Agenda Document Pack - Audit, Performance and Risk Committee - 24/11/2022
Moray Council · 24 November 2022
Back to Audit, Performance and Risk Committee — 24 November 2022 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit, Performance and Risk Committee Thursday, 24 November 2022 Council Chambers NOTICE IS HEREBY GIVEN that a Meeting of the Audit, Performance and Risk Committee, Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Thursday, 24 November 2022 at 14:00 to consider the business noted below. AGENDA 1. Sederunt 2. Declaration of Member's Interests 3. Minutes of meeting of 25 August 2022 3 - 4 4. Action Log of Meeting of 25 August 2022 5 - 6 5. Quarter 2 Performance Report 7 - 14 6. Internal Audit Section - Update Report 15 - 18 7. Strategic Risk Register Report 19 - 46 8. Internal Audit Section Completed Projects Report 47 - 66 9. Directions Monitoring Report 67 - 72 Page 1
Page 2
MORAY INTEGRATION JOINT BOARD SEDERUNT Councillor Scott Lawrence (Chair) Mr Derick Murray (Voting Member) Mr Sandy Riddell (Voting Member) Councillor John Divers (Voting Member) Mr Sean Coady (Member) Mr Graham Hilditch (Member) Mr Simon Bokor-Ingram (Member) Ms Sonya Duncan (Member) Ms Deborah O'Shea (Member) Mr Neil Strachan (Member) Mr Stuart Falconer (Non-Voting Member) Clerk Name: Tracey Sutherland Clerk Telephone: 07971 879268 Clerk Email: committee.services@moray.gov.uk Page 2
Page 3
MINUTE OF MEETING OF THE AUDIT, PERFORMANCE AND RISK COMMITTEE Thursday, 25 August 2022 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Simon Bokor-Ingram, Mr Sean Coady, Councillor John Divers, Mr Graham Hilditch, Councillor Scott Lawrence, Mr Derick Murray, Deborah O'Shea, Mr Sandy Riddell APOLOGIES Sonya Duncan, Mr Steven Lindsay, Ms Jane Mackie, Mr Neil Strachan IN ATTENDANCE Also in attendance were the Chief Internal Auditor and Tracey Sutherland, Committee Services Officer. 1. Welcome and Apologies Sandy Riddell as Chair of the meeting welcomed everyone and apologies were noted. 2. Declaration of Member's Interests Mr Riddell declared that he is Chair of the Mental Welfare Commission. There were no other declarations of Members' interests in respect of any items on the agenda. 3. Minutes of meeting of 30 June 2022 - am The minute of the meeting of 30 June 2022 was submitted and approved. 4. Minute of Meeting of 30 June 2022 - pm The minute of the meeting of 30 June 2022 was submitted and approved. Item 3. Page 3
Page 4
5. Action Log of Meeting of 30 June 2022 The Action Log of the meeting of 30 June 2022 was considered and updated accordingly. 6. Quarter 1 Performance Report A report by the Corporate Manager updated the Committee on performance as at Quarter 1 (April to June 2022) Following consideration the Committee agreed to note: i) the performance of local indicators for Quarter 1 (April to June 2022) as presented in the Performance Report as at Appendix 1; and ii) the analysis of the local indicators that have been highlighted and actions being undertaken to address performance that is outside of acceptable target ranges as detailed in Appendix 1. 7. Internal Audit Section - Update Report A report by the Chief Internal Auditor provided the Committee with an update on progress against the 2022/23 Audit Plan. Following consideration the Committee agreed to note the audit update. 8. Strategic Risk Register Report A report by the Chief Officer provided the Committee with an overview of the current strategic risks, along with a summary of actions which are in place to mitigate those risks, updated August 2022. Following consideration the Committee agreed to: i) note the updated Strategic Risk Register included in Appendix 1; and ii) note the Strategic Risk Register will be further refined to align with the transformation and redesign plans as they evolve. 9. Internal Audit Section - Completed Projects Report A report by the Chief Internal Auditor provided the Committee with an update on audit work completed since the last meeting of the Committee. Following consideration the Committee agreed to note the audit update. Page 4
Page 5
MEETING OF MORAY INTEGRATION JOINT BOARD AUDIT, PERFORMANCE AND RISK COMMITTEE THURSDAY 25 August 2022 ACTION LOG Item No. Title of Report Action Required Due Date Action By Update for 24 November 2022 1. Action Log of Meeting dated 27 August 2020 Payment Verification Assurance Update – once through appropriate NHSG Governance route. June 2022 Sean Coady Payment verification has not yet resumed – verbal update November 2022 2. Civil Contingencies Resilience Standards Report Annual Assurance Report from HSCM Civil Contingencies Group March 2023 Corporate Manager Scheduled 3. External Review of Commissioned Services External Review to be commissioned. August 2022 Chief Officer Draft report received. Special Meeting of AP&R to be arranged once final report from KPMG has been received. 4. Quarter 1 Performance Update report from the Psychological Service to be presented following email sent in July March 2023 Corporate Manager This action to be revisited and actioned. Item 4. Page 5
Page 6
Page 6
Page 7
REPORT TO: MORAY INTEGRATION JOINT BOARD AUDIT, PERFORMANCE AND RISK COMMITTEE ON 24 NOVEMBER 2022 SUBJECT: QUARTER 2 (JULY TO SEPTEMBER 2022) PERFORMANCE REPORT BY: CORPORATE MANAGER 1. REASON FOR REPORT 1.1 To update the Audit, Performance and Risk Committee on performance as at Quarter 2 (July to September 2022). 2. RECOMMENDATION 2.1 It is recommended that the Audit, Performance and Risk Committee consider and note the performance of local indicators for Quarter 2 (July - September 2022) 3. BACKGROUND 3.1 The purpose of this report is to ensure the Moray Integration Joint Board (MIJB) fulfils its ongoing responsibility to ensure effective monitoring and reporting on the delivery of services and on the programme of work as set out in its Strategic Plan. Item 5. Page 7
Page 8
4. KEY MATTERS RELEVANT TO RECOMMENDATION 4.1 Local Indicators are assessed on their performance via a common performance monitoring Red, Amber, and Green (RAG) traffic light rating system. RAG scoring based on the following criteria: GREEN If Moray is performing better than target. AMBER If Moray is performing worse than target but within agreed tolerance. RED If Moray is performing worse than target by more than agreed tolerance. 4.2 There is no detailed report attached due to system pressures. Summary 4.3 Performance within Health and Social Care Moray (HSCM) as demonstrated by the agreed indicators up to the end of quarter 2 of the financial year 2022/23 is showing as variable. Four of the indicators are presenting as green and six are red. This represents a reduced performance compared to quarters 3 and 4 in 2021/22 and similar to quarter 1 in 2022. This is a reflection of the pressure being placed on the service that has continued during quarter 2. EMERGENCY DEPARTMENT (ED) - RED 4.4 There was a slight decrease in the attendance rate per 1,000 this quarter from 24.3 to 24, exceeding the target and above the number presenting at the same period last year. The trend over the past 5 months has been a steady and consistent increase each month, in contrast to the gradual decrease each month in the previous 8 months. This increase in demand will not only put pressure on ED but will undoubtedly have an impact on other services. DELAYED DISCHARGES – RED 4.5 The number of delays at the June snapshot was 47, a slight increase from the previous quarter, remaining well above the revised target of 10. Although the number of bed days lost due to delayed discharges reduced from 1207 last quarter to 1197 this is still almost 4 times the target. Both indicators are back to the levels last seen in the winter of 2019/20, just before the COVID-19 pandemic regulations were introduced. EMERGENCY ADMISSIONS – AMBER 4.6 The steady monthly increase in the rate of emergency occupied bed days for over 65s, noted in previous reports, continued this quarter. Since the end of quarter 4 last year the rate has increased from 2,140 to 2,469, exceeding the target of 2,037 per 1,000 population. The emergency admission rate per 1000 population for over 65s has continued to reduce further this quarter from 177.5 to 172.4. Similarly, the long-term trend for the number of people over 65 admitted to hospital in an emergency in the previous 12 months also reduced from 122 to 118.6 over the same period. Both indicators are now GREEN but given the continuing increase in the emergency occupied bed-days for over 65s the overall status for the three indicators combined is AMBER. HOSPITAL RE-ADMISSIONS - GREEN 4.7 The 28-day re-admissions improved and was below target at 6.7%, and the 7- day re-admissions also reduced to below target at 3%. Page 8
Page 9
MENTAL HEALTH – RED 4.8 The service has been unable to meet the 18 week LDP1 target since September 2021. This has declined steadily and in the second quarter of 2022 the % of people who were referred into the service and treated within 18 weeks had fallen to 33%. STAFF MANAGEMENT – RED 4.9 NHS employed staff sickness levels (to the end of August 2022) have declined from 4.2% to 4.5%, still close to the target of 4%. Data for council staff sickness not included in this report due to staffing and time constraints. Figure 1 - Performance Summary *SMO1 data to Sept 2022 5. AREAS NOT MEETING TARGETS Emergency Department 5.1 The rate per 1,000 population presenting at ED is 24, above the required performance level of 21.7 and displaying an increasing trend. In addition, the proportion of patients seen within the 4-hour target time continues to reduce. Prior to March 2020 over 95% of attendees at ED were seen within 4 hours, generally reducing to 90% in the winter months. Performance is below target and continues to deteriorate. 1 Local Delivery Plan Standards; priorities set and agreed between the Scottish Government and NHS Boards. Previously known as HEAT Targets and Standards. Page 9
Page 10
Figure 2 – A&E Attendance rates (all ages) – (TrakCare) 5.2 The Medicine and Unscheduled service continue to working closely with the hospital team and wider partnership to improve flow across the hospital. The hospital continues to experience a significant number of breaches within the ED, many attributed to long bed waits, secondary to delayed discharges and an extensive community hospital waiting list. This regularly equates to 30 percent of the bed base at Dr Gray’s Hospital (DGH). The team has re- established daily breach meetings to establish causes and help mitigate recurring trends. They are also working with the discharge coordinator/social work team and wider Moray partnership to review and manage this on a daily basis. 5.3 Regular, daily, safety briefs are being held to help address any urgent issues with crowding, Scottish Ambulance Service waits and reduced performance, working across the NHSG systems to establish solutions. Minor injury patients are now re-directed regularly and a review of minor injury patients in Moray/DGH has been commenced under the leadership of the Head of Service HSCM and his team. This is ongoing. 5.4 The Medicine and Unscheduled service are also engaging with colleagues across NHSG as part of the redesign of unscheduled care, whilst working to complete the ED service plan which includes plans to reduce the numbers of attendances at ED and improve the performance figures. This includes the design of the rapid assessment and discharge unit based in DGH. This unit will help reduce the pressures faced by ED and improve the flow and performance within the department. 5.5 The ED continues to face significant recruitment issues which have impacted on the service, requiring locum doctors and agency nurses to be engaged. Regular staffing assurance meetings take place with the hospital manager and the team are active in rota management. Finally, a Business Impact Assessment has been completed to help mitigate the impact of gaps in 0 5 10 15 20 25 30 Jan-19 Mar-19 May-19 Jul-19 Sep-19 Nov-19 Jan-20 Mar-20 May-20 Jul-20 Sep-20 Nov-20 Jan-21 Mar-21 May-21 Jul-21 Sep-21 Nov-21 Jan-22 Mar-22 May-22 Jul-22 Sep-22 Rate per 1000 Population A&E Attendance Rate Rate Target Page 10
Page 11
the rota and to ensure the safety of the department, and the well-being of its staff. Delayed Discharge 5.6 The number of people waiting to be discharged from hospital remains high, and there are no indications that the target of 10 people is going to be met soon. The Delayed Discharge indicators (DD-01 and DD-02) continue to be red and remain well above the new targets set at the end of quarter 3 of 2020/21. Figure 3 – Delayed Discharges (all ages) – (PHS, Delayed Discharges publication) 5.7 The reasons for the above target levels remain the same; there is an additional demand from the increase in patients presenting at ED. Previous reports have noted the increased frailty and more complex needs of patients. 5.8 External providers of care within Moray were also experiencing similar high levels of staff absence as were care homes. This significantly limited the ability to meet the demand for care at home. 5.9 The measures outlined in previous reports did appear to be reducing the number of delayed discharges. However, by the end of quarter 2 the situation had reversed, and more people were facing delays when ready to be discharged from hospital. Emergency Admissions 5.10 Emergency Admission rates for the over 65s (EA-02) have reduced further during quarter 1, continuing the trend observed in previous quarters. Note that the rate of 172.4 per 1,000 population is now back below the target based on the 2019 average of 179.9 per 1,000 population. Similarly, the number of people in this category admitted during the past 12 months (EA-03) has followed a similar trend. At the end of quarter 2 the rate had reduced to 118.6 per 1,000 population, below the target of 123.4 per 1,000 population (also based on the 2019 average). 5.11 However, the reduction in admissions may be due to the lack of available beds, in part caused by delays in discharging people and also generally high 0 10 20 30 40 50 60 Jan-19 Mar-19 May-19 Jul-19 Sep-19 Nov-19 Jan-20 Mar-20 May-20 Jul-20 Sep-20 Nov-20 Jan-21 Mar-21 May-21 Jul-21 Sep-21 Nov-21 Jan-22 Mar-22 May-22 Jul-22 Sep-22 Number Delayed Discharges (including code 9) at Census Point Number Target Page 11
