Examination of Witnesses (Questions 180-199)
MR DAVE
HARTNETT CB AND
MR NICK
LODGE
17 DECEMBER 2007
Q180 Phil Wilson: Precisely.
Sir John Bourn: I can respond
to that because we had a full search by the Metropolitan Police
and they looked in every desk and every cupboard and they did
not find it, so I can provide that reassurance.
Q181 Phil Wilson: So has every other
department. We do not know where it is at because it is lost.
Expected routes in paragraph seven: "On the same day we conducted
a further search following the expected route of delivery ...
" Because it is lost did you also look at the unexpected
routes of delivery?
Sir John Bourn: We did our best
to search everywhere it might be and the Metropolitan Police came
and repeated that in even more professional detail than we could.
Q182 Geraldine Smith: Can I ask about
the Process Owner of the Child Benefit. What was her job? What
were her responsibilities?
Mr Hartnett: When we set up HMRC
we created a role of Process Owner for all our main lines of benefit
and Tax Credit business. We wanted them to own the end-to-end
process, to be influential in the Department around that process
and to identify opportunities to improve the process but they
owned the process by which we paid Child Benefit.
Q183 Geraldine Smith: The National
Audit Office, when you were asking for the information you asked
a junior official, a junior civil servant, is that right?
Sir John Bourn: We asked for the
information from HMRC, as I said.
Q184 Geraldine Smith: Were you aware
that you were dealing with a very junior person within HMRC?
Miss Mawhood: We went through
what we understood to be the designated contacts for this information.
Q185 Geraldine Smith: So you thought
that the person you should have been going through was a very
junior official there?
Miss Mawhood: We were given an
individual to contact for the data scan. I do not know if that
individual was junior or not, that was the individual we understood
and were told we should be in contact with for that information.
Q186 Geraldine Smith: Who told you
that?
Miss Mawhood: It was the arrangements
with the individuals in the Child Benefit office who we dealt
with.
Q187 Geraldine Smith: Right. So they
will have been fairly senior people you would deal with who would
tell you who to contact?
Miss Mawhood: I do not know the
precise detail along those lines but Mr Hartnett is saying the
detail of this will come out in Mr Poynter's review. My understanding
at this point in time is that we were given the designated contact
in the Child Benefit office in Washington and that was who we
approached about this information.
Q188 Geraldine Smith: It just seems
very peculiar to me that the National Audit Office is dealing
with junior officials for what is very important information.
It also appears very strange to me that junior officials have
access by themselves to just put this information in the post
without any sort of check. I guess my question to you would be,
why could one person do this? Why was there not even the check
of a second person having to make sure the item was sent correctly?
Mr Hartnett: I think, Miss Smith,
there are two things to say. Maybe I can help Miss Mawhood here.
We did provide a point of contact for the NAO which involved people
who had access to the data in the secure room on the secure computer,
but at no stage that I have seen, or my colleagues behind me have
seen, in that process certainly in March was it envisaged that
the data would be handed to someone to take out of the organisation
and then sent out in October. Our rules say very clearly that
with sensitive material and sensitive data there needs to be authorisation,
and none was sought. These go back to the issues Mrs Browning
was raising, are there cultural or managerial issues that we need
to look at and we are going to be looking at.
Q189 Geraldine Smith: Would the National
Audit Office usually obtain this information on site? Would they
usually come to you to get that information?
Mr Hartnett: My expectation, but
it is only my expectation, all the evidence is not there yet,
is the audit should have been carried out on site and sensitive
information like that should not have been taken away. I have
been reminded from behind of something that is actually quite
important, and that is we had agreed liaison arrangements and
the individual who was asked to send the disks was not on the
list of people provided for those liaison arrangements and the
liaison point was not copied into the emails. I am going too far
into Mr Poynter's work here. Those are issues Mr Poynter and,
indeed, Sir John are going to examine.
Q190 Chairman: You were speaking
very softly, can you just repeat that?
Mr Hartnett: I am sorry, Chairman,
I am not usually accused of that.
Q191 Chairman: Can you just repeat
that?
Mr Hartnett: There were agreed
liaison arrangements in documents that set up the audit. The person
asked to send the disks in October was not on the list of people
in the liaison arrangements and it is my understanding that the
liaison point was not copied into the emails. As I said, I am
trespassing on Sir John's work and I am trespassing on the work
of Mr Poynter.
Chairman: That is an important point.
Q192 Geraldine Smith: It is fair
to say that the National Audit Office should not have been dealing
with that person then?
Mr Hartnett: I cannot say, Miss
Smith.
Q193 Geraldine Smith: You may not
be able to but I can.
Mr Hartnett: I need to say in
response I want all the evidence. I am desperate to see the evidence
in this because I want to know what HMRC has got to do going forward.
There are a lot of things we have already done but there may be
more we have to do and because we have not been able to conclude
our inquiry we do not yet know.
Q194 Geraldine Smith: Why did you
not come to the site? Why was that information requested to be
sent? The only thing on this email says: "Please could you
ensure that the CDs are delivered to the National Audit Office
as safely as possible due to their content". You were aware
that there was a real issue about security and how important that
information was. Why did you not just come and get it and do it
on site as you would normally do?
Sir John Bourn: Information needs
to be available in various ways, electronically and by direct
inspection. All circumstances of this, as we have said, we will
be glad to examine with Mr Poynter. As Miss Mawhood has said,
we went to the person who had been drawn to our attention as someone
who could respond to this. We went to that person, we made the
request and a response was received. We did not get the response,
"You must come and see it on site". If we had that response
we would certainly have taken it very seriously. We followed the
procedures—procedures may be too strong a word—the
understandings that were present and we followed them on this
occasion as we had followed them in the past. As I say, we were
happy to look at whether there should be other ways of carrying
out this work but what we did was to ask for what we had a right
to ask for, we asked for it from the person who had been drawn
to our attention and our request was accepted without demur.
Q195 Geraldine Smith: Mr Hartnett,
a junior official was able to copy this information and just send
it through the post. How many other junior officials would have
been able to do that and had access to that information or, indeed,
how many people?
Mr Hartnett: At least two more,
and I do not know whether there are two more on top of that as
I sit here, so I do not want to give you an assurance, but I know
it is no more than five. That is the lot.
Q196 Geraldine Smith: They could
do that individually without having to rely on anyone else?
Mr Hartnett: No. Only three staff
had access to the secure room and access to the secure computer.
One of the questions that I need an answer to is how did those
staff use the two IT people who supported them. I am absolutely
confident that it is three people, it is unlikely to be five,
but I want to be absolutely precise before I give you an assurance.
Q197 Geraldine Smith: Have you any
idea where the disks are?
Mr Hartnett: I find it incredibly
hard to be even mildly whimsical about this at the minute. It
has been suggested that they are in interesting places like the
Palace of Westminster and Buckingham Palace. I do not know where
the disks are; I really wish I did.
Chairman: Well, I have not got them anyway!
Mr Bacon: They are not on eBay, have
you checked?
Q198 Mr Williams: Can I just come
to the NAO for a moment. When you contacted the Department on
13 March, who did you contact? Was it the same junior official
because someone provided you with information at that stage? Was
it the same junior official on 13 March who was asked to provide
the information at that stage?
Miss Mawhood: The email of 13
March was to the junior business manager, the request for information.
Q199 Mr Williams: Was that the person
we are talking about? Was it the same person on both occasions?
On 13 March was it the same individual you contacted?
Miss Mawhood: No, the individual
had changed by October and we had been given another designated
contact for the October.
| 
