HSE Audit and Risk Committee meeting minutes 8 December 2022

Members Present

Brendan Lenihan (Chair), Fergus Finlay, Michelle O’Sullivan, Ann Markey, Martin Pitt, Colm Campbell & Pat Kirwan

HSE Executive Attendance

Mairead Dolan (Interim CFO), Dean Sullivan (CSO), Tom Malone (Interim ND Internal Audit), Patrick Lynch (ND G&R/CRO), Dara Purcell (Corporate Secretary), Niamh Drew

Joined the Meeting

Colum Maddox (Asst CFO) (Item 5), John Swords (ND Procurement)(Item 4.6), Rosemary Grey (AND Governance & Compliance)(Item 6.1), Joe Ryan (ND Operational Performance & Integration)(Item 6.2), Brian Long (AND Procurement)(Item 8.1),

Minutes reflect the order in which items were considered and are numbered in accordance with the original agenda.

The Chairman welcomed the Committee members to the meeting and held a private session to consider the agenda and papers and the approach to conducting the meeting.

1.1 Workplan

The Committee approved the draft Work Plan 2023.

2.1 Internal Audit Plan 2023

The Committee met with the ND IA in the absence of management in line with good governance practice.

The ND IA presented to the Committee the Internal Audit Plan for 2023. He advised that this represents a reduction of 19% on the number of audits expected to issue in 2022 (260 audit reports). This reduction is primarily due to an increased focus on strategic audits which are more complex in nature and will require additional audit resource days, the reduction in follow-up audits and the cessation of direct funded agency audits.

The Committee provided guidance and feedback to the ND IA in relation to the overall approach to delivering the audit programme in 2023.

The Committee noted that the plan has been developed to take account of consultation with key stakeholders, specific requests from senior management, the views of the Internal Audit Division, the Corporate Risk Register, the Controls Assurance Process and issues identified in the C&AG management letters.

The Committee welcomed the approach to the development of the plan which provides the HSE with a risk-based assurance on the effectiveness of its risk management, control, and governance processes.

The Committee noted that in compliance with Institute of Internal Audit (IIA) standards, an independent risk assessment was completed using the Corporate Risk Register (CRR) and various internal and external information sources to identify and assess the critical risks that could impact on the HSE’s strategic objectives.

The Committee welcomed and approved the Internal Audit Plan 2023 and noted that the Healthcare Audit Plan, which consists of 33 audit topics comprising of 125 audit reports, representing 45% of the overall plan, will be presented to the Quality and Safety Committee at its January meeting.

2.2 Internal Audit’s Review of funded agencies audit approach

The ND IA and QAIP Manager provided the Committee with an update on the review of the audit process of organisations funded under Service Arrangements (SAs) or Grant-aid Agreements (GAs), by the HSE, which had previously been reported to the Committee. The Committee were advised that the review is near finalisation, and noted that it will be finalised following receipt of the results of the External Quality Assessment which is expected by the end of 2022.

The Committee noted that the review finds that the current audit process of Funded Agencies by the HSE Internal Audit Division is not entirely consistent with the IIA Standards.

The Committee considered the proposed assurance options as presented in the paper, and endorsed the proposal to transfer the performance of compliance reviews of Funded Agencies from Internal Audit to Compliance and noted that to support the transition of this work, resources may be made available from Internal Audit and/or the current co-sourced contract, which provides audit services contracted to produce 20 funded agency audits per annum, to be transferred to Compliance. Notwithstanding this, the Chair of the Committee noted that this report will be an input into an important conversation with EMT, the Board and other stakeholders about the overall framework for audit activity. HSE must retain the ability, under the Service Level Agreement or otherwise, on foot of significant risk indicators or other exceptional circumstances, to initiate suitably structured audit activity where concerns arise about the use of HSE funding in funded agencies or about overall governance of such publicly funded agencies. ARC noted that the first half of 2023 should be used to elaborate on the thinking on what might constitute a suitable approach in this regard.

3.1

No conflicts of interest were declared.

3.2 Minutes

The Committee approved the minutes of the Committee of: 09 November 2022 – Draft Capital Plan 2023 and 10 November 2022.

3.3 Action Log

The Committee reviewed the Action Log.

4.1 YTD Expenditure

The CFO reported to the Committee on the YTD October 2022 Expenditure Summary Report as circulated prior to the meeting noting that the draft revenue I&E financial position shows a YTD deficit of €1,149.9m (€874.4m adverse variance on the COVID-19 reported costs and €275.5m adverse variance on core (Non-COVID 19) related costs. She advised that account must also be taken of National Service Plan 2022 funding, which is yet to be drawn down from the Department of Health, of which there is €118.7m yet to be drawn down in December. As the year has progressed, core (non COVID-19) activities increased and the impact of “delayed” care increased demand for core services resulting in core deficits in Acute and Community services.

