HSE Audit and Risk Committee Meeting Minutes 10 February 2022

Members Present

Mr. Brendan Lenihan (Vice Chair), Mr. Fergus Finlay, Mr. Pat Kirwan, Mr. Colm Campbell, Mr. Martin Pitt.

Apologies

Ms Ann Markey

HSE Executive Attendance: Mr. Stephen Mulvany (CFO), Dr Geraldine Smith (ND Internal Audit), Ms. Mairead Dolan (ACFO), Ms Niamh Drew (Secretary), Mr Jaymie Crone.

Joined the meeting

Item 2 Mr Barrie O’Connell (KPMG), Ms Maria Diver (KPMG) Item 4 Mr Tom Malone (AND Internal Audit) Item 5 Mr Jim Curran, (ND Estates), Mr Mark Kane, (AND Estates) Mr Vincent Jordan (Delivery Director Acutes), Prof Richard Greene (Chief Clinical Information Officer), Mr Liam Woods (ND Acute Operations), Mr John Swords (ND procurement), Mr Kilian McGrane (National Programme Director, National Women and Infants Health Programme). Mr Michael Redmond (Deputy CIO), Mr John McQuillan (Programme Manager for MedLIS) Item 6 Mr Michael Redmond (Deputy CIO), Ms Helen Coughlan (Chief Technology Officer) Item 7 Mr Paul De Freine, (Chief Architectural Advisor)

Minutes reflect the order in which items were considered and are numbered in accordance with the original agenda.

1.1 Welcome and Introductions

The V/Chair welcomed the Committee members to the meeting and held a private session to consider the agenda and papers and the approach to conducting the meeting. Martin Pitt agreed to formally act as Committee Chair for the purposes of signing the minutes at this meeting.

1.2 Declarations of Interest

Committee Member Colm Campbell absented himself from item 5.2.3 viii acquisition of lands by the HSE at Leopardstown Park Hospital, Foxrock, Co Dublin by way of a 500 year lease and wished to avoid any perception of a conflict of interest.

1.3 Approval of Minutes

The Committee approved the minutes of Committee meetings held on 13 December 2021 and 20 January 2022.

EMT joined the meeting at 1:30pm

The Chair welcomed Mr Barrie O’Connell (Partner KPMG) and Ms Maria Diver (Director Audit KPMG) who presented to the Committee an update on matters of relevance to Audit and Risk (ARC) Committees generally. Mr O’ Connell noted that the area of corporate reporting is changing and as such the role of the ARC Committee is changing in response to increasing information requirements across the stakeholder spectrum.

Mr O’ Connell briefed the Committee on lessons learned during the pandemic and the importance of process and oversight. He informed the Committee that organisations must have a more proactive approach to horizon scanning in order to support prioritisation and informed decision making. He highlighted the increasing significance of reporting on climate change obligations and the gathering of data, including important non-financial data. He spoke to the importance of the Internal Audit function, where it sits within the organisation structure, the governance it supports, and how it is now being seen in many organisations as a value-added agenda item and the move to broader/less exclusively financial audit deliverables.

Mr O’ Connell also briefed the Committee on the importance of the organisations having a strong focus on risk management. He highlighted the significance of understanding the governance of third-party stakeholders and the need for ensuring that robust policies and procedures are in place. With regards to whistleblowing, he expressed that it was felt that consideration is regularly being given at Audit Committees to having this as a standing organisation agenda item generally.

The Committee welcomed the presentation and briefing presented by KPMG and discussions followed with regards to understanding the importance of being presented with non-financial as well as financial data, cyber security and processes around ethics and whistleblowing trends and hotspots.

The Vice Chair highlighted the lack of Environmental, Social and Governance (ESG) and climate related metrics and targets specifically used in the healthcare sector to assess risks and made reference to the Climate Change Advisory Council Annual Review 2021 which supported that more work can be done to improve tackling ESG and climate related risks. The Committee discussed potentially looking again at the ARC Terms of Reference to provide for more consideration on this topic.

3.1 Year to Date Expenditure Update

The Preliminary Finance Update December YTD 2021 Report, which summaries the full year revenue and expense position of the HSE for year-end 2021, and the Health Budget Oversight Group Meeting (HBOG) Minutes from July to November were circulated to the Committee prior to the meeting for consideration.

The CFO informed the Committee that the expected outturn position for Revenue I&E including known and anticipated AFS adjustments, but before any effect of the accrual review is a deficit of €140.6m. The CFO also noted the DOH advised the HSE that the maximum year end cash holding level permitted for 2021, as agreed between it and DPER would be circa €600m.

