Corporate Objective No 1: To Deliver Value for Money Services to our Customers Report on Action Plan Risk Description (Include DATE ADDED) Current Risk Controls Assurances Action By Whom End Date Comment L I S Rate 2. Inability to quality, productivity and VFM, and show that we are competitive and addressing customer expectations. Risk Owner(s) DoCCP Dirs Type of risk: Financial, Customer/Citizen & Partnership Contractual 2 4 8 High Existing Processes to measure Quality Standards; SLA’S; KPI’s; Framework /Scorecard; Monthly report to Customers; Internal Audit programme; Audit Control Process; Annual Quality report. Accredited Bodies - ISO/Lexcel (E) Monthly Reports to Customers (I) Scorecard monitoring SLA Monitoring (I) Financial Management Standard (I) & (E) Customer Survey (E) SMT Meetings (I) GAC Audit Control Review (I) Dept Accountability Review (E) MIPB Assessment Further participation of BSO Services in Benchmarking programme for 2016-17. Annual customer surveys DoCCP August 2016 January 2017 Questionnaires are currently being completed by a number of service areas with an update report due in August 2016. 2016/17 SLAs have been issued. SLA customer meetings are nearing completion. SLA update paper submitted to Business Committee May 2016.
Corporate Objective No 1: To Deliver Value for Money Services to our Customers Report on Board Action Plan Risk Description (Include DATE ADDED) Current Risk Score Controls Assurances Action By Whom End Dates Comment L I S Rate 3. Lack of Resources to unlock the business case benefits for Finance, HR, Procurement and FPS Business Systems Replacement. Risk Owner Head of SS Dir of Ops Dept SRO Type of risk: Financial 3 4 12 High Following completion of Procurement in October 2012 the updated OBC for FPL and HRPTS systems was approved by DHSSPS and DFP. Revised governance arrangements in place. CXs members of Programme Board and HR & Finance Directors members of Implementation Board. Money released for both systems. Resources identified for FPS systems within HSC ICT budget and OBC approved by DFP. Dept Accountability Review quarterly (E). Programme Reporting monthly (I) Implementation Board monitoring monthly. Technical groups established and meet weekly. Updated OBC for HRPTS & FPL to be submitted and approved before contract signature. Workshops with functional groups will develop work packages including resource requirements. These will be presented to BRP and BSTP Project Boards as developed. Programme Director to work with SRO & Capital Branch to ensure that reserved monies are released as required. Dir of Ops to confirm continued funding with project SRO. Dir Of Ops/Head of Shared Services November 2016 BRP migration plan is in place to deliver outstanding work packages by June 2016, followed by implementation period. BRP Project initiatives continue to progress in line with achieving the BSTP OBC benefits. Plans have been managed and progressed through the BRP Governance structure (BRP & BSTP Project Boards) including reporting and monitoring to unlock the benefits outlined. Throughout this phase there is an increasing risk of losing fixed-term and temporary staff prior to projected programme close-down in June 2016. A BAU structure is in the process of being established to continue benefits realisation deployments and
FPS governance transferred to HSC ICT programme. FPL go-live – all organisations September 2013. Gateway 4 (HRPTS) and Gateway 0 (BSTP) recommended a stream of work on benefits should be established. system enhancements after the BRP project team closes in June 2016.
Corporate Objective No 1: To Deliver Value for Money Services to our Customers Report on Board Action Plan Risk Description (Include DATE ADDED) Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 4. HSC restructuring leads to negative impact on overall SLA funding Risk Owner(s) SMT Type of risk: Financial, Customer/Citizen & Partnership Contractual Risk 9.12.2015 3 4 12 High Engage as early as possible to identify to which organisation(s) current HSCB services will transfer. SLA/ funding realignment to be identified and progressed following clarity on redistribution of services. DoCCP September 2016 DoCCP DoF 2016/17- TBC The CEx is a member of the HSC Restructuring Programme Board. The design phase is ongoing with further public consultation expected Autumn 2016. Implementation of the programme plan is likely to commence during 2017/18 with completion planned for 2018/19.
