Risk Register - Education Department Risks and Mitigations

Transcription

1 Audit Committee 24 Risk Register - Education Department Risks and Executive summary and recommendations Introduction At its meeting on 26 September 2008, the Audit Committee instructed the Chief Executive to ensure that all managers, who had responsibility for risks identified on the risk register, present a review of their respective risks and mitigation plans to the Committee once each financial year. This paper presents the risks owned by the Director of Education (a post currently filled in an acting capacity to cover maternity leave from to January 2011) and associated risks owned by the Partner Manager and Director of IT. The substantive paper which follows provides a more detailed summary of the risks and mitigations for the Committee to review, whilst the appendices for the paper are extracts from the risk register. Decision This paper is for information only. No decision is required. Background information Minutes of the Audit Committee, 26 September 2009, item 8.3 Health Professions Council Risk Register Resource implications None Financial implications None Appendices Substantive Paper Education Department Risks and, p 2 Appendix one Education and Partners risks, p 8 Appendix two HPC Risk Matrix, p 9 Appendix three Risk Matrix Definitions, p 10 Date of paper 9 Date Ver. Dept/Cmte Doc Type Title Status Int. Aud a HRD PPR Education Department Risks and Final Public - Cover Paper DD: None RD: None 1

2 Risk Register Education Department Risks and - About this paper The Risk Register is the Health Professions Council (HPC) document that identifies the risks to which the Health Professions Council is exposed. The Risk Register is published biannually, following a review by the risk owners. The Education Department has risks that are specifically owned by the Director of Education. Additionally, the Education Department is subject to risks emerging from the Partners Department and IT Department. This is owed to Visitor Partners and information systems being a key resource in making recommendations to the HPC Education and Training Committee and managing records of HPC approved programmes of study, respectively. About the Education Department The Education Department is responsible for the list of approved education and training programmes published on the HPC website. An individual must successfully complete one of these programmes in order to be eligible to apply to the HPC Register through the UK approved programme route. The Education Department operates the following four operational processes which affect education providers of pre-registration programmes of study: Approval Annual monitoring Major change Education provider complaints Additional to the operational processes a series of supporting activities are performed which include: An annual series of seminars/workshops A tri-annual newsletter to all education stakeholders (inclusive of Partners) Reviewing and updating of publications for stakeholders Partner selection, recruitment and training Maintenance of Department information systems Many of the risk mitigations for the Department arise from the routine implementation of the operational processes and supporting activities. 2

3 Education Department Risks and Failure to detect low education providers standards (7.1) low risk The standards of education and training and standards of proficiency are the two key sets of standards used to approve pre-registration education and training. In meeting the standards of education and training a programme will produce individuals who meet the standards of proficiency. Failure of an education provider to meet these standards exposes the risk of applicants to the Register through the UK approved programme route not meeting all the required standards for safe and effective practise. The first level of mitigation is the routine application of the approval and monitoring processes. The approval process ensures that all standards are met before a programme is approved. The annual monitoring process ensures that all programmes are routinely subject to an appropriate level of scrutiny. The major change process allows education providers to inform the HPC of significant changes to the way a programme meets the standards. The complaints process allows individuals to inform us of their concerns that a programme may not be meeting our standards. These processes are dependent on the knowledge and skills of the individuals making decisions and recommendations in relation to the standards. Members of the executive are taken through a 6 week induction programme, including observation visits, before being assessed to determine readiness for solo working. Visitor Partners are required to undergo a two day training programme before work can be undertaken for the Department and less experienced visitors are always accompanied by a more experienced visitor on their first visit. Members of the Education and Training Committee also receive training from the executive in relation to the operational processes and decision-making. Education providers refusing visits or not submitting data (7.2) low risk Approval is granted on an open ended basis and therefore education providers are expected to collaborate with the HPC in relation to organising follow-up visits or submitting evidence for the monitoring or complaints processes. Failure to submit information can delay or prevent processes taking place which in turn exposes the risk of failure to detect an education provider not meeting relevant standards and a reduction in confidence in the efficacy of the processes. The Health Professions Order 2001 states in Part IV, Article 7, paragraph 4 states that: Where an institution refuses any reasonable request for information made by the Committee or the Council under this article, the Committee with the approval of the Council may refuse to approve, or withdraw approval from...any education, training, qualification or institution to which the information relates. Evidently, the preferred approach of the Department is a collaborative one and so the series of supporting activities undertaken each year are focussed on making the requirements of the operational processes clear. Accordingly 3

