The Auditor General conducts data matching exercises to assist in the prevention and detection of fraud.

Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. Computerised data matching allows fraudulent claims and payments to be identified. Where a match is found it indicates that there is an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

As the use of data by the Auditor General in a data matching exercise is carried out with statutory authority ((Part 3A of the Public Audit (Wales) Act 2004)), it does not require the consent of the individuals concerned under the Data Protection Act 1998.

All bodies participating in the Auditor General’s data matching exercises receive a report identifying matching data within that body’s own records and between that body’s records and those of other relevant bodies. It is for the body itself to investigate the matches, so as to detect instances of fraud, over or underpayments and other errors and to update its records accordingly.

To date, the NFI has led to the detection of fraud and overpayments in Wales totalling some £7 million.

Legal basis

From 2008, the Auditor General will conduct data matching exercises under new statutory powers contained in the Public Audit (Wales) Act, as amended by the Serious Crime Act 2007. Previous exercises were undertaken under his value-for-money examination and study functions in the 2004 Act and the Government of Wales Act 1998, and under appointed auditor’s powers.

Under the new powers:

1. the Auditor General may carry out data matching exercises for the purpose of assisting in the prevention and detection of fraud;
2. the Auditor General may require local government and NHS bodies in Wales to provide data for data matching exercises;
3. other bodies and persons may participate in its data matching exercises on a voluntary basis where the Auditor General considers it appropriate. Where they do so, the statute states that there is no breach of confidentiality and generally removes other restrictions in providing the data to the Auditor General;
4. the requirements of the Data Protection Act 1998 continue to apply;
5. the Auditor General may disclose the results of data matching exercises where this assists in the prevention and detection of fraud, and for certain other purposes, to bodies that have provided the data and to the auditors that he appoints;
6. the Auditor General may publish a summary report;
7. the Auditor General may disclose both data provided for data matching and the results of data matching to the Audit Commission, the Comptroller and Auditor General for Northern Ireland, the Auditor General for Scotland, the Accounts Commission for Scotland and Audit Scotland, for the purposes of preventing and detecting fraud;
8. wrongful disclosure of data obtained for the purposes of data matching by any person is a criminal offence;
9. the Auditor General may charge a fee to any body participating in a data matching exercise;
10. the Auditor General must prepare and publish a Code of Practice. All bodies conducting or participating in his data matching exercises must have regard to the Code, including the Auditor General himself.

Bodies required to provide or which volunteer data for matching

Currently, the Auditor General requires unitary local government authorities, police authorities, fire and rescue authorities, Local Health Boards (LHBs), NHS Trusts, probation boards and probation trusts to provide data. In addition, the following bodies provide data to the Auditor General for matching on a voluntary basis: Welsh Assembly Government [List of voluntary participating bodies to be updated from time to time]

The data that is matched and the reasons for matching it

For information describing which data sets are matched by the Auditor General and the purposes of each matching please refer to the Auditor General’s guidance available on this website.

Code of Data Matching Practice

Data matching by the Auditor General is subject to a Code of Practice (see  www.wao.gov.uk). This is to help all bodies involved in data matching to comply with the law and good practice, including maintaining data security.

Further information

More details on the Auditor General’s data matching exercises, including national reports, other publications and guidance, may be found at www.wao.gov.uk. Further information on the NFI exercises may be found at http://www.wao.gov.uk/whatwedo/1252.asp.

Alternatively please contact the Wales Audit Office’s NFI Co-ordinator, Wales Audit Office, 24 Cathedral Road, Cardiff, CF11 9LJ (nfi@wao.gov.uk).