Frequently asked questions – NFI private sector

Quick links down the page to Frequently Asked Questions:

New users

1. Why use NFI?

NFI has a proven track record at preventing and detecting fraud and our fees are designed to provide good value for money. NFI can match to many different datasets to help identify fraud and overpayment within your business, this includes; UK Border Agency data on failed immigration and expired visas, and DWP data on deceased persons. NFI has a secure web based solution which means submission of data and the subsequent release of matches is a smooth process.

2. But isn’t the Audit Commission being abolished?

Yes the government have announced the abolition of the Audit Commission. However NFI has been singled out as a significantly successful project and therefore will continue after the abolition. We can therefore confirm that NFI will not only continue to provide data matching solutions but will continue to expand into new areas in both the private and public sector.

3. What kind of support will we get?

We have a team of support staff ready to help you with any queries that you have. There are dedicated IT staff available for any technical queries you may have, and an experienced NFI team that can provide advice and guidance throughout the process.

4. Will my data be secure?

Yes, data security is our highest priority. We require that all data is submitted through our secure web application which has been accredited against HMG Information Assurance Standards. Matches are also passed back to participants via the secure web application.

5. What do I do next?

More information on the next steps can be found at How To Take Part. If you have any further questions or queries, please contact nfiqueries@audit-commission.gov.uk for more information. We can provide demonstrations of the NFI web application to help you understand how we can assist your organisation in preventing and detecting fraud.

Getting started

1. What does the Director of Finance have to do? Who should we nominate for the role?

The Director of Finance (DOF) has overall responsibility for NFI at your organisation. This role can be fulfilled another person but we would suggest that they are suitably senior within your organisation. The main responsibilities of the DOF are: nominate an NFI key contact ensure the key contact has access to the matches (via the secure NFI software) ensure that the key contact fulfils all data protection requirements reviewing overall progress with review and investigation of matches

2. What does the key contact have to do? Who should we nominate for the role?

The key contact will be responsible for: nominating appropriate users to upload data. nominating appropriate dataset contacts ensuring that the data formats guidance and data specifications are adhered to fulfilling data protection requirements. The key contact should be in direct communication with their organisation’s data protection officer or person with equivalent responsibility nominating appropriate users that will investigate the matches and act as point of contact for other bodies coordinating and monitoring the overall exercise ensuring the web application is updated with outcomes from the investigation of matches and providing feedback on the outcomes of the exercise both within the organisation and to the NFI team. We would advise that you nominate someone who is not going to be involved in the day-to-day investigation, but perhaps with more of a supervisory role.

Data submission

1. How should data be submitted for NFI?

A secure Data File Upload (DFU) facility is available within the NFI software from the link on the home page or the left hand menu. This enables you to upload your data quickly and easily. A password can also be added to this data. This is the only acceptable method of providing data for NFI.

2. Can I send data in an excel worksheet?

Preferably not. There are a number of reasons why you should not export data into Excel, some of the more common reasons are listed below. The alternative is to export your data to ‘csv’ or fixed length record format.

The data can be truncated, depending on the number of records in your file, to the maximum lines in a worksheet.
Numeric strings of 16 digits or more are treated as numbers by default and only the first 15 significant figures are stored.
Leading zeros are removed from numeric strings. This is a very common problem which can affect dates, invoice numbers, and so on.
Excel will automatically transform anything that looks like a date into a date however remotely. This causes problems with, for example, house numbers if they are supplied in a different column to the street name (for example, “05-07″).

3. How do I update contact details when they change?

The Director of Finance is responsible for nominating and updating a key contact. The key contact is responsible for updating dataset and data download contact details. Contact details can be amended by accessing User Admin from the NFI home page or the link on the left hand menu of the NFI matches.

4. What are fair processing notices and where can I find more details about them?

The Data Protection Act 1998 normally requires participants to inform individuals that their data will be processed. Unless an exemption applies, for data processing to be fair, the first data protection principle requires data controllers to inform individuals whose data is to be processed of:

The identity of the data controller.
The purpose or purposes for which the data may be processed.
Any further information that is necessary to enable the processing to be fair.

The provision of this information is known as a fair processing notice. Full details of what is required are set out in the code of data matching practice.

5. How do I progress matches to UK Border Agency data?

Guidance is provided within the NFI web application for each NFI report. The process for 2010/11 can be found under ‘help’ within the web application software.

6. What period should the trade creditor payments history data cover?

Creditor payments history data should cover around 3-4 financial years. For example the period for the NFI 2010/11 exercise required bodies to extract payments history data, based on invoice dates, from 1st April 2007 to date of extraction (for example, on or near 4 October 2010).

7. In what format should the data be sent?

This is set out in the file format instructions, but data should be in ASCII format if possible. If comma separated value (csv) records are submitted, please ensure that any commas ( , ) appearing within any of the data fields are converted to a pipe ( | ), or other delimiter, and inverted commas ( ) are excluded. If you require any further guidance please contact the technical support team at our Data Centre by calling 0845 345 8019.

8. How should matches to deceased persons be progressed?

All NFI referrals are issued as potential anomalies that warrant careful consideration before action is taken. This is particularly important in the case of the deceased matches where investigators need to be especially sensitive in order to avoid causing upset and distress.

