© National Audit Office 2024

Lessons learned:
tackling fraud and protecting propriety in government spending during an emergency

Cabinet Office and HM Treasury

Session 2023-24
8 February 2024
HC 444

The National Audit Office (NAO) scrutinises public spending for Parliament and is independent of government and the civil service. We help Parliament hold government to account and we use our insights to help people who manage and govern public bodies improve public services.

The Comptroller and Auditor General (C&AG), Gareth Davies, is an Officer of the House of Commons and leads the NAO. We audit the financial accounts of departments and other public bodies. We also examine and report on the value for money of how public money has been spent.

In 2022, the NAO’s work led to a positive financial impact through reduced costs, improved service delivery, or other benefits to citizens, of £572 million.

We are the UK’s independent public spending watchdog.

We support Parliament in holding government to account and we help improve public services through our high-quality audits.

Report by the Comptroller and Auditor General

Ordered by the House of Commons
to be printed on 6 February 2024

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Gareth Davies
Comptroller and Auditor General
National Audit Office

2 February 2024

Lessons learned reports

Our lessons learned reports bring together what we know on important recurring issues to make it easier for others to understand and apply the lessons from our work.

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.org.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

012723 02/24 NAO

If you are reading this document with a screen reader you may wish to use the bookmarks option to navigate through the parts. If you require any of the graphics in another format, we can provide this on request. Please email us at www.nao.org.uk/contact-us

This report can be found on the National Audit Office website at www.nao.org.uk

If you need a version of this report in an alternative format for accessibility reasons, or any of the figures in a different format, contact the NAO at enquiries@nao.org.uk

The National Audit Office study team consisted of:

Marc Adams, James Ball, Lee Nicholson, Owen Sears and Santhya Sothynathan, under the direction of Joshua Reddaway.

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

020 7798 7400

www.nao.org.uk

@NAOorguk

Overview

What is propriety?

Achieving propriety in public spending means meeting high standards of public conduct, including robust governance, and the relevant parliamentary expectations, especially transparency. This includes managing the risk of fraud and that the right amount of money reaches the right people and businesses.

Why does protecting propriety matter in an emergency?

Emergency spending to support individuals, families and businesses and to buy necessary equipment can carry a higher risk of fraud and impropriety.

Things may have to be done more quickly than usual. Inevitably, the government’s response may not have been fully planned for and will be in addition to its usual responsibilities. The government will need to make difficult decisions, based on imperfect information, and it may not be possible to conduct processes such as full risk analysis or normal levels of due diligence. Fraudsters may target emergency spending believing there are greater opportunities to exploit initiatives that have been set up at pace. Accounting officers will need to make judgements about the trade-offs between speed, accuracy and risk.

But, while the government will need to take risks in an emergency, the fundamental principles of good governance and Managing Public Money will always apply. The impact of actual or perceived impropriety may persist for some time after an emergency, even if proven to be incorrect. This can undermine public trust in the government.

What can the government do to prepare for future emergency spending?

We have seen evidence of the government learning lessons from recent emergencies and improving its approach. However, there is more work to do to complete the analysis and bring it together into a single clear ‘playbook’ for all of government for how concerns around propriety would be managed in a future emergency.

We have identified seven high-level lessons where action can be taken now to prepare for future emergency spending. We believe that government departments can usefully develop a ‘playbook’ for how to manage propriety in a future crisis. We make recommendations for what might be in these playbooks and steps that can be taken now so that government bodies are better prepared to make emergency payments.

Introduction

What is propriety?

1 Propriety is one of the four fundamental standards that public spending should meet, along with regularity, value for money, and feasibility. Accounting officers, who are accountable to Parliament for spending, must scrutinise significant policy proposals against these standards. HM Treasury defines propriety as meeting high standards of public conduct, including robust governance and the relevant parliamentary expectations, especially transparency. This includes managing the risk of fraud and that the right amount of money reaches the right people and businesses.

Why does emergency spending increase the likelihood and perception of impropriety?

2 In an emergency, public bodies may need to react quickly to protect life, safeguard critical infrastructure, and support the economy. They will need to do so quickly, possibly without having a plan ready, and in addition to their usual responsibilities. They will need to make difficult decisions, based on imperfect information and involving trade-offs between speed, accuracy and risk. They may face challenges in terms of scale, the need for innovative approaches, and managing the increased demands on the organisation’s workforce. Fraudsters may target emergency spending believing there are greater opportunities to exploit initiatives that have been set up at pace. All these factors can increase the risk of impropriety and irregular spending, including fraud and error.

3 While the government may necessarily take greater risks with public money, the fundamental principles of good governance and Managing Public Money will always apply. Parliament and the public expect the government to protect propriety, spending money in accordance with high standards of transparency and ethics.

4 The COVID-19 pandemic (the pandemic) saw a large increase in spending as the government sought to protect life and support the economy. The amount of fraud reported in the accounts we audit rose from £5.5 billion in the two years before the pandemic to £21.0 billion in the two years after – £7.3 billion of the £21 billion relates to temporary COVID-19 schemes, most of the rest relates to benefit fraud.

5 The impact of actual or perceived impropriety may persist for some time after the emergency. This is true even if perceived impropriety is subsequently proven to be incorrect. This can undermine public trust. Following the pandemic, the UK has fallen from 11th to 20th (out of 180) in the Transparency International survey of public and business perception of corruption.1

How is the government learning from the pandemic?

6 There are a number of government organisations responsible for preparing for and responding to an emergency, including the Cabinet Office and central government departments. These bodies have already taken steps to learn lessons from the pandemic and other recent emergencies, including their approach to protecting propriety (Figure 1). In May 2021, the government announced that an independent public inquiry would be set up to examine the impact of the pandemic and the UK’s response to learn lessons for the future.

The scope of this lessons learned report

7 In May 2021, we published a report on initial learning from the government’s response to the pandemic.2 This covered the lessons from our initial reports on the government’s response to the pandemic under six themes: risk management; transparency and public trust; data and evidence; coordination and delivery models; supporting and protecting people; and financial and workforce pressures. We said we would refine that thinking as we developed our work.

