HSE Audit and Risk Committee Meeting Minutes 12 May 2022

Members Present

Brendan Lenihan (Vice Chair), Fergus Finlay, Ann Markey, Pat Kirwan, Martin Pitt, Colm Campbell.

HSE Executive Attendance

Mr Stephen Mulvany (CFO), Tom Malone (Interim ND Internal Audit), Patrick Lynch (ND G&R/CRO), Dean Sullivan (CSO), Mairead Dolan (ACFO), Dara Purcell (Corporate Secretary), Ms Niamh Drew (Deputy Corporate Secretary), Ms Hannah Barnes

Joined the Meeting

Mark Kane (AND Estates) (item 3), Paul de Freine (ND Estates) (item 3), Richard Darke and Shane Dinneen (Archus Representatives) (item 3), Justine McCarthy (EY) (item 3), Julie Ryan (Corporate Procurement Planning & Capacity Development) (item 4), Brendan White (Procurement) (item 4), John Swords (Head of Procurement) (item 4), Sharon Cowzer (GM AFS) (item 5.3 ), John Crean (C&AG Representative) (item 5.1), Andy Harkness (C&AG Representative) (item 5.1), Olivia Somers (C&AG Representative) (item 5.1), Richard Greene (item 10.1 ), Martina Burns (Interim ND AND Acute IT) (Item 10.1), Liam Woods (ND Acute operations) (item 10.1), ), John McQuillan (MedLIS Programme manager ) (item 10.1), Kevin Cleary (AND Compliance Unit) (item 9.1)

Minutes reflect the order in which items were considered and are numbered in accordance with the original agenda.

The V/Chair welcomed the Committee members to the meeting and agreed the papers and the approach to conducting the meeting. Ann Markey agreed to formally act as Committee Chair for the purposes of signing the minutes at this meeting. No conflicts of interest were declared.

The Committee approved the minutes of the 14 April 2022.

1.1 Review of Committee Terms of Reference

The Committee noted the V/Chairman will undertake a review of the Committee Terms of Reference and bring back to the Committee any suggested changes if appropriate. Committee Members were invited to submit suggested changes and comments via email.

The Committee reminded the management and the Secretariat about the importance of papers being supplied to the meeting in a timely fashion to allow for full consideration and review. ARC wishes to eliminate the number of late papers being submitted.

The V/Chair was asked to remind the Board Chair about the need to appoint another Board member as an ARC member under the legislation.

The CSO, ND Estates, AND Estates, Mark Kane, Richard Darch, Shane Dineen, and Justine McCarthy joined the meeting at 13:35.

2.1 Property and Asset Management Strategy

The draft HSE Property Management Strategy was introduced by the CSO followed by a presentation from MK. After the presentation, a general discussion/question and answer session took place.

The Committee discussed with the CSO and team the range of new approaches to transform the existing estate and achieving net zero carbon no later than 2050, including the approach to investing in existing vs new facilities, the approach to prioritisation, the approach to design and manufacture, and to maximising value from data and technology, and how the organisation can build in flexibility and adaptability.

Following the discussion, the Committee welcomed the work done to date noting the purpose and intent of the strategy was sufficiently developed and well-articulated. The Committee suggested, however, more information is required confirming the research and evidence that underpins the strategy.

Agreed next step:

CSO and Capital and Estates to present this body of information to ARC in 2 months. This will include the research, case studies and evidence used for the development of the strategy, currently being collated in the Property Strategy compendium.

Also, the Committee was informed that the strategy includes the use of evidence-based modelling and scenario planning to ensure efficient and effective use of funding. An initial modelling tool has been developed in parallel with the strategy. The modelling tool can apply efficiency factors and demonstrate their benefits if certain change approaches are adopted, shaping and informing how future capital programmes will be delivered. It was agreed the next meeting with ARC will include a presentation of this model and its initial findings.

3.1 Draft HSE Corporate Procurement Plan (2022 – 2024)

John Swords, Julie Ryan and Brendan White joined the meeting for this item.

The ND Procurement and AND Procurement briefed the Committee on the work being done to finalise the HSE Corporate Procurement Plan (2022-2024) which is a requirement under the Code of Practice for the Governance of State Bodies (2016). This plan will set out the key priorities to be delivered over the next three years to improve and enhance procurement activities within the health service and will help address the challenges that currently exist within procurement activities including making available integrated procurement technology that yields actionable spend analytics.

The Committee reviewed the procurement priorities set out in the plan, the arrangements for collaboration with the Office of Government Procurement on common categories, the extent to which capital spend is within the procurement budget and the plans to coordinate and collaborate with all HSE organisations to agree a Multi Annual Procurement Plan (MAPP) aligned to the implementation of the HSE Corporate Procurement Plan by end Q2 2022, and for all participating Section 38 and Section 39 health sector agencies by end Q3 2022.

