3. Minutes of Governance and Audit Committee Meeting held on 15 January 2013 GAC 17/2013

Transcription

1 NORTHERN IRELAND HEALTH AND SOCIAL CARE BUSINESS SERVICES ORGANISATION GOVERNANCE AND AUDIT COMMITTEE Minutes of the Governance and Audit Committee (GAC) which took place on Tuesday, 16 April 2013 at 11:00am in the Boardroom, BSO, 2 Franklin Street, Belfast. Present: Brian McMurray (Chair) In David Bingham (Chief Executive) (Minute 1-5 only) Geraldine Fahy Attendance: Paddy Anderson (Director of Finance) Hilary McCartan Catherine McKeown (Head of Internal Audit) Robin McClelland Jenny McCaw (Assistant Head of Internal Audit) David Bryce (AD ITS) (Minute 1-4 only) Denver Lynn (NIAO) (Minute 1-6,7(b)&8(a) only) Catherine O Hagan (NIAO) Claire Dornan (NIAO) (Minute 1-6,7(b)&8(a)only) John Poole (KPMG) Marc Magill (KPMG) Colin Evans (DHSSPS) (Minute 7(b) only) Janine Watterson (Committee Secretary) 1. Apologies There were no apologies for absence. 2. Conflicts of Interest Declaration There were no conflicts of interest declared. 3. Minutes of Governance and Audit Committee Meeting held on 15 January 2013 GAC 17/2013 The minutes of the meeting held on 15 January 2013 were approved and signed subject to an additional sentence being inserted under minute 10(a) Fraud Report to reflect that Mrs Fahy had highlighted that any case closed by CFPS, as a result of failure to locate the next of kin, should be reported to the PSNI. The Secretary confirmed this action had taken place and agreed to amend the minute prior to presentation to the Board. 4. Action Points arising out of Minutes of 15 January 2013 GAC 18/2013 The Committee received the following reports in respect of Action Points which were still outstanding. Action Point 2, Permission to access audit trails within BSO ITS. The Chair reminded the Committee that the Assistant Director of ITS was present at members request to provide further clarification on the processes in place within ITS in respect of the development of live systems and specifically the potential risk of manipulation of audit trails in the live environment. This issue had originated following presentation of the ITS Back and Recovery Report to the Committee in April At the outset the Assistant Director ITS reminded the Committee of previous attempts to respond to this query and explained that he believed that any confusion in responding to members concerns 1

2 may have derived from a misinterpretation that test reproduction in a live environment was interpreted as development. He clarified that fundamentally there is no development of systems within the live environment with any change to systems live environment being controlled through a change control process. In response to a question from Mrs Fahy, the Assistant Director ITS advised that in certain circumstances audit trails may be removed, for example where there is a technical failure however this is very rare and in these instances this is managed through change control. Further, he explained that there is no invisible way of removing audit logs as the deletion of audit logs would most likely lead to a system crashing. Further questioned by Mrs Fahy, HIA confirmed that the report given by the Assistant Director ITS is consistent with the ITS Back Up and Recovery internal audit report. She further commented that the finding in the report highlighted a potential risk that a person working in a live environment could manipulate audit trails as result of a misdemeanour however, it did not report this as normal business practice. In response to a question from Ms O Hagan, the Assistant Director ITS confirmed that FPL at this point in time was outside the control of ITS. The Committee were satisfied with the explanation received. Action Point 5, Finalise protocol between internal and external audit in respect of NAO Self Assessment. HIA advised that the protocol had now been considered by NIAO and now requires final agreement by both parties. Action Point 6, Backlog of superannuation payments. The Director of Finance reported that GP Payments office staff continue to make slow but steady progress in the resolution of outstanding queries with GPs regarding the superannuation backlog. He agreed to keep the Committee informed of progress. Action Point 9, ITS Audit Report. Ms O Hagan, NIAO reported that work on the IT audit was ongoing. A final report would be presented to the Committee in due course. 5. Draft Governance Statement GAC 19/2013 The Chief Executive presented the draft Governance Statement in respect of the 2012/13 year. He took each of the twelve internal governance divergences which had been identified by the Senior Management Team as significant internal control weaknesses and set out the background on each and provided updates on latest position. Mr Denver Lynn, referring to the PaLs Management of Contracts section, suggested that additional wording was required to provide further background to the issue which had led to the 2011/12 accounts qualification. Further, he stated that the Statement should also comment on the current position with regard to the management of contracts and specifically whether the issue had impacted on the 2012/13 year or, alternatively that it no longer exists. The Director of Finance agreed to have the necessary amendments undertaken. In response to a question from Mrs McCartan regarding the governance arrangements of the Business Systems Transformation Programme, the Chief Executive set out the role of the BSO. He explained that the role of the BSO within BSTP is two-fold, firstly to act as a host employer for the BSTP Team and secondly to ensure that good management processes occur for example, in respect of recruitment 2

