1 of 5 Report to Board, 26 July 2017 Report title Board assurance framework and corporate risk register Report from Geoff Stokes, company secretary Prepared by Geoff Stokes, company secretary Previously discussed at Individual executive owners Attachments Board assurance framework and corporate risk register Brief summary of report Board will be aware of the developments that have been made over the past few months to the corporate risk register and the need to develop a board assurance framework. The revised format incorporates the previous corporate risk register in the board assurance framework and includes new risks that have been identified, in part, as a result of the strategy refresh. The covering report includes an analyses of risks by strategic objective to give an overview which can be reviewed in conjunction with the strategic objectives progress report elsewhere on the agenda Risk descriptions have been changed to make them clearer and additional columns have been added to show gaps in control and assurance. Action Required/Recommendation. Board is asked to receive assurance from the updated board assurance framework and corporate risk register including the removal of 7 risks due to de-escalation or replacement. For Assurance For decision For discussion To note Item 11
Transcript
1 of 5
Report to Board, 26 July 2017
Report title Board assurance framework and corporate risk register
Report from Geoff Stokes, company secretary
Prepared by Geoff Stokes, company secretary
Previously discussed at Individual executive owners
Attachments Board assurance framework and corporate risk register
Brief summary of report
Board will be aware of the developments that have been made over the past few months to the corporate risk register and the need to develop a board assurance framework.
The revised format incorporates the previous corporate risk register in the board assurance framework and includes new risks that have been identified, in part, as a result of the strategy refresh. The covering report includes an analyses of risks by strategic objective to give an overview which can be reviewed in conjunction with the strategic objectives progress report elsewhere on the agenda
Risk descriptions have been changed to make them clearer and additional columns have been added to show gaps in control and assurance.
Action Required/Recommendation.
Board is asked to receive assurance from the updated board assurance framework and corporate risk register including the removal of 7 risks due to de-escalation or replacement.
For Assurance For decision For discussion To note
Item 11
2 of 5
Board assurance framework and corporate risk register
1. Introduction Attached is the board assurance framework (BAF) which incorporates the corporate risk register (CRR). Risks have been reviewed by executive leads and include new and updated risks.
The BAF/CRR shows which strategic objective (if any) each risk affects and these have been summarised in section 3.
2. Overall Analyses Since the last review by the board, there have been an additional 8 risks added, mostly as a result of the strategy refresh. These are highlighted below;
Risk Ref
Co
rpo
rate
o
bje
ctiv
e
Exe
cuti
ve
Ow
ner
Source of risk Risk description
Cu
rren
t ri
sk s
core
57
Fin
ance
Ste
ven
Dav
ies
Strategy refresh April 2017
IF commissioners introduce restrictions or bureaucratic processes for clinical treatments THEN patients will not get the care they need and the trust may lose activity LEADING TO poor patient care, loss of income and damage to reputation
12
58
Res
earc
h
Pen
g K
haw
Strategy refresh, April 2017
IF sufficient patients are not recruited to research studies THEN externally set targets may not be met LEADING TO withdrawal of funding or damage to reputation
6
60
Kno
wle
dge
Sha
ring
Dav
id
Pro
bert
Director of human resources
IF an education director is not appointed THEN there is a risk that progress to deliver the strategy will be delayed LEADING TO lack of opportunity to develop and exploit education in trust and beyond
8
74
Pol
icy
Joha
nna
Mos
s Strategy refresh April 2017
IF the trust does appropriately consider or co-ordinate its involvement in policy development THEN the trust may get unconsciously involved in contentious areas of policy or expend effort in low priority areas LEADING TO damage to reputation
9
75
Res
earc
h
Pen
g K
haw
Quality and safety committee
IF research governance is not robust THEN there may be clinical or operational risks that are not managed or escalated appropriately LEADING TO harm to patients, withdrawal of funding or damage to reputation
8
76
Infr
astr
uctu
re
Joha
nna
Mos
s Strategy and investment committee
IF the future operational state of the hospital is not determined THEN the building may not be fit for purpose LEADING TO failure to deliver the project objectives
16
77
Infr
astr
uctu
re
Elis
a S
teel
e
EMR programme board
IF the EMR project is not implemented effectively THEN a new medical records system will not be delivered in a timely manner LEADING TO increased costs and clinical risk or damage to reputation
8
3 of 5
Risk Ref
Co
rpo
rate
o
bje
ctiv
e
Exe
cuti
ve
Ow
ner
Source of risk Risk description
Cu
rren
t ri
sk s
core
78
Car
e
John
Q
uinn
Company secretary
IF the preparation and systems are not effective THEN the outcome of the CQC inspection of Moorfields Private may not be as required LEADING TO regulatory intervention, loss of income or damage to reputation
9
Overall there are 59 risks on the BAF/CRR (compared with 51 on the previous CRR) and changes in the profile of risks from the last board review are shown below.