P Kirwan asked questions about managing the security of supply in the current environment and CFO said he will follow up with him on this following the meeting.

The Committee recommended that the Procurement plan be developed to include more measurable deliverables.

The Committee noted the reference to compliance oversight being a function of the ARC in the document needs to be amended and requested information on the membership and function of the Oversight Group being established to monitor and drive the implementation of the Corporate Procurement Plan.

3.2 Update on findings of Annual Self-Assessment of Competitive/Compliant Procurement exercise

The CFO and ND Procurement reported on the self-assessment exercise under taken as required under the Code of Practice requirement, noting that the 2020 self-declaration was based on a review of all invoices greater than €25k and as part of process improvements the 2021 self-declaration process has been expanded to review all invoices of greater than €20k.

The Committee considered the validated results of SIC 2021 and supporting details of the compliant, competitive, non-compliant and non-competitive procurement. The Committee welcomed the work done in this area noting the findings suggest that the self-assessment of procurement spend on an overall basis was conducted in a robust manner with a low level of error detected. Evidence was provided for 99% of the €444m value requested for validation and 87% of returns sampled. Based on the findings this would appear to indicate a relatively high level of compliance on expenditure above €20k.

The Committee noted however that the HSE continues to have a significant level of non-compliant spend on goods and services and a significant level of non-competitive spend on goods and services. The Committee emphasised that addressing the overall levels of non-compliance/non-competitiveness with the rules and principles governing public procurement declared will require continued investment and effort to drive continuous improvement.

The Committee recommended that the issue of disaggregation of payments to individual suppliers due to multiple systems should be factored into the audit process next year.

The Committee decided that from the period beginning 1 July 2022 it will request a listing of derogations/non compliances to be reported to it in respect of HSE Corporate Centre procurement spending. This will take place in respect of every 6 month period. On a rolling basis more organisational units will be added to this request list.

4.1 Contracts-MedLis

The CIO and the ND Acute Operations spoke to the briefing paper circulated in advance which set out the rationale behind 2 key decisions related to move to vendor hosting and summarised how key issues will be addressed:

1. Move the MedLIS solution from that currently located in HSE datacentre (Clonshaugh) to a vendor hosted offering in their Swedish datacentre on the latest code release. The vendor, Cerner, has explicitly stated that they cannot provide assurance around stability & safety of the HSE Millennium environment in Clonshaugh into the future following the May 2021 cyber-attack
2. Deployment to 3 acute hospitals within the RCSI group, Beaumont, Cavan General and Connolly in the years 2023/2024.

They provided the Committee with a summary of the salient points following multiple reviews of the more detailed proposal submitted and reviewed by the ARC previously. This included challenges with adoption and engagement which can be attributed to project governance and due to the complexity of the proposed move to remote hosting a considered review approach with risk assessment embedded in the process was undertaken commencing June 2021.

The Committee welcomed that changes made in 2021 to strengthen the involvement of the RCSI group in the governance board and to ensure that the project resides with the senior accountability line of Acute Operations, strengthening clinical oversight with a Clinical Advisory Group and a focus within a single Hospital group will address these issues.

Following consideration of the papers, in overall terms the ARC was supportive of the paper and of it proceeding to the Board for the upcoming May meeting, albeit the consensus was that:

1. An updated executive summary would be more appropriate and clearer level of detail for the Board

The CIO and ND Acutes continue to engage with both B Lenihan and T Hynes (Board members) in advance of the Board to give both an opportunity to review updated papers.

4.2 Property transaction

The CSO briefed the Committee on the following property transaction circulated to the Committee prior to the meeting for consideration; Proposed acquisition of the Freehold of the Day Care Centre, Timahoe Road, Portlaoise, Co. Laois.

The CSO noted this is a non-complex proposal for the acquisition of an existing occupied property. There are no budgetary or staff implications for the HSE. The proposal supports healthcare policy and is in keeping with current Government policy. As the acquisition is for a nominal fee of €100, the transaction will acquire HSE Board approval. The Committee agreed to recommend the transactions to the HSE Board for approval.

4.3 Charitable Donation

The Committee noted the briefing paper on this item circulated in advance which set out the background to this voluntary donation of funds by way of an education bursary for nursing and midwifery in recognition of the hard work and the dedication of the 70,000 Irish nurses and midwives in Ireland throughout COVID-19 with a tribute publication entitled The PULSE.

Acceptance of charitable donations over €100,000 is a reserved function of the Board and the ARC agreed to recommend the donation for acceptance by the Board at its next monthly meeting.