4 requests for information to education providers are made as far ahead as possible to prevent refusal occurring. Inability to conduct visits and monitoring tasks (7.3) low risk The approval and monitoring processes are resource intensive to operate with a reliance on significant human resource in the form of members of the executive and Visitor Partners. Partner resources will be addressed in a later item in this paper. Inability to resource an operational activity will open the HPC to the risk of the failure to detect an education provider not meeting standards and also lead to a reduction in confidence from stakeholders. The first level of mitigation relates to resource planning undertaken by the Director of Education in response to known changes in the approval and monitoring workload. For example, prior to a new profession joining the HPC the impact on Departmental resources is considered and the human resources of the Department increased in sympathy if necessary. Visit scheduling is then conducted to ensure that the maximum resources of the Department are never allocated to simultaneous visits (ie an Education Manager or the Director of Education can undertake visits as required in the event of sudden changes to resourcing). The second level of mitigation is linked to the lead-in times and requirements of the operational processes. The long lead-in times of the processes (6 months in the case of the approval process) allow resource allocation to be conducted with sufficient time to redeploy resources and to recruit and induct new employees if a resignation occurs. Elements of the workload are also highly predictable (annual monitoring) which allows annual planning of resources to take place before visits have entered into the schedule. At particular periods of peak activity it is also possible owing to budget planning to recruit temporary members of staff to backfill positions or to undertake particular administrative functions in the Department. Loss of support from education providers (7.3) low risk The operational processes rely on the collaborative working of the HPC and education providers. Any damage to the relationship between the HPC and the education providers may make implementation of the processes more challenging. Ultimately, this increases the risk of failure to detect programmes of study which do not meet all the relevant standards. The Education Department Work Plan contains reference to the Council s strategic objectives in the area of education. In these objectives the Council intends to develop efficient business processes and also to ensure all stakeholders are made aware of the impact of regulation on them. In meeting these objectives, the Education Department processes have been designed to be reflective of the internal processes of the majority of the education providers with whom we work. We also commit to communications activities through our supporting activities to ensure stakeholder engagement. A biennial feedback gathering process is also conducted to ensure that our processes meet the needs of the education providers. Feedback data is reviewed by the Education and Training Committee and is used to determine process improvements. 4

5 The Education Department also engages with various fora related to education through attendance at conferences or sitting on advisory groups. The Visitor Partners will also, for the most part, work in the education or placement setting and so our engagement with this group allows the Department to have a strong relationship with education providers and placement providers. Education database failure (7.5) low risk This risk is owned by the Director of IT but situated in the Education Department risk log. The education database contains the majority of organisational records in relation to the approved programmes and their interaction with the approval and monitoring processes. Loss of this data would have a significant impact of the analysis of cumulative change to approved programmes and also on ongoing operational activity. In turn this would impact upon the ability to detect failure of an education provider to meet appropriate standards. The education database is subject to regular back-ups in order to ensure that any data losses, should they occur, are minimised. The database is currently supported internally by IT but work is underway to outsource support following the IT Department strategy. The database has been subject to Disaster Recovery / Business Continuity testing and therefore is secure in the event of loss of the server located at Park House. The risks associated to Department information systems will change considerably over the next three financial years. The change in the risks will be owed to the commencement of (subject to approval by the Finance and Resources Committee) a major project to review and change all Department processes and systems to increase efficiency of operation. Partners Department Risks and Inability to recruit and/or retain suitable Partners (6.1) low risk The Partners Department is responsible for the planning and implementation of recruitment of new visitors in response to new professions joining the HPC or the resignation of existing Partners. As Partners are a key resource in the approval and monitoring processes, failure to recruit sufficient numbers would have an impact on the operations of the Education Department. The Partners Department monitors the numbers of Partners against the Departmental estimates for numbers needed for a particular financial year. These numbers feed into a recruitment strategy to ensure there are appropriate numbers. In instances of new professions joining the organisation, Partner recruitment is tied into a major project and is conducted prior to the opening of the new Register. Partner fees and expenses are reviewed on a regular basis to ensure they remain competitive for the type of work that is undertaken. A recent review of fees led to changes in April

