HSE Audit and Risk Committee meeting minutes 15 September 2023

Members Present

Brendan Whelan (Chair), Michelle O’Sullivan, Pat Kirwan, John Moody, Éimear Fisher and Sharon Keogh

Apologies

Fergus Finlay, Jean Neary (Office of the CEO)

HSE Executive Attendance

Stephen Mulvany (CFO), Dean Sullivan (CSO), Mairead Dolan (Asst CFO), Joseph Duggan (ND IA), Patrick Lynch (ND G&R/CRO), Trevor O’Callaghan (CEO Dublin Midlands Hospital Group), Dara Purcell (Corporate Secretary), Niamh Drew Deputy (Corporate Secretary), Patricia Perry (Office of the Board)

Joined the Meeting

Elaine Kilroe (AND Risk)(Item 3), Rosemary Grey (AND Compliance)(Item 4), Gary Russell (General Manager Protected Disclosures)(Item 4), Joe Ryan (ND OPI)(Item 5), John Swords (ND Procurement)(Item 6.3 & 6.4), Paul de Freine, (ND Capital & Estates)(Item 8), Eleanor Masterson (Acting Chief Architectural Advisor)(Item 8.1), Dr Cora McCaughan (AND Healthcare Audit)(Item 9), Paul Hannon (AND Special Projects & Investigations IA)(Item 9), Damien McCallion (COO)(Item 9.4 & 10.1) and Mike Corbett (AND Acute Operations)(Item 9.4).

Minutes reflect the order in which items were considered and are numbered in accordance with the original agenda. All performance/activity data used in this document refers to the latest information available at the time.

The Chairman welcomed and introduced the three new External Committee members, John Moody, Éimear Fisher and Sharon Keogh to the meeting and remarked that the Audit and Risk Committee was now considerably strengthened as a result.

The Chair held a private session to consider the agenda and papers and the approach to conducting the meeting. Mr Joseph Duggan ND IA joined for part of the private session. The management of the Internal Audit function was discussed with the Committee.

2.1 Conflicts of Interest

No conflicts of interest were declared.

2.2 Minutes

Committee member Pat Kirwan requested an amendment to the minutes of 14 July 2023, and agreed to speak to the CRO and revert back to the Secretariat. The Chair then agreed to review and will respond by email to the Secretariat if amendments accepted.

2.3 Action Log

The process for follow-up on Actions from ARC were agreed.

2.4 Terms of Reference

The Synopsised Terms of Reference were reviewed and deemed appropriate to be sent to the Board for consideration and approval.

2.5 Workplan

The Committee agreed to review the Workplan for 2024 at the October meeting.

2.6 ARC Proposed Meeting Dates 2024

The Committee agreed to the proposed meeting dates for 2024 and that every second meeting would take place in-person. The option of joining in-person meetings via Teams will remain where an individual cannot make the meeting in-person.

2.7 Compliance with Children First

The Chair advised the Committee that the Chair of the People & Culture Committee has agreed to include this item on the Committee’s agenda in October.

2.8 Matters and Papers for Noting

The Committee noted the following papers.

1. Deferral of an Internal Audit of Safeguarding in Disability Services
2. Review of the Ex Gratia Narcolepsy Reimbursement Scheme
3. Memorandum of Understanding between the Charities Regulator and the HSE

Recording of written procedure

The Committee noted that the following Contract Approval Requests had been approved for recommendation to the Board via written procedure on 20 July 2023.

1. CAR - Mini Competition for the provision of HSE/Health Sector provision of electricity supply
2. CAR - Oxygen Products and Services
3. CAR - Mini-Competition for the Provision of Surgical Services
4. Office 365 License Approval – Software One Value Added reseller
5. Provision of Assisted Medical Reproduction (AHR) Medical Services

Elaine Kilroe, AND Enterprise Risk Management joined the meeting.

3.1 Corporate Risk Review Update

The CRO provided an update to the Committee in relation to the Final draft Report of the Corporate Risk Review 2023, which had been circulated in advance.

The Committee noted the updated presentation, which reflected the output and decisions of the EMT taken at their workshop to consider the Review Report which was held on the 12 September 2023, and were presented with the 10 proposals contained in the Report which responded to the findings of the Review.

The Committee welcomed the update.

3.2 Q2 2023 Corporate Risk Register (CRR) Report

The CRO presented to the Committee the HSE Q2 2023 Corporate Risk Register (CRR) Report.