It was noted that a number of expenditure items such as the Haddington Road Agreement (HRA), building momentum (New Pay Agreement), 2022 DoH Section 39 inflationary fund and Winter Plan 2022 are as yet unfunded for 2022, and the expected costs are circa €565.9m, will fall to be dealt with as part of any Supplementary Estimate for 2022.

The CFO advised the Committee that the Supplementary Estimate for 2022 was approved by the Select Committee on Health the previous day, and the Opening Statement by Minister for Health was noted by the Committee. She advised the Committee that the 2022 Revised Estimates Volume (REV) for Health is scheduled to pass through the Oireachtas no later than the week ending December 09, 2022.

A discussion took place concerning the Supplementary Estimate which does not provide the HSE with the funding initially sought and may present a funding challenge in CORE activities at the end of 2022.

The Chair advised the Committee that the National Service Plan (NSP) 2023 was adopted by the HSE Board and submitted to the Minister on 10 November for approval. It was noted that a significant amount of work has been completed to assess the level of financial issues and risk to be managed within our services in 2023. These were included in the NSP 2023, which is currently being considered by the Minister.

4.2 Health Budget Oversight Group (HBOG) Minutes

4.3 Update on progress with regards to settling reporting requirements to DoH and DPER – verbal update

The draft minutes of the HBOG meeting of 30 June 2022 as circulated were noted.

The Committee noted that the last HBOG meeting was 17 October 2022. The CFO advised that an inperson meeting of HBOG will take place before the end of the year. She advised that she and her team are continuing to liaise with the DoH.

The Committee emphasised the need to ensure that a set of documented and agreed reporting deliverables and arrangements are operating between the HSE, DoH and DPER, and that a plan and timelines should be set, by the end of January 2023, for the coming year. The Committee outlined their strong view that another reporting season without such an agreed and documented approach should not take place.

4.4 Controls Improvement Update

The CFO presented to the Committee an update on the Controls Improvement Programme (ICIP), which was circulated prior to the meeting, the achievement of which is a key element of the CFO’s balanced score card and is reflected on the Corporate Risk Register (CRR13). She advised that they are mid-way into the three-year programme, the purpose of which is to enhance the overall system of internal control within the HSE and to provide additional assurance as to its adequacy ultimately to the EMT, ARC and the Board. Key to this is embedding controls and compliance within HSE culture and continuing to grow awareness across all sectors of the organisation and its staff of the importance of the HSE controls environment and particularly the roles and responsibilities in relation to compliant behaviours.

She provided the Committee with an overview of the ICIP, which incorporates six key work-stream priorities and presented the current project timelines relating to the work-streams and advised that significant progress has been made despite the impact of COVID-19 and the 2021 Cyber Attack.

The Committee welcomed the update and held a discussion concerning the ICIP and some of the workstreams concerning management resources, the delivery of timelines, and further context required in the appendices, to which the CFO provided the Committee with an update and would take on their comments going forward.

4.5 Special Legislative Accounts

The CFO advised the Committee that in addition to the Annual Financial Statements (AFS) the HSE is required to prepare certain accounts under legislation, and present for consideration and recommendation to the Board the following special legislative accounts, which have been audited by the C&AG:

1. Patient Private Property Accounts (PPP) as required by Health (repayment scheme) Act 2006.
2. Hepatitis C Insurance Scheme Accounts as regulated by the Hepatitis C Compensation Tribunal (amendment) Act, 2006.
3. Long Stay Repayments Account as regulated by Section 18 of the Health Act 2006.
4. Long Stay Donations fund as regulated by Section 11 of the Health Act 2006.

The Committee noted that they had previously reviewed these drafts at their June and July 2022 meetings, and subsequently these accounts had been audited and there have been no material changes to the accounts. The Committee noted the accounts were submitted within statutory timelines and have been audited without any material changes or amendments, and that all 4 sets of accounts were submitted to the C&AG in line with the statutory requirement.

The Committee considered the special legislative accounts and recommended them to the Board for signing as part of the Boards reserved functions. They also nominated the CEO and Chairman to sign the accounts in line with signature protocols as agreed with the C&AG as set out in the paper.

4.6 PPE Audit – Report & Assurance

The CFO and ND Procurement presented to the Committee with an update on the assurance report on the implementation of the recommendations by KPMG relating to the HSE Personal Protective Equipment (‘PPE’) Phase 2 Report on the management and usage of PPE.

