HSE Audit and Risk Committee meeting minutes 10 February 2023

Members Present

Brendan Lenihan (Chair), Fergus Finlay, Michelle O’Sullivan, Ann Markey, Martin Pitt, Colm Campbell & Pat Kirwan

HSE Executive Attendance

Mairead Dolan (Interim CFO), Dean Sullivan (CSO), Mr Joseph Duggan, (ND IA), Patrick Lynch (ND G&R/CRO), Dara Purcell (Corporate Secretary)

Joined the Meeting

John Crean, Deputy Director of Audit, Olivia Somers, Audit Manager, Monica Percy (Interim A/CFO)(Item 3.6), John Swords (ND Procurement)(Item 3.4& 3.5), Siobhan Dunphy (Item 3.4 & 3.5), Paul de Freine, ND Capital & Estates)(Item 4 & 5), Martin Mc Keith, Assistant Lead Director CHP&P)(Item 4.2), Elaine Kilroe, AND Enterprise Risk Management (Item 7.3), Tom Malone (AND Internal Audit)(Item 6), Alan Moran, (AND IA)(Item 6), Rosemary Grey (AND Compliance)(Item 7.4), Gary Russell (GM Protected Disclosures)(Item 7.4).

Minutes reflect the order in which items were considered and are numbered in accordance with the original agenda.

The Chairman welcomed the Committee members to the meeting and held a private session to consider the agenda and papers and the approach to conducting the meeting.

2.1 Conflicts of Interest

No conflicts of interest were declared.

2.2 Minutes

The Committee approved the minutes of 08 December 2022.

2.3 Action Log

The Committee reviewed the Action Log.

2.4 Annual Report of Audit and Risk Committee 2022

The Chairman informed the Committee that he was reviewing a draft copy of the Committee’s section for inclusion in the Annual Report 2022 and will circulate to the Committee at the March meeting.

2.5 Review of Committee effectiveness 2022

The Committee reviewed the draft checklist for the effectiveness of the Audit and Risk Committee, as circulated by the Chairman. It was agreed that it would be further updated and circulated to the Committee for completion and return to the Chairman.

2.6 Review of Terms of Reference

The Committee noted that revised copy of the Terms of Reference as circulated prior to the meeting. The Chairman said that further feedback was awaited which will be included and the final version will be brought back to the Committee at the March meeting.

3.1 C&AG Audit Planning Memorandum - the audit plan for year ended 31 December 2022

Officials of the C&AG, John Crean, Deputy Director of Audit & Olivia Somers, Audit Manager joined the meeting.

The Chair welcomed John Crean, Deputy Director of Audit and Olivia Somers, Audit Manager from the Comptroller & Auditor General (C&AG) to the meeting.

The Deputy Director of Audit C&AG presented to the Committee the audit plan for year ended 31 December 2022, which set out the C&AG’s proposed approach for the audit of the HSE, which will be conducted in line with International Standards on Auditing (ISA’s). The audit will provide an opinion on whether the financial statements properly present the state of the HSE’s affairs at year end and the income and expenditure for the year in accordance with the accounting standards specified by the Minister for Health as set out in the basis for preparation section of the accounting policies.

He identified for the Committee the significant business and financial statement risks faced by the HSE and explained the approach to dealing with these in the audit. Any matters of significant importance identified during the course of the audit would be reported to the Committee.

The Committee noted the additional audit requirements under ISA 315 and were advised that these requirements have been taken into account in the timetable for the audit.

The Committee noted that a further update will be brought back to the Committee before the final audit report in May 2023.

3.2 AFS Significant Issues and Judgements

The CFO provided the Committee with a briefing on the significant issues and judgements which are likely to have a material impact on the HSE’s Annual Financial Statements (AFS’s) 2022 financial results, such as Vaccine Stock Write-offs in AFS 2022, Inflationary Payments to S39 providers 3.5%, and the Pandemic Special Payment Recognition Payments to Nursing Homes and S39s. She also advised of the on-going issues carried forward from 2021 which are currently under review such as the on-going impact of COVID-19, the costs of Personal Protective Equipment (PPE), Procurement compliance and consideration of going concern.

