HSE Audit and Risk Committee Meeting Minutes 13 October 2022

Members Present

Brendan Lenihan (Chair), Fergus Finlay, Michelle O’Sullivan, Ann Markey, Martin Pitt

Apologies

Colm Campbell & Pat Kirwan

HSE Executive Attendance

Mairead Dolan (Interim CFO), Dean Sullivan (CSO), Tom Malone (Interim ND Internal Audit), Patrick Lynch (ND G&R/CRO), Niamh Drew (A/Corporate Secretary), Patricia Perry, Bridget Moylan (Board Office).

Joined the Meeting

Yvonne Goff (ND)(Item 2.1.1), Brian Long (AND Procurement)(Item 2.1), Martin McKeith (Item 10), Mark Kane (AND Cap & Est)(Item 4), Colum Maddox (Asst CFO) (Item 5), Tim Cummins (Head of Treasury and Capital)(Item 5.2), Colm Waters (Head of Tax)(Item 5.5), Rosemary Grey (AND Governance & Compliance)(Item 8.1), Patrick Farrell & Hermes Peraza (KPMG)(Item 8.1)

Minutes reflect the order in which items were considered and are numbered in accordance with the original agenda.

The Chairman welcomed the Committee members to the meeting and held a private session to consider the agenda and papers and the approach to conducting the meeting.

EMT joined the meeting at 13.15.

Brian Long, AND Procurement joined the meeting.

2.1 Contracts

The CFO and AND Procurement briefed the Committee on the following Contracts circulated to the Committee prior to the meeting.

Following consideration and discussion, the Committee agreed to recommend the following contracts to the HSE Board for approval.

2.1.1

Contract Approval Request (CAR) for the provision of National Ambulance Service Fleet Asset Coordination Centre

2.1.3

Supply of Directly Acting Antiviral Medicines for the National Hepatitis C treatment programme

2.1.4

Contract Approval Request for COVID-19 Stand-Alone Swabbing Managed Service

Swabb – not a contract, contingency in the event of a surge.

The CFO and AND Procurement briefed the Committee in relation to the next two items.

2.1.5

Contract Approval Request (CAR) for the establishment of Intermediate Care Ambulance Services Dynamic Panel Agreements (DPA).

The Committee held a discussion in relation to the HSE seeking to establish eight Dynamic Panel Agreements (DPAs) for a ten year term with a total value of €100m (€10m p.a.), to replace the original Framework Agreements and to regularise the arrangements for the procurement of external ambulance services for the transport of Intermediate Care patients. It was noted that the DPAs will provide significant flexibility compared to the existing Framework Agreements particularly with respect to the duration of the agreements (10 years versus 4 Years), and the ability to add new service providers throughout the term of the DPAs, with a particular focus on understanding the controls that will be in place to attain competitive tension and demonstrate value for money. ARC asked the Head of Internal Audit to note this area for potential testing in IA Plan 2023 given the significance of the potential spend.

Following consideration and discussion, the Committee agreed to recommend the CAR to the HSE Board for approval, but requested that a presentation on the delivery of DPAs be brought back to the Committee in the coming months.

2.1.6

Provision of a Blood Sciences Managed Level Service (MLS) at Cork University Hospital & University Hospital Kerry.

The Committee held a discussion in relation to the HSE entering into a contract for the supply of a Blood Sciences Managed Level Service (MLS) at Cork University Hospital & University Hospital Kerry with Beckman Coulter which at €64.25 million requires Board approval as it is over the €10m threshold.

Following consideration and discussion, the Committee agreed to recommend the contract to the HSE Board for approval, but requested that the CFO bring back to the Committee in the coming months a policy in relation to the merits or otherwise of adopting a national procurement approach to such contracts with the objective of achieving best value for money for HSE.

AND Procurement left the meeting.

2.2 Properties

Yvonne Goff (ND Change & Innovation) joined the meeting.

2.2.1 Elective Care Centres

The CSO and ND C&I provided a briefing to the Committee in relation to the establishment of the Elective Care Centres, and a request to secure the Committee’s input to and endorsement of the Project-Specific Preliminary Business Cases for Cork and Galway, as set out in the briefing papers circulated to the Committee prior to the meeting.

The CSO outlined to the Committee that the establishment of Elective Care Centres is linked to the Corporate Plan Objective 3, to improve scheduled care to enable more timely access and reduce the number of people waiting for services, and that the objective and actions being taking forward to transform services are fully aligned with Sláintecare and the Programme for Government.