Page 12
demand. Furthermore, the over 65s admitted for an emergency are staying in hospital longer. This has been increasing steadily since the start of 2021 and continued to increase each month during quarter 2 reaching a rate of 2,469 bed-days per 1,000 population, exceeding the target of 2,037 per 1,000 population. Mental Health 5.12 Referrals continue to be received by the team and they are working hard to reduce waiting times, offering short notice appointments when it is practical to do so. Following a workshop in June 2022, the Moray psychological therapies steering group was to reconvene and begin the planning of the work streams identified. Staff Management 5.13 The Moray vaccination programme continues to be delivered across all relevant groups as a priority. 5.14 Provider Services continue to face significant challenges, with high staff absences and vacancies adding real dilemmas for front-line delivery. This fluctuating and high level of absence requires close management, with supervisors and managers often having to deliver care. 5.15 Managers are still being faced with daily challenges to find staff to allocate to rosters and to maintain the delivery of their services, and to prioritise the services being provided. 5.16 Recent quarterly reports have highlighted the issues of staff burn-out and the staffing situation facing the HSCM services. There is not much more to add this quarter other than to say that managers and the HR teams continue to spend much of their time on addressing the shortfall in staff and meeting the demand for care. 6. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) and Moray Integration Joint Board Strategic Plan “Moray Partners in Care 2019 – 2029” Performance management reporting is a legislative requirement under section 42 of the Public Bodies (Joint Working) (Scotland) Act 2014. In addition to publishing an Annual Performance Report, the Moray Integration Scheme requires that the MIJB will “monitor the performance of the delivery of integrated services using the Strategic Plan on an ongoing basis” (para 5.2.2 of the Moray Integration Scheme refers). (b) Policy and Legal None directly associated with this report. (c) Financial implications None directly associated with this report. (d) Risk Implications and Mitigation There are no risk issues arising directly from this report. The long-term impact of the COVID-19 on the Health and Social Care system are still Page 12
Page 13
unknown and performance measurement will remain flexible to enable the service to be prepared and react to any future developments. (e) Staffing Implications None directly associated with this report. (f) Property None directly associated with this report. (g) Equalities/Socio Economic Impact An Equality Impact Assessment is not required for the Performance Framework because there will be no impact, as a result of the report, on people with protected characteristics. (h) Climate Change and Biodiversity Impacts No climate change or biodiversity implications have been determined for this policy/activity. It should be noted that extreme weather events, such as the recent storms, are expected to occur more frequently and with greater ferocity in future years. In the longer-term there are likely to be issues with the reduction in availability and increases in costs of fossil fuels that will pose challenges for the delivery of care services to people living in rural areas. (i) Directions There are no directions arising from this report. (j) Consultations For Health and Social Care Moray the Chief Officer, Corporate Officer and Service Managers in relation to respective areas have been consulted as has Tracey Sutherland, Committee Services Officer, Moray Council and their comments are incorporated in the report. 7. CONCLUSION 7.1 This report provides the MIJB with an overview of the performance of specified Local and National indicators and outlines actions to be undertaken to improve performance in Section 4. Authors of Report: Sonya Duncan, Corporate Manager Background Papers: Available on request Ref: Page 13
Page 14
Page 14
Page 15
REPORT TO: MORAY INTEGRATION JOINT BOARD AUDIT, PERFORMANCE AND RISK COMMITTEE ON 24 NOVEMBER 2022 SUBJECT: INTERNAL AUDIT SECTION - UPDATE REPORT BY: CHIEF INTERNAL AUDITOR 1. REASON FOR REPORT 1.1 To provide an Internal Audit update to Committee members. 2. RECOMMENDATION 2.1 The Audit, Performance and Risk Committee is asked to consider and note this audit update. 3. BACKGROUND 3.1 Public Sector Internal Audit Standards (PSIAS) require the Chief Internal Auditor to prepare and present reports to committee on internal audit’s activity relative to the audit plan and on any other relevant matters. 4. KEY MATTERS RELEVANT TO RECOMMENDATION 4.1 In accordance with the Audit Plan for 2022/23, a review has been undertaken into the systems and procedures in the management and security of data, including the transfer of data between the Council and Care Providers. Further to discussions with the Internal Audit Providers of NHS Grampian, Aberdeen City and Aberdeenshire Councils, it was agreed to coordinate the audit process in order to provide an overall opinion on the control environment. Further to a recent communication, it has not proved possible for the NHS Grampian Internal Audit Provider to participate as a review by the Information Commissioner has taken precedence. I am pleased to report the audit within Moray has been completed, and the draft report issued to the Service. I intend to provide the executive summary and recommendations to the next meeting of the Audit, Performance and Risk Committee. Audit Plan 2023/24 4.2 Preparation has begun to agree on the Audit Plan for 2023/24. Internal Audit’s approach to annual audit planning is risk-based with all areas which may be subject to audit review contained within an ‘audit universe.’ The audit universe Item 6. Page 15
Page 16
is reviewed and updated on an ongoing basis to include all significant activities and systems. 4.3 The consultation process with officers has also provided the opportunity to establish timescales for responding to requests for information during an audit review and in responding to recommendations. Public Sector Internal Audit Standards 4.4 The Local Authority Accounts (Scotland) Regulations 2014 require that ‘a local authority must operate a professional and objective internal auditing service in accordance with recognised standards and practices in relation to internal auditing’. The recognised standards adopted by all Scottish Councils are the Public Sector Internal Audit Standards (PSIAS) developed by the Chartered Institute of Public Finance and Accountancy and the Chartered Institute of Internal Auditors. The standards include a requirement for an annual self-assessment. 4.5 Internal monitoring of performance against these standards has been ongoing in previous years. However, a more structured self-assessment has recently been undertaken in preparation for the next External Quality Assessment, scheduled for 2023. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) and Moray Integration Joint Board Strategic Plan “Moray Partners in Care 2019 – 2029” Internal audit work supports good governance and assists in securing appropriate systems of internal control. (b) Policy and Legal The internal audit service is provided in terms of paragraph 7:1 of the Local Authority Accounts (Scotland) Regulations 2014, and there is a requirement to provide a service in accordance with published Public Sector Internal Audit Standards. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications Audit reports highlight risk implications and contain recommendations for management to address as a means of mitigating. (e) Staffing Implications No implications directly arising from this report (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts None directly arising from this report. Page 16
Page 17
(i) Directions None directly arising from this report. (j) Consultations There have been no direct consultations during the preparation of this report. 6. CONCLUSION 6.1 This report provides committee with an update on internal audit work progressed in the latest review period. Author of Report: Dafydd Lewis, Chief Internal Auditor Background Papers: Internal Audit Files Ref: mijb/ap&rc/24112022 Page 17
Page 18
Page 18
Page 19
REPORT TO: MORAY INTEGRATION JOINT BOARD AUDIT, PERFORMANCE AND RISK COMMITTEE ON 24 NOVEMBER 2022 SUBJECT: STRATEGIC RISK REGISTER – NOVEMBER 2022 BY: CHIEF OFFICER 1. REASON FOR REPORT 1.1 To provide an overview of the current strategic risks, along with a summary of actions which are in place to mitigate those risks, updated on November 2022. 2. RECOMMENDATION 2.1 It is recommended that the Audit, Performance and Risk Committee (APR) agree to: i) consider and note the updated Strategic Risk Register included in APPENDIX 1; and ii) note the Strategic Risk Register will be further refined to align with the transformation and redesign plans as they evolve 3. BACKGROUND 3.1 The strategic risk register is reviewed regularly by the Senior Management Team as part of a robust risk monitoring framework, to identify, assess and prioritise risks related to the delivery of services in relation to delegated functions, particularly any which are likely to affect the delivery of the Strategic Plan. 3.2 The Moray Integration Joint Board (MIJB) Strategic Risk Register is attached to this report at APPENDIX 1 and sets out the inherent risks being faced by the MIJB, together with a current assessment on the level of the risks and mitigating actions being taken to reduce the impact of the risks. This report is presented to Clinical Care Governance committee for their oversight and comment. 3.3 Risk scores are weighted, based on assessment according to their likelihood and corresponding impact, as per Section 5 of the MIJB Risk Policy. Item 7. Page 19
Page 20
3.4 The Strategic Risks received an initial review to ensure they align to the Moray Partners in Care 2019-2029 strategic plan which was agreed at MIJB on 28 November 2019 (para 13 of the minute refers). 4. KEY MATTERS RELEVANT TO RECOMMENDATION 4.1 The Risk Management Framework review was completed and outcome was approved by the Board on 25 June 2020 (para 9 of the minute refers). The approved Risk Appetite Statements have been included in APPENDIX 1. 4.2 The return to ‘business as usual’ from the Covid-19 pandemic continues to progress. However, there has not been any relief in the system over the summer period, and is already facing increased staff absences due to seasonal illness and leave. 4.3 Work is being progressed to ensure the Risk Register is updated in the timescales dictated by the criteria. The action has been added as a standing item on the SLG agenda. 4.4 The continued safe delivery of services is a priority and as such, dedicated management time is being directed to support oversight of operational risks. Grampian Operational Escalation System (GOPES) continues to be utilised to assist in the identification of pressure points across the whole system so that they can be addressed and prioritised appropriately. A review of these principals was revisited during a workshop across the Moray Portfolio on 17/10/22. This highlighted the ongoing pressures facing the entire system and allowed for worthy discussions about how best to capture those pressures. 4.5 The ability to cope with unforeseen incidents continues to provide challenges to the systems. The national cyber-attack on NSS Scotland systems debrief is planned to conclude in November 2022. It is intimated that improved practices across the system have been captured as part of their ongoing planning and recovery phase. These will be captured and shared to SMT and MIJB in due course. 4.6 The possibility of planned power outages raised by SSEN. Civil contingency groups are discussing options and reviewing Business Continuity Plans to ensure planning is underway. Discussions between Scottish Government and Senior Management are also taking place around Protected Sites. 4.7 Ballots are proceeding for the possibility of Staff Industral Action. The outcomes of most of these ballots is expected in early November. Planning meetings are already underway to address the possible outcomes and actions. Plans for cross system working are underway. 4.8 There continues to be significant financial risk in the system. Future reports will incorporate updates to the MIJB. 4.9 Recruitment and selection to staff vacancies continues to prove challenging across most services. Staff wellbeing continues to be a key priority and a significant emphasis is being placed on ensuring that everyone is provided with the support that is readily available, where it is required. The issues that have been identified and factored into the developing workforce plan. This Page 20
