BSO 116/2015 23 Oct 2015 Board Corporate Risk and Assurance Report 2015-16 Purpose of this report The purpose of this report is to record changes to the Corporate Risk & Assurance Report made between July and October 2015, and to outline progress made on risk actions. 2 Changes to Corporate Risks New Risks Two new risks have been added to the register since June 2015. Risk number 16 – risk description is “Delays in payroll responding to pension queries may result in fines from the Pensions Regulator”. Risk number 17 – risk description is “If the HRPTS system update fails then i) payroll may become unstable ii) workforce information/data may be corrupted iii) planned developments may be delayed iv) there is a risk of significant reputational damage.” Revised – The following risks have been updated and/or re-numbered with changes shown in red – 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 15, 16, 17 and 18. Removed Risks
Corporate Objective No 1: To Deliver for Money Services to our Customers Report on Board Action Plan Risk Description (Include DATE ADDED) Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 1. Levels of savings in the overall environment for HSC are so great that BSO service provision to customers are negatively affected and/or we fail to breakeven. The Leadership Centre may be particularly affected by a reduced level of client income. Risk Owner(s) DoF CX / Dirs Type of risk: Economic & Financial 4 4 16 High Budgetary Process Breakeven Budget with specified savings programme Latest Best Estimates Service Offering Meetings held with DHSSPS sponsor branch Budgetary Monitoring (I) SMT Accountability to CX (I) External Audit - Report to those charged with Governance (E) Budgetary Control process (I) Directorate Service Team Meetings (I) Financial Accountability Reviews with Directors (I) Financial Management Standard (I) & (E) Risk Reporting & Review (I) CX Review of Dirs Objectives (I) Dept Accountability Review (E) MIPB Assessment BSO has developed a plan which will deliver the RRL savings required in 2015-16. This has been sent to and agreed with DHSSPS. BSO Service Offering 2015/16 has been issued along with SLAs to clients. The Service Offering details cash releasing and productivity savings for the 2015/16 financial year. The actions to achieve both elements of savings have been factored into the BSO Budget for 2015/16 and a balanced budget has been achieved. The BSO 2015/16 budget was approved by Board on 28 May 2015. DoF/ADFM March 2016 Confirmation received 9th February 2015 that BSO’s recurrent RRL funding will be subject to a 15% cut in A number of SLAs have been signed off for 2015-16 (15 of 16). BSO has received no notification of any impact to 2015/16 funding from the negotiations regarding the NI Executive Budget. BSO has received correspondence from DHSSPS on 12 October 2015 regarding the 2016/17 planning process, requesting savings proposals to address a potential 5%, 10% or 15% savings requirement on recurrent RRL funding. A corporate response to this request will be managed through SMT. going
3. Lack of Resources to unlock the business case benefits for Finance, HR, Procurement and FPS Business Systems Replacement. Risk Owner Dir of Ops Dept SRO Type of risk: Financial 3 4 12 High Following completion of Procurement in October 2012 the updated OBC for FPL and systems was approved by DHSSPS and DFP. Revised governance arrangements in place. CXs members of Programme Board and HR & Finance Directors members of Implementation Board. Money released for both systems. Resources identified for FPS systems within HSC ICT budget and OBC approved by DFP. FPS governance transferred to HSC ICT programme. FPL go-live – all organisations September 2013. Gateway 4 (HRPTS) and Dept Accountability Review quarterly (E). Programme Board Reporting monthly (I) Implementation Board monitoring monthly. Technical groups established and meet weekly. Updated OBC for HRPTS & FPL to be submitted and approved before contract signature. Programme Director to work with SRO & Capital Branch to ensure that reserved monies are released as required. Workshops with functional groups will develop work packages including resource requirements. These will be presented to BRP and BSTP Project Boards as developed. Dir of Ops / Benefits Realisation Manager March 2016 BRP Project initiatives continue to progress in line with achieving the BSTP OBC benefits. Plans have been managed and progressed through the BRP Governance structure (BRP & BSTP Project Boards) including reporting and monitoring to unlock the benefits outlined. Throughout this phase there is an increasing risk of losing fixed-term and temporary staff prior to projected programme close-down in March 2016.
