges?

Establishing a global fraud risk assessment. PSFA’s mandate sets out how it will establish a global fraud risk assessment that sets out the risk across government. This will need to be more specific than the existing estimates of fraud and error if it is to highlight areas where further action is necessary to manage the risk. It should also include some analysis of the causes of fraud and trends across government. It will depend on departments being able to undertake better fraud risk assessments and measurement exercises.

Lack of a defined robust but proportionate approach for smaller risk areas. The current approach to Fraud Measurement and Assurance (FMA) exercises is not leading to robust risk assessments and measurement exercises with sufficient coverage across government to give an overall assessment of where the key fraud risks lie. PSFA needs to work with departments to improve the methodology used for estimating the level of fraud and corruption in government activities so that it can have greater coverage. This needs to make best use of all the available information including intelligence, an assessment of the risk inherent in the activity and knowledge of the controls in place.

A lack of return-on-investment metrics. Only four organisations currently measure the return they achieve from their counter-fraud teams against clear metrics. As a result of the lack of robust fraud measurement, government does not have a methodology for establishing the return on its counter-fraud and corruption investment as a whole. This means it does not know that it has invested the right amount or that its investment is in the right areas. It also means government does not know how its counter-fraud and corruption efforts are contributing to its efficiency agenda.

Inappropriate targets. Some fraud teams have set targets in place on amounts of losses due to fraud that they detect, prevent and recover. These measures can provide the wrong incentives if presented without a measure of the underlying rate of fraud and corruption because they can encourage investigative work (and potentially cherry-picking easy cases) at the expense of focusing on reducing the overall level of fraud and corruption through prevention work.

e) Embrace a preventive approach, tailored to the risks of each area

Why is this important?

3.7 Preventing fraud and corruption is normally more cost-effective than detecting and pursuing it after it has taken place. The aim should be to minimise the risk of fraud and corruption while securing the other objectives of the organisation. This inevitably requires judgement about the trade-offs between competing objectives. Our fraud assessment framework looks for “cost-effective controls” meaning that the preventive controls are working and could not be readily improved without overly harming the wider objectives.28 Public bodies are at different stages of maturity towards achieving this goal, and none have demonstrated that they have a fully cost-effective control environment.

What are the challenges?

Tailoring to specific risks. A cost-effective control environment needs to be tailored to the specific risks and issues faced by each public body, and their approach to achieving it will vary by the nature of the risks they face. PSFA will need to tailor its advice and guidance to each department.

Increasing the influence of the counter-fraud and corruption profession. PSFA will need to be influential beyond the counter-fraud and corruption profession, so that it can work with other professions to design and operate controls including in operations, finance, grants, commercial and policy.

Demonstrating cost-effective controls. Departments need a way of testing that they have achieved cost-effective controls. This requires ways of assessing the strength of individual controls and determining that they are working to best effect without unforeseen consequences on other departmental objectives. So far, departments have not had this level of granularity in their fraud risk assessments.

f) Develop the counter-fraud and corruption profession

Why is this important?

3.8 The counter-fraud profession has traditionally focused more on the detection, investigation and pursuit of fraudsters and corrupt officials rather than on prevention and minimising fraud and corruption. Most people identifying as part of the counter-fraud and corruption profession are trained investigators and not experts in designing operational systems. Many departments lack senior counter-fraud professionals with influence in the organisation.

What are the challenges?

Professionalising the function. Less than 45% of those working in the counter-fraud function are members of the profession and have been trained and assessed against the professional standards. PSFA aims to increase GCFP membership from around 7,000 to 10,000 over the next three years.

Changing the role of the profession. It will require the development of a cadre of staff with different skills to the traditional focus on investigation. It may also require a cadre of more senior counter-fraud and corruption professionals who can influence the creation of policies, operations and systems. PSFA needs to decide whether to develop these cadres centrally or within departments.