3 and the management of the Programme s finances. He also informed the Committee that the Programme Board is chaired by Julie Thompson, Senior Responsible Officer. The Chief Executive provided the Committee with a brief overview of the difficulties being encountered within BSTP and the steps being taken to progress these. He referred to Paper GAC 27/2013, the Director of Finance s letter to Julie Thompson, Deputy Secretary, DHSSPS dated 7 March 2013 which provided the latest position. Mrs McCartan suggested that the Statement was too long and detailed and believed it could be improved if the document was more succinct. She also recommended that members sourced and reviewed an NAO fact sheet which set out good practice observations from NAO audits of governance statements. The Director of Finance informed the Committee that the Statement had been completed in accordance with DHSSPS guidance. He explained that in addition to the written guidance, BSO had met with DHSSPS to discuss the new structure and mandatory requirements of the new governance statement. Mr Poole commented that, in his view, the issues identified were significant and therefore warranted inclusion in the statement. Mr Lynn informed the Committee that NIAO would approach the new Governance Statement in the same manner as the Statement on Internal Control. The Statement would not be audited but would be reviewed for consistency with the audited financial statements. He acknowledged that the Governance Statement will require a period of time to become embedded within Organisations. He also highlighted one additional requirement within the Statement which requires Arms Lengths Bodies to describe the key elements of the way in which they receive assurances, including information about the quality of the assurance received and why the BSO Board finds acceptable. The Director of Finance agreed to arrange for a number of minor amendments to be made to the draft Governance Statement proposed by the Committee. The Committee agreed that the draft Governance Statement should be amended to reflect GAC discussions and then presented to the next BSO Board meeting on 25 April (a) HSC (F) 15/2013 Manual of Accounts: Section E and Appendix 3 GAC 20/2013 The Committee noted Section E and Appendix 3 of the 2012/13 Manual of Accounts which provided guidance on completion of the Governance Statement. (b) Progress Report on 2012/13 Service Risk Action Plans GAC 21/2013 The Director of Finance presented a progress report on 2012/13 Risk Action Plans. The Committee noted that as at 30 March 2013, 80% of risks had been fully implemented, 19% had been partially implemented and 1% had not been implemented. The Committee also noted that presently three risks within BSO had been categorised as Extreme. In reviewing the table on page three of the report which set out Extreme Risks, members proposed the following amendments under the risk description column: Further detail should be inserted by PaLS to depict why the risk of failure to deliver recovery plan has been identified as an extreme risk. Finance Directorate should make reference to inoperative interfaces in the risk identified as lack of system stability 3