5.1 Annual Financial Statements 2021

John Crean, Andy Harkness, and Olivia Somers joined the meeting for this item.

The Vice Chair began discussions by thanking the representatives from the Office of the C&AG for attending and asked them to provide an update to the Committee on the progress of the audit. The Director of Audit confirmed the audit is progressing in line with the planned timelines noting the audit file will be with the C&AG for review next week, and it is expected that a draft audit cert will issue prior to the Board meeting on 27th May, 2022. He informed the Committee there are four accounting issues to be finalised with the Finance team as part of the ongoing audit work - "VAT" Debtor, PPE stock levels, accounting and disclosures relation to prior year adjustment and treatment of certain “ring fenced” funding at year end.

He outlined the potential issue (subject to clearing information requests and discussion with the C&AG) as matters of emphasis in the Audit Cert may be as follows: Non-compliance with procurement rules (as in previous year), PPE expenditure due to the material impairment suffered, DOH Sanction in respect of pay regrading of some Health Care Assistants, there may be a reference to the Prior Period Adjustment of €72m and reference to the “high earners” based on draft IA report.

He noted the C&AG is currently preparing a report on Ventilators and this may be referenced in the cert.

The Committee thanked the C&AG officials for the updated on progress and C&AG officials left the meeting.

The Committee discussed and received an update from the CFO and ACFO on the matters raised by the C&AG as part of the ongoing audit work and the potential issue for the audit cert. The Committee also considered the current draft of the documents which make up the Annual Financial statements 2021. The following papers had been circulated,

• updated paper on significant issues
• draft “final” financial statements and notes to the accounts
• draft statement of internal control (updated)
• draft OFR
• DPER disclosures
• letter of representation

It was noted these documents are still a work in progress. It was agreed a further meeting of the Committee would be arranged for Tuesday 24th May, 2022 to review these documents prior to their presentation at the Board meeting on 27th May, 2022.

The Committee requested that the appropriate messages for public communication regarding the prior year adjustments be circulated to the Committee when finalised as it may be appropriate to include some of this communication in the SIC.

C&AG formal Audit Queries

The Committee noted that replies had issued to the C&AG to his formal audit queries received by the CEO relating to the HSE Payroll sanction and re HSE Financial Statements 2021 – Prior Period Adjustment

The CFO agreed to the request from the Committee that in future the Finance team have a standard approach whereby C&AG requests and correspondence to CEO are shared in a timely fashion upon receipt with ARC for information and advice on the issue raised including into the drafting of any reply by the CEO.

5.2 Financial YTD Expenditure & Health Budget Oversight Group Minutes

The CFO reported to the Committee on the YTD March Expenditure Summary Report as circulated prior to the meeting noting:

• the draft revenue I&E financial position at the end of March 2022 shows an YTD deficit of €250.9m or 4.96%, with a significant element of this being driven by the direct impact of COVID-19
• engagement on the 2022 costs of the HSE’s COVID-19 responses is continuing with both the Departments of Health and Public Expenditure & Reform
• at the most recent meeting of the Health Budget Oversight Group (HBOG), the potential 2022 cost of COVID-19 responses was discussed at length, with particular focus on the 2022 outlook of Acute & Community specific COVID – 19 responses
• the March categorisation of COVID-19 costs is expected to be available by mid-May. Additional sanction requests, totalling €380m, have been submitted to the DoH in order to continue to operate within COVID-19 sanction to the end of May, 31st 2022
• the minutes of the HBOG meetings as circulated were noted

5.3 Chairperson Comprehensive Report

The Committee noted that the Code of Practice for the Governance of State Bodies requires the Board Chairperson to provide a comprehensive report to the Minister in conjunction with the annual report and financial statements.

The draft report set in the format required by paragraph 1.9 of the Code’s Business and Financial Reporting, was considered. It was noted this will be finalised when the AFS including the SIC are agreed. The V/Chair will review with the Board Secretary and ACFO further changes to the letter to reflect the final AFS/SIC documentation. A further version of the letter will come to the next ARC.

6.1 Internal audit Update

The Committee were provided with a verbal update by the Interim ND IA, who outlined that IA is progressing its audit work to provide assurance that the voluntary hospitals have implemented the Mandiant recommendations. IA has completed its fieldwork in 15 of the 17 hospitals. The fieldwork in the remaining two will be completed shortly. The audit work will result in 17 individual audit reports and one consolidated summary report.

IA’s ICT Unit is currently on-boarding Mazars, its new co-sourced ICT audit service provider. Deloitte will finalise the ICT audits they currently have in progress.

IA has recently commenced its risk management audit programme. The first audit will focus on the corporate risk register.