Corporate Objective No 2: To Grow our Services and Customer Base Report on Board Action Plan Risk Description (Include DATE ADDED) Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 5. Shared Services may not achieve business case outcomes. Risk Owner Dept SRO Head of Shared Services Dir of Finance (for charging/funding Type of risk: Financial, Physical & Partnership / Contractual 4 4 16 High Feasibility (2007) on Shared Services Programme Board Project Structure Dept Review Strategic Outline Case (2009/10) – DFP/Dept Assurance Project re-plan presented to BSTP Programme on 2nd September 2013 and approval received. Project Board (I) Programme Board Reporting (I) DFP/Dept OCB Reviewed (E) SS SS Quality Assurance Group (E) Dept Accountability Review (E) MIPB Assessment Engagement with Senior HSC Officers re design of Shared Services. Public consultation closed end Feb. Ministerial decision announced on 14 May 2012. SMT reviewing the implementation plan & progress on a fortnightly basis. Head of Shared Services September 2016 Benefits Realisation Project established with agreed capital and revenue budgets. A delay in uptake of some initiatives in Payments will delay the realisation of benefits until March 2017. A decision has been taken to delay the realisation of benefits in Payroll to enable a period of stabilisation. This is now expected to be complete in September 2016. Accounts receivable benefits realisation is complete. The implementation of Single Pay Frequency initiative has been delayed until September 2016 which will impact the timeframe for the full delivery of savings. Delay in rollout of ESS/MSS will also impact realisation of benefits. Further have been incurred. These have been communicated to customers and the Director of Finance
Corporate Objective No 2: To Grow our Services and Customer Base Report on Board Action Plan Risk Description (Include DATE Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 6. Inability to implement new Shared Service for Payroll, Payments, Income, Selection & Recruitment in line with Departmental timetable and customer expectations. Risk of disruption to services and damage to reputation during period of transition due to system problems and inexperienced staff. Risk Owner Head of Shared Services Dept SRO Type of risk: Partnership / Contractual & Customer/Citizen 5 4 20 Extreme BSTP Governance reporting processes. BSO Shared Services Project oversight by BSO SMT. Project operated using Prince methodology. Project re-plan presented to BSTP Programme Board on 2nd September 2013 and approval received. Working Group/Project Boards in place with all organisations to deal with cut over activities Strategic adviser appointed to assist BSO SMT. BSTP Programme reporting. PMO & reporting established BSTP Implementation Group – regular reporting and review of progress. Central administration, resources and structures to be agreed. Phased roll-out of shared services dependent on systems roll-out and stabilisation. E-Rec implementation plan currently being rolled out. Head of Shared Services September 2016 FPL team addressing workarounds and final areas of functionality not yet delivered by ABS (including line level matching and This will form part of Benefits Realisation work. Payments, Income and Payroll have all completed transition to Shared Services. E-Rec has been fully rolled out. Adoption of the system continues to progress: SHSCT, BHSCT and NHSCT are complete. WHSCT roll-out is completed end March 2016 where possible. Work is underway towards migration by March 2017 SEHSCT rollout commenced February 2016. Work is underway towards full rollout by November 2016. Migration of WHSCT and SEHSCT is dependent on stabilisation of Shared
Corporate Objective No 3: To Pursue and Deliver Excellence through Continuous Improvement Report on Board Action Plan Risk Description (Include DATE ADDED) Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 8. Inability to implement replacement systems for Finance, HR and Procurement in line with agreed plan. Risk Owner Head of SS Dir of Ops Type of risk: Partnership / Contractual 3 4 12 High Fully resourced HRPTS and FPL teams in place. Weekly Status Reporting system in place for HLC AXON an AXON contractors. Integrated regional Implementation Board established with members drawn from all key stakeholder groups. Programme Risk Register and Report regular reviewed by Programme Programme have received conditional approval of addendum OBC from DFP Supply and DHSSPS. Quarterly Dept Accountability Review (E) Monthly Programme Board review Implementation Board monitoring resource plans monthly FPL, and Integrated technical groups in place Self-Assessment Gateway Review (I) Gateway Review (E) CX Review of Dirs Objectives (I) Reporting to BSO BRP systems enhancement initiatives are ongoing and are managed through the project governance structures. Scoping impact and resource of mid-contract application upgrade. Project plan to be submitted to SMT E-Rec implementation plan currently being rolled out. Dir of Ops/Head of Shared Services November 2016 BST/ ITS December 2016 May 2016 September 2016 FPL and (excl E-Rec) now fully live across HSC. The outstanding contractual elements are being delivered by BRP team. Due to delays in project closedown it is anticipated that this will be delayed until November 2016. A major mid-contract application upgrade of FPL is expected to be completed December 2016 (Phase 1) and March 2017 (Phase 2) and BRP, BST and ITS are to develop a project plan. E-Rec has been fully rolled out. Adoption of the system continues to progress: BHSCT and NHSCT are complete. roll-out is completed end March 2016 where possible. Work is underway towards migration by March 2017 SEHSCT rollout commenced February 2016. Work is
