NHS Education for Scotland s1

IN CONFIDENCE NES/AUD/15/15

NHS Education for Scotland

AUDIT COMMITTEE

Minutes of the Fifty Third Meeting of the Audit Committee held on Thursday 9 April 2015 at Westport 102, Edinburgh.

Present: Ms Carole Wilkinson (Chair) Ms Susan Douglas-Scott Dr Doreen Steele Ms Susan Stewart

In attendance: Ms Helen Berry, Scott-Moncrieff Dr Lindsay Burley, NES Board Chair Ms Caroline Lamb, Acting Chief Executive Mrs Audrey McColl, Acting Director of Finance/Lead Officer Mrs Janice Sinclair, Acting Deputy Director of Finance (via telephone) Ms Alison Shiell, Corporate Governance Officer

1. Welcome and introductions

The Chair welcomed everyone to the meeting, particularly Helen Berry from Scott-Moncrieff and Susan Stewart who was attending her first Audit Committee meeting.

2. Apologies for absence

Apologies for absence were received from Chris Brown (Scott-Moncrieff/Internal Auditor) and Jim Boyle (Deloitte/External Auditor).

The Chair noted the external auditors had been invited to attend this Audit Committee in relation to item 6(d), however they did not consider this necessary as they do not formally place any reliance on the work of the internal auditors but use their findings to “direct and inform” our approach.

3. Any other business

There was no other business requiring consideration by the committee.

The Chair requested that, due to linked content, items 6(d) and 7(e) and then items 7(b) and 11 were taken together. The minutes have been written to reflect this.

4. Minutes of the Audit Committee, 8 January 2015. (NES/AUD/15/01)

The minutes of the previous meeting held on 8 January 2015 were approved as a correct record. Action: AS 5. Matters arising

There were no matters arising which were not covered elsewhere on the agenda.

1 6. Operation of the Audit Committee

The Chair introduced this item by noting recent changes to Audit Committee membership and recognised an opportunity for the committee to review its remit and how it performs its duties. a. Review of Remit (NES/AUD/15/03)

The committee considered the current remit of the Audit Committee and discussed whether it was fit for purpose.

In response to a query from the Chair, members agreed it would be helpful to state explicitly that the Audit Committee receives annual reports from all board standing committees as part of its review of governance arrangements which informs the Governance Statement in the annual accounts. It was agreed the remit should include a new third bullet point within part (a) Internal Control, Risk Management and Corporate Governance.

Helen Berry highlighted that part (a) of the remit could also include a bullet point stating the Audit Committee regularly receives an update report on counter-fraud arrangements within NES and NHSScotland. Members agreed this addition would be helpful.

After discussion, members agreed it would be helpful to revisit the remit after the self-assessment exercise (item 6(c)) has been completed and new board members have completed their audit training. It was noted the remit will be amended in light of the committee’s discussion. Action: AMcC b. Audit Committee Workplan for 2015/16 (NES/AUD/15/04)

The Chair presented the draft Audit Committee workplan for the 2015/16 financial year and asked for comments. The workplan sets out the draft agenda items for the 2015/16 committee meetings and also includes information on how each item links to the Audit Committee remit.

After discussion, it was agreed the workplan will be amended in light of any changes to the Internal Audit Plan and will then be brought to the Audit Committee meeting on 11 June, along with the final draft of the 2015/16 Internal Audit Plan. Action: AMcC/AS c. Self-Assessment (NES/AUD/15/05)

The Chair introduced an Audit Committee self-assessment questionnaire and noted it was best practice for standing committees to periodically review their performance and identify any future training needs. The Chair also noted that recent changes to the Audit Committee’s membership meant that only a small number of members could complete the questionnaire and asked for the committee’s input in relation to how this exercise could be taken forward.

The Chair highlighted that Helen Berry had offered to facilitate a workshop for Audit Committee members focusing on the self-assessment exercise and any other useful topic areas. Caroline Lamb noted it may be helpful for longer-standing members of the Audit Committee to complete the self-assessment questionnaire in advance of the workshop, with this information being used as a starting point for discussion.