8 This report focuses on protecting propriety in an emergency. We do not look at wider aspects of responding to an emergency. We draw on lessons from our work and what the government has already done to identify lessons itself. The report does not seek to repeat our previous audit findings to assess how well the government managed recent emergencies. Instead, it sets out lessons and recommendations for how the government can go further to improve its approach for protecting propriety in future emergencies.

9 We reached our conclusions following our analysis of evidence collected primarily between August 2023 and November 2023. Our audit approach is set out in Appendix One. As part of this fieldwork we:

reviewed more than 60 reports published by the National Audit Office and the Committee of Public Accounts (PAC). Most of these were on the pandemic response, but we also looked at our reports on other emergencies (Appendix Two);

examined the government’s progress against our recommendations and its response to PAC’s reports;

interviewed officials from 18 departments that played a role in the response to recent emergency situations and reviewed lessons learned documents where provided by departments; and

held cross-government workshops to provide challenge for our findings.

10 The following pages (pages 12 to 38) set out our recommendations from this work across seven lessons.

1 Transparency International Corruption Perceptions Index, accessed on 1 February 2024. Available at:
www.transparency.org/en/cpi/2023

2 Comptroller and Auditor General, Initial learning from the government’s response to the COVID-19 pandemic, Session 2021-22, HC 66, May 2021.

Lessons for the government

What are the challenges?

11 In an emergency, public bodies may need to make decisions at pace. They may need to work in ways different than business-as-usual and set up new delivery bodies or schemes to support the response. While the general expectation that the principles of good governance and established spending controls continue to apply, departments may choose to streamline internal approval and decision processes to allow them to respond more quickly. However, such governance arrangements can take time to be formalised and documented, or continue as informal arrangements, increasing the risk of confusion and unclear accountability.

12 Streamlined governance arrangements may include greater delegation of decision-making so decisions can be made faster. However, it is not possible to hand-off the accountability or fully transfer the risks around either delivery or propriety, so the governance arrangements will require appropriate reporting and oversight. It is also important to identify appropriate stakeholders and expertise, such as corporate expertise on grant management and fraud risk.

13 Emergency responses can be hindered if the guidance that public bodies use to coordinate with stakeholders is not clear and consistently communicated. Public bodies may also find that they have to frequently change guidance as they learn more about the emergency or their response. Changes that come at short notice present the risk that frontline staff and partners are not notified in a timely way, leading to an ineffective or inconsistent government response.

What progress has the government made recently?

14 Early in the pandemic, HM Treasury wrote to departments to remind them of the spending rules, while increasing delegation levels (the amounts they could spend without requiring HM Treasury approval for specific transactions) and varying arrangements for how high-value spending was to be approved, so departments could make quicker decisions. This provided clarity on what they were allowed to do. In response to the Boardman review, HM Treasury drew on its pandemic experience to produce a playbook for Spending in a Crisis, which sets out how it can use temporary flexibilities to the spending framework to support future emergency responses (Figure 2).

15 The Cabinet Office has also sought to improve training on how to make decisions in a crisis. Its Crisis Management Excellence Programme aims to deliver targeted training – including on protecting propriety – to senior decision-makers so that they are prepared for future emergencies. The programme aims to provide training to every permanent secretary and director-general in the civil service.

What do we recommend the government do to go further?

16 We recommend that HM Treasury:

a publish, disseminate and maintain the Spending in a Crisis guidance it produced in response to the Boardman review.

17 We recommend that departments, working with HM Treasury, Cabinet Office and the Public Sector Fraud Authority (PSFA):

b each develop internal ‘how to guides’ (‘playbooks’) to aid future responses. These need to cover how governance can be streamlined when needed, how to bring in and use the right additional expertise, and what additional delegations are needed and how these will be managed. Consideration should also be given to how the regularity of spending will be monitored and reported. Where departments have already prepared such guides, we recommend they share and continue to improve them.

c include in the playbooks how they will keep delivery partners up to date on the relevant rules. The government’s delivery partners, including companies, charities and local authorities, will often need to plan and develop their capabilities to deliver new schemes. It is important that departments set out emergency scheme rules as soon as possible to support this. Where elements still need to be developed, it should be clearly communicated to delivery partners that they will be returned to. When changes to scheme rules are required, give them as much notice as possible.

18 We recommend that the Cabinet Office working with HM Treasury and the PSFA:

d continue to develop training on meeting public spending rules in an emergency, building on the short module on public spending rules in the Crisis Management Excellence Programme and desktop exercises.

What are the challenges?

19 Propriety is concerned with meeting high standards of public conduct and parliamentary expectations, none of which can be dispensed with in an emergency. Officials we spoke to for this report told us that, during an emergency, it can be difficult to find the right balance between prioritising speed of response and the normal actions associated with protecting propriety. They challenged us to suggest ways to streamline the requirements. However, in all the scenarios we examined, we found that all the basic elements of protecting propriety can be done to at least some extent, but the best balance of these requirements in an emergency is a judgement.

20 The government faces the challenge of ensuring that ‘perfection does not become the enemy of the good’ in ways that harm the intended response. For example, it will not always be possible to complete a full fraud risk assessment or to carry out full due diligence before acting. But a quick assessment based on incomplete information can still have value during the scheme design stage and can be updated later.

21 AOs are responsible to Parliament for how their organisations uses taxpayers’ funds and need to make difficult judgements about the right balance to strike on a case-by-case basis. They need processes to help them structure and document the reasoning behind these key judgements. This should include setting out the constraints that drove crucial decisions and how they will come back to meet requirements that have been deprioritised. Where risks on propriety are being taken, it is important for the AO to be transparent to Parliament about how they are exercising their duties.

22 Although early prioritisation may be necessary, it can make it harder to protect propriety later on. Officials told us that goodwill between the government and partners is strongest near the start of a crisis. Public bodies can use this to seek early buy-in for the intended approach to managing propriety, even if it cannot be implemented immediately. Public bodies should make it clear to commercial and delivery partners at the start of an emergency that they will come back to enhance controls that have been deprioritised.

What progress has the government made recently?

23 HM Treasury has recently updated its AO assessment guidance. These changes seek to clarify that the assessment summary should clearly stipulate the reason for the assessment and include the date when the assessment was performed. The new guidance requires the assessment to cover the risk of fraud as part of the assessment of propriety, and HM Treasury has committed to update this to encourage consultation with the Public Sector Fraud Authority. HM Treasury has also reiterated its guidance to AOs that they should be transparent and, where confidentiality is in the public interest, should consider sharing the information privately with Parliament.3

What do we recommend the government do to go further?

