Agenda Document Pack - Audit, Performance and Risk Committee - 30/03/2023
Moray Council · 30 March 2023
Back to Audit, Performance and Risk Committee — 30 March 2023 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
Audit, Performance and Risk Committee Thursday, 30 March 2023 Council Chambers NOTICE IS HEREBY GIVEN that a Meeting of the Audit, Performance and Risk Committee, Council Chambers, Council Office, High Street, Elgin, IV30 1BX on Thursday, 30 March 2023 at 14:00 to consider the business noted below. AGENDA 1. Sederunt 2. Declaration of Member's Interests 3. Minutes 3a. Minutes of Meeting of 24 November 2022 5 - 6 3b. Minutes of Special Meeting of 26 January 2023 7 - 8 4. Action Log of Meeting of 24 November 2022 9 - 10 5. Quarter 3 Performance Report 11 - 48 6. Internal Audit Plan Report 49 - 52 7. Strategic Risk Register 53 - 82 8. External Audit Plan for the Year Ending 2022-23 83 - 146 9. Internal Audit Section Completed Projects Report 147 - 166 10 Civil Contingencies - Resilience Standards Progress 167 - 176 11. External Review of Commissioned Services Update Report 177 - 212 Page 1
Page 2
Page 2
Page 3
MORAY INTEGRATION JOINT BOARD SEDERUNT Councillor Scott Lawrence (Chair) Mr Derick Murray (Voting Member) Mr Sandy Riddell (Voting Member) Councillor John Divers (Voting Member) Mr Sean Coady (Member) Mr Graham Hilditch (Member) Mr Simon Bokor-Ingram (Member) Ms Sonya Duncan (Member) Ms Deborah O'Shea (Member) Mr Stuart Falconer (Non-Voting Member) Clerk Name: Tracey Sutherland Clerk Telephone: 07971 879268 Clerk Email: committee.services@moray.gov.uk Page 3
Page 4
Page 4
Page 5
MINUTE OF MEETING OF THE AUDIT, PERFORMANCE AND RISK COMMITTEE Thursday, 24 November 2022 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Mr Simon Bokor-Ingram, Mr Sean Coady, Councillor John Divers, Ms Sonya Duncan, Mr Stuart Falconer, Mr Graham Hilditch, Councillor Scott Lawrence, Mr Derick Murray, Ms Deborah O'Shea, Mr Sandy Riddell APOLOGIES Mr Neil Strachan IN ATTENDANCE Also in attendance at the above meeting were the Chief Internal Auditor and Tracey Sutherland, Committee Services Officer. 1. Declaration of Member's Interests Mr Riddell declared that he is Chair of the Mental Welfare Commission. There were no other declarations of Members' interests in respect of any items on the agenda. 2. Minutes of meeting of 25 August 2022 The minute of the meeting of 25 August 2022 were submitted and approved. 3. Action Log of Meeting of 25 August 2022 The Action Log of the meeting of 25 August 2022 was considered and updated accordingly. 4. Quarter 2 Performance Report A report by the Corporate Manager updated the Audit, Performance and Risk Committee on performance as at Quarter 2 (July to September 2022). Item 3a. Page 5
Page 6
Following consideration the Committee agreed to note the performance of local indicators for Quarter 2 (July - September 2022). 5. Internal Audit Section - Update Report A report by the Chief Internal Auditor provided the Committee with an Internal Audit update. Following consideration the Committee agreed to note the audit update. 6. Strategic Risk Register Report A report by the Chief Officer provided an overview of the current strategic risks, along with a summary of actions which are in place to mitigate those risks, updated on November 2022. Following consideration the Committee agreed to: i) note the updated Strategic Risk Register included as Appendix 1; and ii) note the Strategic Risk Register will be further refined to align with the transformation and re-design plans as they evolve. 7. Internal Audit Section Completed Projects Report A report by the Chief Internal Auditor provided an update for the Committee on audit work completed since the last meeting of the Committee. Following consideration the Committee agreed to note the audit update. 8. Directions Monitoring Report The Interim Chief Financial Officer joined the meeting for the consideration of this item. A report by the interim Chief Financial Officer informed the Committee of the issued Directions of the Moray Integration Joint Board for the period 1 April to 30 September 2022. Following consideration the Committee agreed to note the Directions issued in the first six months of 2022/23. Page 6
Page 7
MINUTE OF MEETING OF THE AUDIT, PERFORMANCE AND RISK COMMITTEE Thursday, 26 January 2023 Council Chambers, Council Office, High Street, Elgin, IV30 1BX PRESENT Mr Simon Bokor-Ingram, Councillor John Divers, Ms Sonya Duncan, Mr Stuart Falconer, Mr Graham Hilditch, Councillor Scott Lawrence, Mr Derick Murray, Ms Deborah O'Shea, Mr Sandy Riddell APOLOGIES Mr Sean Coady IN ATTENDANCE Also in attendance at the above meeting were Brian Howarth, Audit Scotland and Tracey Sutherland, Committee Services Officer. 1. Chair The meeting was chaired by Councillor Scott Lawrence. 2. Declaration of Member's Interests There were no declarations of Members' interests in respect of any items on the agenda. 3. External Auditors Report to Those Charged with Governance Report A report by the Interim Chief Financial Officer requested the Committee to consider the reports to those charged with governance from the Board's External Auditor for the year ended 31 March 2022. The External Auditor advised the Committee that amendments had been made to Note 3 - Events after the Reporting Period and it now read: The unaudited accounts were issued by Deborah O’Shea, Interim Chief Financial Officer on 30 June 2022 and the audited accounts were authorised for issue on 26 Item 3b. Page 7
Page 8
January 2023. Events taking place after this date are not reflected in the financial statements or notes. The Scottish Government on the 16 January 2023 advised the IJBs of the intention to request that unspent monies in the earmarked Covid reserves are to be returned as they were for specific purposes and are not to be used to fund day to day expenditure. The amount for Moray IJB is £6.2 million. The accounts have not been adjusted for this amount, as the technical advice provided by CIPFA confirms that this is not an adjusting event but a disclosure in the 2021/22 accounts. In December 2022 the IJB was notified of costs relating to two out of area placements. Following receipt of the Scottish Government decision on ordinary residence for the first placement, the IJB is due to pay £0.7 million covering the period from October 2018 to 31 March 2022. The surplus on provision of services and reserves are overstated by this amount but the annual accounts have not been adjusted as this amount is not considered material. The IJB has not accepted responsibility for the second placement and this is considered to be a contingent liability until the individual’s ordinary residence is agreed or determined by the Scottish Government. Following consideration the Committee noted the reports from the External Auditor within Appendices 1 and 2. 4. Audited Annual Accounts 2021-22 A report by the Interim Chief Financial Officer submitted the Audited Annual Accounts for the year ended 31 March 2022. Following consideration the Committee agreed to recommend to the Moray Integration Joint Board the Audited Accounts for the financial year 2021/22. Page 8
Page 9
MEETING OF MORAY INTEGRATION JOINT BOARD AUDIT, PERFORMANCE AND RISK COMMITTEE THURSDAY 24 NOVEMBER 2022 ACTION LOG Item No. Title of Report Action Required Due Date Action By Update for 30 March 2023 1. Action Log of Meeting dated 27 August 2020 Payment Verification Assurance Update – once through appropriate NHSG Governance route. June 2022 Sean Coady Payment verification has resumed for dentistry, optometry and pharmacy. Payment verification for general medical services is expected to recommence in 2023. As the reports are received they will be presented to Committee 2. Civil Contingencies Annual Assurance Report from HSCM Civil Contingencies Group March 2023 Corporate Manager On today’s agenda Item 4. Page 9
Page 10
Item No. Title of Report Action Required Due Date Action By Update for 30 March 2023 Resilience Standards Report 3. External Review of Commissioned Services External Review to be commissioned. August 2022 Chief Officer On today’s agenda 4. Quarter 1 Performance Update report from the Psychological Service to be presented following email sent in July March 2023 Corporate Manager Scheduled – included as part of Performance report Page 10
Page 11
REPORT TO: MORAY INTEGRATION JOINT BOARD AUDIT, PERFORMANCE AND RISK COMMITTEE ON 30 MARCH 2023 SUBJECT: QUARTER 3 (OCTOBER TO DECEMBER 2022) PERFORMANCE REPORT BY: CORPORATE MANAGER 1. REASON FOR REPORT 1.1 To update the Audit, Performance and Risk (APR) Committee on performance as at Quarter 3 (October to December 2022). 2. RECOMMENDATION 2.1 It is recommended that Committee consider and note: i) the performance of local indicators for Quarter 3 (October - December 2022) as presented in the Performance Report at APPENDIX 1; and ii) the analysis of the local indicators that have been highlighted and actions being undertaken to address performance that is outside of acceptable target ranges as detailed in APPENDIX 1; 3. BACKGROUND 3.1 The purpose of this report is to ensure the Moray Integration Joint Board (MIJB) fulfils its ongoing responsibility to ensure effective monitoring and reporting on the delivery of services and on the programme of work as set out in its Strategic Plan. 3.2 APPENDIX 1 identifies local indicators for the MIJB and the functions delegated by NHS Grampian and Moray Council, to allow wider scrutiny by the Board. 4. KEY MATTERS RELEVANT TO RECOMMENDATION 4.1 Local Indicators are assessed on their performance via a common performance monitoring Red, Amber, and Green (RAG) traffic light rating system. Item 5. Page 11
Page 12
RAG scoring based on the following criteria: GREEN If Moray is performing better than target. AMBER If Moray is performing worse than target but within agreed tolerance. RED If Moray is performing worse than target by more than agreed tolerance. 4.2 The detailed performance report for quarter 1 is attached in APPENDIX 1. Summary 4.3 Performance within Health and Social Care Moray (HSCM) as demonstrated by the agreed indicators up to the end of quarter 3 of the financial year 2022/23 is showing as variable. Four of the indicators are presenting as green, one is amber and six are red. This represents a similar performance compared to quarters 1 and 2 of 2022/23. This is a reflection of the continued pressure being placed on the service. 4.4 Figure 1 provides a summary and the historical trend by indicator since quarter 3 of year 2021/2022. A summary of performance for each of the 6 reporting categories is provided below. One area is presenting as green, while two are amber and the other three are red. EMERGENCY DEPARTMENT - AMBER 4.5 There was a decrease in the attendance rate per 1,000 this quarter from 24 to 22.6, just above the target of 21.7. The trend over the past 5 months has been generally downwards, but above the target. However, the longer-term trend over 2 and ½ years is a gradual increase in the attendance rate This increase in demand will not only put pressure on ED but will undoubtedly have an impact on other services. DELAYED DISCHARGES – RED 4.6 The number of delays at the December census snapshot was 29, down considerably from 47 at the end of quarter 2 but remaining well above the revised target of 10. Although the number of bed days lost due to delayed discharges reduced from 1,197 last quarter to 1,063 this is still over 3 times the target. EMERGENCY ADMISSIONS – AMBER 4.7 The steady monthly increase in the rate of emergency occupied bed days for over 65s, noted in previous reports, continued this quarter. Since the end of quarter 2 the rate has increased from 2,469 to 2,547, exceeding the target of 2,107 per 1,000 population. The emergency admission rate per 1000 population for over 65s has increased slightly this quarter from 172.4 to 173.3. While the long-term trend for the number of people over 65 admitted to hospital in an emergency in the previous 12 months reduced from 118.6 to 117.4 over the same period. Both indicators are now GREEN but given the continuing increase in the emergency occupied bed-days for over 65s the overall status for the three indicators combined is AMBER. HOSPITAL RE-ADMISSIONS - GREEN 4.8 The 28-day re-admissions remain on target at 8.0%, as do the 7-day re- admissions 3.8%. Page 12
Page 13
MENTAL HEALTH – RED 4.9 The service has been unable to meet the 18 week LDP1 target since September 2021. This has declined steadily and in the first quarter of 2022 the % of people who were referred into the service and treated within 18 weeks had fallen to 27%, but in quarter 3 there have been signs of a recovery at and the proportion of people being treated within 18 weeks is 79%. STAFF MANAGEMENT – RED 4.10 NHS employed staff sickness levels (to the end of November 2022) have increased from 5.0% to 5.5%, while Council employed staff sickness was 8.3% last quarter, more than double the 4% target. Figure 1 - Performance Summary – Date to Nov 2022 5. AREAS NOT MEETING TARGETS Emergency Department 5.1 The rate per 1,000 population presenting at ED is 22.6, closer to the required performance level of 21.7. However, the proportion of patients seen within the 4-hour target time continued to reduce during 2021 and 2022 (Figure 2). Prior to March 2020 over 95% of attendees at ED were seen within 4 hours, generally reducing to 90% in the winter months. Since May 2021 this rate has 1 Local Delivery Plan Standards; priorities set and agreed between the Scottish Government and NHS Boards. Previously known as HEAT Targets and Standards. Q3 2122 Q4 2122 Q1 2223 Q2 2223 Q3 2223 New Target Previous Target Oct-Dec Jan-Mar Apr-Jun Jul-Sep Oct-Dec (from Q1 2122) (from Q1 2021 or earlier) AE Accident and Emergency AE-01 A&E Attendance rate per 1000 population (All Ages) 20.0 20.0 24.3 24.0 22.6 no change 21.7 A DD Delayed Discharges DD-01* Number of delayed discharges (including code 9) at census point 39 46 46 47 29 no change 10 R DD-02 Number of bed days occupied by delayed discharges (including code 9) at census point 1142 1294 1207 1197 1063 no change 304 R EA Emergency Admissions EA-01 Rate of emergency occupied bed days for over 65s per 1000 population 2045 2140 2320 2469 2547 2037 2107 R EA-02 Emergency admission rate per 1000 population for over 65s 187.2 183 177.5 172.4 173.3 179.9 179.8 G‚ EA-03 Number of people over 65 years admitted as an emergency in the previous 12 months per 1000 population 126.3 125.2 122 118.6 117.4 123.4 124.6 G‚ HR Hospital Readmissions HR-01 % Emergency readmissions to hospital within 7 days of discharge 3.5% 3.4% 4.3% 3.0% 3.8% no change 4.2% G‚ HR-02 % Emergency readmissions to hospital within 28 days of discharge 8.4% 8.0% 8.3% 6.7% 8.0% no change 8.4% G‚ MH Mental Health MH-01 % of patients commencing Psychological Therapy Treatment within 18 weeks of referral 67% 33% 27% 33% 79.0% no change 90% R SM Staff Management SM-01 NHS Sickness Absence (% of hours lost) 5.5% 4.7% 4.2% 5.0% 5.5% no change 4% R Data to Nov 22 SM-02 Moray Council Sickness Absence (% of days lost) 8.1% 8.9% 8.8% 5.2% 8.3% no change 4% R Health and Social Care Moray Performance Report Code Barometer (Indicator) RAG Page 13
Page 14
dropped and at the end of quarter 3 was 64.7%. Performance is below target, but in January there was a 10% improvement to 74.8%, which may indicate improved performance for 2023. Figure 2 – Percentage of patients seen within 4 hours (all ages) – (PHS data) 5.2 Following the launch of the Medical Ambulatory Emergency Care (AEC) service at Dr Gray's hospital on 09 January 2023, we have seen an improvement in ED performance. These figures are in correlation with a 10% fall in specialty admissions to hospital (surgical and medical) from ED, compared to December 2022. Delayed Discharge 5.3 The number of people who are clinically safe waiting to be discharged from hospital remains high, and there are no indications that the target of 10 people is going to be met soon. The Delayed Discharge indicators (DD-01 and DD- 02) continue to be red and remain 3 times higher than the new targets set at the end of quarter 3 of 2020/21. For the past 11 months the average number of people waiting to be discharged each week has fluctuated around 40, although at the end of the last week of 2022 this had reduced to 21. At the start of 2023 numbers rose back to 41, but have since slowly reduced week- by-week. The most recent data recorded 35 people waiting in hospital. 5.4 There are various pressures on the system that are preventing medically fit people from being able to leave hospital, most of which have been reported extensively in previous reports. The number of staff available to work has been an issue throughout the pandemic and continues to be an issue and is discussed in more detail below. Council staff absences due to sickness have fluctuated between 6-8%, while the NHS staff absences during quarters 1 and 2 this year returned closer to 4%. However, NHS absences are increasing once more and ended the year at 5.5%. 5.5 High numbers of people facing delays in leaving hospital indicate problems elsewhere in the system. Apart from the few cases where power of attorney, or other legal matters, require time to be resolved, the majority of the delays are either due to a suitable package of care not being available, or lack of beds in a residential home. Figure 3 shows the number of care homes that have been available each week since January 2022 (those in the ‘Red’ Page 14
Page 15
category have not been able to admit new residents). Apart from the occasional week there has typically been at least one care home unable to accept new residents. Figure 3: Moray Care Home RAG Status (Number at Red, Amber or Green) 5.6 There are few empty beds in residential homes in Moray (Figure 4). At the start of November 2022 bed occupancy was 99.3%, with just 3 beds available (this figure excludes the 6 interim beds that Health and Social Care Moray pay for in addition, to support short-term needs). Consequently, between care homes not being able to take in new residents and a shortage of care home beds, which might not always be located where the person wants to live, there are only limited places for a person waiting in hospital to go. 5.7 More care home beds have become available recently. Cathay was closed while a large-scale investigation was underway, but since re-opening has enabled 8 empty beds to become instantly available. Spynie was closed for some time due to Covid but has since re-opened. Care Home operators have also been requested that they offer places to residents from Moray first rather than offer them to people from outside Moray. Page 15
Page 16
Figure 4: Moray Care Home Bed Occupancy Rate (%) 5.8 The average number of people waiting to be discharged have reduced from 50 in July 2022 to 29 for the most recent week. The measures that have been put in place to manage the flow of patients from hospital to home (or care home) include the following: • People who have been waiting a while have sourced care under Option 22 as there has been availability through that option. • Daily portfolio meetings have helped expedite the outcomes for people. • The new Planned Discharge Date system changed the criterion from ‘medically fit’ to ‘clinically fit’. When we declare a person is clinically fit it allows time for occupational therapy, physio-therapy and social work to carry out their assessments before the person is categorised as a delay, and this measure has reduced delays slightly. 5.9 In addition, more people have been recruited into the Care at Home team enabling more rotas to be opened, and there are fewer people requiring double-up care than in recent months. It appears that people with more complex needs are choosing to move into residential homes rather than requiring Care at Home services. Both these changes have allowed more people to be given care packages, helping to reduce the backlog (see section 6 for more details of unmet need). 5.10 Care at Home assessors are now able to complete assessments in a timely manner and there is no backlog of assessments waiting to be completed. Third, there is a close liaison between the assessors and area managers and their Allied counterparts, ensuring that any spare capacity is able to be utilised promptly to provide care packages for people waiting. The demands and capacity are discussed twice weekly at the Care-at-home hub meetings. 2 As part of Self-directed support (SDS), there are several options for managing your care. Option 2 is one of these options. You choose how the budget is used but the money is managed by someone else. Page 16
Page 17
5.11 Finally, and sadly, some people die waiting to be discharged. The numbers aren’t large, but in 2022 there were 7 such deaths and in 2023 so far there have been 2. Since the start of 2023 the most common reason for a residential or nursing agreement to be closed is due to the person’s death (71%, see Figure 5), but then allows the next person waiting for a residential or nursing agreement to be offered the care they require. These figures will be monitored in future reports to identify trends from year to year. Figure 5: Reasons for Closed Residential Nursing Agreements (Jan – Feb 2023) 5.12 For Care at Home packages most are closed due to a change in service (63%), but the second largest cause is death, responsible for the closure approximately 1 in 5 agreements (Figure 6). Again, these deaths allow packages to be made available to the next person on the waiting list. Reason Percentage Change In Service Client Deceased Service Not Required Hospital Admission Re-ablement Completed Transferred To Another Home 63.28% 18.75% 8.59% 7.81% 0.78% 0.78% Page 17
Page 18
Figure 6: Care at Home (CAH) Packages Closed by Category (January to February 2023) 5.13 Figure 5 displays the weekly average number of people, who are clinically safe, experiencing delayed discharge, by hospital, and illustrates how many more people are being affected than before the COVID-19 pandemic. This continues to represent a significant loss of bed–capacity for other medical procedures, for example, and an additional unplanned burden on hospital and social care staff. Approximately half the delays are for people admitted to one of Moray’s community hospitals. Figure 7: Average Number of Delayed Discharge Patients in Moray per Week 5.14 To put the Moray experience into context, at the end of quarter 3 the average across Scotland was 55, similar to the figure of 56 at the end of quarter 2. The Moray average during 2022 has consistently been below the Scottish level, and apart from being more spiky, has tended to follow a similar trend (Figure 8). Page 18
Page 19
Figure 8: Hospital Delayed Discharges over time - Comparison of Scotland and Moray (Scottish Government data) Emergency Admissions 5.15 Emergency Admission rates for the over 65s (EA-02) have reduced significantly over the past 15 months, although there was a small increase in December 2022. Note that the rate of 173.3 per 1,000 population is below the target based on the 2021 average of 179.8 per 1,000 population. Similarly, the number of people in this category admitted during the past 12 months (EA-03) has followed a similar trend. At the end of quarter 3 the rate had reduced to 117.4 per 1,000 population, below the target of 124.6 per 1,000 population. 5.16 However, the reduction in admissions may be due to the lack of available beds, in part caused by delays in discharging people. Furthermore, the over 65s admitted for an emergency are continuing to stay in hospital longer as evidenced by the Emergency Occupied Bed Days for over 65s (EA-01) indicator. This has been increasing steadily since the start of 2021 and continued to increase each month during quarter 3 reaching a rate of 2,547 bed-days per 1,000 population, exceeding the target of 2,037 per 1,000 population, and the highest recorded rate since this indicator was first measured. Mental Health 5.17 Approximately 1 in 5 patients requiring psychological therapy treatment are having to wait more than 18 weeks for their treatment to begin. While this figure remains below the target it is a significant improvement on the previous 2 quarters when almost 4 out of 5 patients had to wait more than 18 weeks. Improvement is attributed to close monitoring of the service and implementation of a series of actions aimed at reducing variation, maximizing capacity and efficiency within the department. Page 19
Page 20
5.18 Long term absence of the psychology service lead and psychology resource being diverted elsewhere in the wider system impacts on ability to achieve 90% target. Recruitment processes are currently underway for an NHS Grampian wide Band 8D adult mental health psychology lead post. Meanwhile existing Moray psychological services staff will continue to be supported to identify and implement any actions that assist further towards meeting the required standard. Progress continues to be monitored within NHS Grampian Psychological Service Improvement Board. 5.19 Moray service is working with Grampian colleagues as part of the NHS Grampian Psychological Therapies Improvement Plan which has been submitted to the Scottish Government and will be monitored. Part of this work has been to look at capacity and demand within the service, offering a set number of sessions dependant on clinical need and contracting patients in line with these recommendations. 5.20 Staff working within the service have been triaging patients on the waiting list and offering group work, when appropriate, to increase the number of people they can see. However, some people will not be suitable for this and will require individual appointments. 5.21 The team has been affected by ongoing sickness absence which impacts on service delivery and there is an upcoming maternity leave. Discussions are taking place about cover for the latter. Staff Management 5.22 The average absence due to sickness for all Moray Council staff since May 2020 was 6.8% at the end of quarter 3. This is just above the Scottish average of 6.1% for the same period and above the pre-pandemic levels. Sickness absence for Moray Council employed HSCM staff remains high at 8.3%, and NHS staff absences due to sickness have increased from 4.2% at the end of quarter 1 to 5.5% in quarter 3 (data to November 2022). 5.23 The locally collected data for Provider Services provides an illustration of the magnitude of the difficulties that faced managers in this front-line delivery service (Figure 7). The high absence rates of 17% experienced in March 2022 have steadily reduced, but throughout the summer and autumn of 2022 the absence rate has fluctuated between 13% to 7%, still requiring close management. Page 20
Page 21
Figure 9: Provider Services staff absence rate from 26 January 2022 to September 2022 (latest available service collated data) 5.24 Moray Council has recently reinstated face-to-face Health and Work training for all managers who have staff attendance responsibility. The Moray Council’s Health and Work policy is a supportive policy, and the training sessions provide vital skills to those managing absence. 6. UNMET NEED 6.1 The continuing staff shortages for care at home is impacting on the service’s ability to meet the demand from people who require support. Since July last year there have been approximately 150 to 165 people waiting to receive a social care assessment. However, since the start of December 2022 the number of people waiting has steadily reduced to 119. Still high, but the trend is in the right direction (Figure 8). Over the same period the number of hours of care not being delivered has remained well above the pre-pandemic levels, but has gradually and steadily been reducing from 1,500 hours in March 2022 down to 1,058 hours for the most recent week (Figure 9). Page 21
Page 22
Figure 10 Figure 11 6.2 The impact of this lack of capacity to deliver care is predominantly on people living in the community. The number of people in hospital who have been assessed and are waiting for a package of care to be put in place has reduced from 41 last August to just 12. However, there are 106 people in the community waiting for their care packages to begin (Figure 10). Overall the numbers of people in this category have reduced from over 170 to about 120 in the past 12 months, so the trend is heading in the right direction and the rate at which the numbers are reducing is speeding-up, albeit after a slow start. Page 22
Page 23
Figure 12: 6.3 The shortfall in provision of care is also monitored by measuring the number of hours of care not provided each week. The data are measured for those in hospital and those in the community who are waiting for care packages to commence, and also for those with a care package in place but who aren’t receiving the full allocation of hours of care assessed as needed. The number of hours not being provided has been high for most of 2022, but there are signs the situation may be improving, albeit still at higher levels than is acceptable. 6.4 The following 3 figures (Figures 11, 12 &13) illustrate the difficulties faced by the Social Care team in providing the required numbers of hours of care during the COVID-19 pandemic. Page 23
Page 24
Figure 13: Hours of Care yet to be Provided for Individuals in Hospital Figure 14: Hours of Care yet to be Provided for Individuals in the Community Page 24
Page 25
Figure 15: Hours of Care Assessed as Needed and not Provided for those in Receipt of a Care Package 6.5 Although the levels of unmet need may have peaked and are starting to reduce the average time that people have to wait for an assessment continues to increase. The average number of days has doubled from 152 in September 2021 to over 300, while the number of people waiting has reduced back to the September 2021 figure. The increased waiting time may suggest that care packages are becoming more complex and assessments are taking longer so that fewer are able to be completed each week, or that there are insufficient staff to undertake the number of assessments required. Figure 16: Average Waiting Time for Assessments Page 25
Page 26
7. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) and Moray Integration Joint Board Strategic Plan “Partners in Care 2022 – 2032” Performance management reporting is a legislative requirement under section 42 of the Public Bodies (Joint Working) (Scotland) Act 2014. In addition to publishing an Annual Performance Report, the Moray Integration Scheme requires that the MIJB will “monitor the performance of the delivery of integrated services using the Strategic Plan on an ongoing basis” (para 5.2.2 of the Moray Integration Scheme refers). (b) Policy and Legal None directly associated with this report. (c) Financial implications None directly associated with this report. (d) Risk Implications and Mitigation There are no risk issues arising directly from this report. The long-term impact of the COVID-19 on the Health and Social Care system are still unknown and performance measurement will remain flexible to enable the service to be prepared and react to any future developments. (e) Staffing Implications None directly associated with this report. (f) Property None directly associated with this report. (g) Equalities/Socio Economic Impact An Equality Impact Assessment is not required for the Performance Framework because there will be no impact, as a result of the report, on people with protected characteristics. (h) Climate Change and Biodiversity Impacts No climate change or biodiversity implications have been determined for this policy/activity. It should be noted that extreme weather events, such as the recent storms, are expected to occur more frequently and with greater ferocity in future years. In the longer-term there are likely to be issues with the reduction in availability and increases in costs of fossil fuels that will pose challenges for the delivery of care services to people living in rural areas. (i) Directions There are no directions arising from this report. (j) Consultations For Health and Social Care Moray the Chief Officer, Corporate Officer and Service Managers in relation to respective areas have been consulted as has Tracey Sutherland, Committee Services Officer, Moray Council and their comments are incorporated in the report. Page 26
Page 27
8. CONCLUSION 8.1 This report provides the MIJB with an overview of the performance of specified Local and National indicators and outlines actions to be undertaken to improve performance in Section 4 and expanded on in APPENDIX 1. As this is my final report before I retire, may I take the opportunity to wish the MIJB all the best for the future. Authors of Report: Sonya Duncan, Corporate Manager Carl Bennett, Senior Performance Officer Background Papers: Available on request Ref: Page 27
Page 28
Page 28
Page 29
Appendix 1 PERFORMANCE REPORT - SUPPORTING CHARTS QUARTER 3 2022/23 (1 OCTOBER 2022 – 31 DECEMBER 2022) Item 5. Page 29
Page 30
