HSE Audit and Risk Committee meeting minutes 10 March 2022

Members Present

Brendan Lenihan (Vice Chair), Fergus Finlay, Pat Kirwan, Colm Campbell, Martin Pitt.

Apologies

Ann Markey. HSE Executive Attendance: Ms Geraldine Smith (ND Internal Audit), Mr Stephen Mulvany (CFO), Ms Mairead Dolan (ACFO), Ms Niamh Drew (Secretary), Ms Hannah Barnes.

Joined the meeting

Sharon Cowzer (AFS Manager (item 3.2), John Swords (Head of Procurement) (item 3), Julie Ryan (Head of Business Excellence & Digital Innovation) (item 3.3), Brendan White (Head of Sourcing and Contracting)(item 3.3), Ms Michelle Galvin (AND ICT Audit) (item 4.2), Mr David Kinsella (Deloitte representative) (item 4.2), Ms Charlene Frazer (Deloitte representative) (item 4.2), Mr Dean Sullivan (CSO) (item 5, 6, &7), Patrick Lynch (ND Governance and Risk/ CRO) (item 6 & 7), Rosemary Grey (Manager National Appeals Service and Protected Disclosures Unit) (item 6).

Minutes reflect the order in which items were considered and are numbered in accordance with the original agenda.

The V/Chair welcomed the Committee members to the meeting and held a private session to consider the agenda and papers and the approach to conducting the meeting.

Martin Pitt agreed to formally act as Committee Chair for the purposes of signing the minutes at this meeting. No conflicts of interest were declared.

The Committee approved the minutes of the 3 and 10 February 2022.

2.4 Ethics Disclosures

The Secretary provided an update to the V/Chair on the status of the 2021 Ethics in Public Office Acts returns.

The Governance and Compliance Manager joined the meeting at 13.40.

3.1 Output of Controls Assurance Review Process 2021

The Committee discussed with the ACFO the Control Assurance Review Process 2021 update which was circulated in advance of the meeting.

The ACFO advised that as obliged by the Code of Practice for the Governance of State Bodies 2016, the HSE has undertaken and completed a review of the effectiveness of the organisation’s system of internal control. This update concludes the 2021 Controls Assurance Reporting Process (CARP) and Internal Controls Questionnaire (ICQ).

The ACFO confirmed that the 2021 Controls Assurance testing and external verification process has been completed for all staff and that this process included appropriate enhancements to facilitate current Covid-19 remote working restrictions.

The Committee were provided with an overview of the key findings and recommendations from the review which identified six high priority findings in the areas of; ICT Control Environment, Payroll, Absence of a National Financial System, Procurement, Grants to Outside Agencies, and Local Control & Environment Issues - stock management.

The Committee discussed the ratings and prioritisation of the findings with regards to the handling of Cash. The Committee requested that the reporting details on page 14 of the report is re-worded to highlight the independence of the Internal Audit division within the HSE. It was noted that the review of effectiveness report forms a substantial part of the SIC and is provided to the C&AG In response to questions from the Committee on the learnings from this year’s process the ACFO confirmed that there would be further development of the Statement of Internal Control (SIC) and Effectiveness reports in terms of content, format and focus.

3.2 Health Budget Oversight Group Minutes

The CFO provided a verbal update to the Committee in respect of the current year to date financial position. Additionally, the CFO advised the Committee that a formal note of apology had been received from the DoH in relation to recent media articles and that the HSE considers the matter closed.

However, the HSE and DoH have agreed to work in collaboration to ensure that a clear pathway of communication and reporting is agreed going forward. The CFO agreed to keep the Chair informed as to the status of that ongoing engagement.

3.3 Draft Annual Financial Statements (AFS) including the draft Statement of Internal Controls

The ACFO and the AFS Manager presented the draft AFS for review by the Committee. The Committee expressed satisfaction with the standard of the draft. The draft AFS has been submitted in line with the DPER Code to the C&AG and to the DoH on 28 February 2022 and will be presented to the Board for adoption at its meeting on 25 March 2022.

The Committee discussed key issues impacting the financial statements with the ACFO and AFS Manager including the treatment of PPE inventory, the review of 2020 accruals and provisions and the position in regards to the material potential debtor arising from VAT charges which the HSE considers to be recoverable on the basis of tax advice.

The Committee made some suggestions to the ACFO in relation to the current draft statement of internal control (SIC) which had been circulated in advance of the Committee meeting. The ACFO advised that the statement had been written considering the context of the on-going COVID-19 environment in 2021.

The Committee noted that the Statement of Internal Controls Report was completed and provided to the C&AG and that the final version may be impacted by findings arising from the on-going audit of the 2021 financial statements.

3.3.1 Review and Validation of the HSE Non-Pay Accruals (NPA) AFS 2020

The Committee discussed the briefing document on the Review & Validation of the HSE Non-Pay Accruals (NPA) AFS 2020 which was circulated in advance of the meeting.