2 After discussion, the Chair asked that an informal discussion is held at the end of the Audit Committee meeting to discuss the format and logistics of the planned workshop. The outputs of this discussion are noted at the end of the minutes. d. Future Approach to Audit Delivery 7e. Draft Internal Audit Plan 2015-18 (NES/AUD/15/10)

As noted in item 3, the future approach to audit delivery and the draft internal audit plan items were taken together.

The Chair introduced a discussion on the future approach to audit delivery by stating the idea for the discussion came out of the recent internal audit tendering process and the re-appointment of Scott-Moncrieff as NES’ internal auditors. During the tendering process, Chris Brown and Helen Berry raised the issue of where they, as internal auditors, should be focusing their future audit activities. Members recognised the majority of reports submitted to the Audit Committee over the past year did not highlight any cause for concern. Whilst noting this positive development, the Chair asked members to consider whether the Audit Committee should take a different approach to internal audit going forward and how this could be achieved.

Helen Berry introduced the draft Internal Audit Plan for 2015-18 alongside the ‘future approach’ discussion and began by noting the planned number of internal audit days for 2015/16 had been reduced from 125 to 110. Helen Berry also noted she had recently attended a meeting of the NES Executive Team to discuss the draft internal audit plan and how future internal audit activities could become more focused on providing support for business improvement as well as their assurance role As a result of meeting with the Executive Team, Helen Berry confirmed the following proposals/actions for internal audit in NES going forward:

 Scott-Moncrieff will meet with the Executive Team individually to discuss any areas of concern and how these could be addressed by internal audit.  The internal audit days at the beginning and end of each scheduled audit will be used to meet with senior managers to discuss the scope of the audit beforehand and the resulting management recommendations at the end.

The Chair and Helen Berry asked members for comments and during discussion, the following points were noted:

 The Chair highlighted the importance of senior managers within NES understanding the internal audit process and engaging with internal auditors going forward. Audrey McColl noted that she and Helen Berry are planning to facilitate an internal audit session at a future meeting of the Senior Operational Group, which comprises of senior managers across NES.  Audrey McColl noted the Executive Team’s discussions with Helen Berry included how the current internal audit focus on individual systems could be expanded to incorporate wider processes/strategies, with the current Digital Transformation highlighted as an example. The GMC visit in 2017, quality control in relation to data gathering and the corporate complaints processes, were also noted as potential areas of focus for future internal audits.  One member stated that territorial boards invite senior managers to Audit Committee meetings to discuss internal audit reports and queried whether NES could adopt a similar approach. Members agreed it would be useful for relevant senior managers to attend a meeting where an internal audit report highlights a need for improvement to encourage dialogue between the Audit Committee and staff.  The Chair asked if NES’s preparations for the implementation of health and social care integration could be audited. Members recognised the challenges associated with carrying out an internal audit in this area.

3  Caroline Lamb noted the importance of internal audit focusing on NES’ corporate complaints process, particularly in light of an increase in complaints received from trainees who had previously exhausted other appeals processes. Members noted the opportunities for learning and improvement in this area.  Members discussed how issues in territorial boards in relation to the learning environment could be affecting NES’ ability to deliver educational programmes and the importance of NES reviewing the mechanisms in place to address any issues raised, particularly in relation to the creation and implementation of action plans resulting from trainee surveys. It was noted this could be raised by the Educational & Research Governance Committee as a future area of internal audit.  One member asked whether enough internal audit days had been scheduled for reviews of the Digital Strategy and Internal Communications, specifically in light of the planned changes in these areas and the forthcoming retiral of the current Head of Corporate Communications. Members noted these issues had also been raised at the meeting with the Executive Team. Helen Berry confirmed an internal audit report regarding the Turas system and the wider Digital Transformation is currently being prepared and will be submitted to the Audit Committee on 11 June.  The NES Board Chair highlighted the importance of NES as an organisation understanding how it can best use internal audit. Members agreed internal audit should be raised at future meetings of the Educational & Research Governance and Staff Governance committees. Action: AS

After discussion, the committee noted the information contained in the draft Internal Audit plan. Helen Berry confirmed she will meet with the Executive Team to discuss future internal audit priorities. The final version of the Internal Audit plan will be submitted to the Audit Committee meeting on 11 June for formal approval.