Improving the quality of counter-fraud professionals. PSFA aims to move towards a ‘licence to operate system’ for those practicing in the function. GCFP published revised professional standards for fraud risk assessment in March 2022 and investigation in November 2022. It plans further standards for other aspects of counter-fraud. It is working with training providers to train members of the profession to those standards and wants to introduce more continuing professional development.

Competing for talent. The experience of other government professions shows that as it increases its focus on countering fraud and corruption, government will be competing for the new cadre of staff it is developing. Departments told us they are already competing with industry for the best counter-fraud professionals, who are in high demand, particularly in banking. PSFA may therefore find that it needs to coordinate talent management, recruitment and retention activity.

g) Harness and use data to prevent fraud and corruption

Why is this important?

3.9 Cost-effective prevention approaches will require better use of data and information across government. This includes data for governance and decision-making, intelligence and best practice sharing and data matching for bothdetection and prevention purposes.

What are the challenges?

Embedding the use of data to assess the risk of fraud before payment. Counter-fraud staff told us that their use of data-matching is limited and they continue to encounter legal and technical difficulties with data-sharing.Achieving the benefits of better data is not simple to achieve in practice and will require focused effort, funding and prioritisation to achieve. Counter-fraud staff told us that it would be helpful if PSFA works with Cabinet Office to lead on developing data-sharing policy to overcome both technical and legal barriers.

Improving public confidence in data analytics. The Committee of Public Accounts has identified the need for transparency to increase public confidence in the use of data analytics and machine-learning for the detection of fraudulent activity. For instance, DWP is trialling machine-learning to identify suspicious Universal Credit claims before an advance is made and hopes to use this more widely across the benefit system.29 While the use of machine-learning means that there will not be an algorithm that can be published, departments can provide transparency over the governance, inputs, outputs, and outcomes for different user groups of the use of such analytics.

Improving the collection and use of intelligence. There are numerous bodies offering counter-fraud intelligence including the Action Fraud hotline run by the City of London Police and Cifas, whose members share information about fraud. PSFA is considering how best to improve and share intelligence across government. However, smaller counter-fraud teams may not have the capacity to absorb intelligence and act on it.

h) Design out fraud and corruption from new initiatives and systems

Why is this important?

3.10 Government needs to design out fraud and corruption from its processes and systems. One of the key lessons from government’s COVID-19 response is the need to design counter-fraud measures, including controls, reporting and recovery, into new initiatives at an early stage of the policy cycle.

What are the challenges?

Building in controls to new initiatives. PSFA has developed and trialled a process to apply counter-fraud expertise to the development of new spending initiatives through the use of Initial Fraud Impact Assessments (IFIAs). Departments and the PSFA now need to demonstrate that IFIAs lead to fraud management and measurement that delivers substantial savings and reductions in reported fraud. The National Audit Office will, where appropriate, look at these assessments and how they are used as part of our standard approach to auditing the value for money of spending initiatives.

Embedding counter-fraud and corruption expertise into the design of programmes and systems. The counter-fraud profession needs to take a prominent role in incorporating counter-fraud measures into the design of new systems and operational processes, as a standard part of government’s change programmes, if it is to build in the required preventive measures such as data matching and audit trails. For example, the Department for Environment, Food & Rural Affairs has embedded counter-fraud professionals in its team designing the Future Farming and Countryside Programme. Joining up systems with better data-matching may require a central strategy setting out data standards for public bodies to work to.

Transparency over IFIAs. Parliament has a legitimate interest in understanding the fraud and corruption risks inherent in the spending, regulations and initiatives that it debates and approves. However, government can be wary of publishing too many details for fear of advertising weaknesses in its controls that criminals can exploit. Government needs to develop a means of enhancing transparency over its IFIAs that manages these risks.

i) Use its investigative powers and capabilities as an effective preventive deterrent

Why is this important?

3.11 Detecting and pursuing fraudsters and corrupt officials is important for the provision of justice, to provide intelligence on what frauds and corruption are occurring and to act as deterrent for others. However, government has neither the ability or capacity to detect, investigate and gather sufficient evidence to support a prosecution of all fraud and corruption. Most money lost to fraud and corruption is not detected or recovered. Government therefore needs to use its investigative capabilities to best effect.

