The NHS Counter Fraud Authority (NHS CFA) has reported an increased number of allegations relating to falsifying timesheets and expenses. The allegations involve temporary staffing (agency or bank) and potential collusion between the line manager and the worker.

Timesheet fraud occurs when an employee falsifies a timesheet of hours worked for the purposes of receiving a financial gain. Expense claims can be falsified by an employee to obtain additional payments at the expense of the organisation. The risk of an organisation processing a falsified timesheet/expense claim increases when the necessary controls are lacking, or policies and procedures are not adhered to.

The NHS CFA has seen an increase in incidents of timesheet fraud where agency staff do not complete their own timesheets. They are completed by their employing agency instead and sent to the NHS organisation for payment. The risk of fraud is heightened when there is no oversight or supervision on the processing of timesheets and there is no ability to reconcile the hours invoiced against the hours worked.

The NHS CFA has also received a report of potential collusion between a line manager and employee, where an informal agreement is entered for a falsified timesheet that is submitted and authorised by the line manager for days not worked. In addition, the NHS CFA has seen an increase in expense claims being made by agency staff who often circumnavigate the usual approval procedures as they have limited access to an NHS organisation’s internal expense programmes. Paper expense claims may come directly from the agency with no counter fraud declaration/evidence of expenses incurred, and an ad-hoc approval process is often undertaken.

Prevention Advice

The NHS CFA recommend that organisations consider the following controls:

  • Access to timesheet and expense systems should be secure, auditable, and where possible, apply Multi-Factor Authentication (MFA).
  • Timesheets and expense claims must only be completed and submitted by the contractor/employee.
  • Timesheets and expense systems must include a suitable counter fraud declaration and is signed by the employee and the authoriser.
  • Verification checks should be undertaken by the authoriser, to ensure all timesheet claim forms submitted are from the correct individual, the hours claimed are correct, include all the correct information with no gaps, and the declaration is signed by both the staff member and the authoriser. Incomplete and ineligible timesheets should not be processed and returned to the employee.
  • Timesheets for agency staff should be designed to include the hours and location worked, deduction of mandatory breaks, the shift type (e.g. is it a shift that attracts a higher payment such as resident/non-resident on-call) and stipulate who the approving manager is within the NHS organisation and the agency.
  • Where timesheets/expense claim forms are paper based, extra caution should be taken as these claims carry a higher risk of fraud. Completed forms should be clear and not overwritten. The authoriser should block out fields not completed on paper forms to avoid any amendments being made. Any amendments that need to be made to claims should be initialled by the authorising signatory.
  • All paper-based timesheets/expense claims completed by agency staff should be recorded on the organisations systems once approved to avoid manipulation by the individual. These timesheet/expense claims should then be reconciled against the invoice received from the agency.
  • Organisations should ensure that an authorised signatory list is kept up to date and the list is cross-referenced against those authorising timesheets.
  • All paper and electronic records relating to shift patterns, e.g. allocation sheets, are completed and used to reconcile which patients the worker was assigned to, and that the claimed hours worked are accurate.
  • Record employees’ whereabouts adequately through the use of shared calendars or a central record to allow line managers to have knowledge of employees’ whereabouts. Not only does this adhere to safeguarding purposes but also mitigates potential fraud with employees falsifying timesheets and expense claims.
  • There should be clear policies and procedures in place for the completion, submission, and authorisation of timesheets and/or overtime claim forms for agency/bank employees, as well as under special circumstances, i.e. maternity leave, on-call, or unsociable hours to avoid any overpayments.
  • All expense claims must only be submitted in accordance with organisational policy. Expense claims should be scrutinised and should, where appropriate, include legitimate proof of purchase. Authorisers should reject expense claims if organisational policy has not been followed or there are suspicions of fraudulent activity.
Action Required

NHS organisations should ensure a robust policy/Standard Operating Procedure is in place in relation to approving all timesheet and expense claims.

As a minimum, an organisational policy should stipulate that timesheets/expense claims have a counter fraud declaration and this is completed and submitted by the employee, and not their employing agency (for agency staff).

Staff who manage agency staff should receive adequate counter fraud training to outline the risks associated with false timesheets and expense claims to ensure there is a consistent approach in the management of timesheets and expenses.

Guidance

The NHS CFA has further guidance available at: Payroll Fraud

For further discussion and support, including fraud awareness training, contact: Tony Hall, Senior Anti-Crime Manager, email: fraud@tiaa.co.uk