Table of Contents Health and Social Care Moray - 1 - 2022-23 Quarter 3 Performance Report 1. TABLE OF CONTENTS 1. Table of Contents ............................................................................................................................. 1 1. Performance Summary .................................................................................................................... 2 Barometer Overview ........................................................................................................................... 2 2. Delayed Discharge - RED .................................................................................................................. 3 DD-01: Number of delayed discharges (including code 9, Census snapshot, at end of quarter) ....... 3 DD-02: Number of Bed Days Occupied by Delayed Discharges per quarter (inc code 9) per 1000 18+ population ........................................................................................................................................... 3 3. Emergency Admissions - AMBER ..................................................................................................... 5 EA-01: Rate of emergency occupied bed days for over 65s per 1000 population .............................. 5 EA-02: Emergency Admissions rate per 1000 population for over 65s .............................................. 6 EA-03: Number of people over 65 years admitted as an emergency in the previous 12 months per 1000 population .................................................................................................................................. 7 4. Emergency Department – AMBER ................................................................................................... 8 AE-01: ED Attendance rates per 1,000 population (All Ages) ............................................................. 8 5. Hospital Re-admissions - GREEN ...................................................................................................... 9 HR-01: Percentage of Emergency Re-admissions to hospital within 28 days - Moray Patients ......... 9 HR-02: Percentage of Emergency Re-admissions to hospital within 7 days - Moray Patients ......... 10 6. Mental Health – RED ...................................................................................................................... 11 MH-01: Percentage of patients commencing Psychological Therapy Treatment within 18 weeks of referral ............................................................................................................................................... 11 7. Staff Management - RED ............................................................................................................... 12 SM-01: NHS Sickness Absence % of Hours Lost ................................................................................ 12 SM-02: Council Sickness Absence (% of Calendar Days Lost) ............................................................ 13 Council STAFF Absence OVER TIME – SCOTLAND COMPARISON...................................................... 14 Appendix 1: Key and Data Definitions .................................................................................................. 15 RAG Scoring Criteria .......................................................................................................................... 15 Peer Group Definition ....................................................................................................................... 15 Appendix 2: Strategic Priorities............................................................................................................. 16 Appendix 3: National Health and Wellbeing Outcomes ....................................................................... 18 Page 30
Page 31
Performance Summary Health and Social Care Moray - 2 - 2022-23 Quarter 3 Performance Report 1. PERFORMANCE SUMMARY BAROMETER OVERVIEW Moray currently has 11 local indicators. Of these 4 are Green, 1 is Amber and 6 are Red. Figure 1 - Performance Summary Q3 2122 Q4 2122 Q1 2223 Q2 2223 Q3 2223 New Target Previous Target Oct-Dec Jan-Mar Apr-Jun Jul-Sep Oct-Dec (from Q1 2122) (from Q1 2021 or earlier) AE Accident and Emergency AE-01 A&E Attendance rate per 1000 population (All Ages) 20.0 20.0 24.3 24.0 22.6 no change 21.7 A DD Delayed Discharges DD-01* Number of delayed discharges (including code 9) at census point 39 46 46 47 29 no change 10 R DD-02 Number of bed days occupied by delayed discharges (including code 9) at census point 1142 1294 1207 1197 1063 no change 304 R EA Emergency Admissions EA-01 Rate of emergency occupied bed days for over 65s per 1000 population 2045 2140 2320 2469 2547 2037 2107 R EA-02 Emergency admission rate per 1000 population for over 65s 187.2 183 177.5 172.4 173.3 179.9 179.8 G‚ EA-03 Number of people over 65 years admitted as an emergency in the previous 12 months per 1000 population 126.3 125.2 122 118.6 117.4 123.4 124.6 G‚ HR Hospital Readmissions HR-01 % Emergency readmissions to hospital within 7 days of discharge 3.5% 3.4% 4.3% 3.0% 3.8% no change 4.2% G‚ HR-02 % Emergency readmissions to hospital within 28 days of discharge 8.4% 8.0% 8.3% 6.7% 8.0% no change 8.4% G‚ MH Mental Health MH-01 % of patients commencing Psychological Therapy Treatment within 18 weeks of referral 67% 33% 27% 33% 79.0% no change 90% R SM Staff Management SM-01 NHS Sickness Absence (% of hours lost) 5.5% 4.7% 4.2% 5.0% 5.5% no change 4% R Data to Nov 22 SM-02 Moray Council Sickness Absence (% of days lost) 8.1% 8.9% 8.8% 5.2% 8.3% no change 4% R Health and Social Care Moray Performance Report Code Barometer (Indicator) RAG Page 31
Page 32
Delayed Discharge - RED Health and Social Care Moray - 3 - 2022-23 Quarter 3 Performance Report 2. DELAYED DISCHARGE - RED Trend Analysis The number of delays at snapshot (29) was just one lower than at the end of quarter 3 2021/22. The number of bed days lost due to delayed discharges reduced from 1,197 to 1,063. Both indicators remain around 3 times above target. DD-01: NUMBER OF DELAYED DISCHARGES (INCLUDING CODE 9, CENSUS SNAPSHOT, AT END OF QUARTER) Purpose Reliably achieving timely discharge from hospital is an important indicator of quality and is a marker for person centred, effective, integrated, and harm free care. Strategic Priority 2: HOME FIRST Linked Indicator(s) DD-02 National Health & Wellbeing Outcomes 2, 3, 5, 7 Figure 2 – Delayed Discharges Indicator Trend – Reducing Despite some volatility in numbers from month to month the underlying trend for the number of people experiencing Delayed Discharge had been steadily increasing since the end of Quarter 4 2020/21 until May 2022. Since the trend has shown a gradual reduction, but still 3 times the target level. Source Public Health Scotland DD-02: NUMBER OF BED DAYS OCCUPIED BY DELAYED DISCHARGES PER QUARTER (INC CODE 9) PER 1000 18+ POPULATION Page 32
Page 33
Delayed Discharge - RED Health and Social Care Moray - 4 - 2022-23 Quarter 3 Performance Report Purpose This monitors the number of people delayed in hospital once medically fit for discharge. Longer stays in hospital are associated with increased risk of infection, low mood, and reduced motivation. Strategic Priority 2: HOME FIRST Linked Indicator(s) DD-01 National Health & Wellbeing Outcomes 2, 3, 5, 7 Figure 3 – Delayed Discharge Bed-days Indicator Trend – Reducing The number of bed-days are over 3 times the target number of days and after averaging around 1200 for the past three quarters has now reduced to closer to 1,000. Source Public Health Scotland Page 33
Page 34
Emergency Admissions - AMBER Health and Social Care Moray - 5 - 2022-23 Quarter 3 Performance Report 3. EMERGENCY ADMISSIONS - AMBER Trend Analysis Since March 2021 there has been a steady increase each month in the rate of emergency occupied bed days for over 65s and the rate increased during quarter 3 from 2,469 to 2,547 in December 2022. However, the emergency admission rate per 1000 population for over 65s has increased from 173.3 to 172.4 over the same period, while the number of people over 65 admitted to hospital in an emergency reduced from 118.6 to 117.4. EA-01: RATE OF EMERGENCY OCCUPIED BED DAYS FOR OVER 65S PER 1000 POPULATION Purpose EA-01, EA-02, and EA-03 are all interconnected and provide a narrative when viewed together of whether emergency admissions and bed days are within tolerance and indicate where potential risks could arise. Strategic Priority 1: BUILDING RESILIENCE Linked Indicator(s) EA-02, EA-03 National Health & Wellbeing Outcomes 1, 2, 3, 5 Figure 4 – Emergency Occupied Bed-days (Over 65s) Indicator Trend – Increasing This indicator was on a downward trend for most of 2020, but since the start of 2021 has been increasing and exceeded the reduced target throughout 2022. Source Health Intelligence Page 34
Page 35
Emergency Admissions - AMBER Health and Social Care Moray - 6 - 2022-23 Quarter 3 Performance Report EA-02: EMERGENCY ADMISSIONS RATE PER 1000 POPULATION FOR OVER 65S Purpose EA-01, EA-02, and EA-03 are all interconnected and provide a story when viewed together of whether emergency admissions and bed days are within tolerance and indicate where potential risks could arise. Strategic Priority 1: BUILDING RESILIENCE Linked Indicator(s) EA-01, EA-03 National Health & Wellbeing Outcomes 1, 2, 3, 5 Figure 5 – Emergency Admissions (Over 65s) Indicator Trend – Increasing At the start of 2021 the trend had been rapidly increasing, but since August 2021 there has been a steady and sustained reduction. However, there was a small increase in December 2022, but the rate remains below the target. Source Health Intelligence Page 35
Page 36
Emergency Admissions - AMBER Health and Social Care Moray - 7 - 2022-23 Quarter 3 Performance Report EA-03: NUMBER OF PEOPLE OVER 65 YEARS ADMITTED AS AN EMERGENCY IN THE PREVIOUS 12 MONTHS PER 1000 POPULATION Purpose EA-01, EA-02, and EA-03 are all interconnected and provide a story when viewed together of whether emergency admissions and bed days are within tolerance and indicate where potential risks could arise. Strategic Priority 1: BUILDING RESILIENCE Linked Indicator(s) EA-01, EA-02 National Health & Wellbeing Outcomes 1, 2, 3, 5 Figure 6 – Number of Over 65 People Emergency Admissions Indicator Trend – Increasing This indicator was showing a consistent downward trend until February 2021, since when the trend reversed and increased rapidly. As with Figure 4 the rate levelled off in August 21 and then reduced to be below the target, although there was a slight increase in December 2022. Source Health Intelligence Page 36
Page 37
Emergency Department – AMBER Health and Social Care Moray - 8 - 2022-23 Quarter 3 Performance Report 4. EMERGENCY DEPARTMENT – AMBER Trend Analysis There has been an reduction in the rate per 1,000 this quarter from 24 to 22.6, remaining above target and double the number presenting in April 2020. AE-01: ED ATTENDANCE RATES PER 1,000 POPULATION (ALL AGES) Purpose A greater system-wide understanding of how people access emergency care, and why certain choices are made, will allow local health systems to develop intelligence about avoidable attendances at emergency departments and target their responses. Strategic Priority 3: PARTNERS IN CARE Linked Indicator(s) HR-01, HR-02 National Health & Wellbeing Outcomes 1, 2, 3, 5 Figure 7 – ED Attendance Rate Indicator Trend – Stable During quarter 3 the attendance rate per 1,000 population has remained reasonably stable, just above the target level. However, the attendance rate is almost double the rate experienced at the end of April 2020. Source Health Intelligence Page 37
Page 38
Hospital Re-admissions - GREEN Health and Social Care Moray - 9 - 2022-23 Quarter 3 Performance Report 5. HOSPITAL RE-ADMISSIONS - GREEN Trend Analysis 28-day re-admissions remain GREEN at 8.0%, and 7-day Re-admissions remain GREEN at 3.8%. HR-01: PERCENTAGE OF EMERGENCY RE-ADMISSIONS TO HOSPITAL WITHIN 28 DAYS - MORAY PATIENTS Purpose Re-admissions are often undesirable for patients and have also been shown to be associated with the quality of care provided to patients at several stages along the clinical pathway, including during initial hospital stays, transitional care services and post-discharge support. (This measure lags by a month due to the time required for a potential 28 day discharge to occur) Strategic Priority 1: BUILDING RESILIENCE Linked Indicator(s) HR-02, AE-01 National Health & Wellbeing Outcome 1, 2, 3, 5 Figure 8 – 28-dayEmergency Readmissions Indicator Trend – Stable 28-day Hospital Re-admissions have remained around the target of 8% for this quarter. Source Health Intelligence Page 38
Page 39
Hospital Re-admissions - GREEN Health and Social Care Moray - 10 - 2022-23 Quarter 3 Performance Report HR-02: PERCENTAGE OF EMERGENCY RE-ADMISSIONS TO HOSPITAL WITHIN 7 DAYS - MORAY PATIENTS Purpose Re-admissions are often undesirable for patients and have also been shown to be associated with the quality of care provided to patients at several stages along the clinical pathway, including during initial hospital stays, transitional care services and post-discharge support. Strategic Priority 1: BUILDING RESILIENCE Linked Indicator(s) HR-01, AE-01 National Health & Wellbeing Outcome 1, 2, 3, 5 Figure 9 – 7-day Emergency Readmissions Indicator Trend – Stable 7-day Hospital Re-admissions have generally remained below the target of 4.2% since July 2021, apart from 2 occasions. Source Health Intelligence Page 39
Page 40
Mental Health – RED Health and Social Care Moray - 11 - 2022-23 Quarter 3 Performance Report 6. MENTAL HEALTH – RED Trend Analysis After 24 months below target and a year at around 20% this measure was at 100% for the 6 months from December 2020 through to June 2021. However, since quarter 3 there has been a rapid reduction with 27% of patients being referred within 18 weeks during June 2022. MH-01: PERCENTAGE OF PATIENTS COMMENCING PSYCHOLOGICAL THERAPY TREATMENT WITHIN 18 WEEKS OF REFERRAL Purpose Timely access to healthcare is a key measure of quality and that applies equally in respect of access to mental health services. Strategic Priority 3: PARTNERS IN CARE Linked Indicator(s) National Health & Wellbeing Outcome 1, 2, 3, 5 Figure 10 – Psychological Therapy Treatment within 18 Weeks Indicator Trend – Improving After being around 30% for most of 2022 there has been a marked improvement in performance, which had achieved 79% by the end of quarter 3 2022/23, albeit still below the target of 90%. Source Health Intelligence Page 40
Page 41
Staff Management - RED Health and Social Care Moray - 12 - 2022-23 Quarter 3 Performance Report 7. STAFF MANAGEMENT - RED Trend Analysis Sickness absence for NHS employed staff remains above target reaching 5.5% at the end of quarter 3. Council employed staff sickness has remained high with a minimal reduction from 8.98% to 8.87%, which is above the figure for the same period in the previous 2 years. SM-01: NHS SICKNESS ABSENCE % OF HOURS LOST Purpose Attendance at work of all employees is essential in the interests of the effective and efficient operation of services. Strategic Priority 1: BUILDING RESILIENCE Linked Indicator(s) SM-02 National Health & Wellbeing Outcome 8 Target (+10%) Q2 21/22 Q3 21/22 Q4 21/22 Q1 22/23 Q2 22/23 Q3 22/23 4% 6.0% 5.5% 4.7% 4.2% 5.0% 5.5%* Figure 11 – NHS Sickness Absence Indicator Trend – Increasing This indicator has increased steadily throughout 2022/23 although it remained unchanged in November and December 2022 at 5.5%. *Data to November 2022 Source Health Intelligence Page 41
Page 42
Staff Management - RED Health and Social Care Moray - 13 - 2022-23 Quarter 3 Performance Report SM-02: COUNCIL SICKNESS ABSENCE (% OF CALENDAR DAYS LOST) Purpose Attendance at work of all employees is essential in the interests of the effective and efficient operation of services. Strategic Priority 1: BUILDING RESILIENCE Linked Indicator(s) SM-01 National Health & Wellbeing Outcome 1, 2, 3, 5 Target Q2 21/22 Q3 21/22 Q4 21/22 Q1 22/23 Q2 22/23 Q3 22/23 4% 7.8% 8.05% 8.98% 8.87% 5.22% 8.34% Figure 12 – Moray Council Sickness Absence Indicator Trend – Increasing After a 3% reduction during quarter 2 this indicator rose during quarter 3 to double the target and close to the peak of 9% recorded in quarter 4 2019/20. Source Council HR Page 42
Page 43
Staff Management - RED Health and Social Care Moray - 14 - 2022-23 Quarter 3 Performance Report COUNCIL STAFF ABSENCE OVER TIME – SCOTLAND COMPARISON Chart provided by the Improvement Service using data from the from weekly SOLACE council returns. This update captures data from the week ending 13 January 2023. Moray remains above the Scottish average and there was a marked increase in absence towards the end of quarter 3. Figure 13 – Moray Council Sickness Absence Compared to National Average Page 43
Page 44
Staff Management - RED Health and Social Care Moray - 15 - 2022-23 Quarter 3 Performance Report APPENDIX 1: KEY AND DATA DEFINITIONS RAG SCORING CRITERIA GREEN If Moray is performing better than target. AMBER If Moray is performing worse than target but within specified tolerance. RED If Moray is performing worse than target but outside of specified tolerance. PEER GROUP DEFINITION Moray is defined as being in Peer Group 2 in the Local Government Benchmarking Framework Family Group 1 Family Group 2 Family Group 3 Family Group 4 East Renfrewshire East Dunbartonshire Aberdeenshire Edinburgh, City of Perth & Kinross Aberdeen City Shetland Islands Orkney Islands Moray Stirling East Lothian Angus Scottish Borders Highland Argyll & Bute Midlothian Falkirk Dumfries & Galloway Fife South Ayrshire West Lothian South Lanarkshire Renfrewshire Clackmannanshire Eilean Siar Dundee City East Ayrshire North Ayrshire North Lanarkshire Inverclyde West Dunbartonshire Glasgow City Page 44
Page 45
Staff Management - RED Health and Social Care Moray - 16 - 2022-23 Quarter 3 Performance Report APPENDIX 2: STRATEGIC PRIORITIES Page 45
Page 46
Staff Management - RED Health and Social Care Moray - 17 - 2022-23 Quarter 3 Performance Report •EA-01: RATE OF EMERGENCY OCCUPIED BED DAYS FOR OVER 65S PER 1000 POPULATION •EA-02: EMERGENCY ADMISSIONS RATE PER 1000 POPULATION FOR OVER 65S •EA-03: NUMBER OF PEOPLE OVER 65 YEARS ADMITTED AS AN EMERGENCY IN THE PREVIOUS 12 MONTHS PER 1000 POPULATION •HR-01: PERCENTAGE OF EMERGENCY RE-ADMISSIONS TO HOSPITAL WITHIN 28 DAYS -MORAY PATIENTS •HR-02: PERCENTAGE OF EMERGENCY RE-ADMISSIONS TO HOSPITAL WITHIN 7 DAYS -MORAY PATIENTS •SM-01: NHS SICKNESS ABSENCE % OF HOURS LOST •SM-02: COUNCIL SICKNESS ABSENCE (% OF CALENDAR DAYS LOST) BUILDING RESILIENCE •DD-01: NUMBER OF DELAYED DISCHARGES (INCLUDING CODE 9, CENSUS SNAPSHOT, AT END OF QUARTER) •DD-02: NUMBER OF BED DAYS OCCUPIED BY DELAYED DISCHARGES PER QUARTER (INC CODE 9) PER 1000 18+ POPULATION •UN-01: NUMBER OF LONG-TERM HOME CARE HOURS UNMET AT WEEKLY SNAPSHOT •UN-02: NUMBER OF PEOPLE WITH LONG-TERM CARE HOURS UNMET AT WEEKLY SNAPSHOT HOME FIRST •OA-01: NUMBER OF REVIEWS OUTSTANDING AT END OF QUARTER SNAPSHOT •MH-01: PERCENTAGE OF PATIENTS COMMENCING PSYCHOLOGICAL THERAPY TREATMENT WITHIN 18 WEEKS OF REFERRAL •AE-01: A&E ATTENDANCE RATES PER 1000 POPULATION (ALL AGES) PARTNERS IN CARE Page 46
Page 47
Staff Management - RED Health and Social Care Moray - 18 - 2022-23 Quarter 3 Performance Report APPENDIX 3: NATIONAL HEALTH AND WELLBEING OUTCOMES 1 - PEOPLE ARE ABLE TO LOOK AFTER AND IMPROVE THEIR OWN HEALTH AND WELLBEING AND LIVE IN GOOD HEALTH FOR LONGER. 2 - PEOPLE, INCLUDING THOSE WITH DISABILITIES OR LONG-TERM CONDITIONS, OR WHO ARE FRAIL; ARE ABLE TO LIVE, AS FAR AS REASONABLY PRACTICABLE, INDEPENDENTLY AT HOME, OR IN A HOMELY SETTING IN THEIR COMMUNITY. 3 - PEOPLE WHO USE HEALTH AND SOCIAL CARE SERVICES HAVE POSITIVE EXPERIENCES OF THOSE SERVICES, AND HAVE THEIR DIGNITY RESPECTED. 4 - HEALTH AND SOCIAL CARE SERVICES ARE CENTRED ON HELPING TO MAINTAIN OR IMPROVE THE QUALITY OF LIFE OF PEOPLE WHO USE THOSE SERVICES. 5 - HEALTH AND SOCIAL CARE SERVICES CONTRIBUTE TO REDUCING HEALTH INEQUALITIES. 6 - PEOPLE WHO PROVIDE UNPAID CARE ARE SUPPORTED TO LOOK AFTER THEIR OWN HEALTH AND WELLBEING, INCLUDING TO REDUCE ANY NEGATIVE IMPACT OF THEIR CARING ROLE ON THEIR OWN HEALTH AND WELLBEING. 7 - PEOPLE USING HEALTH AND SOCIAL CARE SERVICES ARE SAFE FROM HARM. 8 - PEOPLE WHO WORK IN HEALTH AND SOCIAL CARE SERVICES FEEL ENGAGED WITH THE WORK THEY DO AND ARE SUPPORTED TO CONTINUOUSLY IMPROVE THE INFORMATION, SUPPORT, CARE, AND TREATMENT THEY PROVIDE. 9 - RESOURCES ARE USED EFFECTIVELY AND EFFICIENTLY IN THE PROVISION OF HEALTH AND SOCIAL CARE SERVICES. Page 47
Page 48
Page 48
Page 49
REPORT TO: MORAY INTEGRATION JOINT BOARD AUDIT, PERFORMANCE AND RISK COMMITTEE ON 30 MARCH 2023 SUBJECT: INTERNAL AUDIT PLAN 2023/24 BY: CHIEF INTERNAL AUDITOR 1. REASON FOR REPORT 1.1 To provide the Audit, Performance and Risk Committee with information on the proposed internal audit coverage for the 2023/24 financial year. 2. RECOMMENDATION 2.1 It is recommended that the Committee considers and notes this report and agrees the proposed audit coverage. 3. BACKGROUND 3.1 Scottish Government Integrated Resources Advisory Group (IRAG) guidance requires each IJB to establish adequate and proportionate internal audit arrangements to review risk management, governance and control of delegated resources. 3.2 The guidance recommends that a risk-based audit plan should be developed by the Chief Internal Auditor of the IJB and be approved by the IJB or other Committee (in Moray, the Audit, Performance and Risk Committee). Importantly it also notes that the operational delivery of services within the Health Board and Local Authority on behalf of the IJB will be covered by their respective internal audit arrangements. 3.3 In recent years, discussions have been held with the internal audit providers for NHS Grampian, Aberdeen City and Aberdeenshire Councils. The intention has been to develop closer working relationships to better coordinate the audit planning process. An audit of Information Management was agreed as the first step to be undertaken by all internal audit providers. It is therefore pleasing to report that the audit review was completed and a report issued with Item 6. Page 49
Page 50
recommendations agreed by the Service. It is hoped moving forward that closer working relationships can continue to ensure a greater coordinated audit approach. 3.4 Moray Council’s Audit and Scrutiny Committee, at its meeting on 15 of February 2023, approved an audit plan which provided 80 days of input for audit work relating to the MIJB (para 5 of the minute refers). 4. KEY MATTERS RELEVANT TO RECOMMENDATION 4.1 In selecting audit topics, a full evaluation of the council’s resource inputs to the activities directed by the MIJB has been undertaken, with consideration given to: • materiality (based on expenditure or income) • consultation with senior management for areas of work where it was considered internal audit could make a contribution through its work programme • time elapsed since an area was last subject to a review • overall audit assessment of the control environment 4.2 The following areas are considered for inclusion within the 2023/24 Audit Plan:- • Commissioning Services - Review the arrangements for the commissioning of services for children to ensure these are designed and delivered to meet the specified needs and demonstrate best value. • Disabled Parking System - Review the system for administering the disabled parking permits, also known as Blue Badges. • Occupational Therapy Services – Stores - A review of the Occupational Services Stores Systems to ensure appropriate accounting systems are followed. 4.3 The impact of the pandemic has resulted in changes in the working practices of services with officers working from home. The Internal Audit Section has adapted, and greater use has been made of electronic methods of communication. However, sometimes this has proved challenging and has slowed the pace of audits. Committee should therefore be aware of possible delays in progressing and completing audit reviews. 4.4 The Public Sector Internal Audit Standards require the Chief Internal Auditor to consider whether or not the audit staffing resources are sufficient to meet the audit needs of the organisation and where it is believed that the level of resources may impact adversely on the provision of the annual internal audit opinion draw this to the attention of the Committee. In recent years there have been increased demands on the Internal Audit Section to ensure we meet the Page 50
Page 51
requirements of the service by attendance on various working groups, consultation on specific issues of concern, and ensuring sufficient coverage to provide an annual audit opinion. As the Chief Internal Auditor of the MIJB, I am of the opinion these demands will increase, and I am therefore concerned that the available resource will be sufficient to meet these needs. 4.5 In considering the audit coverage, the Audit, Performance and Risk Committee should be aware that the responsibility for developing and maintaining a sound control environment rests with management and not with Internal Audit. Similarly, it will be recognised that Internal Audit is not the only scrutiny activity within the MIJB, with services challenged through other mechanisms, including external audit and inspection and separate reporting on clinical and care governance. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) and Moray Integration Joint Board Strategic Plan “Partners in Care 2022-2032” Internal audit work supports good governance and assists in securing appropriate systems of internal control. (b) Policy and Legal The internal audit service is provided in terms of paragraph 7:1 of the Local Authority Accounts (Scotland) Regulations 2014, and there is a requirement to provide a service in accordance with published Public Sector Internal Audit Standards. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications and Mitigation Audit reports highlight risk implications and contain recommendations for management to address as a means of mitigating. (e) Staffing Implications No implications directly arising from this report (f) Property No implications. Page 51
Page 52
(g) Equalities/ Socio Economic Impacts Not required as there is no change to policy. (h) Climate Change and Biodiversity Impacts None directly arising from this report. (i) Directions None arising directly from this report. (j) Consultations There have been no direct consultations during the preparation of this report. 6. CONCLUSION 6.1 The Committee is asked to consider and agree the planned audit coverage for the MIJB for 2023/24. Author of Report: Dafydd Lewis, Chief Internal Auditor Background Papers: Audit working papers Ref: MIJB/APRC/300323 Page 52
Page 53
REPORT TO: MORAY INTEGRATION JOINT BOARD AUDIT, PERFORMANCE AND RISK COMMITTEE ON 30 MARCH 2023 SUBJECT: STRATEGIC RISK REGISTER – MARCH 2023 BY: CHIEF OFFICER 1. REASON FOR REPORT 1.1 To provide an overview of the current strategic risks, along with a summary of actions which are in place to mitigate those risks, updated March 2023. 2. RECOMMENDATION 2.1 It is recommended that the Audit, Performance and Risk Committee agree to: i) consider and note the updated Strategic Risk Register included in APPENDIX 1; and ii) note the Strategic Risk Register will be further refined to align with the transformation and redesign plans as they evolve 3. BACKGROUND 3.1 The strategic risk register is reviewed regularly by the Senior Management Team as part of a robust risk monitoring framework, to identify, assess and prioritise risks related to the delivery of services in relation to delegated functions, particularly any which are likely to affect the delivery of the Strategic Plan. 3.2 The Moray Integration Joint Board (MIJB) Strategic Risk Register is attached to this report at APPENDIX 1 and sets out the inherent risks being faced by the MIJB, together with a current assessment on the level of the risks and mitigating actions being taken to reduce the impact of the risks. This report is presented to Audit, Performance and Risk Committee for their oversight and comment. 3.3 Risk scores are weighted, based on assessment according to their likelihood and corresponding impact, as per Section 5 of the MIJB Risk Policy. Item 7. Page 53
Page 54
3.4 The Strategic Risks received an initial review to ensure they align to the Partners in Care 2022-2032 strategic plan which was agreed at MIJB on 24 November 2022 (para 14 of the minute refers). 4. KEY MATTERS RELEVANT TO RECOMMENDATION 4.1 The Risk Management Framework review was completed and outcome was approved by the Board on 25 June 2020 (para 9 of the minute refers). The approved Risk Appetite Statements have been included in APPENDIX 1. 4.2 The return to ‘business as usual’ from the Covid-19 pandemic continues. However, there has not been any relief in the system, and it continues to challenge an already pressured system. 4.3 The senior leadership teams continually consider the appetite for risk whilst planning and effecting transformational change and redesign, despite operating within a very finite budget. 4.4 Work continues across teams to ensure the Risk Register is updated in the timescales dictated by the criteria. Work continues to support teams with this. 4.5 Governance, adverse events and risk will be covered as part of a Clinical Governance workstream in upcoming workshops, commenced January 2023. 4.6 The continued safe delivery of services is a priority and as such, dedicated management time is being directed to support oversight of operational risks. The Grampian Operational Escalation System (GOPES) continues to be utilised to assist in the identification of pressure points across the whole system so that they can be addressed and prioritised appropriately. These principals continue to be revisited across the system in Grampian. 4.7 Recruitment and retention continues to provide challenges across all disciplines. The Moray Health and Social Care Workforce Plan was approved by MIJB on 29 Sep 2022 (para 12 of the minute refers). Over the next three years, the workforce plan will focus on the five key areas known as ‘pillars’; they include, Plan, Attract, Train, Employ and Nurture staff. A report discussing the challenges and plans of Recruitment and Retention was presented to MIJB on 26 January 2023 (para 13 of the minute refers). 4.8 As part of the ongoing work to ensure all patients are treated in ‘the right place, at the right time’, HSCM Senior Clinical Leads led two days of audit across Moray. The findings will be used to further develop plans across HSCM. 4.9 The possibility of planned power outages were raised by SSEN. Civil contingency groups are discussing options and reviewing Business Continuity Plans to ensure planning is underway. Additional support has also been funded by HSCM to assist Primary Care Contractors with planning. 4.10 There continues to be significant financial risk in the system. The 2021-22 audited financial accounts were signed off by MIJB 26 January 2023 (para 7 of the minute refers). It was noted that the full impact of the clawback of the Covid reserve is not yet quantifiable. A full update is scheduled to be Page 54
Page 55
presented in the Interim Chief Financial Officer’s report to MIJB in March 2023. 4.11 There continues a significant number of hours per week of unmet need for care at home, with little change in these figures this year. There is an urgent need to increase supply to support the Health and Social Care system. Regular meetings and action plans continue to take place to support teams. 4.12 As plans evolve, the Strategic Risk Register will continue to be updated to ensure that it reflects any potential risks to realise the vision set out in our Strategic Plan. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) and Moray Integration Joint Board Strategic Plan “Partners in Care 2022-2032” The MIJB requires effective governance arrangements for those services and functions delegated to it and Risk Management systems are integral to this. (b) Policy and Legal As set out in the terms of reference, the Board has responsibility to provide assurance of the adequacy of the risk management framework. There are no legal implications arising from this report. (c) Financial implications There are no direct financial implications arising from this report however the Board should note the failure to manage risks effectively could have a financial impact for the MIJB. (d) Risk Implications and Mitigation This report forms part of the governance arrangements for identifying and managing strategic risks of the MIJB. The risks are outlined in the body of the report in section 4. (e) Staffing Implications There are no additional staffing implications arising from this report. (f) Property There are no property implications arising from this report. (g) Equalities/Socio Economic Impact An Equalities Impact Assessment is not required because there are no service, policy or organisational changes being proposed. (h) Climate Change and Biodiversity Impacts There are no impacts arising from this report. (i) Directions None arising from this report. (j) Consultations Page 55
Page 56
Consultation on this report has taken place with the Senior Management Team and presented to Clinical and Care Governance Group. 6. CONCLUSION 6.1 This report and appendices contains proposed risk appetite statements that, when approved, will underpin the MIJB approach to strategic decision making. 6.2 The report outlines the current position and recommends the Committee note the revised and updated version of the Strategic Risk Register. Author of Report: Sonya Duncan, Corporate Manager Background Papers: held by HSCM Ref: Page 56
Page 57
Appendix 1 HEALTH AND SOCIAL CARE MORAY STRATEGIC RISK REGISTER AS AT MARCH 2023 Item 7. Page 57
Page 58