Risk Description (Include DATE ADDED) Current Risk Controls Assurances Action By Whom End Date Comment L I S Rate 4. BSO will face the risk of legal challenge and/or financial loss under new legislation, the Late Payment of Commercial Debt Regulation 2013, which requires 30 day payment of supplier invoices. Risk Owner All Directors Type of risk: Political, Economic, Legislative / Statutory, Financial, Legal, Performance management , Customer/Citizen & Risk Added: 12.06.13 4 4 16 High Policies & Procedures; Service Risk Register - Risk Action Plan; Invoice Backlog Team operational from 1st May. Review of existing payment procedures. SMT monitoring; Risk reporting & review; Corporate Scorecard to monthly. SMT oversight of actions to reduce aged invoices. Directors December 2015 Teams continue to address. Prompt payment figures improved across HSC in April 2015 with an average of 92% paid within 30 working days. May 2015 average across HSC remained at 92%, June 2015 average was 91.8% and July 2015 average at 90.68%. August 2015 average was 90.61% and September 90.02%. Initiatives including Self-Bill and Cloud Invoicing are being implemented by the Benefits Realisation Project which will improve Prompt Payments. Corporate Objective No 2: To Grow our Services and Customer Base
Report on Action Plan Risk Description (Include DATE ADDED) Current Risk Controls Assurances Action By Whom End Date Comment L I S Rate 5. Shared Services may not achieve business case outcomes. Risk Owner Dept SRO Head of Shared Services Dir of Finance (for charging/funding model) Type of risk: Financial, Physical & Partnership / Contractual 4 4 16 High Feasibility (2007) on Shared Services Programme Project Structure Dept Review Strategic Outline Case (2009/10) – DFP/Dept Assurance Project re-plan presented to BSTP Programme Board on 2nd September 2013 and approval received. Project Board (I) Programme Board Reporting (I) DFP/Dept OCB Reviewed (E) SS SS Quality Assurance Group (E) Dept Accountability Review (E) MIPB Assessment Engagement with Senior HSC Officers re design of Shared Services. Public consultation closed end Feb. Ministerial decision announced on 14 May 2012. SMT reviewing the implementation plan & progress on a fortnightly Head of Shared Services March 2016 Benefits Realisation Project established with agreed capital and revenue budgets. Plans have been agreed to deliver OBC benefits by end March 2016. The implementation of Single Pay Frequency initiative has been delayed until April/May 2016 which will impact the full delivery of savings by March 2016.
Corporate Objective No 2: To Grow our Services and Customer Base Report on Board Action Plan Risk Description (Include DATE ADDED) Current Risk Controls Assurances Action By Whom End Date Comment L I S Rate 6. Inability to implement new Shared Service for Payroll, Payments, Income, Selection & Recruitment in line with Departmental timetable and customer expectations. Risk of disruption to services and damage to reputation during period of transition due to system problems and inexperienced staff. Risk Owner Head of Shared Services Dept SRO Type of risk: Partnership / Contractual & Customer/Citizen 5 4 20 Extreme BSTP Governance reporting processes. BSO Shared Services Project oversight by BSO SMT. Project operated Prince methodology. Project re-plan presented to BSTP Programme Board on 2nd September 2013 and approval received. Working Group/Project Boards in place with all organisations to deal with cut over activities SSIG & RIB monitoring Strategic adviser appointed to assist BSO SMT. BSTP Programme Board reporting. PMO & reporting established BSTP Implementation Group – regular reporting and review of progress. Central administration, resources and structures to be agreed. Phased roll-out of shared services dependent on systems roll-out and stabilisation. E-Rec implementation plan currently being rolled out. Head of Shared Services March 2016 FPL team addressing workarounds and areas of functionality not yet delivered by ABS (including line level matching and This will form part of Benefits Realisation work. Payments, Income and Payroll have all completed transition to Shared Services. E-Rec has been fully rolled out. Adoption of the system continues to progress: SHSCT, BHSCT and NHSCT are complete. WHSCT adoption of roll-out commenced May 2015 and have agreed to go live in April 2016. SEHSCT rollout will commence in January 2016 and is expected to be complete March 2016.
