3.19 The NDA told us it believes its assumptions for the competition may have been incorrect because it did not have comprehensive information about the state of the sites. In March 2017, the NDA's internal audit reported "a risk that the NDA may have paid for work which has been incorrectly reported as completed by the previous contractor". Since the interim internal audit report was published, the NDA has not undertaken any work to establish whether it may have paid for work that was not performed.