HSE Audit and Risk Committee Meeting Minutes 13 March 2026

A meeting of the HSE Audit & Risk Committee was held on Friday 13 March 2026 at 9.00am, via videoconference.

Members Present

Anne Carrigy (Chair), Yvonne Traynor, Michael Cawley, Patrick Bailey, Éimear Fisher, John Moody and Sharon Keogh

Apologies

Peter Lynch

HSE Executive Attendance

Joseph Duggan (Chief Internal Auditor), Michael Lane (Acting Chief Financial Officer), Joe Ryan (ND Public Involvement, Culture and Risk Management / CRO), Elaine Kilroe (AND ERM), Kate Killeen White (REO Dublin Midlands), Mairead Dolan (Asst CFO), Dara Purcell (Corporate Secretary), Niamh Drew (Deputy Corporate Secretary), Patricia Perry (Office of the Board)

Joined the Meeting

Tim Hynes (Board member and Chair Strategy & Reform Committee), Anne Marie Hoey (Chief People Officer), Brian O’Connell (ND, Head Strategic Health Infrastructure & Capital Delivery), Gareth Morton (ND Procurement), Leonard Clinton (Asst CFO Finance Shared Services), David Langton (AND CCF), Neal Mullen (CISO), Eamonn Hunt (AND National Employee Relations), Eileen Winnington (AND HR Shared Services), Sean Donoghue (Operation Pensions Manager), Teresa Coss (General Manager – Pensions Quality Standards), Pat Healy (ND National Services and Schemes) and Shaun Flanagan (AND PCRS)

Minutes reflect the order in which items were considered and are numbered in accordance with the original agenda. All performance/activity data used in this document refers to the latest information available at the time.

The Chair held a private session to consider the agenda, papers and the approach to conducting the meeting.

2.1 Conflicts of Interest

No conflicts of interest were declared.

2.2 Minutes

The Committee approved the minutes of the 13 February 2026.

2.3 Action Log and Follow Up Items

The Committee reviewed the action log, discussed progress on actions, and requested that all outstanding actions be reviewed with SLT members.

3.1 Committee Discussion with Chief Internal Auditor – In private session

The Committee held a discussion with the Chief Internal Auditor (CIA) in private session and discussed Internal Audit overdue recommendations relating to an Internal Audit and asked for a one page explanation from management. The Committee asked that consideration be given by HSE Procurement to the inclusion of a corporate contracts register.

3.2 Q4 2025 Activity Highlights (IA Reports and IA Recommendations Monitoring)

The CIA provided a report to the Committee which included Audit Activity and Plan Status Q4 2025; Audits commencing; Audits Issued and Key control findings from Audit Reports in Q4 2025; Implementation of audit recommendations at 31 December 2025 and National Performance Indicator; and open recommendations by area.

The Committee noted that 21 audits were commencing in Q1 2026; the update in relation to the Internal Audit Plan Status at 31 December 2025, with 4 audit reports issued and 8 agreed actions in Q4 2025 and a summary of their key findings. The Committee discussed the implementation of audit recommendations, noting 58 recommendations open and 40 overdue for implementation.

The Committee discussed the oversight role of the Committee and asked that the CEO be invited to a future meeting.

3.3 CIA Annual Opinion 2025

The CIA presented to the Committee the Annual Audit Opinion 2025. He informed the Committee that based on the results of internal audit work completed during 2025, that Limited assurance can be provided in respect of the governance, risk management and control systems operating in the subject areas audited and outlined the reasons for his opinion, which were included in the report.

He advised that sufficient and appropriate audit procedures had been conducted and evidence gathered to support the conclusions reached in the audit reports issued in 2025. The conclusions were based on conditions at the time of audit and are only applicable to the HSE.

The Committee reviewed the report presented and acknowledged and commended the good work undertaken by the Internal Audit function. It noted that of the 475 audit recommendations (open and issued during 2025), 417 were closed, with Internal Audit selecting a sample of recommendations reported as implemented and verified the accuracy of the status provided for these by management.

4.1 Pension Abatement in the HSE

The Chief People Officer (CPO) provided an update to the Committee who were asked to recommend to the Board the approval to commence discussions with the Department of Health and the Department of Public Expenditure, Infra-structure, Public Service Reform and Digitalisation (DPER) in relation to issues arising relating to the application of pension abatement of HSE pensioners where the pensioner was in public service employment.

The Committee held a discussion with the CPO and HR officials in relation to the process outlined and the issues for consideration. The Committee were not satisfied with the recommended approach being suggested and did not agree to recommend to the Board. Further information is to be brought back to the April meeting.

