The Department did not give the risk of fraud appropriate priority, and it is likely that the known levels of fraud are a significant under-statement of the true level of fraud. No single organisation has overall responsibility for preventing and detecting fraud on ECO4 and GBIS. The Department did not carry out a fraud risk assessment during the design of ECO4 and the ownership of some known fraud risks was agreed only in October 2025. Ofgem’s role in relation to fraud is limited to progressing counter-fraud investigations where allegations have been made. Yet no organisation is responsible for pro-actively looking for fraud, nor holds all the data it would require to do so effectively. Ofgem has identified installations worth 1.75% of the scheme value as fraudulent but, given the above, we suspect the true level of fraud to be much higher and above the Departments tolerance threshold of 2%. If the Department had paid more attention to preventing and detecting fraud, it would likely have avoided some of the poor quality installations too. We suggest that the Serious Fraud Office should look at this case. recommendation a. Given the likely role of fraud in the poor quality installations, the Department should refer the issue to the Serious Fraud Office to investigate the extent of fraud across ECO and bring criminals to justice. b. HM Treasury should extend its requirement in Managing Public Money for a Fraud Risk Assessment on all new major areas of public spend to include levy-funded schemes instigated by the government, such as ECO. c. In future schemes, the Department should ensure that one body is responsible for fraud prevention and detection at the system level, enabled by counter-fraud activities of and data from other organisations in the system. d. HM Treasury should amend its guidance in Managing Public Money to recommend public bodies design fraud out of all new schemes as far as is sensible, and have one body responsible for fraud prevention and detecti