Appendix 1 RISK SUMMARY 1. The Moray Integration Joint Board (MIJB) does not function as set out within the Integration Scheme, Strategic Plan and in-line with Standing Orders and fails to deliver its objectives or expected outcomes. 2. There is a risk of MIJB financial failure in that the demand for services outstripping available financial resources. Financial pressures being experienced by the funding Partners will directly impact on decision making and prioritisation of MIJB. 3. Inability to recruit and retain qualified and experienced staff to provide safe care whilst ensuring staff are fully able to manage changes resulting from integration. 4. Inability to demonstrate effective governance and effective communication and engagement with stakeholders. 5. Inability to cope with unforeseen external emergencies or incidents as a result of inadequate emergency and resilience planning. 6. Risk to MIJB decisions resulting in litigation/judicial review. Expectations from external inspections are not met. 7. Inability to achieve progress in relation to national Health and Wellbeing Outcomes. Performance falls below acceptable level. 8. Inability to progress with delivery of Strategic Objectives and Transformation projects as a result of inability to resolve data sharing and data security requirements. 9. Requirements for support services are not prioritised by NHS Grampian and Moray Council. RISK RATING LOW MEDIUM HIGH VERY HIGH RISK MOVEMENT DECREASE NO CHANGE INCREASE The process for managing risk is documented out with the MIJB Risk Policy. Page 58
Page 59
Appendix 1 Description of Risk: Regulatory The Integration Joint Board (IJB) does not function as set out within the Integration Scheme, Strategic Plan and Scheme of Administration and fails to deliver its objectives or expected outcomes. Lead: Chief Officer Risk Rating: Low/ medium/ high/ very high MEDIUM Risk Movement: Increase/ decrease/ no change NO CHANGE Rationale for Risk Rating: The strategic plan “Partners in Care 2019-2029” was revised and presented as “Partners in Care 2022 to 2032”, this was approved by MIJB in November 2022. Membership of IJB committees recently changed due to the elections in May. An amendment to the Scheme to increase membership by one from each of the partner organisations was ratified in March 2022 by the Scottish Government following due process and approval by Moray Council and NHS Grampian Board. During the initial Covid 19 response, normal business was suspended and emergency arrangements were implemented. IJB, CCG and APR meetings restarted during August 2020. Weekly meetings were instigated with Chair/Vice Chair and Chief Officer and these continue. A delivery plan for the new Strategic Plan “Partners in Care” 2022-32 will be presented Spring 2023. Rationale for Risk Appetite: The Board, staff and providers across Moray are all committed to ensuring high standards of clinical care & governance through operational policies. Innovation and new ways of working may mean traditional regulations do not exist, or are contradictory. We will only take regulatory risks knowingly, following consultation with the relevant regulatory body and where we have clear risk mitigation in place. Controls: • Integration Scheme. • Strategic Plan “Partners in Care” 2022-32 • Governance arrangements formally documented and approved by MIJB January 2021. • Agreed risk appetite statement. • Performance reporting mechanisms. • Consultation with legal representative for all reports to committees and attendance at committee for key reports. • Standing orders have been reissued to all members Mitigating Actions: Induction sessions were held for new IJB members after May elections. Further sessions will be arranged for recent appointees. IJB member briefings are held regularly as development sessions. 1 Page 59
Page 60
Appendix 1 Conduct and Standards training held for IJB Members in June 2022 provided by Legal Services. SMT regular meetings and directing managers and teams to focus on priorities. Regular development sessions held with IJB and System Leadership Group Strategic Plan and locality management structure is in place. The work that has been progressed through the Covid19 response has escalated developments in some areas as a matter of priority. This has been achieved through collaborative working with partner organisations and the third sector. Assurances: • Audit, Performance and Risk Committee oversight and scrutiny. • Internal Audit function and Reporting • Reporting to Board. • The Moray Transformation Board has recently recommenced and will support an oversight of planned business across HSCM. Gaps in assurance: The new strategic delivery plan and will incorporate the work being taken forward for Self-Directed support, Hospital at Home and Locality Planning. Current performance: The Scheme of Administration is reported when any changes are required. Legal advisors are currently working on the requirements to the integration scheme in relation to the proposed The integrated scheme of delegation of Children’s and Families and Justice Services was presented and accepted by MIJB on 26th January 2023. The Governance Framework was approved by IJB 28 January 2021. Re-appointment of Standards Officer agreed by IJB 31 March 2022. Members Handbook has been updated and circulated to all members in June 2022. Comments: Strategic Planning and Commissioning Group approved the generic Terms of Reference and Chairs of the transformation boards at the meeting on 19 December 2019. These groups have now recently recommenced following the pause during the Covid19 response. The Interim Strategy and Planning Lead is now taking this forward and prioritising and focusing on strategic planning and priorities over the short and longer term. Page 60
Page 61
Appendix 1 2 Description of Risk: Financial There is a risk of MIJB financial failure in that the demand for services outstrips available financial resources. Financial pressures being experienced both by the funding Partners and Community Planning Partners will directly impact on decision making and prioritisation of MIJB. Lead: Chief Officer/Chief Financial Officer Risk Rating: Low/ medium/ high/ very high VERY HIGH Risk Movement: Increase/ decrease/ no change INCREASING Rationale for Risk Rating: Whilst the 2020/21 to 2022/23 settlement saw additional investment for health and social care that was passed through to the MIJB, there remains a significant pressure due to the recurring core overspend, since most of the new investment related to new commitments. Financial settlements are set to continue on a one year only basis, which does not support sound financial planning. In addition, many uncertainties have arisen relating to the carried forward ear marked reserves with the clawback of the Covid reserve and reduction of the PSIF funding in 2022/23 as well as other funding being looked at. The full impact is not yet quantifiable. The Revenue Budget 2022/23 was approved by MIJB on 31 March 2022 as a balanced budget. A small savings plan of £0.11 million was approved and achieved. Additional Scottish Government investment was provided again for 2022/23, this is to meet additional policy commitments in respect of adult social care pay uplift for externally provided services and seeks to ensure that capacity can be maximised and ensuring system flow. The update medium Term Financial Framework was presented as part of the budget papers on the 31st March 2022 however, it is imperative that this is further reviewed during the 2022/23 year to ensure alignment with the upcoming revisions to the Strategic Plan and is planned to be presented to MIJB on 30 March 2023. Rationale for Risk Appetite: The Board recognises the financial constraints all partners are working within. While we are cautious and open about accepting financial risks this will be done: • Where a clear business case or rationale exists for exposing ourselves to the financial risk • Where we can protect the long term sustainability of health & social care in Moray The Covid-19 recovery continues to place risk on the MIJB finances as we continue through the, recover and transform stages. Whilst we are now officially in the recovery phase there has been no change in the pressures felt by the system.. Controls: There is an interim arrangement for CFO cover from Moray Council. Permanent recruitment efforts have not been successful. The Chief Officer is working with both the Council and NHS Finance Leads to secure a longer term interim arrangement. Page 61
Page 62
Appendix 1 The CFO and Senior Management Team have worked together to address further savings which will be presented to the Board for approval as part of the budget setting procedures for 2022/23. This should be a focus of continuous review to ensure any investment is made taking cognisance of existing budget pressures. A revised Financial Framework was presented to the MIJB on 31 March 2022, and a further review will take place once the current strategic plan has been reviewed to assure alignment. The Senior Management Team met in February 2023 to consider and plan for the financial challenges for 2023/24. Mitigating Actions: Risk remains of the challenge that the MIJB can deliver transformation and efficiencies at the pace required whilst dealing with the pressures that are emerging as a result of the pandemic. Financial information is reported regularly to both the MIJB, Senior Management Team and System Leadership Group. The Chief Officer and Chief Financial Officer (CFO) continue to engage in finance discussions with key personnel of both NHS Grampian and Moray Council. These conversations have continued throughout the pandemic phase. Chief Officer and CFO will continue to engage with the partner organisations in respect of the financial position throughout the year. Cross partnership performance meetings are in with partner CEOs, Finance Directors and the Chair/Vice Chair of the MIJB. Assurances: MIJB oversight and scrutiny of budget. Reporting through MIJB, NHS Grampian Board and Moray Council. Gaps in assurance: None known Current performance: An overspend of £1,454,162 was reported to the IJB at 30 Sept 2022. The Scottish Government have announced their intention to reclaim surplus Covid reserves, £6,239,000 is due to be clawed back in 2023. Comments: Senior managers continue to work with Chief Officer and Chief Financial Officer to address the continuing financial challenge, continuing to seek efficiencies and opportunities for real transformation as we look to make efficient and effective investment in services that are truly transformational. There are additional pressures from the cost of living crisis, increasing energy bills, inflation and the potential for staff industrial action. Page 62
Page 63
Appendix 1 3 Description of Risk: Human Resources (People): Inability to recruit and retain qualified and experienced staff to provide and maintain sustainable, safe care, whilst ensuring staff are fully able to manage change resulting from response to external factors such as the impact of Covid and the actions that arose from the recommendations from the Independent Review of Adult Social Care 2021. Lead: Chief Officer Risk Rating: Low/ medium/ high/ very high HIGH Risk Movement: Increase/ decrease/ no change NO CHANGE Rationale for Risk Rating: There continues to be issues with recruitment to front line services that require specific skills and experience. This has been the case for some time now and continues to place pressure on existing staff. Allied Health Professions, Social Work and Nursing are some of the particular areas experiencing difficulties with obtaining people with the appropriate skills and training. Care at Home staffing levels are pressured for Internal services and externally with local providers all experiencing the same difficulties. There are also impacts on recruitment of Dentists and other graduates arising from Covid as the number graduating has reduced during the period. The various impacts of Covid-19 has placed a significant strain on the Partnerships resources across frontline and support functions and this has resulted in delays for the progress of projects relating to the achievement of strategic objectives. HSCM is currently has approximately 70 fixed term or seconded posts which can create long term instability for teams. This is being reviewed by the Senior Management Team. The Care Homes in Moray also face difficulties with recruitment and retention of staff to care at home roles in particular is still being experienced. Efforts are being made to provide support but the situation remains challenging. The transition from EU membership has not presented any specific concerns for workforce and this will continue to be monitored. The impact of forthcoming budget allocations and the withdrawal of all Covid funding will also mean that HSCM will face some challenging decisions in 2023. The impact of budgetary decisions by the Council in relation to reducing staffing levels has reduced levels of support provided in some key areas for Health and Social Care Moray (HSCM), such as ICT, HR, Legal and design. The lack of suitable housing for Health and Social Care staff has resulted in people not being able to take up posts in Moray. Rationale for Risk Appetite: Safety risks that could result in harm to service users, staff or the public are inherent in Health & Social Care services. The safety of individuals is paramount therefore standards of safety management and clinical care have to be high, and the Board will continue to seek assurances this is the case. Page 63
Page 64
Appendix 1 The Board’s ambition is for health & social care to be people centred. This means supporting people in decision making about their own health & care, which may expose individuals to higher risk where they make an informed decision. The Board will also seek to balance individual safety risks with collective safety risks to the community. Controls: Management structure in place with updates reported to the MIJB. Organisational Development plan in place and Workforce Plans are being updated to align to the new strategic plan. Continued activity to address specific recruitment and retention issues. Management competencies continue to be developed through Kings Fund training although this was suspended due to Covid19. Communications & Engagement Strategy was approved in November 2019 and continues. Council and NHS performance systems in operation with HSCM reporting being further developed and information relating to vacancies, turnover and staff absences is integral to this. Managers are highlighting any areas of concern and where appropriate this is identified in operational risk registers. HSCM services have commenced weekly reporting of workforce sit reps for Senior Management Team oversight highlighting vacancies, annual leave, sickness absence and Covid impacts so that issues can be identified and assessed quickly. Moray Council are carrying out a study of accommodation needs, including people working in the Health and Care sector. Mitigating Actions: System re-design and transformation. Organisational Development Plan and Workforce plan were updated and approved by MIJB in November 2019. The updated Workforce plan has been submitted to Scottish Government and comments were received by the HSCP in October 2022. These are currently being worked through. These plans are core documents for the Workforce Forum which has recently re-commenced following a temporary suspension during the first quarter of this year due to Covid impact. Staff Wellbeing is a key focus and there are many initiatives being made available to all staff including training, support, information and access to activities. Locality Managers are developing the Multi-disciplinary teams in their areas and some project officer support has been provided to develop the locality planning model across Moray. Lead Managers are involved in regional and national initiatives to ensure all learning is adopted to improve this position. Lead Managers and Professional Leads are linked to University Planning for intakes and programmes for future workforce development. Page 64
Page 65
Appendix 1 Assurances: Operational oversight by Moray Workforce Forum has resumed and will report to MIJB in accordance with the agreed Governance framework. The HSCM Response Group was in place over the whole period of the Covid19 pandemic providing focussed leadership around emerging issues and resolving them. This group stood up again in April and is meeting daily whilst the system is pressured, this will be reviewed as the situation evolves. The Heads of Service are co-ordinating and escalate to SMT where necessary. These meetings have been increased as service needs dictate. Gaps in assurance: Further work required to develop workforce plans to reflect strategic plan implementation programmes.. Current performance: The IMatter survey results for 2022 were received by managers for review and action plans. Preparatory work is commencing on the action plans for iMatter 2023. Discussions are underway with HR in both Council and NHS to develop access to appropriate HR information at a summarised level to facilitate the necessary workforce planning and subsequent monitoring of plans. There continues to be a need for more streamlining in recruitment processes as the delay in approval to recruit to having a member of staff available is in excess of 8 weeks. There is also a lack of suitable applicants for various posts which is impacting on ability to appoint for some roles. Comments: Staffing issues are owned by the Systems Leadership Group who will work collaboratively across the system to seek opportunities to make jobs more attractive where it has proved difficult to recruit in the past. For some professions there is a potential risk that staff move from one position to a new position within HSCM will just move the vacancy to elsewhere in the system, so Senior Management Team are aware of this risk and taking it into account in considerations for vacancies. This needs to be considered when fixed term contracts and secondments are planned, consideration needs to be given to the whole of HSCM and not services in isolation. Many of our staff may have transferrable skills and experience. The continuing system issues and lack of available beds may mean operations cannot be scheduled to reduce the backlog and key staff may not have the necessary time in surgery to maintain essential skills. This in turn may add to the staff retention issues within certain specialties. Page 65
Page 66
Appendix 1 4 Description of Risk: Reputation: Inability to demonstrate effective governance and effective communication and engagement with stakeholders. Lead: Chief Officer Risk Rating: low/medium/high/very high MEDIUM Risk Movement: increase/decrease/no change NO CHANGE Rationale for Risk Rating: Locality planning assessed as medium in relation to ability to work at the pace required and current workforce capacity. Performance framework to be further developed from a planning perspective to show the links through operational service delivery to strategic objectives. Recent engagement with individuals representing their communities or third sector organisations in a variety of forums is highlighting that problems with their capacity to fulfil our needs so more co-ordination and clearer focus is required to ensure that the communication, engagement and outcomes are meeting identified needs. Rationale for Risk Appetite: The Board is cautious but open about risks that could damage relationships with different stakeholders. It recognises many of our aspirations depend on effective collaboration, coproduction and partnership working with a range of stakeholders. The appetite also recognises that while the aspiration is to be a co-operative partner, some partners will not be able to move at the same pace as us all the time. We will seek to protect relationships in the long term and will not set out to antagonise stakeholders deliberately. For example, we must not be seen to exclude or prevent participation in the design of services where there is an appetite to do this. We must be mindful that repairing relationships is easier when there is already a well of goodwill to draw on, and that further damage to an already damaged relationship will not be conducive to good long term outcomes. Controls: Governance Framework approved by IJB January 2021 Communication and Engagement Strategy approved November 2019 Annual Governance statement produced as part of the Annual Accounts 2021/22 and submitted to External Audit. Annual Performance Report for 2021/22 was published in November 2022. Performance reporting mechanisms in place and being further developed through performance support team, home first group and system leadership team. Page 66
Page 67
Appendix 1 Community engagement in place for key projects areas such as Forres, Keith and Lossiemouth with information being made available to stakeholders and the wider public via HSCM website. Participation of stakeholders in a variety of meetings such as Home First project, carer strategy, Strategic, Planning and Commissioning groups. Mitigating Actions: Schedule of Committee meetings and development days in place and implemented. Good working relationship established with Audit Scotland, the MIJB’s appointed external auditors since 2016/17. Discussions at leadership meetings to ensure all standards are being met around Public Sector Equality Duty and published where appropriate. There is a new programme of training to ensure all policies are Equalities Impact Assessed and the findings are published. Annual Performance Report for 2022/23 will be published in July 2023 after being presented to the IJB in June 2023. Social media is actively used as a method of engaging with the public, with short videos focussing on particular services being trialled. SMT have considered the existing arrangements for engagement with stakeholders and work is being undertaken to align our framework with the Scottish Government “Planning with people guidance” and ensure that mechanisms are in place across services to evidence and evaluate their impact. Assurances: Oversight and scrutiny by Clinical and Care Governance Committee, Audit Performance and Risk Committee and MIJB. Summary reports of minutes of MIJB meetings are submitted to Council committee and NHS Board. Gaps in assurance: Progress on implementation of the Communication and Engagement Strategy has been impacted by the Covid 19. Due to the impact of COVID and requirement for social distancing the normal mechanism for engagement were not all available. More use is being made of social media and Microsoft teams and other options and methods for engagement with staff are being used via NHSG such as videos on YouTube and one question surveys. Going forward there may be more opportunity for face to face meetings to take place again but it should be considered that this will not be beneficial for all. It is anticipated that once a Communication and Engagement Officer and supporting role are recruited.that this work stream will rapidly restart as a priority. Current performance: Communications Strategy was reviewed approved by IJB November 2019. Annual Performance Report 2021/22 published November 2022. Audited Accounts for 2021/22 were audited and approved in January 2023 and will be published in February 2023. Due to Covid19 there have been increased levels of briefings to staff, the public and Chair/Vice Chair of MIJB with a focus on the key elements of the response. Page 67
Page 68
Appendix 1 Comments: A communication cell was established as part of the Local Resilience Partnership Covid and storms response with representation from Councils, HSCP and NHSG. This was led by Aberdeen City Council and was an example of the collaborative working that took place. This forum provides assurance that messages to all stakeholders are consistent. There has been representation from the Home first project at the Wellbeing forum to facilitate sharing of information and seeking views. Page 68
Page 69
Appendix 1 5 Description of Risk: Environmental: Inability to cope with unforeseen external emergencies or incidents as a result of inadequate emergency and resilience planning. Lead: Chief Officer Risk Rating: low/medium/high/very high HIGH Risk Movement: increase/decrease/no change NO CHANGE Rationale for Risk Rating: Due to the response requirements for Covid 19 progress has been made in a number of areas. SMOC information is updated, control room guidance updated and expanded, control centre protocols were implemented and remain in place and management teams have responded in an agile, responsive and collaborative way under very challenging conditions. Teams continue to do their best but there are areas where they still feeling overwhelmed and service delivery is challenging. With effect from March 2021 MIJB is defined as a Category 1 responder under the Civil Contingencies (Scotland) Act and there are additional requirements for preparedness that is being taken forward in partnership with NHSG and Moray Council emergency planners. Rationale for Risk Appetite: The MIJB understand the requirement to meet the statutory obligations set out within the Civil Contingencies Act and the Category 1 status applied in March 2021, and work with partner organisations to meet these obligations. Controls: Winter Preparedness Plan was updated (but not tested as in previous years) alongside NHSG plans as NHSG implemented their crisis management framework which required participation of partners at Daily connect meetings to discuss and prioritise resource to address issues with system flow. HSCM Civil Contingencies group established and meeting regularly to address priority subjects. NHS Grampian Resilience Standards Action Plan approved (3 year). Business Continuity Plans in place for some services although overdue a review in some areas. Knowledge of critical functions and ability to respond quickly and effectively has been in evidence during incidents such as Gas outages in Keith (January and February 2021) and Covid response, Storms (Arwen, Malik and Corrie) – debriefs carried out and learning identified. A Resilience Newsletter started in December 2022 to ensure all staff receive some personal resilience information together with resources for teams to plan. Regular updates to SMT and SLG regarding potential power outages across the country. Additional sessions delivered to Primary Care Contractors to assist with their Business Continuity Planning around power outages. Regular system wide meetings to discuss potential Industrial Action implications and service planning. Page 69
Page 70
Appendix 1 A review of the Festive season arrangements has commenced and will conclude in March 2023. Mitigating Actions: Information from the updated BIA/BCP informed elements of the Winter Preparedness Plan A Friday huddle is in place which gathers the status of services across the whole system to provide information and contact details to the Senior Manager on Call (SMOC) over the weekend. If any potential issues are highlighted the relevant Persons at Risk Data is compiled and if appropriate, shared with relevant personnel. NHSG have introduced system wide daily huddles to manage the flow and allocation of resources which require attendance from Dr Grays and HSCM. Practitioner group established for Moray with representation from HSCM, Dr Grays, Moray Council and NHSG to discuss matters arising from the Local Resilience Forum and within our respective organisations. In addition it will provide a forum for discussion of the linkages between organisational response plans to ensure there are no gaps or over reliance on particular local resources. HSCM continues to monitor the local situation regarding impacts on staffing and is engaged with NHSG emergency planning arrangements and Council Response and Recovery management team to be ready to escalate response if required. Work was undertaken within NHSG, Aberdeenshire HSCP and Aberdeen City HSCP to look at Surge flows and establish a mechanism that will provide easy identification of “hot spots” across the whole system in Grampian, to facilitate a collaborative approach to addressing the issues through the use of a common Operational Pressure Escalation approach. This work could underpin surge responses in winter and at other times of pressure and having a standard approach across Grampian could aid communication and understanding. Assurances: Audit, Performance and Risk Committee and NHS Grampian Civil Contingencies Group oversight and scrutiny. HSCM Civil Contingencies group review specific risks and action plans to mitigate, developing plans and testing arrangements in partnership with NHSG and Council Gaps in assurance: Moray Integrated Joint Board (MIJB) was designated as a Category 1 responder under the Civil Contingencies Act 2004 from March 18th 2021. That designation imposed a number of statutory duties in terms of the Act and the associated Scottish Regulations1. MIJB has no dedicated, specialist in post and is reliant on the Corporate Manager covering this increasingly demanding role in addition to other duties without the necessary background, knowledge, skills and experience. This presents a potential organisational risk in terms of compliance, and our ability to provide assurance on discharging our civil contingency arrangements. This has been highlighted to the Chief Officer and IJB. 1 Civil Contingencies Act 2004 (Contingency Planning) (Scotland) Regulations 2005 Page 70
Page 71
Appendix 1 The debriefs from the storms in 2021/22 have identified lessons learnt for Grampian Local Resilience Partnership and more locally for the response co-ordination within Moray. Action plans are being developed in collaboration with Moray Council’s emergency planning officer to address the issues identified. The main issues related to developing wider awareness of roles and responsibilities, and improving general awareness of response structures and meeting protocols. This will be incorporated into training schedules going forward. It has also highlighted the need for a robust arrangement for out of hours contact and clarity of roles and responsibilities across the system which is being discussed at SMT. Option Appraisal discussions have commenced. Progress has been made however further work is required to address the targets in the implementation plan that have not been met and the Resilience standards as identified by the NHSG Civil Contingencies Group. Due on ongoing system pressures and staff vacancies the draft strategy document ‘Care for People’ document has been presented to HSCM SMT for comment and will also be presented to CMT and then MIJB. It is anticipated this will be completed by end March 2023. A draft operational response plan has been drawn up and will also be presented for approval shortly after. The intention is to hold a table top exercise with managers from HSCM and Moray Council to test the invocation arrangements to ensure common understanding of roles and responsibilities. Table top style exercises are currently being arranged with some of those services who have submitted their finalised Business Continuity plans for February 2023. Current performance: The Senior Management Team participated in Strategic Leadership in a Crisis training in 2020 and a programme of further training for the wider management team is scheduled. A follow up session was held in September 2022. Many services have business continuity arrangements and some are overdue for an update. Work has progressed in identification of a critical functions list for agreement by System Leadership Group that will inform planning arrangements going forward. There will need to be changes made to business continuity plans following the implementation of additional ICT resources in services which have provided a greater deal of resilience for some services and functions – albeit reliant on electricity supply. A schedule of review and exercising of business impact assessments and plans has been scheduled for this year across services. All services have been requested to prioritise their Business Continuity planning with a particular lens on power outages. Annual report on progress against NHS resilience standards will be presented to the APR committee on 30 March 2023. Report on the implications of the designation as a Category 1 responder was presented to MIJB 25 November 2021. Page 71
Page 72
Appendix 1 Work is currently underway to plan for possible National Power Outages across the UK. This is being co-ordinated across Grampian to ensure all Partners are involved. It is also planned to provide additional resource to ensure our Primary Care partners are informed and engaged in the process. Comments: The requirements of a Category 1 Responder continue to increase in demand placing increased pressures across already overstretched services and managers. MIJB does not have a subject matter expert leading on these topics. Page 72
Page 73