The Committee discussed the overall write down in respect of COVID-19 vaccines of circa €94.6m which is a material charge for 2022, based on stocks that are now out of date as at the end of December and those that are due to be out of date or considered obsolete in the coming months. The CFO will provide further information on this to the Committee Chairman.

The CFO advised that the finance teams are currently working through the AFS template and review process, and an updated report and the draft AFS 2022 will be presented to the Committee at their meeting in March 2023.

The Committee were advised that there has been significant ongoing engagement with the Department of Health in relation to the financial challenges as described in the current NSP, but no agreement has been made, but that engagement is continuing.

3.3 YTD Expenditure - verbal update

The CFO provided a verbal update on the YTD expenditure at the end of 2022, and advised that at present more analysis is required and that the year-end figures for 2022 are still to be finalised. but the expected end of your position is substantial breakeven (deficit will be less than €20m). The expectation is that before consideration of the first charge brought forward from 2021 that the HSE will have a surplus. However, she further advised that the end of year position cannot be finalised until a decision is made as to what level of deficit from within voluntary bodies the HSE should fund. It may therefore result in a statutory deficit for 2022.

3.4 2022 Review of Effectiveness of System of Internal Control within the HSE - Controls Assurance Process

The Committee were presented with an update in relation to the 2022 Controls Assurance Review Process (CARP) by the Interim A/CFO. The Committee were advised that 3,585 (42%) staff and senior management completed the CARP, an increase of 16% participation on 2021, with which reflects the growing awareness across HSE staff of the necessity of controls and compliance. A National Training Plan was completed prior to CARP with saw an increase in participation of 1,028 up from 796 in 2021.

ASM, the external audit firm are currently undertaking a review of the ICQ responses and their report is due to be completed today, 10 February 2023.

The Committee noted that control findings are being reviewed for inclusion within the Draft Statement of Effectiveness of Internal Controls and the Statement of Internal Control reports, with 1st drafts to be submitted to the C&AG and the DOH along with the AFS by the 28th Feb 2023 in line with the DPER code. The Committee will be able to discuss these at the March meeting. Following the validation process, the ICQ responses will be reviewed, analysed and shared with each Division, Hospital Group and CHO to allow for the development of a key actions improvement plan.

The Committee discussed the participation rate, and the percentage of compliance across all areas including the clinical side. It was agreed that an example of questions made to Clinical Leads be forwarded to the Committee and a further report, which includes planned targets for next year, be brought to the Committee at their meeting in March.

3.5 Update on Procurement Compliance (Statement of Internal Controls SIC) 2022

John Swords, ND Procurement and Siobhan Dunphy, AND Sourcing joined the meeting

The Chairman welcomed the ND Procurement and AND Sourcing to the meeting. Further to an update received by the Committee at their November 2022 meeting, the CFO / ND Procurement presented a paper outlining the status update with regard to the Q1 to Q3 2022 returns based on data received as of the 03 February 2023 and progress on the implementation of the overall Procurement compliance programme. It was outlined that circa 20,000 invoices were assessed which exceeded the €25k threshold; 78% invoices were returned and 92% declared compliant.

The Committee were briefed on the steps taken to enhance the 2022 Procurement Compliance SelfAssessment Declaration Process such as training, Procurement Compliance Assessment Tool, and the establishment of two Communities of Interest (CoI), one for CHOs and one for HGs.

The Committee discussed the update and noted that a further report will be brought back to the March meeting.

3.6 National Procurement Approach - Dynamic Purchasing System

The ND Procurement presented to the Board a paper in relation to the Dynamic Purchasing System (DPS), which was previously circulated, and advised that the DPS is unlike a traditional framework for the supply of goods, works or services, but is an fully electronic tendering system designed to give Buyers access to a pool of pre-qualified suppliers and product offerings that are continually updated. Suppliers can join at any time but are subject to the normal controls and requirements applicable to traditional frameworks.

The Committee welcomed the update and a discussion took place concerning the assurance around controls, the measurement of effectiveness, the performance of suppliers and financial thresholds, and were advised that the performance management is included in the tender documents and that Business Relationship Managers have and continue to build up good working relationships with the PEG group. The ND Procurement gave an outline to the Committee of the different financial thresholds.

The Committee suggested that input from ND IA on the new arrangements might be appropriate and requested that the CFO would liaise with him.