Page 21
ongoing work will be progressed with partners across Grampian for recruitment. 4.10 Prior to March 2021, IJB’s were reliant on NHS Board and Council specialist advisors for support. Currently HSCM is represented by the Corporate Manager on all matters involving Civil Contingencies. Unlike other partnerships, HSCM does not employ a subject matter expert on this topic and this has been highlighted and placed on the Strategic Risk Register, with a High rating. 4.11 The new Care at Home contract, with Allied working in partnership with the Council’s internal provision, started in October 2021. This contract limited Self-Directed Support (SDS) option 3 supply to Allied and internal provision. Prior to the new Care at Home contract we also contracted with the other providers under SDS option 3. This ended, after a short extension, in April 22. The providers were then only contracted to supply care under SDS options 1 and 2. 4.12 There are currently a significant number of hours per week of unmet need for care at home, with little change in these figures this year. There is an urgent need to increase supply to support the Health & Social Care system. 4.13 The Moray Portfolio Additional Flow Huddle has agreed to explore the potential for expanding the Care at Home SDS option 3 provision with a view to increasing the supply of Care at Home. Moray Council Procurement support using the existing Scotland Excel national Care at Home framework for other external care at home providers. The plan is to provide a 12 month contract for these other providers to support capacity and create a wider group of support over the next few months. This workplan has been brought to the attention of the Chair and Vice Chair of the MIJB to try and address the unmet need identified. 4.14 As plans evolve, the Strategic Risk Register will continue to be updated to ensure that it reflects any potential risks to realise the vision set out in our Strategic Plan. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) and Moray Integration Joint Board Strategic Plan “Moray Partners in Care 2019-2029” The MIJB requires effective governance arrangements for those services and functions delegated to it and Risk Management systems are integral to this. (b) Policy and Legal As set out in the terms of reference, the Board has responsibility to provide assurance of the adequacy of the risk management framework. There are no legal implications arising from this report. Page 21
Page 22
(c) Financial implications There are no direct financial implications arising from this report however the Board should note the failure to manage risks effectively could have a financial impact for the MIJB. (d) Risk Implications and Mitigation This report forms part of the governance arrangements for identifying and managing strategic risks of the MIJB. The risks are outlined in the body of the report in section 4. (e) Staffing Implications There are no additional staffing implications arising from this report. (f) Property There are no property implications arising from this report. (g) Equalities/Socio Economic Impact An Equalities Impact Assessment is not required because there are no service, policy or organisational changes being proposed. (h) Climate Change and Biodiversity Impacts There are no impacts arising from this report. (i) Directions None arising from this report. (j) Consultations Consultation on this report has taken place with Sean Coady, Head of Service. 6. CONCLUSION 6.1 This report and appendices contains proposed risk appetite statements that, when approved, will underpin the MIJB approach to strategic decision making. 6.2 The report outlines the current position and recommends the Board note the revised and updated version of the Strategic Risk Register. Author of Report: Sonya Duncan, Corporate Manager Background Papers: held by HSCM Ref: Page 22
Page 23
Appendix 1 HEALTH AND SOCIAL CARE MORAY STRATEGIC RISK REGISTER AS AT 15 NOVEMBER 2022 Item 7. Page 23
Page 24
Appendix 1 RISK SUMMARY 1. The Moray Integration Joint Board (MIJB) does not function as set out within the Integration Scheme, Strategic Plan and in-line with Standing Orders and fails to deliver its objectives or expected outcomes. 2. There is a risk of MIJB financial failure in that the demand for services outstripping available financial resources. Financial pressures being experienced by the funding Partners will directly impact on decision making and prioritisation of MIJB. 3. Inability to recruit and retain qualified and experienced staff to provide safe care whilst ensuring staff are fully able to manage changes resulting from integration. 4. Inability to demonstrate effective governance and effective communication and engagement with stakeholders. 5. Inability to cope with unforeseen external emergencies or incidents as a result of inadequate emergency and resilience planning. 6. Risk to MIJB decisions resulting in litigation/judicial review. Expectations from external inspections are not met. 7. Inability to achieve progress in relation to national Health and Wellbeing Outcomes. Performance falls below acceptable level. 8. Inability to progress with delivery of Strategic Objectives and Transformation projects as a result of inability to resolve data sharing and data security requirements. 9. Requirements for support services are not prioritised by NHS Grampian and Moray Council. RISK RATING LOW MEDIUM HIGH VERY HIGH RISK MOVEMENT DECREASE NO CHANGE INCREASE The process for managing risk is documented out with the MIJB Risk Policy. Page 24
Page 25
Appendix 1 Description of Risk: Regulatory The Integration Joint Board (IJB) does not function as set out within the Integration Scheme, Strategic Plan and Scheme of Administration and fails to deliver its objectives or expected outcomes. Lead: Chief Officer Risk Rating: Low/ medium/ high/ very high MEDIUM Risk Movement: Increase/ decrease/ no change INCREASING Rationale for Risk Rating: The strategic plan “Partners in Care” 2019 to 2029 was developed and launched in December 2019. Membership of IJB committees has recently changed due to the elections in May. An amendment to the Scheme to increase membership by one from each of the partner organisations was ratified in March 2022 by the Scottish Government following due process and approval by Moray Council and NHS Grampian Board. During the initial Covid 19 response, normal business was suspended and emergency arrangements were implemented. IJB, CCG and APR meetings restarted during August 2020. Weekly meetings were instigated with Chair/Vice Chair and Chief Officer and these continue. Progress is underway to review the Strategic Plan “Partners in Care” 2019 to 2029 which will be completed by December 2022. Rationale for Risk Appetite: The Board, staff and providers across Moray are all committed to ensuring high standards of clinical care & governance through operational policies. Innovation and new ways of working may mean traditional regulations do not exist, or are contradictory. We will only take regulatory risks knowingly, following consultation with the relevant regulatory body and where we have clear risk mitigation in place. Controls: • Integration Scheme. • Strategic Plan “”Partners in Care” 2019 to 2029 • Governance arrangements formally documented and approved by MIJB January 2021. • Agreed risk appetite statement. • Performance reporting mechanisms. • Consultation with legal representative for all reports to committees and attendance at committee for key reports. • Standing orders have been reissued to all members Mitigating Actions: Induction sessions were held for new IJB members after May elections. . IJB member briefings are held regularly as development sessions. Conduct and Standards training held for IJB Members in June 2022 provided by Legal Services . 1 Page 25
Page 26
Appendix 1 SMT regular meetings and directing managers and teams to focus on priorities. Regular development sessions held with IJB and System Leadership Group Strategic Plan and locality management structure is in place The work that has been progressed through the Covid19 response has escalated developments in some areas as a matter of priority. This has been achieved through collaborative working with partner organisations and the third sector. Assurances: • Audit, Performance and Risk Committee oversight and scrutiny. • Internal Audit function and Reporting • Reporting to Board. Gaps in assurance: The Covid 19 Response caused a delay in producing the Transformation Plans which in turn has impacted on communication and engagement with staff and partners in respect of the intended outcomes. Work is underway on the refresh of the Strategic plan and will incorporate the work being taken forward for Self-Directed support, Three conversations, Locality Planning, Hospital at home and Hospital without walls. A delivery plan will be developed alongside the refreshed Strategic Plan. Current performance: Scheme of administration is reported when any changes are required. Legal advisors are currently working on the requirements to the integration scheme in relation to the proposed delegation of Children’s and Families and Justice Services. Report presenting the Strategic Plan, Communication Strategy, Organisational Development and Workforce Plans, Performance Framework and the draft Transformational Plan were presented and approved at MIJB on 28 November 2019 Governance Framework was approved by IJB 28 January 2021.Re-appointment of Standards Officer agreed by IJB 31 March 2022 Members Handbook has been updated and circulated to all members in June 2022. Comments: Strategic Planning and Commissioning Group approved the generic Terms of Reference and Chairs of the transformation boards at the meeting on 19 December 2019. It was intended that these boards would be established by April 2020 however this work was on hold due to Covid19 and is now restarted but will incorporate the changes on new ways of working and will recommend a revised way forward. The interim Strategy and Planning Lead is now taking this forward and prioritising and focusing on strategic planning and priorities over the short and longer term. Page 26
Page 27
Appendix 1 2 Description of Risk: Financial There is a risk of MIJB financial failure in that the demand for services outstrips available financial resources. Financial pressures being experienced both by the funding Partners and Community Planning Partners will directly impact on decision making and prioritisation of MIJB. Lead: Chief Officer/Chief Financial Officer Risk Rating: Low/ medium/ high/ very high VERY HIGH Risk Movement: Increase/ decrease/ no change NO CHANGE Rationale for Risk Rating: Whilst the 2020/21 and 2021/22 settlement saw additional investment for health and social care that was passed through to the MIJB, there remains a significant pressure due to the recurring core overspend, since most of the new investment related to new commitments. Financial settlements are set to continue on a one year only basis, which does not support sound financial planning. In addition, many uncertainties have arisen through the Covid response and continue as we continue to remobilise. The full impact is not yet quantifiable. The Revenue Budget 2022/23 was approved by MIJB on 31 March 2022 as a balanced budget. A small savings plan of £0.11 million was approved. Additional Scottish Government investment is provided again for 2022/23, this is to meet additional policy commitments in respect of adult social care pay uplift for externally provided services and seeks to ensure that capacity can be maximised and ensuring system flow. The final outturn position will be finalised and reported to the MIJB in June where it is anticipated there will be a small general reserve. The update medium Term Financial Framework was presented as part of the budget papers on the 31st March 2022 however, it is imperative that this is further reviewed during the 2022/23 year to ensure alignment with the upcoming revisions to the Strategic Plan. Rationale for Risk Appetite: The Board recognises the financial constraints all partners are working within. While we are cautious and open about accepting financial risks this will be done: • Where a clear business case or rationale exists for exposing ourselves to the financial risk • Where we can protect the long term sustainability of health & social care in Moray The Covid-19 recovery continues to place additional risk on the MIJB finances as we continue through the pandemic, recover and transform. Whilst we are now officially in the recovery phase there has been no change in the pressures felt by the system during the summer period. Controls: There is an interim arrangement for CFO cover from Moray Council. Permanent recruitment efforts have not been successful. The Chief Officer is working with both the Council and NHS Finance Leads to secure a longer term interim arrangement. Page 27