24 AO assessments provide a means by which an AO can set out their consideration of the propriety of spending decisions and how propriety will be managed (Figure 3). Such assessments could also provide the mechanism to record the key judgements around trade-offs and accountability for the decisions on how propriety will be managed on an ongoing basis. We recommend that HM Treasury should strengthen existing guidance to:

e support AOs to use AO assessments to structure their thinking and record judgements about the balance of priorities with respect to propriety. This should include consideration of the limitations around decisions, such as limited information, time, or resources to conduct normal processes. AO assessments can be done at a programme level where individual spending decisions are delegated.

f clarify that, where a ministerial direction is used, AOs should still use the AO assessment process to set out how propriety will be managed. Where an AO cannot fully meet their responsibilities regarding propriety, they need to request a ministerial direction. However, they should still use the AO assessment to set out how propriety will be managed within the bounds of the direction, and the plan to bring ongoing expenditure into alignment with their AO duties.

g encourage, where AOs believe it is appropriate to take risks with propriety or proceed with incomplete information or process, but have not sought a ministerial direction, to publish a summary of their AO assessment setting out the risks and how they intend to manage them. Where a summary AO assessment cannot be published, the AO might instead write to the Chair of the Committee of Public Accounts.

25 We recommend that departments:

h stress the need to agree upfront with delivery partners the principles by which fraud and propriety will be managed in departmental playbooks and training (recommendations b and d), even if the full terms and conditions relating to issues such as inspection, monitoring, and clawback cannot be agreed before the scheme is launched.

What are the challenges?

26 It is generally accepted good practice that fraud should be managed through a fraud risk management cycle, whereby risks are identified, mitigations and controls put in place, the success of those controls and mitigations tested and reported, and root cause analysis used to amend the strategy and improve the system (Figure 4). Emergency spending has a heightened risk of fraud and impropriety, which can be managed by using this fraud risk management cycle. However, there are a number of challenges to embedding the cycle and getting it right during an emergency.

Fraud risk assessments done at pace may be insufficient or ineffectively acted upon, leading to risks being identified later. Officials told us that, under emergency conditions, risk assessments can be seen as a one-off requirement that do not lead to follow-up work.

If there is insufficient focus on controls and mitigations, some foreseeable and preventable risks may be left open, leaving the taxpayer vulnerable.

Insufficient emphasis at the start of a scheme that the government will follow-up and clawback misallocated funds creates a weak deterrent against abuse.

Control testing and inspection may focus solely on providing assurance that controls are working as intended, instead of identifying and preventing issues that otherwise would be unknown.

Public bodies may devolve delivery to others. There must be clarity as to who is responsible for managing fraud risks and how oversight and reporting arrangements will operate.

Effective measurement and reporting regimes may be difficult to set up at pace, for example, where a public body needs additional powers or access to data to support measurement which it does not normally have.

Public bodies may find it challenging to resource counter-fraud work if specific activity is not considered or budgeted for as part of the scheme approval.

Where schemes are temporary, there may not be a focus on effectively working through all stages of the fraud risk management cycle, including iterating the scheme to respond to intelligence and mitigate fraud risks.

What progress has the government made recently?

27 We have seen a general increase in the focus on managing fraud across government since 2020. In 2022, the government launched the Public Sector Fraud Authority (PSFA) to act as its centre of expertise for the management of fraud against the public sector. The PSFA leads on developing the Counter Fraud Profession and Counter Fraud Function and is working with departments to understand their fraud risks and improve their counter-fraud capability. Managing fraud also forms part of general risk management. The Government Risk Function has recently: published additional guidance on portfolio risk management; developed toolkits on risk culture and risk scenario planning; and launched additional risk training for non-specialists.

28 In 2022, HM Treasury updated Managing Public Money and made initial fraud impact assessments mandatory for all major new schemes, with the aim of ensuring that fraud risk is considered early. The then Department for Business, Energy & Industrial Strategy piloted these new arrangements by working closely with the PSFA to develop the Energy Bills Support Schemes in 2022, developing the initial fraud impact assessments into a full risk assessment and plan to mitigate those risks.

What do we recommend the government do to go further?

29 The government now needs to fully embed the fraud risk management cycle into its practices, giving greater attention to measurement and follow-up activities within the cycle to ensure that these are done. The cycle is useful for managing fraud in both normal practice and during an emergency. The challenge during an emergency is to iterate the cycle quickly enough to embed continuous learning in a temporary scheme. Where the initial fraud impact assessment indicates a risk of fraud, we recommend that HM Treasury:

i require that business cases include a budget and high-level milestones for implementing the fraud risk management cycle. High-level milestones might include, for example, the month an inspection regime might be in place.

30 We recommend that the Cabinet Office:

j update model contracts and grant agreements with standardised clauses that embed the fraud risk management cycle, particularly to enable inspection, measurement of fraud, clawback, and reporting.

31 We recommend that the PSFA:

k work with the Crown Commercial Service to establish a framework contract to allow public bodies to draw in suitably qualified private sector expertise to support fraud measurement. PSFA should use this to maintain a market for fraud and error measurement and to embed common standards compatible with reporting requirements and proper use of the fraud risk management cycle.

l Maintain a library of good practice controls it can suggest to mitigate fraud risks. For example, the PSFA’s lessons exercise identified that staged payments could limit exposure where payee eligibility has not yet been verified.

What are the challenges?

32 The government cannot know what the next emergency will be and how it will need to respond. But it is likely that there will be increased demand from across government for certain core capabilities, including counter-fraud skills.

33 The government’s existing counter-fraud expertise is in short supply and focused in the departments that have the highest levels of fraud under normal conditions. Effectively deploying this limited resource in an emergency requires the government to have a good assessment of fraud risk and also a detailed assessment of its existing capabilities. This has only been achieved in limited places for routine operations. For example, the Public Sector Fraud Authority (PSFA) believes that 27% of government bodies either have no counter-fraud resources or resources that are clearly mismatched with their fraud risk, and a further 60% of bodies show signs of a potential mismatch.

