75th Report - Government use of data analytics on error and fraud

Government’s digital and counter-fraud experts know what government needs to do to make fraud and error savings through data analytics, but do not have a robust plan to support public bodies to do so. There are several barriers preventing the wider use of data analytics to fight fraud and error across government, including: the continued use of legacy systems; poor quality data; difficulties in sharing data; and a lack of digital skills in central government. However, while government knows what the barriers are, it lacks a detailed action plan to address them. DSIT published its delayed Roadmap for modern digital government in January 2026. 3 While this strategy sets out the government’s ambition to embrace AI and replace legacy IT systems, it contains little detail on how and when this will be done and nothing on how this will help tackle fraud and error losses or what DSIT’s responsibilities will be in this area. recommendation The Government Digital Service, Public Sector Fraud Authority and Government Finance Function should set out how they will work together to deliver the reduction in fraud losses that data analytics can achieve, with clear targets and milestones. This should include how government intends to move from a system of detecting and recovering fraud, to one more focused on preventing fraud in the first place.

We are concerned that government has not built the digital capability or senior digital leadership it needs to achieve change and bring fraud savings from data analytics. Digital transformation will require strong leadership. The government accepted the previous Committee’s September 2023 recommendation that all departments should have a non-executive director with relevant digital, data and technology transformation expertise on their Boards. While DSIT assured us that this is now the case at several key departments, this ambition has not yet been achieved across government. GDS intends for at least 10% of the civil service to be digital, data and cyber professionals, but in April 2025 only 5.5% of the civil service met this criteria, and GDS is concerned that civil service pay rates make it difficult to retain digital leaders and achieve the upskilling it needs. We were also disappointed to hear that DSIT is not proceeding with the appointment of a permanent secretary-level Government Chief Digital Officer. It is instead choosing a structure where two directors-general will report into the DSIT permanent secretary, with responsibility for supporting digital transformation across government and the digital products GDS builds and runs. We believe this is a shortcoming, and that a Chief Digital Officer of appropriate seniority would give DSIT much greater clout across the whole of government to make the massive digital transformation that is necessary. recommendation a. The Department for Science, Innovation and Technology should mandate that there are digitally skilled leaders at board level in all government departments, and all ALBs where technology plays a key part in their ations. It should also mandate the appointment of senior digital specialists in each department and ALB. 4 b. The Department for Science, Innovation and Technology should appoint a highly skilled Government Chief Digital Officer, at permanent secretary level, with the necessary authority and

Government is not doing enough to promote the effective sharing of data, which is stopping departments from maximising the savings they could make from data analytics. Government bodies have legal frameworks through which to share data, such as those established by the Digital Economy Act 2017, but find it time-consuming and difficult to do in practice. The PSFA told us it is taking steps to make this process simpler and quicker. The PSFA also told us it is building a library of counter- fraud controls to encourage and enable better data sharing and to make it easier for government bodies to know what datasets and tools are already available. GDS said it was building a single data platform for use across government that will enable government bodies to find and use data assets. But government does not make full use of the other data- sharing tools available to it. For example, the National Fraud Initiative tool (NFI), which local authorities must use and through which they save millions of pounds by matching their own data with that of other local authorities, is not mandatory for central government. This means the NFI does not benefit from much of central governments data to help flag more potential fraud, and that central government itself does not realise some of the potential savings. recommendation a. The Public Sector Fraud Authority should write to the Committee within 6 months to explain its progress in developing a library of counter-fraud controls. It should also set out its steps to identify and address issues with data sharing through the Digital Economy Act, to make this process simpler and quicker. This communication should include an evaluation of how its work has enabled greater sharing of data and greater use of data analytics. 5 b. In the Treasury Minute response to this report the Department for Science, Innovation and Technology should set out further information on the single data platform. This should include the timetable for completion and be

Departments are not doing enough to be transparent or build public trust on the use of data analytics to tackle fraud. In tackling fraud, government must balance maintaining public trust by being transparent about what it is doing, with not providing so much information that it helps fraudsters. We are concerned that government is not doing enough to assure the public that its use of data analytics is appropriate and does not disadvantage sections of the population. As an example, government bodies are required to disclose publicly any use of algorithms, AI and machine learning in decision making through the Algorithmic Transparency Recording Standard. DSIT told us that, while it believes it has captured most such uses, it knows that not all the expected cases have been recorded. As of February 2026, the Algorithmic Transparency Recording Standard repository held 11 records that mentioned ‘fraud’, and none of the good practice examples of data analytics case studies the NAO reported on were present on the register. recommendation The Department for Science, Innovation and Technology should ensure that all government bodies comply with the Algorithmic Transparency Recording Standard so that the Hub captures all relevant uses of AI and machine learning. It should continuously monitor, update and ensure compliance with guidance around data analytics transparency to ensure that it maximises transparency without assisting fraudsters.

