City of York Council - Fraud Risk Assessment (February 2021)

Risk Area	Risk Description	Risk Controls	Risk Category	Risk Mitigation
Council Tax & Business Rates Frauds (discounts and exemptions)	Council Tax fraud can be a common occurrence. CIPFA report that 81% of all local government related fraud, recorded as part of their annual survey, involved Council Tax or Business Rates payments. Single Occupancy Discount fraud accounted for £19.4m of loss due to fraud in 2018/19 according to the survey. Depending on the scheme, there are several ways in which fraud can occur. These include applicants providing false information and recipients failing to notify the council when they no longer qualify. Revenue from Council Tax is a key income stream. Fraud in this area threatens this source of funding.	The council employs a number of methods to help ensure only valid applications are accepted. This includes requiring relevant information on applications forms and visits to properties (where necessary). Controls including separation of duties between collection and administration, restriction of access to records and management oversight of action such as recovery suppressions help prevent internal fraud and error. Messages reminding residents and businesses to update their circumstances when necessary appear on annual bills issued by the council. The council routinely takes part in the National Fraud Initiative. In addition, the council conducts periodic Single Person Discount reviews.	High	Counter fraud team (CFT) will raise fraud awareness with staff in revenues and customer services teams about frauds affecting Council Tax and Business Rates. The CFT has developed data matches to detect incorrectly received discounts and exemptions. These will be undertaken as required.
Council Tax Support Fraud	Council Tax Support is a council funded reduction in liability introduced in 2013 to replace Council Tax Benefit. Unlike its predecessor, Council Tax Support is resourced entirely through council funds. CIPFA’s fraud tracker showed an 18% increase in the value of fraud found in this area in 2018/19. Frauds in this area can involve applicants failing to declare their total assets, correct household composition or household income. Those receiving support are also obligated to notify relevant authorities when they have a relevant change in circumstances that may affect their entitlement to support. Covid-19 has resulted in an increase nationally for benefits and support claims. These increased numbers raise the number of claims in which changes in circumstances may not be reported or false information could be presented to the council.	The council undertakes eligibility checks on those who apply for support. There are established lines of communication with the Department for Work and Pensions where claims for support are linked to externally funded benefits. The council is able to report Housing Benefit and other benefit frauds to the Department for Work and Pensions but this does not necessarily allow the council control over resolving false claims for Council Tax Support.	High	Fraud concerns are reported to the counter fraud team who determine if criminal investigation is required. The CFT can undertake joint investigation with the Department for Work and Pensions where it is mutually beneficial (e.g. joint claims for benefit). The CFT will continue to raise awareness with relevant staff.
Covid-19 Grants	In response to the covid-19 pandemic, central government has made funding available for local businesses. Several schemes throughout 2020/21 have been administered by councils; some were linked to business rates liabilities while others were to assist those outside this scope. The council had to respond quickly to support businesses. New processes for managing applications and paying grants had to be developed quickly. Further schemes were introduced to provide support to businesses during the covid-19 tier system. In addition, schemes were introduced to aid residents unable to work due to self-isolation requirements and support families with children or vulnerable adults. These schemes have been subject to attempted fraud at a local, national and international level due to the significant funds available (up to £25k per application). While funding is provided by central government, the council is charged with the responsibility of identifying genuine applicants and investigating and recovering incorrect payments. The council therefore needs to show that suitable assurance and recovery actions have taken place.	The council processed over 4300 grant claims for the government's Small Business Grant Fund, Retail, Hospitality and Leisure Grant Fund, and Local Authority Discretionary Grant Fund. Checks by council officers were made into each application to make sure they met the criteria set by government and that payments were being made to the correct people. Applications for ongoing business and resident support schemes continue to be carefully assessed before payment. The CFT have circulated details of all known frauds occurring regionally and nationally to help prevent the council falling victim to fraud. The council provides monthly updates on payments made, fraud/error identified and the status of any recovery work to the Department for Business, Energy & Industrial Strategy.	High	Any instances where an applicant provided false information to the council are reported to the counter fraud team. Where appropriate, criminal investigations can take place. The Department for Business, Energy & Industrial Strategy have stated that councils should conduct investigations where they have resources available. If the council is targeted by a national fraud, this is reported to the National Investigation Service (NATIS) via the CFT. The team will continue to liaise with external agencies as required. The CFT is undertaking a post-payment assurance exercise on the initial business grant schemes and will continue to support post assurance work on later payments. Additionally, the council is participating in the 2020/21 National Fraud Initiative which will include data matches relating to grant payments.
Creditor Fraud	A range of frauds can be committed against the council as a result of publically available creditor payment data. Criminals undertaking these types of fraud are often found to be operating from overseas. The most common issue is mandate fraud where fraudsters impersonate legitimate suppliers and attempt to divert payments by requesting changes in banking details. Other types of fraud in this area include whaling, where senior members of the council are targeted and impersonated in order to obtain fraudulent payments. With increased remote working due to covid-19, there are increased opportunities for fraudsters to impersonate budget holders or suppliers in electronic communications, to divert funds.	The council has a number of controls in place to identify fraudulent attempts to divert payments from genuine suppliers and to validate any requests to change supplier details. This includes contacting companies to confirm that any requested change of bank account details for payments is genuine. Segregation of duties exist between the ordering, invoicing and payment processes.	High	The CFT undertake work to raise staff awareness of these types of frauds. Increased awareness provides a greater chance of stopping fraudulent attempts before losses occur. All instances of whaling fraud reported to the CFT will be reported to the police’s Action Fraud Unit, National Cyber Security Centre and directly to internet service provider from which the false emails originated. The CFT share intelligence on any attempted frauds occurring nationally to ensure the council can prevent losses.
