Findings labelled a ‘whitewash’ after failing to mention that friend of Boris Johnson moved to US

A £100,000 government grant to a firm run by a US businesswoman embroiled in a conflict of interest row over her close friendship with Boris Johnson was “appropriate”, an inquiry has concluded.

The Government Internal Audit Agency (GIAA) launched a review after it was revealed that Jennifer Arcuri’s company, Hacker House, had been given the cyber-skills grant intended for UK-operating businesses in January even though she and her husband had relocated to California last year.

The report, published on Thursday by the Department for Digital, Culture, Media & Sport, makes no reference to the fact that Arcuri and her business partner husband, Matthew Hickey, live in the US. It was immediately labelled a “whitewash” by Labour’s deputy leader, Tom Watson.

It reveals that Arcuri’s firm was awarded the six-figure sum by the DCMS’s Cyber Skills Immediate Impact Fund despite not meeting requirements that funding not exceed half of the company’s annual income.

The department also released a lengthy application form sent by Arcuri in which she claimed her company aimed to be the “Netflix of security”.

The report discloses that Arcuri’s firm initially applied for £273,000 but was eventually granted £100,000.

Watson said: “This ‘review’ is a complete whitewash. The documents published raise more questions than we had before. No one reading Hacker House’s grant application would give the company a penny, let alone £100,000 of taxpayers’ money.

“The fundamental question of why Hacker House was ever given this grant remains unanswered. The public deserve to know why their money was handled so irresponsibly. We will not let this lie.”

The government’s digital minister, Matt Warman, told MPs in September that £53,000 of the grant had yet to be paid to the company and would be frozen until the review was completed. The DCMS was unable to confirm on Thursday evening whether it would be paying the remaining funds.

Arcuri’s friendship with the prime minister has been closely scrutinised in recent weeks following revelations that another business she ran received more than £26,000 in public money while Johnson was London mayor.

The report sheds light on how Hacker House received the money despite not meeting application requirements. It says the company’s application recorded its annual income as £0, adding: “This figure was found to be inaccurate, as bank statements submitted with the application provided evidence of income during the previous financial year. However, the level of annual income was still less than the gateway requirement.”

It adds: “GIAA concludes the assessment of eligibility and subsequent reduced grant award to Hacker House Ltd was appropriate. It did however observe areas where questions on the grant application form would have benefitted from being clearer eg defining ‘limited trading history’ ... and a breakdown of the roles of staff employed by the lead organisation.”

In her application form explaining what her firm intended to use the funds for, Arcuri wrote that she wanted the cash to fund her “hands-on hacking” course “to build out the ‘Netflix of security’”.

In September, after it emerged that Hacker House was facing an investigation over its eligibility for the grant, the Guardian discovered that the company had hastily set up a new “virtual” office in London.

A minister’s claim that the department had done “usual due diligence” on the firm, which he said had a British phone number, was undermined when the Guardian rang it only to get through to a woman in the US.

Although the GIAA report makes no reference to questions raised over Arcuri and her husband’s presence in the US, the DCMS released a letter from the department’s minister, Nicky Morgan, in which she sought to downplay concerns.

Writing to the DCMS select committee chair, Damian Collins, she said the guidance for the award stated that initiatives must be “carried out in England”, adding: “Nothing in the application form, the guidance to applicants or the grant agreement requires a grantee to have and maintain a corporate presence in the UK.”

A DCMS spokesman said: “An independent review has concluded the eligibility and subsequent grant award to Hacker House Ltd was appropriate. Companies House records show Hacker House had a registered UK address when the grant was awarded and this was verified by the DCMS as part of the application process. The conditions of the grant were clear that initiatives must be carried out in England and this was the case with the Hacker House award.”