Appendix 1 6 Description of Risk: Regulatory Risk to MIJB decisions resulting in litigation/judicial review. Expectations from external inspections are not met. Lead: Chief Officer Risk Rating: low/medium/high/very high MEDIUM Risk Movement: increase/decrease/no change NO CHANGE Rationale for Risk Rating: Considered medium risk due to the impact of Covid-19 and resultant efforts required to remobilise services and/or the increase in workloads stretching a workforce that has been under sustained pressure for a considerable time. The ongoing impact of the Covid 19 pandemic is stretching resources to deliver care in the community across all providers (internal and external) so there is a potential increased risk of expected standards not being achieved despite the best efforts of all concerned. Rationale for Risk Appetite: The Board, staff and providers across Moray are all committed to ensuring high standards of clinical care & governance through operational policies. Innovation and new ways of working may mean traditional regulations do not exist and require to be developed, no longer apply, or are contradictory. We will only take regulatory risks knowingly, following consultation with the relevant regulatory body and where we have clear risk mitigation in place. Controls: Clinical and Care Governance (CCG) Committee established and future reporting requirements identified Clinical Risk Management and Practice Governance group has oversight of their respective professional standards and feed into Clinical and Care Governance Group, which then escalates to CCG Committee as necessary. High and Very High operational risks are reviewed by System Leadership Group monthly and a review of all risks will be undertaken as part of the risk management framework. Workshops took place in January and February 2023, ‘A conversation about Clinical Governance’. This will be followed by 2 more workshops in 2023. Complaints and compliments procedures in place and monitored. Clinical incidents and risks are being reviewed on a weekly basis to ensure processes are followed appropriately and consistently and responses are recorded in a timely manner. Adverse events and duty of candour procedures in place and being actioned where appropriate and summary reports submitted to CCG committee. Page 73
Page 74
Appendix 1 Reports from external inspections reported to appropriate operational groups and by exception to SMT for subsequent reporting to CCG or Audit Performance and Risk Committee as appropriate, albeit there has been a reduction in some areas of external inspection reporting during the Covid period due to social distancing restrictions Care Home Oversight Group meets to oversee and manage risks in care homes. Children and Adult Protection services are being delivered and reported to their respective committee on a regular basis. Mitigating Actions: This risk is discussed regularly by the three North East Chief Officers. Additional resource has been allocated to support the analysis of information for presentation to CCG committee All High and Very High risks are now brought before the senior management team in Moray. Process for sign off and monitoring actions arising from Internal and External audits has been agreed Assurances: Audit, Performance and Risk and Clinical and Care Governance Sub-Committees oversight and scrutiny. Governance Framework in place and operational. Gaps in assurance: Process for highlighting recurring themes or strategic expectations from external inspections requires further development to ensure Committee has sight of significant issues. Current performance: External inspection reports are reviewed and actions arising are allocated to officers for taking forward. Two Days of Audit took place across Moray on 25th and 26th January, 2023 respectively. These were led by the Clinical Service Leads. An update on this will be provided to MIJB on 30th March 2023, with a report going to the Clinical and Care Governance Group in due course. A summary of inspections is included in the Annual Performance report. The level is marked as an increasing risk on the basis that services are under pressure with the issues with staffing capacity and the need to focus on delivery of critical functions which may mean external inspection are not the priority at this moment in time. The Adult Support Protection inspection took place in April/May and an action plan has been developed and is now in place. Comments: No major concerns have been identified for HSCM services in any audits or inspections during 2021/22. Page 74
Page 75
Appendix 1 7 Description of Risk: Operational Continuity and Performance: Inability to achieve progress in relation to national Health and Wellbeing Outcomes. Performance of services falls below acceptable level. Lead: Chief Officer Risk Rating: low/medium/high/very high HIGH Risk Movement: increase/decrease/no change NO CHANGE Rationale for Risk Rating: Potential impacts to the wide range of services in NHS Grampian and Moray Council commissioned by the MIJB arising from reductions in available staff resources as budgetary constraints impact. Unplanned admissions and delayed discharges place additional cost and capacity burdens on the service. The level of delayed discharges has remained high, reflecting the sustained pressure in the system following the Covid -19 pandemic impact and the lack of availability of care in the community. There are sustained focussed and collective efforts by all those working in the pathway. However this is a complex area and will require continued effort to realise reductions and maintain them. Rationale for Risk Appetite: The Board is cautious but open about risks that could affect outcomes that are priorities for people in Moray. There is a slightly higher appetite to risks that may mean nationally set outcomes – that by design are not given a high priority in Moray - are not met. There is new focus on addressing positive risk taking to ensure the most appropriate and timely measure of care for the population of Moray, this is being supported through various work streams across the system. This will only be accepted where there is a clear rationale, and preferably also a way of demonstrating what the IJB is doing to meet the aspiration the outcome was created for. Controls: Performance Management reporting framework. 2022 to 2032 “Partners in Care” Strategic Plan was approved and development of delivery plan is underway. Performance is regularly reported to MIJB. Revised Scorecard being developed to align to the new strategic priorities. Best practice elements from each body brought together to mitigate risks to MIJB’s objectives and outcomes. Chief Officer and SMT managing workload pressures as part of budget process. A daily Huddle and write up circulates the picture on performance across community and acute services for the Portfolio and service managers have a shared understanding of the pressures in the system and mitigations taking place. Work continues on refinement of G-OPES (Grampian Operating Pressures and Escalation System) led by Page 75
Page 76
Appendix 1 NHSG but being developed locally to identify the triggers and resultant actions required in services to respond to pressure points. Mitigating Actions: Service managers monitor performance regularly with their teams and escalate any issues to the System Leadership Group (SLG) for further discussion to provide wider support, developing shared ownership and a greater understanding across the whole system. Key operational performance data is collated and circulated daily to all managers. A Daily dashboard is held on illuminate for managers to access to ensure any potential issues are identified quickly so action can be taken. This dashboard is being reviewed and will be further developed with the intention of further dashboards to provide a whole system overview. This has been discussed at SLG and agreed. Performance information is presented to the Performance sub group of Practice Governance Group to inform Social Care managers of the trends in service demands so that resources can be allocated appropriately. Assurances: Audit, Performance and Risk Committee oversight. Operationally managed by service managers, summary reports to Practice Governance and clinical and care governance group and to System Leadership Group. Strategic direction provided by Senior Management Team. HSCM Response Group continues to meet and reviews the key performance information and actions that are required to deliver the priority services. Gaps in assurance: Development work in performance to establish clear links to describe the changes proposed by actions identified in the Strategic Plan has recommenced but is at an early stage. This will be progressed as the revised outcomes are determined and associated KPI are identified. Progress will be reported to future Board meetings. Review of systems and processes will commence across HSCM to ensure they are fit for purpose and ensure that there are no indirect consequences of structure changes resulting in any gaps in assurance processes. Current performance: The Covid19 pandemic impacted on all areas of the service and work is underway to take the learning and experience gained during the response to collate performance information in dashboards to support mangers interpret the impact of Covid19 on their services, now and going forward. There are likely to be changes to ways of working and this may also have impact on the performance information required. Comments: Locality profile information has been provided to Locality Steering Group/Locality Manager to inform potential priorities for consideration in Localities and work will be taken forward regarding development of performance monitoring and reporting of key performance indicators in relation to Localities once it has been determined what the intended outcomes are. Locality plans will be presented to the IJB in March 2023. Page 76
Page 77
Appendix 1 The delayed discharge group has produced an action plan for implementation and progress is being made. Practice Governance have reviewed their operational performance requirements and have a comprehensive data set used to inform operational priorities. The Home First priorities are being taken forward and updates are reported to this committee or MIJB on a regular basis. Progress in this area has been hampered due to the increased demand for urgent or critical services requiring staff resource to be prioritised to frontline service delivery. The Council has procured new modules for their performance reporting system Pentana and HSCM performance team have been developing its use for reporting. Page 77
Page 78
Appendix 1 8 Description of Risk: Transformation Inability to progress with delivery of Strategic Objectives and Transformation projects. Lead: Chief Officer Risk Rating: low/medium/high/very high HIGH Risk Movement: increase/decrease/no change NO CHANGE Rationale for Risk Rating: There are many issues that will impact on the ability to progress to deliver Strategic Objectives. The Strategic Planning & Commissioning group has been refreshed and re-launched and key work is being progressed. There was an initial meeting held on 22 September 2021 to consider terms of reference and the proposed structure for oversight, prioritisation and assurance in relation to key developments, their fit with IJB strategy and enabling elements. The interim appointment of the Strategic and Planning Lead provides capacity to take this forward and to align the priorities arising nationally, Grampian-wide and locally. The remobilisation plan for HSCM services that were suspended or reduced is progressing with Providers services and social work implementing the IJB decision to return to delivery of both substantial and critical eligibility criteria. Work has progressed risk assessments are completed and assessments have been or are in the process of being reviewed to ensure equality. The impact of Covid 19 on the population of Moray is still not fully realised. It is therefore not possible to predict the extent of the impact on the ability to progress with delivery of Strategic Objectives. There are some aspects that have progressed very well such as introduction of Near Me consultations but there are others that are more difficult to progress. There is concern that due to the workloads and challenges over the last year that teams are weary and/or do not have capacity at this moment in time, to progress with delivery of development plans at this moment in time. In addition the pandemic is still present in the community so services are still responding to the impacts it has for the population of Moray. Managers are working with teams to establish “readiness” and their capacity and sense of wellbeing and the collated output will inform plans going forward. One key aspect to facilitate transformation is the need for progress in relation to ICT infrastructure, data sharing and data security across the whole system. Work was undertaken by NHS Grampian and partners to address the needs for ICT kit and information during the response to Covid. Page 78
Page 79
Appendix 1 Rationale for Risk Appetite: The Board has a high appetite for risks associated with delivery of transformational redesign. The following should be considered when accepting these risks: • We understand and can mitigate other risk types that may arise, e.g. safety or financial within appetite • Service users are consulted and informed of changes in an open & transparent way • We will monitor the outcome and change course if necessary Controls: It is recognised that there will be significant changes taking place in Social Work practice with the implementation of the Self Directed Support standards and the move to outcomes based services, so governance arrangements are being set up to facilitate the same type of oversight and communication that is in place for the Home First programme. Mitigating Actions: Integrated Infrastructure Group previously established, with ICT representation from NHSG and Moray Council, to consider and provide solutions to data sharing issues and ICT infrastructure matters which is an area that will be taken forward alongside the Moray Growth Deal projects. The Moray Transformation Board has recently restarted and will link to all relevant groups. Assurances: Strict ICT and data sharing policies and protocols in place with NHS Grampian and Moray Council. Gaps in assurance: Transformation/implementation planning is in development and will inform outcomes and performance reporting on the delivery of the strategic plan. Protocol for access to systems by employees of partner bodies are in place. Information Management arrangements to be developed and endorsed by MIJB. Process of identification of issue and submission to data sharing group requires to be reinforced to ensure matters are progressed. The strict information sharing protocols can cause issues when trying to work across system in an open and transparent way. Smarter Working programmes are being progressed in partnership with Council and NHSG. Current performance: Training programme to be developed on records management, data protection and related issues for staff working across and between partners. Comments: Where national systems are involved it may not be possible to identify a solution however the issues will be able to be raised at the appropriate level via the Grampian Data Sharing Group where all three partnerships are represented. Page 79
Page 80
Appendix 1 9 Description of Risk: Infrastructure Requirements for support services are not prioritised by NHS Grampian and Moray Council. Lead: Chief Officer Risk Rating: low/medium/high/very high HIGH Risk Movement: increase/decrease/no change NO CHANGE Rationale for Risk Rating: Changes to processes and necessary stakeholder buy-in still bedding in. Moray Council is undertaking a Property review of office and depot accommodation and the potential impact for HSCM services requires consideration. The output was anticipated in October 2019 however due to changes with roles and responsibilities within the Council however the paper has been out for consultation. NHSG have advised that staff should continue to work from home at present whilst policies and protocols are developed. Moray Council have a dedicated MC officer leading on a hybrid working plan with input from HSCM on their requirements. It is anticipated that this will conclude end 2023. ICT infrastructure service plans in NHS Grampian and Moray Council are not yet visible to HSCM and development of communication and engagement process is required. The impact of Covid has resulted in a change in ICT strategy for Moray Council. Council employed staff requiring mobile technology have now been provided with it and some staff are still working from home. Rationale for Risk Appetite: Low tolerance in relation to not meeting requirements. Controls: Chief Officer has regular meetings with partners Computer Use Policies and HR policies in place for NHS and Moray Council and staff. PSN accreditation secured by Moray Council Infrastructure Programme Board was established with Chief Officer as Senior Responsible Officer/Chief Officer member of CMT. Process for submission of projects to the infrastructure board approved and implemented to ensure appropriate oversight of all projects underway in HSCM. The Board has only recently restarted, so in the interim, project requests are being processed via Senior Management Team. The interim Strategy and Planning Lead will support the Infrastructure Programme Board for Moray portfolio. Page 80
Page 81
Appendix 1 Mitigating Actions: Membership of the Board was reviewed and revised to ensure representation of all existing infrastructure processes and funding opportunities. Process for ensuring infrastructure change/investment requests developed Dr Gray’s strategy (vision for the future) is being produced collaboratively with input from NHSG and HSCM management. Assurances: Infrastructure Programme Board functions to provide robust governance and assurance that proposed projects have a robust business case and meets requirements of the respective partner organisations. This board reports to Strategic Planning and Commissioning Group. Both of these groups have been recently refreshed and remobilised. Workforce Forum meeting regularly with representation of HR and unions from both partner organisations Gaps in assurance: Further work is required on developing the process for approval for projects so that they are progressed timeously. Need to review all existing processes in relation to infrastructure changes/projects/investments and streamline to avoid duplication of effort. Infrastructure Board is in development and priority issues are being addressed in relation to infrastructure and premises risk. Due to staff changes this work will now be incorporated into other roles. This will likely mean that this work will complete with other priorities of already busy roles. Legal services have reduced capacity to provide support due to budget cuts and vacancies so any requests may take longer. Recruitment for vacancies takes considerable time due to various factors and is presenting a strain on services to maintain normal service whilst covering vacancies. There have been several posts that have had to go out to advert more than once extending the time other staff are covering gaps. Current performance: No update. Comments: Existing projects will be reviewed as part of the development of the transformation plans for the Strategic Plan to ensure resources are being dedicated appropriately and aligned to the emerging Strategic priorities. Our requirements for support will be communicated via appropriate channels Page 81
Page 82
Page 82
Page 83
REPORT TO: MORAY INTEGRATION JOINT BOARD AUDIT, PERFORMANCE AND RISK COMMITTEE ON 30 MARCH 2023 SUBJECT: EXTERNAL AUDIT PLAN FOR THE YEAR ENDING 2022/23 BY: CHIEF FINANCIAL OFFICER 1. REASON FOR REPORT 1.1. To inform the Committee of the Auditor’s Annual Plan for 2022/23. 2. RECOMMENDATION 2.1 It is recommended that the Audit, Performance and Risk Committee considers and notes the contents of the External Auditor’s Annual Plan for 2022/23. 3. BACKGROUND 3.1. In September 2022, Grant Thornton was confirmed as the external auditor of the Moray Integration Joint Board (MIJB). The appointment was for financial years 2022/23 to 2026/27 inclusive. 3.2. Grant Thornton were appointed by the Accounts Commission to deliver the public audit for Moray, they will provide independent assurance to the people of Scotland that public money is spent appropriately and provides value. Audit work is carried out in accordance with International Standards on Auditing, the Code of Audit Practice https://www.audit-scotland.gov.uk/publications/code-of- audit-practice-2021 and any other relevant guidance. 4. KEY MATTERS RELEVANT TO RECOMMENDATION 4.1. An Annual Audit Plan for 2022/23 has been received from Grant Thornton and is attached at APPENDIX 1 to this report. The Plan sets out the scope of the audit work and the auditors approach to the audit. The Plan details the initial risks identified by Grant Thornton and planned work to be undertaken for the audit of the financial statements for the year ending 2022/23. Grant Thornton also aim to add value to the MIJB through its work. Item 8. Page 83
Page 84
4.2. The Audit Plan identifies the main risks for the MIJB which will be the focus of audit testing and are outlined in page 9 of the Plan. In order to assist with the assessment of risk, an Informing the Audit Risk Assessment was completed by senior managers and is attached at APPENDIX 2. 4.3. On page 5 of the Audit Plan, Grant Thornton has shown the External Audit fee for 2022/23 as being £31,470 and represents a 15% increase on the previous year. 4.4. The annual accounts timetable, including key deadlines are shown on page 7 of the audit plan and requires the MIJB to submit the Unaudited Annual Accounts along with supporting working papers to Grant Thornton by 30 June 2023 following consideration by those charged with governance at the meeting of the MIJB on 29 June 2023. The MIJB will be asked to approve the audited annual accounts and to consider the Annual Audit Report at its meeting of 28 September 2023. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) and MIJB Strategic Commissioning Plan ‘Partners in Care’ 2022 – 2032 The work undertaken by External Audit seeks to provide assurance to the MIJB on the financial governance and resource management. It will express a view on the key risks to be managed in order to secure operational efficiency in line with the Strategic Plan 2019 - 29. (b) Policy and Legal The external audit is conducted in terms of statutory powers afforded to the appointed External Auditor and in accordance with Grant Thorntons Code of Practice. (c) Financial implications The annual audit fee set for 2022/23 by Grant Thornton and paid by the MIJB is £31,470. (d) Risk Implications and Mitigation The risks associated with the Audit Plan have been identified and categorised within the Plan on page 9. (e) Staffing Implications Preparation of the MIJB’s financial statements will require input and coordination from the MIJB Chief Financial Officer and the finance teams of both Moray Council and NHS Grampian which forms part of the scheduled work. Page 84
Page 85
(f) Property None arising directly from this report. (g) Equalities/Socio Economic Impact None arising directly from this report as there has been no change to policy. (h) Climate Change and Biodiversity Impacts None arising directly from this report. (i) Directions None arising directly from this report. (j) Consultations The content of the Plan has been discussed with the Chief Officer, Chief Internal Auditor and Senior Managers prior to production and their comments have been incorporated where appropriate. 6. CONCLUSION 6.1. The Annual Audit Plan informs the MIJB, its Committees and officers of the work to be undertaken by External Audit (Grant Thornton) in the year ahead. Author of Report: Deborah O’Shea Background Papers: with author Ref: Page 85
Page 86
Page 86
Page 87
APPENDIX 1 Item 8. Page 87
Page 88
Commercial in confidence Page 88
Page 89
Commercial in confidence Page 89
Page 90
Commercial in confidence • • • • • • • Page 90
Page 91
Commercial in confidence • • • • • • Page 91
Page 92
Commercial in confidence Page 92
Page 93
Commercial in confidence 7 • • • • • Page 93
Page 94
Commercial in confidence Page 94
Page 95
Commercial in confidence • • • • • • Page 95
Page 96
Commercial in confidence Page 96
Page 97
Commercial in confidence • • • • – – – – – – • • Page 97
Page 98
Commercial in confidence • • Page 98
Page 99
Commercial in confidence Page 99
Page 100
Commercial in confidence Page 100
Page 101
Commercial in confidence Page 101
Page 102
Commercial in confidence Page 102
Page 103
Commercial in confidence Page 103
Page 104
Commercial in confidence • • Page 104
Page 105
Commercial in confidence Page 105
Page 106
Commercial in confidence Service Fees £ Service Fees £ • • • • Page 106
Page 107
Commercial in confidence 21 Adding value through the audit • • • Inflo • • • • • •Page 107
Page 108
Page 108
Page 109
Commercial in confidence Page 109
Page 110
Commercial in confidence Page 110
Page 111
Commercial in confidence Page 111
Page 112
Commercial in confidence 26 • • • • • Page 112
Page 113
Commercial in confidence 27 • • • • • • Page 113
Page 114
Commercial in confidence • • • • • • Page 114
Page 115
Commercial in confidence • • • • • • Page 115
Page 116
Commercial in confidence 30 • • • • • • • • • • Page 116
Page 117
Commercial in confidence • • • • • • • • Page 117
Page 118
Page 118
Page 119
Informing the audit risk assessment for Moray IJB 2022/23 Angela Pieri Director T 0161 214 6337 E Angela.L.Pieri@uk.gt.com Hannah McKellar Manager T 0131 659 8569 E Hannah.L.McKellar@uk.gt.com APPENDIX 2 Item 8. Page 119
Page 120
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence The contents of this report relate only to the matters which have come to our attention, which we believe need to be reported to you as part of our audit process. It is not a comprehensive record of all the relevant matters, which may be subject to change, and in particular we cannot be held responsible to you for reporting all of the risks which may affect your business or any weaknesses in your internal controls. This report has been prepared solely for your benefit and should not be quoted in whole or in part without our prior written consent. We do not accept any responsibility for any loss occasioned to any third party acting, or refraining from acting on the basis of the content of this report, as this report was not prepared for, nor intended for, any other purpose. 2 Page 120
Page 121
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Table of Contents Section Page Purpose 4 General Enquiries of Management 6 Fraud 9 Fraud Risk Assessment 10 Laws and Regulations 15 Impact of Laws and Regulations 16 Related Parties 18 Going Concern 20 Accounting Estimates 22 Accounting Estimates - General Enquiries of Management 23 Appendix A – Accounting Estimates 26 3 Page 121
Page 122
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Purpose The purpose of this report is to contribute towards the effective two-way communication between Moray IJB’s external auditors and Moray IJB’s Audit, Performance and Risk Committee, as 'those charged with governance'. The report covers some important areas of the auditor risk assessment where we are required to make inquiries of the Audit, Performance and Risk Committee under auditing standards. Background Under International Standards on Auditing (UK), (ISA(UK)) auditors have specific responsibilities to communicate with the Audit, Risk and Assurance Committee. ISA(UK) emphasise the importance of two-way communication between the auditor and the Audit, Performance and Risk Committee and also specify matters that should be communicated. This two-way communication assists both the auditor and the Audit, Performance and Risk Committee in understanding matters relating to the audit and developing a constructive working relationship. It also enables the auditor to obtain information relevant to the audit from the Audit, Performance and Risk Committee and supports Audit, Performance and Risk Committee in fulfilling its responsibilities in relation to the financial reporting process. Communication As part of our risk assessment procedures we are required to obtain an understanding of management processes and the Authority’s oversight of the following areas: • General Enquiries of Management • Fraud, • Laws and Regulations, • Related Parties, • Going Concern, and • Accounting Estimates. 4 Page 122
Page 123
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Purpose This report includes a series of questions on each of these areas and the response we have received from Moray IJB’s management. The Audit, Performance and Risk Committee should consider whether these responses are consistent with its understanding and whether there are any further comments it wishes to make. 5 Page 123
Page 124
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence General Enquiries of Management Question Management response 1. What do you regard as the key events or issues that will have a significant impact on the financial statements for 2022/23? Clawback/ repayment of ear marked reserves brought forward by Scottish Government 2. Have you considered the appropriateness of the accounting policies adopted by Moray IJB? Have there been any events or transactions that may cause you to change or adopt new accounting policies? If so, what are they? Accounting Policies are reviewed each year as the Accounts are prepared and changes incorporated where deemed necessary. No changes to accounting policies are anticipated for the 2022/23 accounts 3. Is there any use of financial instruments, including derivatives? If so, please explain No 4. Are you aware of any significant transactions outside the normal course of business? If so, what are they? Not aware of any significant transactions 6 Page 124
Page 125
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence General Enquiries of Management Question Management response 5. Are you aware of any changes in circumstances that would lead to impairment of non-current assets? If so, what are they? N/A 6. Are you aware of any guarantee contracts? If so, please provide further details N/A 7. Are you aware of the existence of loss contingencies and/or un-asserted claims that may affect the financial statements? If so, please provide further details N/A 8. Other than in house solicitors, can you provide details of those solicitors utilised by Moray IJB during the year. Please indicate where they are working on open litigation or contingencies from prior years? Brodies solicitors for the scheme of integration update 7 Page 125
Page 126
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence General Enquiries of Management Question Management response 9. Have any of the Moray IJB’s service providers reported any items of fraud, non-compliance with laws and regulations or uncorrected misstatements which would affect the financial statements? If so, please provide further details Not aware of any instances of fraud 10. Can you provide details of other advisors consulted during the year and the issue on which they were consulted? KPMG for audit on Commissioning service 11. Have you considered and identified assets for which expected credit loss provisions may be required under IFRS 9, such as debtors (including loans) and investments? If so, please provide further details N/A 8 Page 126
Page 127
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Fraud Matters in relation to fraud ISA (UK) 240 covers auditors responsibilities relating to fraud in an audit of financial statements. The primary responsibility to prevent and detect fraud rests with both the Audit, Performance and Risk Committee and management. Management, with the oversight of the Audit, Performance and Risk Committee, needs to ensure a strong emphasis on fraud prevention and deterrence and encourage a culture of honest and ethical behaviour. As part of its oversight, the Audit, Performance and Risk Committee should consider the potential for override of controls and inappropriate influence over the financial reporting process. As Moray IJB’s external auditor, we are responsible for obtaining reasonable assurance that the financial statements are free from material misstatement due to fraud or error. We are required to maintain professional scepticism throughout the audit, considering the potential for management override of controls. As part of our audit risk assessment procedures we are required to consider risks of fraud. This includes considering the arrangements management has put in place with regard to fraud risks including: • assessment that the financial statements could be materially misstated due to fraud, • process for identifying and responding to risks of fraud, including any identified specific risks, • communication with the Audit, Performance and Risk Committee regarding its processes for identifying and responding to risks of fraud, and • communication to employees regarding business practices and ethical behaviour. We need to understand how the Audit, Performance and Risk Committee oversees the above processes. We are also required to make inquiries of both management and the Audit, Performance and Risk Committee as to their knowledge of any actual, suspected or alleged fraud. These areas have been set out in the fraud risk assessment questions below together with responses from Moray IJB’s management. 9 Page 127
Page 128
