Backlogs have nearly tripled, and DWP still cannot show the scheme delivers value for money

The National Audit Office's investigation into the Department for Work & Pensions' Access to Work scheme finds a programme growing faster than DWP's ability to run it. DWP itself accepts it cannot show whether the scheme delivers value for money, and its own loosely defined guidance has let award decisions drift from policy intent - a gap DWP is only now trying to close through staff training. Rising demand has driven processing times and backlogs well past DWP's own targets, and DWP does not expect them to fall significantly without policy change; the case data needed to diagnose where the process breaks down are not robust enough to support that analysis. Efficiency measures introduced to speed decisions have knowingly traded away some of the evidence base that kept awards aligned with policy, and a fast-growing volume of reconsiderations is consuming capacity that might otherwise reduce the backlog. Even after more than doubling staff numbers and spending, case-manager productivity has fallen short of DWP's own standard since 2023.

The Access to Work scheme

UK 2026: Support to people with disabilities

Priorities are set, but the police cannot show they are followed through

The Netherlands Court of Audit built a Crime Harm Index (CHI) to test whether police investigation priorities actually target the crimes causing the greatest societal harm. They only partly do: over 10,000 reports of CHI-serious crime went unprocessed in 2024, including 1,600 that had themselves been prioritised by the Public Prosecution Service or the minister. Underneath this sits a Documentation failure - registration systems cannot trace whether investigation results align with stated priorities - and a Reporting gap so complete that neither the minister nor the police commissioner can say what is spent on each of the police's statutory tasks.

A serious Case: Police priorities in criminal investigations

NL 2026: Internal affairs

DOD's Real Property Blind Spot: Inconsistent Data, No Risk Guidance

GAO's review of DOD's oversight of underutilized and excess real property (GAO-25-106132) found that the military services measure and report facility utilization inconsistently — the Army has entered either 0% or 100% utilization for every property since fiscal year 2020, while the Navy and Marine Corps instead average rates across groups of similar facilities — and that DOD has not held the services accountable for following its own 2016 utilization guidance. Beyond the data problem, installations report making costly renovation, mothballing and demolition decisions without any detailed guidance on how to weigh sustainment, use and disposal risk: historic buildings such as those at Fort Bliss must be kept in usable condition even when vacant, and the Navy's roughly $700 million demolition backlog continues to grow for want of dedicated funding. GAO is making five recommendations to close these data and guidance gaps; DOD generally concurred.

DOD Real Property: Actions Needed to Improve Oversight of Underutilized and Excess Facilities

US 2025: Maintenance of infrastructure

Broadband rollout stalls as operators walk away

NIK's audit of Poland's FERC broadband programme (P/25/006) found that within two years of launch, nearly half of the telecom operators originally approved for funding had withdrawn from their projects, forcing the managing authority CPPC to cut the programme's EU allocation by 59%. Even among operators still active, disbursement and construction progress lag far behind the contracted schedule: only 5.9% of funds had been paid out and under a tenth of the planned network built by the audit date. NIK traced part of the shortfall to address-point eligibility data that CPPC does not itself own but should have flagged as unreliable, and noted that a near-identical data-quality recommendation from its own 2023 audit of the predecessor programme remains unimplemented — pointing to a recurring weakness in how change and follow-up on prior findings are managed, not a one-off.

Ensuring universal access to broadband internet under the Digital Poland Development Funds programme (FERC), Action 1.1

PL 2025: Key investment

Stable portfolio, concentrated risk

The GAO's 18th annual review of NASA's major projects finds a portfolio of 36 projects, worth at least $70 billion in life-cycle costs, that is broadly under control: only 4 of 18 projects in development reported new cost or schedule overruns this year. That aggregate stability, however, conceals two concentrated sources of risk that dominate the individual case findings below — a wholesale restructuring of the Artemis lunar-return architecture triggered by a December 2025 executive order, which is forcing simultaneous re-design across half a dozen interdependent projects; and a 22 percent cut to NASA's civil-servant workforce in 2025, whose effects on specific projects are only now surfacing. A handful of individual project assessments — Commercial Crew's Starliner anomaly, Dragonfly's power-source shortfall, Mars Sample Return's cancellation — further illustrate internal-control weaknesses that cut across the categories of guid_ICS-AuditingIC.xml.

