Board Development

The report is not about the governance structures and processes that trust boards should use to assure themselves that their organisation is operating effectively and meeting its strategic objectives. All organisations have structures and processes in place and there is a great deal of guidance – over 1,000 pages – on the subject. It is about the rigour with which they operate the processes and get the assurance they need.

Healthcare is inherently complex and risky, boards therefore need to assure themselves that their organisations are well managed, providing safe and appropriate care and are, in short, places where patients would want to be treated. How they do this is described as the ‘system of internal control’.

Internal control is ‘a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

• effectiveness and efficiency of operations,
• reliability of financial reporting, and
• compliance with applicable laws and regulations.

The assumption is that such systems operate effectively but there is evidence to the contrary.

Taken together, these factors indicated that trust boards need to increase the rigour with which they assure themselves about the strength of their internal controls.

Effective assurance requires a number of elements to be present together:

• the right governance framework and risk culture and a clear understanding of strategic objectives and risks,
• good internal controls,
• evidence that internal controls are operating effectively, and
• good data quality.

The Audit Commission review showed that:

• Controls and assurances were often poorly defined, making it difficult to see how boards could be clear that the controls were working effectively and that assurances were sound. Risks and controls were not always aligned to strategic objectives.
• Greater attention needed to be paid to compliance mechanisms and these needed to be more clearly distinguished from internal audit, which should review the effectiveness of the compliance framework, not be a substitute for it.
• Use of internal audit could be improved, with greater emphasis given to the quality of the assurance derived from it rather than cost minimisation. Its use should also be placed in a wider framework of review as there are alternatives to internal audit in many cases; use of clinical audit as part of the BAF (Board Assurance Framework) was poorly developed. This is a significant weakness. Few trusts could set out how clinical audit was being used in a systematic way to address risks with the results reported to the board through the BAF.
• Many trusts had elements of assurance processes in place for data quality but very few were comprehensive and very few boards saw this as a significant issue. There was limited evidence of formally planned audit or review programmes to verify the accuracy of data reported.
• Greater effort was made to review and assess assurances provided in respect of self-assessments for compliance with health standards for Better Health. Even so, these efforts were not wholly successful as judged by the results of follow-up inspections by the Healthcare Commission.

The Healthcare Commission’s report on its investigation into Mid Staffordshire NHS Foundation Trust shows that processes without intelligent and rigorous scrutiny are not enough. Governance arrangements that are persuasive on paper must work in practice. The aim of board assurance is to give confidence that the trust is providing high quality care in a safe environment for patients by staff who have received the appropriate training; that it is complying with legal and regulatory requirements; and that it is meeting its strategic objectives.

On the evidence seen, many board members would not be able to have that confidence. Trusts may indeed be meeting all these requirements but it is not evident from the material presented to the board. This is an important issue for regulators as the regulatory framework is increasingly dependent on self-assessments and self-certification. Mid Staffordshire NHS Foundation Trust certified that it was compliant with all core standards except that relating to waste disposal, but it subsequently became clear that it was very far from providing safe, high quality care. Internal controls and board assurances are often not up to the weight now being placed on them by the regulatory framework.

It was observed that NHS trusts have the processes and arrangements in place, but greater attention now needs to be paid to the rigour and effectiveness with which the processes and arrangements are applied. Below are a number of recommendations that they consider will help to bring this about.

Trusts should:

• ensure that their strategic aims and objectives are clearly defined and few in number so they can be widely understood and clearly cascaded throughout the organisation, and that their strategic risks are identified and aligned to their strategic objectives;
• review their risk management arrangements – including the way in which risks are reported to the board – in line with the findings of this report and consider how best to promote and demonstrate the value of risk management work to staff;
• ensure they have systems in place to comply with all statutory, regulatory, clinical and contractual requirements;
• consider cascading the SIC through the organisation by sub- certification by managers. To avoid this becoming simply a bureaucratic exercise it should be allied with a more effective compliance function, performance information and performance management;
• review how they identify and then evidence assurances on the operation of controls and how these are then evaluated;
• review and increase the assurances they receive from sources other than internal audit, including clinical audit, and in doing so ensure that their full portfolio of risk is covered;
• maximise the assurance obtained from internal audit by reviewing the scope of internal audit plans and improving its commissioning;
• better align clinical audit programmes to key strategic and operational risks to maximise the assurance provided by the clinical audit function; strengthen their compliance mechanisms and distinguish them more clearly from internal audit, which should review the effectiveness of the compliance framework;
• ensure they have robust arrangements for assuring the quality of their data by assessing themselves against the standards for better data quality set out in the Commission’s Figures You Can Trust briefing and by developing systematic and formalised review programmes for their data, including checking accuracy back to records;
• develop policies and guidance on data quality and assurance processes, including defining and allocating responsibility for data quality, to promote consistency and improve awareness of board members.

