north east ambulance service nhs foundation trust · strategic objectives and an analysis of ......

North East Ambulance Service NHS Foundation Trust

Annual Internal Audit Report 2014/15

SIAS is a not for profit agency hosted by City Hospitals Sunderland NHS Foundation Trust

North East Ambulance Service NHS FoundationTrust Annual Internal Audit Report 2014/15

1. Introduction In accordance with the Public Internal Audit Standards, this report provides the Accounting Officer and the Audit Committee with a formal annual report, based on the work performed, on the overall adequacy and effectiveness of the organisation’s framework of governance, risk management and control processes. The report is structured as follows:

• Section 2 sets out the Head of Internal Audit Opinion for the year ending 31 March 2015. • Section 3 provides a summary of the audit service provided. • Section 4 provides a summary of our performance during the year. • Section 5 provides an overall conclusion.


2. Head of Internal Audit Opinion Roles and responsibilities The whole Board is collectively accountable for maintaining a sound system of internal control and is responsible for putting in place arrangements for gaining assurance about the effectiveness of that overall system. The Annual Governance Statement is a statement by the Accounting Officer, on behalf of the Board, setting out:

• how the individual responsibilities of the Accounting Officer are discharged with regard to maintaining a sound system of internal control that supports the achievement of policies, aims and objectives;

• the purpose of the system of internal control as evidenced by a description of the risk management and review processes, including the Assurance Framework process; and

• the conduct and results of the review of the effectiveness of the system of internal control including any disclosures of significant control failures together with assurances that actions are or will be taken where appropriate to address issues arising.

The organisation’s Assurance Framework should bring together all of the evidence required to support the Annual Governance Statement requirements. In accordance with Public Sector Internal Audit Standards, the Head of Internal Audit is required to provide an annual opinion, based upon and limited to the work performed, on the overall adequacy and effectiveness of the organisation’s risk management, control and governance processes (i.e. the organisation’s system of internal control). This is achieved through a risk-based plan of work, agreed with management and approved by the Audit Committee, which should provide a reasonable level of assurance, subject to the inherent limitations described below.

The opinion does not imply that internal audit has reviewed all risks and assurances relating to the organisation. The opinion is substantially derived from the conduct of risk-based plans generated from a robust and organisation-led Assurance Framework. As such, it is one component that the Board takes into account in making its Annual Governance Statement.

The Head of Internal Audit Opinion Purpose of the Head of Internal Audit Opinion The purpose of my Head of Internal Audit Opinion is to contribute to the assurances available to the Accounting Officer and the Board which underpin the Board’s own assessment of the effectiveness of the organisation’s system of internal control. This opinion will in turn assist the Board in the completion of its Annual Governance Statement. My opinion is set out as follows:

• overall opinion; • basis for the opinion; and • commentary.


Overall opinion My overall opinion is that: On the basis of work carried out in accordance with the Annual Internal Audit Plan 2014/15, significant assurance can be given that there is a generally sound system of internal control, designed to meet the organisation’s objectives, and that controls are generally being applied consistently. However, some weaknesses in the design and/or inconsistent application of controls, puts the achievement of particular objectives at risk. Basis for the Opinion The basis for forming my opinion is as follows:

• an assessment of the design and operation of the underpinning Assurance Framework and supporting processes;

• an assessment of the range of individual opinions arising from risk-based audit assignments, contained within internal audit risk-based plans that have been reported throughout the period. This assessment has taken account of the relative materiality of these areas and management’s progress in respect of addressing control weaknesses; and

• any reliance that is being placed upon third party assurances. Commentary The commentary below provides the context for my opinion and together with the opinion should be read in its entirety. The design and operation of the Assurance Framework and associated processes The Board Assurance Framework has been updated during 2014/15. It is based on the Trust’s strategic objectives and an analysis of the principle risks to achieving those objectives. The key controls that have been put in place to manage the risks have been documented, and the sources of assurance for individual controls have been identified. During the year the Audit Committee has received regular reports from senior Trust officers regarding the sources of assurance for particular objectives. This mechanism has contributed to the effectiveness of the Assurance Framework. It has been assessed by Internal Audit that the Assurance Framework is effective in bringing together all of the activities and objectives of the Trust. It provides the Trust with a comprehensive mechanism for the management of the principal risks to meeting its strategic objectives and supports the compilation of the Annual Governance Statement. Although there are a number of gaps in assurance and/or control, plans were put in place to mitigate or eradicate the gaps and these are being followed.