4.1 Review of Capital Plan 2022

The National Director Capital & Estates presented to the Committee a briefing on the HSE Capital 2022 Outturn and advised that challenges encountered during the delivery of Capital Plan 2022 related mainly to the challenging global environment outlining specific challenges in relation to inflation costs, availability of labour and specialised resources within the construction sector, Ukraine and Brexit. Taking into account the challenges identified, adjustments had been managed throughout the year and the ambition statement associated with the financial management of Capital Plan 2022 has been substantially achieved.

The CSO joined the meeting at 10.05am.

4.2 Children’s Hospital Project & Programme - Programme Assurance Plan

The CSO presented the Children’s Hospital Project & Programme – Programme Assurance Plan (PAP) which was circulated to the Committee in advance of the meeting. The PAP is in response to the recommendations of the 2019 PwC report, ‘New Children’s Hospital Independent review of escalation in costs', revised governance arrangements for the programme which were approved by Government in November 2021, which the Committee previously discussed at their meeting in February 2022. The objective of the PAP is to detail how assurance will be provided to the HSE and the Department of Health (DoH) that the programme is being delivered within approved parameters in relation to cost, time, scope, funding, and risk.

The Committee were advised that the PAP has been developed by the HSE Lead Director with support from KPMG, and relevant HSE officials. There has also been extensive engagement with the Children’s Health Ireland (CHI) and the National Paediatric Hospital Development Board (NPHDB); and the document has been shared with the DoH for comment and will require consideration by the Boards of NPH and CHI.

The Committee reviewed and discussed the PAP and noted the three lines of defence model that is used as a filtering mechanism to reduce the likelihood and consequence of high-risk events occurring. The Committee welcomed the PAP but provided feedback in relation to the positioning of the Board and the Audit & Risk Committee in the Plan as it should not be included in the 2nd line of defence, which is to oversee the operation of the review and challenge function provided by the HSE Lead Director, and requested that this be amended. The Committee received an update from the CSO on the overall spend and timelines for completion of the Hospital build.

The Chairman informed the Committee that the Board were invited to visit the Hospital, and Committee members would be welcome to attend when this takes place.

4.3 National Maternity Hospital - Progress on implementation of legal agreement

The CSO presented to the Committee an update on the development of the proposed new National Maternity Hospital on the grounds of St Vincent’s University Hospital.

The Committee noted progress on the project has been slow in the context of the ongoing External Assurance Process of the draft Final Business Case which is being carried out under the direction of the Department of Health. Activity on the project has been largely focused on the completion of tender documents for the construction works, and preparation of a new governance structure to reflect the different roles, responsibilities and skillsets required to support implementation and delivery of this large complex project.

The Committee were informed that the Legal Framework designed to protect the State’s interest in respect of the investment to be made on the project and approved by the HSE Board, the Boards of the two Hospitals, the DOH and Government in May 2022, remains the position and all parties continue to progress the project in the context of these agreements.

The Committee discussed the governance arrangements and the CSO advised that a governance structure was put in place to advance the initial stages of the project, which included representation from all stakeholders, including both Hospitals and the Department of Health, with the process being chaired by HSE Estates. He advised that it is now proposed to evolve and strengthen these governance arrangements as the project moves towards construction, equipping and commissioning. He advised that the proposed new governance arrangements would reflect detailed consideration, review and engagement from these stakeholders and will remain in place until the establishment of the NMH at Elm Park DAC.

The Committee noted these governance arrangements will remain in place until the establishment of the NMH at Elm Park DAC to operate the new Hospital at which point the proposed new governance arrangements will evolve, with responsibilities transitioning to the newly formed DAC.

In the above context, the Committee queried whether the new DAC might be established sooner. The benefits of same would be the enhancement of public confidence if the parties could work together in the new DAC perhaps even as a forum for inputting and advising on the build stage. It was noted by management that the earlier establishment of the DAC is not anticipated under the agreed legal framework and a legal opinion had been obtained that suggested that it would be problematic to have two NMH entities at the same time.

The Committee held a discussion and outlined the benefits that may accrue from collaboration in a new entity at an earlier stage and their concerns in relation to the governance arrangements. It requested that further legal opinion be sought, if necessary if a legal imprediment is identified, to confirm if the new DAC can be established at this point. It was agreed a further update will be given to the Committee at its March meeting.