NASA Assessments of Major Projects

US 2026: Innovation

Key governance issues arise in MEGA-Projects

The British NAO's report highlights critical shortcomings in governance and decision-making processes affecting mega-projects across government. It identifies recurring issues that hinder effective management, emphasizing the need for improved governance frameworks to enhance accountability and strategic oversight. Key findings indicate that these weaknesses not only threaten project success but also result in significant financial and operational inefficiencies, necessitating immediate attention from policymakers to ensure better outcomes in future endeavors.

Lessons learned: Governance and decision‑making on mega‑projects

UK 2025: Project management

SATCOM transition faces reporting gaps

The GAO reports covers many interesting remarks concerning satellite communication under Department of Defense (DOD). The gist of their audit is, however, need for quality systemic control over communication between Government and Lawmaker.

DOD SATELLITE COMMUNICATIONS: Reporting on Progress Needed to Provide Insight on New Approach

US 2025: Public e-services

Drinking water management faces strategic and data gaps

The Netherlands Court of Audit has conducted an extensive audit addressing the critical issue of drinking water security, highlighting that the current policy results concerning drinking water savings are deemed worrying. The audit underscores the urgency of implementing effective measures, as societal pressures and the risk of water shortages necessitate a sustainable approach to water management. The findings emphasize that substantial efforts are required to maintain the quality and availability of drinking water, reflecting the need for comprehensive strategies and actions from the Ministry of Infrastructure and Water Management to ensure future resilience and security in drinking water supply.

Drinking water under pressure

NL 2025: Public e-services

Sharing information on cyber threats to critical infrastructure

This report examines, how US federal agencies, and critical infrastructure owners and operators share cyber threat information. The GAO auditors found that the threat sharing challenges have not been fully resolved. Causes of problems were found in: resources, guidance, communication, access policies, process design.

National Cybersecurity Strategy Needs to Address Information Sharing Performance Measures and Methods

US 2023: Information security

Government faces critical cybersecurity challenges ahead

The UK National Audit Office's report highlights a pressing need for government departments to enhance their governance, accountability, and reporting arrangements concerning cyber risk. It emphasizes that to effectively mitigate threats, departments must rigorously assess their compliance with the cyber security standards. The findings reveal that significant progress is required to achieve a resilient cyber posture, ensuring robust protection against persistent and evolving cyber threats.

Government cyber resilience

UK 2025: Information security

Coordination of Information Protecting system

The UK National Audit Office noticed that in recent years, cuts to departmental budgets and staff numbers, and increasing demands from citizens for online public services, have changed the way government collects, stores and manages information. Concurrently, the threat of electronic data loss from cyber crime, espionage and accidental disclosure has risen considerably. The NAO’s audit results in emphasising role of the whole system coordination.

Protecting information across government

UK 2016: Information security

Who’s there? - Establishing identity at government agencies

The Swedish NAO auditors examined system of establishing the identity of individuals entering Sweden. The audit report highlights a need for stronger expertise, clearer responsibilities, and improved use of biometric data to ensure accurate and unique identity verification

Who’s there? - Establishing identity at government agencies

SE 2024: Public e-services

AI and security of critical infrastructure

The US GAO has reported significant shortcomings in the current AI risk assessments conducted across critical infrastructure sectors. Key findings reveal that while sector risk management agencies have identified some AI use cases and potential risks, the majority failed to adequately assess the likelihood of threats exploiting vulnerabilities and did not fully evaluate the level of risk. This highlights an urgent need for improved guidance and methodologies to enhance the robustness of risk assessments related to artificial intelligence in critical infrastructure.

ARTIFICIAL INTELLIGENCE: DHS Needs to Improve Risk Assessment Guidance for Critical Infrastructure Sectors

US 2025: Public e-services

Preparing to AI requires time

The British NAO covered strategy and governance, use of artificial intelligence in government and future opportunities. The auditors considered also support for adopting and scaling AI. They point out fundamental areas to exploiting AI opportunities: “updating legacy systems and improving data quality and access”. NAO noticed at the same time that it will take time to implement.