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Fraud risk assessment Question Management response 1. Has Moray IJB assessed the risk of material misstatement in the financial statements due to fraud? How has the process of identifying and responding to the risk of fraud been undertaken and what are the results of this process? How do Moray IJB’s risk management processes link to financial reporting? The MIJB has established risk management, governance and operating procedures to mitigate the risk of material misstatement in the financial statements. Agreed arrangements within the NHS for the investigation of fraud. In regard to the Council, Financial Regulations detail that all staff irregularities should be reported to the Audit and Risk Manager.(MIJB Chief Internal Auditor). This is supported by the Policy to Combat Fraud, Theft, Bribery and Corruption and the Whistleblowing Policy. In addition, the Council participates in the National Fraud Initiative data matching exercise and also publicises a point of contact to report fraud or irregularities involving the misuse of council resources. All irregularities and system reviews will be reported to the Audit, Performance and Risk Committee. The corporate risk register detailing the MIJB’s principal risks are regularly reviewed by SMT, with an annual report provided to MIJB Board. Services are also required to maintain risk registers detailing identifiable risks and mitigating actions/controls. In addition, the Chief Internal Auditor (MIJB) also prepares a risk-based audit plan that considers the IJB’s strategic objectives, associated risks and senior management's view. 2. What have you determined to be the classes of accounts, transactions and disclosures most at risk to fraud? Risk registers are also maintained by the parent organisations. Internal Audit will also review and test transactions to ensure compliance with Council Regulations and Procedures. The use of IDEA, a computer assisted software system is used to analyse and select a sample for testing. 3. Are you aware of any instances of actual, suspected or alleged fraud, errors or other irregularities either within Moray IJB as a whole, or within specific departments since 1 April 2022? If so, please provide No irregularity known below the £5000 reporting threshold10 Page 128
Page 129
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Fraud risk assessment Question Management response 4. As a management team, how do you communicate risk issues (including fraud) to those charged with governance? Both the NHS and the Council have their own regulations regarding fraud. The NHS Counter Fraud Authority (NHSCFA) is a health authority charged with identifying, investigating and preventing fraud and other economic crimes within the NHS and the wider health group. The Council’s Financial Regulations require that all irregularities be reported to the Audit and Risk Manager. The Audit and Risk Manager is also responsible for supporting the Council’s risk management arrangements which includes regularly reviewing the principal risks facing the Council. Principal risks facing the MIJB are reviewed regularly by SMT and the corporate risk register is the accordingly updated 5. Have you identified any specific fraud risks? If so, please provide details Do you have any concerns there are areas that are at risk of fraud? Are there particular locations within Moray IJB where fraud is more likely to occur? Yes. Specific concerns have been raised regarding the threat of a successful cyber attack, resulting in a report to the Audit, Risk and Performance Committee with recommendations to improve existing controls. As part of the risk-based approach to preparing the Annual Audit Plan the Chief Internal Auditor of the MIJB will consider fraud risks in determining the reviews to be undertaken. However, this only relates to Council funded services. 6. What processes do Moray IJB have in place to identify and respond to risks of fraud? The NHS Counter Fraud Authority (NHSCFA) is responsible for identifying, investigating and preventing fraud within the NHS. The Council Financial Regulations detail that irregularities should be reported to the Audit and Risk Manager. This is supported by the Policy to Combat Fraud, Theft, Bribery and Corruption and the Whistleblowing Policy. In addition, the Council participates in the National Fraud Initiative data matching exercise and also publicises a point of contact to report fraud or irregularities involving the misuse of council resources. 11 Page 129
Page 130
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Fraud risk assessment Question Management response 7. How do you assess the overall control environment for Moray IJB, including: • the existence of internal controls, including segregation of duties; and • the process for reviewing the effectiveness the system of internal control? If internal controls are not in place or not effective where are the risk areas and what mitigating actions have been taken? What other controls are in place to help prevent, deter or detect fraud? Are there any areas where there is a potential for override of controls or inappropriate influence over the financial reporting process (for example because of undue pressure to achieve financial targets)? If so, please provide details The responsibility for developing and maintaining sound control environment rests with management. However, internal audit prepares a risk based audit plan which considers the MIJB’s strategic objectives and associated risks. While the prevention of fraud and error rests with management through the design and operation of suitable systems of control, reviews undertaken by Internal Audit will make recommendations to improve the control environment. All officers are required to adhere to agreed policies and regulations. 8. Are there any areas where there is potential for misreporting? If so, please provide details None noted 12 Page 130
Page 131
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Fraud risk assessment Question Management response 9. How does Moray IJB communicate and encourage ethical behaviours and business processes of it’s staff and contractors? How do you encourage staff to report their concerns about fraud? What concerns are staff expected to report about fraud? Have any significant issues been reported? If so, please provide details Established arrangements exist to communicate and encourage ethical behaviours and business processes of its staff and contractors. Managers have an ongoing responsibility for implementing effective systems of control which secure the legitimacy of expenditure, the safeguarding of assets and income, the reliability of management information, the accuracy of record keeping and compliance with statutory guidance. They are also responsible for communicating this policy to their staff and ensuring established systems are followed. As detailed, the NHS Counter Fraud Authority (NHSCFA) is responsible for identifying, investigating and preventing fraud and other economic crimes within the NHS and the wider health group. The Council has a Policy to Combat Fraud, Theft, Bribery and Corruption. This policy is built around a counter fraud culture supported by practices to deter and detect fraudulent and corrupt activities. It takes account of the Council’s statutory obligations, including, and in particular, the provisions of the Bribery Act 2010. Council Financial Regulations detail that all irregularities should be reported to the Audit and Risk Manager. In addition, a Confidential ‘whistle blowing’ policy and procedure is in place, enabling employees to raise any concerns about any aspect of the Council’s work without fear of victimisation, subsequent discrimination or disadvantage, and in the knowledge that such concerns will be properly investigated 10. From a fraud and corruption perspective, what are considered to be high-risk posts? How are the risks relating to these posts identified, assessed and managed? There is an expectation that all staff and elected board members will act within the law and with honesty and integrity at all times. In particular, all staff and elected board members are expected to refrain from engaging in fraudulent or corrupt activity of any kind and shall refrain from offering, making or accepting bribes, whether financial or otherwise. Governance standards promote values and behaviours for the MIJB that demonstrate how it will uphold good practice and high standards of conduct. These include codes of conduct for both elected board members and employees and reflect the principles of public life identified by the Nolan Committee, including selflessness, honesty and integrity. This also takes in the Duty (Public Service) and Respect principles added by the Scottish Government. 13 Page 131
Page 132
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Fraud risk assessment Question Management response 12. What arrangements are in place to report fraud issues and risks to the Audit, Performance and Risk Committee? How does the Audit, Performance and Risk Committee exercise oversight over management's processes for identifying and responding to risks of fraud and breaches of internal control? What has been the outcome of these arrangements so far this year? The Public Sector Internal Audit Standards (PSIAS) applicable to Local Government in Scotland requires Internal Audit to report functionally to the Audit, Performance and Risk Committee on various issues relative to the work of the Internal Audit Service, including special investigations. The Audit, Performance and Risk Committee has a remit which includes ensuring that the highest standards of probity and public accountability are demonstrated. This involves oversight of internal control processes as a contribution to good governance and generally supporting an anti-fraud, theft, corruption, and bribery culture. This Committee considers reports produced by Internal and External Audit on the IJB’s systems; reports which include recommendations to strengthen internal controls and in turn reduce the risk of fraud and related behaviours going undetected. 13. Are you aware of any whistle blowing potential or complaints by potential whistle blowers? If so, what has been your response? None noted 14. Have any reports been made under the Bribery Act? If so, please provide details None noted 14 Page 132
Page 133
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Law and regulations Matters in relation to laws and regulations ISA (UK) 250 requires us to consider the impact of laws and regulations in an audit of the financial statements. Management, with the oversight of the Audit, Performance and Risk Committee, is responsible for ensuring that Moray IJB’s operations are conducted in accordance with laws and regulations, including those that determine amounts in the financial statements. As auditor, we are responsible for obtaining reasonable assurance that the financial statements are free from material misstatement due to fraud or error, taking into account the appropriate legal and regulatory framework. As part of our risk assessment procedures we are required to make inquiries of management and the Audit, Performance and Risk Committee as to whether the body is in compliance with laws and regulations. Where we become aware of non-compliance or suspected non-compliance we need to gain an understanding of the non-compliance and the possible effect on the financial statements. Risk assessment questions have been set out below together with responses from management. 15 Page 133
Page 134
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Impact of laws and regulations Question Management response 1. How does management gain assurance that all relevant laws and regulations have been complied with? What arrangements does Moray IJB have in place to prevent and detect non-compliance with laws and regulations? Are you aware of any changes to the Authority’s regulatory environment that may have a significant impact on the Authority’s financial statements? Generally speaking each service area are familiar with the statutory regime in which they operate and will keep up to speed with developments through their professional associations such as CIPFA or SOLAR. Changes to legislation, consultations and guidance are notified to the IJB by the Scottish Government and are distributed to the relevant departmental area. The legal section has teams which specialise in different areas of Council activity and will be involved (at the request of client departments) in the implementation of more complex changes (such as formation of the IJB) and in any areas where legislation is unclear. Legal compliance will often be subject to external regulation (for example data protection). The IJB’s Integration Scheme (detailing the powers given to officers to implement services under specified legislation) is reviewed annually in line with revised legislative powers, in consultation with client departments. 2. How is the Audit, Performance and Risk Committee provided with assurance that all relevant laws and regulations have been complied with? Overview of committee reports undertaken by Legal Services 3. Have there been any instances of non-compliance or suspected non-compliance with laws and regulation since 1 April 2022 with an on-going impact on the 2022/23 financial statements? If so, please provide details Not aware of any instances 4. Are there any actual or potential litigation or claims that would affect the financial statements? If so, please provide 16 Page 134
Page 135
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Impact of laws and regulations Question Management response 5. What arrangements does Moray IJB have in place to identify, evaluate and account for litigation or claims? The legal section has teams which specialise in different areas of activity and will be involved (at the request of client departments) in the implementation of more complex changes (such as formation of the MIJB) and in any areas where legislation is unclear. Where necessary external advice will be sought 6. Have there been any reports from other regulatory bodies, such as HM Revenues and Customs, which indicate non-compliance? If so, please provide details None known 17 Page 135
Page 136
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Related Parties Matters in relation to Related Parties Moray IJB are required to disclose transactions with bodies/individuals that would be classed as related parties. These may include: ■ bodies that directly, or indirectly through one or more intermediaries, control, or are controlled by Moray IJB; ■ associates; ■ joint ventures; ■ a body that has an interest in the authority that gives it significant influence over the Authority; ■ key management personnel, and close members of the family of key management personnel, and ■ post-employment benefit plans (pension fund) for the benefit of employees of the Authority, or of any body that is a related party of the Authority. A disclosure is required if a transaction (or series of transactions) is material on either side, i.e. if a transaction is immaterial from the Authority’s perspective but material from a related party viewpoint then the Authority must disclose it. ISA (UK) 550 requires us to review your procedures for identifying related party transactions and obtain an understanding of the controls that you have established to identify such transactions. We will also carry out testing to ensure the related party transaction disclosures you make in the financial statements are complete and accurate. 18 Page 136
Page 137
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Related Parties Question Management response 1. Have there been any changes in the related parties including those disclosed in Moray IJB’s 2021/22 financial statements? If so please summarise: • the nature of the relationship between these related parties and Moray IJB • whether Moray IJB has entered into or plans to enter into any transactions with these related parties • the type and purpose of these transactions No changes 2. What controls does Moray IJB have in place to identify, account for and disclose related party transactions and relationships? Senior Officers and Elected Board Members make annual returns and members interests are regularly updated on the website, any significant factors that arise as part of this process would be factored into the Related Parties Note in the Annual Accounts. 3. What controls are in place to authorise and approve significant transactions and arrangements with related parties? Normal procedures following the parties authorisation policies would apply – transactions over agreed limits are checked by Chief Financial Officer or Director of finance 4. What controls are in place to authorise and approve significant transactions outside of the normal course of business? For significant transactions that are new and outside the normal course of business IJB Board approval is required. 19 Page 137
Page 138
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Going Concern Matters in relation to Going Concern The audit approach for going concern is based on the requirements of ISA (UK) 570, as interpreted by Practice Note 10: Audit of financial statements and regularity of public sector bodies in the United Kingdom (Revised 2020). It also takes into account the National Audit Office's Supplementary Guidance Note (SGN) 01: Going Concern – Auditors’ responsibilities for local public bodies. Practice Note 10 confirms that in many (but not all) public sector bodies, the use of the going concern basis of accounting is not a matter of significant focus of the auditor’s time and resources because the applicable financial reporting frameworks envisage that the going concern basis for accounting will apply where the body’s services will continue to be delivered by the public sector. In such cases, a material uncertainty related to going concern is unlikely to exist. For this reason, a straightforward and standardised approach to compliance with ISA (UK) 570 will often be appropriate for public sector bodies. This will be a proportionate approach to going concern based on the body’s circumstances and the applicable financial reporting framework. In line with Practice Note 10, the auditor’s assessment of going concern should take account of the statutory nature of the body and the fact that the financial reporting framework for central government bodies presume going concern in the event of anticipated continuation of provision of the services provided by the body. Therefore, the public sector auditor applies a ‘continued provision of service approach’, unless there is clear evidence to the contrary. This would also apply even where those services are planned to transfer to another body, as in such circumstances, the underlying services will continue. For many public sector bodies, the financial sustainability of the body and the services it provides are more likely to be of significant public interest than the application of the going concern basis of accounting. Financial sustainability is a key component of wider scope and best value work and it is through such work that it will be considered. Page 138
Page 139
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Going Concern Question Management response 1. What processes and controls does management have in place to identify events and / or conditions which may indicate that the statutory services being provided by Moray IJB will no longer continue? Regular reporting on the IJB’s Finances would highlight any conditions which may mean the MIJB is no longer to deliver statutory duties. Regular performance reports would also highlight this 2. Are management aware of any factors which may mean for Moray IJB that either statutory services will no longer be provided or that funding for statutory services will be discontinued? If so, what are they? Not aware of any 3. With regard to the statutory services currently provided by Moray IJB, does Moray IJB expect to continue to deliver them for the foreseeable future, or will they be delivered by related public authorities if there are any plans for Moray IJB to cease to exist? The MIJB would expect to continue to deliver statutory services 4. Are management satisfied that the financial reporting framework permits Moray IJB to prepare its financial statements on a going concern basis? Are management satisfied that preparing financial statements on a going concern basis will provide a faithful representation of the items in the financial statements? The annual accounts are prepared on a going concern basis and this will provide a faithful representation of the items included in the financial statements Page 139
Page 140
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Accounting estimates Matters in relation to accounting estimates ISA (UK) 540 (Revised December 2018) requires auditors to understand and assess a body’s internal controls over accounting estimates, including: • The nature and extent of oversight and governance over management’s financial reporting process relevant to accounting estimates; • How management identifies the need for and applies specialised skills or knowledge related to accounting estimates; • How the body’s risk management process identifies and addresses risks relating to accounting estimates; • The body’s information system as it relates to accounting estimates; • The body’s control activities in relation to accounting estimates; and • How management reviews the outcomes of previous accounting estimates. As part of this process auditors also need to obtain an understanding of the role of those charged with governance, which is particularly important where the estimates have high estimation uncertainty, or require significant judgement. Specifically do Audit, Performance and Risk Committee members: • Understand the characteristics of the methods and models used to make the accounting estimates and the risks related to them; • Oversee management’s process for making accounting estimates, including the use of models, and the monitoring activities undertaken by management; and • Evaluate how management made the accounting estimates? We would ask the Audit, Performance and Risk Committee to satisfy itself that the arrangements for accounting estimates are adequate. 22 Page 140
Page 141
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Accounting Estimates - General Enquiries of Management Question Management response 1. What are the classes of transactions, events and conditions, that are significant to the financial statements that give rise to the need for, or changes in, accounting estimate and related disclosures? None directly but the value of the pension liability from partner organisations would have implications 2. How does the Authority’s risk management process identify and address risks relating to accounting estimates? Managed by the partner organisations 3. How does management identify the methods, assumptions or source data, and the need for changes in them, in relation to key accounting estimates? The results of prior year audits are looked at to see whether there was any material concerns raised or amendments made 4. How do management review the outcomes of previous accounting estimates? As above 5. Were any changes made to the estimation processes in 2022/23 and, if so, what was the reason for these? No changes Page 141
Page 142
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Accounting Estimates - General Enquiries of Management Question Management response 6. How does management identify the need for and apply specialised skills or knowledge related to accounting estimates? Each area is looked at in isolation and the relevant skills/knowledge/capacity considered 7. How does the Authority determine what control activities are needed for significant accounting estimates, including the controls at any service providers or management experts? Ensuring that relevant information is provided on time and accurately to ensure that the information received can be relied upon. 8. How does management monitor the operation of control activities related to accounting estimates, including the key controls at any service providers or management experts? Regular updates provided by preparers of the Accounts on any issues that arise 9. What is the nature and extent of oversight and governance over management’s financial reporting process relevant to accounting estimates, including: - Management’s process for making significant accounting estimates - The methods and models used - The resultant accounting estimates included in the financial statements. The unaudited accounts are reported to Committee and then again upon completion of the audit. External Audit reporting also helps to inform on estimates. Page 142
Page 143
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Accounting Estimates - General Enquiries of Management Question Management response 10. Are management aware of any transactions, events, conditions (or changes in these) that may give rise to recognition or disclosure of significant accounting estimates that require significant judgement (other than those in Appendix A)? If so, what are they? Not aware of any 11. Why are management satisfied that their arrangements for the accounting estimates, as detailed in Appendix A, are reasonable? No major changes required to annual accounts in previous years 12. How is the Audit, Performance and Risk Committee provided with assurance that the arrangements for accounting estimates are adequate? Annual accounts are reported 25 Page 143
Page 144
© 2023 Grant Thornton UK LLP | Moray IJB 2022/23 Commercial in confidence Appendix A Accounting Estimates Estimate Method / model used to make the estimate Controls used to identify estimates Whether management have used an expert Underlying assumptions: - Assessment of degree of uncertainty - Consideration of alternative estimates Has there been a change in accounting method in year? Valuation of defined benefit net pension fund liabilities Based on information from actuaries Information provided to actuaries based on year end position reducing the need for use of estimates. Yes Disclosure in accounts regarding the changes that could happen and the impact it would have on the figues included in the accounts No Accruals Based on actual entries in the ledger, or on information received from departments No In most cases based on actual ledger entries so no estimation . Where estimates are provided we know it will be based on professional judgement and we would query it it was materially different from estimates provided No Accrued income Based on actual entries in the ledger, or on information received from departments No In most cases based on actual ledger entries so no estimation . Where estimates are provided we know it will be based on professional judgement and we would query it it was materially different from estimates provided No 26 Page 144
Page 145
© 2023 Grant Thornton UK LLP ‘Grant Thornton’ refers to the brand under which the Grant Thornton member firms provide assurance, tax and advisory services to their clients and/or refers to one or more member firms, as the context requires. Grant Thornton UK LLP is a member firm of Grant Thornton International Ltd (GTIL). GTIL and the member firms are not a worldwide partnership. GTIL and each member firm is a separate legal entity. Services are delivered by the member firms. GTIL does not provide services to clients. GTIL and its member firms are not agents of, and do not obligate, one another and are not liable for one another’s acts or omissions. grantthornton.co.uk Page 145
Page 146
Page 146
Page 147
REPORT TO: MORAY INTEGRATION JOINT BOARD AUDIT, PERFORMANCE AND RISK COMMITTEE ON 30 MARCH 2023 SUBJECT: INTERNAL AUDIT SECTION COMPLETED PROJECTS REPORT BY: CHIEF INTERNAL AUDITOR 1. REASON FOR REPORT 1.1 To provide an update on audit work completed since the last meeting of the Committee. 2. RECOMMENDATION 2.1 The Audit, Performance and Risk Committee is asked to consider and note this audit update. 3. BACKGROUND 3.1 Public Sector Internal Audit Standards (PSIAS) require the Chief Internal Auditor to prepare and present reports to the committee on internal audit’s activity relative to the audit plan and any other relevant matters. 4. KEY MATTERS RELEVANT TO RECOMMENDATION 4.1 In line with the approved internal audit plan, the following reviews were completed: General Data Protection Regulation 4.2 A review has been undertaken of Council systems to ensure compliance with the United Kingdom's General Data Protection Regulation (GDPR). The General Data Protection Regulation is a 2016 European Union Regulation that was incorporated into the United Kingdom Data Protection Act 2018. The audit reviewed systems and controls to ensure the Council is fulfilling the requirements of GDPR. The review sought to confirm the required policies, procedures and guidance are in place; there is awareness throughout the Council with comprehensive training programmes and effective oversight and governance arrangements to monitor ongoing compliance with GDPR. The executive summary and recommendations for this project are given in Appendix 1. Item 9. Page 147
Page 148
Information Management 4.3 An audit has been undertaken to review that an appropriate system exists in the management, security and transfer of data between the Council and care providers, including NHS Grampian. The decision to review information management was undertaken after discussions were held with the internal audit providers for NHS Grampian, Aberdeen City and Aberdeenshire Councils. The intention was to develop closer working relationships to better coordinate the audit planning process and provide a more comprehensive audit opinion of the control environment within Health and Social Care. 4.4 A start date for the information management audit was agreed, but I was then informed by the NHS Internal Audit Provider they could no longer complete the audit as a review by the Information Commissioner was taking precedence. As the audit within the Council was already well progressed, the review was completed in accordance with the Audit Plan. The executive summary and recommendations for this project are given in Appendix 2. Payroll System 4.5 A review has been undertaken of the payroll system. The payroll system is one of the core financial systems of the Council in administering approximately £80 million of annual expenditure. The audit reviewed the key controls in the management of the payroll service. This involved an assessment of the operational effectiveness of these controls. Audit testing included the random selection of a sample of salary payments and deductions to ensure the correct calculation of remuneration and statutory/ voluntary deductions are processed timeously and accurately. The Chartered Institute of Public Finance and Accountancy Control Matrices were used to develop an audit programme. Further to an incident regarding the unauthorised access to an officer’s Employee Self-Service account, additional testing was also undertaken regarding access controls to the Employee Self Service System, where officers can amend their personal information, including bank details. The executive summary and recommendations for this project are given in Appendix 3. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) and Moray Integration Joint Board Strategic Plan “Partners in Care 2022-2032” Internal audit work supports good governance and assists in securing appropriate systems of internal control. (b) Policy and Legal The internal audit service is provided in terms of paragraph 7:1 of the Local Authority Accounts (Scotland) Regulations 2014, and there is a Page 148
Page 149
requirement to provide a service in accordance with published Public Sector Internal Audit Standards. (c) Financial Implications No implications directly arising from this report. (d) Risk Implications and Mitigation Audit reports highlight risk implications and contain recommendations for management to address as a means of mitigating. (e) Staffing Implications No implications directly arising from this report (f) Property No implications. (g) Equalities/ Socio Economic Impacts Not required as no change to policy. (h) Climate Change and Biodiversity Impacts None directly arising from this report. (i) Directions None arising directly from this report. (j) Consultations There have been no direct consultations during the preparation of this report. 6. CONCLUSION 6.1 This report provides Committee with a summary of findings arising from audit projects completed during the review period. Author of Report: Dafydd Lewis, Chief Internal Auditor Background Papers: Internal Audit Files Ref: mijb/ap&rc/30032023 Page 149
Page 150
Page 150
Page 151
APPENDIX 1 AUDIT REPORT 23’015 UK GENERAL DATA PROTECTION REGULATION Executive Summary The annual internal audit plan for 2022/23 provides for a review to be undertaken of the Council systems to ensure compliance with United Kingdom's (UK) General Data Protection Regulation. The General Data Protection Regulation (GDPR) was a 2016 European Union regulation that came into force in May 2018, at the same time as the UK's updated Data Protection Act 2018 (DPA). Since the UK's departure from the European Union, GDPR has been adopted into UK regulation and sits alongside DPA 2018; together they introduce stronger legislation on the handling of personal data. The Council processes an individual's personal data in order to plan, run and improve its services, perform its statutory duties, carry out its regulatory, licensing and enforcement roles, make payments, administer benefits and identify fraud and improve the health of the population it serves. The UK General Data Protection Regulation regulates and protects the processing of personal data about individuals by using the law to protect data and the way it is used by Local Authorities. The scope of the audit reviewed systems and controls to ensure the Council is fulfilling the requirements of UK GDPR. The review sought to confirm the required policies, procedures and guidance are in place, there is awareness throughout the Council with comprehensive training programmes and effective oversight and governance arrangements to monitor ongoing compliance with UK GDPR. Failures that result in a breach of an individual's personal data may result in the Information Commissioner's Office issuing a fine to the Council. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). Difficulties were experienced during the audit in the provision of information required for this review. This resulted in a delay in the completion of the audit; consideration will therefore be required to undertake further audit testing regarding the Council's compliance with data protection regulations in a future Audit Plan. Findings from the audit undertaken noted the following areas for consideration:- • UK GDPR requires the Council to undertake regular monitoring of policy compliance to ensure data handling and security controls are operating effectively in practice. This is not being undertaken. Further monitoring arrangements should be introduced to evidence compliance with UK GDPR and the Council's Data Protection Policy. Item 9. Page 151
