HSE Audit and Risk Committee meeting minutes 14 April 2022

Members Present

Brendan Lenihan (Vice Chair), Fergus Finlay, Ann Markey, Pat Kirwan, Martin Pitt, Colm Campbell.

Board Members

Tim Hynes (item 5.1), Yvonne Traynor (item 6.2).

HSE Executive Attendance

Mr Stephen Mulvany (CFO), Tom Malone (Interim ND Internal Audit), Patrick Lynch (ND G&R), Dean Sullivan (CSO), Dara Purcell (Corporate Secretary), Ms Niamh Drew (Deputy Corporate Secretary), Ms Hannah Barnes (Secretariat).

Joined the Meeting

Prof James Browne (CHI Chair) (item 5.1), Eilísh Hardiman (CHI CEO) (item 5.1), Prof Neil O’Hare (CHI CIO) (item 5.1), Martina Burns (Interim ND AND Acute IT) (Item 5.1), Dean Sullivan (CSO) (from item 5.1), John McQuillan (MedLIS Programme manager ) (item 5.1), Mike Birmingham ( Acting ND Estates) (item 5.2), David Langton (GM IA) (item 6), John Tuohy (Audit Manger IA) (item 6), Joe Ryan (ND OPI) (item 8), Laura Wadding (Deloitte) (item 9).

Minutes reflect the order in which items were considered and are numbered in accordance with the original agenda.

The V/Chair welcomed the Committee members to the meeting and agreed the papers and the approach to conducting the meeting. Martin Pitt agreed to formally act as Committee Chair for the purposes of signing the minutes at this meeting. No conflicts of interest were declared.

The Committee approved the minutes of the 10 March and 14 March.

John Crean, Andy Harkness, Olivia Somers joined the meeting at 13:20.

In accordance with governance best practice the Committee met with C&AG representatives. The V/Chair began discussion by thanking representatives from the Office of the C&AG for the Audit progress memorandum circulated in advance of the Committee meeting.

The Committee discussed the progress of the audit with the C&AG representative. It was noted that the final audit is ongoing and there are a number of key account areas where information and explanations are awaited. These include the final valuation of PPE Inventory, the findings of the procurement self- assessment exercise, a response to a C&AG formal audit query regarding sanction for pay upgrade for a cohort of HSE staff, formal response to audit query on Prior Year adjustment, and final review of material Debtor recognised by HSE.

The C&AG noted to the Committee that the PPE Inventory at year end was calculated on the basis of the lower of net realisable value or cost as consistent with the 2020 position. However, there is some additional analytical work which is being conducted by the HSE finance team which may result in an adjustment to the final financial statements for 2021.

The C&AG also advised the Committee that they have issued a formal query to the CEO in relation to sanction for the upgrading of certain Health Care Assistant (HCAs). This may require consideration in the final Statement of Internal Control (SIC).

With regards to the prior year adjustment the C&AG advised that they are waiting for a formal response through the CEOs office in relation to a formal audit query issued on same. It was noted that the finance team have provided information for audit on same, however, the formal response will be important. The ACFO noted that a formal response is in hand and additionally a final report will be brought to the Committee in May.

The Committee also noted that significant additional audit fieldwork is being conducted in relation to the 2021 accruals as reported in the draft financial statements.

The Committee noted the C&AGs current position in relation to the accounting treatment of a material Debtor related booked by the HSE in relation to VAT payments which the HSE consider to be recoverable based on specialist tax advice.

The Committee further noted the final end of year position as reported in the Capital Income and Expenditure account will be a deficit arising from a template amendment.

The V/ Chair thanked the C&AG representatives for their time.

John Crean, Andy Harkness, Olivia Somers left the meeting at 13:42.

4.2 Annual Financial Statements Key Issues and Judgements

The Committee further discussed with the CFO and ACFO the significant issues and judgements for the AFS 2021 noting the previous discussion with C&AG representatives.