The Trust has well developed risk management processes that are embedded within the organisation. A risk management strategy, supported by appropriate and comprehensive policies and procedures, is in place. The Compliance and Risk (formally Governance and Risk) Committee has overseen the clinical and non-clinical risk management agenda and reported to the Board. Together with the Audit Committee, they provide assurance to the Board on the systems and processes by which the organisation leads, directs and controls its functions in order to achieve its strategic objectives.


Individual audit opinions arising from risk-based audit assignments My opinion is derived from the completion of a range of risk-based Internal Audit assignments, which have been undertaken in accordance with the Annual Internal Audit Plan 2014/15. A table outlining these individual opinions is attached at Appendix 1. The outcome of Internal Audit work is reported regularly to the Audit Committee. . In addition, we have issued a copy of all individual assignment reports to the Director of Finance and Resources, and other appropriate directors and managers, throughout the year. The previous individual opinions of “limited” and “significant” have been revised to enable use of four assurance ratings. The use of an assessment framework to derive each audit’s assurance rating has encouraged consistency and clarity across all audits and the expansion to four options has enabled greater categorisation between assurance ratings. Definitions of assurance levels, findings and recommendations are set out at Appendix 2 and the assessment framework is shown at Appendix 3. We have issued 17 reports since completion of the Annual Internal Audit Report for 2013/14 in May 2014. Of those reports issued, we issued an assurance rating of ‘significant weaknesses’ for two reports, ‘some weaknesses’ for four reports, ‘adequate’ for four reports, ‘good’ for three reports and the remaining four reports relate to follow up work only; no assurance levels have been assigned to these reports. A total of 50 issues were raised; the issues were ranked to reflect priority ratings and appropriate management responses were agreed. Four high priority issues, 21 medium priority issues and 25 low priority issues have been raised. The four high priority issues relate to the following two reports which received assurance ratings of ‘significant weaknesses’: Health and Safety

Two high priority issues, five medium priority issues and two low priority issues were raised in this report. The two high priority issues relate to the governance arrangements in place at the Trust for health and safety. At the time of the audit we could not give assurance that arrangements for reporting and escalating health and safety matters met the requirements of the workplace health and safety standards and comply with the Management of Health and Safety at Work Regulations Act 1999. Furthermore, we saw no evidence that Health, Safety and Wellbeing actions were progressed in a timely manner. As this report was not issued until April 2015, the original implementation dates for action in respect of these issues are not yet due. Progress on the implementation of action agreed will be subject to detailed ongoing review by management and the Audit Committee. HR Processes (DBS Checks and Overpayments)

Two high priority issues, two medium priority issues and one low priority issue were raised in this report, which was issued in January 2015. The two high priority issues related to a review of 64 staff who had received a DBS check which contained previous convictions. The process in place to assess whether staff with previous convictions posed a risk to patient safety was found to be not fit for purpose. For example, 28 out of 64 staff with convictions were risk assessed as ‘low’ or ‘no risk’ to the public despite their previous convictions but without the rationale for this being clearly documented. In addition, we could find no evidence of a risk assessment on file for four staff and three staff were taken off front-line duty but subsequently returned prior to the risk assessment


being completed. In addition, 22 risk assessments required a more detailed record of the discussions held with staff in relation to their convictions and a record of the rationale followed to complete the risk assessment and return the staff to front-line duty. Three out of five issues raised in this audit report have subsequently been actioned by management. One high priority issue required new risk assessments to be carried out or existing assessments to be reviewed for all 64 staff members. This has been actioned and no current risk to patient safety identified, with the exception of one risk assessment which has been delayed due to the continued absence of the staff member in question. In addition, one medium priority issue which required action to draft Standard Operating Procedures is underway and will be finalised by July 2015. Agreed actions outstanding Progress on the implementation of action agreed in respect of the issues raised will be subject to detailed ongoing review by management and the Audit Committee. From a total of 16 agreed actions due for implementation as at the end of the financial year 2014/15 (31 March 2015) 12 have been implemented, one has been superseded, and three actions remain outstanding for implementation. Revised implementation dates have been agreed with management for the outstanding actions. In addition, there are a number of agreed actions with an original implementation date which will become outstanding during 2015/16. These actions will be followed up by Internal Audit in due course. Conclusion Taking into account all of my findings, and the Trust’s actions in response to issues raised, I consider that there are no areas of significant weakness remaining that are relevant to the preparation of the Annual Governance Statement. Acknowledgement The assistance provided by North East Ambulance Service NHS Foundation Trust staff during the course of our work is greatly appreciated. Amanda Bellis Interim Head of Internal Audit May 2015