The ACFO advised the Committee that the National Finance Division (NFD) had conducted a detailed assurance review of NPA accruals which are a subset of total creditors as at 31/12/2020. The Committee were informed that the review was conducted to provide additional assurance around HSE working capital and cash management processes arising from engagement with colleagues in the DOH and DPER.

It was noted that the review was intended to inform a future work-stream in relation to the preparation for IFMS but was accelerated during 2021 as part of enhanced working capital and cash reporting. The Committee were advised that the review identified that a number of aged prior year accruals and provisions were deemed to be no longer valid and were therefore written back in the draft AFS 2021 and treated as a prior period adjustment. The ACFO noted to the Committee that the majority of the findings were confined to one HSE geographic area incorporating National, Community and Acute Hospital services.

Additionally, the Committee noted that one specific CHO which forms a subset of the geographic area referenced also found over-provisions in the areas of pay and grants to outside agencies which were outside the wider scope of the review.

Following further discussion, the CFO explained that the nature of the resulting adjustment is that it will reduce the level of reported expenditure and not increase it and that no additional funding is required by the HSE as a result of this adjustment.

The Committee asked that consideration be given to providing a more detailed explanation in the notes of the accounts explaining what a prior year adjustment is. The CFO agreed to provide a further update to the Committee focusing on root cause, learnings and recommendations going forward arising from the findings of the review.

Action:

• the CFO will provide further information to the Committee focusing on root cause, learnings and recommendations going forward arising from the findings of the review
• the Committee asked that consideration be given to providing a more detailed explanation in the notes of the accounts explaining what a prior year adjustment is.

3.4 KPMG Tracker Report update

The Committee considered with the Head of Procurement the KPMG Tracker Report update circulated in advance of the meeting.

The Committee noted the contents of the tracker and that the implementation of the seventeen recommendations are ongoing.

It was agreed that a further update will be brought to the Committee outlining actions targets and deliverables for each recommendation.

Tim Hynes, David Kinsella, Charlene Frazer, and the AND ICT Audit joined the meeting at 15:25

4.1 Meeting with Deloitte re ICT Audit

The NDIA with the Deloitte representatives spoke to the Committee on the ICT audit reports overview circulated in advance of the Committee meeting. David Kinsella highlighted the key ICT risks to the Committee including Data Privacy / GDPR, Third Party Contract Management, and Vulnerability Assessments.

One audit area retains an unsatisfactory audit opinion and 4 others have been given a limited audit opinion.

The Committee discussed the key observations outlined within the overview and noted more detailed reports, including agreed actions, had been issued to management.

In response to questions the Committee were informed that both the COVAX and Covid Care Tracker systems were built with cyber security at their core and that both reviews were finalised with a Moderate audit opinion.

Regarding the ICT Contracts Library Review which was given an unsatisfactory audit opinion, the AND ICT Audit informed the Committee that the HSE is currently building a framework and process for a contracts library system to be put in place.

The Committee noted that this would be a value-add activity guided by an overall 3rd party ICT strategy. Overall the Committee expressed concern at continuing low levels of assurance being obtained in this stream of Internal Audit work.

Tim Hynes, David Kinsella, Charlene Frazer, and the AND ICT Audit left at 15:55.

The ND Capital Estates joined the meeting at 16:00

5.1 Property Strategy

The CSO provided a verbal update on the development of the Property Strategy to the Committee. He advised the Committee that work was on track to circulate a draft report to the steering group in the next week and then to the April Committee meeting.

5.2 Properties / Contracts

The CSO assisted by the ND Capital and Estates and the Chief Architectural Advisor briefed the Committee on the following property transactions circulated to the Committee prior to the meeting for consideration.

Following consideration of the detail for each proposed transaction the Committee agreed to recommend the following transactions to the HSE Board for approval:

1. Proposed 10-year lease of Marne Villas, Grangegorman Dublin 7 to WALK Disability Services Support organisation.
2. Proposed 10-year Sub-Lease of 2nd Floor Balbriggan PCC, Balbriggan, Co. Dublin to the Central Remedial Clinic.
3. Proposed 10-year Sub-Lease of Part 2 Unit Swords Business campus, Balheary Road, Swords, Co. Dublin to the Central Remedial Clinic.
4. Contract Award 96-bed Ward Block development at University Hospital Limerick.
5. Disposal of lands at St. Loman’s Mullingar and Annexe 1.
6. Proposed lease of accommodation space at Houston Hall for Ul Hospitals Group.
7. Acquisition of Block A, Galway West Business Park, Knocknacarra, Galway for an enhanced Primary Care Centre.

In discussion with the CSO and ND Capital and Estates, the Committee requested that going forward papers are to include the names of property valuers and other professional service providers used in the process of securing property.