Current legislation limits government’s ability to deploy data analytics to tackle fraud and error. Some existing legislation, such as the Digital Economy Act, support the use of data analytics to fight fraud and error by enabling data sharing across departments. However, there are also instances where legislation, written some time ago, does not fully support the effective deployment of modern data analytics techniques. For instance, the Local Audit and Accountability Act, introduced in 2014, does not allow for profiling of individuals’ behaviours. In practice, this means that it does not allow government to flag individuals who have committed fraud 6 before as an indicator for future fraud detection work, as would be done in other industries. Moreover, the data collected as part of the National Fraud Initiative, enabled by the Act, can only be retained for two years. This limits the ability to look at historical fraud trends and the range of data that can be used when trying to identify fraud. recommendation a. The Public Sector Fraud Authority should review the legislation impacting its ability to implement fraud and error data analytics and communicate to Parliament where it believes additional powers or other changes to legislation would be helpful. b. The Department for Science, Innovation and Technology and the Public Sector Fraud Authority should review the regulatory regime around government’s fraud and error activities and communicate to Parliament where they believe additional powers or other changes to legislation would improve controls for specific fraud and error risks. 7 1 Taking the opportunity to make fraud and error savings Introduction

On the basis of a report by the Comptroller and Auditor General, we took evidence from the Department for Science, Innovation and Technology (DSIT), the Public Sector Fraud Authority (PSFA), and the Government Finance Function (GFF) within HM Treasury.1

The PSFA told us that it now agrees annual targets for all government departments to reduce fraud error.12 Its latest figures from 2023–24 suggest that working towards these targets is having a tangible impact in preventing and recovering fraud losses.13 Although DWP makes its own fraud reduction targets public, the bulk of departments agree targets internally with the PSFA and do not publish them.14 The PSFA also told us that these targets are set one year at a time – it does not have a longer-term target that it is aiming towards. Instead, it looks for departments to increase their impact in reducing fraud and error each year.15 Government plans to achieve savings

There are a number of issues that are undermining government’s efforts to use data analytics more widely to combat fraud and error. DSIT told us that that getting usable data can be difficult because they are held on legacy IT systems or because the data are not of good enough quality.16 The PSFA stated that government bodies find data-sharing, which underpins data analytics, difficult because different bodies use different data processes.17 Government has also acknowledged that some parts of the civil service do not have the level of digital skills required to use data analytics to their full potential.18

We recommended in March 2025 that government’s planned digital and AI roadmap should be underpinned by a implementation plan with clear accountabilities, delivery milestones, and metrics to allow progress to be tracked.19 The NAO report echoed this, further recommending that the PSFA publish a plan setting out how it will support public bodies across government to make the best use of data analytics to tackle fraud and error.20 DSIT published its Roadmap for modern digital government in January 2026, some six months later than was originally intended and 10 Q 26 11 C&AG’s Report, para 1.4 12 Q 5 13 Q 5 14 Qq 8-10 15 Qq 13-14 16 Q 26 17 Q 35 18 Q 85 19 Committee of Public Accounts, Use of AI in Government, Eighteenth report of session 2024–25, HC 356, March 2025, recommendation 6a 20 C&AG’s Report, Recommendation 1 10 around a week after our evidence session for this inquiry.21 While the strategy does mention some of the key issues such as enabling better use of AI and replacing outdated IT systems, it contains few concrete milestones to measure progress against and has little to say about using technology to combat fraud and error or what DSIT’s responsibility will be in this area. 21 HMG, A roadmap for modern digital government, January 2026 11 2 Overcoming barriers to achieving savings Digital capability and leadership

The previous Committee recommended in September 2023 that all Departments should appoint at least one non-executive director with relevant digital, data and technology transformation expertise to their Board.22 This recommendation is reflected in the Government’s new Roadmap for modern digital government, which sets an expectation that by December 2026 “Central and local government will be expected to have a digital leader on their executive committee and a digital non- executive director on their board.”23 DSIT told us that the ‘big digital delivery departments’, for the most part, already have digital officers at senior levels in their executive team and on their non-executive boards, but that this is not the case across all government bodies.24