6 Health & Safety of Partners (6.3) low risk Partners conduct work for HPC both in the Park House offices and off site. Failure to ensure the health and safety of Partners whilst they are engaged in HPC business may have a significant financial impact on the organisation. All onsite work is preceded by health and safety information in order to ensure that Partners are fully informed. For visitors choosing to drive to attend a particular piece of work, a road safety policy has been produced and disseminated to Partners. HPC is also covered by personal injury, travel and liability insurance. Partners poor performance (6.4) low risk Partners make recommendations to the Education and Training Committee. Partner performance can be affected in a range of ways, but the key areas that could be highlighted as risks are in relation to unsound or unreasoned decisionmaking and engaging with education providers in ways that do not adhere to the organisational guiding principles or bring the organisation into disrepute. These risks in turn increase the risk of failure to detect programmes not meeting all the relevant standards or loss of stakeholder confidence. The key mitigations for this area are the selection processes and training for Visitor Partners. Selection processes utilise competencies linked to the Visitor Partner role which are assessed via application and interview. Visitor training (which is required before work can be undertaken) covers matters in relation to decision making and working collaboratively with institutions. The Partners Department are currently working on a robust Partner appraisal system also which will allow performance data to be collected by the organisation. Currently, a Partner complaints system is in place to allow performance issues to be managed appropriately. Another mitigation specific to the Education Department and its interaction with visitors can be found in the executive job-role of the Education Officer. The Education Officer plays a role in managing the Visitor Partners at the visit to ensure that only HPC standards are used in decision making and also that visitors take a collaborative posture in their dealings with education providers. Education Officers also draft reports detailing Visitors Partners recommendations which must be ratified by the Education and Training Committee before being considered final. Incorrect interpretation of HPO in use of Partners (6.5) low risk The Health Professions Order, 2001 sets out requirements for visitor partners which must be fulfilled to ensure that the organisation follows the guiding legislation. Failure to allocate appropriate visitors will increase the risk of failure to detect programmes not meeting relevant standards. Additionally, this risk also increases the chance of successful challenges to Education and Trainign Committee decision-making taking place 6

7 The central mitigation for this risk is found in the accuracy of Visitor Partner information recorded both by the Partners Department and the Education Department. These records contain information related to the: profession, modality (when appropriate), occupational background, training status, fitness to practise status, and experience levels for each Partner. This information is used to allocate Visitor Partners to operational work following the requirements of the Health Professions Order, 2001 and also organisationally defined good practice. A conflict of interest procedure is also undertaken for every instance of work undertaken. The Partner selection, recruitment and training mechanisms also ensure that individual Visitor Partners are suitably qualified and experienced to undertake the role. Finally, visitor allocation to work is conducted by individuals with powers delegated from the Education and Training Committee. These individuals all sit in the managerial level of the organisation and are appropriately trained and supported to make sound decisions when allocating visitors to particular pieces of operational work. 7

8 Appendix 1 - EDUCATION AND PARTNERS RISKS THE HEALTH PROFESSIONS COUNCIL RISK ASSESSMENT Education Ref Category Ref # Description 7 Education Failure to detect low education providers standards Links to 1.1, 4.3, 6.4 Education providers refusing visits or not submitting data Links to 1.1 Inability to conduct visits and monitoring tasks Links to 1.1, 6.1, 11.2 & 11.3 Loss of support from education providers Links to 1.1, 14.2 Risk owner (primary person responsible for assessing and managing the ongoing risk) Impact before mitigations Likelihood before mitigations Risk Score = Impact x Likelihood Mitigation I Mitigation II Mitigation III Director of Education Approvals & Monitoring processes Regular training of employees and visitors Director of Education Legal powers (HPO 2001) Director of Education Chief Executive or Director of Education Adequate resourcing, training and visit scheduling Delivery of Education strategy as documented in regular work plan Delivery of Education Dpt supporting activities as documented in regular work plan Approvals & monitoring processes Partnerships with Visitors and professional groups. Complaints about an approved programme process Temporary staff hire to backfill or clear work backlogs Publications, Newsletters, website content, inclusion in consultations and relevant PLGs, consultations with education providers RISK score after Mitigation RISK score after Mitigation September Education database failure Director of IT Effective backup and recovery processes In house skills to support system DR/BC tests Partners Ref Category Ref # Description 6 Partners 6.1 Inability to recruit and/or retain suitable Partners Links to 4.10, 11.3, 7.3, Incorrect interpretation of law and/or SI's resulting in CHRE review Risk owner (primary person responsible for assessing and managing the ongoing risk) Impact before mitigations Likelihood before mitigations Partner Manager Sound recruitment strategy. Training Director of FTP, Director of Education, Head of Registration, Partner Manager Risk Score = Impact x Likelihood Mitigation I Mitigation II Mitigation III HR Strategy: Appropriate compensation package in place. RISK score after Mitigation RISK score after Mitigation September 2009 Regular appraisal system Training Legal Assessors advice availability Regular appraisal system 6.3 Health & Safety of Partners Partner Manager Links to 4.9, Partners poor performance Director of FTP, Director of Education, Head of Registration, Partner Manager H&S briefing at start of any HPC sponsored event. Road Safety policy (for vehicle drivers). Personal Injury and Travel insurance. Liability Insurance Regular appraisal system Regular training 6.5 Incorrect interpretation of HPO in use of Partners Director of FTP, Director of Education, Head of Registration, Partner Manager Accurate and up-to-date Partner list Effective process allocating Correct (robust) selection process and use partners to specific functions; of qualified partners Visits, Hearings etc Date: Ver: a Dept/Cmte: HRD Doc Type: PPR Title: Education Risk Register - Appendices Status: Final Security: Public page 8

