Preventing and investigating insider risk — our response
Published 15 July 2026
© Crown copyright 2026
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/hmrcs-response-to-report-on-managing-insider-risk/preventing-and-investigating-insider-risk-our-response
HM Revenue and Customs (HMRC) has a zero-tolerance approach to insider threat. Where we find criminal wrongdoing, we take swift and firm action to dismiss and will pursue criminal prosecutions.
HMRC commissioned His Majesty’s Inspectorate of Constabulary and Fire and Rescue Services (HMICFRS) to produce a report on our defences against insider risk. We are grateful for their work and have acted on it: we have substantially completed 20 of the 22 recommendations, and work is underway on a pragmatic and proportionate response to the remaining 2.
The fieldwork took place in January and February 2024, and reflects the position more than two and a half years ago. Every case study in the report had already been identified and dealt with by HMRC, and the details were passed to HMICFRS to support inspection.
HMRC has used the independent inspection as a catalyst to deliver a broader transformation of our insider threat capability — going beyond the inspectorate’s recommendations.
We have invested to develop our security capabilities and resilience as a critical priority. The public can be reassured that we take these matters extremely seriously. Over the last 4 years, we have arrested 32 people within the organisation, along with 55 accomplices and have sought criminal proceedings against them.
Our Board now has a dedicated Security and Resilience sub-Committee to ensure that these issues are assured at the highest level in HMRC’s governance. We’ve also stood up a new Insider Risk Management Service and have brought in leading security experts to help us aspire to industry best practice. This sits alongside new digital systems, changes to HR policies and processes, and more robust employment vetting.
The 110 colleagues in our Internal Investigations team work tirelessly to counter insider risk — and they are supported by HMRC’s security, HR, criminal justice and data specialists. We are further increasing the size of this team to 125 officers.
We know that our people are our greatest asset in mitigating this risk: we require all new starters to complete fraud learning, and we provide accessible internal guidance on how to report concerns. These training packages will now be mandatory for everyone in HMRC, regardless of their role.
No levels of insider threat are ever acceptable, and the public can be confident that HMRC will take swift and firm action whenever we find it. We are an organisation of more than 70,000 people, and our staff work hard every day to support the essential public services that we all rely on. We remain very grateful for their professionalism.
Helen Pickles CBE
Chief People Officer and Director General People and Place
Daljit Rehal CB
Chief Digital and Information Officer