The ACFO further explained that the PPE inventory as at the 31 December has been valued at the lower of cost or net realisable value consistent with 2020 position. Therefore, the movement in inventory valuation since 2020 is made up of actual usage and impairment on the basis of most realistic cost prices provided at December 2021. In response to the questions raised by the C&AG representatives around whether the NRV values provided to the AFS team are appropriate in the light of on-going contracts, it was noted that;

• The HSE entered into specific contracts for masks from Irish suppliers which mean that the effective NRV of these is likely to be the contractual price. The HSE is committed to specific purchases at these contracted prices.
• The draft AFS used 3rd party data which forecasted how much those particular PPE items would cost if purchased from the China market and as such a significant impairment was calculated on that basis

The ACFO noted that a final report on the status of the Prior Year Adjustment review is nearing completion and will be brought to the Committees next meeting. The CFO agreed with the Committee that this report should be discussed with the communications team to ensure appropriate reporting. The Committee again reflected on the importance of the implementation of the IFMS project and noted that the issue should be included appropriately in the SIC 2021. A discussion was had on the future role of the Committee in relation to formal audit queries. The ACFO confirmed that a copy of the formal response will be shared with the Committee.

The ACFO confirmed in response to questions that in regards to the “VAT” Debtor a significant amount of engagement is currently underway with the Supplier with an aim to presenting a formal submission to Revenue to expedite the recovery of this VAT. It was noted that it was the view of the HSE that this recovery is “virtually certain” and therefore an additional “VAT” Debtor has been recognised in the draft AFS 2021. The Committee discussed the HSE’s assurances on the likeness of settling this issue by the signature date. The ACFO confirmed that the HSE has drafted a submission to Revenue on the VAT question if required. The HSE is currently working with the supplier to review and agree a final submission that is agreeable to both parties. The HSE has had external tax advice which has indicated a very high assurance level for recovery of this VAT. The ACFO confirmed that the external advice has been provided to the C&AG. The Committee also requested sight of the advice.

The ACFO noted that the C&AG formal audit query on sanction around pay upgrades for certain HCAs is with the National Director of Human Resources.

Action:

• The Committee requested a copy of the PYA audit query and formal response to same.
• The Committee requested sight of the external tax advice on the “VAT” debtor issue.
• The Committee requested a copy of the formal audit query on HCAS (action ACFO) and a briefing on the response.

4.4 Cost of Care in Public Nursing Home - Arrangement for Audit

The Committee reviewed with the CFO the briefing paper on the Cost of Care in Public Nursing Home - Arrangement for Audit circulated in advance of the Committee meeting. The Committee discussed with the CFO the extract from the DoH letter of Determination (LoD) in respect of 2022. It was noted that the request for a plan to address the cost of care in public nursing homes, in order to reduce the variance between the paid cost of care of the Nursing Home Support Scheme (NHSS) and the actual cost of care, was driven by the significant increase in the difference between:

• The total funding provided via the NHSS scheme to public nursing units for long term care and
• The actual costs incurred by the public units for long term care.

The Committee noted that the approved NSP 22 committed to establishing a practical medium to longterm roadmap to sustainable provision of high-quality care with cost of care and occupancy levels that represent strong public value and that can be justified in any properly evidenced comparison with private long stay care. It is intended that this roadmap will be finalised by the end of the year. The Committee were informed that the initial piece of work is complete which was the carrying out of a detailed analysis of the bed stock in the current 128 Public Community Nursing Units. Validation of this data is ongoing and thereafter the significant work of drawing together the key insights to inform a future roadmap for best utilisation of the bed stock and related facilities will be undertaken. The CFO confirmed to Committee members that the plan for the roadmap’s creation has been communicated to the DoH. The Committee asked that a letter is issued to the DoH to confirm the plan and ensure that a full audit is not expected in addition to the roadmap.

Actions:

• A letter is to be sent to the DoH to confirm the plan for the roadmap and ensure that a full audit is not expected.

4.3 Bank Transfer Update

The Committee discussed with the CFO the paper to the Committee in relation to the HSE’s Migration from Ulster Bank to a new Banking Provider which was circulated in advance of the Committee meeting. The HSE hasreceived formal notification that in December 2022, Ulster Bank will issue a letter to the HSE giving 6 months’ notice of the withdrawal of banking services. Given the complexity of the HSE finance and banking systems it is proposed to begin the task of transferring to a new banking provider as soon as possible.