Page 28
Appendix 1 The CFO and Senior Management Team have worked together to address further savings which will be presented to the Board for approval as part of the budget setting procedures for 2022/23. This should be a focus of continuous review to ensure any investment is made taking cognisance of existing budget pressures. A revised Financial Framework was presented to the MIJB on 31 March 2022, and a further review will take place once the current strategic plan has been reviewed to assure alignment. Mitigating Actions: Risk remains of the challenge that the MIJB can deliver transformation and efficiencies at the pace required whilst dealing with the pressures that are emerging as a result of the pandemic. Financial information is reported regularly to both the MIJB, Senior Management Team and System Leadership Group. The Chief Officer and Chief Financial Officer (CFO) continue to engage in finance discussions with key personnel of both NHS Grampian and Moray Council. These conversations have continued throughout the pandemic phase. Chief Officer and CFO will continue to engage with the partner organisations in respect of the financial position throughout the year. Cross partnership performance meetings are in with partner CEOs, Finance Directors and the Chair/Vice Chair of the MIJB. Assurances: MIJB oversight and scrutiny of budget. Reporting through MIJB, NHS Grampian Board and Moray Council. Gaps in assurance: None known Current performance: An overspend of £692,246 was reported to the IJB at 30 June 2022. The Scottish Government have announced their intention to reclaim surplus Covid reserves, the details of this are as yet not confirmed. Comments: Senior managers continue to work with Chief Officer and Chief Financial Officer to address the continuing financial challenge, continuing to seek efficiencies and opportunities for real transformation as we look to make efficient and effective investment in services that are truly transformational. There are additional pressures from the cost of living crisis, increasing energy bills, inflation and the potential for staff industrial action. Page 28
Page 29
Appendix 1 3 Description of Risk: Human Resources (People): Inability to recruit and retain qualified and experienced staff to provide and maintain sustainable, safe care, whilst ensuring staff are fully able to manage change resulting from response to external factors such as the impact of Covid and the actions that arose from the recommendations from the Independent Review of Adult Social Care 2021. Lead: Chief Officer Risk Rating: Low/ medium/ high/ very high HIGH Risk Movement: Increase/ decrease/ no change INCREASING Rationale for Risk Rating: There continues to be issues with recruitment to some front line services that require specific skills and experience. This has been the case for some time now and continues to place pressure on existing staff. Allied Health Professions, Social Work are two particular areas experiencing difficulties with obtaining people with the appropriate skills and training. Care at Home staffing levels are pressured for Internal services and externally with local providers all experiencing the same difficulties. There are also impacts on recruitment of Dentists and other graduates arising from Covid as the number graduating has reduced during the period. The various impacts of Covid-19 has placed a significant strain on the Partnerships resources across frontline and support functions and this has resulted in delays for the progress of projects relating to the achievement of strategic objectives. The Care Homes in Moray have continued to do well to maintain their staffing levels throughout the pandemic however there are examples where there is a reliance on agency staffing. The difficulty with recruitment and retention of staff to care at home roles in particular is still being experienced. Efforts are being made to provide support but the situation remains challenging. The transition from EU membership has not presented any specific concerns for workforce and this will continue to be monitored. The impact of budgetary decisions by the Council in relation to reducing staffing levels has reduced levels of support provided in some key areas for Health and Social Care Moray (HSCM), such as ICT, HR, Legal and design. Rationale for Risk Appetite: Safety risks that could result in harm to service users, staff or the public are inherent in Health & Social Care services. The safety of individuals is paramount therefore standards of safety management and clinical care have to be high, and the Board will continue to seek assurances this is the case. The Board’s ambition is for health & social care to be people centred. This means supporting people in decision making about their own health & care, which may expose individuals to higher risk where they make an informed decision. The Board will also seek to balance individual safety risks with collective safety risks to the community. Controls: Management structure in place with updates reported to the MIJB. Page 29
Page 30
Appendix 1 Organisational Development plan in place and Workforce Plans are being updated to align to the new strategic plan. Continued activity to address specific recruitment and retention issues. The chief social worker reviewed the situation with managers and employed a Consultant Practitioner to develop options for addressing some of the particular issues affecting social work services in Moray and to provide support to managers and staff Management competencies continue to be developed through Kings Fund training although this was suspended due to Covid19. Communications & Engagement Strategy was approved in November 2019 and is being implemented. Council and NHS performance systems in operation with HSCM reporting being further developed and information relating to vacancies, turnover and staff absences is integral to this. Managers are highlighting any areas of concern and where appropriate this is identified in operational risk registers. HSCM services have commenced weekly reporting of workforce sit reps for Senior Management Team oversight highlighting vacancies, annual leave, sickness absence and Covid impacts so that issues can be identified and assessed quickly. Mitigating Actions: System re-design and transformation. Organisational Development Plan and Workforce plan were updated and approved by MIJB in November 2019. The updated Workforce plan has been submitted to Scottish Government and comments were received by the HSCP in October 2022. These are currently being worked through. These plans are core documents for the Workforce Forum which has recently re-commenced following a temporary suspension during the first quarter of this year due to Covid impact. Staff Wellbeing is a key focus and there are many initiatives being made available to all staff including training, support, information and access to activities. Locality Managers are developing the Multi-disciplinary teams in their areas and some project officer support has been provided to develop the locality planning model across Moray. Lead Managers are involved in regional and national initiatives to ensure all learning is adopted to improve this position. Lead Managers and Professional Leads are linked to University Planning for intakes and programmes for future workforce development. Assurances: Operational oversight by Moray Workforce Forum has resumed and will report to MIJB in accordance with the agreed Governance framework. The HSCM Response Group was in place over the whole period of the Covid19 pandemic providing focussed leadership around emerging issues and resolving them. This group stood up again in April and is meeting daily whilst Page 30
Page 31
Appendix 1 the system is pressured, this will be reviewed as the situation evolves. The Heads of Service are co-ordinating and escalate to SMT where necessary. These meetings have been increased as service needs dictate. Gaps in assurance: Further work required to develop workforce plans to reflect strategic plan implementation programmes once they are agreed. Current performance: The IMatter survey results for 2021 were received by managers for review and action plans. Preparatory work is commencing on the action plans for IMatter 2022 Discussions are underway with HR in both Council and NHS to develop access to appropriate HR information at a summarised level to facilitate the necessary workforce planning and subsequent monitoring of plans. There continues to be a need for more streamlining in recruitment processes as the delay in approval to recruit to having a member of staff available is in excess of 8 weeks. There is also a lack of suitable applicants for various posts which is impacting on ability to appoint for some roles. Comments: Staffing issues are owned by the Systems Leadership Group who will work collaboratively across the system to seek opportunities to make jobs more attractive where it has proved difficult to recruit in the past. For some professions there is a potential risk that staff move from one position to a new position within HSCM will just move the vacancy to elsewhere in the system, so Senior Management Team are aware of this risk and taking it into account in considerations for vacancies. There is a concern that if the continuing system issues and beds continue to be blocked for new patients it will mean operations cannot be scheduled to reduce the backlog and key staff may not have the necessary time in surgery to maintain skills. This in turn may add to the staff retention issues within certain specialties. Page 31
Page 32
Appendix 1 4 Description of Risk: Reputation: Inability to demonstrate effective governance and effective communication and engagement with stakeholders. Lead: Chief Officer Risk Rating: low/medium/high/very high MEDIUM Risk Movement: increase/decrease/no change NO CHANGE Rationale for Risk Rating: Locality planning assessed as medium in relation to ability to work at the pace required and current workforce capacity. Performance framework to be further developed from a planning perspective to show the links through operational service delivery to strategic objectives. Recent engagement with individuals representing their communities or third sector organisations in a variety of forums is highlighting that problems with their capacity to fulfil our needs so more co-ordination and clearer focus is required to ensure that the communication, engagement and outcomes are meeting identified needs. Rationale for Risk Appetite: The Board is cautious but open about risks that could damage relationships with different stakeholders. It recognises many of our aspirations depend on effective collaboration, coproduction and partnership working with a range of stakeholders. The appetite also recognises that while the aspiration is to be a co-operative partner, some partners will not be able to move at the same pace as us all the time. We will seek to protect relationships in the long term and will not set out to antagonise stakeholders deliberately. For example, we must not be seen to exclude or prevent participation in the design of services where there is an appetite to do this. We must be mindful that repairing relationships is easier when there is already a well of goodwill to draw on, and that further damage to an already damaged relationship will not be conducive to good long term outcomes. Controls: Governance Framework approved by IJB January 2021 Communication and Engagement Strategy approved November 2019 Annual Governance statement produced as part of the Annual Accounts 2019/20 and submitted to External Audit. Annual Performance Report for 2020/21 was published in August 2021 Performance reporting mechanisms in place and being further developed through performance support team, home first group and system leadership team. Community engagement in place for key projects areas such as Forres, Keith and Lossiemouth with information being made available to stakeholders and the wider public via HSCM website. Page 32
Page 33