Page 152
APPENDIX 1 • It was noted that the Council does not maintain an Information Asset Register or a formal Record of Processing Activities. A requirement of UK GDPR is a need to record data flows and document a register of personal data. This should also assist in facilitating a risk assessment of information areas where further controls may be required. • It was pleasing to note that officers need to complete Council online training modules on data protection. However, no monitoring of participation has been undertaken. A review should be done to highlight officers that have not completed this training module. Any officer identified should be reminded to undertake their data protection training requirement. Page 152
Page 153
APPENDIX 1 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: The Council has the appropriate procedures and controls in place to protect information, fulfilling the requirements of GDPR. 5.01 The Data Protection Policy and guidance should be reviewed to ensure the detailed information remains current and appropriate. Thereafter, a timetable for continued review should be set. Medium Yes Task already identified and awaiting workload capacity. Records & Heritage Manager and Data Protection Officer 31/01/2023 5.02 In compliance with UK GDPR, a Record of Processing Activities (ROPA) should be compiled by the Authority based on a data mapping exercise. High Yes A Data Protection Review is already underway with the Information Governance Officer post now in place. Information collected from the 2018 GDPR introduction work will form the basis of this review. A finalised ROPA and Information Records & Heritage Manager and Data Protection Officer 31/12/2023 Page 153
Page 154
APPENDIX 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Asset Register will be produced, and retentions, privacy notices and training all highlighted too. 5.03 In compliance with UK GDPR, an Information Asset Register should also be compiled and maintained on an ongoing basis. High Yes Records & Heritage Manager and Data Protection Officer 31/08/2023 5.04 A review of Privacy Notices held within Council services should be progressed and the documents made available on the Council website for public inspection. Medium Yes Privacy notices (PNs) are covered in the current DP Review, as the current PNs are updated or new PNs created they are made available on the Council's website. After the review this will be an ongoing process whenever a change in the data process Records & Heritage Manager and Data Protection Officer 31/08/2023 Page 154
Page 155
APPENDIX 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation occurs. 5.05 Consideration should be given to undertaking reviews within Services to audit compliance with the Data Protection Policy and Guidance. This should provide assurance that the Authority is effectively handling personal data in line with regulations. High Yes Current DP Review will assist this. Due to workload pressures, reviews will only be undertaken when investigating data breaches. Records & Heritage Manager and Data Protection Officer 31/08/2023 5.06 A review of the guidance documents and forms held within the Information Management section of the Interchange should be undertaken and updated accordingly. Low Yes When workload capacity allows, these guides are reviewed, updated and promoted. Records & Heritage Manager and Data Protection Officer 30/09/2023 5.07 A review should be undertaken of the officers that have not undertaken the data protection training on the LearnPro training system. Any officer identified should be reminded to undertake their data protection training requirement. High Yes Staff are reminded to do training via interchange news items and in response to data breaches. However, policing the completion of Records & Heritage Manager and Data Protection Officer 30/04/2023 Page 155
Page 156
APPENDIX 1 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation mandatory modules could be given a higher priority. 5.08 Consideration should be given to providing elected members with an update of actions undertaken to ensure the Council's compliance with data protection requirements. High Yes Agreed this should become a regular annual report. Records & Heritage Manager and Data Protection Officer 31/12/2023 Page 156
Page 157
Appendix 2 AUDIT REPORT 23'009 INFORMATION MANAGEMENT Executive Summary The annual audit plan for 2022/23 provides for an audit review of the systems and procedures in the management and security of adult social care information, including the transfer of information between the Council to NHS Grampian and other care providers. This review should also complement the recent audit undertaken regarding the Council’s compliance with the UK General Data Protection Regulation. Effective information controls within adult social care are particularly important due to the sensitive nature of information held concerning service users. In addition, the Council has duties under data protection regulations, and breaches of these regulations can result in substantial financial penalties being levied by the Information Commissioner’s Office. In recent years, discussions have been held with the internal audit providers for NHS Grampian, Aberdeen City and Aberdeenshire Councils. The intention has been to develop closer working relationships to better coordinate the audit planning process within social care. An audit of Information Management was agreed as the first step within this process. This has progressed well with a joint approach undertaken, especially within the Internal Audit Services of Aberdeen City, Aberdeenshire and Moray Councils. However, further to a recent communication, it has not proved possible for the NHS Grampian Internal Audit Provider to participate as a review by the Information Commissioner has taken precedence. The audit was carried out in accordance with Public Sector Internal Audit Standards (PSIAS). The review has highlighted the following areas for consideration:- • The Information Commissioner considers it is good practice to have a data sharing agreement when information is shared between two organisations. Data sharing agreements set out the purpose of the data sharing, cover what happens to the data at each stage, set standards, and help organisations involved in sharing to be clear about their roles and responsibilities. It was found that the data sharing arrangements for patient/ service user information between the Council and NHS Grampian are still based on a Memorandum of Understanding from 2011. Consideration should be given to agreeing on a Data Sharing Agreement between the Council and NHS Grampian to reflect the updated Data Protection Legislation. Item 9. Page 157
Page 158
Appendix 2 • A Data Protection Impact Assessment (DPIA) is an essential part of the Council's accountability obligations under the UK General Data Protection Regulation (GDPR). A DPIA is a process to help identify and minimise data protection risks. Information regarding adult social care service users are shared with approximately 80 care providers. However, it was found that only one DPIA had been completed regarding these data sharing arrangements. • The Council uses a software application to schedule visits for care workers to service users. Details held within this software include personal information concerning individuals receiving care. The software application is administered through desktop computers but with a facility to download information to a mobile device used by carers. Access controls were found to have been installed within the mobile devices; however no individual user login or password was required to access the desktop computers used for administering the software application. Page 158
Page 159
Appendix 2 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Arrangements are in place for secure handling of personal data. 5.01 Data Protection Impact Assessments (DPIAs) should be undertaken to determine whether additional safeguards need to be implemented where information concerning service users is shared with care providers. High Yes DPIAs are to be carried out on all processes, including for new contracts where data sharing is required with partners. Records and Heritage Manager, and, Data Protection Officer/ Commissioning Manager 31/12/2023 5.02 Assurances should be obtained that appropriate data protection training has been undertaken by NHS Grampian employed officers requiring access to Council administered databases. Medium Yes Arrangements to be put in place to confirm that Data Protection training has been received by NHS staff prior to being given access Information Systems Officer 31/03/2023 Page 159
Page 160
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation to Council systems. 5.03 Access to the Staffplan Software Application used to schedule visits by Care Workers to service users should require individual user login and password controls. Medium Yes Password Protection facility to be utilised for Staffplan office based access. Provider Services Manager 31/03/2023 5.04 Regular reviews should be undertaken to confirm the access requirement to the Occupational Therapy Stores Management System by NHS Grampian employed officers. Medium Yes Develop procedure for confirming current NHS staff access requirements to Council systems. Information Systems Officer 31/03/2023 Page 160
Page 161
Appendix 2 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Appropriate security controls operate within Information sharing arrangements 5.05 The Council and NHS Grampian should agree on an updated Data Sharing Agreement (DSA) for operational information concerning service users that includes the requirements of the current data protection regulations. Medium Yes Overarching Information Sharing Protocol with NHS Grampian to be updated and signed. Dedicated DSAs then to be completed for individual processes. Records and Heritage Manager, and, Data Protection Officer/ Commissioning Manager 31/06/2023 5.06 Contract compliance visits to care providers should include a review that appropriate systems are being followed to manage and ensure the security of service user information. Medium Yes Contract Monitoring checklist for external providers updated to include Information Management. Commissioning Manager Implemented Page 161
Page 162
Page 162
Page 163
Appendix 3 AUDIT REPORT 23’018 PAYROLL SYSTEM Executive Summary A payroll software application called iTrent is used to administer the payroll service. It was noted that approximately 5000 officer payslips are processed every month. The iTrent system has a dual function of meeting the requirements of two main service areas, i.e., payroll and human resources. This allows segregation of duties control to ensure a separation between the management process concerning officer appointments, terminations, grading and the processing of salary payments. The scope of the audit involved a review of the key controls in the management of the payroll service. As verification of the operational effectiveness of these controls, the audit reviewed systems and procedures and tested a random sample of salary payments and deductions. The Chartered Institute of Public Finance and Accountancy Control Matrices were used in the development of an audit programme. Further testing was also undertaken regarding access controls to the Employee Self Service System, where officers can amend their personal information, including bank details. The audit was carried out in accordance with the Public Sector Internal Audit Standards (PSIAS). The areas identified for management attention include the following:- • It is pleasing to note that an establishment listing exercise was undertaken in March 2022. This involved an email from the Human Resources Section to every budget manager to request confirmation or changes required to the names, grades, locations and salary details of officers recorded within their services. This exercise is an important control to confirm the accuracy of the payroll system. However, it was found where the budget manager had not replied, no further action was undertaken, or the issue escalated to a Head of Service. • It was noted that the Human Resources Section provides an occupancy end date report to budget managers of employees due to terminate their contract of employment the following month. This report reminds budget managers of the need to complete a “Termination of Employment” Form or update the employee's employment status. Analysis undertaken of the iTrent system found 252 individuals still recorded as officers of the Council, but where records indicate a termination in their employment status. Audit testing found the issue to be an administrative requirement to update officers’ employment status rather than a salary overpayment. The occupancy end date report provided to budget managers should be expanded to include employees recorded as officers of the Council but where records indicate a termination in their employment contracts. Item 9. Page 163
Page 164
Appendix 3 Recommendations Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation Key Control: Review internal controls as detailed within the CIPFA Control Matrices to ensure effective delivery of a payroll service. 5.01 Email requests to the Payroll Section to reset an officer’s access to their Employee Self Service Account should only be accepted from a Moray Council email address or a prior registered personal email account. High Yes In place Assistant Payroll Officer Completed 5.02 Officers should be reminded to record memorable information within their Employee Self- Service accounts. This will allow an additional level of system security to confirm identity before an officer can reset their password. Medium Yes Reminders to go into staff comms. via interchange and Connect Assistant Payroll Officer / Acting Senior Comms. Officer 28/02/2023 5.03 The Human Resources Section should undertake an annual exercise with budget managers to confirm the names, grades, locations and salary details of officers within their Service. High Yes Procedure has been updated re previous schedule (3 times per year) for issue, HR & Business Resources Team Leader Completed Page 164
Page 165
Appendix 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation process for non- responders and timeframe to action changes. 5.04 All budget managers should be reminded of the importance of confirming or advising Human Resources of any changes required to the establishment list reports of officers recorded within their services. If the budget manager does not respond, the issue should be referred to the appropriate Head of Service. Consideration should be given by Human Resources to allocate resource to ensure that any amendments highlighted by Budget Managers can be actioned as quickly as possibly following notification from the service. High Yes Covering email content updated to emphasise importance of completion, procedure updated to include indicative timescales to allow for planned allocation of resources to action any non- responses, escalation procedure for non-responses amended and escalation to Head of Service level if required. HR & Business Resources Team Leader 31/03/23 Page 165
Page 166
Appendix 3 Risk Ratings for Recommendations High Key controls absent, not being operated as designed or could be improved. Urgent attention required. Medium Less critically important controls absent, not being operated as designed or could be improved. Low Lower level controls absent, not being operated as designed or could be improved. No. Audit Recommendation Priority Accepted (Yes/ No) Comments Responsible Officer Timescale for Implementation 5.05 Occupancy end date reports issued to budget managers of employees due to end their employment with the Council the following month should be expanded to include all officers whose records indicate their employment contract has ended. The budget manager should advise the Human Resources Section of any changes required to the employment status of officers within their services. High Yes Report amended as recommended and procedures updated to escalate non responses to head of service. HR & Business Resources Team Leader Changes to report made. Updated procedures live from February 2023 Page 166
Page 167
REPORT TO: MORAY INTEGRATION JOINT BOARD AUDIT, PERFORMANCE AND RISK COMMITTEE ON 30 MARCH 2023 SUBJECT: CIVIL CONTINGENCIES - RESILIENCE STANDARDS PROGRESS BY: CORPORATE MANAGER 1. REASON FOR REPORT 1.1. To inform the Audit, Performance and Risk Committee of Health and Social Care Moray’s (HSCM) progress against NHS Grampian’s Resilience Improvement Plan 2019-21, and provide an overview of the work of HSCM Civil Contingencies Group. 2. RECOMMENDATION 2.1. It is recommended that the Committee: i) consider and note the contents of this report alongside the HSCM Civil Contingencies Group Action Plan (APPENDIX 1); ii) request an annual assurance report to this Committee from the HSCM Civil Contingencies Group; 3. BACKGROUND 3.1. Integration Joint Boards are categorised as Category One responders under the Civil Contingencies Act 2004 (Scotland), as per an amendment to the act in Scottish Parliament on 18 January 2021. This places requirements for the MIJB and HSCM to have mechanisms and plans in place to respond to incidents. 3.2. In May 2016, Scottish Government Health Resilience Unit (SGHRU) published the NHS Scotland Standards for Organisational Resilience (the Standards): this was subsequently updated, revised and a second edition published in May 2018. 3.3. The stated purpose of the 41 Standards is to “support NHS Boards to enhance their resilience and have a shared purpose in relation to health and care services preparedness in the context of duties under the Civil Contingencies Act 2004”. 3.4. Each Standard, of which there are 41, sets out: Item 10 Page 167
Page 168
• A statement of an expected level of resilience practice • A rationale/basis for the Standard (set within the context of statutory duties under the Civil Contingencies Act 2004 and other key legislation and guidance • A series of indicators/measures of what should be in place, or achieved, within/by the Health Board. 3.5. An assurance report was submitted to this committee on 31 March 2022 providing an update on progress against NHS Grampian’s Resilience Improvement Plan and provided an overview of the work of the HSCM Civil Contingencies Group, para 10 of the minute refers. 4. KEY MATTERS RELEVANT TO RECOMMENDATION 4.1. The impact of the Covid-19 pandemic on civil contingencies and partnership working across Health and Social Care Moray, Moray Council and NHS Grampian has been unprecedented. The HSCM Civil Contingencies Group continued to meet quarterly during the Covid-19 response to focus on key issues, identify training needs, monitor and manage risks and progress key actions. 4.2. Close working relationships with NHS Grampian and Moray Council continues with a focus on shared learning and disruptive event planning. The Corporate Manager represents HSCM on all Grampian wide emergency planning groups. 4.3. The HSCM Control room was established in March 2020 and has continued to operate for the purposes of emergency planning and response, providing a central point for receipt and distribution of essential communication and intelligence information. 4.4. The use of technology and in particular, the use of Microsoft Teams has allowed staff to fully engage with colleagues and participate in meetings with cross Grampian implications. It has also enabled incident response teams and control rooms to respond and stand up virtually. However, the use of technology on a daily basis also has implications for events that may result in loss of power or communications and this is being included in Business Continuity and Emergency planning. 4.5. Debriefs and lessons learned from Storm Arwen during November 2021 and Storm Malik and Corrie January 2022, continue to be discussed and implemented across all partners in Grampian. The recommendations from the Scottish Government report, published 28 October 2022, are being incorporated into resilience planning, where appropriate, across the health and social care partnership. 4.6. Much of this shared learning is co-ordinated through the Grampian Local Resilience Partnership (GLRP). The relationships with the other Health and Social Care Partnerships resilience teams and NHSG Civil Contingencies Unit, allows sharing of ideas, plans and support for debriefs. 4.7. The action plan (Appendix 1) is in place to support NHS Grampian’s Resilience Improvement Plan, to close the gaps and address areas of improvement in Moray, with assurance processes around these. The plan, overseen by HSCM Civil Contingencies group on behalf of the Chief Officer, is linked to each Standard and Page 168
Page 169
self-assessment level against each Standard is detailed. (Please see Appendix 2 for criteria for scoring the self-assessment). This plan will be updated in 2023 against the revised Standards. 4.8. The following actions have been identified for 2023: these are predicated on the ongoing maintenance of actions already achieved, identified risks and continuance of the supporting resilience processes and practice in place across the health and social care system: • Care for People (CfP) – Strategic document in final draft • Planning has commenced for a CfP Operational Plan. • Clarify roles and responsibilities for staff within HSCM and invocation of plans, both in hours and out of hours. • Review existing service Business Impact Analysis (BIA) and Business Continuity plans to ensure they reflect new ways of working. A programme for supporting service managers to review and exercise plans is in place. • Training gaps identified and action to address the gaps. • Continue to work closely with partners to share information and learning with other responders to enhance coordination and efficiency in responses, with any gaps in preparedness identified and incorporate into the action plan. • Persons at Risk Database (PARD) – data continues to be accessed via the Care First system to identify vulnerable people within social care. There is ongoing work across the 3 HSCP’s in Grampian to consider other available data, reporting back via the GLRP. 4.9. The Partnership are signed up to Page One, which is run by Police Scotland. It is the method of activating the GLRP. This was used during the storms of 2021/22. 4.10. NHS Grampian have been contacted by Audit Scotland to advise of their intention to carry out an audit of NHS Grampian’s Business Continuity arrangements. Whilst responding to the pandemic HSCM had to suspend testing and exercising of plans, however it is planned that a revised schedule will be agreed. 4.11. The Partnership’s Senior Managers on Call (SMOCs) continue with a 24/7 rota throughout the year. They are responsible for emergency response across HSCM. Review of these arrangements and training is under discussion. 4.12. Prior to March 2021, IJB’s were reliant on NHS Board and Council specialist advisors for support. Currently HSCM is represented by the Corporate Manager on all matters involving Civil Contingencies. Unlike other partnerships, HSCM does not employ a subject matter expert on this topic and this has been highlighted and placed on the Strategic Risk Register, with a High rating. 4.13. Persons at Risk Database (PARD) - a letter has been submitted to the Scottish Government on behalf of the three H&SC Partnerships in Grampian, highlighting the information governance issues that prevent the sharing of health data to identify vulnerable people in the event of an incident. It is important to note that there is no actual database as the name suggests. All three partnerships have to accept that there is risk meantime, that we are not sighted on all data. It is understood that this situation is a common theme in many of the H&SC Partnerships across Scotland. Page 169
Page 170
5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) and Moray Integration Joint Board Strategic Plan “Partners in Care 2022-2032” This report forms part of the governance arrangements of Moray Integration Joint Board; good governance arrangements will support the Board to fulfil its objectives. (b) Policy and Legal The Civil Contingencies Act 2004 outlines a single framework for civil protection in the UK. Part 1 of the Act established a clear set of roles and responsibilities for specified organisations involved in emergency preparedness and response at local level (known as Category 1 responders). Moray Council and NHS Grampian are also Category 1 responders. Sector resilience and preparedness is the responsibility of the Chief Officer. The Corporate Manager is responsible for acting as the point of contact for Moray and for driving forward all matters relating to civil contingencies and resilience within Moray, supported by HSCM Civil Contingencies Group and Moray Resilience Group. (c) Financial implications There are no financial implications associated with this report. (d) Risk Implications and Mitigation HSCM Civil Contingencies Risk Register is routinely monitored by the HSCM Civil Contingencies Group with actions and risks escalated to the system leadership group and senior management team as appropriate. (e) Staffing Implications There are no implications directly arising from this report. (f) Property There are no property implications arising from this report. (g) Equalities/Socio Economic Impact An Equality Impact Assessment is not needed as there is no change to policy or procedure. (h) Climate Change and Biodiversity Impacts None arising directly from this report. (i) Directions Page 170
Page 171
None arising directly from this report. (j) Consultations Consultation on this report has taken place with the Chief Officer, Chief Financial Officer, Ross Ferguson, Emergency Planning officer, Moray Council, Isla Whyte, Interim Support Manager and Lindsey Robinson, Committee Services Officer, Moray Council, who are in agreement with the content of this report as regards their responsibilities. 6. CONCLUSION 6.1. This report summarises the actions that are being progressed to ensure that HSCM meets the appropriate standards and establishes robust contingency arrangements to ensure critical functions can be maintained during disruptive incidents. Progress is being made but there are some areas that require attention and these are being prioritised by senior management. Without dedicated resource, there is a risk to MIJB that it may not fulfil all of its statutory duties as a Category 1 responder under the Civil Contingencies Act 2004. Author of Report: Sonya Duncan, Corporate Manager, March 2023 Background Papers: with author Page 171
Page 172
Page 172
Page 173
Moray Civil Contingencies Improvement Action Plan APPENDIX 1 Last Updated: 01/03/2023 To support the national standards ID Description Linked to Self Assess Level (see criteria on next page) Requirement RAG Status Action Required Evidence Owner Expected Completion Date Completion Date Progress update Proposed revised completion date 2 Governance Standard 2 2 Work plan in place to include training, review of plans, sector based exercising and participation in NHSG programme of exercising A Rolling programme of work to be reviewed and updated following COVID. SBAR sent to Chief Officer October 2022 and added to Risk Register Annual work plan agreed and in place. Interim Support Manager 31/10/2020 31/3/2021 1/3/23 Teams channel for Senior Managers on Call with emergency plans/details. All managers sent emergency response training. All online material circulated. Presentation to all managers regards power outages with supporting resources. Offer to exercise BC plans sent to all managers. 31/03/2023 3 Business Continuity Standard 7,8 2 a) HSCM to have up-to-date, effective Business Continuity (BC) / contingency plans for all prioritised services and functions. b) HSCM to have an overarching BC Plan with agreed list of critical functions/services. A Critical functions list agreed during COVID response. Overarching plan to be completed A) Services have up to date plans in place b) Critical functions approved and overarching BC plan in place and agreed by Systems Leadership Group (SLG) a) Service Managers b) Corporate Manager 11-Nov-22 07-Nov-22 a) 1/3/23 ongoing review of BC plans and some tabletop talk through of plans. Additional resources provided to teams for Power Outages. Workshops provided for Primary Care Contractors to support BC planning for power resilience. b) no longer required , agreed to follow NHS Grampian Business Continuity Management as per discussion with NHSG CCA (7/11/22) 30/03/23 30/09/23 4 Specific needs of Children in MI & BC planning Standard 10 2 The specific needs of children and young people to be addressed in all relevant Major Incident and Business Continuity plans, and ensure that its responses / interventions are sensitive to their needs A Sectors to develop model for engagement of Children's social work services in Resilience Groups Engagement of Children's social work services in resilience planning Systems Leadership Group 31-Dec-22 31-Mar-23 1/3/23 Childrens and Families will formally integrate in April 2023. During the shadow period C+F have been included in all resilience planning including Care for People. The Strategic document is now being presented to both Moray Council and HSCM for approval. Discussions have taken place with Childrens services regards their PARD data. 31/03/2024 7 Pandemic Influenza Standard 16 2 NHS Board shall develop and review its Pandemic Influenza Plan jointly with local partnerships and RRP, and seek their endorsement. A joint multi- agency plan shall be developed, if one does not already exist. A Review of documents and updating where necessary. Completion and sign off MID/Pandemic Flu response plan detailing integrated health system response to MID/Pan Flu, and setting out links to RP response HSCM Civil Contingencies Group 31-Mar-23 To be taken forward with NHSG and LRP Health liaison group. Date to be advised. 7/11/22 currently waiting for pandemic enquiry response, other policies/documents likely to follow to inform the new proposed documents - discussed with NHSG CCU Lead. annual 8 Pandemic Influenza Standard 17 2 Link with NHSG Board in exercising Pandemic Flu plan every 3 years A Grampian wide health and social care system pandemic table top exercise. Exercise documentation and records of attendees. Post exercise report with lessons learned. HSCM Civil Contingencies Group 30-Sep-22 31-Mar-23 Linked to number 7 above. 7/11/22 Pandemic response supersedes all exercise plans and will be reviewed by NHSG and all partnership agencies. Local lessons learned have been identified and 30/09/2023 10 Information Security and ICT Resilience Standard 31 3 BIA/Recovery plans reviewed for IT and Communications G Review and update list of critical ICT requirements following changes to working practices as a result of COVID and advise NHSG EHealth and Moray Council accordingly. BIAs updated and held centrally. Critical functions list agreed. NHS eHealth and Moray Council informed of requirements. HSCM Civil Contingencies Group 31-Jan-23 1/3/23 NHSG and MC monitor IT security systems and potential risks. NHSG introducing 2 factor security. NHSG to audit supplier systems also to reduce risk. ongoing 23/03/2023 C:\Program Files (x86)\neevia.com\docConverterPro\temp\NVDC\D407BCFE-72F4-4BBE-84A8-12395E435753\af48b364-e7fa-4b1f-b785-52b99eff7703 Item 10 Page 173
Page 174
