Corporate Objective No Grow and Develop Report on Board Action Plan Risk Description Current Risk Score Controls Assurances Action By Whom Start – End Dates Comment L I S Rate 4. Shared Services may not achieve business case outcomes. Risk Owner Dir of BSTP Dept SRO Dir Ops Dir of Finance (for charging/funding model) Type of risk: Financial, Physical & Partnership / Contractual 3 4 12 High Feasibility Study (2007) on Shared Services Programme Board Project Structure Dept Review Strategic Outline Case (2009/10) – DFP/Dept Assurance Project re-plan presented to BSTP Programme Board on 2nd September 2013 and approval received. Project Board (I) Programme Board Reporting (I) DFP/Dept OCB Reviewed (E) SS SS Quality Assurance Group (E) Dept Accountability Review (E) MIPB Assessment Engagement with Senior HSC Officers re design of Shared Services. Public consultation closed end Feb. Ministerial decision announced on 14 May 2012. SMT reviewing the implementation plan & progress on a fortnightly basis. AD Shared Services December 2014 is an on-going piece of work being carried out by McClure Watters to review the Shared Services Model and Trust retained functions. Proposal for a Benefits Realisation project received approval at BSTP Programme Board on 7th April 2014. Initial workshop took place with central team on Wednesday 30th April 2014. Work is on-going to finalise PID and approach and resource the team.
Income and Payments centres established with all Trusts except SHSCT & SEHSCT – transition to Shared Services. Payroll – NHSCT, SEHSCT & SHSCT transfers planned for July & September 2014. Recruitment & Selection – new re-plan to be worked up through August 2014. Corporate Objective No Grow and Develop Report on Board Action Plan Risk Description Current Risk Score Controls Assurances Action By Whom Start – End Dates Comment L I S Rate 6. Inability to implement replacement systems for Finance, HR and Procurement in line with agreed plan. Risk Owner 4 4 16 High Fully resourced HRPTS and FPL teams in place. Weekly Status Reporting system in place for HLC AXON an AXON contractors. Integrated regional Quarterly Dept Accountability Review (E) Monthly Programme review Implementation Board monitoring resource plans monthly Implementation in line with FPL corrective plan which was accepted 30th April by RIB and approved on 13th May by BSTP. HRPTS re-plan activities and contractual discussion still on-going. Relationship with AXON stabilised. Dir of BSTP June 2014 project working to revised project plan.
Corporate Objective No Recognise and Embed Excellence & Innovation Report on Board Action Plan Risk Description Current Risk Score Controls Assurances Action By Whom Start – End Dates Comment L I S Rate 8. Failure of key ITS Applications & Infrastructure impacting delivery of Critical Services to Customers. Risk Owner Dir of CCP Type of risk: Technological & Customer / Citizen 3 4 12 High Security Procedures; Testing of Business Continuity Plan; Change Control Process; Testing and planning associated with significant change. Engagement of professional report (Gartner). Internal Audit (E) External Audit (E) SMT Review of ICT Programme (I) Systems Risk Assessment (I) Additional assurances Most of the Gartner actions have been achieved with the remainder Dir of Finance/ Dir CCP December 2014 Gartner Project underway and reporting to BSO Board Additional storage for third copy of data has been deployed within Centre House. Take on of data is currently underway in stages. Confirmation that workshops involving all ITS staff took place. Successful continuity test carried out at the Control Centre in Boucher Crescent on 7th May 2014. BC/DR documentation now moved from being draft to V1 as a live document following the above testing.
Corporate Objective No Recognise and Embed Excellence & Innovation Report on Action Plan Risk Description Current Risk Score Controls Assurances Action By Whom Start – End Comment L I S Rate 9. BSO current mix does not meet future business needs. Risk Dir of HRCS Dirs Type of risk: Managerial / Professional 3 2 6 Low Revised Workforce Strategy approved by Board February 2014. Job Description/ Personal Specification Staff Survey Review PaLS Skills gaps. development / strong commitment to training. Outcome of HSC Staff Survey (E) Customer Surveys (E) SMT/Board Review of Surveys (I) Staff Appraisal - PDPs (I) CX Review of Dirs Objectives (I) A Sub-group has been established to consider a range of issues in PaLS including workforce issues. Business Case skills. Further work to identify recruitment issues. Workforce Planning ongoing in a number of Directorates. DoHRCS June 2014 September 2014 Discussions underway with Directors in respect of strategic work plans for the next 3 years. A number of specific skills areas to be addressed. ITS-SAP skills training. Workforce Plan for ITS commenced; due for completion Summer 2014.