The Committee was informed HSE Treasury have engaged with HSE Procurement and the Office of Government Procurement regarding the HSE’s banking contract and intend to use the Government framework agreement that has been established with Danske Bank. The Committee noted that the range of credit ratings provided by global ratings agencies in relation to Danske Bank and asked the CFO to consider the benefit of monitoring Danske Banks credit rating over time and consider this in a future HSE’s treasury policy. The CFO agreed to consider this point and to update the Committee on the overall governmental responsibility in relation to the monitoring of banks working with public entities.

Action:

• The CFO agreed to consider this point and to update the Committee on who’s responsibility the monitoring of banks working with public entities is.

4.1 YTD Expenditure, COVID - 19 Flash Report and HBOG Minutes

The minutes of the HBOG meetings on 25 November 2021, 27 January 2022, and 3 March 2022 were discussed with the CFO and noted. The CFO responded to questions advising that the IFMS rollout is expected to be substantially completed by 2023.

The CFO provided a verbal briefing on the YTD finance update noting that the draft revenue I&E financial position at the end of February 2022 shows a YTD deficit of €102.5m or 3.03%, with a significant element of this being driven by the direct impact of COVID-19, as reflected in the €105.5m adverse variance on the COVID-19 reported costs and (€3.0m) positive variance on core (Non-COVID19) related costs. The CFO spoke to the Committee about the outlook for 2022 noting that as the third financial year to be impacted by COVID-19 progress, the ongoing uncertainty has contributed to a significant level of complexity and challenge in terms of managing ongoing financial issues and risks, which will continue to be addressed in so far as practicable during the year. Engagement will continue with the DoH via the HBOG process will be continued and enhanced until this risk has been sufficiently bottomed out and mitigated via any and all available options.

The CSO, CIO, CCIO, Interim AND Acute IT, and Chief Assistant Technical Services Officer joined the meeting at 14:45.

The CHI Chair, CEO and CIO joined the meeting at 15:05.

5.1 Contracts

The Committee discussed with the Executive management team how the CHI EHI will integrate with the overall HSE strategy for EHI across acute hospitals. In response to questions the CIO confirmed that ICT Capital funds are allocated within the overall capital plan in line with the capital requirements. He noted that the acute hospital division are responsible for securing the revenue funding for the programme, but that revenue allocation cannot be made until the service plan 2023. The CIO confirmed that DPER wanted only to progress with an EHR for CHI. As a result of this CHI re-developed a CHI ICT Implementation plan in 2019 to support the procurement and implementation of a separate standalone EHR for CHI.

The V/Chair welcomed the CHI representatives to the Committee meeting and thanked them for their time. The Committee discussed with the CIO and CHI Representatives the briefing papers on the Children’s Hospital Electronic Health Record (HER) procurement and implementation.

The CHI CEO spoke to the Committee on the development of the CHI ICT Implementation plan in 2019 to support a procurement and implementation of a standalone EHR for CHI. This process commenced in December 2019 and concluded in January 2022 with the selection of a preferred EHR vendor, EPIC. CHI is currently going through the process of seeking approval for the selection and to ultimately sign contract and implement the vendors solution within the new national children’s hospital and the connected satellite centres.

In response to members questions the CEO CHI confirmed the government approval was for the New Children’s Hospital only and not part of a wider national solution. The CHI CEO did however note that all the relevant documentation and learnings are available to any public body to draw down upon when they are required.

In response to questions on the functionality and access to the EHR system the CHI CEO confirmed that the system does provide access to external clinicians to access patient records from a remote location. This access will be monitored and controlled by CHI.

The Committee discussed with the CHI representatives the arrangement for oversight and delivery of the HER programme. The Chair of CHI confirmed the Board of CHI was satisfied that it had strong oversight arrangements in place to deliver the project.

In conclusion it was agreed that CHI would provide the Committee with formal written assurances in relation to confirmation that the CHI Board would be responsible for the oversight and delivery of the Electronic Healthcare Record and documentation of CHI’s risk assessment on EHR, including mitigations, key controls and Key Performance Indicators (“KPIs”) to monitor risk. The CEO noted that a key dependency for the successful delivery of EHR is certainty around the opening date for the new hospital and it was noted that National Paediatric Hospital Development Board that has responsibility in this area.

The CHI Chair summarised the outcomes from CHI’s EHR Procurement including updated costs and impacts on the EHR Business Case. The Chair confirmed that the EHR Business Case has been approved by the CHI internal approval pathway which passed through the following bodies: EHR Procurement Working Group, Digital Health Steering Committee, and CHI Board.