Corporate Objective No 3: To Pursue and Deliver Excellence through Continuous Improvement Report on Board Action Plan Risk Description (Include DATE ADDED) Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 9. Benefits of the new FPPS system fail to be realised due to: 3 4 12 High Operational & Service Review Group to manage prioritisation and execution of fixes and change controls FPS Project Board (Benefits Realisation) will monitor the progress and consider means of increasing uptake if necessary (a) FPS has planned training events and will use roadshows and meetings with contractor and their representatives to promote the benefits to contractor of using the portal; (b)FPS to gain commitment from HSCB to continue to encourage contractors to use the portal; (ii) (a) FPS to develop an interim contingency plan to resource system impacts in the event of Dir of Ops December 2016 98% of GP practices are the portal to submit at least one Enhanced Services Claim in February payment paid in March. The roll out of the portal to early adopter dental practices is due to commence in April 2016 upon completion of UAT for portal tiered access controls. HSCB Integrated Care are working with FPS to encourage GP practices that are not using the portal to begin submitting claims via the portal. Monitoring of portal uptake is in place and will alert need to retain FPS resource.
Corporate Objective No 3: To Pursue and Deliver Excellence through Continuous Improvement Report on Action Plan Risk Description (Include DATE ADDED) Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 10. Failure of key ITS Applications & Infrastructure impacting delivery of Critical Services to Customers. Risk Owner Dir of CCP Type of risk: Technological & Customer / Citizen 3 4 12 High Security Procedures; Testing of Business Continuity Plan; Change Control Process; Testing and planning associated with significant change. Engagement of professional report (Gartner). Actions from Gartner report completed Internal (E) External Audit (E) SMT Review of ICT Programme (I) Systems Risk Assessment (I) Additional assurances Dir of Finance/ Dir CCP June 2016 A full Disaster Recovery (DR) test was completed in May 2015 based on a scenario of having to evacuate Centre House and carry on operations from the DR site at Boucher Crescent. This was successfully repeated on 19 May 2016. The mobile DR Unit was positioned within the yard in Boucher as part of the test exercise. It has been confirmed that the unit can be connected to the HSC network and the GP OOH solution has been restored from the copy and tested within the DR unit.
Corporate Objective No 3: To Pursue and Deliver Excellence through Continuous Improvement Report on Board Action Plan Risk Description (Include DATE ADDED) Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 11. Fail to implement robust information governance process. Risk Owner Dir of HRCS Dirs Type of risk: Legislative / Regulatory & Performance Management 3 3 9 Medium Policy & Procedures Information Governance / Records Mgt CA Standard Audit Control Risk Register/ Action A range of IG policies renewed and agreed by Board over 2014/15 and 2015/16. IGMG to maintain and progress action plan sub-group established to review the new standard and compare with the current standard. Audits of local record management policies underway as part of IG Improvement Plan to March 2016). CAS Assessment - Records Management /ICT/Governance (I) & (E) Information Governance Group Report (I) Service Risk Reporting & Review (I) GAC Audit Control Review (I) other CA Standards Assessment (I) & (E) Mid-Year Assurance Statement / GS (I) GAC Report (I) CX Review of Dirs Objectives (I) Information Management Controls Assurance Standard has been issued by DHSSPS SIRO annual assurance letter to Permanent Secretary Regular progress reports to regarding action plans (I) Ensure regular update on Data Protection and refresher training is available. Action plan implemented and evidence gathered on ongoing basis. Regular progress reports to SMT. DoHRCS Apr -Mar 2017 DoHRCS Apr -Mar 2016 BSO assessed as Substantive Compliance for in line with DHSSPS expectations. BSO to carry out periodic checks of files in transit. Internal Audit assessment of the Information Management Controls
Corporate Objective No 3: To Pursue and Deliver Excellence through Continuous Improvement Report on Board Action Plan Risk Description (Include DATE Current Risk Controls Assurances Action By Whom End Date Comment L I S Rate 13. There is a risk that delays in the recruitment and selection process leads to failure to meet performance targets and significant reputational damage. Risk Head of SS Type of risk: Partnership / Contractual; Customer/Citizen; Performance Management Risk Added: 16.03.2016 4 4 16 High Recovery team established Review of processes, systems and organisational structures completed Task and finish group established to deliver the recovery and stabilisation of recruitment shared services. Weekly reports of progress against recovery plan to SMT and BSTP programme board. Reports also sent to BSF AD forum and the regional Directors forum chaired by Michael McBride. Delivery of full recovery plan HoSS August 2016 August 2016 Weekly reporting of progress against recovery plan to SMT and BSTP programme board is in place. Customer organisations also have plans in place which align with the BSO recovery plan.
