National Fraud Initiative in Northern Ireland 2024-25 Instructions

Introduction

1. The Comptroller and Auditor General for Northern Ireland (C&AG), head of the Northern Ireland Audit Office (NIAO), has statutory powers to conduct data matching exercises for the purpose of assisting in the prevention and detection of fraud. The powers are contained in the Serious Crime Act 2007, which adds Articles 4a to 4h to the Audit and Accountability (Northern Ireland) Order 2003.
2. The Serious Crime Act imposes a regulatory regime alongside existing fair processing and other compliance requirements of data protection legislation. Any person or body conducting or participating in the C&AG’s data matching exercises must, by law, have regard to a statutory Code of Data Matching Practice.
3. Data matching involves comparing sets of data, such as the payroll or benefits records of a body, against other records held by the same or another body to see how far they match. This allows potentially fraudulent claims and payments to be identified.
4. The next data matching exercise under the C&AG’s powers will be undertaken in 2024-25, as part of the National Fraud Initiative (NFI). As in previous NFI exercises, the Public Sector Fraud Authority will carry out the key aspects of the exercise on behalf of the C&AG, including the collection and processing of data.
5. The data obtained for the 2024 - 25 exercise will be matched on a cross jurisdictional basis across the UK.

Distribution of Matches

6. Once the data matching process is completed, the output will be available to participating organisations, for consideration and investigation, via the secure NFI web-based application. Responsibility for investigating matches will rest with the participating organisations. Organisations are not expected to investigate all matches but should use a risk-based approach to decide on how many, and which, matches to investigate.
7. The data matching output provided by the Public Sector Fraud Authority indicates the priority reports and higher risk data matches within each report. It is important to note that the matches do not necessarily indicate fraud but they highlight an inconsistency which may be worthy of further investigation.

Statutory framework

10. The C&AG conducts data matching exercises under statutory powers in the Audit and Accountability (Northern Ireland) Order 2003, as amended by the Serious Crime Act 2007.
11. The legislation requires the C&AG to prepare a code of practice to govern the data matching exercises, and to consult over it before approving and laying it before the Assembly. The original Code was laid before the Northern Ireland Assembly in July 2008.   A revised Code, taking account of the transfer of the NFI to the Public Sector Fraud Authority and the provisions of the 2018 General Data Protection Regulation (GDPR), was laid in November 2018, following consultation with key stakeholders, including the Information Commissioner’s Office. The revised Code can be viewed here.
12. Under the legislation, the C&AG may carry out data matching exercises for the purpose of assisting in the prevention and detection of fraud, as part of an audit or otherwise. The C&AG may require certain bodies to provide data for a data matching exercise. These are bodies whose accounts are required to be audited by:

• the C&AG, other than any body whose accounts are required to be audited by virtue of section 55 of the Northern Ireland Act 1998, which includes North/South Implementation bodies audited jointly by the C&AG and the Irish Comptroller and Auditor General; and
• a local government auditor.

Therefore central government bodies (that is Northern Ireland departments, executive agencies, police and justice bodies, non-departmental public bodies and health and social care bodies) and local government bodies (district councils) must participate if required.

13. Other bodies may participate in the data matching exercises on a voluntary basis where the C&AG considers it appropriate. The requirements of data protection legislation and the GDPR will apply.
14. The C&AG may disclose the results of a data matching exercise to bodies that have provided the data. The C&AG may also disclose both data provided for data matching and the results of data matching to the Public Sector Fraud Authority, the Auditor General for Wales, the Auditor General for Scotland, the Accounts Commission for Scotland and Audit Scotland, for the purposes of preventing and detecting fraud.   This is an important aspect of the legislation as it enables cross jurisdictional data matching.
15. The processing of data by the C&AG in a data matching exercise is carried out with statutory authority. It does not require the consent of the individuals concerned to satisfy data protection legislation.

Privacy Notices

16. Under data protection legislation and the GDPR, NFI participants must tell individuals that their data will be processed. This information is provided by way of a Privacy Notice.
17. Participants should, as far as is practicable and unless an exemption from the fair processing requirement applies, provide or make readily available, privacy notices to the individuals about whom they are sharing information. The privacy notice should:

• clearly explain that their data may be disclosed for the purpose of preventing and detecting fraud;
• include details of the legal basis on which the data controller relies for the processing;
• in accordance with the Information Commissioner’s guidance, specify with whom the data will be shared; and
• contain details of how individuals can find out more information about the processing in question.