5.1 Properties

The Committee considered the detail for the proposed property transactions, and the Committee agreed to recommend the following to the HSE Board for approval.

1. St Luke’s Radiation Oncology Centre at Beaumont Hospital and Annex
2. Women’s Health Hub - Tallaght Cross West
3. SVUH Surgical Ward and Critical Care Unit development and SAR
4. Proposal for Development at St. James’s Hospital and SAR

6.1 New National Director introduction

The Chair introduced and welcomed Mr Joseph Duggan who took up the role of National Director Internal Audit on 16 January 2023.

6.2 Internal Audit Annual Report

The ND IA presented to the Committee the 2022 Annual Report of the Internal Audit Division.

He informed the Committee that the report is similar to last year and noted that his overall opinion, based on the results of internal audit work completed during 2022, is that limited assurance can be provided in respect of the governance, risk management and control systems operating in the HSE, and outlined the reasons for his opinion, which were included in the report.

The Committee discussed the report and noted the significant amount of unsatisfactory and limited audits, and the absence of an overall assurance framework for the HSE, and the relatively undeveloped state of its risk maturity and Level 2 compliance mechanisms. The Chair advised the Committee that he had discussions relating to the assurance in respect of Section 38’s and that a review of the approach would be required. The Committee agreed that they would reflect on this.

The ND IA advised the Committee that he has had discussions with the CRO re collaboration between the risk function and internal audit, and would have further discussions with EMT members.

6.3 Internal Audit Q4 Report

Tom Malone, AND IA and Alan Moran, AND IA joined the meeting

The ND IA presented to the Committee Q4 – 2022 IA Report which was circulated prior to the meeting, which included the Activity Report, the IA Dashboard, the Status of Recommendations, the Key Internal Audit Reports issued and the Summary Internal Audit Reports issued. He advised that as at 31 December 2022 (Q4 2022) 98 reports were issued in Q3, 19 of which related to TUSLA. Included in the 79 HSE reports were 10 follow-up reports, and 13 reports in respect of funded agencies. He provided an outline of 8 key HSE reports issued, and advised that the External Quality Assessment of the Division by Mazars has been completed with the results expected to be communicated within the first quarter of 2023, the Committee requested an update be brought to their meeting in March 2023.

The Committee held a discussion in relation to the key findings of the Summary Reports relating to Q4-22-CHO-029: Compliance with Children First Legislation (Unsatisfactory opinion); and Q4-22- CHO-035 CHO Oversight of Funded Agencies - CHO4 (Limited).

In relation to Compliance with Children’s First legislation, the CRO advised the Committee that this had been discussed with EMT and that he had held discussions with the CSO and that a full review of compliance in this area will be conducted for end Q2 2023.

The Committee thanked the ND IA for the update and in view of their concern requested that the findings of the Q4-22-CHO-029: Compliance with Children First Legislation report be brought to the People & Culture Committee, and it was agreed that the Chair and Committee member P Kirwan would discuss oversight in Section 39 agencies and that a conversation will be required between the Committee, IA, EMT and the Board on an assurance approach and Quality & Improvement function, which needs to take place in the next 4 -5 months.

6.4 Review of Internal Audit KPI

The Report on Achievement of Key Performance Indicators for 2022 produced by the ND IA was circulated to the Committee prior to the meeting for consideration. The Committee noted the KPI target for 2022 and those achieved. It was agreed that ND IA would obtain an input from Committee members in relation to the KPIs for 2023.

A discussion took place in relation to the WTE complement for the division and a request that this be included in a report to the Committee along with an update from the ND IA on his review of Internal Audit’s KPIs once he has received input from Committee members and a further discussion would take place at the next meeting.

6.5 Detailed breakdown of any outstanding 2020 and 2021 recommendations by Division

The ND IA provided to the Committee an update on the open recommendations from 2020 and 2021 which were closed in Q4, and those still open at the end of 2022, which included responses received from National Leads in response to a previous request from the Committee. He advised that this has also been discussed at the EMT meetings. The Committee emphasised the importance that the backlog is cleared.

The Chair acknowledged Mr Tom Malone who acted as Interim ND IA from March 2022 and thanked him for the work that he achieved whilst acting in the position.