Use of artificial intelligence in government

UK 2024: Artificial intelligence

Urgent reforms needed for troubled IT investments

The US GAO highlights significant challenges in federal IT acquisition and management, underscoring that over $100 billion invested annually often fails to deliver timely capabilities, incurs cost overruns, and lacks effective management. Despite substantial investments aimed at maintaining and developing critical systems, many projects fall short on mission-related outcomes due to deficiencies in project planning, requirements definition, and oversight, necessitating urgent reforms to enhance accountability and performance in federal IT initiatives.

Critical Actions Needed to Urgently Address IT Acquisition and Management Challenges

US 2025: Public e-services

Unclarities make task harder

The Swedish NAO audited Commission focusing on integrity across law enforcement agencies. Among findings were: lack of clarity on the administrative support it receives and a risk of tasks unbalanced with capacities.

Oversight of law enforcement agencies - An audit of the Swedish Commission on Security and IntegrityProtection

SE 2016: Professional integrity

Help, measure and analize

US GAO reviewed Early Hearing Detection and Intervention (EHDI) program and discovered that although there is evidence supporting its effectiveness, some children in need may not have appropriate access to them. The audit findings show among others that measurement of the program performance requires improvement, as well as analysis of its results.

HEARING DETECTION AND INTERVENTION: Program Connects Deaf or Hard of Hearing Infants and Children to Services, but Actions Needed to Improve Access

US 2025: Public e-services

Incomplete implementation

The SAI Kosovo audit covered digitizing the management of pharmaceutical stock in healthcare institutions to supply medicines and disposable materials to patients from essential and non-essential lists. It was revealed that the system was not fully implemented in all healthcare units, like pharmacies in hospital wards and clinics, as well as Family Medicine Centers. This has led to inadequate management of pharmaceutical stock, lack of proper planning, and inefficient use of medicines and medical supplies.

Pharmaceutical Stock Information Management System

KS 2024: Public e-services

Cyber security of critical water structures not watertight

Dutch SAI examined the way in which the Directorate-General for Public Works and Water Management are prepared to deal with cyber threats to critical water structures. The audit analyses what scenarios and tools can be applied to detect cyber threats and protect water structures against cyber attacks. It also reviews if the tools for detecting cyber threats and attacks are effective and whether they offer sufficient protection.

Strengthening the digital defences: the cyber security and critical water structures

NL 2019: Information security

Ransomware - significant security challenge to critical infrastructure

The US GAO report describes the impact of ransomware attacks on the nation's critical infrastructure, assesses federal agencies' efforts to implement best practices across sectors, and analyzes their actions to evaluate ransomware risks and the effectiveness of support. To achieve this, US GAO examined four critical infrastructure sectors.

CRITICAL INFRASTRUCTURE PROTECTION: Agencies Need to Enhance Oversight of Ransomware Practices and Assess Federal Support

US 2024: Information security

Secondary occupations examined

Additional transfer of knowledge takes often place through the secondary occupations of professors and other scientific employees. The Swiss Federal Audit Office (SFAO) examined whether the sufficient measures had been taken to prevent financial or reputational damage. In addition, the SFAO assessed whether the applicable rules allow for sufficient knowledge transfer.

Cross-sectional audit of secondary occupations with a focus on conflicts of interest

CH 2023: Professional integrity

The water sector faces increasing cybersecurity-related risks

US GAO reviewed cybersecurity threats facing the water sector and the federal government’s efforts to address these threats. Auditors found out problems including: funding prioritization, incident reporting, sector-wide risk assessment and vulnerability self-assessment tool.

CRITICAL INFRASTRUCTURE PROTECTION: EPA Urgently Needs a Strategy to Address Cybersecurity Risks to Water and Wastewater Systems

US 2024: Information security

Avoiding conflicts of interest requires more attention from Finansinspektionen

The overall conclusion of the Swedish NAO is that Finansinspektionen needs to do more to combat the risk of conflicts of interest. The authority has the most important tools in place in the form of rules, guidelines and work processes, but needs to increase its efforts in order for them to be applied as intended and with the desired results.