Corporate Objective No 4: To Enhance the Contribution and Development of our People Report on Board Action Plan Risk Description (Include DATE ADDED) Current Risk Score Controls Assurances Action By Whom End Date Comment L I S Rate 15. BSO current skill mix does not meet future business needs. Risk Owner Dir of HRCS Dirs Type of risk: Managerial / Professional 3 3 9 Medium Revised Workforce Strategy approved by Board February 2014. Job Description/ Personal Specification Staff Survey Review PaLS Skills gaps. Staff development / strong commitment to training. Outcome of HSC Staff Survey (E) Customer Surveys (E) SMT/Board Review of Surveys (I) Staff Appraisal - PDPs (I) CX Review of Dirs Objectives (I) A Sub-group has been established to consider a range of issues in PaLS including workforce issues. Business Case skills. Moving Forward Programme launched. Re-accreditation of IIP complete Further work to identify recruitment issues. Workforce Planning ongoing in a number of Directorates. Scoping the direction of several Service Areas on behalf of DHSSPS. Profiling with directorates regarding skills requirements is underway. The outcomes will feed into the appraisal and PDP process and drafting the BSO training plan for 2016/17. DoHRCS September 2016 Discussions underway with Directors in respect of strategic work plans for the next 3 years. Workforce Plan for ITS has been completed Action plans in place for Shared Services alongside Corporate action plan. PaLS workforce plan has been drafted
Appendix A Archive Report of risks removed from Corporate Register 2016-2017 Corporate Objective Risk Description Risk Score Comment L I S Rate 3. 13. Delays in payroll responding to pension queries may result in fines from the Pensions Regulator. There is also a wider reputational risk associated with delays in the ability to provide estimates. 2 4 8 High Interface has been implemented – risk to be managed through appropriate service risk registers Appendix B Archive Report of Completed Risk Actions 2016-17 Corporate Objective Risk No / Description Actions Completed 1 1. Levels of savings in the overall environment for HSC are so that BSO service provision to customers are negatively affected and/or we fail to breakeven. The Leadership Centre may be particularly affected by a reduced level of client income. Develop Service Offering The actions to achieve both these elements of savings have been factored into the BSO Budget for 2015/16 and a balanced budget has been achieved. The BSO 2015/16 budget was approved by Board on 28 May 2015. Re-submit savings plans to DHSSPS prior to final business plan approval - complete The Leadership Centre is currently engaging with HSCB to identify the impact of any change in requirements/funding - The Leadership Centre has discussed the income received from the HSCB with the Board SLA Co-coordinator and Chief Executive. Implementation of the programme plan is likely to commence during 2017/18 and as such this action will remain on the service risk register 2. 5. Shared Services may not achieve business case outcomes. Meeting with DoF, HoSS and SSRO to discuss 2016/17 plan - complete 3 10. Fail to implement robust information governance process BSO to communicate with Info Owners to advise that all medical files to be checked before forwarding to BSO – completed Develop action plan – developed and submitted to SMT