In a warehouse in the Midlands, gowns bought at the height of the pandemic sat unopened for two years before anyone checked whether they were fit to use. By the time inspectors got to them, whatever claim the government might have had to recover the money was gone. That single detail, buried in Tom Hayhoe's final report as Covid Counter-Fraud Commissioner, tells you more about how Britain lost £10.9 billion of public money than any account of ministers and their friends.

The headline figures are already familiar in outline. Some £13.6 billion was spent on personal protective equipment, 38 billion items were bought, and 11 billion of them were never used. Across the full range of pandemic schemes, from furlough to the Bounce Back Loan Scheme, fraud and error totalled £10.9 billion, of which £1.79 billion has been recovered. Roughly £762 million is now judged permanently beyond reach, largely because stock sat unchecked for so long that any legal route to clawing back the cost expired with it.

What matters is where Hayhoe puts the blame. He expressly leaves the accusations of cronyism and the VIP lane to the Covid Inquiry. His report is instead a study in governance, and its conclusion is uncomfortable precisely because it refuses the easier story. The losses did not stem primarily from fraudsters exploiting a crisis, though some did. They stemmed from a government that consciously chose speed over control, built no capacity to check what it was buying, and then failed to build that capacity even once the emergency phase had passed. Fraud controls were weakest, he finds, exactly where they mattered most: in the early design of schemes, when officials were trading off risk against the volume of protection they could get out of the door.

This is where the story stops being a Westminster post-mortem and becomes an NHS problem in real time. The health service is currently making versions of the same trade-off, at pace, across several fronts at once. The rollout of ambient voice technology and AI scribes into clinical settings is proceeding well ahead of the MHRA's regulatory architecture for agentic AI, on the reasonable argument that clinicians need the productivity gain now. The Federated Data Platform, procured under conditions of genuine urgency and genuine controversy, still carries unresolved questions about data governance that were subordinated to delivery timetables. Jim Mackey's accountability drive across a consolidating ICB landscape depends on providers absorbing new financial discipline faster than the systems to monitor it can be built. In each case, the logic is the same one that produced the PPE losses: move first, verify later, and treat the assurance function as something to retrofit once the crisis, or the deadline, has passed.

Hayhoe's recommendations are aimed at exactly this pattern. He wants fraud and error risk built into the Treasury's Managing Public Money guidance as a standing feature of any emergency business case, not an afterthought. He wants a statutory duty on public bodies to embed fraud prevention into scheme design from the outset, with named senior officials accountable for it and automatic reporting of higher-value cases. Additionally, instead of presuming that fundamental financial restrictions can be disregarded until the disaster is resolved, he wants crisis readiness exercises that test if emergency expenditure routes can withstand contact with them.

None of this guarantees the NHS will absorb the lesson. The service has absorbed worse ones before. But the political cost of ignoring it is now higher than it was in 2020, because the public has already watched one government lose nearly £11 billion and call it an accident of circumstance. A second wave of losses, this time in data systems or AI deployment rather than gowns and visors, will not be treated as circumstance. It will be treated as a choice, made in full knowledge of what the last one cost.

The commissioner's report closes, in effect, with a warning dressed as a recommendation: build the controls before the next crisis, not during it. For an NHS leadership already stretched between reform, industrial action and a technology rollout it cannot afford to get wrong, that is not a historical footnote. It is the operating instruction for the next eighteen months.