The CHI Representatives left the meeting at 15:35.

The Committee reviewed with the CIO and ND Acute Operations the papers circulated in advance of the Committee meeting on the Medlis programme. The ND Acute operations advised the Committee that he had recently taken over as Chair of the Millennium Executive Governance group over this project. The benefits of the programme were outlined and the Committee discussed different aspects of the project, including the need to progress with CERNER over a number of sites, the move to a hosted vendor platform, and the ability for this project to deliver the agreed programme within the agreed resources.

The Committee discussed the need for further clarity and assurances on accountability for the programme. It was agreed that a further paper would be brought to the Committee addressing the clarifications sought by the Committee and further information on the risk management process and considerations for the programme.

Action:

• The Committee requested formal written submissions from CHI in relation to the various aspects discussed about the EHR.
• It was agreed that a further paper would be brought to the Committee addressing the clarifications sought by the Committee and further information on the risk management process and considerations for the MedLIS programme.

5.2 Properties

The CSO briefed the Committee on the following property transactions circulated to the Committee prior to the meeting for consideration;

• Proposed Disposal and Granting of lease of Lands at St. Ita’s Hospital, Portrane, Co. Dublin.
• Proposed 10-year lease of ‘Alvernia’, St. Fintans Campus, Portlaoise, Co. Laois.

Following consideration of the detail for both of the proposed transactions the Committee agreed to recommend the transactions to the HSE Board for approval.

The GM IA, the Audit Manger IA and Yvonne Traynor joined the meeting at 16:05.

6.1 ND IA Update

The V/Chair Committee welcomed the Interim NDIA Tom Malone, who was formally appointed to the role in April 2022. The V/Chair noted that the recruitment process for the permanent position of NDInternal Audit has begun.

The Committee were provided with a verbal update by the Interim ND IA, who outlined that the IA function is currently carrying out large undertakings with audits on all Voluntary hospitals in respect of their implementation of the Mandiant recommendations.

6.2 Audit Reports

The NDIA presented to the Committee the two Audit reports circulated in advance of the Committee meeting relating to High Earners and AFS disclosure note 7. The Committee noted that the audit opinion for one report indicated a satisfactory rating whilst the other had received a draft unsatisfactory rating. The Committee noted that the first report has been finalised and settled and provides clear assurances in the area being considered.

The Second report it was noted was still in draft form and awaited management comment. The Committee discussed the draft unsatisfactory rating noting that in addition to some non-compliances, it also could not confirm compliance in various category of payments, around ‘local agreements. The NDIA informed the Committee that the CEO EMT has set in place a process under the leadership of the Chief Operating Officer to examine the contents of this report and to revert with management comments within 6 weeks.

Following consideration of the unsatisfactory report the Committee agreed to send both reports to the office of the C&AG, noting management comment is awaited with regard to factual content and draft conclusions. The Committee is now considering a request for additional work to be undertaken by the HSE IA function which may include (but not be limited to):

• A review of “local arrangements” particularly the timing and longevity of these agreements.
• More details to be documented about the settling and documentation of these local agreements, the authorisation for payment of these amounts and the attendant accountability mechanisms in place up through the management structure.
• Details of the actions that have been, and/or will be undertaken to recoup amounts that were either overpaid or non-compliant.
• The extension of the scope of the audit to include personnel earning (for example) between €250,000 and €300,000, to assist in more accurately sizing the issues involved in different categories of arrangement.
• Ensure the report is compliant with any data protection requirements.

The Committee agreed to refer the draft report to the Chairs of both the Safety & Quality Committee and the People and Culture Committee. It was also agreed that the report would be referred to the Board for consideration at its April meeting.

Action;

• The V/Chair will share a copy of both audit reports with the C&AG.
• The Committee agreed to refer the draft report to the Chairs of both the Safety & Quality Committee and the People and Culture Committee.
• The Committee agreed that the report would be referred to the Board for consideration at its April meeting.

The GM IA, the Audit Manger IA and Yvonne Traynor left the meeting at 16:58.