7. Internal Audit Reports a. Internal Audit Progress Report (NES/AUD/15/06)

Helen Berry presented an internal audit Progress Report. This report presents the Audit Committee with a formal summary of internal audit activity since the last meeting, and confirms the reviews planned for the coming quarter (in line with the 2014/15 internal audit plan).

Helen Berry confirmed the two remaining IT internal audit reports, which will include an application review of the Turas system, and the Property Transaction Monitoring report will be submitted to the Audit Committee on 11 June. An annual report of all 2014/15 internal audit activity will also be submitted to the June meeting.

After discussion, the committee noted the information contained in the Progress Report. b. Audit Visit Memo - Fraud Prevention (NES/AUD/15/07) 11. Counter-Fraud Update (NES/AUD/15/13)

As noted in item 3, the Fraud Prevention audit visit memo and the Counter-Fraud Update items were taken together. The Counter-Fraud update included a section on progress in relation to the completion of the Counter Fraud Services (CFS) Fraud Risk Assessment Methodology (FRAM), and this is referenced in the audit visit memo.

Helen Berry introduced an internal audit visit memo which focused on the annual gap analysis that NES is required to carry out in respect of fraud. The Scottish Government issued CEL 11 (2013) which includes a requirement for organisations to complete a fraud risk assessment using the CFS methodology.

4 The fraud risk assessment consists of two elements. The first part requires management to identify which of a maximum of 90 areas of potential fraud risk are relevant to NES; and members noted that NES, as a special health board, is only required to look at two out of the seven CFS fraud classifications: ‘External’ and ‘Staff’. The second part requires management to allocate scores for materiality, inherent risk and control risk to each relevant fraud risk classification using the CFS fraud risk assessment methodology (FRAM). Janice Sinclair explained how the FRAM applies the materiality, inherent risk and control risk features against each identified area of risk. NES has not reported any frauds since the issue of CEL 11 and members noted that the public sector general fraud/error level had been applied for the measurement of inherent risk.

NES had requested that the internal audit days available for fraud prevention work were used to support management in completing the fraud risk assessment. Scott-Moncrieff provided the results of previous internal audit work to inform the scoring of control risk, using the CFS scoring methodology. NES identified 48 out of 90 relevant areas of risk and Scott-Moncrieff was able to provide control risk scores for all but 17 risk areas. For the remaining 17 a control risk score was given based on controls known to be in place, but not yet subjected to internal audit. Helen Berry noted the results of the fraud risk assessment will be used to identify areas for focus in the 2015/16 internal audit plan.

The Counter-Fraud Update paper included initial results of the FRAM with the top 20 areas of risk shown in rank order.. Members were asked for feedback in relation to the control risk measurements, particularly for those areas which had not been reviewed by internal audit, as any changes could potentially affect the current rank order. Janice Sinclair highlighted these results were part of the first draft of the fraud risk assessment so any feedback and amends would be welcomed.

During discussion of the FRAM, the following points were noted:

 Members discussed the FRAM in relation to the low risk nature of NES’ work in comparison with territorial boards and the differences in NES/territorial boards’ ways of working. Caroline Lamb noted the importance of NES not being driven by a mechanical process. Members noted that as NES hadapplied a generic public sector fraud/error level (between 3 – 8%), as there were no historic levels to use, this could lead to the submission of misleadingdata.  Helen Berry noted completion of the FRAM is a useful opportunity for Audit Committee discussion and recommended that NES include an additional column within the FRAM spreadsheet to indicate what action NES will take in relation to a particular FRAM risk score. Audrey McColl noted this column could also include evidence of other NES policies that monitor particular risk areas. Members agreed this would be a helpful approach. Action: JS/AMcC  Caroline Lamb queried the high control risk score of the Staff/Theft of Intellectual Property risk. After discussion, members agreed the control score risk should be reduced from 80 to 20 to provide a more realistic fraud risk. The importance of defining and sharing NES intellectual property was recognised.