The Committee noted that there are currently 21 risks on the Register, of which 15 are rated High and 6 rated Medium.

The Committee noted that as the Corporate Risk Review is being concluded in parallel with the Q2 2023 Corporate Risk Register (CRR) Report, the Q2 report is “by exception”.

3.3 Risk Management Across Committees

The Committee discussed along with the CRO the plan to review the approach to risk oversight by the Committees of the Board and it was agreed that the Audit & Risk Committee and other Committee Chairs would hold a separate meeting devoted solely to the topic with the CRO and team and report back to Board for consideration of how Risk should be managed at Board level, which would likely include the need for a similar Risk orientation for all Board and Committee members.

AND Enterprise Risk Management left the meeting.

Rosemary Grey, AND Compliance and Gary Russell, General Manager Protected Disclosures joined the meeting.

4.1 Protected Disclosures Report - Half year update January to June 2023

The ND GR presented to the Committee the Protected Disclosures Half year update for the period 01 January to 30 June 2023.

The Committee noted that there were 48 reports received during this time, with 22 assessed as being valid Protected Disclosures (PDs) with 4 closed in this period. Of the 22 valid PDs, 15 were made by HSE employees and 5 by other workers (section 38/39 agency employees or not directly employed by the HSE).

The Committee discussed the Protected disclosures that remain open as of 30 June 2023, and noted that there was a reduction in open legacy cases (2017 – 2022) of 44%, with 52 closed (117 open cases as of the 31 December 2022 compared to 65 for the same period remaining open as of the 30 June 2023). The Committee welcomed that the National Office for Protected Disclosures (NOPD) have engaged with case owners and senior accountable officers to progress cases to completion and/or agree closure paths were possible.

The opportunity for institutional learning arising from the outcome of valid PDs was discussed and the ND GR advised the Committee that an analysis of patterns and learning for matters upheld is planned. The Committee welcomed that the HSE wants to demonstrate the maximum level of openness and transparency about what it has found and the actions it has taken in response to a PD and that the NOPD is currently finalising procedures to ensure a standardised approach to sharing learning.

AND Compliance and General Manager Protected Disclosures left the meeting.

Joe Ryan, ND Operational Performance and Integration (ND OPI) joined the meeting.

5.1 Data Protection briefing on HSE’s Record Retention Policy

The ND OPI provided an update to the Committee in relation to the Implementation of the Healthcare Records Retention Policy, which was a requirement in line with the GDPR regulations and a requirement of the Scally Report.

The Committee noted that the Policy has been substantially rewritten with some issues needing to be resolved in relation to the governance of the policy prior to the development of the Implementation Plan, and that a working group has now been formed to develop and implement the plan over a two year period.

The Committee discussed the key concerns arising from the implementation of the Policy, and the risk that it could take some areas longer to implement then the proposed two years. The ND OPI advised the Committee it is now intended to release the policy in advance of the implementation plan being available, and that the working group will work with regional teams to implement the policy across the services.

ND Operational Performance & Integration left the meeting.

6.1 YTD Expenditure and Q2 Financial Update

6.2 Estimates 2024 - Existing Level of Service (ELS)

The CFO advised the Committee that he would take Item 6.1 and 6.2 together. He provided a briefing to the Committee on the YTD Financial Position as at June 2023. The draft revenue I&E financial position shows a YTD deficit of €656.2m or 6.1%, of this €55.7m is driven by the impact of COVID-19 with the remaining €600.5m relating to core activity. This core variance includes a net deficit of €505.2m in Acute Operations, €11.5m in Community and €172.0m in pension and demand led areas which is slightly offset by a surplus of (€88.2m) in Other Operations / Support Services. The Committee noted that the key priority for 2024 is to reduce the level of financial risk being managed by the HSE, a key element of which is the Financial Control Framework 2023 which will remain a key financial management priority for 2024. Significant additional recurring funding will need to be secured, to maintain existing service levels and this will be a priority over the development of new services.

The CFO presented the Committee with an overview of the Estimates for ELS for 2024, which had been before the Board at their meeting on 13 September 2023. He advised that the financial outlook is showing a year end deficit range of between circa €1.7bn and €2.0bn excluding the 1st charge, compared to the National Service Plan 2023 risk of up to €2.2bn.

He advised that the ELS 2024 bid has two high level components: ELS 2024 – Deficit 2023, recurring unfunded costs arising in 2023 or prior years that are not already funded; and ELS 2024 – Incremental costs 2024, additional costs that are expected to arise in 2024, not otherwise funded. It was noted that it is anticipated that 2024 will be an extremely challenging year throughout the system when factors of demand, inflation and control will again create pressures.