3. Internal Audit Service The Internal Audit service at the North East Ambulance Service NHS Foundation Trust is provided by Sunderland Internal Audit Services (SIAS). SIAS was originally set up to provide an internal audit function for hospitals in the Sunderland area. Since then we have expanded to service a range of clients on a not-for-profit basis across the health sector. Our clients include four Foundation Trusts, seven Clinical Commissioning Groups, and two NHS business partners in the third sector. Our mission is to provide “Excellence in audit and service by putting the client first”. We provide an effective internal audit service to our clients, ensuring that our internal audit plans focus on the key risks facing the organisation, and are flexible in addressing risks as they emerge in year. We also offer consulting activities on request and all work is carried out in accordance with Public Sector Internal Audit Standards. We have a highly skilled team, with significant experience in the public and private sectors, including:

• NHS internal audit; • NHS external audit; • local government internal audit; • local government external audit; • education internal audit; • education external audit; and • private sector internal and external audit.

The team includes qualified accountants, qualified internal auditors, a NEBOSH qualified health and safety specialist, accredited counter fraud specialists and a ISACA certified information systems auditor.


4. Internal Audit Performance A number of performance indicators are reported to the Audit Committee as a means of helping to assess the performance of Internal Audit. The indicators are derived through the analysis of a range of internally generated performance indicators and from the independent assessment of the service by external bodies. Achievement of the Annual Internal Audit Plan For all of the planned audit work, we issued all audit reports by 13 May 2015, with the exception of the audit of Incident Management. Finalisation has been delayed due to the unavailability of a key member of client staff. The audit fieldwork has been completed and a report has been drafted for this audit, this will be finalised and reported to Audit Committee during 2015. The following areas were included in the original Annual Audit Plan 2014/15: • board and board committees – cancelled due to the completion of a major governance

review by Deloitte. • salary overpayments, pre-recruitment checks and payroll – the audit of HR Processes (DBS

Checks and Overpayments) was completed and issued in January 2015. These audits were deferred to allow time for the implementation of actions from this audit report.

Issues raised Management have agreed to take appropriate action in relation to all relevant issues raised by Internal Audit. Internal Audit satisfaction questionnaire results Satisfaction surveys are issued after the completion of audit reviews and the results are monitored. A total of seven client satisfaction surveys have been returned during 2014/15. The results are positive. The average figure across all survey criteria has increased from 4.17 to 4.42. Table 3

Key: 1 - Poor 2 – Fair 3 – Average 4 – Good 5- Excellent

1 1.5 2 2.5 3 3.5 4 4.5 5

Professionalism

Quality of planning

Validity of findings

Practicality of recommendations

Responsiveness to queries

Overall satisfaction

Figure 1 Survey Analysis 2014/2015


Service development We have continued to develop the provision of an effective Internal Audit service to our clients by ensuring that Internal Audit plans focus on the key risks facing NHS organisations in a fast moving environment, and being flexible in addressing risks as they emerge in year. We continue to be a member of NHS Audit England, a national group representing NHS based Internal Audit and Counter Fraud service providers. SIAS is a founder member of the NHS Audit England special interest group for providers of audit to ambulance services throughout England. Out of the ten ambulance service providers in England seven are audited by NHS audit providers with a further two audited by an affiliate member. All are part of the special interest group which enables both the sharing of audit information and the benchmarking of audit areas. Quality control External quality accreditation for providers of Internal Audit services is recommended in the Public Internal Audit Standards, in order that clients can gain assurance of the quality of service provided. We are accredited to the internationally recognized quality standard ISO 9001:2008 and we are regularly monitored by SGS - the world's leading inspection, verification, testing and certification company. The last ISO 9001:2000 quality standard external inspection was carried out in March 2015. We received a favourable review and no significant weaknesses requiring action were identified. Organisational independence and individual objectivity In order to ensure compliance with the Public Internal Audit Standards, the Head of Internal Audit is required to confirm to the Board, at least annually, the organisational independence of the internal audit activity. We can confirm that organisational independence is in place, i.e. the Head of Audit has free and unfettered access to the Accounting Officer, and internal audit is free from interference in relation to determining and performing its work, and communicating the results of that work. With respect to individual objectivity, the Public Internal Audit Standards state that steps must be taken to avoid or manage transparently and openly conflicts of interest so that there is no real or perceived threat or impairment to independence in performing the audit role. All internal auditors working within the NHS must complete an annual declaration of interest identifying possible conflicts of interest and the actions taken to mitigate them. Annual declarations have been completed by all SIAS staff for 2014/15 and no conflicts of interest were identified.