In response to questions the CSO confirmed that the design process and other professional services related to properties are being considered as part of the Property Strategy review and that currently there is a framework for design teams to be chosen from.

ND G&R joined the meeting at 15:55

The Committee reviewed with the ND G&R the briefing on the Protected Disclosure Bill. The ND G&R informed the Committee of the key changes envisaged in the Bill together with an early assessment of the implications for the HSE.

The Committee noted that 2022 Bill expands the definition of those who can make disclosures, the type of wrongdoings that can be disclosed and what is considered to be penalisation of those who make disclosures.

The ND G&R confirmed that the Bill also introduces of criminal offences and penalties including fines and/ or imprisonment. The Committee also reviewed the Protected Disclosures Annual Report 2021 with the ND G&R which was circulated in advance of the meeting.

The Committee noted that in total there were 65 Protected Disclosures received in 2021 compared to 54 received in 2020. In response to questions the ND G&R advised that the figure represents the number of protected disclosures made rather than the amount of protected disclosures open within the system. The ND G&R agreed to bring this information to the Committee.

Actions:

• The ND G&R is to provide the Committee at a future meeting with information on the amount of open Protected Disclosers currently within the system.

The Committee reviewed with the CRO the revised Corporate Risk Register Q1 2022 (CRR) which had been circulated in advance of the meeting.

The ND G&R informed the Committee that a number of the recommendations made by the Committee at its January meeting had been accepted by the EMT and are reflected in the revised CRR. It was noted that the revised CRR links the risks to the HSE’s Risk Appetite Statement.

The Committee discussed with the CRO:

• the inherent risk ratings versus the corresponding residual ratings and how despite controls being in place, both ratings remain the same for some of the risks
• the need to understand the strength of controls and the real impact they are having on mitigating the risk
• whether in addition to the Sláintecare risk, a separate Corporate Plan/ National Service Plan risk should be included
• for many of the risks, action due dates are due for delivery in Q4 2022. There should be some interim milestones throughout the year.

The CRO anticipates further work on developing the register will happen once the new risk team members are appointed.

In response to questions on the advancement of a joint risk assessment with the DoH, the CSO advised that progress has not yet been made on the matter. The V/Chair of the Committee said that he would update the Board on the matter and urged management to agin seek to engage with the Department on same. In the alternative this matter will be escalated to the Board.

The CRO agreed to work with the Vice Chair to agree the allocation of risks to the relevant Board Committees.

The Committee noted that as part of the corporate risk review the Q4 2021 review of the previous risk register was completed and that the review serves as a due diligence exercise on the previous register.

Action:

• the will provide the ARC feedback on the Q1 2022 CRR to EMT members
• the CRO will work with the Vice Chair to agree the assignment of risks to Board Committees
• the CSO and CRO will have further discussions with the DoH in relation to how both organisations can work together on risk.

The ND Strategy and Research joined the meeting at 16:45

The Committee considered with the CSO and ND Strategy and Research the paper outlining the HSE donating surplus PPE to low resource countries, which was circulated in advance of the meeting. The ND Strategy and Research outlined that as part of Ireland’s international development programme in health, the HSE has been donating used medical equipment from Irish hospitals to countries in Africa since 2014 under the EQUALS Initiative, managed by the HSE Global Health Programme.

During 2021, the HSE responded to a range of requests for humanitarian assistance in the COVID-19 pandemic. The Committee noted that towards the end of 2021 the HSE still had large stocks of surplus PPE which would not be used in Ireland within the expiry dates and by coordination through the HSE’s Global Health Programme function donations of such PPE were made in response to specific requests.

The Committee further noted that the HSE’s Service Plan 2022 has committed to continuing to donate equipment and surplus PPE to less developed countries in response to COVID-19. There are plans in place for donations to Tanzania and Kenya in Q1 2022, and requests from other countries will be addressed throughout the year. The Committee discussed the HSE’s governance of donations and the ACFO confirmed that NFR 17 currently provides guidance regarding donations made to the HSE but not by it.

The Committee also discussed the HSE’s response to the Ukraine crisis. The CSO informed the Committee that the CEO is currently chairing the HSE Ukrainian Humanitarian Oversight group, which held its first meeting on 1st March and will meet on a weekly basis to oversee all aspects to the HSE’s response to the current crisis.

Recommended to Board

The CSO provided a verbal update on the progress of the relocation of the National Maternity Hospital to St Vincent’s University Hospital campus at Elm Park. The CSO informed the Committee that engagement is taking place with the two hospitals (NMH and SVHG) in relation to the Legal Framework and Constitution, with input from the DoH, in order to reach a shared position in respect of final draft documents.

The Committee were told that all feedback was due to be received on this day and it would be likely that a special meeting of the Committee would be convened the following week to consider the revised draft documents.

The meeting concluded at 17:20.

Terms of Reference: Audit and Risk Committee