3.2 2021 AFS Significant Issues & Judgements

The 2021 Annual Financial Statement Significant Issues & Judgements briefing by the ACFO was circulated to the Committee prior to the meeting for consideration which highlights elements that may have material impact on the AFS financial results.

The Committee were notified that the first Draft AFS is to be completed by 28 Feb 2022 in line with the DPER Code and this draft will be submitted to C&AG and Department of Health before being brought to the Committee for discussion in March 2022. The HSE Board are required to formally adopt the final AFS by 1 April 2022 in line with the requirements of the Health Act 2004.

The ACFO informed the Committee that an accruals review was conducted in 2021 to accelerate processes in relation to IFMS and data cleansing to determine if there were outstanding issues. The review looked at year to date non-pay accrual balances at end of 2020. At present the ACFO determined around €50m of non-pay accruals have been judged as no longer required and will need to be reversed as part of 2021 AFS proess.

The Committee discussed the area of the materiality or otherwise of the proposed adjustment and the potential accounting treatment of this is line with accounting standards and noted that further information on its nature and origin would be presented at future meetings as it becomes available. The ACFO noted that it also has to be considered in line with the materiality amount set by the Controller & Auditor General (C&AG). The ACFO also noted that the proposed adjustment arose over a number of years prior to Financial Year 2020 and and the annual impact in those years individually was believed to be substantially below materiality levels,. The V/Chair noted that as spending controls had improved in the HSE the attention had logically extended to effeicient use of Balance Sheet and he encouraged the work being done in this regard to review these Balance Sheet captions and prepare for further rollout of IFMS.

3.3 HSE SIC Procurement Declaration Process

The HSE Statement of Internal Controls (SIC) Declaration of Non-Competitive Procurement 2021, which specifically calls out compliance with public procurement regulations and provides estimates of non-compliance, was circulated to the Committee prior to the meeting for consideration.

The Head of Procurement affirmed that following review of the HSE AFS & SIC (2020), the C&AG required deeper analysis for the SIC Procurement Declaration process for 2021 and preparations were made to facilitate a review of invoices greater than €20k.

The CFO informed the Committee that the final review of 2021 expenditure greater than €20K is expected to be concluded by 1 March 2022. Approval has been given for the recruitment of 20 Grade 7 staff in procurement to assist with overall compliance improvements including the annual self-review process.

The V/Chair reminded management that the goal to which we were headed also critically included the presentation of a timely list of items with explanations of non-compliance/derogations with public procurement regulations.

3.4 2021 Controls Assurance Review Process

An update was brought to the Committee in respect to the 2021 ICQ and CARP process noting that the 2021 Review of Effectiveness of System of Internal Control (SIC) will be brought to the March Committee meeting for information and consideration.

The Committee were informed that the 2021 Controls Assurance testing and external verification process has been completed for all staff including appropriate enhancements to facilitate current Covid-19 remote working restrictions and to ensure minimal disruption to those involved in priority activities.

The Committee noted that the SIC Report is on course to be completed by 28 Feb 2022. The Audit firm ASM, are due to provide their draft audit report February 11, 2022. Following this validation process, the ICQ survey responses will be reviewed, analysed and then shared with each Division/ Hospital Group and CHO to allow for the development of a key action’s improvement plan.

3.5 Corporate Procurement Plan 2022

The Corporate Procurement Plan 2022 was circulated to the Committee prior to the meeting for consideration. The plan underpins analysis of expenditure on procurement and the purchasing and procurement of structures in the organisation and sets practical and strategic aims and objectives for improved procurement outcomes and appropriate measures to achieve these aims.

ND Procurement advised the Committee of the implementation of a Communication Model for procurement, which changes the process of how the communication of contract statuses and promotional materials for procurement regulation awareness are made available.

The Committee were informed that the target date for final drafting of the HSE Corporate Procurement Plan 2022-2024 is Q1 2022 with the intentions of it being reviewed by the Committee ahead of issuing to the Board for approval.

The Committee discussed the acquisition process of Information Communication Technology (ICT) procurement systems and how this could be improved. The Committee was of the strong view that the approach generally in the public service was not fit for purpose and required radical rethinking and redesign if HSE is to achieve its Corporate Plan goals, including in eHealth. This process may require liaison with OGP and DPER to be effective. Management was encouraged to bring forward transformation in this regard. The Committee were informed that meetings with the CIO have taken place to consider the function and spend in acquiring systems and the use of dynamic purchase systems. A dedicated team on ICT and innovation are being established.