The Committee noted that the submission of the overall ELS bid for 2024 is an iterative process with preliminary drafts of components shared with the DoH in early August. The CFO advised that discussions on the current draft ELS bid between the DoH and HSE shows that they are reasonably aligned around the approach, but noted that while efforts are continuing to reduce the 2023 deficit, supplementary funding to year end will be required and the challenge is to secure as much as possible as recurring funding.

6.3 Procurement Compliance Self-Assessment 2023 – Q1 & Q2 Update

John Swords, ND Procurement joined the meeting. The CFO / ND Procurement presented a paper outlining the status update with regard to the Q1 & Q2 2023 returns based on data received as of 18 August 2023.

It was outlined that 14,612 invoices (€747.2m) were assessed which exceeded the €25k threshold; 84% invoices were returned and 88% declared compliant. The Committee noted that the compliance rate of 88% for invoices greater than €25k for Q1 & Q2 2023 remains broadly consistent with the overall compliance rate of 93% reported for 2022.

It was agreed that Procurement compliance returns will continue to be made and a further update will be provided at a future ARC meeting.

6.4 Contract Approval Requests (CARs)

The Asst CFO and ND Procurement presented to the Committee the following Contract Approval Requests (CARs).

1. Respiratory Therapy Products
2. NAS Intermediate Ambulance Services The Committee considered the detail of the proposed CARs and agreed to recommend to the HSE Board for approval. ND Procurement left the meeting.

7.1 Update on Progress of Internal Controls Improvement Programme (ICIP)

The Asst CFO provided an update to the Committee on the Progress of the Internal Controls Improvement 3 year programme, which is in its final year. She advised that work continues to grow awareness among all staff of the importance of compliant behaviour and the role each individual plays in this regard. The Committee welcomed that significant progress that has been made across the six work streams, notwithstanding the challenges faced in recent years including Covid-19 and the Cyber Attack. The Committee noted that the programme will continue to monitor for positive outcomes and that there will be an increased level of assurance to the HSE’s controls environment.

7.2 Report on 2023 Plan for Review of Effectiveness of System of Internal Control within the HSE – Controls Assurance Process.

The Asst CFO provided an update of the Plan for the Control Assurance Review Process 2023 and that Committee welcomed that it is underway and was reporting to be on schedule.

CSO, Paul de Freine, ND Capital & Estates and Eleanor Masterson, A/Chief Architectural Advisor joined the meeting.

8.1 National Maternity Hospital at St Vincents University Hospital - Proposed Programme Governance Arrangements

The Committee reviewed with the CSO and ND Capital & Estates the paper seeking the Committee’s feedback and approval on the proposed governance arrangements for the National Maternity Hospital (NMH) at St Vincents University Hospital (SVUH) programme, which would ensure that an effective Programme Governance Framework, incorporating project governance, and a performance management and accountability system is in place to deliver the programme in line with approvals.

The Committee considered the revised proposal presented that the HSE will hold primary delivery, commissioning accountability, assurance accountability, and act as the Contracting Authority, and noted that it had been tested and challenged against the key risks that may materialise. The Committee noted that it will require separate teams and the recruitment/employment of external resources with indepth hospital construction expertise. The Committee considered the detail and agreed to recommend the proposal to the HSE Board for their feedback and approval, noting that feedback would also be sought from the HSE Executive Management Team and the Department of Health.

It was also agreed that the Committee would receive an update in the coming months.

8.2 Building Contracts and Properties

The Committee considered the detail for the following proposed contracts and properties, and agreed to recommend the following to the HSE Board for approval.

Contracts:

1. Award of Contract Beaumont Hospital Cystic Fibrosis Unit

Properties:

1. Proposed Lease of Primary Care Centre, Co. Cavan
2. Proposed Lease of Primary Care Centre at Mayfield/Ballyvolane, Co Cork
3. Proposed Lease of Primary Care Centre, Navan, Co. Meath

CSO, ND Capital & Estates and A/Chief Architectural Advisor left the meeting.

Dr Cora McCaughan, AND Healthcare Audit and Paul Hannon, AND Special Projects and Investigations IA joined the meeting.

9.1 Internal Audit Q2 2023 Report

In accordance with the Committee’s Terms of Reference, the ND IA provided a report to the Committee regarding Internal Audit activity, which assists the Committee in discharging its responsibilities to oversee and advise on matters relating to the operation and development of the HSE’s Internal Audit division.