11 Supply Chain Resilience Standard 39 2 BIA/Recovery plans reviewed for suppliers A Define list of critical suppliers and ensure risk assessment mitigation measures are in place. NHSG Board to be informed. BIAs updated and held centrally. Critical functions list agreed. Risk assessment completed with actions to mitigate detailed. NHSG and Moray Council 31-Dec-22 1/3/23 NHSG eHealth to start incorporating BC as part of supplier commissioning. Fuel planning considered as part of power outage work. ongoing 12 (Surge) Winter Plan Standard 18 4 Sectors shall have robust Winter Plans and implement a range of actions to enhance resilience during winter period. G Review and update plan - short term working group to be established. Winter plan in place and action plan in place. Part of Grampian's year-round planning cycle and participation in joint planning, table top exercises and debrief exercises. Systems Leadership Group 31-Mar-23 30-Nov-22 1/3/23 Additional support provided for power outages. Following each storm event plans are revisited. 31-Mar-23 13 Major Incident /Resilience Plans Standard 9 2 NHS Board shall have Major Incident or resilience plans that reflect its emergency preparedness. Sectors to sign off plan. Through HSCP, GP / Primary Care made aware of their role in the Major Incident Plan and expectations of them. A Take final NHS Board plan to SLG and HSCM CC Group for discussion and sign off. Grampian plan signed off and partnership working with primary care in place. Systems Leadership Group 31-Mar-23 1/3/23 NHS G plan currently being updated. 30/09/2023 14 Training Standard 12 1 Training gaps identified: - who needs to be trained and in what course / session A A locally delivered Civil Contingencies programme of training courses for HSCM managers and staff to be identified and implemented NHSG Civil Contingencies Unit (CCU) training programme in place and dates communicated to SLG Interim Support Manager 31-Mar-23 1/3/23 Loggist and Chair training provided by NHSG CCU. Support provided by HSCM Corporate team around BC. ongoing 15 Care for People Standard 38 1 Establishment of the care for people plan and supporting framework for implementation, including clarification of roles and responsibilities for partner agencies G Using revised C for P plan from Aberdeen City as basis update for Moray, communicate widely across partnership. Resurrect regular Care for People meetings Strategic Care for People document submitted for approval. Draft delivery plan in place. PARD /mechanism for identification of vulnerable people at risk in place. Care for people and PARD meetings taking place regularly and plans exercised Corporate Manager/Head of Service / CSWO/ 31-Mar-23 1/3/23 Strategic document submitted to HSCM SMT for approval. Plan to do exercise for delivery plan. 30-Jun-23 16 Category 1 Responder / Organisational Resilience Standard 5, 13 2 Civil Contingencies- Report to Discharge duties of Cat 1 Responder to CO Actively participate in Local and Regional Resilience Partnerships. Programme in place to assess, mitigate or manage resilience risks. A IJBs included within the Civil Contingencies Act 2004 as Category 1 responders, effective 18 March 2021. Report to IJB 24/11/22 to highlight the risk to the IJB not delivering its full responsibility without subject matter expert. Managers are participating in the appropriate forums and working closely with colleagues in the LRP, Moray Council and NHS Grampian to ensure that necessary communication channels and protocols are in place for response action and that plans are in place, and exercised collaboratively. Where any gaps in preparedness are identified they will be incorporated into the action plan. Moray Integrated Joint Board ongoing 1/3/23 Report to MIJB (24/11) highlighting risk to IJB not employing Civil Contingencies subject matter expert to discharge Cat 1 duties. Also on Strategic Risk Register as High Risk. 31/10/2023 23/03/2023 C:\Program Files (x86)\neevia.com\docConverterPro\temp\NVDC\D407BCFE-72F4-4BBE-84A8-12395E435753\af48b364-e7fa-4b1f-b785-52b99eff7703 Page 174
Page 175
Appendix 2 Self-assessment level The table below explains the self-assessment levels used against each NHS Scotland Standards for Organisational Resilience (the Standards). The assessment level determined for each action is shown in Appendix 1 Level 1 – Planning • Benchmarking against ‘Action’ undertaken and analysed • Planning arrangements have been initiated • Local improvement plan to meet standard developed and forms integral part of Health Board’s Resilience Committee’s work plan. Level 2 – Implementing • Resilience Committee / Resilience Exec Lead tasked to progress ‘Action’ • Implementation plan and methodology agreed • Collating appropriate information to monitor delivery of ‘Action’ • Some evidence of ‘Action’ being delivered. Level 3 – Monitoring • ‘Action’ implemented consistently and geographically across Health Board • Agreed process in place and being reviewed over time • Associated learning and improvement planning in place to ensure delivery of standard. Level 4 – Reviewing • ‘Action’ has been mainstreamed into existing services • Quality assurance and performance management established to review ‘Action’ on an on-going basis. Item 10 Page 175
Page 176
Page 176
Page 177
REPORT TO: MORAY INTEGRATION JOINT BOARD AUDIT, PERFORMANCE AND RISK COMMITTEE ON 30 MARCH 2023 SUBJECT: EXTERNAL REVIEW OF COMMISSIONED SERVICES UPDATE BY: TRACY STEPHEN, CHIEF SOCIAL WORK OFFICER 1. REASON FOR REPORT 1.1. To inform the Committee of the findings and action plan relating to the external review of the adult Commissioning Service. 2. RECOMMENDATION 2.1. It is recommended that the Audit, Performance and Risk Committee: i) consider and note the findings of the external review included in APPENDIX 1; and ii) agree the improvement actions included in APPENDIX 1. 3. BACKGROUND 3.1. A peer review exercise was completed by Aberdeen City and Aberdeenshire Councils Shared Services (Commissioning) in December 2021 on behalf of Health & Social Care Moray (HSCM) to provide evidence and assurance that the commissioning of adult services by the Commissioning Service were robust, appropriate, equitable, efficient and provided value for money for the population of Moray. 3.2. The report findings were not accepted by the CSWO (Chief Social Work Officer) and Head of Service in post at that time and an external review was agreed as a way forward by Audit, Performance and Risk Committee on 31 March 2022 to gain a definitive perspective on the challenges experienced by the service and how improvements could then be made (para 11 of the minute refers). 3.3. KPMG were appointed to complete the external review and they completed that process in February 2023. Item 11. Page 177
Page 178
4. KEY MATTERS RELEVANT TO RECOMMENDATION 4.1. The report has been shared with the Commissioning Team and appropriate conversations have happened between the team and KPMG to reach a final agreed position which is reflected in the report. 4.2. An action plan has now been created to achieve the agreed outcomes and monitor progress, with support from the CSWO and Head of Service now in post. The team are committed to achieving the outcomes set out in the report and steps have already started towards achieving improvements. 4.3. There are some risks to achieving the set timescales due to staffing implications and related restructuring that has taken place following the external review. The CSWO is looking at the capacity issue and how that risk can be mitigated using interim support. There is also a significant amount of remedial work needed to update contracts and ensure that best value is being achieved. 4.4. Progress on the actions will be reported back to Audit, Performance and Risk Committee on a quarterly basis. 5. SUMMARY OF IMPLICATIONS (a) Corporate Plan and 10 Year Plan (Local Outcomes Improvement Plan (LOIP)) and Moray Integration Joint Board Strategic Plan “Partners in Care 2022 – 2032” In order to fulfil the MIJB strategic aims, it is essential that services are operating with optimum efficiency to ensure the needs of the Moray population can be met, that services are fit for purpose and that processes and accountability is clear. (b) Policy and Legal The CSWO/Head of Service must ensure that services delegated by her work within the legal and policy framework related to commissioning and delivery of services. (c) Financial implications There are no financial implications arising from this report. (d) Risk Implications and Mitigation There is a risk that timescales and outcomes may not be reached due to the current resource and restructure of the team, although, efforts will be made to minimise this risk. (e) Staffing Implications There are no staffing implications (f) Property There are no property implications (g) Equalities/Socio Economic Impact This report does not require an EIA. Page 178
Page 179
(h) Climate Change and Biodiversity Impacts None (i) Directions None (j) Consultations Not required 6. CONCLUSION 6.1. The committee is requested to agree the improvement plan at APPENDIX 1. Author of Report: Tracy Stephen, CSWO and Head of Service Background Papers: Ref: Page 179
Page 180
Page 180
Page 181
Social Care Commissioning The Moray Council: The Moray Health and Social Care Partnership KPMG Governance, Risk & Compliance Services February 2023 APPENDIX 1 Item 11. Page 181
Page 182
2 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Content Distribution list For action: Simon Bokor-Ingram, Chief Officer of Health and Social Care Moray Tracy Stephen, Chief Social Work Officer and Head of Service For information: Audit & Scrutiny Committee Report status Closing meeting: 27 October 2022 Draft report issued: 10 November 2022 Updated draft report issued: 14 February 2023 Final report issued: 23 February 2023 01 Executive summary 3 02 Findings and management actions 6 03 Appendices 19 Sample testing Analysis of commissioning database Scope extract Acknowledgments Rating definitions Page 182
Page 183
3 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 3 Acknowledgements We would like to thank the following individuals for their contribution during this internal audit: — Key individuals involved in our work are acknowledged at Appendix D. 01 Executive summary Conclusion We have performed a review of social care commissioning within Health and Social Care Moray (‘HSCM’). Our review assessed the design of controls in place, as well as their operating effectiveness in order to determine the suitability of internal procedures, the application of these procedures and whether the approach taken to commissioning aligns with best practice. In order to make this determination our work included, but was not limited to, sample testing of contracts with providers, invoices and governance meeting minutes. The delivery of social care is led by the commissioning team, but is supported by other functions across the Council including finance and procurement. Our review included meetings with staff from across these areas. We have raised 11 key findings relating to governance, roles and responsibilities, strategy/processes and contract management. We have rated six of these findings as high-level (red), four as mid-level (orange) and one as low-level (green). Governance There is not a clear structure for the escalation and oversight of commissioning issues. We specifically note that Commissioning Manager meetings have not been held since February 2022. Such meetings should act as a forum to monitor commissioning activity and provide oversight on the efficient resolution of issues. Our review of the governance arrangements in place can be found in Finding 2.1 and Appendix A . Roles and responsibilities The overarching role of the Council’s Commissioning provision should be to provide services that meet the needs of users. This means that commissioning activity must evolve to meet needs and new contracts may need to be procured. Therefore, commissioning encapsulates a number of Council areas (e.g. Commissioning Team, Procurement, etc), so it is important that staff understand the gaps for which they are responsible to ensure functional working relationships (Finding 2.2) . As per Finding 2.3 , we identified a need for staff training which would assist in communicating job Priority rating: Control design Operating effectiveness 2 4 3 1 1 0 High Medium Low Summary Page 183
Page 184
4 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Contract management We applied data analytics to the contracts database and found it to be only 78.71% complete due to a number of fields being left blank. We found out of date contracts within the database dating back as far as 2004. We have included details of this analysis in Finding 2.8 and Appendix B. Failure to keep the central contracts database up to date creates a risk to monitoring activities as contracts may be omitted from monitoring plans and/or incorrectly included. The Council has a Senior Performance Officer responsible for rolling out performance management frameworks across the Council. However, Commissioning is yet to benefit from such a framework and we were not able to obtain information relating to timelines for implementation. Delays pose a risk that there is inadequate oversight of performance at a team level. When rolled out, the framework should include suitable KPIs to measure performance (Finding 2.9) . The contract review process (Finding 2.10) is not capable of sufficiently monitoring contract compliance as it is currently only conducted periodically. Providers should be subject to more frequent, in -depth reviews that evaluate compliance with legal and regulatory standards as well as other contractual terms. This will ensure that the Council has working relationships only with compliant organisations, upholding the Council’s overall credibility and reputation. Block contracts are currently being used, however we understand that a transition away from such arrangements is in progress. The operation of block contracts require detailed tracking and monitoring in order to be managed well, however we have not found this to be the case. The Council should endeavour to complete the transition as soon as possible (Finding 2.11) . Executive summary descriptions to staff and signposting sources of guidance and escalation should the need arise. Training would also reinforce the Council’s standard operating procedures and improve adherence to such procedures Strategy & processes There is no documentation setting out the commissioning and decommissioning process, including the lack of a policy document relating to how services should be procured and managed under the Self-Directed Support (‘SDS’) framework (Finding 2.4). Our testing of a sample of 13 contracts with providers and 25 invoices demonstrated further shortcomings in contract documentation. For example, we were unable to obtain four of the sampled contracts and 15 of the sampled invoices due to insufficient audit trails which will have further implications in terms of future planning. Without complete documentation, there is a risk that staff are not following formal Council policies and procedures. The findings from our sample testing are further detailed in Finding 2.5 and Appendix A . The ‘Moray Partners in Care’ strategy, formulated by Moray Council, is a strategic plan covering the next 10 years. Although we identified a clear direction within the strategy, there are no clear targets, KPIs or milestones against which the Council can hold itself accountable. A delivery plan for the strategy is currently being developed and should be implemented as a priority to ensure the strategy is being followed (Finding 2.6) . Robust controls in invoicing ensure that expenditure is incurred appropriately, however we observed that controls are not applied consistently as they are not formally documented. For example, the 15 minute variance for billed care time and expected care time set by the Finance team has not been formalised. Furthermore, if the invoices cannot be agreed to the underlying contract, queries are raised without retaining any evidence, leading to undocumented decision making (Finding 2.7) . Page 184
Page 185
5 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Executive summary Summary of key findings Governance structure 2.1 The Council should prioritise having senior oversight to close the gap between the organisation and those charged with governance, as there is currently an insufficient grip on governance. Team structure and roles 2.2 There is a lack of clarity around roles and responsibilities, and poor cross-organisational relationships. Strategy 2.6 The Council does not have a clear strategy for the Health and Social Care Commissioning Division, supported by KPIs and milestones. Process documentation 2.4 The Council has not documented the processes around commissioning and de-commissioning. Invoicing 2.7 Financial controls around the invoicing processes are inconsistently applied. Contracts register 2.8 The Council should develop a centralised contracts register to ensure there is adequate oversight over contracts held, including their value and date. Performance management system 2.9 The Council should prioritise the development of a performance management system in commissioning. Sample testing 2.5 Our sample testing identified a number of issues relating to missing documentation and inadequate audit trails. Contract review 2.10 Contracts are currently subject to an annual review but there should be more regular review. Block contracts 2.11 The Council should ensure there is adequate monitoring of block contracts to ensure greater accuracy of billing. Training 2.3 A lack of training for staff has contributed to confusion as to what is expected of different teams. Contract management: Roles and responsibilities: Strategy & processes: Governance: Page 185
Page 186
6 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 6 02 Findings and management actions Governance 2.1 Governance structure The Council should prioritise having senior oversight to close the gap between the organisation and those charged with governance, as there is currently an insufficient grip on governance. The provision, management and oversight of health and social care delivered in Moray is governed by the Integration Joint Board (‘IJB’). This forms part of the wider governance structure, which is presented in more detail in Appendix A. Our review identified that currently, there is no clear structure for the escalation and oversight of issues relating to Social Care Commissioning. As part of our review, we also reviewed minutes for a number of meetings: Systems Leadership Group Meetings (leadership) – Commissioning was not discussed at leadership level as it was not on the agenda, nor was there commissioning representation. Senior Management Team Meetings (management) – There was a standing agenda item in each of these meetings labelled ‘Gaps in Social Care Provision’ where those with oversight of commissioning provided an update. – However, we noted three meetings where social care was insufficiently addressed, as discussion lacked depth and detail. On a further three occasions, the standing item was not discussed. This means that the opportunity to extract constructive actions from these meetings relating to commissioning is not utilised. Commissioning Group Meetings (operational) – Commissioning Manager Meetings are held on a roughly quarterly basis. It was agreed that action plans for each Commissioning Manager Meeting would be created, however this has not yet been done. Continued… High Page 186
Page 187
7 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.1 Governance (contd.) Risk: There is inadequate central oversight of billing and budgeting in relation to contracts. Expenditure related to contracts is not appropriately authorised, in line with Standing Financial Instructions. The Council has insufficient governance in place to successfully plan, commission and manage contracts with the highest complexity, cost and risk. Agreed management action: 1. As per guidance issued by the Sottish Government, the IJB Terms of Reference should be revised to include clear roles and responsibilities in relation to the management and oversight of all social care commissioning activities. 2. The Council should clarify the expectation around attendance at meetings and attendance should be reported at least part-publicly. Deputies attending should have the delegation to make decisions on behalf of their superior. 3. The Council should prioritise the production of action plans for each Managers Commissioning meeting. These should clearly set out the action, responsible individual and due date for completion. Progress against the action log should be monitored at each meeting. Evidence to confirm implementation: Reviewed Terms of Reference. Communications to senior management regarding manager meeting intentions. Proposed template action logs. Responsible person/title: Service Manager Target date: 1. 31st August 2023 2. 29th February 2024 3. 31st May 2023 Findings and management actions High Page 187
Page 188
8 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Roles and Responsibilities 2.2 Team structure and roles There is a lack of clarity around roles and responsibilities, and poor cross-organisational relationships. The overarching role of the Commissioning function is to provide services that meet the needs of end users. To achieve this, services must evolve according to the changing needs of service users, which is not currently possible due to blurred lines of responsibility acting as a barrier to collaborative working. Adapting alongside changing user demands may include the procurement of new contracts. This therefore incorporates a number of teams into the overall commissioning process, such as Procurement and Finance. Through our discussions with staff from across the different areas of the Council, we found that there was a lack of clarity around which teams are responsible for which parts of the commissioning process. The absence of guidance around the commissioning and de-commissioning process also exacerbates the confusion around roles and responsibilities (see Finding 2.4 ), as staff are not assigned specific responsibilities. This lack of clarity, combined with a lack of communication has exposed the Council to risks where core tasks relating to the commissioning process have not been completed as expected, because the responsible staff member did not complete the task in time. We found that teams do not work together, and fractured relationships pose a direct challenge to the effective and efficient completion of tasks. Determining roles and responsibilities requires the council to first review its commissioning structure, including the aims of the commissioning division and how these will be met, and how other teams across the council engage with the commissioning process (if required). Once an effective framework has been established, the council can then use this to re-communicate the roles and responsibilities of the different teams and individuals which sit within and alongside the commissioning function. This process will ensure that the goals are clear and are aligned on both an individual and a higher level. Risk: Roles and responsibilities are not clearly set out and allocated, resulting in inadequate completion of tasks. Continued… Findings and management actions High Page 188
Page 189
9 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.2 Team structure and roles (contd.) Agreed management action: 1. The Council will develop clear job descriptions for each role, which set out the responsibilities of the individual. These job descriptions will be shared with staff on commencement of a role, and will be made available for future reference. 2. The opportunity and scope for collaboration across the various Council teams will be explored so that the Council can benefit from shared learning and increased efficiency. 3. As part of the wider performance management process, staff will be held accountable for their roles. If tasks are not completed as expected, the reasoning behind this should be explored and appropriate action taken to avoid the chance of a recurrence. Evidence to confirm implementation: Clearly defined job descriptions. Revised approach to collaborative working. Clearly defined controls to link performance management and accountability for job roles. Responsible person/title: Service Manager Target date: 1. 31st May 2023 2. 31st August 2023 3. In place Findings and management actions High Page 189
Page 190
10 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.3 Training A lack of training for staff has contributed to confusion as to what is expected of different teams. Finding 2.2 notes that there is a lack of clarity around the roles and responsibilities of different teams, meaning expectations of each of the teams involved in the wider delivery of social care are not sufficiently understood. As part of the move towards a new single service under ‘The National Care Service’, the training that HSCM provides should include an ‘awareness raising’ arm. This will set out exactly what the service is aiming to achieve, what is required of different teams and job roles, as well as how this should be performed in accordance with the Council’s policies and standard operating procedures. Training would also provide an opportunity to signpost sources of guidance and escalation where staff feel it necessary. Ideally, training would be followed up by a series of guidance documents to be referred to should instances of uncertainty later arise. Risks: Council staff involved in commissioning are not consistently complying with the Council’s policies and procedures. Roles and responsibilities are not clearly set out and allocated, resulting in inadequate completion of tasks. Agreed management action: 1. Implement a clearly defined staff training plan, supported by a series of readily- available guidance documents. Evidence to confirm implementation: Staff training plan. Responsible person/title: Team Manager Target date: 31st August 2023 Findings and management actions Medium Page 190
Page 191
11 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Strategy / Processes 2.4 Process documentation The Council has not documented the processes around commissioning and de-commissioning. Our review identified that there is no documented process in place which clearly sets out the commissioning and de-commissioning process. Self-Directed Support (‘SDS’) A number of contracts are procured under the SDS framework, which has its own set of rules and regulations. The Council does not have a policy / document in place which sets out how services should be procured and managed under the SDS framework. Currently, invoices received under SDS option 2 are sent to the commissioning manager for approval. This is in the process of changing as the invoices should be signed off by the budget holder to be in line with the Council's financial regs. The Council should prioritise this alignment to financial regulations. Risk: Staff are unaware of what is required of them. Steps in the commissioning and decommissioning process may be omitted, exposing the Council to risk around incomplete contract terms. Agreed management action: 1. The Council will develop and document a clear end-to-end process, which sets out each of the steps of both the commissioning and decommissioning process. 2. All staff involved in commissioning will be provided with training around this process, and details of the process will be made available to staff for future reference. 3. Prioritise alignment with SDS financial regulations. Evidence to confirm implementation: End-to-end process document for commissioning and decommissioning. Training programme. Progress report as to the alignment with SDS financial regulations. Responsible person/title: Service Manager Target date: 31st August 2023 Findings and management actions High Page 191
Page 192
12 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Findings and management actions (cont.) High 2.5 Sample testing Our sample testing identified a number of issues relating to missing documentation and inadequate audit trails. We have presented the detailed results of our sample testing in Appendix A. Contracts We took a sample of 13 contracts under social care commissioning arrangements and reviewed whether each contract was in date, sufficiently approved and agrees to the contracts database. We identified the following issues: – We were unable to obtain documentation for four contracts in our sample, suggesting an insufficient audit trail has been maintained, and we confirmed that there was no contract in place for a further one. – There were five instances where contracts signed by the contracting party were not retained on file, these were only signed by the Council. – We were unable to confirm that five contracts were still in date, due to either no end date information or conflicting contract clauses. – We were unable to reconcile any of the contract values to the value as per the contract database as different costing information was used (e.g. per resident per week, total value, etc). – It was only possible to reconcile end dates to the database for one contract as variations to contract end dates were not accounted for in the database. – There were four contracts where the respective contract numbers were not reflected in the contracts database. Invoices We selected a sample of 25 invoices from a listing of all transactions which had been incurred by the Council. For each item in our sample, we attempted to verify the invoice and underlying approvals of the transaction. We identified the following issues: – For 15/25 items in our sample we were unable to view the invoice. This was because management was unable to tie back the transactions in our listing to individual invoices. – We were unable to confirm that any invoices in our sample had been sufficiently approved prior to payment. This was due to the Council not retaining any evidence relating to this approval. Continued… Page 192
Page 193
13 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.5 Sample testing (contd.) From the results of our sample testing, we identified three key areas for improvement: – Audit trails: as per our findings, we were unable to obtain documentation relating to both contracting and invoicing. This indicates that thorough audit trails are not maintained. Documentation should always be obtainable so that expenditure can be easily identified and monitored. – Contracts database: the database is not subject to ongoing updates to reflect contract expirations or extensions. It is also not possible to reconcile contract values with the database due to an inconsistent approach. We have expanded on this in Finding 2.8 and Appendix B . – Approvals:the Council should have a robust approvals process in place, which can be documented and applied consistently. However, for the samples we tested we were unable to confirm that approvals were sufficient and were not capable of being construed as approvals, often not even containing the word 'approved'. To be in line with best practice, the approvals process should ensure there is segregation of duties. For example, we noted that one invoice was received and 'approved' by the same member of staff. Risk: Inefficiencies in commissioning may lead to delays in the overall procurement process, thereby increasing costs to the Council and delaying commencement of the services. Insufficient internal checks are performed at the Council, which fail to identify deficiencies or gaps within the processes around commissioning. Council staff involved in commissioning are not consistently complying with the Council’s policies and procedures. Agreed management action: 1. All contracts will be signed, and copies of these signed contracts stored for future reference. 2. The Council will explore the possibility of adjusting the reporting system such that expenditure listings can easily be tied back to the underlying invoice. 3. Invoices will not be processed without adequate approval. 4. The Council will consider introducing spot-checks and/or audits of documentation, to ensure that processes are consistently being followed across the organisation. Evidence to confirm implementation: Updated and approved process documentation that clearly sets out the requirements. Signed, dated and approved contracts. Consideration of changes to system. Spot checking process. Responsible person/title: Service Manager Target date: 28th February 2025 Findings and management actions (cont.) High Page 193
Page 194
14 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.6 Strategy The Council does not have a clear strategy specifically for the Health and Social Care Commissioning Division, supported by KPIs and milestones. Moray Council has a ‘Moray Partners in Care’ strategy, which was approved and issued in 2019. This strategy sets out the strategic plan for Health and Care for the next 10 years, across Moray. The strategy covers three broad themes: 1. Building Resilience 2. Home First 3. Partners in Care While the strategy provides a good over-arching understanding of the Council direction, the strategy does not provide sufficient detail on how the Health and Social Care Commissioning department can achieve the transformation required. This means that the strategic intent has been articulated, but this has not been operationalised. For example, the outcomes noted are not supported by clear targets, supporting KPIs and milestones for the division to hold themselves against, and this strategy is not underpinned by a delivery plan. We note that the Council is currently in the process of developing a delivery plan for this strategy, which should clearly set out guidelines for how staff at the Council can deliver on the requirements of the strategy. Risk: The Council’s Health and Social Care Commissioning Division lacks direction, and is unable to support the wider Council in achieving its aims. Agreed management action: 1. The Council will develop an implementation plan which supports the wider strategy. This implementation plan will clearly set out the goals for the Council, how these will be achieved and the method for monitoring the success of this strategy. Evidence to confirm implementation: Implementation plan incorporating the considerations in our recommendation. Responsible person/title: Head of Service Target date: 29th February 2024 Findings and management actions (cont.) Medium Page 194
Page 195