The Committee held a discussion and requested that refinements be made to the paper and include comments with regard to governance to be included at the final business case stage, consideration of RHAs, and that a review be done of page 57 of the document in relation to the Engineering Construction Procurement (ECP). The Committee agreed to recommend the paper to the HSE Board once their comments have been included. The CSO agreed to take on the Committees comments and review the paper before it is brought to the HSE Board meeting in October 2022.

The Committee then considered the detail for the remainder of the proposed property transactions, and the Committee agreed to recommend the following to the HSE Board for approval.

2.2.2 Acquisition of land in Dublin 8 and Annexe (x2)

2.2.3 Lease of Primary Care Centre, Graiguenamanagh, Co. Kilkenny

2.2.4 Lease of Primary Care Centre, Lismore, Co. Waterford

2.2.5 Lease of Primary Care Centre, Rosslare, Co. Wexford

3.1

No conflicts of interest were declared.

3.2 Minutes

The Committee approved the minutes subject to changes being made based on feedback from the meeting. The following line to be included in relation to YTD:

‘The Committee raised the longer term sustainability of funding for the health service given demographics, service requirements etc. The CFO said there was an appreciation of this issue and it was under consideration.’

It was agreed that the updated minutes would be circulated to the Committee.

3.3 Action Log

The Chair confirmed that the Action Log would be reviewed at a later date.

Mark Kane AND Capital & Estates joined the meeting.

4.1 Implementation Plan

Further to previous engagement with the Committee at their meeting in September, the CSO and AND Capital and Estates presented the current version of the HSE Capital & Estates Strategy and Implementation Plan.

The CSO advised that a period of implementation planning has been progressed in relation to the delivery of the Strategy’s six key objectives and the Implementation Plan presented to the Committee sets out the resulting planning details. It describes the required governance structures including a Steering Group chaired by the CSO and Project Management Office with responsibility for driving and co-ordinating the Programme’s implementation. This plan details the Programme structure required including the five work-streams, their role, scope and deliverables and the phased approach for delivery.

The Committee held a discussion in relation to the availability of revenue and capital resources which are to be refined as the implementation process is progressed, and that there are ongoing talks with the DoH. Committee members queried if there was anywhere else that had a similar programme as a benchmark. The AND C&E advised that from a workforce planning element there are international learnings specifically in Germany, Denmark and the UK. Also, in UK (NHS) there are elements of the programme that have been advanced (eg – Demand and Capacity analysis, standardised schedules of accommodation, programmatic approach to delivery of capital) but there was nowhere identified that advanced the full scope of the intended HSE Implementation Programme.

The Committee also outlined their request to see the role and financial impact between the public / private sector (e.g. long leases on primary care centres) included, and encouraged the cultural assessment included in the Implementation Plan, and that the culture piece to be forwarded to the People & Culture Committee to review.

The Committee outlined some minor amendments to be made to the Strategy and once amended agreed to recommend the Strategy and Implementation Plan to the HSE Board, suggesting that this approval be for the next 2 year term to allow a ‘base camp’ to be reached where enablers would be put in place and to allow time for progression of discussions with DoH as funder as regards the pathway/visibility of the financial resources to complete the programme out to 2050.

The CSO and AND C&E left the meeting.

5.1 Update on Management Action Plan – High Earners Review - Consultants IA Report

The Chair informed the Committee that a late paper was received for the meeting, but a decision was made to return it because it lacked sufficient information. He outlined his views that the Committee were not receiving a full update in relation to the actions set out to implement the recommendations of the High Earners Internal Audit Report and if they were completed, specifically relating to actions due for end September 2022. CFO to convey the Committee’s views to the EMT and the Committee requested that the CEO/COO attend the Audit & Risk Committee meeting in November with a full update.

5.2 Opening of bank accounts with Danske Bank

Colum Maddox Asst/CFO and Tim Cummins Head of Treasury & Capital (H T&C) joined the meeting

The CFO provided an update to the Committee in relation to the HSE’s current banking service provider, Ulster Bank’s exit from the Irish banking market in early 2023, and that Danske Bank, which is the current banking provider on the OGP framework, has been selected as the preferred HSE banking partner. A project was stood up to transition banking services from Ulster Bank to Danske Bank, which is being overseen by the Asst/CFO and H T&C.