5. Conclusion There has been a very positive working relationship between internal audit and Trust staff, which has enabled us to deliver our programme of work successfully. Significant assurance has been given for 2014/15 in the Head of Internal Audit Opinion for the financial year ending 31 March 2015. We have issued 17 reports and have one report outstanding for issue; it is considered that there are no issues arising in these reports that need to be reflected in the Trust’s Annual Governance Statement for the financial year ending 31 March 2015.


Appendix 1 Individual assurance opinions

Reports issued

Audit Overall opinion

HR Processes (DBS Checks and Overpayments) Significant Weaknesses

Management of Health and Safety Significant weaknesses

Ambulance Car Service Some weaknesses

Freedom of Information Some weaknesses

Complaints Some weaknesses

EAT Training Some weaknesses

Procurement and Contracts Adequate

Financial Planning and Budgetary Control Adequate

Assurance Framework and Risk Management Adequate

IG Toolkit Adequate

Financial Ledger Good

Monitor Risk Assessment Framework Submissions Good

Project Management Good

Data Protection (follow up of previous “limited assurance” report) N/A

PC Environment (follow up of previous “limited assurance” report) N/A

Commercial Business Services (follow up of previous “limited assurance” report)

N/A

111 System (follow up of previous “limited assurance” report) N/A

Outstanding for issue

Audit Results of audit fieldwork

Incident Management and the Management of Risk

Draft report. No fundamental control weaknesses that impacts upon our overall Head of Internal Opinion of significant assurance


Appendix 2

Overall Opinion

Good – There is an effective and efficient system of risk management and governance in place to ensure that the objectives of the system are met.

Adequate – Efficient and effective arrangements are in place to ensure that the majority of risks are managed. Some small improvements need to be made in order to provide assurance that all the objectives of the system are met.

Some weaknesses – Improvements are required in a number of areas to increase the efficiency and effectiveness and ensure objectives of the system are met.

Significant weaknesses – There is a substantial risk that the system will fail to meet its objectives. Immediate significant improvements are required to increase the efficiency and effectiveness of risk management and governance.

Findings and Recommendations

High Priority: Findings referring to important issues that are fundamental and material to the Trust’s system of internal control. Action needs to be taken as a matter of urgency.

Medium Priority: Issues arising referring mainly to matters that have an important effect on the Trust’s system of internal control but do not require immediate action. A system objective may still be met in full or in part or a risk adequately mitigated but the weakness represents a significant deficiency in the system.

Low Priority: Issues arising that would, if corrected, improve the Trust’s system of internal control in general but are not vital to the overall system of internal control.


Appendix 3 Overall assessment framework

HIGH PRIORITY

• Any illegal operation • Any national reputation impact • Any high risk failure to comply with regulatory requirements • Failure or absence of a control which would probably result in

a direct risk of serious injury to staff, customers or third parties

• Absence or failure of fundamental control where there is no compensating control

MEDIUM PRIORITY • Absence of clear organisation policy or organisational non-

compliance • Any local reputation impact • Failure or absence of a control which would possibly result in

a direct risk of serious injury to staff, customers or third parties • Absence or failure of key controls i.e. orders not authorised,

no review of bank reconciliation • A weakness in fundamental control • Absence or inadequacy of procedure notes • Inefficiency practice which fails to achieve value for money or

result in increased costs LOW PRIORITY

• General weakening of the control environment • Localised non-compliance with policy • Failure or absence of a control which would possibly result in

an indirect risk of serious injury • Localised failure of a control which would possibly result in

direct risk of injury to staff, customers or third parties • Procedure notes not updated • Poor use of resources

A NUMBER OF HIGH PRIORITY ACTIONS

ANY HIGH PRIORITY ACTION

A NUMBER OF MEDIUM ACTIONS THAT CUMULATIVELY COULD MEET THE CRITERIA FOR A HIGH PRIORITY ACTION

A LARGE NUMBER OF LOW PRIORITY ACTIONS THAT CUMULATIVELY COULD MEET THE CRITERIA FOR A MEDIUM PRIORITY ACTION

ANY MEDIUM PRIORITY ACTION

LOW PRIORITY ACTIONS THAT CUMULATIVELY DO NOT WARRANT A SATISFACTORY STATUS

SIGNIFICANT WEAKNESSES

SOME WEAKNESSES

ADEQUATE

GOOD

north east ambulance service nhs foundation trust · strategic objectives and an analysis of ......

Documents