7.1 CRR Q4 2022 Report

The CRO presented the Corporate Risk Review (CRR) Q4 2022 End of Year report to the Committee.

The Committee noted that there are currently 21 risks on the Register, up from 19 risks reported in Q3, with the addition of Data Protection and Workplace Violence and Aggression, of which 16 have residual risk rating of Red and 5 as Amber.

In relation to the two new risks added to the CRR following the advices of the Committee, CRR 020 Workplace Violence and Aggression was added. This related to CRR009 Health, wellbeing, resilience and safety of staff, which was reviewed in Q4 and a decision was made that given the risks relating to violence and aggression in the workplace, it should be recorded as a specific risk on the CRR. The Committee agreed to monitor this risk and if required escalate the matter to the Board in the event of there being a requirement to bring it to the attention of the Minister to strengthen legislation to protect health care workers.

In relation to CRR 021 Data Protection, as a result of the extraction of personal data at the time of the 2021 cyber-attack on the HSE’s systems, it was decided that a specific Data Protection risk should be included on the CRR, which the Committee welcomed.

The Committee were updated on the movement in residual risk ratings between Q3 and Q4 2022 and noted that in relation to CRR 002 Future trajectory of COVID, the risk description had been expanded to include the compounding effect of surges of more than one pathogen at the same time, with the residual risk rating revised upwards from 12 to 16.

In relation to CRR13 Internal controls and financial management, the Committee noted that following previous discussions the risk description had been expanded to reflect economic uncertainty risks. The residual risk rating was revised upwards from 10 to 15 (due to continuing economic uncertainty and known shortfall in budget allocated for 2023). The Committee advised that the risk as previously described, focused on the HSE’s management of its control environment and budgets. Widening the risk to include areas outside of its control, which resulted in the higher rating, could be viewed as a HSE failure to implement effective internal controls and budget management. The CFO agreed to consider the advice of the Committee as part of the Q1 2023 CRR Review.

The Committee noted that the CRO expects that both ratings for CRR002 and CRR13 will come back down in the next quarter, and that the Safety & Quality Committee were reviewing CRR 08 Safety Incidents Leading to Harm to Patients at their meeting that was taken place today.

The Committee highlighted that there was no change recorded for CRR 001 Major Disruption to Clinical and Non Clinical Service Continuity, and in light of the exceptional pressures on Emergency Departments, acute hospitals and the wider health system this winter, they would have expected to see the increased level of risk to have been reflected. The CRO agreed to feedback their comments to the Risk Owner and EMT.

In reviewing the CRR, the Committee emphasised the importance of understanding that risk concerns the effect that uncertainty has on the HSE’s objectives. As such, corporate risks should ideally fall out of those objectives. The Committee agreed that the current Corporate Plan needed to be updated, and advised that work on its successor Plan should start as early as possible and that the Strategy should be informed by risk which should in turn guide the application of resources. The Committee requested that the CRO bring this advice to the attention of the EMT.

The Committee noted the delay in approving the National Service Plan 2023, which is core to addressing and monitoring the treatment of risk, and requested that the CRO advise the EMT of their concern.

The Committee were advised by the CRO that the EMT held its annual Corporate Risk Workshop on 25 January 2023, and outlined that in relation to Reflecting on the HSE’s Corporate Risk Process, a number of practical ‘back to basics’ risk workshops are to be arranged, and two initial workshops will focus on Current CRR Risk - Access to care and a new risk with regard to Implementing RHAs.

The Workshop also looked at the review of the HSE’s Corporate Risks and Risk Appetite Statement, including new or emerging risks and current corporate risks. The Committee thanked the CRO for the update and it was agreed that the Committee will seek to align their review of the risks designated to them with the review of Internal Audit identified risks.

7.2 Mental Health Commission CAMHS report - operation of the risk management system - verbal update

The Chair referred to the Interim report of the ‘Independent Review of the provision of Child and Adolescent Mental Health Services (CAMHS) in the State by the Inspector of Mental Health Services’ which was submitted to the HSE in January 2023. Concerns were identified in four out of five CHOs, and the operation of a risk management system was highlighted as one of the areas of concerns within CAMHS.

The CRO advised the Committee the Report outlined that in some areas reviewed, risk management was poor, with a lack of communication, lack of actions to mitigate risks, and a limited understanding as to what constituted a risk, how it was assessed, and how it was escalated. This led to frustrations in the teams, with risks then not being notified or escalated.

