Self appraisal checklist NFI

Background

 

  1. The National Fraud Initiative (NFI) is a biennial UK-wide counter-fraud exercise. In Northern Ireland, the exercise is undertaken by the Comptroller and Auditor General for Northern Ireland (C&AG) under his statutory data-matching powers set out in Article 4 of the Audit and Accountability (Northern Ireland) Order 2003.  The C&AG works in collaboration with the Public Sector Fraud Authority, Audit Scotland and Audit Wales, which undertake the NFI exercise in England, Scotland and Wales respectively. 

 

  1. The NFI uses computerised techniques to compare information about individuals, held by different public bodies and on different financial systems, which might suggest the existence of fraud or error. It means that public bodies can take action if any fraud or error has taken place, and it allows auditors to assess the fraud prevention arrangements which those organisations have in place. 

 

  1. Information about the NFI and copies of our NFI reports are available on the NIAO website.

Self-appraisal checklist

 

  1. The NFI is one aspect of an organisation’s counter-fraud arrangements. We have prepared this two-part checklist included at Appendix 1 to help participating bodies self-appraise their involvement in the NFI, prior to and during the NFI exercises.

  • Part A is designed to assist audit committee memberswhen reviewing, seeking assurance on, or challenging the effectiveness of their organisation’s participation in the NFI. 

  • Part B is for officers involved in planning and managing the NFI exercise. 

5. We encourage all participating bodies to complete the checklist and present it to those charged with governance to support scrutiny of their NFI arrangements.

How to work more efficiently

 

  1. The C&AG encourages organisations to review and investigate NFI matches efficiently and effectively. This enables them to make better use of their limited resources. Some suggestions for improving efficiency and effectiveness are included in Appendix 2. 

 

Contact details

  1. Any queries about this checklist, or the NFI exercise in general, should be addressed to the NFI Coordinator at the Northern Ireland Audit Office – nficoordinator@niauditoffice.gov.uk 

Appendix 1

Self-appraisal checklist

 

Part A:

For those charged with governance

 

 

Yes/No/

Partly

 

Is action required?

 

Who by and when?

Leadership, commitment and communication 
 

 

Are we committed to the NFI? Have the board/council, audit committee and senior management expressed support for the exercise and has this been communicated to relevant staff?

 

 

 

Is the NFI an integral part of our corporate policies and strategies for preventing and detecting fraud and error?

 

 

 

Are NFI progress and outcomes reported regularly to senior management and elected/board members (e.g. the audit committee or equivalent)?

 

 

 

Where we have not reviewed the NFI data matches returned to us, are we satisfied that alternative fraud detection arrangements are in place and that we know how successful they are?

 

 

 

Does internal audit, or equivalent, monitor our approach to the NFI and our main outcomes, ensuring that any weaknesses are addressed in relevant cases?

 

 

 

Do we review how frauds and errors arose and use this information to improve our internal controls?

 

 

 

Do we publish, as a deterrent, internally and externally, the achievements of our fraud investigators (e.g. successful prosecutions)?

 

 

 


 

 

Part B:

For NFI Senior Responsible Officers and Key Contacts

 

Yes/No/

Partly

 

Is action required?

 

Who by and when?

Planning and preparation 

 

Are we aware of emerging fraud risks, and have we put in place appropriate preventive and detective measures?

 

 

 

Are we investing sufficient resources in the NFI exercise?

 

 

 

Do we plan properly for NFI exercises, both before submitting data and prior to matches becoming available? This includes considering the quality of data.

 

 

 

Is our NFI Key Contact the appropriate officer for that role and do they oversee the exercise effectively?

 

 

 

Does the Key Contact have the time to devote to the exercise, and sufficient authority to seek action across the organisation?

 

 

 

Where NFI outcomes have been low in the past, do we recognise that this may not be the case the next time, that NFI can deter fraud, and that there is value in the assurances that we can take from low outcomes?

 

 

 

Do we confirm promptly (using the online facility on the secure website) that we have met the fair processing notice requirements?

 

 

 

Do we provide all NFI data on time, using the secure data file upload facility properly?

 

 

 

Have we considered using the point of application data matching service offered by the NFI team (AppCheck) to enhance assurances over internal controls and improve our approach to risk management?

 

 

 

Effective follow-up of matches

Do those involved in the NFI start the follow-up of matches promptly after they become available?

 

 

 

Do we give priority to following up high-risk matches, those that become quickly out-of-date and those that could cause reputational damage if a fraud is not stopped quickly?

 

 

 

Are we investigating the circumstances of matches adequately before reaching a ‘no issue’ outcome, in particular?

 

 

 

Are we seeking help and expertise from counter fraud experts where appropriate (e.g. health bodies might liaise with Counter Fraud and Probity Services)?

 

 

 

Are we taking appropriate action in cases where fraud is alleged (such as disciplinary action, penalties, cautions or reporting to the police)? Are we recovering funds effectively?

 

 

 

Do we avoid deploying excessive resources on match reports where early work (e.g. on high-risk matches) has not found any fraud or error?

 

 

 

Where the number of high-risk matches is very low, are we adequately considering the medium and low-risk matches before we cease our follow-up work?

 

 

 

Overall, are we deploying appropriate resources on managing the NFI exercise?

 

 

 

Recording and reporting

 

 

 

Are we recording outcomes properly in the secure NFI website and keeping it up-to-date?

 

 

 

Do staff involved in NFI work use the online training modules and guidance on the secure website, and do they consult the key contact or NFI Co-ordinator if they are unsure about how to record outcomes?

 

 

 

If work is done outside the secure NFI website (which is not encouraged), do we ensure that all outcomes are then recorded within the secure NFI website?

 

 

 

Do we provide appropriate and timely feedback to senior management, board/council members and the audit committee on NFI activity and outcomes?

 

 

 

 

 

 


 

 

Appendix 2

How to work more efficiently 

 

Potential inefficiency

How to work more efficiently

Participants may not be using the latest time-saving enhancements to the NFI software.

Ensure staff within the organisation who are working on the NFI keep up-to-date with new features of the secure NFI website, and with good practice, by reading the guidance notes and watching the online training modules, before they begin work on the matches.

Matches that are time-critical, and which could identify an overpayment, may not be given priority.

Key contacts should schedule staff resources so that time-critical matches can be dealt with as soon as they are received.

Investigations that fall across different parts of the organisation may not be coordinated, resulting in duplication of effort or delays in identifying overpayments.

Key contacts should coordinate investigations across internal departments where applicable, to ensure all relevant issues are appropriately actioned.

Disproportionate time may be spent looking into every match in every report.

Use the tools within the NFI web application to help prioritise matches that are the highest risk. This will save time and free up staff for the most important investigations.

Enquiries from other organisations that take part in the NFI may not always be responded to promptly.

Regularly review and respond to enquiries from other organisations so that investigations can be progressed.

Data quality issues that are highlighted within the web application may not be addressed before the next NFI exercise.

Review the quality of the data supplied before the next exercise, allowing time for necessary improvements before the next data upload. Better data quality will improve the quality of the resulting matches.