Cybercrime	Cybercrime is a constantly evolving area. Criminals are continually refining their techniques in order to overcome controls put in place to protect organisations. Types of cybercrime experienced by local authorities in recent years include ransomware, phishing, whaling, hacking, and denial of service attacks. Attacks can lead to loss of funds, loss and theft of data, and access to systems being compromised. Councils hold a range of data on residents which can be attractive to criminals.	The council has a highly skilled ICT department which helps mitigate the threat of cybercrime. Where appropriate the CFT investigate specific incidents of cybercrime.	High	Raising awareness with staff can be crucial in helping to prevent successful cyberattacks. Any counter fraud training delivered will reinforce anti-cybercrime messages to members of staff. All instances of cybercrime and related fraud will be reported to the police’s Action Fraud Unit and the National Cyber Security Centre.
Procurement Fraud	Procurement fraud has been perceived as a high risk by local authorities in the CIPFA fraud tracker for a number of years. Procurement fraud, by its nature, is difficult to detect but can result in large scale loss of public funds over long periods of time. The Competition and Markets Authority estimates that having a cartel within a supply chain can raise prices by 30% or more. CIPFA reported losses of £20.3 million in 2018/19 for local authorities, due to procurement fraud. It found that 12% of fraud detected in this area involved ‘insider fraud’ and 5% involved organised crime. In response to the effects on businesses as a result of Covid-19, the government issued a Procurement Policy Notice in February 2020. This introduced a supplier relief scheme to support council suppliers during and after the outbreak to ensure service continuity. The council has the responsibility for ensuring this relief is correctly applied and not abused.	The council has established Contract Procedure Rules. The rules are reviewed annually and ensure the requirement for a competitive process (where required) through an e-tender system. A team of procurement professionals provide guidance and advice to ensure that procurement processes are carried out correctly. A tendering and evaluation framework is in operation to help prevent fraud. It also sets out the requirements for declarations of interest to be made. Contract monitoring is implemented to help detect and deter fraud.	High	Continued vigilance by relevant staff is key to identifying and tackling procurement fraud. The counter fraud team will continue to provide training to raise awareness of fraud risks in this area. The counter fraud and internal audit teams monitor guidance on fraud detection issued by the Competition and Markets Authority and other relevant bodies. Potential abuses of the supplier relief scheme will be reported to the CFT for further investigation.
Theft of Assets	The theft of assets can cause financial loss and reputational damage. It can also negatively impact on employee morale and disrupt the delivery of services. The council owns large numbers of physical items, such as IT equipment, vehicles and tools. Reduction of staff at council premises during the covid-19 outbreak could leave equipment at heightened risk of theft. Unauthorised access to buildings may not face the same level of visibility or challenge as would be the case in normal conditions.	Specific registers of physical assets (e.g. capital items, property and ICT equipment) are maintained. In addition, there are registers for information assets held by the council. The council's whistleblowing arrangements provide an outlet for reporting concerns of theft.	High	Members of staff should also be vigilant and report all possible thefts promptly to the police and CFT.
Internal Fraud	There are a range of potential employee frauds including falsifying timesheets and expense claims, abusing flexitime or annual leave systems, undertaking alternative work while sick, or working for a third party on council time. Some staff have access to equipment and material that may be misused for private purposes. Payroll related fraud can involve the setting up of 'ghost' employees in order to divert salary payments to others. Corruption and bribery is a significant risk to all public sector organisations, however, only low levels have ever been detected.	The council has an established whistleblowing policy through which concerns can be raised. Controls are in place surrounding flexitime, annual leave and sickness absence. Participation in the National Fraud Initiative helps the council identify potential cases of internal fraud.	Medium	The CFT investigate all suspicions of corruption while internal audit ensure that appropriate checks and balances are in place to help prevent it.
Recruitment Fraud	Recruitment fraud can affect all organisations. Applicants can provide false or misleading information in order to gain employment such as bogus employment history and qualifications or providing false identification documents to demonstrate the right to work in the UK.	The council has controls in place which include verification of qualifications and reviewing references to help mitigate against the risk of fraud in this area.	Medium	Where there is a suspicion that someone has provided false information to gain employment, the counter fraud team will be consulted on possible criminal action in addition to any disciplinary action that may be taken.
Blue Badge & Parking Permit Fraud	Blue Badge fraud carries low financial risk to the authority but can affect the quality of life for disabled residents and visitors to the city. There is a risk of reputational damage to the council if abuse of this scheme is not addressed.	CFT and Parking Enforcement work closely together to identify and deter parking fraud.  Days of action are held regularly in the city centre where all badges are checked for misuse.	Low	The CFT regularly issues warnings to people who choose to misuse parking permits and blue badges.  Serious cases are considered for prosecution.
Fraudulent Insurance Claims	The council may receive exaggerated or fabricated insurance claims. CIPFA report that in 2019 the average value of a fraudulent claim against local authorities was over £39.5k.	While insurance fraud is common, the burden of risk is currently shouldered by the council’s insurers who have established fraud investigation systems.	Low	n/a
Treasury Management	The impact of losses in this area could be significant. There are no recorded frauds within the council.	Treasury Management systems are well controlled and no fraud has been detected in this area.	Low	Internal audit undertake periodic reviews of the controls in this area.