Internal audit and anti-fraud privacy notice

Alert

Council tax scam: text message being sent to residents asking them to pay additional rent

COVID-19 Coronavirus: advice and guidance

Who we are and what we do

The Internal Audit and Anti-Fraud Division is part of the Finance and Governance Directorate and provide an independent function to provide the council assurance on its internal control, fraud and governance processes. This is set out under Section 151 of the Local Government Act 1972. These functions require us to hold or have access to information from systems and processes across the council, in order to fulfil the legal requirement to provide an internal audit function and to prevent, detect, deter and investigate referrals of fraud bribery and corruption.

Information we hold about you Click to get info

The Internal Audit and Anti-Fraud Division may collect a wide variety of information from a range of sources, including, but not limited to:

Personal, such as name, date of birth, address;
Employment, for example national insurance number, employer details and history, next of kin, sickness records;
Financial details, such as bank account information, mortgage accounts, pensions, credit history;
Health information gathered to assess eligibility for benefits;
Information gathered during the course of an investigation or proactive exercise;

Documentary evidence provided in order to access council services.

Why we need your information and how we use it Click to get info

Information collated as part of a sample to undertake internal audits of council provided services and of services provided to the council
Information used for proactive anti-fraud exercises to identify fraud
To assist with the investigation of criminal, civil and disciplinary offences
To verify that the information you have supplied is correct and accurate
For service planning, delivery and improvement
To prevent money-laundering and to verify your identity

The lawful basis for the processing Click to get info

The Internal Audit and Anti-Fraud Division have a duty to protect the public purse. The following acts and regulations provide the basis on which the section operates:

Section 151 of the Local Government Act 1972 requires that authorities ‘make arrangements for the proper administration of their financial affairs’
The Accounts and Audit Regulations 2015 require that ”a relevant body must undertake an effective internal audit to evaluate the effectiveness of its risk management, control and governance processes, taking into account public sector internal auditing standards or guidance. Any officer or member of that body must, if the body requires:
- a) make available such documents and records (including those in electronic form); and
- b) supply such information and explanation.

as are considered necessary by those conducting the internal audit”.

The Police and Criminal Evidence Act 1984
Criminal Procedure and Investigations Act 1996
Local Government Finance Act 1992
Council Tax Reduction Schemes (Detection of Fraud and Enforcement) (England) Regulations 2013
Prevention of Social Housing Fraud Act (Power to Require Information) (England) Regulations 2014
Regulation of Investigatory Powers Act 2000
Criminal Procedures and Investigations Act 1996
Police & Criminal Evidence Act 1984
Public Interest Disclosure Act 1998
Local Audit and Accountability Act 2014

For more details on the Lawful Basis see the ICO guidance

Who your information will be shared with Click to get info

Including but not limited to:

Other local authorities
Registered social landlords
The Cabinet Office
Other Government departments
Fraud prevention agencies
The Police
Employers
NHS
Judicial agencies, for example; Courts
Where information is requested under relevant legislation.

How long we will keep your information Click to get info

The Internal Audit and Anti-Fraud Division have retention schedules in place to ensure that information is only held for as long as is needed.

For successful sanction cases, we are requested to keep your information for a minimum of seven years after which time it will be destroyed. For other cases, your information will be kept for 12 months after which time it will be destroyed.