Appendix 1 Participation of stakeholders in a variety of meetings such as Home First project, carer strategy, Strategic, Planning and Commissioning groups. Mitigating Actions: Schedule of Committee meetings and development days in place and implemented. Good working relationship established with Audit Scotland, the MIJB’s appointed external auditors since 16/17. Discussions at leadership meetings to ensure all standards are being met around Public Sector Equality Duty and published where appropriate. There is a new programme of training to ensure all policies are Impact Assessed and the findings are published. Annual Performance Report for 2021/22 will be published in November 2022 after being presented to the IJB. Social media is actively used as a method of engaging with the public, with short videos focussing on particular services being trialled. SMT have considered the existing arrangements for engagement with stakeholders and work is being undertaken to align our framework with the Scottish Government “Planning with people guidance” and ensure that mechanisms are in place across services to evidence and evaluate their impact. Assurances: Oversight and scrutiny by Clinical and Care Governance Committee, Audit Performance and Risk Committee and MIJB. Summary reports of minutes of MIJB meetings are submitted to Council committee and NHS Board. Gaps in assurance: Progress on implementation of the Communication and Engagement Strategy has been impacted by the Covid 19. Due to the impact of COVID and requirement for social distancing the normal mechanism for engagement were not all available. More use is being made of social media and Microsoft teams and other options and methods for engagement with staff are being used via NHSG such as videos on YouTube and one question surveys. Going forward there may be more opportunity for face to face meetings to take place again but it should be considered that this will not be beneficial for all. Current performance: Communications Strategy was reviewed approved by IJB November 2019. Annual Performance Report 2020/21 published August 2021. Audited Accounts for 2020/21 were publicised by deadline 30 September 2021 Due to Covid19 there have been increased levels of briefings to staff, the public and Chair/Vice Chair of MIJB with a focus on the key elements of the response. The staff newsletter commenced during Covid continues to be distributed. Comments: A communication cell was established as part of the Local Resilience Partnership Covid and storms response with representation from Councils, HSCP and NHSG. This was led by Aberdeen City Council and was an example of the collaborative working that took place. This forum provides assurance that messages to all stakeholders are consistent. Page 33
Page 34
Appendix 1 It also ensures that there is support for our Communications Officer and resilience provided with the access to other communication officers. There has been representation from the Home first project at the Wellbeing forum to facilitate sharing of information and seeking views. Page 34
Page 35
Appendix 1 5 Description of Risk: Environmental: Inability to cope with unforeseen external emergencies or incidents as a result of inadequate emergency and resilience planning. Lead: Chief Officer Risk Rating: low/medium/high/very high HIGH Risk Movement: increase/decrease/no change NO CHANGE Rationale for Risk Rating: Due to the response requirements for Covid 19 progress has been made in a number of areas. SMOC information is updated, control room guidance updated and expanded, control centre protocols were implemented and remain in place and management teams have responded in an agile, responsive and collaborative way under very challenging conditions. Teams continue to do their best but there are areas where they still feeling overwhelmed and service delivery is challenging. With effect from March 2021 MIJB is defined as a Category 1 responder under the Civil Contingencies (Scotland) Act and there are additional requirements for preparedness that is being taken forward in partnership with NHSG and Moray Council emergency planners. Rationale for Risk Appetite: The MIJB understand the requirement to meet the statutory obligations set out within the Civil Contingencies Act and the Category 1 status applied in March 2021, and work with partner organisations to meet these obligations Controls: Winter Preparedness Plan was updated (but not tested as in previous years) alongside NHSG plans as NHSG implemented their crisis management framework which required participation of partners at Daily connect meetings to discuss and prioritise resource to address issues with system flow. HSCM Civil Contingencies group established and meeting regularly to address priority subjects. NHS Grampian Resilience Standards Action Plan approved (3 year). Business Continuity Plans in place for most services although overdue a review in some areas. Knowledge of critical functions and ability to respond quickly and effectively has been in evidence during incidents such as Gas outages in Keith (January and February 2021) and Covid response, Storms (Arwen, Malik and Corrie) – debriefs carried out and learning identified. Debriefs being undertaken for HSCM, Moray (Council and HSCM) and Local Resilience Response with lessons learnt being collated and prioritised for an action plan. Mitigating Actions: Information from the updated BIA/BCP informed elements of the Winter Preparedness Plan A Friday huddle is in place which gathers the status of services across the whole system to provide information and contact details to the Senior Manager on Call (SMOC) over the weekend. Page 35
Page 36
Appendix 1 NHSG have introduced system wide daily huddles to manage the flow and allocation of resources which require attendance from Dr Grays and HSCM. Practitioner group established for Moray with representation from HSCM, Dr Grays, Moray Council and NHSG to discuss matters arising from the Local Resilience Forum and within our respective organisations. In addition it will provide a forum for discussion of the linkages between organisational response plans to ensure there are no gaps or over reliance on particular local resources. HSCM continues to monitor the local situation regarding impacts on staffing and is engaged with NHSG emergency planning arrangements and Council Response and Recovery management team to be ready to escalate response if required. Work was undertaken within NHSG, Aberdeenshire HSCP and Aberdeen City HSCP to look at Surge flows and establish a mechanism that will provide easy identification of “hot spots” across the whole system in Grampian, to facilitate a collaborative approach to addressing the issues through the use of a common Operational Pressure Escalation approach. This work could underpin surge responses in winter and at other times of pressure and having a standard approach across Grampian could aid communication and understanding. Assurances: Audit, Performance and Risk Committee and NHS Grampian Civil Contingencies Group oversight and scrutiny. HSCM Civil Contingencies group review specific risks and action plans to mitigate, developing plans and testing arrangements in partnership with NHSG and Council Gaps in assurance: Moray Integrated Joint Board (MIJB) was designated as a Catagory 1 responder under the Civil Contingencies Act 2004 from March 18th 2021. That designation imposed a number of statutory duties in terms of the Act and the associated Scottish Regulations1. MIJB has no dedicated, specialist in post and is reliant on the corporate manager covering this increasingly demanding role in addition to other duties without the necessary background, knowledge, skills and experience. This presents a potential organisational risk in terms of compliance and our ability to provide assurance on discharging our civil contingency arrangements. The debriefs from the storms in 2021/22 have identified lessons learnt for Grampian Local Resilience Partnership and more locally for the response co-ordination within Moray. Action plans are being developed in collaboration with Moray Council’s emergency planning officer to address the issues identified. The main issues related to developing wider awareness of roles and responsibilities, and improving general awareness of response structures and meeting protocols. This will be incorporated into training schedules going forward. It has also highlighted the need for a robust arrangement for out of hours contact and clarity of roles and responsibilities across the system which is being discussed at SMT. Option Appraisal discussions are intended to commence end October 2022. 1 Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 Page 36
Page 37
Appendix 1 Progress has been made however further work is required to address the targets in the implementation plan that have not been met and the Resilience standards as identified by the NHSG Civil Contingencies Group. Due on ongoing system pressures and staff vacancies the Care for People plan and associated response structures has not been completed to date. It is anticipated this will be completed by end October 2022, allowing for the operational response plans to be drawn up. The intention is to hold a table top exercise with managers from HSCM and Moray Council to test the invocation arrangements to ensure common understanding of roles and responsibilities. Current performance: The Senior Management Team participated in Strategic Leadership in a Crisis training in 2020 and a programme of further training for the wider management team is scheduled. Many services have business continuity arrangements and some are overdue for an update. Work has progressed in identification of a critical functions list for agreement by System Leadership Group that will inform planning arrangements going forward. There will need to be changes made to business continuity plans following the implementation of additional ICT resources in services which have provided a greater deal of resilience for some services and functions – albeit reliant on electricity supply. A schedule of review and exercising of business impact assessments and plans has been scheduled for this year across services. Annual report on progress against NHS resilience standards was reviewed by APR committee on 31 March 2022. Report on the implications of the designation as a Category 1 responder was presented to MIJB 25 November 2021. Information has been collated regarding dependencies of fuel for delivery of critical functions for submission to NHSG and Council for inclusion in the planned response to the invocation of the National Fuel Plan. Work is currently underway to plan for possible National Power Outages across the UK. This is being co-ordianated across Grampian to ensure all Partners are involved. Comments: The requirements of a Category 1 Responder continue to increase in demand placing increased pressures across already overstretched services and managers. MIJB does not have a subject matter expert leading on these topics. Page 37
Page 38
Appendix 1 6 Description of Risk: Regulatory Risk to MIJB decisions resulting in litigation/judicial review. Expectations from external inspections are not met. Lead: Chief Officer Risk Rating: low/medium/high/very high MEDIUM Risk Movement: increase/decrease/no change INCREASING Rationale for Risk Rating: Considered medium risk due to the impact of Covid-19 and resultant efforts required to remobilise services and/or the increase in workloads stretching a workforce that has been under sustained pressure for a considerable time. The ongoing impact of the Covid 19 pandemic is stretching resources to deliver care in the community across all providers (internal and external) so there is a potential increased risk of expected standards not being achieved despite the best efforts of all concerned. Rationale for Risk Appetite: The Board, staff and providers across Moray are all committed to ensuring high standards of clinical care & governance through operational policies. Innovation and new ways of working may mean traditional regulations do not exist and require to be developed, no longer apply, or are contradictory. We will only take regulatory risks knowingly, following consultation with the relevant regulatory body and where we have clear risk mitigation in place. Controls: Clinical and Care Governance (CCG) Committee established and future reporting requirements identified Clinical Risk Management and Practice Governance group has oversight of their respective professional standards and feed into Clinical and Care Governance Group, which then escalates to CCG Committee as necessary. High and Very High operational risks are reviewed by System Leadership Group monthly and a review of all risks will be undertaken as part of the risk management framework. Complaints and compliments procedures in place and monitored. A complaints co-ordinator role is being developed and will be implemented to reduce duplication of effort, to provide co-ordination and improve information flow and support managers in responses with the intention of streamlining processes and improving achievement of target timescales. Clinical incidents and risks are being reviewed on a weekly basis to ensure processes are followed appropriately and consistently and responses are recorded in a timely manner. Adverse events and duty of candour procedures in place and being actioned where appropriate and summary reports submitted to CCG committee. Page 38
Page 39
