Recommendation 11

The government did not maintain adequate cost visibility over the direct financial consequences of the data-breach response. The NAO found that the MOD could not identify ARR-specific costs with normal audit confidence, because those costs had not been separately recorded. The evidence also suggests that government did not consistently distinguish between the marginal cost of the breach response, the cost of the ARR, the cost of prioritised ARAP relocations and the wider cost of Afghan resettlement. Weak cost visibility, ambiguous presentation and delayed programme controls limited assurance and made it harder to test whether decisions were being taken on a realistic understanding of their financial consequences. (Conclusion, Paragraph 132) 70