4 In response to a question from Mr McClelland, the Director of Finance confirmed that the risk surrounding the data centres had been categorised as high. The Committee noted the report provided. (c) Annual Report on Risk Management and Action Plans for GAC 22/2013 The Director of Finance presented the 2012/13 Annual Report on Risk Management and 2013/14 Action Plans. He explained that the report provided an overview of the risk management activities in the BSO during the 2012/13 financial year and the Action Plans set out actions to be taken in respect of risk activity in the 2013/14 year. Mrs Fahy requested that two points within the report be amended. Firstly, in respect of paragraph 3.1, the wording should reflect that while the BSO Board is responsible for managing all risks, they can only do this if all risks have been identified in the first instance. Secondly, in paragraph 4 of the report some reference should be made to highlight that, where appropriate, cost effectiveness is also a key consideration in mitigation of risks. The Committee noted the report provided. 6. Chair s Business (a) Annual Review of GAC Terms of Reference GAC 23/2013 The Committee reviewed its Terms of Reference and agreed the following changes, under the following headings: Attendance and Secretariat - the word should in the first paragraph should be replaced with will. Authority - the word outsider should be replaced with the words external parties. Internal Audit - bullet point three the words Chief Internal Auditor should be replaced with Head of Internal Audit. The Committee also agreed that reference to the Statement on Internal Control and the Government Internal Audit Standards should be updated to reflect that both have been replaced with the Governance Statement and Public Sector Internal Audit Standards respectively. The Secretary agreed to make the necessary amendments after which the Chair would present to the Board for approval. If approved, the Chair would also propose for an amendment to be made to the Standing Orders in line with the approved GAC Terms of Reference. 7. Internal Audit (a) Progress and Follow up Reports as at 31 March GAC 24/2013 The Head of Internal Audit (HIA) gave a progress report on Internal Audit work undertaken since the last meeting. She informed the Committee that she was presenting four reports for consideration: Payroll, General Ledger, Stock take Review and Year End Follow up Report. The Committee noted each of the Reports presented and raised the following issues: 4

5 At the outset, the Committee considered the appropriateness of performing the Payroll and General Ledger audits given the fundamental weaknesses and problems with stock accounting and payroll interface already acknowledged with regard to the new systems prior to the audits taking place. The Director of Finance responded that these audits were conducted as part of a wider programme of audits and were replicated in other HSC Trusts. He also referred to the reliance placed by external audit on these audits as a key part of their year end work. Mr John Poole concurred with this view and added that whilst there were issues of concern raised within the payroll report it was important to note that HIA had not raised concerns about the accuracy of pay computed by the new systems. In response to a question from Mrs McCartan, the Director of Finance stated that these audits were conducted late in the financial year to allow time to rectify some of the system related issues. He added, that a number of issues still to be addressed are outside the direct control of BSO. HIA responded by justifying her decision to carry out these audits. She explained the audits had led to a greater awareness of the weaknesses within the HRPTS and FPL systems. She also highlighted that it was imperative for the BSO Governance and Audit Committee to consider internal audit s opinion in respect of these systems along with client organisations and indeed not to do so may have been viewed, by others, as remiss. The Committee then reviewed the reports presented. i. Payroll HIA reported a Limited level of assurance. The Committee noted that this report contained four priority one findings and that the majority of recommendations related to weaknesses with the newly introduced systems. In the main, the implementation of recommendations lay with the BSTP Team and these were currently being progressed. However, the absence of verification checks in respect of payroll and also scrutiny and review checks in respect travel payments had also been highlighted and these were now fully implemented. The Director of Finance responded to the findings within this report, stating that this audit had taken place directly after the first month during which the new travel and expenses systems went live. At that time, a validation report was not in operation within the new system and therefore the travel errors highlighted in the report had not been not been detected. He continued, that following the audit BSO Finance had put into place procedures to ensure that travel payments are now appropriately verified, reviewed and scrutinised. In response to a question from Mrs McCartan, the Director of Finance detailed the review procedures which now take place. The Director of Finance then drew the Committee s attention to the various issues which finance staff are dealing with as a result of the implementation of the new systems, highlighting in particular a number of stock accounting issues, an invoice backlog across HSC and the fact that the payroll interface between HRPTS and FPL is not functioning. He explained that these complex issues were placing a significant pressure on the finance function within the Organisation. In response to a question from Mrs McCartan regarding the Recovery Plan, the Director of Finance advised that in the absence of a final report from the supplier he had been left with no alternative but to extend manual checks to ensure the relevant documents were available for external audit review. 5