Corporate Objective No 4 To Ensure Good Governance Report on Board Action Plan Risk Description Current Risk Score Controls Assurances Action By Whom Start – End Dates Comment L I S Rate 11. Fail to implement robust information governance process Risk Dir of HRCS Dirs Type of risk: Legislative / Regulatory & Performance Management 2 3 6 Medium Policy & Procedures Information Governance / Records Mgt CA Standard Audit Control Risk Register/ Action Plans A of IG policies renewed and agreed at August, September & October 2013 Board meetings. New IGMG sub-group established to review the new standard and compare with the current standard. CAS Assessment - Records Management /ICT/Governance (I) & (E) Information Governance Group Report (I) Service Risk Reporting & Review (I) GAC Audit Control Review (I) other CA Standards Assessment (I) & (E) Mid-Year Assurance Statement / GS (I) GAC Report (I) CX Review of Dirs Objectives (I) New draft Information Management Controls Assurance Standard has been issued by DHSSPS who have asked HSC organisations for comments. Audit planned for Autumn 2013 (I) Regular progress reports to SMT/Board regarding action plans (I) Ensure regular update on Data Protection and refresher training is available. Frequency of IGMG meetings increased Following assessment, action plan to be developed and monitored by IGMG. Discussion with HSCB / DHSSPS on impact of greater deployment of mobile devices and access to DoHRCS Apr -Mar 2015 DoHRCS Apr -Mar 2015 Project Plan in process of implementation. Initial assessment of BSO compliance with standard for 2013-14 indicates ‘moderate’ compliance as required by DHSSPS. Discussion with HSCB/DHSSPS led to understanding of shared data guardian roles and HSCB
Transfer of information as a conduit organisation (especially medical relevant to FPS & Legal) (a) Guidance to be sought from ICO on how to manage sensitive medical information in transit systems such as ECR. BSO to communicate with Info Owners to advise that all medical to be checked before forwarding to BSO. BSO to carry out periodic checks of files in transit. issuing a new HSC ICT Security Policy.
Corporate Objective No Ensure Good Governance Report on Action Plan Risk Description Current Risk Score Controls Assurances Action By Whom Start – End Dates Comment L I S Rate 12. A significant project to change Fermanagh addresses will impact on approx. 15,000 addresses in the area which will affect HSC information systems and patient contact. This could result in a patient not receiving a cancer screening invitation. Risk Owner Dir of Ops Type of risk: Performance management, Environmental, Partnership / Contractual & Customer/Citizen 2 5 10 High FPS Staff recording changes to GP practice addresses in order that they can be reviewed when postcodes are issued by Post Office end March 2013 Links developed with other Government Agencies Link established with Fermanagh District Council HSC Group established and action plan developed In house system developed enabling searches to be carried out of the pointer address file Permanent Secretary has written to Fermanagh District Council; AD FPS has spoken to the Council who have offered assistance with future actions to resolve outstanding issues. BSO are in regular contact with HSCB, PHA, Land & Property Services and Fermanagh District Council to update all parties on this project and phase 2 which involves renumbering more urban areas. AD/Senior Staff FPS July 2014 HSCB developed a Local Enhanced Service (LES) in June 2013 to take the work forward. This was suspended in October 2013 due to failure of FDC and Royal Mail to reach a consensus regarding official addresses. The LES reinstated April 2014 and will run to March 2015. Clear guidance has been given to GPs and BSO that ‘What’s’ my address” website should be used in all circumstances to acquire the correct address. FDC initiated 2 in March 2014; Newry & Mourne to run similar smaller scale project July 2014. Changes appear to be better
Corporate Objective No Ensure Good Governance Report on Action Plan Risk Description Current Risk Score Controls Assurances Action By Whom Start – End Dates Comment L I S Rate 13. Risk to Data Centres from unstable hospital power / environment may cause further outages. Risk Owner Dir of CCP Type of risk: Technological, Environmental, Physical & Partnership /Contractual Risk Added: 12.12.12 4 5 20 Extreme Security procedures Business Continuity Plan. SIB has appointed a Project Director for the Data Centres. Surge Protectors have been installed and are operational. Gartner technical work streams. An SLA has been agreed with BHSCT Estates for support of the regional data centre. Outline Business Case for new Data Centre Review of all elements of SLA to be carried out. Head of Infrastructure and Architecture May 2013 To approval date Long-term Business case for future data centre arrangements has been submitted to DHSSPS. Department has issued approval to proceed to FBC & governance arrangements are being set up. This Annual Review is underway. Band 8B appointed to prepare for and take forward ITS to the public sector data centre procurement solution. Work on-going with Belfast Trust Estates exploring the feasibility of installing UPS for the air con units. Work is continuing to transfer to transfer 350 Terabytes of data to secure 3rd data copy
Report on Board Action Plan Risk Description Current Risk Score Controls Assurances Action By Whom – End Dates Comment L I S Rate 14. BSO will face the risk of legal challenge and/or financial loss under new legislation, the Late Payment of Commercial Debt Regulation 2013, which requires 30 day payment of supplier invoices. Risk All Directors Type of risk: Political, Economic, Legislative / Statutory, Financial, Legal, Performance management , Customer/Citizen & Risk 12.06.13 4 4 16 High Policies & Procedures; Service Risk Register - Risk Action Plan; Invoice Backlog Team operational from 1st May. SMT monitoring; Risk reporting & review; Corporate Scorecard to Board monthly. SMT oversight of actions to reduce invoice backlog. Review of existing payment procedures. Directors June 2014 continue to address. Backlog in scanning identified and recovery plan / monitoring established. progress reports to Directors/SMT and unapproved invoices being highlighted to relevant signatories. Scanning backlog reduced to 1 day; plan to achieve zero backlog by end June 2014. Corporate Objective No Ensure Good Governance
Total Impact Catastrophic 5 12 13 Major 4 2,7 1,3,4,8 6,14,15 5 Moderate 3 11 10 Minor 2 9 Insignificant 1 1 2 3 4 5 Rare Unlikely Possible Likely Almost Certain *Risk Classification / Numbers LOW 1 Risk MEDIUM 2 Risks HIGH 10 Risks EXTREME 2 Risks *in accordance with AS/NZS 4360:2004 guidance