18. For more information on privacy   notices,  participants   should   refer  to the Information Commissioner’s guidance at https://ico.org.uk/for- organisations/accountability-framework/transparency/
19. The Comptroller and Auditor General’s full text privacy notice for the National Fraud Initiative is available on the NIAO’s website at https://www.niauditoffice.gov.uk/national-fraud-initative . It includes an explanation of the legal basis for the C&AG’s data matching exercises.
20. The Key Contact for each participating organisation must submit a declaration via the secure NFI web application confirming that they have complied with Privacy Notice requirements.

Contact nominations and responsibilities

Senior Responsible Officer role

21. The director of finance, or equivalent senior named officer, will act as ‘Senior Responsible Officer’ (SRO) for the NFI. The SRO is responsible for ensuring the participating organisation meets its statutory requirements. The SRO should:

• nominate a Key Contact;
• ensure the Key Contact has access to the matches via the secure NFI web application when they become available; and
• ensure that the Key Contact fulfils all privacy notice requirements.

Key Contact role

22. The Key Contact is responsible for:

• fulfilling the organisation’s privacy notice requirements. The Key Contact should be in direct communication with their organisation's data protection officer or equivalent;
• ensuring that the data formats guidance and data specifications are adhered to;
• nominating appropriate users to upload data submissions, investigate the matches and act as point of contact for other bodies about a match (‘preferred dataset contact’);
• co-ordinating and monitoring the overall exercise; and
• ensuring that outcomes from the investigation of matches are recorded on the secure NFI web application promptly and accurately.

23. In small organisations, one person may fulfil the Key Contact, data submission, dataset contact and investigation roles.

Data submission role

24. The user responsible for the submission of the data should ensure that data:
    • meets the specifications (see Appendix 1);
    • contains a header row;
    • is in the correct format (see Appendix 3);
    • is submitted via the data file upload (DFU) facility; and
    • is submitted by the required deadline (see Table 2 at paragraph 30).

Investigation role

25. The Key Contact will set up a user or number of users with access to the NFI web application so that they can review and investigate the matches.   The users may also be responsible for responding to enquiries from other matched bodies if the Key Contact delegates this role.

26. Once the data matching process for each exercise is completed, the output will be available to the relevant participating body via the secure NFI web application. Participating bodies are then responsible for reviewing and investigating matches as appropriate.
27. The secure NFI web application contains embedded guidance with the data matching output. It is essential that users follow this guidance as it helps with prioritising reports and the matches within them.

1. Before data is extracted (downloaded) from local systems, it is essential that the guidance on data upload to the NFI secure website is taken into account:

• data upload instructions (Appendix 2); and
• data format (Appendix 3).

1. If you require any further guidance on how to extract, upload or submit data please contact the NFI Data Centre (Synectics Solutions Ltd) via email helpdesk@nfi.gov.uk or call 0845 345 8019.

1. To upload the data, log into the secure NFI web application and select the Data File Upload option from the relevant National Exercise menu. The secure application features 256 bit Secure Sockets Layer encryption and enables data files to be password protected. Before downloading data from your system, please refer to Appendix 2.

1. Data should be submitted using the Data File Upload (DFU) facility within the NFI secure website. This is the only acceptable method to supply NFI data. If any other method of submission is used, our policy will be to inform the Senior Responsible Officer that data has been put at unnecessary risk.

Password protection

1. As part of our ongoing commitment to keep your data secure, in line with good practice when handling personal data, you are required to password protect each dataset once extracted from the relevant systems. If required, refer to the guidance on the Public Sector Fraud Authority website at https://www.gov.uk/guidance/uploading-data-to-national-fraud-initiative .

1. The document Protect Yourself Online (available on the Public Sector Fraud Authority website at the above link) provides guidance on using the NFI secure web application.

1. If you require any further guidance on extracting data from your system or submitting data, contact the NFI Data Centre (Synectics Solutions Ltd) via email helpdesk@nfi.gov.uk or call 0845 345 8019.

1. The Senior Responsible Officer and Key Contact can take measures to make the NFI process more efficient. These include:

• ensuring all contact details are up to date;
• reviewing the data quality reports from the previous exercise to identify any improvements that can be made for the next data submission (these reports will be accessible from the home page of the secure NFI web application);
• making sure that appropriate staff review all data extraction guidance documents prior to submission of data; and
• planning in advance what investigative resources are needed, based on local expertise and knowledge, so the matches can be dealt with promptly. For example, trade creditor duplicate matches are perhaps best dealt with by a nominated person in either Internal Audit or Accounts Payable.