The following 7 risks are recommended for removal from the BAF/CRR. If agreed, these will be removed from the next report and, where de-escalated, will be managed at divisional level.
Risk Ref
Co
rpo
rate
o
bje
ctiv
e
Exe
cuti
ve
ow
ner
Risk description
Cu
rren
t ri
sk s
core
Reason
38
Ent
erpr
ise
John
Q
uinn
IF the growth in Moorfields Private is not to plan THEN there will not be sufficient revenue generated LEADING TO pressure on trust finances elsewhere
8 Replaced (merged with risk 4, commercial income)
23
Peo
ple
Dec
lan
Fla
naga
n
IF the educational standards of trainees are not maintained THEN sufficient MPET funding may not be attracted LEADING TO loss of income and damage to reputation
6 De-escalated
29
Ope
ratio
nal
Elis
a S
teel
e IF there are high vacancy rates in IT with
reliance on key members of staff THEN service and project delivery may be affected LEADING TO loss if income, clinical risk and loss of reputation
6 De-escalated
45
John
Qui
nn IF there is poor management or increasing
demand against capacity THEN national treatment targets (RTT) may not be met LEADING TO poor patient experience, damage to reputation or potential regulatory intervention
6 De-escalated
4 of 5
Risk Ref
Co
rpo
rate
o
bje
ctiv
e
Exe
cuti
ve
ow
ner
Risk description
Cu
rren
t ri
sk s
core
Reason
34
Ent
erpr
ise
Mar
iano
G
onza
lez
IF the licence to operate is revoked for Moorfields Dubai THEN the trust will not be able to treat patients LEADING TO loss of income and damage to reputation
4 De-escalated
35
Ent
erpr
ise
Mar
iano
G
onza
lez
IF the licence to operate is revoked for Moorfields Abu Dhabi THEN the trust will not be able to treat patients LEADING TO loss of income and damage to reputation
4 De-escalated
30
Infr
astr
uctu
re
Elis
a S
teel
e IF OpenEyes cannot be developed into a viable
system THEN the trust will not have an effective medical records system LEADING TO clinical risk, loss of income and damage to reputation
8 Replaced by risk 77 (implementation of EMR)
3. Analyses by objective One of the key features of the board assurance framework is that it enables the board to assess risks against the strategic objectives, and the following diagrams show the risks in BAF/CRR that have been analysed against strategic objectives. There are 18 risks that have do not related to individual strategic objectives.
4. Other risk management activities As the board will be aware, a review is being carried out of all risk registers across the trust which may identify further risks to be added to the BAF/CRR or enable risks to be de-escalated for management on divisional risk registers.
This review should be finished within the next few weeks and an update will be given to the audit and risk committee and the board at its next review.
5 of 5
An electronic system for managing risks is being introduced and this is being piloted using the BAF/CRR. It is intended that this will be used to produce the next review, at the end of quarter 2.
5. Conclusions The BAF/CRR summarises the key risks of concern to the board and, alongside the risk management arrangements across the trust, should provide the board with assurance that risks are being properly managed.