34 The government currently has limited flexibility to move counter-fraud staff. In an emergency, departments without mature counter-fraud teams may have to rely on external consultants or secondees from other organisations to provide the expertise they need. But only the largest departments have the ability to second out staff to support other public bodies. A small number of public bodies may be able to move counter-fraud staff around internally to work on emergency schemes, but this may reduce their normal compliance work.

What progress has the government made recently?

35 In 2020-21, the Cabinet Office developed a global fraud risk assessment covering the key COVID-19 pandemic response schemes. It told us that this helped them to have some limited influence over the deployment of counter-fraud resources across government, including to support the schemes selected for review by its Fraud Measurement and Assurance programme.

36 In 2022, the government established the PSFA to improve its approach to managing fraud, which includes building on the existing Government Counter Fraud Function and Counter Fraud Profession. The PSFA has worked with departments to map their counter-fraud capability and set higher professional standards.

What do we recommend the government do to go further?

37 Officials from across departments told us they would have benefited from more effective cross-government coordination to help them tap into existing counter-fraud expertise during the pandemic.

38 The government functions provide a means to develop general capability, but there will need to be strong central coordination of how and where these resources are best deployed in an emergency. The PSFA will need to encourage networking and cohesion within the profession, so that teams can come together quickly to tackle an emergency. We recommend that:

m the PSFA develop and test a plan so that in an emergency it has the following.

Clarity over the key counter-fraud priorities. This should build on the experience of providing the global fraud risk assessment during the COVID-19 pandemic and provide clarity on where the resources are needed. This should take account of both the likely return on investment from deploying people to that area, and the opportunity cost of not retaining them where they are.

Visibility over where people with the right skills are. The PSFA should develop a more comprehensive map of counter-fraud talent within government, including where it exists outside of the profession. The PSFA should facilitate better networking within the profession.

Strong bonds across the Government Counter Fraud Profession so that it can form effective new teams in an emergency. It is helpful if teams have worked together before they have to do so in an emergency. Such a model could vary from a network of people that the PSFA draws upon across departments (such as currently used for project reviews), a central surge team (such as the Commercial Function’s complex transactions team), or centralised employment (such as the Government Commercial Organisation) (Figure 5).

Influence over their deployment. The PSFA should continue to develop its global assessment of fraud risks within government to enable it to better target the deployment of existing talent across government in emergencies.

What are the challenges?

39 Departments need the right data to effectively tackle the fraud and impropriety risks of their emergency responses. For example, schemes can be less open to abuse where the eligibility of recipients can be verified using existing datasets. The government has also had some success in stopping and recovering fraudulent payments using data-matching and analytical techniques. In 2022-23 the Public Sector Fraud Authority (PSFA) reported £311 million of savings from using data analytics and data-matching.4

40 The government does not always have the data it needs to verify or automate payments or to detect fraud and error. The government has time-lagged data on individuals’ and businesses’ income through the tax system, but limited information on households and household income. Confidence in some key datasets, such as Companies House data, has been undermined by errors and fake entries.5 Some public bodies do not have sufficient data about the sectors of society they support, resulting in schemes that are poorly targeted or difficult to administer, in turn leading to fraud and error. Some schemes may rely on third parties and do not always clearly define the data they need, making it challenging to detect and recover fraud and error.

41 Officials told us that they struggled to access the data that they needed that existed elsewhere in government to support emergency responses. The recent pandemic demonstrated that agreeing data sharing under the Digital Economy Act 2017 can be cumbersome and take too much time to be practical in an emergency.

42 Improving data and interoperability is a systemic challenge for government. Public bodies have different approaches to data governance and data is dispersed across central and local government bodies. Different software and hardware may be used, and the same information recorded in different ways. In 2019, we recommended that government “identify datasets that are critical to government functions, look at how to share them easily and examine how they can be enhanced by process improvement and automation”.6

What progress has the government made recently?

43 The government has sought to clarify that data can be shared. The Information Commissioner’s Office data-sharing code of practice provides guidance to support public bodies sharing data in emergencies.7 It states that data protection law is not a barrier to sharing data where appropriate and recommends planning for the data, and agreements, that may be needed in advance. The PSFA has established a team to help departments share data for the purpose of fighting fraud using the Digital Economy Act 2017 (Figure 6).

44 The government is also seeking to identify its key datasets. In 2021, the Cabinet Office set up a National Situation Centre to provide real-time access to the data the government needs to respond to emergencies. In November 2023, the Cabinet Office’s Central Digital and Data Office (CDDO) launched an initiative to identify ‘essential shared data assets’. It views this as an important step in its roadmap for improving the quality and use of data.8

What do we recommend the government do to go further?

45 Regardless of the nature of future emergencies, it is likely that data on businesses, vulnerable individuals, charities and households will be needed to make support payments, and data sharing will be needed to verify payments and support the recovery of fraud. We recommend the CDDO work with departments and the PSFA to extend the remit of the essential shared data assets plan to:

n Work out now what current datasets might be needed in an emergency to make payments and fight fraud. This should include current datasets that are not shared in normal times but would become critical datasets in an emergency.

o Review the extent to which these datasets are accessible and readily shareable within government. As part of the general maintenance and development of these datasets, improve their ability to be shared and made use of at pace in an emergency.

p Consider what data-sharing arrangements could be set up now. In an emergency, public bodies may not have time to agree data-sharing protocols.

What are the challenges?

46 During an emergency, Parliament and the public are likely to be acutely interested in how money is being spent at a time when decision-making is at its most pressurised. They will expect to know where grants have been provided and contracts awarded to demonstrate that public money is being spent where most needed. At the same time, there’s a heightened need for the government to be transparent to demonstrate expected good practice has been followed, good decision-making at pace and that propriety has been fully considered. For example, adequate documentation is required to support the additional disclose required by the use of emergency procurement rules, the fair choice of suppliers and how any potential conflicts of interest have been identified and managed.

47 Public bodies may find it challenging to prioritise record keeping against competing pressures and to produce a clear audit trail of their decision-making without a plan for doing so. This is especially the case where normal governance arrangements have been streamlined so that normal practices, such as ministerial submissions, minutes of committees, and other record-keeping practices are not being used to capture the key decisions in the normal way. For example, our work on the COVID-19 ventilator programme showed sufficient documentation is possible at speed (Figure 7). The team prepared for accountability despite a pressured timetable, by establishing a clear decision-making process and recording key decisions properly.