The Committee noted the update in relation to the Internal Audit Plan Status; 30 Reports issued in Quarter 2 2023 including their summaries, 7 Key Reports issued and the Implementation of audit recommendations.

The Committee noted the reports made to Internal Audit under the HSE Fraud and Corruption Policy, and requests for advice in relation to the prevention of fraud and the management of specific fraud risks, and noted the specific issue of PCRS €1m over-claim. The Committee discussed the outstanding recommendations relating to 2014 to 2020 noting that 78% of audit recommendations made in 2022 reports had been closed (implemented or superseded) by 30 June 2023. For 2021, 7% outstanding recommendations were well overdue, and included 26 high rated recommendations.

Finally for the years 2017 to 2020, there were 67 outstanding recommendations, including 19 high rated. The ND IA advised the Committee that Internal Audit is improving the recommendations process, as was previously presented to the Committee in July 2023, and will include a new data repository and reporting tool.

The Committee noted that the outstanding recommendations report provided was similar to the outcome of Q1 2023 and re-inforces the need for improvement in internal controls.

The Committee reiterated their request that respective management of outstanding aged recommendations will be required to report to Committee on audit issues, at the point in time that audit reports are presented to the Committee.

9.2 Internal Audit Planning 2024 - Update

The ND IA advised the Committee that Internal Audit have commenced its audit planning for 2024- 2026 under the core pillars of consultation, analysis and research. The forward audit plan is being developed in consultation with service areas to provide timely, relevant, responsive and risk-based coverage, with the integration of internal audit and Enterprise Risk Management where possible. The Committee noted the high-level approach set out in the paper presented and that Internal Audit has undertaken meetings with EMT members and selected national leads, to gather relevant information to derive possible auditable topics for the audit universe and audit plan. During September 2023, Internal Audit will consult with Hospital Group (HG) CEOs and Community Hospital Organisation (CHO) Chief Officers, after which the NDIA will engage with the Chair and the Committee.

9.3 Internal Audit Plan 2023 - Recalibration

The ND IA advised the Committee that Internal Audit undertook a mid-year review of the approved 2023 Audit Plan which comprised 363 reports relating to 154 audit topics. The review considered the capacity to deliver the plan, risk coverage, assurance coverage, and appropriateness of audit timing. The Committee were updated in relation to the Workplace Relations Commission (WRC) conciliation agreement, and the HSE temporary pause on recruitment.

The Committee were presented with the proposed revised plan, and the rationale and commentary in relation to the deferred/cancelled audits. The Committee noted their concern in relation to the proposed deferral of the audit relating to State Claims Agency/HSE interface, and the ND IA agreed to review the proposed deferral.

9.4 High Earners Review - Action Plan

Damien McCallion, COO and Mike Corbett, AND Acute Operations joined the meeting The Committee reviewed and discussed the paper presented in relation to the High Earners 2022 Review presented by the COO and Mike Corbett, Assistant National Director, Acute Operations which summarised the main issues in relation to High Earners in the HSE and provided an update on the implementation of the High Earners Action Plan.

The Committee welcomed the significant work that has taken place on the matter, and noted that there is a reasonable case for the high earner threshold to be increased from €300k to €500k, due to inflationary and other factors. The Committee noted that eight employees fall into the >€500k category, and seven of the eight relate to the provision of cover to support essential services due to the level of vacancies or shortfalls in the consultant complement. The COO advised the Committee that management will continue to review each case in the context of the safety and quality of the care provided, the health and wellbeing of its employees and the operational and financial sustainability of the service.

The Committee welcomed that HSE management is committed to address the issue of high earners within the organisation and that progress has been made in improving the control environment around consultant pay compliance. The Committee noted that the solutions required to address resourcing, recruitment and retention challenges are likely to be longer term and more strategic in nature.

AND Acute Operations left the meeting.

10.1 Mount Carmel Surgical Hub - Construction Tender Award

The COO advised the Committee that Mount Carmel has been selected as the preferred option for the location of the Surgical Hub facility for Dublin South. The works contract has been competitively tendered and the tenders received reflect the current market rates for this scale of project in the area. The Committee noted that a proposal to bring forward a recommendation to award the contract to the preferred contractor will come before the Committee in due course.

There was no further business. The Chair thanked Committee and EMT members.

The meeting ended at 12.50pm.

Committee members then held a private discussion.

Terms of Reference: Audit and Risk Committee