4.1 Internal Audit 2021 Annual Report

The ND Internal Audit presented the Internal Audit 2021 Annual Report to the Committee.

The ND IA informed the Committee that the Report notes that during 2021 the IA Division was impacted by the Cyber-attack and continued to operate in a challenging Covid-19 environment. The ND IA stated that 176 audit reports were issued comprising of 161 HSE (reported to HSE ARC) and 15 TUSLA (reported to TUSLA’s ARC). A total of 890 recommendations were contained in the HSE audit reports. She noted that 18% of the HSE audit opinions in 2021 reporting assessed the HSE control environment as “satisfactory” (24 reports), 30% as “moderate” (40 reports), 37% as “limited” (49 reports) and 15% as “unsatisfactory” (19 reports).

In relation to HSE funded agency audits, 17% of the audit opinions in 2021 reported assessed the funded agency control environment as “satisfactory” (2 reports), 33% as “moderate” (4 reports), 25% as “limited” (3 reports), and 25% as “unsatisfactory” (3 reports).

The ND IA noted that as at 31st December 2021, 28% (253) of the 2021 recommendations due to be implemented remained open, while 36% (263) of 2020 recommendations and 8% (97) of 2019 recommendations also remained open at 31st December.

The ND IA reported that her annual overall audit opinion for 2021 is that Limited Assurance can be provided on the governance, risk management, and internal control processes within the HSE. She noted that her 2019 and 2020 annual audit opinions were also ‘Limited’.

The Committee discussed, and emphasised to management present at the meeting, the importance of management closing out audit recommendations and not leaving them open for extended periods. With Covid appearing to be receding at present, this needs to be a priority.

The Committee discussed with the ND IA the top control issues identified in the report noting the need for management to establish a dedicated programme to deal with control issues present in people related areas such as HR/Payroll/Training. The Committee asked the ND IA to consider sending the IA Annual Report to the People and Culture Committee for the Committee’s consideration of the HR and people related control issues.

4.2 KPI Achievement as at 31 Dec 2021

The 2021 Key Performance Indicator (KPI) Achievement & Proposed 2022 KPIs Report produced by the ND IA was circulated to the Committee prior to the meeting for consideration. The Committee noted the KPIs for 2021 and also the key performance indicators for 2022

4.3 2021 Q3 & Q4 Activity Reports

The NDIA report containing the Q3 and Q4 IA Activity Report and the Dashboard setting out, inter-alia, the implementation status of recommendations contained in Internal Audit reports (including Health Care Audit reports) was circulated to the Committee prior to the meeting for consideration. 104 HSE internal audit reports issued in Q3& Q4.

The Committee discussed the IT General Controls Secure Payments National Payments Service Audit report and the findings, inter-alia, in relation to the process for removal of user access on inactive accounts and noted the audit assurance level of “unsatisfactory”. The Committee suggested the CFO provide an update addressing these issues in April 2022.

In relation to the audit report Review of Payments to Master of Holy Ghost Hospital, the Committee decided to refer a copy of the report to the Charities Regulator and to write to the Holy Ghost Hospital informing them of this decision and of the release of the IA report under FOI on 28 February 2022 in keeping with the HSE’s Freedom of Information policy.

4.4 Update on MOU with the Charities Regulator

The Committee were informed that the HSE Compliance Section had advised that the HSE has obligations under statute and as a public body to disclose relevant information to the Charity’s Regulator arising from audit findings carried out by HSE in S38/39 funded organisations. These voluntary organisations if registered as a charity also have obligations to disclose information to the Charity’s Regulator.

The Committee also noted that the Compliance Section is working to develop a Memorandum of Understanding (MOU) with the Charity’s Regulator that it is appropriate for the HSE which when finalised, will be presented to the Committee at a future meeting. The V/Chair underlined that it was important that this work be expedited and requested a draft be sent to the April meeting.