Janice Sinclair confirmed the FRAM spreadsheet would be updated in light of members’ comments and then shared with Helen Berry and the CFS. Caroline Lamb noted it would be useful to revisit the risk assessment carried out by NES when CEL 11 (2013) was originally issued and complete a comparison with the FRAM results to identify whether anything has been missed out. Action: JS/AMcC

5 Janice Sinclair presented the remaining sections of the Counter-Fraud Update to the committee. Members noted that progress against the revised CEL checklist had not changed since the previous Audit Committee in January, apart from completion of the FRAM. The Chair asked that evidence relating to the provision of the Bribery Act (2010) is strengthened to include how staff are informed of the contents of the act and their responsibilities in relation to it. Action: JS

Members discussed whether the CEL checklist needed to be included in every Counter- Fraud Update. Helen Berry noted the full checklist is not usually contained in other NHS board updates. It was agreed the checklist should be included in the update to the June Audit Committee and a further decision regarding its future inclusion will be made at the June meeting.

Section D of the update provided information in relation to the National Fraud Initiative (NFI). The NFI is Audit Scotland’s biannual data matching exercise and NES uploaded data for the 2014-15 exercise at the end of 2014. 2014 data matches were made available to participating organisations on 29 January 2015 and the results were presented as a table on page 13 of the update. Janice Sinclair highlighted that data matches indicate that further investigation is required, but did not necessarily mean an instance of fraud. The 2014 NFI data for NES has flagged a ‘payroll to payroll’ data match which is a part-time member of staff who is also legitimately employed by another Board. Janice Sinclair confirmed the data matches will be reviewed and closed over the coming months and that no official deadline had been given by Audit Scotland for the completion of the 2014-15 NFI exercise in recognition of data matches being released at the financial year-end. Members noted that regular NFI updates will be submitted at future Audit Committee meetings.

After discussion, the committee noted the audit visit memo and counter-fraud update. The committee confirmed they were content for the FRAM result to be submitted to the CFS once the necessary amends are made and approved the release of CEL quarterly return to the CFS (Section E). On behalf of the committee, the Chair thanked Janice Sinclair for her work. Action: JS c. Educational Governance Framework (NES/AUD/15/08)

The Educational Governance Framework sets out the guidelines to be followed in providing assurance about the quality of NES educational initiatives.

Helen Berry introduced an internal audit report which reviewed the action plan developed to implement the revised Educational Governance Framework. The report also considered the extent to which the existing framework is applied across NES and whether any additional areas for improvement should be included within the implementation action plan.

The report confirmed the internal auditors gained a high level of assurance over the arrangements in place for the development and planned implementation of the revised Educational Governance Framework. The report identified one area for improvement which was then addressed through the revisions incorporated into the latest version of the framework.

The committee welcomed and noted this very positive report.

6 d. Follow-Up Review (NES/AUD/15/09)

Helen Berry presented a follow-up review of the 2014/15 internal audit year. It was noted the ‘Quarter 4’ front cover of the review was incorrect. The follow-up review provides senior management and the Audit Committee with assurance that internal audit actions agreed during previous financial year(s) have been implemented satisfactorily.

Members noted the summary of progress on pages 2 and 3 of the review and the reduction in outstanding internal audit actions from 87 to 26. Of the 26 outstanding actions, 18 are partially complete and 8 are not yet due for completion. There is one outstanding Grade 4 (red) action which relates to the configuration of the Scottish Online Appraisal Resource (SOAR).

Helen Berry noted the annual internal audit follow-up review will move to a quarterly report going forward. Follow-up reports will be submitted to every Audit Committee meeting with the aim of giving more frequent attention to outstanding actions. Audrey McCollalso confirmed the NES internal audit tracker will be incorporated into the Integrated Planning and Performance (IPPS) system to simplify the update process.

The Chair welcomed the follow-up report and the progress made in closing outstanding actions. During discussion members noted the importance of providing realistic timescales to the implementation of internal audit recommendations, particularly in light of actions which originally appeared on the tracker during the 2010/11 financial year.

After discussion, the committee noted the information contained in the follow-up review and the Chair thanked Helen Berry for her work.

e. Draft Internal Audit Plan (NES/AUD/15/10)

This item was taken in conjunction with item 6(d) – Future Approach to Audit Delivery.