BOARD ASSURANCE FRAMEWORK AND CORPORATE RISK REGISTER
QUARTER 1 UPDATER
isk
Re
f
Co
rpo
rate
Ob
ject
ive
Exe
cuti
ve
Ow
ne
r
Co
mm
itte
eRisk Description Source of risk Existing Controls
Co
nse
qu
en
ce
Like
liho
od
Ris
k sc
ore Gaps in Controls
Further Controls
(who, by when)
Co
nse
qu
en
ce
Like
liho
od
Ris
k sc
ore
Last
re
vie
w
Ne
xt R
evi
ew
Pre
vio
us
sco
re
Cu
rre
nt
sco
re
Ne
xt s
core Source of Assurance
Ass
ura
nce
leve
l
Gaps in Assurance(ref no. of further
assurance)
Further assurances
(who, by when)
43
Elis
a St
eele
IF there is a successful
cyber-attack
THEN the trust may suffer
from a loss of service
and/or corruption of data
LEADING TO poor patient
care or experience, loss of
income and damage to
reputation
IT risk assessment • IT security policy
• Annual penetration tests
carried out
• Disaster recovery plan in place
including cyber-security action
cards
• NHS Cyber alerts actions
• Annual cyber-security
assessment
• Robust patching policy and
procedures
4 4 16 • 17/18 penetration test
and completion of
action plan
• 17/18 cyber-security
assessment and action
plan
• Additional toolsets to
support cyber-security
• Address issues arising from
recent penetration test (ES,
Sep 17)
• Further penetration test to
be carried out (ES, Oct 17)
4 2 8
14
Ju
l 20
17
1 O
ct 2
01
7
16 16 16 IG Committee 1 • Independent
review
• Internal audit review,
(KMPG, 17)
• IG Committee review of
cber-security (IG
committee, Aug 17)
76
Infr
astr
uct
ure
Joh
ann
a M
oss
Stra
tegy
& In
vest
men
t C
om
mit
tee IF the future operational
state of the hospital is not
determined
THEN the building may not
be fit for purpose
LEADING TO failure to
deliver the project
objectives
Strategy and
investment committee
4 4 16 • Service development
programme
• Appoint external advisors to
support service development
work (JM, Oct 17)
4 1 4
13
Ju
l 20
17
1 O
ct 2
01
7
New
ris
k
16 16 Strategy & Investment
Committee
11
Car
e
Joh
n Q
uin
n
IF there is poor
environment, practices or
behaviour
THEN outpatient clinics
may not be managed
effectively
LEADING to poor patient
experience, low staff
morale or damage to
reputation
• Buzzers provided to make
waiting more convenient
• Outpatients improvement
programme created
• Service improvement projects
to improve patient flow has
commenced in glaucoma,
medical retina and external
diseases at City Road.
3 5 15 • Systematic approach
to management of clinic
flows
• Glaucoma – implementation
of new flow (KWA, Oct 18)
• Medical retina
implementation of new flow
(KWA, Dec 18)
• External disease
implementation of new flow
(KWA, Mar, 2019)
3 3 9
27
Ju
n 2
01
7
1 O
ct 2
01
7
15 15 15 SIS Programme board 1
13
Fin
ance
Stev
en D
avie
s
Fin
ance
co
mm
itte
e
IF a financial surplus at the
required level is not
maintained
THEN there may be a
shortage of available funds
LEADING TO a reduction in
or cancellation of major
capital projects (e.g. Oriel),
regulatory intervention or
cash flow issues
NHSI and treasury
investment rules
• Financial plan/budget
development, including cost
improvement plans.
• Major capital expenditure &
funding sources identified
• Short term capital investment
commenced to maintain and
increase capacity of services and
improve environment.
• Active engagement by CFO with
the local health system
• SFIs reviewed Mar 2017
• Divisional performance
management meetings in place
• Costing project initiated
5 3 15 • Confirmation of
financial commitments
• Better understanding
and tighter control of
costs
• Report to Board on longer
term financial planning
including Project Oriel (SD, Jun
17)
• PMO in place to support
management of savings plans.