What are the challenges?

Powers. Enforcement and recovery powers are fragmented across government. HMRC and DWP have specific administrative powers to apply penalties on a civil burden of proof. DWP can recover funds through the welfare system. Other departments rely on the Proceeds of Crime Act to pursue the recovery of fraudulent payments. PSFA told us that it is working with departments to identify gaps in powers that prevent the investigation and recovery of funds and is considering new legislation to provide public bodies with more legal recourse to fight fraud.

Getting the balance right between criminal and civil prosecution. Some departments face the choice of referring a fraud they find for prosecution or applying a civil penalty, normally with a lower burden of proof and lower fine. The latter can offer a more cost-effective route to investigate fraud and recover funds, but may not offer the same deterrent effect. Departments need a way to demonstrate that they have this balance right between the two that provides for both the recovery of funds and a deterrent effect. But calculating these aspects can be very challenging. To help it achieve this balance, we recently recommended that HMRC analyses the relative rates of return from different types of compliance intervention.

Setting up a central enforcement function. Not all departments have the capability to investigate fraud for themselves. For example, the National Investigation Service (NATIS) – a local authority investigation service – provided some core investigative capability to support the Department for Business, Energy & Industrial Strategy with Bounce Back Loans. PSFA intends to establish its own enforcement function, which will need to be appropriately targeted and work with existing law enforcement agencies.

Clear communication and messaging. Government language and messaging, including broadcasting government’s enforcement successes, are important tools to act as a deterrent and reduce the risk of widespread non-compliance. There is potential for PSFA to develop a cross-government communication strategy, enhance transparency and maximise the impact of government’s enforcement interventions.

28 National Audit Office, Good practice guidance Fraud and error, March 2021.

29 For a description of how DWP manages the risks around its use of machine learning see Comptroller and Auditor General, Report on Accounts, in Department for Work & Pensions, Annual Report and Accounts 2021-22, Session 2021-22, HC 193, National Audit Office, July 2022.

Appendix One

Our evidence base

1 Our independent conclusions on government’s progress in tackling fraud and corruption against the public sector were reached following our analysis of evidence collected primarily between September 2022 and January 2023.

2 Our report focuses on fraud and corruption attacks against the public sector. It does not cover fraud against individuals or businesses that does not involve abuse of government processes or systems. The report also does not examine the effectiveness of individual departments’ activities to counter fraud and corruption.

Interviews with departmental officials

Selection and recruitment

3 We interviewed 46 officials from the main government departments and a selection of their agencies. Thirty-three of the officials had direct responsibilities for countering fraud and corruption, including the heads of counter-fraud for all the main departments and their larger arm’s-length bodies. Thirteen of the officials were responsible for aspects of wider business delivery and were primarily selected to provide us with an overview of how well integrated counter-fraud and corruption work is to departments’ overall operations.

Fieldwork

4 Fieldwork took place between November 2022 and January 2023. Interviews were carried out online, typically lasted one hour and detailed notes were taken.

5 Interviews focused on the following topics and were tailored to the job roles of those being interviewed:

Fraud risk landscape.

Departmental counter-fraud and corruption capabilities, including people, data, processes and systems.

Integration of counter-fraud and corruption experts within operational and programme delivery teams.

Relationship of departments with the centre of government.

System-wide perspective of government’s counter-fraud and corruption arrangements.

Analytical approach

6 We organised the interview notes in SharePoint to facilitate comprehensive and consistent analysis. We analysed the data thematically, reviewing the data against the themes identified in our evaluative framework; as well as taking into consideration themes emerging from the data. We used the data analysis to:

explore the systemic challenges to embedding best practice counter-fraud and corruption arrangements across government; and

triangulate evidence from other sources (including our document review and evidence from wider stakeholders).

Interviews with wider stakeholders

Selection and recruitment

7 We selected stakeholders to provide a broad range of perspectives on the role of the Public Sector Fraud Authority (PSFA) and the key challenges it faces. We identified stakeholders with a particular interest in tackling fraud and corruption across government. In total we carried out four interviews and spoke to seven representatives.