15 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.7 Invoicing Financial controls around the invoicing processes are inconsistently applied. Robust financial controls in the invoicing process are vital to ensuring that expenditure is incurred appropriately, in line with the Council’s Standing Financial Instructions (‘SFIs’). The responsibility for complying with financial controls lies with the finance team as opposed to the commissioning team. Financial control processes are not documented, and therefore controls are not applied consistently. Our review identified the following issues: Variances There is no set limit at which any variances on invoices received are subject to further investigation. Although the finance team has informally set an acceptable limit of 15 minutes for billed care time and expected care time, there is no formal documentation to support this as a limit. Queries When the invoicing team are unable to agree invoices received to underlying contracts, queries are raised with the social commissioning team if it relates to a contract or with the social worker who raised the invoice if it relates to a one-off payment. Although an explanation is sought for the variance, the team does not retain any evidence. Risk: The Council could be incurring additional cost by paying invoices for inappropriately raised bills. Without an adequate audit trail, invoices could be processed which do no meet the Council’s needs. Agreed management action: 1. The Council will formalise and document its approach to variances. 2. Staff will ensure that all evidence is retained throughout the invoicing process, to ensure that there is an adequate audit trail for all decisions made. Evidence to confirm implementation: Revised approach to variance analysis. Document retention guidance. Responsible person/title: Head of Service Target date: 29th February 2024 Findings and management actions (cont.) Medium Page 195
Page 196
16 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Findings and management actions (cont.) High Contract Management 2.8 Contracts register The Council should develop a centralised contracts register to ensure there is adequate oversight over contracts held, including their value and date. The Council holds contracts with different providers who are responsible for the delivery of social care to the residents of Moray. We requested copies of a contracts register in order to complete our testing, however the majority of staff we interviewed were unfamiliar with the contracts register and did not believe one was in place. For the purpose of sample selection, we therefore relied on a listing of all 175 suppliers with whom transactions had been raised by the Council, provided by the Procurement department, and a listing of 59 contracts provided by Commissioning. Through further investigations, we found that the Council holds a Commissioning Database, which acts as the Contracts Register. This database includes key details related to each contract, including dates, values and responsible individual for each contract. We performed data and analytics routines (see Appendix B ) over this database and identified a number of issues. Procurement maintain its own contracts register, encompassing all Council contracts and not just commissioning. However, the extent to which commissioning information is accurately presented in this register depends on the effectiveness of communication between teams. This is something we have touched on in Finding 2.2. Incomplete Fields Overall, we identified 575 blank entries out of a possible 2,701, suggesting that the database is, at most, 78.71% complete. 49.49% of budget details and 12.33% of contracting party details were incomplete. The database contained 73 contracts in total, while the listing of contracts provided by Commissioning which we used to select our sample contained 59 contracts. Through our discussions with management, we were informed that commissioning officers are not always aware of all the details relating to their contracts, as these have not been formally recorded. This results in reputational risk if commissioning officers reach out to contracting parties to ask them to confirm the details, as well as exposing the Council to the risk that they will be held to terms which they have not agreed, and are not in line with regulations. Continued… Page 196
Page 197
17 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.8 Contracts register (cont.) Out of date contracts Our data and analytics routines identified that 21.92% of contracts on the database had start dates prior to August 2012, so related to contracts more than 10 years old. 43 contracts included on the database had expired, with 38 of these having expired prior to August 2020. Through discussions with management, we were informed that contracts often reach their expiry date, and the Council is forced to roll contracts over, or continue their operation. Data Quality Our review of the contracts database found that information entered was of varying quality. For example, information was not consistently formatted and additional comments were included for some categories. Risk: There is no central oversight of contracts held. Contracts are omitted from the register and therefore not subject to the appropriate level of monitoring and review. Without a central contracts register, there is the risk that contracts expire without the Council being aware, or irregular monitoring results in the Council failing to re-tender for contracts in time, increasing use of single tender waivers and contract extensions. Budgeting or monitoring spend cannot be achieved effectively, if there is insufficient grasp of current contracts. Agreed management action: 1. Health and Social Care Moray should prioritise the development of an expenditure contracts database, which clearly sets out their expenditure and details of the agreements they hold. 2. Once established, this database should be monitored, reviewed and routinely updated to ensure that all data is accurate and of a high quality. There will be clear ownership of the contracts register, and as part of the review process these registers should be scrutinised by senior management. 3. The Contracts database will be shared and made available to all staff involved in the commissioning process, such as the procurement team. Evidence to confirm implementation: Updated contracts database reflecting the true state of commissioning within the Council. Responsible person/title: Service Manager Target date: 31st August 2024 Findings and management actions (cont.) High Page 197
Page 198
18 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.9 Performance management system The Council should prioritise the development of a performance management system in commissioning. Contracts should be subject to regular performance review to ensure the quality of work needed is delivered to end service-users. Without a sufficient performance management system, there is a risk that the quality of services is compromised. Currently, performance management is done solely on a contract basis by the senior commissioning officers. The Council has a Senior Performance Officer, in post since November 2021 whose role includes rolling out a performance management framework and system across the Council. This has not yet been done for Commissioning, and there is no timeline in place for when this will be implemented. Risk: Without a performance management system, there is inadequate oversight of performance at a team level. Agreed management action: 1. The Council will prioritise rolling out a performance management system. This framework, when rolled out, will look at performance management on a team-wide level, including looking at what performance management KPIs should be. Evidence to confirm implementation: Performance management system incorporating the considerations in our recommendation. Responsible person/title: Service Manager Target date: 29th February 2024 2.10 Contract review Contracts are currently subject to an annual review but there should be more regular review. Although contracts are reviewed periodically, this should be conducted more often. The review should be aligned with strategic objectives, and ensure providers are held to legal and regulatory standards to ensure relationships with only compliant organisations. This should be subject to pro-active review as opposed to just informal feedback. The Council should determine the standards to be reviewed against (i.e. Council or Integration Joint Board-level objectives) that providers are expected to meet. Risk: Contracts are awarded to substandard and/or unapproved suppliers that do not meet the needs of the Council including timeliness, quality and competence. This will impact on the quality of services and best value for the Council. Agreed management action: 1. The Council will implement a regular contract review procedure that assesses the suitability of providers. Evidence to confirm implementation: Contract review procedure. Responsible person/title: Service Manager Target date: 31st August 2023 Findings and management actions (cont.) High Medium Page 198
Page 199
19 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential 2.11 Block contracts The Council should ensure there is adequate monitoring of block contracts to ensure greater accuracy of billing. We understand that the Council is already undergoing the process of moving away from block contract arrangements. This transition should be prioritised as the operation of block contracts required detailed tracking and monitoring in order to be managed well, however we have not found this to be the case. Block contracting is not monitored sufficiently enough to effectively track activity, meaning the billing which arises from this type of contracting does not align with the Council’s current position. This concerns the operation of block contracts as opposed to the use of block contracts themselves. Risk: There is insufficient tracking and monitoring of financial incentives available to the Council, resulting in the Council not obtaining optimum value for money. Agreed management action: 1. Ensure that any block contracts are appropriately monitored to ensure that best value is obtained. Evidence to confirm implementation: Active, high-quality monitoring of block contracts. Responsible person/title: Service Manager Target date: 31st August 2023 Findings and management actions (cont.) Low Page 199
Page 200
20 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Sample testing –contracts We took a sample of 13 contracts under social care commissioning arrangements, using two different listings – ten from one, and three from the other. We reviewed whether each contract was in date, sufficiently approved and agrees to the contracts database. A summary of the results from our testing is as follows: Appendix A # Contract in place Contract signed Contract in date Agrees to database (value) Agrees to database (date) Agrees to database (contract no.) 1 (Note 4) (Note 5) (Note 6) 2 (Note 3) 3 (Note 1) 4 5 6 (Note 7) 7 8 9 (Note 2) 10 11 12 13 Page 200
Page 201
21 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Sample testing –contracts (cont.) Appendix A Note 1 – we were unable to obtain documentation relating to four contracts (highlighted grey), suggesting that the Council should focus on maintaining audit trails (Finding 2.5) . We have excluded these contracts from our charts to more accurately display our results, and the following notes are all in addition to these four contracts. Note 2 – there was one arrangement for which we confirmed with the Council that there was no contract in place, leaving no formal document to govern this working relationship. This is in addition to the four contracts identified in Note 1. (Finding 2.5) Note 3 – there were five contracts where signatures were incomplete. Three of these were signed by the Council but not the contracting party, one was signed by neither party, and the final one related to the arrangement in Note 2 above. (Finding 2.5) Note 4 – there were five contracts that had expired, two of which had extensions that expired March 2022 and March 2020, one of which contained no end dates meaning we were unable to confirm whether it was in date, and a further one relating to the arrangement in Note 2 above. The final one contained a clause stating the duration as four years with a further conflicting clause stating it ends when no longer required. (Finding 2.5) Note 5 – we were unable to reconcile contract amounts to the contracts database for all of the contracts because contracts and the database used different pricing calculations (e.g. total / per resident per week). (Finding 2.8) Note 6 – we were unable to reconcile end dates with the contracts database for eight contracts. (Finding 2.8) Note 7 – we were unable to reconcile contracts numbers with the contracts database for four contracts. (Finding 2.8) Contract in place Contract signed Contract in date Agrees to database (value) Agrees to database (date) Agrees to database (contract no.) Yes No Fig 1. Summary of Sample Testing We have presented a summary of our contract sample testing findings in graphical form, in Figure 1. Additional comments In addition to these findings from our sample testing, we were unable to locate any document that stipulates who has sufficient power to sign and approve contracts. We would expect to see this is a scheme of delegation, or similar. Therefore, it cannot be confirmed whether the member of staff signing on behalf of the Council had the power to do so. (Finding 2.5) Page 201
Page 202
22 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Sample testing –invoices We obtained a list of AP transactions for HSCM in 2022 and selected a sample of 25 invoices from this listing. We then reviewed whether the amount as per the invoice agreed with the listing, whether the supplier details as per the invoice agreed with the listing, and whether the invoice had been sufficiently approved. A summary of the results from our testing is as follows: Appendix A # Amount agrees to invoice Supplier details agree to invoice Approval 1 (Note 1) 2 3 (Note 2) 4 5 6 7 8 9 10 11 12 13 # Amount agrees to invoice Supplier details agree to invoice Approval 14 15 16 (Note 3) 17 18 19 20 21 22 23 24 25 Page 202
Page 203
23 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Sample testing –invoices (cont.) Appendix A Note 1 – we received confirmation from the Council that it was not possible for 15 invoices in our to match expenditure with individual invoices due to the volume of payments. As a result we were unable to test these samples. The Council should ensure that sufficient documentation is retained which acts as an audit trail for expenditure in order to reduce the risk of duplicate or missing payments. (Finding 2.5) Note 2 – for the ten invoices we were able to obtain documentation for, we were not able to confirm that approvals were satisfactory. Although we were able to acknowledge that some type of confirmation had been received for the payment of invoices, we noted a number of issues with this. For example, for one invoice the person who received it was also the person who approved it, meaning there was no segregation of duties. Other invoices had been approved in batches, meaning individual invoices may not have been sufficiently checked. Furthermore, as we have not been able to locate a document setting out a scheme of delegation (i.e. who has the authority to approve payments), it was also not possible to confirm that those confirming approval had the power to do so. (Finding 2.5) Note 3 – for all but one of the invoices in our sample we obtained documentation for, we were able to reconcile the supplier details and value as per the invoice with the list of AP transactions. For the exception, the invoice value could be reconciled but the supplier name did not match that contained within the list of AP transactions. This poses a risk that payments are sent to the incorrect person or entity. (Finding 2.5) Page 203
Page 204
24 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Sample testing –governance Appendix A We examined meeting minutes from three governance forums on an operational level, management level and leadership level and noted our findings in the boxes below. (Finding 2.1) Commissioning Group Meetings (operational level) We could only obtain documentation for one operational meeting. Staff feel this meeting is always effective, but it is not held consistently enough. The meeting we reviewed was well attended and contained a number of useful actions. The risk register, however we found to be empty, unlike the ‘operational issues’ register which appeared comprehensive. Senior Management Team Meetings (management level) We sampled ten of these meetings, for which documentation was readily available. Each meeting had space for a standing agenda item termed ‘Gaps in Social Care Provision’ where those with oversight of commissioning are to give an update of Moray’s current position. However, on three occasions this standing item referred to other parts of the meeting where social care was discussed briefly, and lacked depth and detail. On a further three occasions, this item was not discussed at all. Systems Leadership Group Meetings (leadership level) We sampled three of these meetings, all being generally well attended. But, we did note that commissioning was not discussed in any of the three meetings sampled and there was no commissioning representative in one of them. As a result, no constructive actions were drawn from the meetings we reviewed. Page 204
Page 205
25 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Analysis of commissioning database We obtained the commissioning database used to record contracts entered into with care providers, which showed a total of 73 contracts. We then performed data analysis on the database and have noted two key areas of risk – (i) completeness; and (ii) contract start/end dates. We have set out below our approach to analysing this information and our observations, as well as a number of other key findings to be considered. For all of the below comments, we used a cut off of August 2022. Area of analysis – completeness Approach: — We initially recognised a large number of blank fields within the database and grouped columns into the five categories reflected in Table 1 & Chart 1 below . We then noted how many blank fields each category had and tested for completeness across the database. Findings: The database contains budgets ranging from 2017/18 to 2023/24, however fields relating to budgets were the least complete, with 49.49% of entries being incomplete. This suggests budgets are not being monitored sufficiently. (Finding 2.8) The most complete category was information relating to contracts such as dates (however, see next page) and contract numbers, as 9.93% of fields were incomplete. (Finding 2.8) Overall, we identified 575 blank entries out of a possible 2,701, suggesting that the database is, at most, 78.71% complete. (Finding 2.8) Appendix B Category of information Total fields in category No. of blank fields Incomplete % Risk rating Contracting party details 730 90 12.33% Contract information 584 58 9.93% Budgets 584 289 49.49% Monitoring 438 63 14.38% Other (e.g. H&SC standards, contract request requirements, etc). 365 75 20.55% Table 1 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Other Contract information Contracting party details Budgets MonitoringChart 1 Page 205
Page 206
26 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Analysis of commissioning database (cont.) Area of analysis – contract start/end dates Approach: — We condensed the database using four identifiers – name of the contracting organisation, contract numbers, start date, and end date. From this, we were able to analyse start and end dates in order to reach the following conclusions. Findings: The earliest contract start year was 2004, with 16 contracts commencing more than ten years ago (before August 2012). This equates to 21.92% of contracts in the database. (Finding 2.8) A further 27 contracts commenced more than five but less than ten years ago (August 2012 – August 2017), equating to 36.99% of contracts in the database. In Chart 2 below we have summarised the position regarding contract start dates in. (Finding 2.8) The earliest contract expiry year was 2017 and we identified a total of 43 expired contracts, equating to 58.90% of contracts in the database. This suggests that expired contracts have either not been removed from the database or renewals have not been processed correctly. (Finding 2.8) Of those 43 expired contracts, 21 had expired more than two years ago (before August 2020), equating to 28.77% of contracts in the database. (Finding 2.8) Appendix B 21.92% 36.99% 27.40% 13.70% Start date more than 10 years ago Start date 5-10 years ago Start date less than 5 years ago No information Other key findings We noted two contracts that were not assigned a commissioning officer, which showed in the database as ‘unallocated’. This presents a risk that there will be insufficient monitoring activity and limits accountability should problems arise with these contracts in particular as there is no one assigned to hold accountable. We found three instances where the database stated that there was no contract in place. This suggests that either work begins before contracts are signed or the database is not updated regularly enough. Chart 2 Page 206
Page 207
27 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Scope extract Background of the internal audit Moray Council has identified the processes that support the commissioning of services provided externally as an area of focus to ensure continuous improvement within services. The Commissioning Service is managed within the Moray Health and Social Care Partnership, and is primarily concerned with social care commissioning. The Chief Officer and Head of Service, who is also the Chief Social Work Officer, have requested a review of the Commissioning Service as part of a continuous improvement programme, and for the assurance required by the Integrated Joint Board’s Audit, Performance and Risk Committee. The Chief Officer has been given a specific instruction from the Committee to seek this review. The review will look at the work undertaken by the Commissioning Service and provide a report to the Integration Joint Board on how social work contracts are awarded and managed. Our report will provide detail findings and improvement recommendations for the Council’s Management and Commissioning Service to implement through an action plan. Our review will assess the design of controls over the Council’s commissioning process against the national background, local priorities and best practice. We will also review the operating effectiveness of the commissioning process and the extent to which these reflect the current Standing Orders, Standing Financial Instructions and the Scheme of Delegation in place and the Council’s level of compliance with these. Specifically, roles and responsibilities for the commissioning process need to be clearly defined and adhered to. For any contract management to be successful the Council must ensure that contracts are known and understood by all those who will be involved in their management and there are clear lines of responsibility, roles and accountability. Contracts represent an area of risk for many Councils where relationships often rely heavily on providers to bill accurately for the services provided. Our review will also therefore assess the processes and controls in place over the monitoring of contracts, management of contractual relationships and consequences of KPI and/or contract breaches. Our approach Our work will involve the following activities: — Meetings with the key staff involved in the commissioning and management of contracts; — Walkthroughs of the processes for commissioning and monitoring contracts; — Desktop review of documentation supporting the internal controls; — Sample testing of ten contracts; and — Benchmarking of the commissioning and contract management processes and policies against good practice. Appendix C Page 207
Page 208
28 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Scope extract –risks identified Appendix C Key risks identified Objective One: Commissioning Controls 1 The Council does not have an accurate internal needs analysis process in place. This results in the potential under and/or overstatement of business needs and unrealistic budgets and timescales impacting on the subsequent procurement decisions and best value considerations. 2 Contracts are awarded to substandard and/or unapproved suppliers that do not meet the needs of the Council including timeliness, quality and competence. This will impact on the quality of services and best value for the Council. 3 Contracts are awarded outside of the formal procurement procedures, preventing a fair tender process. This may also lead to the absence of appropriate authorisation. 4 Inefficiencies in commissioning may lead to delays in the overall procurement process, thereby increasing costs to the Council and delaying commencement of the services. 5 The Council have insufficient organisational capability and capacity with regard to the commissioning skills and resources required to deliver best value. 6 The Council have insufficient governance processes in place to successfully plan, commission and manage contracts with the highest complexity, cost and risk. 7 Insufficient internal checks are performed at the Council, which fail to identify deficiencies or gaps within the processes around commissioning. 8 Council staff involved in commissioning are not consistently complying with the Council’s policies and procedures. Objective Two: Contract Management Governance 9 The Council does not have robust procedures in place, applied consistently across the Council for agreeing, monitoring and reporting on contracts. 10 The Council does not have example documentation and contracts in place, which provide the wording for key clauses to help ensure that Council contracts are worded in line with legal expectations and Council requirements. 11 Roles and responsibilities are not clearly set out and allocated, resulting in inadequate completion of tasks. 12 Invoices raised are incomplete, inaccurate or not raised in a timely manner. 13 There is inadequate central oversight of billing and budgeting in relation to contracts. Expenditure related to contracts is not appropriately authorised, in line with Standing Financial Instructions. 14 There is insufficient tracking and monitoring of financial incentives available to the Council, resulting in the Council not obtaining optimum value for money. 15 The Council does not have effective KPI’s in place, to support monitoring and measuring of performance against contract terms. 16 The Council does not effectively share and report on data relating to contract performance throughout the Council, limiting the Council’s ability to improve contract performance. 17 Contract obligations, including non-financial obligations, are not clear opening up the Council to the risk of regulatory or legal non-compliance. Page 208
Page 209
29 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Acknowledgements Appendix D We would like to thank the following individuals for their contribution during this internal audit: Stakeholder Title Simon Bokor-Ingram Chief Officer of Health and Social Care Moray Jane Mackie Chief Social Worker Roddy Huggan Commissioning Manager Aimee Borzoni Senior Commissioning Officer Diane Beattie Head of Procurement Carl Bennet Senior Performance Manager Fiona McPherson Public Involvement Officer Charles McKerron Integrated Services Manager Laurie Anne Davidson Development Worker Michelle Fleming SDS/Carers Officer Stakeholder Title Catherine Quinn Interim Community Care Finance Officer Carmen Gillies Interim Strategy Lead Tracie Wills Senior Commissioning Manager Pauline Knox Senior Commissioning Manager Tracey Peden Development Officer Page 209
Page 210
30 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential Ratings definitions We have set out below the overall report grading criteria and priority ratings used to assess each individual finding. Appendix E Low Medium High Issues arising that would, if corrected, improve internal control in general but are not management actions which could improve the efficiency and / or effectiveness of the system or process but which are not vital to achieving your strategic aims and objectives. These are generally issues of good practice that the auditors consider would achieve better outcomes. A potentially significant or medium level weakness in the system or process which could put you at risk of not achieving its strategic aims and objectives. In particular, having the potential for adverse impact on your reputation or for raising the likelihood of your strategic risks occurring. A significant weakness in the system or process which is putting you at serious risk of not achieving its strategic aims and objectives. In particular: significant adverse impact on reputation; non-compliance with key statutory requirements; or substantially raising the likelihood that any of your strategic risks will occur. Any management action in this category would require immediate attention. Finding priority rating Definition Significant assurance Significant assurance with minor improvement opportunities Partial assurance with improvements required The system is well designed and only minor low priority management actions have been identified related to its operation. Might be indicated by priority three only, or no management actions (i.e. any weaknesses identified relate only to issues of good practice which could improve the efficiency and effectiveness of the system or process). The systems is generally well designed however minor improvements could be made and some exceptions in its operation have been identified. Might be indicated by one or more priority two management actions. (i.e. there are weaknesses requiring improvement but these are not vital to the achievement of strategic aims and objectives - however, if not addressed the weaknesses could increase the likelihood of strategic risks occurring). Both the design of the system and its effective operation need to be addressed by management. Might be indicated by one or more priority one, or a high number of priority two management actions that taken cumulatively suggest a weak control environment. (i.e. the weakness or weaknesses identified have a significant impact preventing achievement of strategic aims and/or objectives; or result in an unacceptable exposure to reputation or other strategic risks). Overall report rating Definition No assurance The system has not been designed effectively and is not operating effectively. Audit work has been limited by ineffective system design and significant attention is needed to address the controls. Might be indicated by one or more priority one management actions and fundamental design or operational weaknesses in the area under review. (i.e. the weakness or weaknesses identified have a fundamental and immediate impact preventing achievement of strategic aims and/or objectives; or result in an unacceptable exposure to reputation or other strategic risks). Page 210
Page 211
31 © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. Document Classification: KPMG Con fidential This report has been prepared solely for MHSCP in accordance with the terms and conditions set out in our engagement letter. We do not accept or assume any liability or duty of care for any other purpose or to any other party. This report should not be disclosed to any third party, quoted or referred to without our prior written consent. © 2023 KPMG LLP, a UK limited liability partnership and a member firm of the KPMG global organisation of independent member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved. The KPMG name and logo are registered trademarks or trademarks of KPMG International. | CREATE: CRT128147 kpmg.com/uk This report is provided pursuant to the terms of our engagement letter. Nothing in this report constitutes a valuation or leg al advice. We have not verified the reliability or accuracy of any information obtained in the course of our work, other than in the limited circumstances set out in our engagement letter. This report is for the sole benefit of The Moray Council: The Moray Health and Social Care Partnership (‘MHSCP’). In preparing this report we have not taken into account the interests, needs or circumstances of anyon e apart from MHSCP, even though we may have been aware that others might read this report. This report is not suitable to be relied on by any party wishing to acquire rights against KPMG LLP (other than MHSCP) for any purpose or in any context. Any party other than MHSCP that obtains access to this report or a copy (under the Freedom of Information Act 2000, the Freedom of Information (Scotland) Act 2002, through the MHSCP Publication Scheme or otherwise) and chooses to rely on this report (or any part of it) does so at its own risk. To the fullest extent permitted by law, KPMG LLP does not as sume any responsibility and will not accept any liability in respect of this report to any party other than MHSCP. Any disclosure of this report beyond what is permitted under our engagement letter may prejudice substantially our commercial interests. A request for our consent to any such wider disclosure may result in our agreement to these disclosure restrictions being lifted in part. If MHSCP receives a reque st for disclosure of the product of our work or this report under the Freedom of Information Act 2000 or the Freedom of Information (Scotland) Act 2002, having regard to these actionable disclosure restrict ions MHSCP should let us know and should not make a disclosure in response to any such request without first consulting KPMG LLP and taking into account any representations that KPMG LLP might make. Page 211
Page 212
Page 212