Appendix 1 Reports from external inspections reported to appropriate operational groups and by exception to SMT for subsequent reporting to CCG or Audit Performance and Risk Committee as appropriate, albeit there has been a reduction in some areas of external inspection reporting during the Covid period due to social distancing restrictions Care Home Oversight Group meets to oversee and manage risks in care homes. Children and Adult Protection services are being delivered and reported to their respective committee on a regular basis. Mitigating Actions: This risk is discussed regularly by the three North East Chief Officers. Additional resource has been allocated to support the analysis of information for presentation to CCG committee All High and Very High risks are now brought before the senior management team in Moray. Process for sign off and monitoring actions arising from Internal and External audits has been agreed Assurances: Audit, Performance and Risk and Clinical and Care Governance Sub-Committees oversight and scrutiny. Governance Framework in place and operational. Gaps in assurance: Process for highlighting recurring themes or strategic expectations from external inspections requires further development to ensure Committee has sight of significant issues. The vacancy of clinical governance co-ordinator has now been appointed to and this will be part of their work programme. Current performance: External inspection reports are reviewed and actions arising are allocated to officers for taking forward. A summary of inspections is included in the Annual Performance report. The level is marked as an increasing risk on the basis that services are under pressure with the issues with staffing capacity and the need to focus on delivery of critical functions which may mean external inspection are not the priority at this moment in time. The Adult Support Protection inspection took place in April/May and our action plan has been developed. Comments: No major concerns have been identified for HSCM services in any audits or inspections during 2021/22. Page 39
Page 40
Appendix 1 7 Description of Risk: Operational Continuity and Performance: Inability to achieve progress in relation to national Health and Wellbeing Outcomes. Performance of services falls below acceptable level. Lead: Chief Officer Risk Rating: low/medium/high/very high HIGH Risk Movement: increase/decrease/no change NO CHANGE Rationale for Risk Rating: Potential impacts to the wide range of services in NHS Grampian and Moray Council commissioned by the MIJB arising from reductions in available staff resources as budgetary constraints impact. Unplanned admissions or delayed discharges place additional cost and capacity burdens on the service. The level of delayed discharges has remained high, reflecting the sustained pressure in the system following the Covid -19 pandemic impact and the lack of availability of care in the community. There are sustained focussed and collective efforts by all those working in the pathway. However this is a complex area and will require continued effort to realise reductions and maintain them. Rationale for Risk Appetite: The Board is cautious but open about risks that could affect outcomes that are priorities for people in Moray. There is a slightly higher appetite to risks that may mean nationally set outcomes – that by design are not given a high priority in Moray - are not met. This will only be accepted where there is a clear rationale, and preferably also a way of demonstrating what the IJB is doing to meet the aspiration the outcome was created for. Controls: Performance Management reporting framework. 2019 to 2029 “Partners in Care” Strategic Plan approved and refresh of Plan and development of implementation plans underway. Performance regularly reported to MIJB. Revised Scorecard being developed to align to the new strategic priorities. Best practice elements from each body brought together to mitigate risks to MIJB’s objectives and outcomes. Chief Officer and SMT managing workload pressures as part of budget process. A daily Huddle and write up circulates the picture on performance across community and acute services for the Portfolio and service managers have a shared understanding of the pressures in the system and mitigations taking Page 40
Page 41
Appendix 1 place. Work continues on refinement of G-OPES (Grampian Operating Pressures and Escalation System) led by NHSG but being developed locally to identify the triggers and resultant actions required in services to respond to pressure points. Mitigating Actions: Service managers monitor performance regularly with their teams and escalate any issues to the System Leadership Group (SLG) for further discussion to provide wider support, developing shared ownership and a greater understanding across the whole system. Key operational performance data is collated and circulated daily to all managers. A Daily dashboard is held on illuminate for managers to access to ensure any potential issues are identified quickly so action can be taken. This dashboard is being reviewed and will be further developed with the intention of further dashboards to provide a whole system overview. This has been discussed at SLG and agreed. Performance information is presented to the Performance sub group of Practice Governance Group to inform Social Care managers of the trends in service demands so that resources can be allocated appropriately. Assurances: Audit, Performance and Risk Committee oversight. Operationally managed by service managers, summary reports to Practice Governance and clinical and care governance group and to System Leadership Group. Strategic direction provided by Senior Management Team. HSCM Response Group continues to meet and reviews the key performance information and actions that are required to deliver the priority services. Gaps in assurance: Development work in performance to establish clear links to describe the changes proposed by actions identified in the Strategic Plan has recommenced but is at an early stage. This will be progressed as the revised outcomes are determined and associated KPI are identified. Progress will be reported to future Board meetings. Current performance: The Covid19 pandemic impacted on all areas of the service and work is underway to take the learning and experience gained during the response to collate performance information in dashboards to support mangers interpret the impact of Covid19 on their services, now and going forward. There are likely to be changes to ways of working and this may also have impact on the performance information required. Comments: Locality profile information has been provided to Locality Steering Group/Locality Manager to inform potential priorities for consideration in Localities and work will be taken forward regarding development of performance monitoring and reporting of key performance indicators in relation to Localities once it has been determined what the intended outcomes are. The delayed discharge group has produced an action plan for implementation and progress is being made. Page 41
Page 42
Appendix 1 Practice Governance have reviewed their operational performance requirements and have a comprehensive data set used to inform operational priorities. The Home First priorities are being taken forward and updates are reported to this committee or MIJB on a regular basis. Progress in this area has been hampered due to the increased demand for urgent or critical services requiring staff resource to be prioritised to frontline service delivery. The Council has procured new modules for their performance reporting system Pentana and HSCM performance team has been developing its its use for reporting. 8 Description of Risk: Transformation Inability to progress with delivery of Strategic Objectives and Transformation projects. Lead: Chief Officer Risk Rating: low/medium/high/very high HIGH Risk Movement: increase/decrease/no change NO CHANGE Rationale for Risk Rating: There are many issues that will impact on the ability to progress to deliver Strategic Objectives. The Strategic Planning & Commissioning group has been refreshed and re-launched and key work is being progressed. There was an initial meeting held on 22 September 2021 to consider terms of reference and the proposed structure for oversight, prioritisation and assurance in relation to key developments, their fit with IJB strategy and enabling elements. The interim appointment of the Strategic and Planning Lead provides capacity to take this forward and to align the priorities arising nationally, Grampian-wide and locally. The remobilisation plan for HSCM services that were suspended or reduced is progressing with Providers services and social work implementing the IJB decision to return to delivery of both substantial and critical eligibility criteria. Work has progressed risk assessments are completed and assessments have been or are in the process of being reviewed to ensure equality. The impact of Covid 19 on the population of Moray is still not fully realised. It is therefore not possible to predict the extent of the impact on the ability to progress with delivery of Strategic Objectives. There are some aspects that have progressed very well such as introduction of Near Me consultations but there are others that are more difficult to progress. Page 42
Page 43
Appendix 1 There is concern that due to the workloads and challenges over the last year that teams are weary and/or do not have capacity at this moment in time, to progress with delivery of development plans at this moment in time. In addition the pandemic is still present in the community so services are still responding to the impacts it has for the population of Moray. Managers are working with teams to establish “readiness” and their capacity and sense of wellbeing and the collated output will inform plans going forward. One key aspect to facilitate transformation is the need for progress in relation to ICT infrastructure, data sharing and data security across the whole system. Work was undertaken by NHS GRAMPIAN and partners to address the needs for ICT kit and information during the response to Covid. Rationale for Risk Appetite: The Board has a high appetite for risks associated with delivery of transformational redesign. The following should be considered when accepting these risks: • We understand and can mitigate other risk types that may arise, e.g. safety or financial within appetite • Service users are consulted and informed of changes in an open & transparent way • We will monitor the outcome and change course if necessary Controls: It is recognised that there will be significant changes taking place in Social Work practice with the implementation of the Self Directed Support standards and the move to outcomes based services, so governance arrangements are being set up to facilitate the same type of oversight and communication that is in place for the Home First programme. Mitigating Actions: Integrated Infrastructure Group previously established, with ICT representation from NHSG and Moray Council, to consider and provide solutions to data sharing issues and ICT infrastructure matters which is an area that will be taken forward alongside the Moray Growth Deal projects. Linkages to Infrastructure board and Information sharing groups have been established albeit these meetings are not taking place regularly at the moment. Assurances: Strict ICT and data sharing policies and protocols in place with NHS Grampian and Moray Council. Gaps in assurance: Transformation/implementation planning is in development and will inform outcomes and performance reporting on the delivery of the strategic plan. Protocol for access to systems by employees of partner bodies are in place. Information Management arrangements to be developed and endorsed by MIJB. Process of identification of issue and submission to data sharing group requires to be reinforced to ensure matters are progressed. Page 43
Page 44
Appendix 1 Smarter Working programmes are being progressed in partnership with Council and NHSG. Current performance: Training programme to be developed on records management, data protection and related issues for staff working across and between partners. Comments: Where national systems are involved it may not be possible to identify a solution however the issues will be able to be raised at the appropriate level via the Grampian Data Sharing Group where all three partnerships are represented. Page 44
Page 45
Appendix 1 9 Description of Risk: Infrastructure Requirements for support services are not prioritised by NHS Grampian and Moray Council. Lead: Chief Officer Risk Rating: low/medium/high/very high HIGH Risk Movement: increase/decrease/no change NO CHANGE Rationale for Risk Rating: Changes to processes and necessary stakeholder buy-in still bedding in. Moray Council is undertaking a Property review of office and depot accommodation and the potential impact for HSCM services requires consideration. The output was anticipated in October 2019 however due to changes with roles and responsibilities within the Council however the paper has been out for consultation. NHSG have advised that staff should continue to work from home at present whilst policies and protocols are developed. Moray Council have a dedicated MC officer leading on a hybrid working plan with input from HSCM on their requirements. ICT infrastructure service plans in NHS Grampian and Moray Council are not yet visible to HSCM and development of communication and engagement process is required. The impact of Covid has resulted in a change in ICT strategy for Moray Council. Council employed staff requiring mobile technology have now been provided with it and some staff are still working from home. Rationale for Risk Appetite: Low tolerance in relation to not meeting requirements. Controls: Chief Officer has regular meetings with partners Computer Use Policies and HR policies in place for NHS and Moray Council and staff. PSN accreditation secured by Moray Council Infrastructure Programme Board was established with Chief Officer as Senior Responsible Officer/Chief Officer member of CMT. Process for submission of projects to the infrastructure board approved and implemented to ensure appropriate oversight of all projects underway in HSCM. The Board is not meeting at present, so in the interim, project requests are being processed via Senior Management Team. The interim Strategy and Planning Lead will support the the Infrastructure Programme Board for Moray portfoilio to be re established. Page 45