(JQ, Jun 17)
• Implement improvements in
managing costs (SD, Sep 17)
• Draw up plan for
engagement of wider trust
leadership team with the local
health system (SD, Aug 17)
• Patient level costing to be
put in place (SD, Dec 17)
5 2 10
22
Ju
n 2
01
7
1 O
ct 2
01
7
15 15 15 Finance committee 2
Gaps in AssuranceDate TrendReference Gaps in Controls Existing assuranceCurrent Residual
BOARD ASSURANCE FRAMEWORK AND CORPORATE RISK REGISTER
QUARTER 1 UPDATER
isk
Re
f
Co
rpo
rate
Ob
ject
ive
Exe
cuti
ve
Ow
ne
r
Co
mm
itte
eRisk Description Source of risk Existing Controls
Co
nse
qu
en
ce
Like
liho
od
Ris
k sc
ore Gaps in Controls
Further Controls
(who, by when)
Co
nse
qu
en
ce
Like
liho
od
Ris
k sc
ore
Last
re
vie
w
Ne
xt R
evi
ew
Pre
vio
us
sco
re
Cu
rre
nt
sco
re
Ne
xt s
core Source of Assurance
Ass
ura
nce
leve
l
Gaps in Assurance(ref no. of further
assurance)
Further assurances
(who, by when)
Gaps in AssuranceDate TrendReference Gaps in Controls Existing assuranceCurrent Residual
12
Joh
n Q
uin
n
IF data quality is poor
THEN this could reduce the
ability of the trust to
manage its activities
LEADING TO poor patient
care, a reduction in income
or damage to the trust's
reputation
External and internal
auditors
• A data quality group is leading
the development of systems to
ensure robust data entry,
monitoring and review.
• A data assurance framework
describes the approach to
improving data quality for all the
key areas across the organisation.
• Internal audit has been
undertaken
• A data quality action plan has
been written based on the
reports from internal and
external audit.
• An action plan has been
developed which is being
monitored through the Trust
Access group.
3 4 12 • Implementation of
data quality action plan
• Data quality action plan to be
implemented (RS, Sep 17)
3 3 9
27
Ju
n 2
01
7
1 O
ct 2
01
7
12 12 12 Data quality group 1 • External audit • External audit (Deloitte, May 18)
16
Peo
ple
Sally
Sto
rey
Peo
ple
, Div
ersi
ty a
nd
Ed
uca
tio
n
Co
mm
itte
e
IF the trust is unable to
shift its culture
THEN poor behaviour will
continue (e.g. bullying,
harassment and lack of
opportunity)
LEADING TO poor staff,
morale, high turnover and
damage to the trust's
reputation as an employer
Staff survey results • The Moorfields Way behaviours
published and woven into
existing policies and processes.
• Local action plans to bring TMW
to life and address specific staff
survey concerns in place.
• Leadership development
programme has commenced
following clinical restructure
3 4 12 • Lack of consistent
application of policy in
dealing with 'breaches'
of The Moorfields Way
behaviours
• Leadership development for
retention to commence. (SSt,
Sep 17)
• Internal audit planned to
review equalities and diversity
in 17/18 (SSt, Sep 17)
• Agree standards for dealing
with 'breaches' of The
Moorfields Way. (SSt, tbc)
3 2 6
23
Ju
n 2
01
7
1 O
ct 2
01
7
9 12 9 Management executive 1
17
Car
e
Joh
ann
a M
oss
IF policies and standards
are not consistent across
the network
THEN operating models
and service quality may
vary
LEADING TO poor patient
care, a reduction in income
or damage to the trust's
reputation
CQC report • Local quality partners in place
• Policies are in place across the
whole organisation including all
network sites.
• Vanguard programme is in
place
• Network toolkit launched
3 4 12 • Local monitoring of
quality standards
• Consistent application
of standards across the
network
• Sanctions or
enforcement for non-
compliance
• Local quality and safety
dashboards to be introduced
(IT, Aug 17)
• Identify approaches needed
across the network. (JM, Sep
17)
3 3 9
13
Ju
l 20
17
1 O
ct 2
01
7
12 12 12 Local management 1 • No independent
assurance
• Determine corporate
assurance process
• Report to quality &
safety committee in the
first instance (TL, tbc)
31
Infr
astr
uct
ure
Joh
n Q
uin
n
IF SIS programme is not
effective
THEN the organisation will
not transform quickly
enough
LEADING TO poor patient
experience, reduced
income or damage to
reputation
Board • Service Improvement &
Sustainability programme Board
has been established.
