Some of our readers may be aware that Her Majesty’s Revenue & Customs (”HMRC”) has recently been the subject of an external review by Kieran Poynter, senior partner of PriceWaterhouseCoopers, one of the UK’s leading accountancy firms. This was as a result of the fiasco surrounding HMRC’s loss of several data discs in October 2007 containing the entire Child Benefit database. The review has recently been published and its findings and recommendations are sure to make gruesome reading for certain parts of the HMRC machine.

The loss of the discs arose because the National Audit Office (”NAO”) were engaged to conduct an audit of certain data and procedures within HMRC in the context of the administration of child benefits. Three different divisions of HMRC were involved and, inevitably, more senior officials delegated critical tasks downwards to more junior staff. The review found that HMRC’s more junior staff had raised a number of concerns which were missed or glossed over by more senior staff who should have taken responsibility for assisting in NAO’s audit. In essence, the problem arose when a junior member of HMRC staff posted the discs in question to NAO, which were carried by a third party mail delivery service (without tracking information). The discs were never received by NAO until a duplicate set was later requested (which were duly sent and successfully received some days later). The loss of the discs was only reported as a “security incident” some two to three weeks after the first set of discs were sent.

The HMRC management structure was inadequate in the context of the audit, the review found. Furthermore, the security systems for data distribution within HMRC were unclear even to those “on the inside”. Perhaps the most challenging recommendation of the review was that HMRC should move towards a system whereby each individual taxpayer has a separate record of all transactions, records and dealings with HMRC as a whole and that responsibility would rest with individual taxpayers for maintaining their own records. Concerns over fraudulent data-entry by taxpayers must be a concern here given the increased activity of internet hackers in recent years, however, the review goes some way towards dragging HMRC into the 21st century.

Posted: July 28th, 2008 under Corporate Finance.
Comments: none