top stories

As the healthcare sector scrambles to meet HM Treasury’s corporate governance framework deadline of 31 March 2004, Julia Rudrum details the steps that you should take to ensure compliance.

In my first article on improving corporate governance in the NHS (see issue 48 of Health Service Review) I explained the background and developments that have taken place in the NHS to ensure that robust governance arrangements are in place.

The Audit Commission has defined corporate governance in healthcare as:
“The systems and processes by which health bodies lead, direct and control their functions, in order to achieve organisational objectives and by which they relate to their partners and wider community.”

While this is orientated towards the healthcare sector rather than the Cadbury Committee definition, the key is still how the board directs and controls the organisation to meet corporate objectives. The challenge for any board was summed up by Sir Stuart Burgess when he said: “How do you equate the total accountability of the board for all that the organisation does with the practical impossibility of knowing everything that is being done in the board’s name?”

Effective governance arrangements are designed to minimise the risks associated with this conundrum. In the NHS, there is already a strong governance framework that has been developed, including:

• framework documents – such as standing orders and standing financial instructions
• management and organisational structure – board and committee requirements are defined
• culture – whilst this is variable by organisation, the Nolan principles of public life give a good basis
• external regulation – as well as being subject to statutory external audit, the NHS is also reviewed by the Commission for Health Improvement, Royal Colleges, Health & Safety Executive and approximately 160 other organisations!
• systems and processes – organisations have established arrangements for the main functions
• external environment – particularly in the NHS, the role of central government, the Department of Health (DoH), HM Treasury, local councils etc, has a significant impact.

What is not clear is how effective these arrangements are and how the board knows that they are working. How does the board get assurance?

Assurance: The Board Agenda
In order to address this problem, the DoH issued guidance in July 2002, entitled Assurance: The Board Agenda. The guidance stated that boards need to be confident that the “systems, policies and people that they have put in place are operating in a way that is effective, is focused on key risks and is driving the delivery of objectives.”

In order to demonstrate the achievement of this goal, boards were required to document their assurance framework, where this is defined as:
“An assurance framework must be driven by the objectives of the organisation. In turn, the principal risks that might prevent those objectives being met need to be clear. This necessitates the existence of an embedded risk management culture and process throughout the organisation.”

As with the governance arrangements, the NHS already has a significant number of sources of assurance:

• line management
• reports and presentations
• credibility and trust of individuals
• benchmarking
• independent assurance bodies, such as Internal Audit
• external assurers
• stakeholder feedback.

The key is documenting which are used in each organisation, how complete the assurance is and where any gaps are, so that the board can manage those gaps effectively.

Statement on Internal Control
The Statement on Internal Control was introduced in the NHS in 2001/02. The objective was to provide assurance to the public that internal control arrangements in each organisation are effective. A phased approach has been adopted to take account of the fact that systems to demonstrate this needed to be developed. For 2002/03, the Statement on Internal Control wording required the chief executive to confirm on behalf of the board:

“I am satisfied that an effective system of internal control has been in place throughout the full financial year and is ongoing….. This is demonstrated by the board’s assurance framework and evidence of compliance with the requirements of the core controls assurance standards.”

In the majority of cases, it was not possible to confirm this, primarily because the assurance framework was not documented. Therefore limited assurance statements were included in the accounts, together with detailed action plans showing how the organisation would ensure compliance by the end of 2003/04.

All government bodies were required by HM Treasury to ensure that arrangements and systems were in place by 31 March 2003 to enable an unqualified Statement on Internal Control to be signed and included in the accounts for the 2002/03 financial year. The NHS has been given a year’s grace in terms of this deadline, but it is clear that there will be no leeway after 31 March 2004.

Changes for 2003/04
As a result of the limitations for 2002/03, strategic health authorities have been tasked with performance managing the delivery of the action plans of individual organisations that were unable to sign a ‘clean’ Statement on Internal Control. This should be included in their disclosures to make sure that they can sign for the 2003/04 financial year.

On 18 September new wording for the Statement on Internal Control for inclusion in the 2003/04 annual accounts (designed to bring the NHS fully in line with HM Treasury requirements) was published in the DoH’s Chief Executives’ Bulletin. The key changes are:

• a requirement for accountable officers to identify how the risk management processes are maintained and developed to ensure continuing effectiveness
• a requirement for disclosure of significant internal control issues
• a requirement for a description of the processes in place at the organisation
• a requirement for documented evidence of the assessment of the effectiveness of the system of internal control and assurances that actions are or will be taken where appropriate to address issues arising
• no provision for partial statements for 2003/04 and beyond.

Sir Nigel Crisp made clear in his covering letter that the preparation of assurance frameworks to provide a structure for focusing the board’s attention on the main risks to meeting the organisation’s objectives would provide the necessary evidence to support the new statement, and that there would not be any additional burdens imposed on NHS bodies as a result. The development of assurance frameworks is therefore critical to the success of each organisation’s ability to meet the deadline.

What needs to be done
Those organisations that published a partial Statement on Internal Control – and therefore have an action plan to implement during 2003/04 – need to ensure that arrangements are in place to deliver this by 31 March 2004.

I also suggest that organisations take the opportunity now to draft the Statement on Internal Control that they would like to be able to sign at 31 March 2004 and then assess what, if any, additional work is required in the interim period to ensure that it can be achieved.

Heads of internal audit will be required to produce annual opinion statements (as in the previous two years) to be used as part of the evidence base for the accountable officer to consider when finalising the wording for the Statement. This year the head of internal audit’s interim feedback as to the likely degree of success in meeting the 31 March 2004 deadline could prove valuable in helping the organisation meet its obligations.

The NHS has a clear target to meet relating to the Statement on Internal Control. All board members and particularly accountable officers should be aware of this deadline and ensure that suitable arrangements are in place in their organisation. This is not something that can be left to the director of finance just because the Statement on Internal Control is published as part of the annual accounts, it is a corporate responsibility and there is less than six months to ensure compliance.

Julia Rudrum – Vice Chair, ACCA Health Service Network Panel and Deputy Director, South Coast Audit & Consultancy Services

Back to top