The Project is in 3 waves, and the Committee were advised that their approval in Wave 1 consisted of the Approval of:

• the Danske Composite Mandate
• to Open Bank Account
• update to Main Signatories for Ulster Bank Composite Bank Mandate

It was advised that a Composite Bank Mandate, governing all HSE Danske Bank accounts, outlining the powers of authorisation for banking purposes is required to open the new Danske Bank accounts. The Danske Composite Bank Mandate provides for two categories of signatories on the bank accounts; Main Signatories and Designated Signatories. The Committee held a discussion in relation to this, and agreed that it be forwarded to the Board for approval, with suggested amendments from ARC made to the mandate to reflect the Board’s reserved matters. The Committee requested that CFO ensure that controls and safeguards in relation to assets and HSE officials be documented in the 2nd and 3rd waves when brought back to the Committee.

Head of Treasury & Capital left the meeting.

5.2 YTD Expenditure - To include a breakdown of maximum expenditure limits with Hospital Groups (HGs) and Community Health Care Organisations (CHOs)

The CFO provided a briefing to the Committee on the financial position year to date and the forecast to year end as set out in the briefing papers circulated to the Committee prior to the meeting. She advised the Committee that a briefing in relation to the breakdown of maximum expenditure limits with HGs and CHOs was not available but would collate the data and circulate to the Committee. The Chair outlined his concern that a briefing was not available (despite asking now a number of times), as it was important that the Committee have sight of how strong the controls and limits are at the level of HGs and CHOs, and that immediate assurance is required. CFO to follow up.

Asst / CFO provided the Committee with an update in relation to the YTD Expenditure, he advised that the draft revenue I&E financial position at the end of August 2022 shows an YTD deficit of €844.5m or 6.3% with a significant element of this being driven by the direct impact of COVID-19, as reflected in the €665.4m adverse variance on the COVID-19 reported costs and €179.1m adverse variance on core (Non-COVID 19) related costs. However, when account is taken of COVID-19 related costs, Acute income, bad debts and PNU cost of care issues which are embedded in Core services, this variance reduces to c€94m YTD. He advised that account must also be taken of National Service Plan 2022 funding yet to be drawn down from the DoH. It is also expected that the core (non COVID-19) activities will naturally increase and the impact of “delayed” care will also increase demand for core services.

The Committee held a discussion in relation to the capital expenditure showing at August YTD expenditure of €445.5m against a YTD budget profile of €506.9m which leads to a positive variance against profile of (€61.4m) or (12.1%). Concern was outlined in relation to the “positive”/underspent variance of (€44.2m) in Acute Operations, which is mainly attributable to acute capacity, critical care, diagnostics/laboratories and trauma (€9.1m), National Children’s Hospital (€30.8m) and radiology oncology (€3.1m). The Committee queried if budget is available why are we below target in delivering beds. Chair to liaise with ND Capital & Estates in relation to this.

5.3 Health Budget Oversight Group Minutes

The CFO and Asst/CFO advised the Committee that the HBOG meeting scheduled for 29th September 2022 was deferred, but there is a meeting scheduled for next Monday which is to be held in person and will discuss the run up to year end and 2023.

The Committee discussed further the need for strong exchange of information between the HSE, DoH and DPER which needs to be formalised with an agreed document. The CFO advised that work is ongoing to provide more structure, including a roadmap, which has been delayed due to the Estimates process, but a plan is in place to look at this process after the Estimates are finalized. The Committee indicated that once a schedule of agreed reporting expectations is settled (or if not in the next number of meetings) an invite will be issued to the Assistant Secretary of the DoH to attend an ARC meeting to outline their perspectives or concerns (if any) they may have on the process of reporting of financial results. It is vitally important that we settle agreement on the expectations on HSE at some point in the near term. Asst/CFO to follow up with the DoH.

Asst / CFO left the meeting.

5.5 Tax Submission

Colm Waters Head of Tax joined the meeting

CFO introduced Colm Waters, Head of Tax to the meeting for consideration of this Item, and advised that two papers were being presented to the Committee; 2021 Tax Self Review and Payment to Revenue (Review carried out in 2022 retrospectively), and Cooperative Compliance Framework.

The Head of Tax advised the Committee that the HSE carried out a high level Tax Self Review, in respect of the 2021 tax year during 2022, following on from reviews performed for each of the years from 2011 to 2020. This review was completed on 22nd September 2022 and the paper presented is draft pending consideration by the EMT.