The Cabinet Office told us in March 2025 that, to achieve annual savings of up to £500 million by reducing the need for digital consultants, it was aiming for 10% of civil servants to have digital expertise.25 Only 5.5% of the civil service met this criteria in April 2025, though DSIT told us that some government departments had already met this 10% target and that others are progressing towards it.26 It also told us that while there are schemes, such as apprenticeships, aimed at developing government’s digital capability, it faces challenges in recruiting and retaining at senior digital roles because of the wide pay differentials between the public and private sectors. DSIT told us that there is a degree of pay flexibility in making senior appointments and that it makes the case for these to be used, working with HM Treasury.27 We reported in December 2025 that the 22 Committee of Public Accounts, Digital transformation in government: addressing the barriers to efficiency, Seventieth report of session 2022–23. HC 1229, 13 September 2023, Recommendation 3b 23 HMG, A roadmap for modern digital government, January 2026, ‘Elevating digital leadership across government’ section 24 Q 87 25 Letter from Cabinet Office, 24 March 2025 (letter incorrectly dated 24 March 2024) 26 Q 85 27 Q 41 12 digital pay framework has been revalorised, but that it still falls short of industry rates in London and the South East, and this affects recruitment and retention.28

At present much work on sharing best practice and increasing digital and counter-fraud capability across government is carried on through networks and communities of practice, though not all colleagues who might benefit from these sessions are in attendance.29 The PSFA told us that it works with DSIT and the community of practice to produce guidance and training to reflect the nature of counter-fraud work, and building standards and qualifications for people working in fraud.30 The Government Counter-Fraud Function also circulates guidance, including guidance on data analytics pilot schemes to combat fraud that it produced in conjunction with counter-fraud colleagues from Australia.31

As confirmed in January 2025’s Blueprint for modern digital government policy paper, cross-government digital leadership now resides with DSIT.32 The blueprint included a plan to raise the status of the Government Chief Digital Officer to second permanent secretary-level. DSIT told us that it has now replaced the Government Chief Digital Officer, who was responsible for all the digital work within the GDS, with two new directors general posts. One of these is the director-general for digital products who is responsible for the various products that GDS builds and runs itself; the other is the director-general for digital transformation who is responsible for the architecture that supports other government departments to deliver their digital programmes (including progressing the digital profession, improving data and promoting the use of AI).33 Neither role of director-general for digital transformation or director-general for digital products has been filled permanently, although interim appointments were made to both posts in January 2026.34 28 Committee of Public Accounts, Government services: identifying costs, Fifty-Eighth report of session 2024–26. HC 1421, 12 December 2025, Conclusion 5 29 Qq 45-46 30 Qq 33 and 45-46 31 Q 46 32 DSIT, A blueprint for modern digital government, CP 1252, January 2025 33 Q 86 34 Emily Middleton has been appointed as interim DG for digital and Christine Bellamy has been appointed as interim DG for digital products 13 Sharing data effectively across government

The Digital Economy Act 2017 established a process through which government bodies can agree arrangements to share data with one another. The NAO reported that, as of July 2025, there had been 28 data-sharing pilot agreements set up through this process to tackle fraud, although only four had become business-as-usual processes.35 The NAO noted that government bodies found it difficult and time-consuming to conclude these data-sharing agreements. The PSFA had an ‘indicative timeline’ which suggested that setting up a data-sharing agreement should take around 20 weeks, but the NAO found that the process could take months or even years to negotiate and that the PSFA does not have a formal monitoring process to check whether this is achieved.36 The PSFA told us that, in response to these findings, it had produced a number of standard templates which it hopes will make the process quicker and simpler.37 It also noted that projects initiated through the Digital Economy Act had achieved benefits in excess of £200 million in reducing fraud.38

The National Fraud initiative (NFI) is a tool created in 1996 that brings data together from across the public sector to help bodies look for fraud and, to a lesser extent, for error. The NFI was originally focused on local authorities, who are required to use it. But the PSFA told us it is now increasingly used by central government bodies as well.39 Thirty-six central government bodies (including arm’s-length bodies) took part in the most recent NFI exercise in 2024–25, an increase from 22 bodies in the previous iteration.40 The PSFA told us that there is more that could be done with the NFI and there are parts of it that it would encourage greater use of.41 It explained to us that central government bodies are not mandated to use the NFI because the original legislation was targeted at local government and has not since been amended.42 The Treasury told us that there may be an option to mandate central government bodies to feed data into the NFI even if they were not going to use it themselves. However, it also said that government has chosen not to mandate central government bodies to participate, as not all would have useful data.43 In written evidence provided after the session, the PSFA provided a preliminary estimate that making 35 C&AG’s Report, para 2.5 36 C&AG’s report, para 2.19 37 Qq 36-37 and 57 38 Q 82 39 Qq 48-49 40 C&AG’s Report, Figure 5 41 Q 48 42 Q 52 43 Q 53 14 the NFI mandatory for central government departments, and amending legislation to allow more data matching activities, could realistically save between £120 million and £150 million per two-year National Fraud Initiative cycle. Even under the PSFA’s most conservative modelling, it still projected a net uplift of approximately £60 million per two-year cycle.44