Page 46
Appendix 1 Mitigating Actions: Membership of the Board was reviewed and revised to ensure representation of all existing infrastructure processes and funding opportunities. Process for ensuring infrastructure change/investment requests developed Dr Gray’s strategy (vision for the future) is being produced collaboratively with input from NHSG and HSCM management. Assurances: Infrastructure Programme Board functions to provide robust governance and assurance that proposed projects have a robust business case and meets requirements of the respective partner organisations. This board reports to Strategic Planning and Commissioning Group. Both of these groups are being refreshed and remobilised. Workforce Forum meeting regularly with representation of HR and unions from both partner organisations Gaps in assurance: Further work is required on developing the process for approval for projects so that they are progressed timeously. Need to review all existing processes in relation to infrastructure changes/projects/investments and streamline to avoid duplication of effort. Infrastructure Board is in development and priority issues are being addressed in relation to infrastructure and premises risk. Legal services have reduced capacity to provide support due to budget cuts and vacancies so any requests may take longer. Recruitment for vacancies takes considerable time due to various factors and is presenting a strain on services to maintain normal service whilst covering vacancies. There have been several posts that have had to go out to advert more than once extending the time other staff are covering gaps. Current performance: No update. Comments: Existing projects will be reviewed as part of the development of the transformation plans for the Strategic Plan to ensure resources are being dedicated appropriately and aligned to the emerging Strategic priorities. Our requirements for support will be communicated via appropriate channels Page 46
Page 47
REPORT TO: MORAY INTEGRATION JOINT BOARD AUDIT, PERFORMANCE AND RISK COMMITTEE ON 24 NOVEMEBER 2022 SUBJECT: INTERNAL AUDIT SECTION– COMPLETED PROJECTS REPORT BY: CHIEF INTERNAL AUDITOR 1. REASON FOR REPORT 1.1 To provide an update on audit work completed since the last meeting of the Committee. 2. RECOMMENDATION 2.1 The Audit, Performance and Risk Committee is asked to consider and note this audit update. 3. BACKGROUND 3.1 Public Sector Internal Audit Standards (PSIAS) require the Chief Internal Auditor to prepare and present reports to the committee on internal audit’s activity relative to the audit plan and any other relevant matters. 3.3 In line with the approved internal audit plan, the following reviews were completed: 4. INTERNAL AUDIT- COMPLETED PROJECTS Cyber Security 4.1 Cyber Security concerns the protection of computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. Cyber security controls are designed to combat threats against networked systems and applications, whether those threats originate from inside or outside an organisation. The Scottish Government in 2020 issued a Cyber Resilience Framework to all Local Authorities. The Framework includes a self- assessment tool to assist Local Authorities in improving their cyber resilience and compliance with a range of legislative, regulatory, policy and audit requirements regarding cyber security. The audit programme was developed from this Cyber Resilience Framework and other good practice guidelines. The impact of a successful cyber attack would immediately affect how services can be delivered on a day to day basis. The executive summary and recommendations for this project are given in Appendix 1. Item 8. Page 47
Page 48
Social Care and CareFirst System Information Governance Review 4.2 An audit has been undertaken into how information relating to social care service users is recorded, accessed and kept up to date. The Council uses a system known as CareFirst to record and manage social care cases for both adult and children’s services. CareFirst is a long standing widely used application within the public sector for recording social care data. Most of the service user data is available on CareFirst, with some data retained separately either on a Council server or in paper files. 4.3 The scope of this review considered the findings and recommendations from an audit undertaken of the CareFirst System within the 2017/18 Audit Plan. The audit also reviewed the management arrangements for reviewing case files and access controls of who can view, add, amend or delete information, recognising that restricted access has to be balanced with a need for prompt availability of information for those employees who require it for the effective delivery of services. The executive summary and recommendations for this project are given in Appendix 2. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) and Moray Integration Joint Board Strategic Plan “Moray Partners in Care 2019 – 2029” Internal audit work supports good governance and assists in securing appropriate systems of internal control. (b) Policy and Legal The internal audit service is provided in terms of paragraph 7:1 of the Local Authority Accounts (Scotland) Regulations 2014, and there is a requirement to provide a service in accordance with published Public Sector Internal Audit Standards. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications Audit reports highlight risk implications and contain recommendations for management to address as a means of mitigating. (e) Staffing Implications No implications directly arising from this report (f) Property No implications. (g) Equalities/ Socio Economic Impacts No implications. (h) Climate Change and Biodiversity Impacts None directly arising from this report. Page 48
Page 49
(i) Directions None arising from this report. (j) Consultations There have been no direct consultations during the preparation of this report. 6. CONCLUSION 6.1 This report provides Committee with a summary of findings arising from audit projects completed during the review period. Author of Report: Dafydd Lewis, Chief Internal Auditor Background Papers: Internal Audit Files Ref: mijb/ap&rc/24112022 Page 49
Page 50
Page 50
Page 51
Appendix 1 AUDIT REPORT 23’011 CYBER SECURITY Executive Summary The annual audit plan for 2022/23 provides for a review to be undertaken into the Council's arrangements surrounding its Cyber Security. Cyber Security concerns the protection of computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. The scope of this audit was to provide a review of systems, practices and an assessment of the controls in place to protect the Council from a cyber-attack. The audit also reviewed Information, Communication and Technology (ICT) security policies and procedures to ensure they are regularly reviewed and promote best practices. Cyber security controls are designed to combat threats against networked systems and applications, whether those threats originate from inside or outside an organisation. A successful cyber-attack would immediately impact the delivery of services within the Council. The Scottish Government in 2020 issued a Cyber Resilience Framework to all Local Authorities. The Cyber Resilience Framework was developed jointly between the Scottish Government and the National Cyber Resilience Advisory Board. The Framework includes a self-assessment tool to assist Local Authorities in improving their cyber resilience and compliance with a range of legislative, regulatory, policy and audit requirements regarding cyber security. The audit programme has been developed from this Cyber Resilience Framework and other good practice guidelines. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The review has highlighted the following areas for improvement:- • The Scottish Government recommends that all Local Authorities should comply with the Scottish Government Cyber Resilience Framework. The Service has accepted the requirement to comply with the Framework by undertaking a self-assessment tool to highlight improvements needed to the Council’s cyber resilience arrangements. It is appreciated that due to the pandemic, the ICT Service has been under additional pressure to meet changes in working practices across all Services. The audit found progress had been undertaken in completing the self-assessment tool; however, further action is needed to complete this review. • It was found that no formalised incident response plan has been developed in the event of a successful cyber-attack. A cyber security incident response plan is a document that gives officers clear instructions on how to respond to Item 8. Page 51
Page 52
Appendix 1 a serious security incident, such as a data breach, data leak, ransomware attack, or loss of sensitive information. Effective security controls would reduce the risk of a successful cyber-attack, however if the worse did occur, an incident response plan would ensure clear procedures are followed to limit the damage and disruption to Services. • The Council has policies and guidelines detailing best practices that should be followed regarding information security and computer use. However, they have not been reviewed for several years. Policies and Guidelines should be reviewed and if required updated to include current best practices in information management, computer use and cyber security arrangements. Page 52
Page 53
Appendix 1 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Effective Cyber Security Controls to combat threats against networked systems and applications. 5.01 The ICT Service should progress with completing the Scottish Government Cyber Resilience Framework self-assessment tool. Any improvement actions required to Council systems and procedures should be agreed with an action plan detailing recommendations for implementation. High Yes In the latest response to the Scottish Government Cyber Assurance survey (Feb 22), the ICT Service reported that it currently aligns with the Progression Stage of ‘Partial Target’. The intention is to progress to ‘Target’ by the end of the current financial year. Note there are dependencies on the ICT Team Leader (Infrastructure & Information Security) 31 March 2023 Page 53
Page 54
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation implementation of 5.04 and 5.05 5.02 ICT policies and guidelines should be reviewed and if required updated to include best practices in information management, computer use and cyber security practices. Medium Yes The Corporate Information Security Policy is currently under review. A revised draft will be available by the end of September. The Computer Use Policy will be reviewed thereafter. ICT Team Leader (Infrastructure & Information Security) 31 December 2022 5.03 The ICT Business Continuity Plan should be reviewed and if required updated to reflect current cyber resilience arrangements. High Yes This was acknowledged in the response to the latest Scottish Government Cyber Assurance survey. ICT Infrastructure Manager 31 December 2022 Page 54
Page 55
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.04 Cyber security awareness training should be provided to officers of all levels within the Council. Medium Yes A solution to provide phishing simulations and linked eLearning content, to raise cyber awareness has been procured. The work to implement this solution is in progress and discussions have taken place with regard to the baseline phishing campaign ICT Team Leader (Infrastructure & Information Security) 31 March 2023 5.05 An Incident Response Plan should be developed and thereafter regularly tested through simulation exercises. High Yes This was acknowledged in the response to the latest Scottish Government Cyber Head of HR, ICT & OD / Infrastructure Manager 31 December 2022 Page 55
Page 56
Appendix 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Assurance survey. Work is also being progressed via CMT/SMT with regard to this, in light of the SEPA lessons learned. 5.06 A review of existing insurance cover should be carried out to ensure the level of cover is appropriate and adequate in relation to the threat level from cyber-attack. Medium Yes There is cover in the existing policy for reinstatement of data as well as cyber incidents. Further information is required on the obligations and requirements for cyber insurance in future renewals. ICT Infrastructure Manager 30 September 2022 Page 56
Page 57