He advised the Committee that the review was conducted based on an agreed risk assessment approach with Revenue under their co-operative compliance framework. The 4 areas specifically requested by Revenue, were Contractors (where there may be doubt as to the employment status); Foreign Agencies (supply of staff where the HSE may have a secondary PAYE liability); VAT (where the HSE is the accountable person i.e. has the obligation to self- account to Revenue for VAT); and PSWT (where the HSE is obliged to withhold tax from payments for professional services).

The outcome of the review resulted in an unprompted qualifying tax disclosure being made to the Revenue Commissioners and a payment of just over €2.1m in underpaid taxes and interest was paid in respect of 2021.

The Committee discussed the key findings of the report and noted that the Payroll Tax settlements to contractors and foreign agencies and the VAT settlement had all shown a decrease from 2020, and were advised that the ongoing steps implemented by the tax team and Finance Shared Services are working, which included the completion of Employee/Self Employed checklists and training webinars.

The Head of Tax advised the Committee that earlier this year, Revenue requested that the HSE make a formal application to enter the Cooperative Compliance Framework (CCF), and received Revenue’s formal acceptance into the CCF on 30th September 2022, the first Public Sector body to be formally accepted. The CCF approach involves Revenue and the taxpayer agreeing actions to ensure tax compliance, but does not limit Revenue’s right to test compliance through audit or other interventions. He advised the Committee that a meeting with Revenue is scheduled for 7th November 2022 and will be able to provide a further update after that. The Chair thanked the Head of Tax for his update and requested that the CFO would provide a further update to the Committee early next year.

The Head of Tax left the meeting.

6.1 National Ambulance Service (NAS) Strategy – Procurement element

The Chair informed the Committee that a paper was received for the meeting, but he decided not to table it at this meeting, and would be discussed at a later meeting.

7.1 Corporate Risk Register – Q3 2022 Report

The CRO presented the Q3 2022 Corporate Risk Register (CRR) Report to the Committee. He confirmed that the advices provided by the ARC at their Corporate Risk Workshop held in July had been considered as part of the Q3 2022 review. The Committee noted that there are currently 19 risks on the Register, of which 12 are rated as Red and 7 as Amber. The CRO highlighted an upward movement in residual risk rating between Q2 and Q3 2022 in relation to CRR06 Major Capital Projects; CRR10 Climate action failure and sustainability; CRR12 Delivering Sláintecare. In relation to CRR19 Displaced Ukrainian Population, the residual risk rating was reassessed from Amber to Red due to continued arrivals from Ukraine, the recent COVID surge and absence of isolation facilities. He advised the Committee that the Department of Housing / Environmental Protection Agency are considering the potential risk of nuclear release in Ukraine and subsequent exposure across Europe. Public Health are involved in this process and it may be necessary to reflect further on this risk when more information becomes available.

The CRO advised the Committee that work is underway on two new risk assessments. These relate to Data Protection and the risks associated with economic uncertainty. In relation to the economic uncertainty risk, the ARC advised that the assessment should also consider ongoing sustainability in the context of the State’s capacity to fund all of the demands on the health service, not only current pressures but potentially unsustainable demands relating to changing demographics, Capital requirements, increasing public expectations, improved [though expensive] therapeutics etc.

The CRO also advised the Committee that the Review of the Risk Management Policy 2017 is continuing.

A discussion took place in relation to the Risk Appetite Statement (RAS), which was approved by the Board in November 2021 and that is due to be reviewed before the end of the year. It was proposed to have a series of meetings with each Committee Chair and ARC members Pat Kirwan and Colm Campbell to capture their views on the current RAS.

A discussion took place in relation to CRR09 Health, wellbeing, resilience and safety of staff, and the Committee was advised that it is planned that the risks associated with violence and aggression will be separated from CRR09, and that a new risk and a detailed risk assessment will be performed in Q4. The Committee requested that the Head of Occupational Health and Safety attend the Committee meeting in November, and the Secretariat are to arrange same.

The Chair advised Committee members that he will be speaking at a Forum with Section 38 / 39 agencies in the DoH in November with regard to the Risk Appetite Statement of the HSE and the learnings from the IA process, and will liaise with CRO and ND IA beforehand.

Rosemary Grey AND Gov & Comp, Patrick Farrelll and Hermes Peraza KPMG joined the meeting

8.1 Governance & Compliance Framework – progress updated

The CSO and ND GR introduced this agenda item and advised that today’s discussion will focus on two papers; the progress update from KPMG on their work in relation to the Compliance Project and next steps for finalising the overall Report; and the review of the draft Compliance Framework and proposed future operating model. The ND GR requested the Committee’s observations prior to the Framework being finalised and submitted for formal approval.