IA has provided individual details/schedules to Acutes to assist them in their work in progressing the management response to the draft high earners report.

IA has recently selected a preferred candidate to fill its Quality Assurance and Improvement Programme Manager Post. The appointment should be completed in the coming weeks. Other vacancies at Grade 7 Auditor and Grade 8 Audit Manager are proving difficult to fill.

Review of Internal audit’s Funded Agencies Audit Approach

ND IA informed the Committee that Internal Audit is initiating a review to determine the appropriateness of its current funded agency audit approach and its consistency with the IIA standards. They will benchmark with experiences from other funders such as Pobal with input from the IIA. The review will commence in June and will take approximately 4 weeks.

The approach was endorsed by the Committee and it was agreed when the review team is in place there will be further engagement with ARC. A discussion followed which previewed some of the feedback that the Committee may provide as input into the review.

7.1 Corporate Risk Update

The CRO provided the Committee with a general update on the ongoing activities relating to the development of the HSE Risk Management Framework including progress on recruitment to establish the central Risk Management Team and building the risk support capacity at EMT level. He informed the Committee that the new General Manager took up post on the 25 April and the Assistant National Director will start at the end of June 2022. Other team members will be recruited once the AND commences. Six of the Grade VIII posts embedded with the EMT members’ teams have now taken up posts.

An introductory in person workshop for new team members was held on the 13 April. Work on the Risk Information System is now almost complete. It is anticipated that it will ‘go-live’ for the Q2 Review in June.

Internal audit are currently scoping four Risk Management - Verification of Controls audits as part of the 2022 audit plan. The audits will seek to provide management with assurance that that controls listed on selected risk registers on the Corporate Risk Register are appropriate.

The Committee welcomed the work being done to develop the risk management capacity within the office of the CRO and at EMT level.

The CRO informed the Committee 2 additional risks had been added to the CRR relating to the Assisted Decision Making legislation and the impact on HSE of the response to the Ukraine refugee situation.

The Committee agreed:

• a joint meeting with the S&Q Committee should be arranged to review claims incident reporting
• it would hold a focused meeting before the end of June at which they will undertake a substantive review of each of the risks on the Corporate Risk Register. Members of the Corporate Risk Support Team (CRO) will join the CRO for this workshop

8.1 Briefing

The Committee noted the briefing paper circulated in advance and welcomed the programme of work set out in the paper the primary purpose of which will be the development of a practical and implementable Governance and Compliance Framework for the health service.

It was agreed the CRO should provide regular reports to the ARC on this programme of work.

The AND Compliance Unit joined the meeting for this item.

9.1 Memorandum of Understanding with the Charities Regulator

The Committee reviewed with the AND Compliance Unit the draft MOU proposed between HSE and the Charities Regulator (CR) based on a template MOU which has been developed by the CR for use with public bodies. In addition the Committee noted that a separate Data Sharing Agreement (DSA) is to be entered into with the CR. The DSA will operate alongside the MOU and it will also allow for any specific data protection concerns to be dealt separate to the MOU.

The Committee discussed the requirement to have the MOU and DSA in place noting a considerable number of the Agencies that are funded by the HSE also have charitable status and matters can emerge - albeit on a very limited number of occasions - that may require disclosure/exchange of information to the CR. Equally, the CR may wish to share a report or other information with the HSE. The experience over recent years is that this is not a frequent occurrence and it is not foreseen that it will be necessary to invoke the MOU on anything near a frequent basis. However, where required, the MOU supported by the DSA and a Standard Operating Procedure (SOP), and overseen by the Compliance Unit, will ensure that it is implemented in a standard manner across the HSE. It will also be a clear demonstration of a good working relationship, cooperation and liaison between both public bodies and to a certain degree will further enhance the HSE’s oversight of relevant funded Agencies.

The Committee welcomed that an SOP is being developed to support the MOU so that any matters that may warrant disclosure of information, where required, to the CR will be handled in a standard manner. The SOP will ensure that matters such as the contractual obligations in accordance with the Service Agreements, GDPR/ Data Protection Act 2018, Protected Disclosures and fair procedures, etc. are addressed from the outset.

The Committee emphasised the need to have an engagement and communication issued to all relevant S38 and S39 Agencies advising them of the MOU, in particular, the background to it and to ensure that they have a full understanding of how it will operate. That communication can be settled when the MOU is at final stage and ready for signing but it would be important.

The Committee requested that the MOU be updated to reflect the role of the ARC and its role in the governance structure, including, to refer matters to the CR without necessarily seeking consent of HSE management.

The Committee noted the MOU and the DSA are at draft stage and agreed it will continue to engage on the development of the documents.

The meeting concluded at 17.45.

Terms of Reference: Audit and Risk Committee