The Committee held a discussion in relation to the risk literacy issue, and the need to anticipate risks more effectively in the services. At the suggestion of Fergus Finlay, the CRO agreed as part of the new Risk Policy to develop a non-technical summary that could be used to increase the understanding across the system of how risks should be managed.

7.3 Draft Enterprise Risk Management Policy, Process and Guidance 2023 - ARC Review

Elaine Kilroe, AND Enterprise Risk Management joined the meeting.

The CRO presented to the Committee for their consideration, the penultimate draft of the revised HSE Enterprise Risk Management [ERM] Policy 2023, which was previously circulated. He advised that the HSE’s Risk Management Policy was last updated in 2017, and work on revising this Policy has concluded.

The Committee noted that the inputs to the Review included the findings and recommendations of the HSE’s Risk Reviews 2019 and 2021 (Moody Review); International Standards; the key developments in Risk Management thinking since 2017 and consideration of risk management documentation from other jurisdictions and the undertaken of a comprehensive and extensive two phase consultation process with health service staff and HSE funded agencies and their representative bodies. Committee members P Kirwan and C Campbell were also involved in the consultation process.

He advised that once the HSE ERM Policy 2023 is approved, a comprehensive communication programme will be rolled out, which will include a formal launch and an information road-show.

The Committee welcomed the update and noted that some additional amendments were being made including adding a summary section. The Committee requested that the CRO ensures that the Policy is contextualised so that it responds to the needs of front line staff including clinicians; that it strengthens the section on the need to engage on risk with bodies outside of the HSE, particularly where the ability to control the risk lies outside of the HSE’s power; that in parts of the policy the language needs to be strengthened, table 4 should include staff in its description and a FAQ document should be developed.

The Committee considered the Policy, and once their suggestions were included, which the CRO agreed to undertake, it was agreed that the final draft would be brought to the Committee in March 2023 in advance of it being tabled for approval by the Board.

The Committee outlined their thanks to Elaine Kilroe AND and Carol Clarke General Manager for all their work in the revision of the policy.

7.4 Protected Disclosures

Rosemary Grey, AND Compliance and Gary Russell, General Manager, Protected Disclosures joined the meeting.

The ND Governance and Risk presented to the Committee the following papers, as circulated prior to the meeting. 2022 End of Year Status Report, Proposed Future Status Reporting, Statutory return to the Minister for Public Expenditure and Reform and the HSE’s Protected Disclosures Annual Report 2022. The ND GR introduced Mr Gary Russell who has taken up the role as the Head of the National Office for Protected Disclosures [NOPD] and also welcomed Rosemary Grey AND Compliance and Authorised Person to the meeting.

Protected Disclosures 2022 End of Year Status Report

The Committee reviewed the Protected Disclosures 2022 End of Year Status Report, and reiterated that the backlog of open PDs is a priority for the Committee. It was noted that there were 366 Protected Disclosures received by the HSE between 2017 and 2022, with 68% of reports that have been closed, and 117 remain open. 310 cases were received between 2017 and 2021, with 71 remain open. The Committee acknowledged that the length of time it is taking to close out such a high proportion of cases is a concern.

The Committee were advised that as a priority action, an in depth review of all open cases listed on the protected disclosures activity log commenced in December 2022, and the Committee reviewed the methodology for the Review and validation, the status of the Review as of the end January 2023 and stage of decisions by the NOPD in relation to the Open cases.

Annual Statutory Reporting

The ND GR advised the Committee that under the Protected Disclosures (Amendment) Act 2022, the HSE is required to provide a Statutory return to the Minister for Public Expenditure and Reform by the 1 March each year, and prepare and publish a Protected Disclosures Annual Report by the 31 March each year.

The Committee noted the paper previously circulated and it was agreed that the ND GR review the draft Protected Disclosures Annual Report 2022 with a view to considering anything additional that can be added in terms of what we have done, impact and outcomes, and bring back to the Committee at the meeting in March 2023.

There was no further business. The Chair thanked Committee and EMT members and noted that the next meeting of the Audit and Risk Committee will take place on 24 March 2023.

The meeting ended at 13.05.

Terms of Reference: Audit and Risk Committee