Finansinspektionen’s work to combat conflicts of interest

SE 2020: Professional integrity

Infrastructure Upgrade On Track

The Swiss Federal Audit Office’s recent review of the Polycom Value Preservation 2030 project highlights effective management and coordination by the Federal Office for Customs and Border Security. Despite the rapid technological transition, the project remains on track for completion by the end of 2024, with dismantling expected by the end of 2025. This audit underscores the project’s robust planning and execution, ensuring Switzerland’s security radio system is up-to-date and reliable.

Audit of the DTI key project Polycom Value Preservation 2030 with a focus on the border security subnetwork

CH 2024: Public e-services

Cyberincident reporting needs to be quicker

The Swiss Federal Audit Office reviewed the effectiveness of the cyberinicident management process. In particular, the audit focused on issues relating to the timely flow of information from the sources to the Center, and on the processing this information with the Centre's own monitoring results. In addition, the detection of cyberincidents and the timely implementation of measures, as well as the flow of information to the relevant units, was assessed.

Audit of the effectiveness of incident management in protecting federal ICT from cyber-risks

CH 2022: Information security

Be prepared for breakdowns

Danish NAO underlines that public authorities depend on IT to deliver their services. Thus, major IT problems and loss of data relating to critical IT systems can have far-reaching consequences for the government, citizens and companies. The audit focused on IT contingency plans, secure continuity of operations and mitigation of the consequences of system breakdowns or data losses in the event of major IT breakdowns.

Cyber security resilience of the Danish public sector II

DK 2023: Information security

Upgrade or decommission

Servers are essential part of IT infrastructure. At the same time, they are vulnerable to cyberattacks, because they can be exploited by hackers to gain unauthorized access to the system and steal sensitive information, corrupt data, or cause systems to malfunction. Once the security of a server is compromised, attackers can gain access to other computers and servers across the network. Danish auditors paid attention to risky stages of servers lifecycle.

Security of servers managed by the Danish Agency for Governmental IT Services

DK 2023: Information security

Completing leadership and oversight requirements

GAO continues to review and report status of information security - the high-risk area for more than 25 years already. Special focus is on federal cybersecurity challenges.

CYBERSECURITY: Implementation of Executive Order Requirements Is Essential to Address Key Actions

US 2024: Information security

Sometimes it is really not about the money…

Informatisation of healthcare is one of the most money-consuming IT activities of the State. Polish NIK shows how a poor concept can delay modernization of hospitals. The new IT system was expected to take some burden off doctors, streamline medical care, prevent fraud and improve efficiency. But will it be created at all?

Informatization of hospitals

PL 2013: Public e-services

Demistify the Algorithms!

The Netherlands Court of Audit applied their audit framework to algorithms used by the Dutch Government. They point at the salient issues like: lack of clear requirements, risk of anomalies produced, insufficient documentation and thus transparency, need for more privacy guarantees. What more, the Dutch colleagues provide their audit framework as an appendice. (The CUBE web page re-edited in line with the up-to-date format).

Understanding algorithms - 2021

NL 2021: Artificial intelligence

Generative AI in Brief

The GAO’s Q&A Report to Congressional Requesters provides readers with a helpful “overview of how generative AI works, how it differs from other kinds of AI” – adding examples of its use across various industries.

Artificial Intelligence: Generative AI Technologies and Their Commercial Applications

US 2024: Artificial intelligence

Balance needed for success of Information Society Development Plan

Access to useful information, true suppervision and measurement of progress are listed by the Estonian SAI as key elements necessary to keep balanced development of strategy for Information Society.

Use of European Union funds in promoting information society

EE 2012: Public e-services

Development of eServices requires constant care

The Lithuanian SAI found that some electronic services provided by public institutions are unavailable through the E-Government Gateway portal. Institutions do not perform evaluations of the suitability of public and administrative electronic services for users and do not identify the needs for changes in the service provision process.