• A governance structure has
been put in place and is now
operational.
• Programmes of work have been
identified and teams with SROs
agreed.
3 4 12 • Comprehensive
delivery plans
• Specific plans to be
developed for all projects
within each programme. (JQ,
Sep 17)
3 3 9
27
Ju
n 2
01
7
1 O
ct 2
01
7
12 12 12 SIS Programme board 1 • Programme
management
arrangements
• Programming
monitoring arrangements
(JQ, Sep 2017)
BOARD ASSURANCE FRAMEWORK AND CORPORATE RISK REGISTER
QUARTER 1 UPDATER
isk
Re
f
Co
rpo
rate
Ob
ject
ive
Exe
cuti
ve
Ow
ne
r
Co
mm
itte
eRisk Description Source of risk Existing Controls
Co
nse
qu
en
ce
Like
liho
od
Ris
k sc
ore Gaps in Controls
Further Controls
(who, by when)
Co
nse
qu
en
ce
Like
liho
od
Ris
k sc
ore
Last
re
vie
w
Ne
xt R
evi
ew
Pre
vio
us
sco
re
Cu
rre
nt
sco
re
Ne
xt s
core Source of Assurance
Ass
ura
nce
leve
l
Gaps in Assurance(ref no. of further
assurance)
Further assurances
(who, by when)
Gaps in AssuranceDate TrendReference Gaps in Controls Existing assuranceCurrent Residual
50
Joh
n Q
uin
n
IF theatre plant breaks
down on Duke Elder ward
(SGH)
THEN there may be delays
in treatment
LEADING TO poor patient
experience, loss of income
and damage to reputation
Incident reports • SLA signed with SGH 3 4 12 • Confirmed plans for
refurbishing theatre
plant
• Refurbishment plan
(including decant) to be
confirmed. (CH, Jun 17)
• Completion of refurbishment
plan (CH, Dec 17)
3 1 3
16
Mar
20
17
1 J
ul 2
01
7
12 12 12 Chief operating officer 1
18
Car
e
Joh
ann
a M
oss
IF service level agreements
across the network are not
in place or properly
managed
THEN service standards
may be inconsistent
LEADING TO poor patient
care, a reduction in income
or damage to the trust's
reputation
CQC report • Ad hoc conversations and
meetings between MEH local
leads and host trusts
• Most SLAs in place with host
sites
• Project group established for
longer term work (JM, May 17)
4 3 12 • Enact SLAs for remaining
sites (JM, Aug 17 )
• Implement robust SLA
management arrangements
(JM, Mar 18)
4 2 8
13
Ju
l 20
17
1 O
ct 2
01
7
12 12 12 Director of strategy and
business development
1
19
Infr
astr
uct
ure
Joh
ann
a M
oss
Stra
tegy
& In
vest
men
t C
om
mit
tee IF the key assumptions
behind Project Oriel are
not achieved
THEN there may be
insufficient capital (human,
financial etc.) available
LEADING TO failure to
deliver the project
objectives
Strategy and
investment committee
• Some analysis of patients who
can be repatriated has taken
place across the network.
4 3 12 • PA consulting are designing
an activity model (JM, Aug
17)
• Revised set of assumptions to
be determined and agreed
(JM, Sep 17)
• Engagement of all relevant
colleagues in new assumptions
(JM, Sep 17)
4 2 8
13
Ju
l 20
17
1 O
ct 2
01
7
12 12 12 Strategy & Investment
Committee
2
20
Fin
ance
Joh
ann
a M
oss
Stra
tegy
& In
vest
men
t C
om
mit
tee
IF there are delays in
Project Oriel
THEN the programme may
become unaffordable
LEADING TO failure to
deliver the project
objectives
Strategy and
investment committee
• Active engagement with
current owner of preferred site as
part of NCL sustainability and
transformation plan
• 'Influencing strategy' for key
individuals across the system is in
operation.