The NAO report noted that, at present, there is no available library of counter-fraud tools and examples for government bodies to refer to.45 It recommended that the PSFA should maintain a library of digital counter- fraud control that public bodies can use to find ways to address their fraud risks.46 The PSFA told us that it felt that this was a useful recommendation and is taking the project forward.47 DSIT told us that it was in the process of creating a single register of data assets that will ultimately underpin a platform that enables data sharing across government. Its intention is that this will highlight instances of successful data sharing and encourage government bodies to learn from them.48 44 Letter from the Public Sector Fraud Authority, 12 March 2026 45 C&AG’s Report, para 2.6 46 C&AG’s Report, recommendation 2 47 Q 83 48 Qq 27 and 43-44 15 3 Building public trust and optimising related legislation Transparency and maintaining public trust

The PSFA told us that it is important to use data to fight fraud, and to maintain public trust that government bodies are holding their data in accordance with Parliament’s intentions.49 The C&AG told us that, while transparency in government operations was a positive thing, when dealing with counter-fraud measures it is important to not provide so much information that it helps fraudsters to circumvent controls.50 The PSFA outlined that its current approach is to disclose what data analytics are being used to fight fraud and to let the public know how their data will be used, but not to make public the various checks it performs on the data.51

To ensure transparency, government bodies are required to disclose the use of algorithms, AI and machine learning through the Algorithmic Transparency Recording Standard (ATRS) hub.52 As at February 2026 the hub, which requires records of any such items used in decision making, recorded 110 being used in central government. Of these records, 11 mention ‘fraud’.53 None of the items the NAO report listed as good practice examples were recorded in the hub. DSIT reported that departments find the process challenging as they do not want to provide information that might help fraudsters, and it provides guidance on this subject.54 DSIT acknowledged that the ATRS hub was not a complete record, but told us that it was confident it had recorded the majority of cases.55

The NAO noted that DWP provided an example of good practice in transparency by setting out in its annual report and accounts how it ensures that its use of data analytics does not result in adverse impacts 49 Q 37 50 Q 25 51 Q 74 52 Qq 69-70 53 Government Digital Service, Algorithmic Transparency Recording Standard Hub, accessed 3 February 2026 54 Qq 71-72 55 Q 71 16 to customers.56 When we considered DWP’s 2023–24 accounts, we were concerned that the department’s use of data analytics and machine learning might have a detrimental impact on customers. DWP assured us that it had conducted a fairness impact assessment, but that it could not publish the results as they could assist fraudsters.57 Legislative challenges

The PSFA told us that current legislation, for example the Digital Economy Act 2017 mentioned previously, is an essential foundation for the use of data analytics to fight fraud and error. That Act provided a mechanism which enabled government bodies to share certain datasets, allowing for greater use of data analytics.58

However, the PSFA also told us that there are instances where legislation, written some time ago, does not fully support the effective deployment of modern data analytics techniques. For example, the Local Audit and Accountability Act 2014 does not allow for profiling of individuals’ behaviours. Which means in practice that data collected under that Act can be used to look for or prevent fraud, but it cannot be used for ongoing live fraud investigations. It also does not allow the data to be used to flag individuals who have previously committed fraud to inform future counter- fraud work. The PSFA told us that, in other industries, it would be standard practice to use evidence that someone has committed fraud as an indicator that they may do so again.59

Legislation also requires that data collected as part of the National Fraud Initiative, enabled by the Local Audit and Accountability Act, can only be retained for the two years – the duration of each biennial exercise. The PSFA told us that this data would be useful to inform counter-fraud work if it was retained for longer. This is common practice in other industries where they use historical data on fraud to identify trends and train models to understand what to look for. We note that it is common practice elsewhere for records to be retained for longer. For instance, HMRC requires companies to retain records for six years.60 56 C&AG’s Report, para 2.25 57 HC Committee of Public Accounts, DWP Customer Service and Accounts 2023–24, Sixth report of session 2024–25, HC 354, 31 January 2025, para 7 58 Q 92 59 Q 92 60 Qq 92 and 96 17