Corporate Objective No 2: To Grow our Services and Customer Base Report on Board Action Plan Risk Description Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 7. There is a risk that the NIHSC Interpreting Service will fail to meet its objectives due to an inadequate system of governance, risk management and controls. Risk Owner Head of Shared Services Type of risk: Financial; Technological; Performance management; Customer/Citizen; Risk Added: 17.12.2014 4 4 16 High SMT monitoring; Internal report; Risk reporting & review; Head of Service appointed. Implementation of Internal Audit recommendations underway. Recruitment of staff underway. SLA with HSCB to be agreed and signed. Head of Shared Services November 2015 Remaining recommendations to be implemented upon completion of new IT system. This is now due to be complete in November due to additional requirements having been identified by the project board. Interpreting Service Band 5 Operations in post March 2015. A meeting between Head of Commissioning, HSCB DoF, BSO CX and Head of Shared Services was held on 10th June 2015. A number of actions were agreed to assist in reducing spend e.g. move towards a majority of telephone consultations.
Corporate Objective No 2: To Grow our Services and Customer Base Report on Board Action Plan Risk Description Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 8. BSO Growth may be negatively affected by transfer of NIFRS to Department of Justice. Risk All Directors Type of risk: Financial; Physical. Risk 26.03.2015 4 3 12 Medium SMT monitoring; TUPE of staff. Clarification has been sought from DHSSPS on 17 July 2015 as to the operational effect on BSO. Clarification to be sought on the position of NIFRS staff providing the Pensions service. Confirmation has been received from NIFRS that they do not wish to proceed with the enhanced PaLS service proposals. The Chief Executive has written to NIFRS in July 2015 To be raised on the Accountability Review agenda. BSO currently providing the following services to NIFRS: Internal Audit, PaLS, ITS & Pensions. Staff are entitled to transfer with the work and agreements need to be reached between NIFRS and staff about potential redeployment prior to transfer of work. Pensions SLA has been signed for a period (Sept 17) year
September 2015 seeking clarification around SLA arrangements in light of the move to DoJ. Corporate Objective No 3: To Pursue and Deliver Excellence through Continuous Improvement Report on Action Plan Risk Description (Include DATE ADDED) Current Risk Controls Assurances Action By Whom End Date Comment L I S Rate 9. Inability to implement replacement systems for Finance, HR and Procurement in line with agreed plan. Risk Owner Dir of Ops Type of risk: Partnership / Contractual 4 4 16 High Fully resourced HRPTS and FPL teams in place. Weekly Status Reporting system in place for HLC AXON an AXON contractors. Integrated regional Implementation Board established with members drawn from all key stakeholder groups. Programme Risk Register and Report regular reviewed by Programme Board. Quarterly Dept Accountability Review (E) Monthly Programme review Implementation Board monitoring resource plans monthly FPL, HRPTS and Integrated technical groups in place Self-Assessment Gateway Review (I) Gateway Review (E) CX Review of Dirs Objectives (I) BRP systems enhancement initiatives are ongoing. E-Rec implementation plan currently being rolled out. Dir of Ops / Benefits Realisation Manager March 2016 March 2016 FPL and HRPTS (excl now fully live across HSC. E-Rec has been fully rolled out. Adoption of the system continues to progress: BHSCT and NHSCT are complete. WHSCT adoption of roll-out commenced May 2015 and have agreed to go live in April 2016. SEHSCT rollout will commence in January 2016 and is expected to be complete March 2016.