• Optimism bias built into
business case
• Land purchase business case
agreed by board
4 3 12 • Land purchase to be pursued
following review by
membership council (TF, Jul
17)
4 2 8
13
Ju
l 20
17
1 O
ct 2
01
7
12 12 12 Strategy & Investment
Committee
2
BOARD ASSURANCE FRAMEWORK AND CORPORATE RISK REGISTER
QUARTER 1 UPDATER
isk
Re
f
Co
rpo
rate
Ob
ject
ive
Exe
cuti
ve
Ow
ne
r
Co
mm
itte
eRisk Description Source of risk Existing Controls
Co
nse
qu
en
ce
Like
liho
od
Ris
k sc
ore Gaps in Controls
Further Controls
(who, by when)
Co
nse
qu
en
ce
Like
liho
od
Ris
k sc
ore
Last
re
vie
w
Ne
xt R
evi
ew
Pre
vio
us
sco
re
Cu
rre
nt
sco
re
Ne
xt s
core Source of Assurance
Ass
ura
nce
leve
l
Gaps in Assurance(ref no. of further
assurance)
Further assurances
(who, by when)
Gaps in AssuranceDate TrendReference Gaps in Controls Existing assuranceCurrent Residual
25
Po
licy
Joh
ann
a M
oss
IF the trust fails to respond
to government policies or
plans
THEN opportunities may be
missed or threats ignored
LEADING TO regulatory
intervention, loss of
income and/or damage to
reputation
• Director of Strategy and
Business Development oversees,
with team.
• Business planning cycle ensures
policy review is taken into
account
• Board strategy half-days, twice
per year
• Strategy refresh carried out,
including explicit objective on
'influencing policy'
4 3 12 Lack of agreed approach
and prioritisation
• Delivery of 'current state'
report (JM, Oct 17)
• Board to agree policy
priorities and approach to
policy activity (JM, Dec 17)
4 2 8
13
Ju
l 20
17
1 O
ct 2
01
7
9 12 9
27
Joh
ann
a M
oss
Stra
tegy
& In
vest
men
t C
om
mit
tee
IF there is insufficient
planning, monitoring or
executive ownership of the
strategy
THEN the trust may fail to
implement its strategy
LEADING TO poor patient
care, loss of income or
damage to reputation
Strategy refresh • Quarterly review of progress to
Board
• Board strategy half-days, twice
per year
• Board assurance framework
aligned to corporate objectives
• Revised strategy agreed
• Revise templates for action
plans and reports
4 3 12 • Longer term planning
to ensure 5 year
objectives met
• Planning for years 2 to 5
(JM, Dec 17)
• Develop a plan to embed in
planning cycle (JM, Dec, 17)
4 2 8
13
Ju
l 20
17
1 O
ct 2
01
7
8 12 8 Board 2
51
Infr
astr
uct
ure
Elis
a St
eele
IF data warehouse fails
THEN activity may not be
recorded
LEADING TO a loss of
income
IT risk assessment • Monitoring tool implemented.
• Manual checks implemented
between flex and freeze to check
activity unchanged
• Permanent employee secured
• Documentation and standard
operating procedures reviewed
4 3 12 • Procure replacement
solution (ES, Jul 18)
4 2 8
14
Ju
l 20
17
1 O
ct 2
01
7
12 12 12 IT security group 1 • Management
executive overview
57
Fin
ance
Stev
en D
avie
s
IF commissioners introduce
restrictions or bureaucratic
processes for clinical
treatments
THEN patients will not get
the care they need and the
trust may lose activity
LEADING TO poor patient
care, loss of income and
damage to reputation
Strategy refresh Apr
2017
• Signed contract with
commissioners
4 3 12 • Negotiation with
commissioners (SD, Jul 17)
4 1 4
22
Ju
n 2
01
7
1 O
ct 2
01
7
New
ris
k
12 12 Chief financial officer 1
BOARD ASSURANCE FRAMEWORK AND CORPORATE RISK REGISTER
QUARTER 1 UPDATER
isk
Re
f
Co
rpo
rate
Ob
ject
ive
Exe
cuti
ve
Ow
ne
r
Co
mm
itte
eRisk Description Source of risk Existing Controls
Co
nse
qu
en
ce
Like
liho
od
Ris
k sc
ore Gaps in Controls
Further Controls
(who, by when)
Co
nse
qu
en
ce
Like
liho
od
Ris
k sc
ore
Last
re
vie
w
Ne
xt R
evi
ew
Pre
vio
us
sco
re
Cu
rre
nt
sco
re
Ne
xt s
core Source of Assurance
Ass
