Mr. Seamus McCarthy:

Generally, if there is an incident like this, we will draw it to the committee's attention, and we have done so over the years. In the case of the university, I think the first set of lessons that have to be learned are within the institution as to what specific control weaknesses could have occurred that created an opportunity for this. There is also an important systemic learning. For instance, supplier fraud is something that we have come across, and we have attempted to alert others. We have written to public sector organisations telling them to be aware that this is a risk, outlining what it looks like and the things they need to do in order to mitigate any such risk.

One of the things that was happening was that public sector organisations were being contacted using what looked like official headed notepaper. The message purported to be from a service provider which was changing its bank account. It gave the details of a new bank account and payments were processed without an additional check being done. That is how a fraud has occurred in a number of situations.