8. External Audit Reports a. Financial Capacity in Public Bodies (NES/AUD/15/11)

Audrey McColl presented an Audit Scotland paper to the committee for information. The Baseline Information Audit Guide - Financial Capacity in Public Bodies paper has been produced in light of Annual Audit Reports indicating that overall reductions in staff numbers in public bodies may be affecting the capacity of back-office functions, and finance teams in particular. Audit Scotland have asked external auditors to collect information as part of the 2014/15 audit that may identify common or emerging issues.

The paper includes a questionnaire to be used by the external auditors to gather baseline information for the 2014/15 accounts. Audrey McColl confirmed the contents of the questionnaire raises no concerns for NES. Audrey McColl and Janice Sinclair will shortly be meeting with the external auditors to discuss the 2014/15 accounts and will ask for clarification in relation to how much time/resource will be needed to complete the questionnaire. Action: AMcC/JS

The committee noted the information contained in the Audit Scotland paper. Audrey McColl confirmed members will see the completed questionnaire as part of the 2014/15 Annual Accounts report submitted to the Audit Committee on 11 June.

7 9. Other External Reports

There were no items to consider under this agenda heading.

10. Accounting Policies Update (NES/AUD/15/12)

Janice Sinclair presented a paper on the 2014-15 accounting policies to be adopted by NES to the committee for approval. Members noted the Annual Accounts Manual for 2014-15 did not require any changes to the accounting policies which apply to NES.

The Auditor General issued best practice guidance for NHS reports and accounts in December 2014. This guidance advised boards to tailor the template for accounting policies contained in the Annual Accounts Manual, and in particular, remove references to ‘zero balance’ items. Janice Sinclair confirmed NES has reviewed its accounting policies in line with this guidance and a small number of wording changes have been proposed as indicated in Appendix 2.

The committee approved the proposed wording changes to the accounting policies for 2014-15 and noted the helpful colour-coding used within the paper. Members noted the policies could change further between this Audit Committee and the meeting in June if other zero balance items are identified during the annual accounts preparation process.

11. Counter-Fraud Update (NES/AUD/15/13)

This item was taken in conjunction with item 6(b) – Audit Visit Memo: Fraud Prevention.

12. Items for information

a. Audit Scotland Reports

i. An overview of local government in Scotland 2015 (NES/AUD/15/14)

Members received and noted a report from Audit Scotland commenting on the challenges faced by local government in Scotland in 2015, particularly in relation to 2015/16 budgetary pressures and establishing effective health and social care partnerships.

The committee noted the information contained in the report. During discussion, members commented on the importance of public sector organisations carrying out medium and longer-term financial planning to ensure they are prepared for further financial challenges. Members also noted the lack of references to health and social care integration within the report and commented on the significant policy changes the integration plans will involve.

13. Private Meeting a. Private Meeting between Auditors and Audit Committee Members

The Chair agreed with Helen Berry that a private meeting between the Auditors and Audit Committee members was not required at this meeting.

14. Date and time of next meeting

The next meeting of the Audit Committee will be held on Thursday 11 June 2015 at 10:45am, Westport 102.

8 Informal Discussion with Audit Committee – Audit Workshop

As noted in item 6(c), members discussed the possible content of an Audit workshop facilitated by Helen Berry.

Members agreed it would be helpful to review the self-assessment questionnaire together and talk through the implications of each question as part of the workshop. The Chair asked members to consider and send through any additional topics that could be covered.

It was agreed longer-standing Audit Committee members and those in attendance should complete the self-assessment questionnaire in advance of the workshop. Alison Shiell will co-ordinate the return of the questionnaires. Newer members of the committee were asked to submit any questions relating to the self-assessment in advance of the workshop.

It was agreed the workshop should be held after the Audit Committee on 11 June from 1:00 – 3:00pm. Lunch will be provided. Members also agreed the workshop invite should be extended to other members of the board. Alison Shiell will co-ordinate the meeting logistics and the sending out of the workshop invite. Action: AS

NES April 2015 AS/cl/amcc