Corporate Objective No 3: To Pursue and Deliver Excellence through Continuous Improvement Report on Board Action Plan Risk Description (Include DATE ADDED) Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 10. is a risk to BSO reputation and customer satisfaction due to the limited resource available to support Trusts in undertaking Social Care procurements. Risk Owner Dir of Ops Type of risk: Social; Partnership / Contractual; Legislative / regulatory; Customer/citizen; Financial; Risk Added: 29.01.15 3 3 9 Medium Additional resources deployed through PaLS framework for specialist procurement support to ensure services are supplied to HSC organisations. HSCB led Task and Finish Group was established to address prospective changes to EU Directives and UK Legislation and resource limitations. BSO PaLS to engage with DHSSPS in an effort to secure adequate funding to support the current arrangements forward. HSCB produce a Task & Finish Group report. Dir of Ops and AD PaLS met with HSCB CEx on 6 July 2015 to progress the issue. A report was subsequently brought to and discussed at the Regional Procurement Board on 24 July 2015. The matter remains unresolved and correspondence was drafted for BSO CEx to issue to HSCB CEx. Following a meeting between HSCB and BSO on 30 September, a revised options appraisal is being submitted to HSCB and subsequently the AD PaLS Jan 2016 BSO PaLS funding has been secured from the Department for 3 WTEs to provide procurement advice and support on tenders based on capacity; however dependencies remain on the HSCB Task & Finish Group. The Task & Finish Group report recommends the ongoing role for BSO PaLS in supporting HSC organisations. The Task & Finish Group also recommends additional support from BSO PaLS and funding for this remains a significant barrier to progress and is as yet unresolved.
Regional Procurement Board (January 2016) Corporate Objective No 3: To Pursue and Deliver Excellence through Continuous Improvement Report on Action Plan Risk Description (Include DATE Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 11. Benefits of the new system fail to be realised due to: 3 4 12 High Operational & Service Review Group to manage prioritisation and execution of fixes and change controls FPS Project Board (Benefits Realisation) will monitor the progress and consider means of increasing uptake if necessary (a) FPS has planned training events and will use roadshows and other meetings with contractor and their representatives to promote the benefits to contractor of using the portal; (b)FPS to gain commitment from HSCB to encourage contractors to use the portal; (c)FPS to develop an interim contingency plan to resource system impacts in the of contractors not using the portal. Prioritised list has been presented to ITS and is Dir of Ops March 2016 FPS has gone live for all three elements – Pharmaceutical, Dental and GP payments. Work is progressing on resolution of issues identified within the new Dental system particularly in respect of Prior Approvals. A backlog of work has accumulated due to the system not transmitting messages to contractors. There may be an adverse impact upon patients’ oral health. The issue of Prior Approvals is stated as a Divergence in the Annual Governance Statement 2014-15. An action plan to address the backlog was approved by the Project Board on 12th June 2015. Progress has been made and continues to be monitored on a weekly
Corporate Objective No 3: To Pursue and Deliver Excellence through Continuous Improvement Report on Board Action Plan Risk Description (Include DATE ADDED) Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 12. Failure of key ITS Applications & Infrastructure impacting delivery of Critical Services to Customers. 3 4 12 High Security Procedures; Testing of Business Continuity Plan; Change Control Process; Internal Audit (E) External Audit (E) SMT Review of ICT Programme (I) Systems Risk Assessment (I) Additional assurances Dir of Finance/ Dir CCP June 2015 A full Disaster Recovery (DR) test was completed in May 2015 based on a scenario of having to evacuate Centre House and carry on
13. Fail to implement robust information governance process. Risk Owner Dir of HRCS Dirs Type of risk: Legislative / Regulatory & Performance Management Transfer of information as a conduit organisation (especially medical files 3 3 9 Medium Policy & Procedures Information Governance / Records Mgt CA Standard Audit Control Risk Register/ Action Plans A range of IG policies renewed and agreed at August, September & October 2013 Board meetings. New IGMG sub-group established to review the new standard and compare with the current standard. Assessment by Internal Audit February 2014 and development of action plan. Audits of record management policies underway as part of IG Improvement Plan to March 2016). (a) Guidance to be sought from ICO on how to manage sensitive medical information in transit CAS Assessment - Records Management /ICT/Governance (I) & (E) Information