Appendix 2 AUDIT REPORT 23'012 SOCIAL CARE & CAREFIRST SYSTEM INFORMATION GOVERNANCE REVIEW Executive Summary The annual internal audit plan for 2022/23 provides for a review of the CareFirst system and the various databases used for recording service user information. CareFirst is the primary database that records and manages social care cases for Adult, Children and Families Services. CareFirst is a long standing widely used application within the public sector for recording social care data. Most service user data is available on CareFirst, but some information is saved separately either on a council IT server or in paper files due to the lack of a facility within CareFirst to attach documents and the continued requirement to hold some information in hard copy for legal reasons. The audit reviewed access controls around the management of case files. This included consideration of who can view, add, amend or delete information, recognising that restricted access has to be balanced with a need for prompt availability of information for those employees who require it to deliver services effectively. Controls in this area are particularly important due to the sensitive nature of much of the information. In addition, the Council has duties under data protection regulations, and breaches of these regulations can result in censure and substantial financial penalties being levied by the Information Commissioner’s Office. The audit also considered the findings from a review of the CareFirst System that was undertaken within the 2017/18 Audit Plan and a check undertaken to evidence the implementation of these recommendations. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). It is appreciated that due to the pandemic, officers have been focused on supporting service users for the last few years to ensure that essential care continues to be delivered. The review has highlighted the following areas for consideration:- • Information concerning a service user care package is recorded on multiple databases, i.e., CareFirst, shared drive and paper files. Evaluation should be undertaken with improving technology, if it is feasible to strengthen case recording procedures such that all data ultimately can be recorded in a single file for each service user. • Case recording procedures have been developed, however it was noted they had not been reviewed for several years. In addition, with the imminent transfer of Children and Families Services to the Moray Integration Joint Board, there is an opportunity to review working practices and develop uniform procedures for recording information and reviewing case files. Item 8. Page 57
Page 58
Appendix 2 • The audit reviewed who can view, add, amend or delete information from the various databases used for recording service user information. Different access controls were found between the CareFirst system, Council IT server and paper files. Consideration should be given to reviewing access controls for these various databases to ensure consistency in operating arrangements and that officers can only access information required to undertake duties of their post. Page 58
Page 59
Appendix 2 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Effective Information control systems in operation to protect and secure access to social care data. . 5.01 Investigation should be undertaken to explore the possibilities of developing a single case recording system. Medium Yes This is a key requirement for the replacement of CareFirst System. The CareFirst Replacement Board was suspended at the beginning of the pandemic. Health & Social Care Moray are currently developing a prioritised delivery plan for our Strategic Plan, Commissioning Manager The delivery plan for Health & Social Care Moray’s Strategic Plan, incorporating the proposed timetable for replacement of the CareFirst, is scheduled to be put before the IJB by 30 November 2022. Page 59
Page 60
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Partners In Care. The prioritisation of the replacement of CareFirst will be part of this process. 5.02 Additional access controls to the CareFirst System should be introduced to include time limited access and more complex password combination requirements. Medium Yes Time limited access will be introduced. It is not possible to introduce more complex password combinations on CareFirst but this will be a requirement for the replacement of CareFirst. Information Systems Officer 31 October 2022 5.03 A review of access rights to CareFirst, Shared Drive and Medium Yes Agreed. Implementation Commissioning Manager The delivery plan for Health & Page 60
Page 61
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Paper Files should be undertaken with the purpose that officers should only be authorised to view case file information required to undertake their duties. will be depended on the replacement to the CareFirst System. Social Care Moray’s Strategic Plan, incorporating the proposed timetable for replacement of the CareFirst, is scheduled to be put before the IJB by 30 November 2022. 5.04 An officer should record a clear description within the CareFirst System to explain why access is required to a Restricted Case File. Where restricted service user records are also held within the shared drive and paper records, a clear description should also be maintained detailing reasons for access. Low Low Yes Yes A review of the management reports where access is required to a restricted case file will be undertaken to ensure the reason for access is clearly recorded. A Commissioning Manager/ Information Systems Officer Commissioning Manager/ Information Systems Officer 31 December 2022 31 December 2022 Page 61
Page 62
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation report from the review will be considered by the Practice Governance Board. 5.05 CareFirst Case Files should be deleted in accordance with the Council Document Retention Policy. Deletion of case files should only be actioned after the authority of a senior manager is obtained. Medium Yes Implementation arrangements will be reviewed and agreed by the Practice Governance Board. Commissioning Manager/ Information Systems Officer 31 December 2022 5.06 The deletion of CareFirst System files should also include information held regarding a service user within the shared drive and paper files. Medium Yes Implementation arrangements will be reviewed and agreed by the Practice Governance Board. Commissioning Manager 31 December 2022 5.07 The re-introduction of regular reviews of case files should be undertaken by Managers Medium Yes Regular reviews of case files will be Head of Community Care/ Head Children & 31 October 2022 Page 62
Page 63
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation within Adult, Children and Families Services. undertaken by managers. Families & Criminal Justice 5.08 Case recording procedures should be updated for Adult, Children and Families Services. Medium Yes Adult Services have reviewed the Case Recording Procedure and are developing a complementary Records Management Procedure. The revised Case Recording Procedure is currently at final draft stage. Children and Families Services are also intending to update their Commissioning Manager Quality Improvement & Policy Manager 31 December 2022 31 January 2023 Page 63
Page 64
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Case Recording Procedure. 5.09 A review should be undertaken of the security of paper records held within the Community Care Finance Offices to ensure service user information can only be viewed by authorised officers. Medium Yes This has recently taken place, a number of actions from the review have been completed. New office equipment is currently being purchased e.g. new lockable filing cabinets and the Community Care Finance Officer is liaising with Health & Safety Section with a view to identifying any further security Community Care Finance Officer Completed Page 64
Page 65
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation measures for both the office and the building. Page 65
Page 66
Page 66
Page 67
REPORT TO: MORAY INTEGRATION JOINT BOARD AUDIT, PERFORMANCE AND RISK COMMITTEE ON 24 NOVEMBER 2022 SUBJECT: DIRECTIONS MONITORING REPORT BY: CHIEF FINANCIAL OFFICER 1. REASON FOR REPORT 1.1. To inform the Committee of the issued Directions of the Moray Integration Joint Board (MIJB) for the period 1 April to 30 September 2022. 2. RECOMMENDATION 2.1. It is recommended that the Audit, Performance and Risk Committee consider and note the Directions issues in the first six months of 2022/23. 3. BACKGROUND 3.1 The Public Bodies (Joint Working) (Scotland) Act 2014 (the Act) established the legal framework for integrating health and social care in Scotland. The Act required Integration Authorities to develop a Strategic Plan for the integrated functions and budgets delegated by the health board and local authority. 3.2 In accordance with Sections 26-28 of the Act, MIJB has in place a mechanism to action its Strategic Plan which takes the form of binding Directions to one or both of the Partners. Directions are the means by which the MIJB informs NHS Grampian and Moray Council of what is to be delivered using the integrated budget in order to achieve the strategic aims outlined in its Strategic Plan. A Direction must be issued in respect of every function that has been delegated to the MIJB. Directions are an obligatory legal mechanism. 4. KEY MATTERS RELEVANT TO RECOMMENDATION 4.1 At the MIJB meeting on 31 March 2022, the Directions policy and procedures were approved (para 17 of the minute refers). This was to enhance governance, transparency and accountability between the MIJB and its Partner organisations, NHS Grampian and Moray Council through a clear framework for the setting and reviewing of Directions and to confirm adequate governance arrangements. Item 9. Page 67
Page 68
4.2 As part of the approved procedures, The Audit, Performance and Risk Committee are to review all live Directions on a six monthly basis for assurance of delivery and compliance through an update report. With any resulting concerns being escalated to the MIJB at the first available opportunity. 4.3 APPENDIX 1 details the Directions approved during the period 1 April to 30 September 2022, for consideration. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) and Moray Integration Joint Board Strategic Commissioning Plan 2019 – 2029 ‘Partners in Care’ This report is consistent with the objectives of the Strategic Plan and includes Directions detailed to the partners of the MIJB. (b) Policy and Legal The MIJB is, in terms of Section 26 to 28 of the Public Bodies (Joint Working) (Scotland) Act 2014 required to direct NHS Grampian and Moray Council to deliver services to support the delivery of the Strategic Plan is as far as the functions that have been formally delegated. (c) Financial implications None arising directly from this report. (d) Risk Implications and Mitigation The delivery of the Strategic Plan is put at risk should appropriate Directions not be issued. The quality of the Directions are also a factor in ensuring implementation as intended. Close monitoring of Directions and scrutiny by Committee provides reasonable assurance that Directions are being carried out as intended. (e) Staffing Implications None arising directly from this report. (f) Property None arising directly from this report. (g) Equalities/Socio Economic Impact None arising directly from this report. (h) Climate Change and Biodiversity Impacts None arising directly from this report. (i) Directions None arising directly from this report. (j) Consultations The Chief Officer and Corporate Manager of the MIJB have been consulted for comment where appropriate. Page 68
Page 69
6. CONCLUSION 6.1 The Audit, Performance and Risk Committee are asked to consider and note the report content and Directions included in APPENDIX 1. Author of Report: Deborah O’Shea, Interim Chief Financial Officer Background Papers: with author Ref: Page 69
Page 70
Page 70
Page 71
MIJB Register of Directions APPENDIX 1 Issue to Agreed by IJB on Effective from Title of Direction and Reference Functions covered by Direction Link to direction MC 30 June 2022 31 March 2022 2022/21 Core Functions Ref: 20220630MC01 All functions listed in Annex 1, Part 1 of the Moray Health and Social Care Integration Scheme and all functions listed in Annex 2, Part 1 of the Moray Health and Social Care Integration Scheme. SPMAN- 1236605834-1393 GHB 30 June 2022 31 March 2022 2022/21 Core Functions Ref: 20220630GHB01 All functions listed in Annex 1, Part 1 of the Moray Health and Social Care Integration Scheme and all functions listed in Annex 2, Part 1 of the Moray Health and Social Care Integration Scheme. SPMAN- 1236605834-1394 MC 29 Sept 2022 01 April 2022 MIJB Updated Budget Position Ref: 20220401MC02 All functions listed in Annex 1, Part 1 of the Moray Health and Social Care Integration Scheme and all functions listed in Annex 2, Part 1 of the Moray Health and Social Care Integration Scheme. SPMAN- 1236605834-1436 GHB 29 Sept 2022 01 April 2022 MIJB Updated Budget Position Ref: 20220401GHB02 All functions listed in Annex 1, Part 1 of the Moray Health and Social Care Integration Scheme and all functions listed in Annex 2, Part 1 of the Moray Health and Social Care Integration Scheme. SPMAN- 1236605834-1435 Item 9. Page 71
Page 72
Page 72