ura
nce
leve
l
Gaps in Assurance(ref no. of further
assurance)
Further assurances
(who, by when)
Gaps in AssuranceDate TrendReference Gaps in Controls Existing assuranceCurrent Residual
4
Fin
ance
Stev
en D
avie
s
Stra
tegy
& In
vest
me
nt
Co
mm
itte
e
IF the growth in
commercial activities is not
to plan
THEN there will not be
sufficient revenue
generated
LEADING TO pressure on
trust finances elsewhere
Strategy and
investment committee
• Regular granular reports to
Board on commercial activity
• Budget re-set approved by S&I
• Commercial governance
structure approved by S&I
• Revised plan for Abu Dhabi
factored in to financial plan,
following review by S&I
members
• Moorfields Private business
case approved
• Commercial opportunities
screening tool
5 2 10 • Review financial processes
and systems in Moorfields
Private (MD, Jul 17)
• Review effectiveness of
improvement plan in Abu
Dhabi (MG, Nov 17)
4 2 8
22
Ju
n 2
01
7
1 O
ct 2
01
7
9 10 10 Strategy & Investment
Committee
2
7
Infr
astr
uct
ure
Elis
a St
eele
IF there is a major IT failure
THEN access to the trusts IT
systems could be disrupted
LEADING TO poor patient
care, a reduction in income
or damage to the trust's
reputation
IT risk assessment • Disaster Recovery and Business
Continuity Plans are documente
and reviewed annually
• Further configuration changes
to secondary server room and
network completed
• Follow up DR exercise carried
out in March 2017
• Annual desktop disaster
recovery and business continuity
exercise
• Key systems (e.g. PAS,
OpenEyes) disaster recovery test
3 3 9 Disaster recovery and
business continuity
plans need to be
updated
• Limitations of
recovery for some
systems (e.g. imaging)
• Investigate options to move
out of Ebenezer Street and
outsource secondary data
centre (ES, Dec 17)
3 2 6
14
Ju
l 20
17
1 O
ct 2
01
7
12 9 9 IG Committee 1 • External validation
of disaster recover
plans
• Internal audit review
due, (KPMG,2021/22)
8
Peo
ple
Sally
Sto
rey
Peo
ple
, Div
ersi
ty a
nd
Ed
uca
tio
n C
om
mit
tee
IF mandatory training
standards are not met
THEN staff may not be
competent to carry out
their functions
LEADING TO poor patient
care, a reduction in income
or damage to the trust's
reputation
Performance report to
board
• Oversight by mandatory
training group
• Insight system is now
embedded across the
organisation.
• Reports continually produced
to hold departments/managers
to account.
• The ten core high-volume
mandatory training subjects have
been converted to online
programmes
• From Jan 2017 new starters are
required to complete ten core
programmes before starting in
role
3 3 9 • Strengthen
accountability of
divisional management
• Fines for DNAs will be
introduced (SSt, Sep 17 )
3 2 6
23
Ju
n 2
01
7
1 O
ct 2
01
7
12 9 9 Board 2
BOARD ASSURANCE FRAMEWORK AND CORPORATE RISK REGISTER
QUARTER 1 UPDATER
isk
Re
f
Co
rpo
rate
Ob
ject
ive
Exe
cuti
ve
Ow
ne
r
Co
mm
itte
eRisk Description Source of risk Existing Controls
Co
nse
qu
en
ce
Like
liho
od
Ris
k sc
ore Gaps in Controls
Further Controls
(who, by when)
Co
nse
qu
en
ce
Like
liho
od
Ris
k sc
ore
Last
re
vie
w
Ne
xt R
evi
ew
Pre
vio
us
sco
re
Cu
rre
nt
sco
re
Ne
xt s
core Source of Assurance
Ass
ura
nce
leve
l
Gaps in Assurance(ref no. of further
assurance)
Further assurances
(who, by when)
Gaps in AssuranceDate TrendReference Gaps in Controls Existing assuranceCurrent Residual
9
Car
e
Dec
lan
Fla
nag
an
Qu
alit
y &
Saf
ety
Co
mm
itte
e
IF proper clinical practice is
not followed
THEN there may be serious
clinical incidents
LEADING TO patient harm
and damage to reputation
Serious incident
reporting
• Robust clinical governance
arrangements exist.