5.1 Property Papers & 5.2 Contract Award

The CSO assisted by the ND Capital and Estates and the Chief Architectural Advisor briefed the Committee on the following property transactions circulated to the Committee prior to the meeting for consideration. Following consideration of the detail for each proposed transaction the Committee agreed to recommend the following transactions to the HSE Board for approval:

• proposed Lease for additional accommodation space at Castlebar Primary Care Centre, Moneenbradagh, Castlebar, Co. Mayo
• proposed Lease for additional space at Primary Care Centre, Castle Square, Carrigtwohill, Co. Cork
• proposed Lease for additional space at Primary Care Centre, Listowel, Islandmacloghry, Co. Kerry. Primary Care Centres
• proposed Lease of Primary Care Centre at Church Street Rathdowney Co Laois
• proposed Lease of Primary Care Centre at St Mary’s Road, Edenderry, Co. Offaly
• proposed 10 Year Sub-Lease of Unit 1 & 2 Ground Floor Ongar House, Ongar, Dublin 15 to the Central Remedial Clinic
• disposal of prime commercial site for Blocks A & B in Area D of Grangegorman Campus at Broadstone Gate
• acquisition of lands by the HSE at Leopardstown Park Hospital, Foxrock, Co. Dublin by way of a 500-year lease and Appendix

Following a discussion on elements of the Leopardstown Park Hospital contract, the Committee agreed to recommend to the HSE Board for approval but requested that a more detailed explanation of reasons for engaging in this transaction be included in the briefing paper brought to the Board.

The Committee sought assurances about the underlying professional valuation received in respect of the Grangegorman site and this information was provided.

The Extending Pathfinder Maternity and New-born Electronic Health Records (EHR) Programme and the proposed extension of the Maternal and New-Born Clinical Management System (MN-CMS) contract was presented to the ARC Committee and was approved to be submitted to the Board.

The Committee discussed the need for the MN-CMS program to support the strategic objectives of the National Maternity Strategy 2016-2026. The Committee were informed that there are plans to move the MN-CMS programme infrastructure out of the HSE datacentre to a Technology Managed Service provided by the supplier in Sweden. The Committee queried whether MN-CMS could be cloud-hosted and were informed the supplier does not currently offer this solution. However, the supplier has indicated their product roadmap will make such an offering available in the next 3-5 years. It was recognised that there are already many systems acquired by the HSE that are cloud based, such as the system used for COVID vaccinations. The learning from these acquisitions have been captured and inform the way forward for the HSE making more use in future of cloud acquisitions. Subject to minor edits the Committee agree to submit the paper for Board consideration.

5.2 Property Strategy

An update briefing on the development of a Property and Asset Management Strategy was circulated to the Committee prior to the meeting which works to create a framework for delivering sustainable, fit-for-future estate provision.

The CSO informed the Committee that to deliver the strategy, a Property and Asset Management Steering Group (SG) has been established comprising representation from across the HSE and from the DoH. The SG has

approved the establishment of five work-streams which comprises of baseline assessments of existing estates, identifying key drivers of change, researching new methods of design and construction, researching modelling and funding options and development of a strategic assessment framework.

The CSO informed the Committee that the first draft will be submitted to the April meeting.

5.3 Covid-19 Therapeutics Update

The Committee noted that the contract for Covid 19 Therapeutics had been approved via written procedure by the Board on 10 January 2022 following the Committees consideration of the contract and subsequent recommendation to the Board for approval.

The eHealth & ICT Capital Plan 2022 was circulated to the Committee prior to the meeting for their consideration. The CFO highlighted the plan, frameworks and strategic objectives that will be implemented to stay current, to ensure security and protection, and to provide an ongoing basis for further development and innovation in relation to technology and I.T.

The CFO informed the Committee that within the NSP 2022, the 2022 ICT Plan as approved by the Board on 23 November 2021 was unchanged and the 2022 Capital Plan as also approved by the Board on 23 November 2021 was subject to further consideration by the Department with minor suggested amendments which was brought to Board in a special meeting on 7 Feb 2022.

The Deputy CIO noted the ICT and eHealth capital funding available in 2022 is €130m, an increase of €10m on 2021. An additional contingency plan, totalling €7m in COVID related ICT Capital investment has been prepared, should funding be made available from the COVID Capital Contingency fund.

The Committee requested a further update from the CIO when the implementation plan for the projects in the eHeath & ICT Capital Plan 2022 have been agreed.

The Committee discussed with the CSO the briefing paper circulated in advance of the meeting which provided an update on the status of the National Children’s Hospital project. It was noted that the last update on the project went to ARC in May 2021.

The Committee were informed that new governance arrangements were developed for the Children’s Hospital Project & Program (CHP&P) and were approved by Government in November 2021.

The Committee requested a revised version of the governance arrangements be presented in the coming months.

The Committee held a private session to debrief post meeting.

The meeting concluded at 5:30pm.

Terms of Reference: Audit and Risk Committee