7.1 HSE Annual Report 2021 - Noting Risk

The Committee discussed with the CRO the briefing paper on the Risk Management Section of the HSE Annual Report 2021. The CRO advised that this is the third year in which the Annual Report has contained a standalone section on the organisation’s corporate risks. The HSE’s risk profile set out in the report reflects the Corporate Risk Register approved by the Board in November 2021. The revised corporate risks approved in Q1 2022 will be reported in the 2022 Annual Report. In the response to the Committee’s suggestion that further detail on the risk appetite statement be included in the annual report, the CRO agreed to make this amendment.

Actions:

• The CRO is to include more details on the RAS within the risk section of the Annual Report.

7.2 Update on discussion with DoH ref joint work on risk

The CRO briefed the Committee on the discussions he has had with the DoH in relation to joint work on HSE risks, as recommended within the Moody Report, to support the sharing of strategic risk intelligence, assist in understanding the strategic corporate risks of both organisations, and to provide a mechanism for undertaking joint assessments of key strategic risks. The Committee V/Chair emphasised the need to have this engagement with the DoH on joint risk assessments established as a matter of priority, and if required the matter will be escalated.

The ND OPI joined the meeting at 16:55

8.1 Update on the review of Data Retention

The Committee reviewed with the ND OPI the paper on the Data Retention Policy Review circulated in advance of the Committee meeting. In a Hospitals Sector report, the DPC remarked that there was little evidence that processes have been put in place to give effect to the HSE’s 2013 Data Retention Policy by means of an effective data destruction programme. Recommendations were that an internal analysis should be carried out and that proactive steps including the revision of the retention periods were required. The Committee were advised that internal circulation and validation of this policy commenced in November 2020 with stakeholder engagement continuing until May 2021 when the decision was made to suspend this activity as a result of the cyber-attack. The project was re-initiated in March 2022 and will deliver in June 2022.

The ND OPI advised the Committee of the observations made on the Policy review to date which includes that the policy is too long, too complex and hard to maintain. It was also noted that the policy is not in line with other HSE policies and that and retention guidelines need to be simplified and indexed so that stakeholders responsible for policy implementation can access their relevant section easily. The Committee noted the project deliverables and in response to questions the ND OPI confirmed that it is planned that the Committee will have sight off the revised policy in June 2022 after it has been through EMT. The ND OPI also answered questions on implementation of the policy noting that as soon as it is agreed a programme of implementation will be considered.

8.2 Data Breach relating to Cyber Attack

The Committee reviewed with the ND OPI the briefing shared on the data breach relating to the cyberattack in advance of the Committee meeting. The Committee noted the contents of the briefing paper including the legal engagement context and overview, the approach and assessment of the HSE Data impact, the established data exfiltration, and the subsequent data process including the data notification process. The Committee noted that in accordance with its obligations under the General Data Protection Regulations, the HSE will be notifying data subjects that the Cyber-Attack has resulted in a personal data breach that is likely to impact the rights and freedoms of certain data subjects. The Data and Legal Work Stream Team continue to work through the data to finalise the number of data subjects affected and will confirm this to the committee and Board in the coming weeks. The Committee discussed the potential for the DPC to launch a formal inquiry in relation to the cyberattack. It was agreed that the Committee would be kept updated on this matter.

The NDOPI left the meeting at 17:35.

Laura Wadding (Deloitte) joined the meeting at 17:37.

Laura Wadding presented to the Committee on the topic of Sustainability Reporting / EU Taxonomy. The presentation included the latest information from the recently released UN’S Intergovernmental Panel on Climate Change (IPCC) report, the different ways in which enterprises have responded and lead on sustainability, the ESG disclosure landscape, including the introduction of the EU Taxonomy. The Committee discussed the points outlined in the context of the HSE’s own progress on energy and sustainability. It was noted that the HSE wishes to play a leadership role in achieving the carbon emissions reduction targets set out in the Climate Action Plan and in adopting a preventive approach to reducing GHG emissions to reduce the negative impact of climate change on the health of our nation. The CSO advised that work is ongoing to develop and implement a comprehensive strategic plan to address wider decarbonisation of the HSE and noted that this is being led by the Climate Action Steering Group. The CSO agreed to bring a report back to the Committee on this strategic issue.

The V/Chair thanked Ms Wadding for her time, noting the importance of the issue and advised that sustainability will be kept on the Committee’s agenda

No further matters were raised under this item.

No matters were raised under AOB.

The meeting concluded at 18:05.

Terms of Reference: Audit and Risk Committee