The ND GR then introduced Mr Patrick Farrell, KPMG who presented to the Committee their progress update in relation to HSE Compliance Framework and Operating Model. He outlined that six key objectives were defined by the HSE and delivered by KPMG. In delivering these objectives, they performed over 25 interviews with stakeholders across all core HSE functional departments; reviewed over 100 documents; held multiple workshops with HSE stakeholders; and held weekly steering group meetings Chaired by the ND GR. He outlined to the Committee the progress made against each of the objectives, which included high and medium priorities.

Mr Farrell advised the Committee that addressing the challenges highlighted in the paper presented, will require and be dependent on the implementation of a substantial multi-year change programme, with appropriate resources and strong sponsorship. The proposed Operating Model seeks to apply the three Lines of Defence (LOD) approach to risk management and internal control and proposes the establishment of a second Line of Defence (2LOD) Central Compliance Function (CCF).

Following discussion, the Committee requested that the following be reviewed prior to the final report. An organisational chart that sets out the relationship between the CCF and the First Line of Defence (1LOD) functions, the co-mingling of risk and compliance, the role of the ND GR and how the functions of Risk and Compliance he is responsible for should relate to the EMT/ Board. The report also needs to reflect the Board’s role in providing assurances to the Minister for Health and the resourcing of the CCF to allow work to commence as soon as possible. A number of other minor amendments were proposed which the KPMG Team agreed to reflect on.

The Chair thanked the CSO, ND GR and KPMG for their update and advised them that the Committee was supportive of the framework and once the report and framework is finalised, it should be brought back to the Committee for review and recommendation for approval to the HSE Board.

Patrick Farrell and Hermes Peraza left the meeting.

8.2 Protected Disclosures

The ND GR provided the Committee with a verbal update in relation to Protected Disclosures (PDs). He advised the Committee that Ms Rosemary Grey, AND Governance & Compliance is leading out on Protected Disclosures. The Protected Disclosures (Amendment) Act 2022 has completed the legislative process and was signed into law in July 2022, with the planned commencement date of 1st January 2023. A guidance document is currently in development with Department of Public Expenditure and Reform (DPER). The recruitment process for the Head of the Protected Disclosures Office at General Manager level has been completed. Training is to be provided for relevant PD officials in October / November 2022. The next stage will be the drafting of HSE policies and procedures in relation to the new Act. The Committee discussed how the Act will bring about significant change in how PDs are managed, and involved more detailed requirements on reporting timelines for dealing with PDs, and require more detail annual reporting to the Minister for Health.

The Committee requested a fuller update on Protected Disclosures for the ARC meeting in November 2022.

AND Governance & Compliance left the meeting.

It was noted that the Item Internal Audit’s Review of funded agencies audit approach was removed from the agenda and will be brought to the Committee meeting in November.

9.1 Post Audit Client Survey results

ND IA presented the Committee with the results of the Post Audit Client Surveys. 105 surveys issued to management in July 2022 covering all HSE IA reports issued in the period July – December 2021.58 responses were received by the closing date representing a response rate of 55%. The Committee were satisfied with the response rate.

The feedback from the survey was largely positive, which was welcomed by the Committee. The survey also contained optional questions to seek a more detailed response to outline what they thought worked well and what they thought could be improved upon, to which the ND IA briefly outlined the findings. The Committee asked what was going to be done as a result of the responses and feedback. ND IA stated that conflicting responses were given, and as the IA are concentrating on trends to inform their response to the surveys’ findings, they hope to see a trend following the 3rd survey which will allow them to assess which particular aspects need to be addressed.

The Committee requested to see the survey results split between internal HSE audits and funded agency audits, and to show the committee the results of the first survey again. It was also requested that they return to the Committee with something on the corrective actions that will be taken in response to the surveys. ND IA informed the Committee that IA are working on the Q3 report and will have a substantial pack for the next meeting.

10.1 Progress Update

CSO provided the Committee with an update on the progress of the Children’s Hospital. The expected completion date of the hospital was outlined, as was the budget.

On the Board’s role in relation to the budget for the hospital, it was noted that the budget is set by the Government, and therefore the Board will not be asked to sign off anything at budgetary level. The Chair noted the impact the Children’s Hospital budget will have the Capital Plan, and asked the Committee to make a note of this.

The update was welcomed by the Committee.

The meeting ended 17.05pm, and Committee members held a Private debrief session.

Terms of Reference: Audit and Risk Committee