Governance Group Report (I) Service Risk Reporting & Review (I) GAC Audit Control Review (I) other CA Standards Assessment (I) & (E) Mid-Year Assurance Statement / GS (I) GAC Report (I) CX Review of Dirs Objectives (I) New draft Information Management Controls Assurance Standard has been issued by DHSSPS who have asked HSC organisations for comments. Audit planned for Autumn 2013 (I) Regular progress reports to SMT/Board regarding action plans (I) IG update to new Business Committee (Aug 2015). Ensure regular update on Data Protection and refresher training is available. Action plan being implemented and evidence gathered on ongoing basis. Regular progress reports to SMT. BSO to communicate with Info Owners to advise that all medical to be checked before DoHRCS Apr -Mar 2016 DoHRCS Apr -Mar 2016 BSO self-assessed as Substantive Compliance for in line with DHSSPS expectations. BSO to carry out periodic checks of files in transit. Internal Audit assessment of the Information Management Controls Assurance standard is due to be completed Autumn 2015. 15
Corporate Objective No 3: To Pursue and Deliver Excellence through Continuous Improvement Report on Board Action Plan Risk Description (Include DATE ADDED) Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 14. Pressure from organisations to deploy mobile and hand held devices compromises overall HSC security and increases the risk of access to systems and records Risk Owner Dir of HRCS Dirs Type of risk: Legislative / Regulatory; Technological; Customer/citizen; Risk Added: 29.01.15 3 4 12 High HSC Security Policy; HSC organisations code of connections; Completion of report into the security implications of recent requests; Discussion with HSCB/DHSSPS led to understanding of shared data guardian roles and HSCB issuing a new HSC ICT Security Policy. HSCB to organise a regional meeting to address this with a view to developing an effective system to protect information which has the support of BSO and all of HSCNI. DoHRCS September 2015 Meeting of Trust SIROs to review the output of ANSEC report was held on 29th April 2015. Unfortunately this meeting was not well attended by the SIROs and the outcome was inconclusive because of this poor attendance. Sean Donaghy is to set up a further meeting and to ensure SIRO attendance at this.
Corporate Objective No 3: To Pursue and Deliver Excellence through Continuous Improvement Report on Board Action Plan Risk Description (Include DATE ADDED) Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 15. Risk to Data Centres from unstable hospital power / environment may cause further outages. Risk Owner Dir of CCP Type of risk: Technological, Environmental, Physical & Partnership /Contractual Risk Added: 12.12.12 4 5 20 Extreme Security procedures Business Continuity Plan. SIB has appointed a Project Director for the Data Centres. Protectors have been installed and are operational. Gartner sub-group to reconvene with revised remit to include strategic direction for transfer of data to 3rd data copy. Gartner technical work streams. An SLA has been agreed with BHSCT Estates for support of the regional data centre. Disaster Recovery Plan Review of all elements of SLA to be carried out. ITS going to competitive Head of Infrastructure and Architecture May 2013 To approval date This Annual Review is underway. Work with Belfast Estates to implement UPS back-up for the air con units has been cancelled due to inability to acquire space in BCH and RVH sufficient to house required equipment. Work is completed to transfer 350 Terabytes of data to secure 3rd data copy for retention in Centre Subscription to HP Mobile Data Centre solution has been implemented on a 2 contract. A full recovery test from third site copy has been completed. The competitive dialogue stage has
Training needs of Payroll staff to be identified and targeted training to be carried out. . complete December 2015. Corporate Objective No 3: To Pursue and Deliver Excellence through Continuous Improvement Report on Board Action Plan Risk Description (Include DATE ADDED) Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 17. If the HRPTS system update fails then i) payroll may become unstable ii) workforce information/data may be corrupted iii) planned developments may be delayed iv) there is a risk of significant reputational damage.” Risk Owner Dir of Ops (as Chair of BRP Project Board) 2 4 8 High Fully resourced HRPTS teams in place. Weekly Status Reporting system in place for the system supplier. Regression testing designed to reflect current business processes Updates provided to Project and Programme Boards Monthly Project Board review UAT exit strategy agreed. Testing to be performed by HSC functional groups First phase of testing completed. Second phase to begin 26 October 2015 Benefits Realisation Manager December 2015 Testing schedule in place BRP Leadership are project managing the implementation and the project risks/mitigating actions, supported by the BST team and IT team.