CPO and HR officials left the meeting

5.1 HSE National Strategy for Clinical Audit 2026-2030

The HSE National Strategy for Clinical Audit 2026-2030 update was deferred to the April meeting.

6.1 Finance Update

The A/CFO provided a briefing to the Committee on the YTD Financial Position as at 31 January 2026, noting that the HSE is over the overall expenditure budget by €54.4m / 2.3%, (deficit of €71.0m Department of Health (DoH) and surplus of €16.5m Department of Children, Disability and Equality (DCDE)). He advised that if January spend levels were to continue for the remainder of 2026, and accounting for other costs yet to happen, expenditure levels are projected to be circa €675m / 2.7% above DoH funded levels. It was noted that the DoH Letter of Determination requires the HSE to produce a plan to reduce agency costs below €720m, and with agency expenditure at €70.6m at the end of January, this will need to decrease in order to meet this ceiling.

The A/CFO reported on the closing cash-at-bank position of €4.5m across all revenue accounts at end February 2026, with HSE Revenue utilised €5m capital funding at month-end in order to pay State Claims, these funds were returned to Capital on 02 March 2026.

The Committee noted that each Region has developed a comprehensive agency savings plan with defined actions to address total spend within the prescribed allocation, and that non-pay savings plans are scheduled for discussion at the March meeting of the Board.

The Committee outlined their concern that expenditure overall is ahead of budget in January, emphasised the importance that the rate of expenditure will need to be reduced to ensure breakeven by year end, and that focused oversight to the Committee on the delivery of Savings Plans to ensure early identification of risks to delivery be provided.

The ND Procurement provided the Committee with an update on Procurement Savings, noting that between 01 January 2025 and the start of March 2026, 236 central contracts have been put in place which are estimated to generate net savings of €169.8m over the timeline duration of the contracts and a net saving YOY for 2026 vs 2025 of €26.9m.

6.2 Draft AFS (including draft SIC)

The Asst CFO presented to the Committee the draft Annual Financial Statements (AFS) for review. The Committee noted that the draft AFS have been submitted to the C&AG on 27 February 2026 in line with the DPER requirement and will be presented to the Board for formal adoption in line with the Health Act at its meeting on 25 March 2026.

The Committee noted the draft Statement on Internal Control (SIC) and the draft AFS 2025 reporting Revenue I/E deficit of €1,000.3m (including First Charge from 2024) actual in year deficit of €239.5m and Capital I/E Deficit of €29.2m, including the impact of the first charge from 2024.

The Committee were advised that the audit is on-going and the accounts will not be considered final until the audit has concluded and any material changes that may arise have been considered and actioned. It is expected subject to the progression of the C&AG audit that the final draft will be brought to the SLT, ARC and the Board in May and any material changes to the AFS and disclosures will be explained.

The Committee agreed to endorse the draft AFS including SIC for onward submission to the HSE Board for consideration and adoption.

6.3 2025 Review of Effectiveness of System of Internal Control within the HSE – Controls Assurance Review Process

The Committee was presented with an update in relation to the 2025 Controls Assurance Review Process (CARP) by the Asst CFO and noted the key findings of the review which identified two high priority and five medium priority findings noting that development plans to improve controls continue to be progressed in all areas, and where relevant will be included and discussed in draft SIC 2025.

The Committee highlighted the need on continuing focus in improving controls across the organisation, and increasing and expanding the breadth of participation with the CARP.

6.4 Private Health Insurance DPER Sanction

At the request of the Committee at the January and February 2026 meeting, the Asst CFO advised the Committee that additional assurance work was undertaken and that the conclusion of the issue that arose in the hospital was isolated and that corrective controls have been implemented locally to prevent recurrence at that site.

The Committee noted the further assurance received and asked that an insurance billing review and private patient under-recovery be included as an initiative in the Non-Pay Savings Programme for 2026.

The Committee considered the details presented and agreed to recommend to the Board for approval.

6.5 Update re duplicate payments

Mr Leonard Clinton, Asst CFO joined the meeting

The Committee received an update on the review and investigation of potential duplicate payments, and noted the actions taking since the February meeting. The Committee noted that the review and investigation of the potential duplicates in years 2025, 2024, 2023 & 2020 has been completed by Finance Shared Services with 73% of all monies recouped.

As requested by the Committee previously, the Asst CFO advised that a review of the top 100 vendors that submitted duplicate invoices in Q4 2025 had been completed and provided an update to the Committee.

