Select committee: Public Accounts Committee
Conclusion 17
67th Report - NS&I’s transformation programme
Published 13 Feb 2026
Addressed to HM Treasury
Public Accounts Committee NS&I’s transformation programme All items in this report Report on parliament.uk ↗ Inquiry on parliament.uk ↗
Conclusion (the committee's words)
In 2025, NS&I implemented a new Risk Management Framework, but has not yet fully embedded the framework throughout its organisation.43 We wanted assurance that this framework is good enough to ensure that risks to customer data could be managed, and NS&I claimed it was “comprehensive”.44 NS&I did say that it had improved its risk management processes through greater involvement of its risk directorate, but also 38 Qq 6, 11; C&AG Report, para 2.4 and Figure 6 39 Q 65 40 Q 22 41 C&AG’s Report, paras 20 and 24 42 Q 78 43 C&AG’s Report, para 3.23 44 Q 66 12 said that it was relying on GIAA, as “we accept that we do not have all the expertise in these areas”.45 GIAA is intended to be an internal audit function which should be assuring risk management, rather than doing the work. Having the right skills and capability to deliver the Programme
From: Public Accounts Committee, 67th Report - NS&I’s transformation programme (HC 1237), 13 February 2026
Government response
The government responded to the whole report on 7 April 2026 (deadline 13 April 2026).
Summary written by Accountability Index from the government's response. It is not the government's own words.The government states that it "agrees with the Committee's recommendation" on each of the recommendations in the report, and sets target implementation dates between June and Autumn 2026.
- On the integrated plan, the government agrees that NS&I should prepare a realistic plan. NS&I is developing costed options, which will form the basis of a revised Full Business Case in the second quarter of 2026-27, "subject to Treasury and Ministerial process timings".
- NS&I will write to the Committee "within six months" setting out the integrated plan, including timelines and a revised estimated cost, and will provide a written update on its risk management framework "by June 2026".
- On culture, a business-wide programme of cultural change activity will be developed, with an initial plan to go to the Board and the Treasury in early Summer 2026 for "rolling implementation over the coming 12-18 months".
- The Treasury says it will evaluate NS&I's agreed plan through a full Treasury Approval Panel process and will write to the Committee in the Autumn on lessons learned from its oversight.