48 Transparency over who has received emergency spending may act as a deterrent to people taking money they do not need. The Committee of Public Accounts has recommended ‘a presumption of transparency’ around the business recipients of government support.9 The government rejected a general presumption, citing a reluctance to publish information about grant recipients due to privacy considerations.

49 Publishing information can seem a distraction when acting in an emergency. It can take time to review and then publish documentation manually, when resources are focused on operational delivery. To tackle these perverse incentives against transparency, the government needs lean and preferably automated systems that promote easy publication.

What progress has the government made recently?

50 We saw transparency lead to businesses returning public funds they did not need. For example, following a recommendation we made in October 2020, HM Revenue & Customs (HMRC) published a list of those employers who claimed employment support as part of a commitment to transparency and to help deter fraudulent claims. It also enabled employees to check where their employer had received furlough payments on their behalf through their personal tax accounts. This acted as a prompt so people could report where their employer had received payment for furlough, but they had continued to work (Figure 7).

51 The Procurement Act 2023 introduces a legal requirement for enhanced transparency requirements throughout the commercial lifecycle, including the publication of notices to justify where contracts have been awarded directly to suppliers. The Act also includes new powers to enable the secretary of state to trigger an emergency, during which direct awards may be made with a streamlined disclosure requirement around the rationale for using such an award.

What do we recommend the government do to go further?

52 The government now needs to implement the Procurement Act 2023, be clear about how it will deal with non-compliance and apply this consistently. We recommend that the Cabinet Office and HM Treasury:

q embed into their guidance and training the expectations of how decisions on public spending are to be recorded during an emergency to uphold accountability. Use this to emphasise to staff the importance of maintaining transparency during an emergency.

r seek to automate transparency over spending so publication requires little or no human involvement, building on current plans on contract awards following the Procurement Act 2023.

s adopt a presumption of transparency around the recipients of emergency payments to act as a deterrent to their improper use and to aid in reporting of fraud – this should be built into future business cases and authorising legislation.

What are the challenges?

53 In a crisis the government can find itself buying goods and services in a seller’s market – that is, a market where demand is high, and a seller can easily find another buyer. The government may not be able to follow normal procurement processes and have limited commercial leverage to make demands. This may mean the government takes more risk when it buys goods and services for the emergency response. For example, it may not be able to demand normal terms and conditions, such as payment after receipt and inspection of goods.

54 The pandemic presented government with a particularly difficult seller’s market. The government called for support to help access scarce products and services and found itself in receipt of more offers than it could easily consider. But those offering help also had significant commercial power because they could find another buyer. Some were from businesses that government would not normally contract with because they do not meet the usual rules over financial standing or have a track record of delivery, including companies set up to act as ‘brokers’ to the underlying suppliers. On occasion government was willing to pay a premium compared to previous prices to some of these new suppliers to secure access to goods and services. Given the rapid onset of the pandemic and, in the case of personal protective equipment, the number of offers received in a short period, the government faced a significant challenge in triaging such potential sellers in a way that was transparently fair.

55 Responses to calls for support may include people with a position of actual or potential influence with the government. Buying goods and services in an emergency does not remove the responsibility of public bodies to identify and effectively manage actual or perceived conflicts of interest. Demonstrating that those in a position of influence have not abused that position is crucial to maintain public trust.

What progress has the government made recently?

56 The government has recently undertaken a review and agreed steps to tighten its systems for recording and managing conflicts of interest. The first Boardman report, published in December 2020, considered the award of contracts for COVID-19 communications services made by the Cabinet Office in March 2020. Of the 28 recommendations, 12 recommendations specifically related to improving management of conflicts of interest and bias. The Cabinet Office accepted all recommendations and is implementing them (Figure 8).

57 The Procurement Act 2023 requires procuring authorities to prepare and maintain an assessment of how they are managing conflicts of interest and to confirm this has been done as part of publishing their procurement notices.

What do we recommend the government do to go further?

58 Over the past 10 years the government has increased its commercial capability, sought to improve its contract management, and introduced better standards of transparency over its outsourcing contracts. This has included the far greater use of open-book accounting whereby the government can investigate the providers’ costs and profits. At the same time, the Committee of Public Accounts has exercised greater oversight over government outsourcing through its direct scrutiny of providers.

59 While it may be impossible to apply the norms of transparency and accountability to all emergency purchasing, such as directly buying and receiving overseas, they should be applied where possible. Building in expected standards of transparency and accountability from UK-based vendors could act to provide needed public confidence in the propriety of expenditure and act as a deterrent for both poor behaviour and excessive profits.

60 We recommend that the Government Commercial Function:

t produces guidance for commercial staff, to sit alongside its outsourcing and construction playbooks, on how to buy in a seller’s market. This would apply to both national emergencies and other situations where departments face a seller with significant commercial leverage. To do so it should consider recent experience of handling:

the need to understand the market, and the level of competition and the characteristics of a seller’s market that make normal procurement practices difficult;

how to use the emergency powers in the Procurement Act 2023;

how to triage high volumes of offers, potentially with the use of dynamic purchasing arrangements;

high standards of transparency and accountability expected from vendors and how these can be used to provide additional leverage where commercial leverage is limited;

how to demonstrate value for money using benchmarking;

the use of open-book accounting for brokers of goods; and

how to record and manage actual and perceived conflicts of interests.

3 HM Treasury, Dear Accounting Officer 01/24, 16 January 2024. Accessed on 24 January 2024.

4 Public Sector Fraud Authority, Annual Report 2022-23, November 2023.

5 Committee of Public Accounts, Department for Business, Energy & Industrial Strategy Annual Report and Accounts 2021–22, Forty-fifth report of Session 2022-23, HC 1254, March 2023.

6 Comptroller and Auditor General, Challenges in using data across government, Session 2017-2019, HC 2220, National Audit Office, June 2019.

7 Information Commissioner’s Office, Data Sharing: a code of practice, 17 October 2022, Version 1.0.31, accessed on 22 January 2024.