The Committee noted the action plan going forward which included the approval to establish a Payments Services Overpayments and Creditor Reconciliation team with a focus on implementing preventative measures to reduce the risk of overpayments going forward and to complete an expanded lookback process to review potential historic overpayments. Focus on further enhancing its duplicate invoice reporting capabilities is also planned, which includes fuzzy matching and to assess whether there may be evidence of unusual patterns of expenditure and possible fraud.

The Committee held a discussion with the Asst CFO and asked that consideration be taking with regard to the recoupment of savings being brought back to the Centre’s budget; and the reasons for invoices delayed relating to POs in Vendor Invoice Management to be progressed with the PTP improvement group.

6.6 Procurement Compliance (Progress of self- assessment of non- compliant procurement

Gareth Morton (ND Procurement) joined the meeting

Further to the February meeting, the ND Procurement advised the Committee he had communicated to the Regions with regard to the low level of response rates.

The Committee noted the update from the ND Procurement in relation to Full Year 2025 procurement compliance self-assessment returns completed as at 16 February 2026, which achieved a return rate of 100% (by value) and an improved compliance rate of 95% versus 91% reported for 2024. A snapshot of the 2025 random sampling returns below €25k taken on 16 February 2026 shows a return rate of 96% (by value) and a compliance rate of 84% (80% 2024) by value. The ND Procurement advised the Committee that this gives a confidence level of circa 97%, and that users can continue to access the Procurement Assessment Compliance Tool (PACT) system to reach the target 100% return rate for full year 2025.

The Committee discussed the reasons why procurement is undertaken without following the appropriate procedures, noting that full (100%) compliance is required. The Committee further advised that if non-compliance continues, the ND Procurement should identify and highlight the relevant areas, and management will be requested to attend a Committee meeting to provide an explanation.

Committee members requested the National Director Public Involvement, Culture and Risk Management (ND PICRM) to consider the emerging situation in the Middle East from a Corporate Risk perspective and report back to the Committee.

6.7 Contract Approval Requests

The CFO and ND Procurement presented to the Committee the following Contract Approval Requests (CARs):

1. Provision of Salesforce Licences, Implementation Services, Development and Support for the National Immunisation Information System (NIIS)
2. Single Supplier Framework for the supply of Bulk Liquid Fuels to the Irish Public Sector
3. National Hospital Medicine Management System

The Committee considered the details of the proposed CARs and agreed to recommend (ii) Single Supplier Framework for the supply of Bulk Liquid Fuels to the Irish Public Sector to the Board for approval.

With regard to the remaining two contracts relating to the (i) Provision of Salesforce Licences, Development and Support for the National Immunisation Information System (NIIS); and (iii) the National Hospital Medicine Management System; the Committee were not satisfied to recommend these two contracts for Board approval and requested further clarification on both to be brought back to the April meeting.

Neal Mullen, David Langton (AND CCF) joined the meeting

7.1 Corporate Risk Briefing R007, Cyber Security Update

Board member and Chair of the Strategy & Reform Committee, Tim Hynes joined the meeting.

The CISO provided the Committee with an update in relation to Corporate Risk Register R007, Cyber Security. The Committee noted the papers circulated in advance of the meeting which included updates on: the January CISO Cyber Posture Summary; Cyber Security Initiatives Progressing in 2026; and Independent Assurance.

The Committee discussed with the CISO the recommendations implemented from the Conti Cyber Attack post incident review, the Application Modernisation programme; the Cyber Security report; Cyber event investigations particularly Third Party Compromise; Scenario planning for cyber attacks and business continuity planning.

It was agreed that a discussion with the Strategy and Reform Chair, an ARC member, CISO and CRO take place with regard to 3rd party risk; and that the ARC Chair and Strategy and Reform Chair would discuss the allocation of cyber risk to Committees.

7.2 Governance pathway for PCRS including probity and broader strategic work programmes

Pat Healy (ND National Services and Schemes) and Shaun Flanagan (AND PCRS) in attendance

The ND PICRM noted that a governance pathway gap in relation to PCRS was highlighted at the March 2025 Committee meeting, in that, the area had no reporting relationship into any Board Committee despite managing an annual budget of circa. €4billion. The National Director Services and Schemes (ND SS) and AND PCRS attended the Committee meeting. They acknowledged both the request from, and the support provided by the ND PICRM and AND CCF, and delivered an update on the governance pathway for PCRS including probity and broader strategic work programmes.

The ND SS proposed that a half year and an end of year report from the PCRS Probity Unit aligned to the compliance reporting of the Central Compliance Function would be included on the ARC workplan. Also on the broader strategic agenda quarterly reports will be provided which will update the Committee on key programmes including implementation of the Framework Agreement on the Supply and Pricing of Medicines (FASPM) agreement and matters relating the sustainability of the drugs budget; as well as progress with modernisation plans including AI & automation and alignment of PCRS payment systems with national contract agreements with primary care contractors.