• Generally good clinical
procedures and guidelines are in
place.
• The level of serious incidents
remains fairly consistent from
year to year and very low
compared to other trusts
• Revised WHO checklist process
in place
3 3 9 • Serious incidents and
never events have
occurred in areas
thought to be controlled
• To be determined 3 2 6
2 M
ar 2
01
7
1 J
ul 2
01
7
9 9 9 Quality and safety
committee
2 • WHO checklist not
consistently
followed
• Monthly audits taking
place (ADw, Aug 2017)
21
Stev
en D
avie
s
IF the City Rd estate is not
maintained effectively
THEN this could lead to
operational or service
failure
LEADING TO poor patient
care, loss of income or
damage to reputation
Capital programme
and oversight group
• Backlog and other maintenance
programme embedded in
working practices of estates team
• System in place to monitor
compliance and delivery
3 3 9 • Approval of land purchase
(JM, Dec 17)
3 3 9
22
Ju
n 2
01
7
1 O
ct 2
01
7
12 9 9 Quality and safety
committee
2
39
Peo
ple
Sally
Sto
rey
Peo
ple
, Div
ersi
ty a
nd
Ed
uca
tio
n C
om
mit
tee
IF Brexit affects
recruitment and retention
THEN there may be staff
shortages and skills gaps
LEADING TO poor patient
care or a reduction in
income
Feedback from
affected staff
• Currently recruitment is open
world-wide and is not restricted
to EU applicants
• CEO message of support to all
EU staff
• CEO and HRD engaged in
influencing ministers through
various national groups
• seminars arranged for EU staff
to provide legal advice about
residency
• Nursing strategy actions to
improve ability to recruit nurses
Extra resource added to support
retention
3 3 9 • Regular communications to
affected staff (SSt, tbc)
3 2 6
23
Ju
n 2
01
7
1 O
ct 2
01
7
9 9 9 Management executive 1
40
Stev
en D
avie
s
Qu
alit
y &
Saf
ety
Co
mm
itte
e
IF there is inconsistent
management of the estate
across the network
THEN there may be a
failure to meet statutory
obligations for the
management of estate
related issues
LEADING TO poor patient
experience, loss of income
or damage to reputation
• System in place for recording
statutory and mandatory
compliance and identifying where
areas of non-compliance exist.
• Some leases are in place (incl.
St George's)
• Compliance assurance sought
regularly from host trusts
• Interim compliance officer
appointed
3 3 9 • Effective (e.g.
enforceable) leases in
place across the
network
• Convert existing agreements
to leases (CH, Jan 18)
3 2 6
22
Ju
n 2
01
7
1 O
ct 2
01
7
12 9 9 Quality and safety
committee
BOARD ASSURANCE FRAMEWORK AND CORPORATE RISK REGISTER
QUARTER 1 UPDATER
isk
Re
f
Co
rpo
rate
Ob
ject
ive
Exe
cuti
ve
Ow
ne
r
Co
mm
itte
eRisk Description Source of risk Existing Controls
Co
nse
qu
en
ce
Like
liho
od
Ris
k sc
ore Gaps in Controls
Further Controls
(who, by when)
Co
nse
qu
en
ce
Like
liho
od
Ris
k sc
ore
Last
re
vie
w
Ne
xt R
evi
ew
Pre
vio
us
sco
re
Cu
rre
nt
sco
re
Ne
xt s
core Source of Assurance
Ass
ura
nce
leve
l
Gaps in Assurance(ref no. of further
assurance)
Further assurances
(who, by when)
Gaps in AssuranceDate TrendReference Gaps in Controls Existing assuranceCurrent Residual