6 ii. General Ledger HIA reported a Limited level of assurance. This report contained five priority one findings. HIA paid tribute to finance staff for all their efforts in cooperating with audit staff during a busy period of work. There were no issues raised by the Committee in respect of this report. iii. Stocktake Review The Committee noted that HIA had provided a satisfactory level assurance on the stocktake review. There were no issues raised by the Committee in respect of this report. iv. Year End Follow Up Report The Committee noted that 80% of recommendations had been fully implemented, 18% were partially implemented and 2% were not implemented. HIA drew the Committee s attention to the outcome of the follow up exercise carried out on the FPL Go Live report and in particular the delay in implementing a recommendation relating to a lessons learnt register in respect of BSTP issues. There were no issues raised by the Committee in respect of this report. (b) Government Internal Audit External Quality Assessment GAC 25/2013 Mr Colin Evans, DHSSPS Head of Internal Audit presented the Government Internal Audit External Quality Assessment Report. He informed the Committee that under the Government Internal Audit Standards, external assessments are required to be conducted every five years. The purpose of the assessment is to monitor the effectiveness of internal audit and identify opportunities for improvement. He explained the methodology used in carrying out this assessment and the five-level evaluation scale. Level one being the lowest and Level five the highest. Mr Evans continued, stating that BSO Internal Audit function had been assessed at Level 4 Maturing. He reported that the External Quality Assessment Team had positive discussions with those interviewed as part of the assessment process which had reflected that BSO Internal Audit is respected and valued by BSO and its clients. Mrs Fahy enquired how BSO clients were selected to take part in the assessment process. Mr Evans replied that a decision had been taken to focus on Trusts and the BSO. The Chair endorsed the findings of this report. Mrs McCartan, referring to the People, Knowledge and Skills section of the report, enquired if HIA believed the current training budget was adequate to meet the needs of the function. HIA advised that she was currently reviewing the training budget along with the Director of Finance. Mrs Fahy enquired as to how those staff currently undertaking CCAB qualifications are obtaining relevant experience. HIA responded that whilst internal audit staff are primarily exposed to audit, they also gain relevant experience in other aspects of finance whilst auditing. Mrs Fahy queried whether there should have been included a recommendation to reflect that there is lack of IT audit skills and perhaps clinical audit within BSO Internal Audit and Mr Evans and HIA responded. Mrs Fahy, referring to the Governance and Leadership section of the report, suggested that the wording should be amended to clarify that the BSO Governance and Audit Committee only receive 6

7 the Internal Audit Strategy and Annual Audit plans pertaining to the BSO. Mrs Fahy also referred to the Audit Strategy section and proposed that the sentence The HIA does a good job developing and managing audit strategies for all of her clients should be extended to highlight the number of strategies which had been reviewed. The Committee welcomed the positive assurances provided in the Government Internal Audit External Quality Assessment on BSO Internal Audit. 8. External Audit (a) BSO Audit Strategy GAC 26/2013 The BSO Audit Strategy was presented by Denver Lynn NIAO and John Poole, KPMG. At the outset, Mr Denver Lynn introduced Claire Dornan, Audit Manager from the NIAO Value for Money Division. He drew the Committee s attention to Annex 2 of the Audit Strategy which set out the relevant Value for Money reports issued over last five years, current and planned VFM activities and other ongoing studies with relevance, or interest, to the HSC. The Committee noted the work undertaken by the VFM Division within the NIAO. Mr John Poole, KPMG provided an overview of the external audit. He took the Committee through the key aspects of the report highlighting the audit approach to be taken in respect of the eight significant risks which had been identified in the Strategy. Mr Poole also drew the Committee s attention to the audit timetable and reported that target dates in respect of BSO financial and regularity and financial controls assurance had been deferred due to problems reported under paper GAC 27/2013 Letter dated 7 March 2013 from Director of Finance to Ms Julie Thompson. Presently, no revised date for the commencement of these elements of the audit had been agreed. Further, he reported that fieldwork in respect of FPS and PaLS had commenced and assurances in these areas would be provided. The Committee noted however that the PaLS assurance provided would be in respect of regularity and non stock. Mrs McCartan enquired if the audit fee reported in the Strategy represented value for Money, NIAO responded stating that the audit fee was similar to the previous year; the increase shown reflected the additional work required to issue an assurance in respect of PaLS management of contracts. The Chair concluded discussions stating that he was aware of problems faced and the considerable communication around the timetable. He also acknowledged the resultant pressure placed on the Finance Directorate and other Directorates within the BSO and thanked them for all efforts /13 Final Accounts (a) Letter from Director of Finance to Julie Thompson, Deputy Secretary DHSSPS dated 7 March 2013 regarding FPL Stock Accounting Issues GAC 27/2013 The Director of Finance presented his letter to Julie Thompson, Deputy Secretary DHSSPS dated 7 March 2013 which set out the latest position in respect of stock accounting issues and specifically stock issues to HSC organisations, BSO financial records, stock valuation and implications for BSO/ HSC. The Director of Finance presented two further letters, for noting. The first, a letter from Julie Thompson Deputy Secretary DHSSPS acknowledging the exceptional circumstances that BSO is 7