The Committee considered and approved the proposal of reporting arrangements.

7.3 Risk Appetite Statement

The AND ERM presented to the Committee the draft 2026 HSE Risk Appetite Statement (RAS) advising that a comparison to the HSE National Service Plan 2026, Corporate Plan 2025-2027 and consultation process with the SLT, the Corporate Risk Support Team (CRST), and a number of further key stakeholders, to determine agreement with the proposed risk appetite levels had taken place. The Committee considered the draft RAS and agreed to recommend to the Board for approval.

7.4 Central Compliance Function - Compliance Reports

1. KPMG Compliance Report Implementation Plan Update
   The AND CCF presented to the Committee the quarterly update in relation to the KPMG Compliance Project Implementation Plan and progress to date. The Committee noted the update and the overview of the recommendations completed since the January 2026 meeting.
2. Principal Compliance Obligations Metrics (PCOR) Q4 2025 & associated PCOR Metrics Report
   The AND CCF presented the Principal Compliance Obligations Register (PCOR) Metric Reporting Q4 2025 to the Committee, with 12 obligations listed on the PCOR, noting there continues to be significant scope for improvement in compliance rates. The PCOR annual review has been completed with the potential addition of three additional obligations, which were outlined to the Committee.
3. Compliance Obligations Register (COR) Q4 2025 Update
   The AND CCF presented the Compliance Obligations Register (COR) Q4 2025 to the Committee. It was noted that Internal Obligations have increased by 19 (2%) from 840 to 859; and External Obligations have increased by 25 (5%) from 484 to 509.
4. Compliance Assurance Monitoring Plan 2026 Progress Update
   Further to the approval of the Compliance Assurance Monitoring Plan 2026 by the Committee at the December 2025 meeting, the AND CCF provided an update noting that the plan enables the Regions to provide assurances to the Committee relating to activities under its remit. The AND CCF outlined the work that has been progressed to ensure the reviews performed across all 6 Regions are consistent, and reported using a standard template that enables meaningful comparison and conclusions to be drawn.

Brian O’Connell, ND, Head Strategic Health Infrastructure & Capital Delivery (ND SHICD) joined the meeting

8.1 Surgical Hubs

At the request of the Committee at the October 2025 meeting, the National Director for Strategic Health Infrastructure and Capital Delivery (ND SHICD) provided the Committee with an update in relation to the approval of resources for Surgical Hubs. The Committee noted the schedule of accommodation and design of the Surgical Hubs is consistent where possible across the HSE Surgical Hub programme.

The ND SHICD outlined to the Committee the annual activity targets that could be delivered relating to ambulatory procedures, and outpatient consultants when all of the HSE Surgical Hubs are fully delivered and operational. The Committee noted that when the first Surgical Hub opened, the South Dublin Surgical Hub (under under the governance of St. James’ Hospital), it had a target of 3,000 procedures for 2025, but delivered a total of 3,729 patient activities, which exceeded the target by c.24%, which had a discernible impact on waiting lists and waiting times for certain specialties on the St James’s Hospital day case waiting list.

8.2 Capital Planning Expert Group and Capital Planning Steering Group update

The ND SHICD provided an update to the Committee on the Capital Planning Steering Group (CPSG) and the Capital Planning Expert Group (CPEG), noting the number of meetings since the Groups were established in June 2025. Submissions for Capital Proposals and Projects are considered in line with the requirements of the Infrastructure Guidelines published by the Department of Public Expenditure, Infrastructure, Public Service Reform and Digitalisation, as well as Department of Health’s Strategic Healthcare Investment Framework (SHIF) and the HSE’s Capital Projects Manual & Approvals Protocol. The Committee noted the summary overview of the total impact of CPEG Decisions and No. of Proposals / Projects considered by Region.

8.3 Building Contracts & Properties

The Committee considered the details of the following proposed contracts which was presented by the ND SHICD.

The Committee approved the following contract:

• Freehold disposal of Plot 5 at St Brigid’s / St Joseph’s Complex, Ardee, Co Louth to Square United FC

The Committee agreed to recommend to the Board for approval the following contracts:

• Proposed Strategic Acquisition of a property in Dublin 4
• Capital grant to St. Francis Hospice Raheny New In-Patient Unit and Mortuary
• Proposed extension of lease of Primary Care Centre at Galway City West, Seamus Quirke Road, Galway

The Chair thanked the Committee and SLT members. The meeting ended at 1.30pm

Terms of Reference: Audit and Risk Committee