Type of risk: Partnership / Contractual Risk 20.10.2015 Corporate Objective No 4: To Enhance the Contribution and Development of our People Report on Action Plan Risk Description (Include DATE ADDED) Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 18. BSO current skill mix does not meet future business needs. Risk Owner Dir of HRCS Dirs Type of risk: Managerial / Professional 3 3 9 Medium Revised Workforce Strategy approved by Board February 2014. Job Description/ Personal Specification Staff Survey Review PaLS Skills gaps. Staff development / strong commitment to training. Outcome of HSC Survey (E) Customer Surveys (E) SMT/Board Review of Surveys (I) Staff Appraisal - PDPs (I) CX Review of Dirs Objectives (I) A Sub-group has been established to consider a range of issues in PaLS including workforce issues. Business Case skills. Moving Forward Programme launched. Further work to identify recruitment issues. Workforce Planning ongoing in a number of Directorates. Scoping the direction of several Service Areas on behalf of DHSSPS. Re-accreditation of IIP underway. DoHRCS 2016 Dec 2015 November 2015 Discussions underway with Directors in respect of strategic work plans for the next 3 years. A number of specific skills areas to be addressed. Workforce Plan for ITS due to be finalised September 2015. Action in place for Shared Services
BSO Corporate Risk Score Matrix Total Impact Catastrophic 5 Major 4 2, 17 3,11,12,14 1,4,5,7,9 6 Moderate 3 10,13,16,18 8 Minor 2 Insignificant 1 1 2 3 4 5 Rare Unlikely Possible Likely Almost Certain *Risk Classification / Numbers LOW 0 MEDIUM 5 Risks HIGH 11 Risks EXTREME 2 Risks *in accordance with AS/NZS 4360:2004 guidance
1 1. Levels of savings in the overall environment for HSC are so great that BSO service provision to customers are negatively affected and/or we fail to breakeven. The Leadership Centre may be particularly affected by a reduced level of client income. 3. Lack of resources to unlock the business case benefits for Finance, HR, Procurement and FPS Business Systems Replacement BSO requires confirmation of DHSSPS’s commitment to cover any unanticipated funding pressures within the areas affected, primarily BSTP. Currently engaging with HSC clients re development of Service offering for 2015-16 which will deal with the issue of Management Fees. The issue of reduced funding for the Leadership Centre has been resolved for 2014-15, with a commitment from the Trusts that they will negotiate with BSO regarding any reductions in the Service Level Agreement for 2015-16. Issue of revenue costs for implementation of shared services systems remains unaddressed. Whilst appropriate steps have been taken to resource the BRP team, this continues to be a challenge with BRP Project Manager leaving in December 2014. A new interim Project Manager has been appointed and is in post. 2 6. Inability to implement new Shared Service for Payroll, Payments, Income, Selection & Recruitment in line with Departmental timetable and customer expectations. A review of Recruitment & Selection staffing levels across HSC organisations is underway which will inform a decision on the rollout of Recruitment & Selection Shared Services. W.E.F. 29.01.2015, Shared Services Payroll will be providing payroll & travel across all the HSC. Proposed implementation dates for Bank Reconciliation: – complete SEHSCT – complete SHSCT – complete WHSCT – completed March 2015 BHSCT – completed March 2015 3 9. Inability to implement replacement systems for Finance, HR and Procurement in line with agreed plan. 10. (a) In advance of FPS Replacement System, older more manually intensive systems fail to meet their objectives. 12. Fail to implement HRPTS re-plan activities and contractual discussion still on-going. Relationship with AXON stabilised. SEHSCT, NIAS & NIMDTA – 2 February 2015; BHSCT – 1 April 2015 Draft readiness plans shared with NHSCT for and deployment in May 2015. Dates for WHSCT & SHSCT to be confirmed by Trusts. Dentists have received estimated payments for complex claims valuing approx. 7% of the total payment. User Acceptance testing on the new GP Payment system is drawing to a close.