8 currently encountering during the implementation phase of BSTP, coupled with the ongoing activities of financial and budgetary management at a key period in the accounts finalisation. Ms Thompson requested that BSO consider the practicalities of the accounts production process alongside these other significant competing priorities and decide whether faster closing can be achieved. The second, a letter from Denver Lynn, Director NIAO regarding the likely impact that a delay would place on the audit timetable. The letter also highlighted NIAO s view that BSO s financial statements would not meet faster closing timetable. The Director of Finance reported that he would be meeting with NIAO/KPMG within the next few weeks to agree a revised audit timetable for 2012/13 accounts. In advance of this he would write to Ms Thompson to formally confirm that BSO annual accounts would not meet faster closing deadlines and offer an alternative reporting timetable which had been agreed with KPMG and NIAO. (b) BSO Draft Year End Timetable - GAC 28/2013 The Director of Finance presented the draft Year End Timetable which provided the Committee with an overview of the key tasks to be undertaken in respect of the annual accounts. He explained that while some of the actions identified had been deferred, due to lack of stability within the FPL and HRPTS systems, the majority of actions will, or have been progressed, on target. Further, he advised that the Plan was monitored by the Acting Assistant Director of Finance on a weekly basis. In conclusion, the Director of Finance thanked all parties involved in managing this difficult situation and stated that he hoped a reasonable solution could soon be established. 10. Business Matters (a) Progress Report on audit recommendations as at 5 April 2013 GAC 29/2013 The Committee noted the BSO s progress report as at 5 April 2013, which provided details of actions taken against audit recommendations received from internal and external audit. (b) National Fraud Initiative (NFI) i. 2010/11 NFI Data Matching Exercise - GAC 30/2013 The Director of Finance presented a progress report on the National Fraud Initiative in Northern Ireland: Data Matching 2010/11. The Committee noted that all of the 184 recommended matches have been investigated, with one report requiring further investigation. This report was referred to the BSO Legal Directorate for consideration who advised that given the size of the debt and the fact that the debtor resides in the US it would not be cost effective to pursue. BSO will now be recommending to DHSSPS that the outstanding overpayment of 5,514 be written off. As this action completes all outstanding investigations, no further updates on the 2010/11 Exercise will be brought to the Committee. 8

9 ii. 2012/13 NFI Data Matching Exercise - GAC 31/2013 The Committee noted that BSO had received information of the total number of matches available and the number of matches to be undertaken in respect of the 2012/13 NFI Data Matching Exercise. The Committee also noted that the process of investigating these matches had commenced and going forward, regular reports will be provided to the Committee. (c) BSO Fraud Register - GAC 32/2013 The Committee noted that one new potential fraud and been passed to Counter Fraud and Probity Services since the last meeting. The Secretary also provided a progress report in respect of ongoing frauds/thefts. (d) DFP Annual Theft and Fraud Report 2011/12 GAC 33/2013 The Committee noted the 2011/12 DFP Annual Theft and Fraud Report. (e) BSO Counter Fraud and Probity Services 2011/12 Annual Report GAC 34/2013 The Committee noted the 2011/12 BSO Counter Fraud and Probity Services Annual Report. (e) Register of Departmental Finance Circulars GAC 35/2013 The Committee noted the Register of Circulars which provided members with an overview of the Financial Circulars received from the Department during the 2012/13 year. 11. Notified Any Other Business There were no matters raised under this item. 12. Date of Next Meeting The date of the next meeting was confirmed as Tuesday 28 May Chair Date 9