8 Central Digital and Data Office, Essential Shared Data Assets Policy, December 2023, accessed on 22 January 2024.

9 Committee of Public Accounts, Fraud and Error, Ninth Report of Session 2021-22, HC 253, June 2021.

Appendix One

Our audit approach

Our scope

1 In May 2021, we published a report on initial learning from the government’s response to the COVID-19 pandemic.10 This covered the lessons from our first 17 reports we had published on the COVID-19 response under six themes: risk management; transparency and public trust; data and evidence; coordination and delivery models; supporting and protecting people; and financial and workforce pressures. We said we would refine that thinking as we developed our work.

2 This report follows on from that initial report and focuses specifically on tackling fraud and protecting propriety. We consider the actions taken during procurement activity, issuing grants, direct payments and loans to individuals and organisations to protect and demonstrate propriety as part of the response to the pandemic and other recent pressurised situations. These actions may have been taken by central government departments, local authorities or other organisations as set out in documents we reviewed as part of this report.

3 In discussing the actions of the government and others we do not comment on value for money or wider aspects of responding in an emergency. We have looked at the lessons from our work and what the government has already done to identify some recommendations for how it can go further to improve its approach for tackling fraud and protecting propriety in future emergencies. This report does not repeat previous audit findings.

Our evidence base

4 We conducted our fieldwork between August 2023 and December 2023. The purpose of this work was to identify what lessons the government could learn from recent emergencies on how to tackle fraud and protect propriety, and what actions it could take now to ensure that it is better prepared for future emergencies. We drew on a variety of evidence sources.

Document review

5 We reviewed our back catalogue of reports, and that of the Committee of Public Accounts (PAC), to identify a long list of reports where government was likely to need to tackle fraud and protect propriety in public spending. We also used colleagues’ expertise to identify additional relevant reports. We reviewed more than 60 reports published between 2020 and 2023 (Appendix Two) to identify extracts which covered fraud or impropriety and thematically grouped these. We used this review to:

iteratively develop an initial list of risks to propriety and possible mitigations. We shared this initial list of risk areas with our audit and insights teams who were involved in the reports we reviewed to test the consistency and completeness of our review;11

inform interviews with officials responsible for emergency responses during the pandemic; and

inform interviews with officials from HM Treasury, Cabinet Office, the Public Sector Fraud Authority (PSFA) and the Government Commercial Function.

6 We reviewed government departments’ publicly available lessons learned reports following the pandemic to supplement the insights from our reports and those of PAC. To ensure we understood the full extent of existing lessons learned activity, we requested departments share the results of any unpublished reports or lessons learned activities relevant to protecting propriety. Only the PSFA, HM Revenue & Customs (HMRC) and the Department of Health & Social Care (DHSC) provided documents. Also, to understand the wider emergency planning and response arrangements we reviewed published government guidance.

Interviews with government officials

7 We identified government departments with a spend above £50 million as at June 2022 on COVID-19 pandemic response measures, using our COVID-19 cost tracker.12 We selected a £50 million threshold to focus on those departments with the most significant spending and to keep the amount of fieldwork required manageable within the time available. We checked this list of departments against the reports reviewed to ensure we had selected departments where the National Audit Office or the PAC had already undertaken some audit work on the response.

8 We used the list of departments covered in the reports we reviewed, in collaboration with our audit teams to identify those departments who had greater exposure to propriety and fraud challenges during the pandemic to interview further. We held 9 interviews with officials from HMRC, the Department for Business and Trade, the Department for Energy Security & Net Zero, the Department for Work and Pensions, the Department for Levelling Up, Housing & Communities, the Department for Culture, Media & Sport and the British Business Bank. We also invited officials from DHSC for interview. We also received some written comments from these departments, including DHSC.

9 We shared our initial analysis of risk areas for written comments with those departments we interviewed, and departments we did not approach for interview, namely: the Department for Environment, Food & Rural Affairs, the Department for Transport, the Department for Education, the Home Office, the Foreign, Commonwealth & Development Office, the Ministry of Defence and the Ministry of Justice. We received 12 sets of comments. We sought feedback on the structure and content of the risk areas and for additional practical lessons or good practice examples on how to protect propriety in an emergency response.

10 We interviewed officials from Cabinet Office and HM Treasury, including the PSFA, as the lead departments in the centre of government for spending and commercial controls. We discussed our initial analysis of risk areas, how the government had sought to learn lessons from recent emergencies and what more could be done. We also interviewed officials within the Cabinet Office’s Resilience Directorate and the Cabinet Office Briefing Rooms Unit with responsibility for emergency preparedness to understand how their work relatedto protecting propriety.

Interviews and roundtable discussions on the seven lessons identified

11 Following feedback from departments during interviews and in writing, we developed our identified risk areas into seven lessons where the government could take action to improve how it tackles fraud and protects propriety in future emergencies. Within each area we proposed recommendations to the whole of government, HM Treasury or Cabinet Office.

12 We shared these draft lessons with HM Treasury and Cabinet Office to test these were relevant and realistic and to ensure the draft recommendations were deliverable by the government. We also held two virtual roundtable semi-structured discussions in November 2023 on these draft lessons with in-scope departments. We invited over 70 officials from 12 departments to attend either discussion. We used this feedback to further develop the lessons and identify case study examples.

10 Comptroller and Auditor General, Initial learning from the government’s response to the COVID-19 pandemic, Session 2021-22, HC 66, National Audit Office, May 2021.

11 Our insights teams cover the following functional areas: analysis, major project delivery, commercial, people & operations management, financial & risk management and digital.

12 National Audit Office, COVID-19 cost tracker overview - interactive visualisation, 23 June 2022. Available here:
www.nao.org.uk/overviews/covid-19-cost-tracker/

Appendix Two

Reports reviewed

Reports relevant to each lesson

1 We reviewed over 60 reports by the National Audit Office and the Committee of Public Accounts that we identified as having lessons for emergency spending. We have listed those that are most relevant to each of the lessons in this report below.

Lesson 1: Be clear on governance and rules

Comptroller and Auditor General, COVID-19 business grant schemes, Session 2022-23, HC 1200, National Audit Office, March 2023.