The Committee noted that as at November 2022, KPMG had reviewed the recommendations. They are assured that out of the 17 recommendations that were submitted to HSE management on 14 June 2021, 12 recommendations have been fully implemented. Five recommendations have not been fully implemented due to underlying plans not yet being executed, which were outlined as follows:

1. Two of these recommendations were due to be implemented by November 2022. However, they relate to the creation of a new National Emergency Framework which is currently under way and due to be complete by June 2023.
2. Two of these recommendations are reliant on the implementation of a new stock management system which is due to be completed by January 2023.
3. It was noted that the last recommendation is dependent on the implementation of IFMS, which is a longer term plan due for delivery in phases over the coming years.

The CFO advised the Committee that there are 35 HSE actions that have been agreed as required to support the implementation of the 17 recommendations, and of these, 28 are implemented, 4 are in progress and 3 are late. The items marked as in progress or completed or implemented in the report have been assessed by KPMG, whose assurance has been sought.

The Committee welcomed the update and queried the delay in timelines noting that some recommendations that were due to be implemented have now been given timescales of January 2023 and June 2023.

The Committee requested a level of assurance in relation to Recommendation 2: Sourcing Strategy – Emerging Viral Threat Programme, the completion of which is dependent on funding and on the creation of the new Emergency Management Framework which will include an approved plan for PPE management, and requested that an explanation be sought from EMT outlining the reasoning why that date has moved at a significant rate, before bringing this draft report to the Board.

The Committee noted the briefing paper circulated, outlining the statutory and regulatory background to the production of the Annual Financial Statements (AFS), the associated timelines and an overview of any issues which may have a material impact on same.

She advised that under DPERs Code of Practice for the Governance of State Bodies 2016, the HSE is required to produce a draft set of AFS and notes to the Comptroller and Auditor General (C&AG) and DoH within two months of the financial year end, which is 28 February 2023, and will be reviewed by the Committee in March 2023.

The Committee noted the timelines as follows:

• Board adopts AR (including AFS) Wed 26 April 2023
• HSE submits within 21 days which is 16 May 2023
• Minister lays these before the Oireachtas 07 June 2023

The CFO then presented to the Committee an overview of Key Issues that have arisen in the past 2 years and that are reflected in Statement of Internal Control and/or Audit Certificate only, such as Impact of Cyber Attack, Covid 19, the costs of Personal Protective Equipment (PPE), Ventilators and Bad Debt Provision and Procurement compliance. The Committee thanked the CFO for the update and the Chair will provide feedback to the CFO in relation to the presentational layout of the AFS 2023, particularly in relation to the annotations used in the disclosure notes.

5.1 Corporate Risk – verbal update

The CRO provided the Committee with an update in relation to risk management, noting that the Q3 2022 Corporate Risk Register (CRR) report is to be presented to the Board at its December meeting for its annual consideration of the HSE’s principal risks. From 2023 it will be the Q4 CRR Report that will be brought to the Committee and then the Board for approval. This will align the Board’s consideration of the principal risks and its approval process of the Annual Report, including the risk chapter.

He advised that the review of the HSE’s Risk Management Policy is well advanced, and has received a good level of engagement with HSE services and Section 38 / 39 agencies, and that the period of engagement has been extended by 2 weeks to ensure that all feedback is received.

The Committee noted that the review of the Risk Appetite Statement is ongoing and will be concluded in Q1 2023, and Committee members C Campbell and P Kirwan will be meeting separately with the CRO to contribute to the review.

The CRO also advised that the National Risk Assessment for 2023, led by the Department of An Taoiseach, has commenced. The HSE will be making a submission to the process by the closing date of mid-February 2023 and it is expected that the development of the submission will be the first joint risk initiative between the HSE and DoH.

The Committee welcomed the update and noted that from earlier discussions the Internal Audit Plan for 2023 is risk responsive and will include audits relating to risk areas, and it was agreed that deep dives on Corporate Risks which would align with the IA report, would be included in the Committee’s Workplan for 2023. The Chair agreed to hold discussions with ND IA and CRO.

6.1 Compliance Project Final Report

The ND G&R presented to the Committee two documents:

1. The final report of the Compliance Project prepared by KPMG which details the findings from the review of compliance activity, areas of current good practice, key recommendations, the benefits of implementing the proposed compliance framework.
2. The proposed HSE Compliance Framework which is a companion document translating the findings and recommendations from the KPMG Report into a ‘Future State Compliance Framework’.

The briefing note agreed by the Compliance Project Steering Group and presented to the Committee sets out a number of immediate implementation proposals, and proposed next steps.

The Committee held a discussion and noted that implementing this framework represents a significant change to the way in which the HSE manages compliance activity across the organisation, and the achievability will be dependent on a significant organisational commitment which will involve a substantial multi-year programme of work and the assignment of additional dedicated resources both for the Central Compliance Function and for the further development of the First Line of Defence activities.

The Committee recorded their strong endorsement of the framework and recommended it and the implementation proposals to the EMT who will consider the Report and Framework at their meeting on the 13 December. It was agreed that following consideration by the EMT, the report will be brought to the Board in January 2023.