Management of digitalization of public and administrative services

LT 2023: Public e-services

Enhanced Information Security Needed for National Database

Does database access management ensure that only authorised individuals can access data? The report provides insights into the implementation of access management practices regarding public administration databases in Estonia. The document emphasizes the importance of establishing robust information security processes, including risk assessment, access management, data protection, incident response, security monitoring, and compliance management, to safeguard sensitive data and IT resources from unauthorized access and security breaches.

Database access management

EE 2023: Public e-services

Effective use of the official electronic address

The eAddress solution was designed and the laws and regulations were approved to stipulate its operating principles, but the implementation of the solution caused difficulties by resulting in the non achieved goals of the eAddress. The eAddress aims at providing official electronic communication between the state and an individual; which is not achieved as individuals rarely use it. The eAddress solution is new and unknown, and other, more familiar channels are available for electronic communication with the state. The principles of eAddress (security, guaranteed delivery, and convenience) do not ensure sufficient motivation to change existing communication habits.

Does the country ensure effective use of the official electronic address in communication with individuals and businesses?

LV 2021: Public e-services

Comprehensive review of Public Key Infrastructure

Public Key Infrastructure (PKI) is understood here as a set of technologies, policies, and procedures used to manage digital certificates and public-private key pairs. Although the Swiss public key infrastructure related service achieved a high level of security, there are still areas for improvement such as system monitoring, log management, and decision-making processes. In addition, there are areas where transparency and coordination can be increased, such as in change, release, and life-cycle management. Finally, the costs and risks associated with transitioning to a commercially provided PKI should be considered

Examination of development and operation of the public key infrastructure

CH 2023: Public e-services

Meet requirements of own framework

The ANAO noticed that despite the importance of cyber security in safeguarding the Australian Government’s digital information, there has been ongoing low levels of cyber resilience of non-corporate entities and weaknesses in the regulatory framework for ensuring compliance with mandatory cyber security strategies. The audit focused on: cybersecurity risk management, application of related norms and level of a culture of cyber security resilience.

Cyber Resilience of Government Business Enterprises and Corporate Commonwealth Entities

AU 2019: Information security

Coordination and budget

The SAI Finland investigated whether cyber protection in central government had been arranged as effectively and cost-efficiently as possible. In their opinion, the rise of concern is required in operating modelling, design of procedures and change management approach.

Cyber protection arrangements

FI 2017: Information security

Consistency on strategic level

The Swedish NAO audited whether the Government’s efforts to strengthen national information and cyber security had been efficient. The audit’s focused on problems related to: strategy, coordination and international best practices.

Government control of national information and cyber security – both urgent and important

SE 2023: Information security

Implementation difficulties

SAI of Bosnia and Herzegovina emphasizes the importance of developing a response system to avoid serious threats to cyber security, such as unauthorized access to information, lost working hours and increased costs for information system recovery, delays in performing tasks within one's competence, loss of trust, and damage to the institution's reputation.

Activities of BiH institutions to ensure the basic assumptions for cyber security

BH 2022: Information security

Civil register needs safety guarantee

The procedure by which a government keeps track of its inhabitants' life events - such as births, marriages, and deaths - is known as civil registration. Its primary goal is creation of legally required personal documents. NAO of Kosovo found that apart from continuous development, operator of the civil registry should improve its IT governance, information security and application controls.

Civil Status Information System in the Civil Registry Agency

KS 2023: Information security

ASSURANCE NEEDED TO SECURE INFORMATION

The Lithuanian SAI audit covered a range of key topics regarding the national cybersecurity: risk management, planning, incidents management, and legal regulation of cyber security and electronic information security.

Cyber Security Assurance

LT 2022: Information security

Manage access to the receipt of e-services

The requirements for the attainable level of accessibility for the integrated national IS, state integrator and e-services have been set in regulations, but it is not clear what and how to measure and there is no calculation methodology either. Auditors did not get an unequivocal answer because the information provided by the institutions about the level of access to information systems and e-services was mostly based on opinions, not facts. Institutions understand the IS accessibility achieved in different ways, as they do not measure anything and do not even highlight IS accessibility as a necessity, they only measure the accessibility of databases (which is one of the components for IS and e-service to function), interpret IS security incidents in different ways.

Can we rely on the access to IS and the receipt of e-services?

LV 2022: Public e-services