Comptroller and Auditor General, Report by the Comptroller and Auditor General: Department of Health & Social Care 2021-22, National Audit Office, January 2023. Published in Department of Health & Social Care, Annual Report and Accounts 2021-22, HC 1043, January 2023.

Comptroller and Auditor General, Report by the Comptroller and Auditor General: Department for Work and Pensions 2021-22, National Audit Office, July 2022. Published in Department for Work and Pensions, Annual Report and Accounts 2021-22, HC 193, July 2022.

Comptroller and Auditor General, The Bounce Back Loan Scheme: an update, Session 2021-22, HC 861, National Audit Office, December 2021.

Comptroller and Auditor General, Lessons learned: Delivering programmes at speed, Session 2021-22, HC 667, National Audit Office, September 2021.

Comptroller and Auditor General, Investigation into preparations for potential COVID-19 vaccines, Session 2019-21, HC 1071, National Audit Office, December 2020.

Comptroller and Auditor General, The government’s approach to test and trace in England – interim report, Session 2019-21, HC 1070, National Audit Office, December 2020.

Comptroller and Auditor General, The supply of personal protective equipment (PPE) during the COVID-19 pandemic, Session 2019-21, HC 961, National Audit Office, November 2020.

Comptroller and Auditor General, Implementing employment support schemes in response to the COVID-19 pandemic, Session 2019-21, HC 862, National Audit Office, October 2020.

Comptroller and Auditor General, Investigation into the Bounce Back Loan Scheme, Session 2019-21, HC 860, National Audit Office, October 2020.

Lesson 2: Prioritise, but communicate that you will return to things you cannot cover immediately

Comptroller and Auditor General, COVID-19 business grant schemes, Session 2022-23, HC 1200, National Audit Office, March 2023.

Comptroller and Auditor General, Tackling fraud and corruption against government, Session 2022-23, HC 1199, National Audit Office, March 2023.

Comptroller and Auditor General, Report by the Comptroller and Auditor General: Department for Work and Pensions 2021-22, National Audit Office, July 2022. Published in Department for Work and Pensions, Annual Report and Accounts 2021-22, HC 193, July 2022.

Comptroller and Auditor General, The Bounce Back Loan Scheme: an update, Session 2021-22, HC 861, National Audit Office, December 2021.

Lesson 3: Embed the fraud risk management cycle

Committee of Public Accounts, Energy bills support, Fifty-Eighth Report of Session 2022-23, HC 1074, June 2023.

Comptroller and Auditor General, Tackling fraud and corruption against government, Session 2022-23, HC 1199, National Audit Office, March 2023.

Comptroller and Auditor General, COVID-19 business grant schemes, Session 2022-23, HC 1200, National Audit Office, March 2023.

Committee of Public Accounts, Department for Business, Energy & Industrial Strategy Annual Report and Accounts 2021–22, Forty-Fifth Report of Session 2022-23, HC 1254, March 2023.

Comptroller and Auditor General, Energy bills support, Session 2022-23, HC 1025, National Audit Office, February 2023.

Comptroller and Auditor General, Report by the Comptroller and Auditor General: HM Revenue & Customs 2021-22 Accounts, National Audit Office, July 2022. Published in HM Revenue & Customs, Annual Report and Accounts 2021-22, HC 494, July 2022.

Comptroller and Auditor General, The Bounce Back Loan Scheme: an update, Session 2021-22, HC 861, National Audit Office, December 2021.

Comptroller and Auditor General, Investigation into the Bounce Back Loan Scheme, Session 2019-21, HC 860, National Audit Office, October 2020.

Lesson 4: Create a flexible counter-fraud capability

Comptroller and Auditor General, Tackling fraud and corruption against government, Session 2022-23, HC 1199, National Audit Office, March 2023.

Comptroller and Auditor General, Managing tax compliance following the pandemic, Session 2022-23, HC 957, National Audit Office, December 2022.

Comptroller and Auditor General, Report by the Comptroller and Auditor General: Department for Business, Energy & Industrial Strategy 2021-22, National Audit Office, October 2022. Published in Department for Business, Energy & Industrial Strategy, Annual Report and Accounts 2021-22, HC 771, October 2022.

Comptroller and Auditor General, The Bounce Back Loan Scheme: an update, Session 2021-22, HC 861, National Audit Office, December 2021.

Comptroller and Auditor General, Investigation into government funding to charities during the COVID-19 pandemic, Session 2019-21, HC 1236, National Audit Office, March 2021.

Lesson 5: Plan for the data you will need

Committee of Public Accounts, Local authority administered COVID support schemes in England, Sixty-Eighth Report of Session 2022-23, HC 1234, September 2023.

Comptroller and Auditor General, Tackling fraud and corruption against government, Session 2022-23, HC 1199, National Audit Office, March 2023.

Committee of Public Accounts, Department for Business, Energy & Industrial Strategy Annual Report and Accounts 2021–22, Forty-Fifth Report of Session 2022-23, HC 1254, March 2023.

Committee of Public Accounts, COVID employment support schemes, Fortieth Report of Session 2022-23, HC 810, March 2023.

Comptroller and Auditor General, Energy bills support, Session 2022-23, HC 1025, National Audit Office, February 2023.

Committee of Public Accounts, Department for Business, Energy & Industrial Strategy Annual Report and Accounts 2020–21, First Report of Session 2022-23, HC 59, May 2022.

Committee of Public Accounts, HMRC’s management of tax debt, Forty-Eighth Report of Session 2021-22, HC 953, March 2022.

Comptroller and Auditor General, The Bounce Back Loan Scheme: an update, Session 2021-22, HC 861, National Audit Office, December 2021.

Comptroller and Auditor General, Initial learning from the government’s response to the COVID-19 pandemic, Session 2021-22, HC 66, National Audit Office, May 2021.

Comptroller and Auditor General, Challenges in using data across government, Session 2017-19, HC 2220, National Audit Office, June 2019.

Lesson 6: Increase transparency

Comptroller and Auditor General, Tackling fraud and corruption against government, Session 2022-23, HC 1199, National Audit Office, March 2023.

Comptroller and Auditor General, Investigation into the government’s contracts with Randox Laboratories Ltd, Session 2021-22, HC 1018, National Audit Office, March 2022.