NFI uses advanced techniques to identify exact and almost exact matches (fuzzy matching for example to identify slight misspellings of one element of the name). Although this has proved hugely successful, for example NFI 2008/09 identified 2,163 cases where a pension continued to be paid after the death of the pensioner. Investigators must assess each match carefully before deciding how best to proceed as there is a risk, as with all data matching, that a match relates to different persons. For example:

On pension to deceased person matches, we continue to identify a small number of matches where the pension scheme did not update the National Insurance number when the former employee passed away and they began paying the widow/widower, leading to an NFI match based on the National Insurance number with the former employee.
A miss-keyed date of birth on one record leads to an exact match with a different person.

The suggested guidance for deceased matches (Appendix 2 of the NFI guidelines) suggests that for pension payments to deceased person matches, a death certificate is obtained before any direct action is taken. We accept that this is not likely to be a practical solution for all deceased matches.

Data specification

1. Should I include casual employees in the payroll data download?

If they are still live on the payroll and have a gross pay to date this financial year greater than zero they should be included in the data extraction.

2. What should I enter in the ‘full time/part time indicator’ field on the payroll data specification?

Enter ‘F’ where 30 or more hours per week are worked, ‘P’ where less than 30 hours a week are worked or ‘C’ for casual/as-and-when staff.

3. What should I enter in the ‘standard hours per week’ field on the payroll data specification?

This should contain the hours the employee is contracted, for example, 3750 (= 37.5 contracted hours).

4. What should we put in the ‘creditor type’ field?

If your data submission only contains trade creditors then providing data in this field is not essential. However, populating this field it is important if you submit the different categories of creditor, such as expense claim payments or refunds, as it will enable you to filter the output more easily and focus resources on what you may deem to be the most worthwhile matches.

5. How should I treat matches where the National Insurance number is the same* but the surname and forename of the two individuals are different?

Where a match potentially shows two different people with the same National Insurance number they should not simply be ignored because they appear to relate to different people.

In most cases the match has occurred because of a data quality issue where one of the two matched systems holds the wrong National Insurance number. It is therefore important that you validate the number you hold and, where necessary, take action to correct the details held. It is also important to be aware that, although less likely, these matches may reveal cases of deliberate identity fraud rather than data quality issues.

* – By this we mean the prefix (first 2 characters) and the 6 digits that follow are identical as this combination is allocated uniquely. The suffix (A, B, C or D) has no current relevance at all and exists for historic reasons.

6. How do I treat an employee who has more than one post within the organisation?

There are two possible scenarios that could occur within your payroll system, an employee with:

multiple posts but one employee reference number
multiple posts and multiple employee reference numbers

We would ask that in both cases, you try and amalgamate the records so that you are providing one record per employee. Uploading data which includes more than one line per employee could cause multiple matches to the same individual, increasing investigation time and generating more queries from other participants.

In cases where an employee has more than one position or post but only one employee reference number please amalgamate the records using the employee reference number. This amalgamation should produce aggregated totals for both the gross pay to date and hours worked, if these figures are available. If your organisation has audit software such as IDEA or ACL then this task should be straightforward, we can talk you through this process if required.

If the employee has multiple posts and multiple employee reference numbers you should try and find a unique reference number within the system to identify and link them to provide the data on a one record for one employee basis. If this is not possible then the data should be supplied as it stands.

In the department code field you could include the details of both / all positions which would give the investigator more detail if the employee came back as a match. Otherwise include the department where the employee works for the majority of the time. Use the total gross pay to date (from April ’10) that an employee has been paid by the organisation.

If the employee has more than one recorded bank account, include the bank account where the employee gets paid the majority of their pay.

General

1. I cannot access the NFI web site address (https://www.nfi.gov.uk/2010/login.aspx) (external link), how can I find out where the problem is occurring?

Call the technical helpdesk on 0845 345 8019 and they will be able to tell you if there is a problem with our communications links or hardware and when it is likely to be resolved. There is also an alternative website address for emergency use https://www2.nfi.gov.uk (external link). It does not have as fast a connection as the main site so should only be used in instances where the main website address is unavailable and you urgently need to continue working on the results.

2. Are fair processing notices required for trade creditors?

The data extract is limited to trade creditors and does not include personal data. As a result no data subject notification is required.

3. Why can I not print or export NFI data?

In order to protect the NFI data the matches are released in a secure environment. Because the print and export functions allow a user to take this data outside this secure environment they are initially restricted to Directors of Finance. If the Director of Finance feels these features are necessary to allow the key contact to carry out their NFI work effectively they can grant the print and/or export permissions via User Admin. Once permission is granted the key contact can extend these permissions to other users where required. It may be more appropriate to issue these permissions for specific authorised tasks and remove them once the task has been completed.

It is the responsibility of the Director of Finance and the key contact to control and monitor these permissions. On all occasions the data extracted should be the minimum amount necessary to achieve the intended purpose. It is also important to note that as soon as data is extracted from the secure NFI environment, your normal responsibilities for data security (including avoiding inappropriate disclosure and ensuring the data is irrecoverably destroyed when it is no longer needed) take effect. We would therefore encourage you to remind any user who is granted print and/or export permissions of your relevant policies and procedures.

To assist the Director of Finance and the key contact in monitoring these permissions, management information reports that record the use of the export function have been introduced. Further management information reports, including one listing all users who have these permissions, are in development. These can be accessed via the Management Info link within the left hand menu on the summary screen.