Questions for board members to ask themselves

1.Good assurance requires the right governance framework to be in place

• How clear are we about what the organisationis trying to achieve? What strategic aims and objectives have we set out for the trust? Are they clearly defined?
• How do we provide leadership to the staff delivering the objectives that we have set? What process do we have in place for translating the objectives into the contribution expected from divisions, care groups and frontline staff and how will their performance will be monitored?
• Are the governance structures clear and straightforward with minimal overlap? How well do we understand them and how do we think current governance arrangements could be improved?
• How do we oversee the strategy for achieving our objectives? How do we ensure that the systems of internal control are operating robustly? Is our board agenda dynamic and focused on the right things: the strategy and its implementation? How much time do we spend on strategic issues at board meetings? To what extent do we have the right information prepared for board meetings to allow us to monitor this? Have we considered and acted on The Intelligent Board Dr Foster report 2006?
• Are board meetings managed effectively? What improvements could be made to ensure that we operate as a team? Do we have trust and respect between executive and non-executive directors?
• What skills do we need as a board? To what extent do we have the right skills? How clear are we about what the role of the chair and non-executive directors should be? Do we delegate responsibilities effectively and appropriately?

2.Good assurance requires good internal controls, effective risk management and a good assurance framework

• How can we be sure that we have identified all of our strategic risks? Are we monitoring them properly and what level of independent scrutiny or constructive challenge from within the organisation is there?
• How timely and relevant is the performance information that we use to monitor risks? What reports do we receive that provide evidence of the effectiveness of risk management and progress in achieving strategic objectives?
• How do we provide leadership on risk management? Do we monitor the organisation's main operational risks? How can we be sure that the risk management processes in place will avoid operational risks becoming strategic risks? How clear are we about our risk appetite? Do we quantify risk appropriately? Do we have an accountability framework for the trust that sets out the level of risk that is expected to be managed at each level of the trust?
• Have we devolved risk management sufficiently and how can we be sure that it is embedded within operational processes and that there is ownership of risk?
• Do we understand what risk culture we are trying to embed? Do we know what a good risk culture looks and feels like? How and when do we communicate this?

3.Good assurance is required on internal controls

• How are we using the internal audit function to obtain assurance on internal controls? Is the scope and level of investment in internal audit appropriate? How are we maximising the assurances we can gain from internal audit and do internal audit staff have the right skills and experience? Are we making best use of other independent forms of assurance?
• Do we need to establish or increase investment in a separate compliance function to ensure operations comply with laws, rules, regulatory requirements and our policies?
• To what extent do we use the clinical audit function appropriately? Is it systematic and focused on our own risks as well as on nationally identified issues? Are the results regularly reported to the board through the assurance framework? Does it give us a comprehensive view of the quality of clinical services across the trust’s portfolio? What are our potential sources of assurance? Do we use these appropriately, balancing them across the risk profile of the trust? How have we satisfied ourselves that they are not skewed towards big and topical projects and that we keep our eye on the ball more widely? How do we systematically test and evaluate the sources of assurance?
• Where have we set out the roles and responsibilities of sub- committees to the board and do we receive full and appropriate reports from them? Specifically, how will the audit committee programme enable it to meet the board’s expectations? Do all non-executive directors have the opportunity to communicate with those on the sub-committees?

4.Good assurance requires good data quality

• Is there a corporate framework in place for the management and accountability of data quality? Is there a commitment to secure a culture of data quality throughout the organisation? How have we made clear the responsibility for data quality governance and accountability at all levels of the organisation? Do our clinicians understand the purpose and use of the data collected?
• What policies or procedures are in place to secure the quality of the data used for reporting? What policies and guidance on data quality do we have? Are they appropriate?
• What policies or procedures are in place to secure the quality of the data used as part of the normal business activity of the organisation? How has the trust ensured that staff have the knowledge, competencies and capacity in relation to data quality? What kind of training is made available on data quality issues?
• What arrangements are there to ensure that data supporting reported information are actively used in the decision-making process? Are they subject to a system of internal control and validation?
• What controls do we have to ensure that the quality of data used for decision making is good enough? Is the quantity and timeliness of information we receive for board meetings adequate? How do our board reports explain the assurance process for the data contained in them? Do they clearly highlight any issues?