Comptroller and Auditor General, Report by the Comptroller and Auditor General: HM Revenue & Customs 2020-21 Accounts, National Audit Office, October 2021. Published in HM Revenue & Customs, Annual Report and Accounts 2020-21, HC 696, November 2021.

Committee of Public Accounts, Fraud and error, Ninth Report of Session 2021-22, HC 253, June 2021.

Committee of Public Accounts, COVID-19: Government procurement and supply of Personal Protective Equipment, Forty-Second Report of Session 2019-21, HC 928, February 2021.

Committee of Public Accounts, Covid-19: Support for jobs, Thirty-Fourth Report of Session 2019-21, HC 920, December 2020.

Comptroller and Auditor General, Investigation into government procurement during the COVID-19 pandemic, Session 2019-21, HC 959, National Audit Office, November 2020.

Comptroller and Auditor General, Investigation into how government increased the number of ventilators available to the NHS in response to COVID-19, Session 2019-21, HC 731, National Audit Office, September 2020.

Lesson 7: Plan how to buy in a seller’s market

Comptroller and Auditor General, Lessons learned: competition in public procurement, Session 2022-23, HC 1664, National Audit Office, July 2023.

Comptroller and Auditor General, Report by the Comptroller and Auditor General: Department of Health & Social Care 2021-22, National Audit Office, January 2023. Published in Department of Health & Social Care, Annual Report and Accounts 2021-22, HC 1043, January 2023.

Comptroller and Auditor General, Investigation into the management of PPE contracts, Session 2021-22, HC 1144, National Audit Office, March 2022.

Comptroller and Auditor General, Report by the Comptroller and Auditor General: Department of Health & Social Care 2020-21, National Audit Office, January 2022. Published in Department of Health & Social Care, Annual Report and Accounts 2020-21, HC 1053, January 2022.

Committee of Public Accounts, Initial lessons from the government’s response to the COVID-19 pandemic, Thirteenth Report of Session 2021-22, HC 175, July 2021.

Committee of Public Accounts, COVID-19: Government procurement and supply of Personal Protective Equipment, Forty-Second Report of Session 2019-21, HC 928, February 2021.

Comptroller and Auditor General, Investigation into government procurement during the COVID-19 pandemic, Session 2019-21, HC 959, National Audit Office, November 2020.

Comptroller and Auditor General, The supply of personal protective equipment (PPE) during the COVID-19 pandemic, Session 2019-21, HC 961, National Audit Office, November 2020.

Other reports we have reviewed

2 We also reviewed the following reports to inform our general analysis:

Committee of Public Accounts, Department of Health and Social Care 2021-22 Annual Report and Accounts, Sixty-Second Report of Session 2022-23, HC 997, July 2023.

Committee of Public Accounts, Managing tax compliance following the pandemic, Forty-Ninth Report of Session 2022-23, HC 739, May 2023.

Committee of Public Accounts, HMRC performance in 2021–22, Thirty-Third Report of Session 2022-23, HC 686, January 2023.

Committee of Public Accounts, The Department for Work and Pensions’ Accounts 2021–22 – Fraud and error in the benefits system, Twenty-Sixth Report of Session 2022-23, HC 44, November 2022.

Comptroller and Auditor General, Delivery of employment support schemes in response to the Covid-19 pandemic, Session 2022-23, HC 656, National Audit Office, October 2022.

Committee of Public Accounts, Management of PPE contracts, Twelfth Report of Session 2022-23, HC 260, July 2022.

Committee of Public Accounts, The rollout of the COVID-19 vaccine programme in England, Eleventh Report of Session 2022-23, HC 258, July 2022.

Committee of Public Accounts, Bounce Back Loans Scheme: Follow-up, Fiftieth Report of Session 2021-22, HC 951, April 2022.

Committee of Public Accounts, Government preparedness for the COVID-19 pandemic: lessons for government on risk, Forty-Sixth Report of Session 2021-22, HC 952, March 2022.

Comptroller and Auditor General, The rollout of the COVID-19 vaccination programme in England, Session 2021-22, HC 1106, National Audit Office, February 2022.

Comptroller and Auditor General, Report by the Comptroller and Auditor General: Department for Business, Energy and Industrial Strategy 2020-21, National Audit Office, November 2021. Published in Department for Business, Energy & Industrial Strategy, Annual Report and Accounts 2020-21, HC 808, November 2021.

Comptroller and Auditor General, The government’s preparedness for the COVID-19 pandemic: lessons for government on risk management, Session 2021-22, HC 735, National Audit Office, November 2021.

Committee of Public Accounts, The Department for Work and Pensions’ Accounts 2020–21 – Fraud and error in the benefits system, Twenty-Fifth Report of Session 2021-22, HC 633, November 2021.

Comptroller and Auditor General, Managing tax debt through the pandemic, Session 2021-22, HC 799, National Audit Office, November 2021.

Comptroller and Auditor General, Test and trace in England – progress update, Session 2021-22, HC 295, National Audit Office, June 2021.

Committee of Public Accounts, COVID-19: Government Support for Charities, Fifth Report of Session 2021-22, HC 250, June 2021.

Committee of Public Accounts, COVID 19: Culture Recovery Fund, Fourth Report of Session 2021-22, HC 340, June 2021.

Committee of Public Accounts, COVID-19: Local government finance, Fourth Report of Session 2021-22, HC 239, June 2021.

Comptroller and Auditor General, Local government finance in the pandemic, Session 2019-21, HC 1240, National Audit Office, March 2021.

Comptroller and Auditor General, Investigation into the Culture Recovery Fund, Session 2019-21, HC 1241, National Audit Office, March 2021.

Committee of Public Accounts, COVID-19: Test, track and trace (Part 1), Forty-Seventh Report of Session 2019-21, HC 932, March 2021.

Committee of Public Accounts, COVID-19: Planning for a vaccine Part 1, Forty-Third Report of Session 2019-21, HC 930, February 2021.

Committee of Public Accounts, Covid-19: Bounce Back Loan Scheme, Thirty-Third Report of Session 2019-21, HC 687, December 2020.

Committee of Public Accounts, Covid-19: Supply of ventilators, Twenty-Seventh Report of Session 2019-21, HC 685, November 2020.

Design and Production by NAO Communications Team
DP Ref: 012723-001