6.2 HSE Records Retention Policy Revision 2022

The ND OPI briefed the Committee in relation to the updated HSE Records Retention Policy Revision 2022, highlighting in particular the work completed to implement the recommendations in respect of the Scally Report and the Irish Data Protection Commissioner's (DPC) Report in 2018. This report highlighted gaps in the implementation of the Records Retention Policy by hospitals and found that the patient charts were held indefinitely, in a potential breach of General Data Protection Regulation (GDPR) and the Data Protection Acts.

It was noted that the HSE Retention Policy aims to serve as a guide to be used for the management of retention periods of records processed by the HSE, and updates the “Record Retention Periods - Health Service Policy 2013” document and sets out the periods for which records should be retained.

The Committee held a discussion in relation to a number of issues that will impact on the implementation of this policy which included resources, IT infrastructure, storage space and capacity of the service, and noted that a transitionary period will be required between the 2 policies due to these complexities.

The Committee welcomed the updated policy, noting that it is imperative that a consistent and effective records policy is adopted, considering that a wide variety of records are held across the HSE including healthcare records, financial records, HR records and general administrative records .

The Committee thanked the ND OPI for the update and noted that the Policy will now be brought to the EMT. They recommended that it be tabled at a future Board meeting.

6.3 HSE Report on Global Health Programme 3-Year Plan, 2022-2024 & HSE Policy on Donation of Medical Equipment and Supplies to Developing Countries and Other Countries in Crisis

The CSO presented to the Committee the following two documents which highlight the important work in supporting developing nations.

• HSE Report on Global Health Programme 3-Year Plan, 2022-2024
• HSE Policy on Donation of Medical Equipment and Supplies to Developing Countries and Other Countries in Crisis

He stated that the main focus of the Global Health Programme 3 Year Plan facilitates the fulfilment of global health priorities in the NSP 2022. The Programme has led a global approach in the HSE, developing and implementing initiatives aimed at improving health in developing countries while also learning from other countries to improve healthcare in Ireland. The main focus of the programme is technical cooperation with developing countries in Africa to improve health services. The Committee noted the paper.

The CSO provided an update to the Committee on the HSE Policy on Donation of Medical Equipment and Supplies to Developing Countries and other Countries in Crisis, which is provided for noting, consideration and recommendation to the Board. The CSO advised the Committee that the Programme leads and coordinates HSE donations of surplus medical equipment and supplies to other countries in need. While all HSE donations are from surplus stocks or decommissioned equipment which would not have a future use in the HSE, there has been no previous HSE policy regarding such donations, including governance arrangements and levels of financial approval required for donating items which have a book value.

The Committee welcomed and approved the policy for onward submission to the Board, and requested that it be amended to reflect that donations in a cumulative financial year above €2m should be presented to the Board for approval. The CSO agreed to this request.

7.1 Draft HSE Property Protocol - Update 2022

The Committee noted the draft HSE Property Protocol to the Committee which has been updated by HSE Capital & Estates and is a key Governance document for all staff involved in the management and delivery of property transactions on behalf of the HSE. The CSO informed the Committee that the review and update of the Protocol is recommended by the Internal Audit Review of Property Leases, and the consideration of the revised Protocol will facilitate finalisation of updates to relevant National Financial Regulations. The protocol sets out the procedures to be followed when the HSE acquires or disposes of a property interest.

8.1 Contracts

1. Contract Approval Request for supply of Cylinder and Bulk Medical gases
   The CFO and Procurement presented an update to the Committee on the Contract Approval Request for supply of Cylinder and Bulk Medical gases, which had previously been discussed at their meeting in November, where the Committee requested assurance in connection to international benchmark figures and insurance policy relating to the Contract. Following consideration of the update given by the CFO, the Committee agreed to recommend the Contract to the Board for approval.
2. Proposed entry into a construction contract for improvement works at a Mental Health Facility, Cork
   The CSO then briefed the Committee on the proposed entry into a construction contract for improvement works at a Mental Health Facility, Cork, which was circulated prior to the meeting. Following consideration and discussion, the Committee agreed to recommend the contract to the Board for approval.

8.2 Properties

The Committee considered the detail for the proposed property transactions, and the Committee agreed to recommend the following to the HSE Board for approval.

1. Proposed granting of lease for property to Voluntary Organisation in Co Galway for a nominal fee.
2. Proposal for Replacement of the Laboratory Facilities at University Hospital Galway and Annex
3. Edenderry Primary Care Centre Change of Location

There was no further business.

The Chair thanked Committee and EMT members and noted that there will be no meeting in January 2023, a gap that facilitates the annual financial reporting cycle, and that the next meeting of the Audit & Risk Committee will take place in February 2023.

The meeting ended at 3.45pm.