Fieldwork

8 Interviews took place in October 2022 and were carried out online. Interviews typically lasted around one hour, and detailed notes were taken.

9 Interviews explored stakeholder perspectives on the challenges faced by government in tackling fraud and corruption, with a particular focus on:

the fraud risk landscape;

government’s strategy and capability to tackle fraud and corruption; and

the system-wide perspective of the fraud landscape.

Analytical approach

10 We used the data to inform further lines of enquiry that were followed up with departments and to inform our assessment of the systemic challenges faced by government in its approach to tackling fraud and corruption. The findings presented in this report reflect the range and diversity of the views of stakeholders interviewed. As the sample was small and not statistically representative, the prevalence of views and experiences arising from the stakeholder interviews is not reported.

Document review

Focus and purpose

11 We reviewed a range of government documents to assist with defining the scope of the audit and to deepen the study team’s understanding of the scale of fraud and corruption, and government’s approach, including the launch of the PSFA, to overcoming the challenges it faces. This included a review of:

risk assessments;

governance arrangements;

organisational Workforce and Performance Review (WPR) returns collated as part of the PSFA’s review of government capability; and

counter-fraud functional standards.

Analytical approach

12 We reviewed each document against our overarching audit questions. The  review was also used to refine the scope of the study.

Data analysis

13 We analysed Whole of Government Accounts to set out the exposure of the various departmental groups to the different types of fraud and corruption risk. On establishing the scale of fraud and corruption across government, in addition to the PSFA’s annual estimate of fraud and error losses, we reviewed the estimated levels of fraud reported in the audited departmental accounts.

14 We analysed data collected, over the period April to May 2022, by the PSFA and its predecessor bodies, as part of its WPR of 70 public sector organisations, to establish government’s capability to tackle fraud and corruption. We used the number of counter-fraud staff as a proxy for the distribution of capabilities across government. We did not undertake an in-depth audit of organisations’ control environments to establish their effectiveness in deterring and preventing fraud and corruption.

Appendix Two

Types of fraud and corruption risks across government and where they have been measured

1 In this appendix we have set out the six types of fraud and corruption risks that we identify in this report as impacting major areas of government spend. For each risk type we have included a definition, discussion of the issues, case study and a summary of the fraud measurements conducted by government departments under the Fraud Measurement and Assurance (FMA) programme. Ideally, all of these area of spend should have undergone a fraud risk assessment, to identify the main fraud threats, followed by fraud measurement to quantify the potential impact.

a) Grant fraud.

b) Service-user fraud.

c) Procurement and commercial fraud.

d) Income evasion.

e) Internal fraud and corruption.

f) Regulatory fraud.

Appendix Three

Good practice guidance relevant to tackling fraud and corruption against government

CORRECTION SLIP

Title: Tackling fraud and corruption against government

SESSION 2022-23

HC 1199
ISBN: 978-1-78604-479-2

Ordered by the House of Commons to be printed on 29 March 2023

Correction One:

On page 4, key facts, 3rd column, an error needs to be corrected. The sentence currently reads as follows “£11.5bn (at least) of the £21 billion estimated fraud set out in the 2020-21 and 2021-22 Annual Report and Accounts relates to the COVID-19 pandemic”. This should read “£7.3bn of the £21 billion estimated fraud set out in the 2020-21 and 2021-22 Annual Report and Accounts relates to temporary COVID-19 schemes”.

The text currently reads:

£11.5bn (at least) of the £21 billion estimated fraud set out in the 2020-21 and 2021-22 Annual Report and Accounts relates to the COVID-19 pandemic.

The text should read:

£7.3bn of the £21 billion estimated fraud set out in the 2020-21 and 2021-22 Annual Report and Accounts relates to temporary COVID-19 schemes.

Date of correction: 29 March 2023

BACK

Design and Production by NAO Communications Team
DP Ref: 012234-001