9 Strategic Programme / Project Operational Status: Final Security: Public page 9 Appendix 2 - HPC RISK MATRIX Public Protection Financial Reputation Catastrophic 5 Catastrophic 5 Catastrophic 5 A systematic failure for which HPC are ultimately responsible for, exposes the public to serious harm in cases where Unfunded pressures greater than Incompetence/ maladministration or other event mitigation was expected. 1 million that will destroy public trust or a key relationship Significant 4 Significant 4 Significant 4 A systematic failure for which HPC are ultimately responsible Incompetence/ maladministration that will for, exposes more than 10 people to harm in cases where Unfunded pressures greater than undermine public trust or a key relationship for a mitigation was expected. 50,000 sustained period or at a critical moment. Moderate 3 Moderate 3 Moderate Incompetence/ maladministration that will undermine public trust or a key relationship for a short period. Example Policy U-turn A systemic failure for which HPC are ultimately responsible for exposes more than 2 people to harm in cases when mitigation was expected. Unfunded pressures greater than 8,000 IMPACT Minor 2 Minor 2 Failure to detect low education providers standards Unfunded pressures over 2,000 Event that will lead to widespread public criticism. A systemic failure which results in inadequate protection for individuals/individual communities, including failure to resolve celebrity cases. Insignificant 1 Insignificant 1 Education providers refusing visits or not submitting data Event that will lead to public criticism by external stakeholders as anticipated. Unfunded pressures over 1,000 A systemic failure for which fails to address an operational requirement Negligible1 Rare 2 Unlikely 3 Possible 4 Probable 5 KEY "Clear and present danger", represented by this risk - will probably impact on this initiative - sooner rather than later. Likely to happen at some point during the next one or two years. May well occur during the lifetime of the strategy. Only small chance of occurring in the lifetime of the strategy. Extremely infrequent unlikely to happen in a strategic environment or occur during a project or programmes lifecycle. May occur once a year or so in an >11 High Risk: Urgent action required Likely to occur in the life-cycle of the project, probably early on and perhaps more than once. Likely to happen in the lifecycle of the programme or project. May occur during the life of the programme or project. Not likely to occur during the lifecycle of the programme of project. Extremely infrequent unlikely to happen in a strategic environment or occur during a project or programmes lifecycle. May occur once a year or so in an 6-10 Medium Risk: Some action required The threat is likely to happen almost every day. May well happen on a weekly basis. May well happen on a monthly basis. Does not happen often - once every six months. Extremely infrequent unlikely to happen in a strategic environment or occur during a project or programmes lifecycle. May occur once a year or so in an <5 Risk: Ongoing monitoring required LIKELIHOOD Doc Type: PPR Title: Education Risk Register - Appendices Date: Ver: a Dept/Cmte: HRD

10 Appendix 3 - RISK MATRIX DEFINITIONS IMPACT TYPES LIKELIHOOD AREAS IMPACT Public Protection Financial Reputation Strategic Programme / Project Operational Catastrophic 5 Catastrophic 5 Catastrophic 5 Probable 5 Probable 5 Probable 5 A systematic failure for which HPC are ultimately responsible for, exposes the public to serious harm in cases where mitigation was expected. Unfunded pressures greater than 1 million Incompetence/ maladministration or other event that will destroy public trust or a key relationship "Clear and present danger", represented by this risk - will probably impact on this initiative - sooner rather than later. Likely to occur in the life-cycle of the project, probably early on and perhaps more than once. The threat is likely to happen almost every day. Significant 4 Significant 4 Significant 4 Possible 4 Possible 4 Possible 4 A systematic failure for which Incompetence/ maladministration HPC are ultimately responsible Unfunded pressures greater than that will undermine public trust or Likely to happen at some point Likely to happen in the life-cycle May well happen on a weekly for, exposes more than 10 people 50,000 a key relationship for a sustained during the next one or two years. of the programme or project. basis. to harm in cases where mitigation period or at a critical moment. was expected. Failure to detect low education providers Moderate 3 Moderate 3 Unlikely 3 Unlikely 3 Unlikely 3 standards A systemic failure for which HPC are ultimately responsible for exposes more than 2 people to harm in cases when mitigation was expected. Minor 2 A systemic failure which results in inadequate protection for individuals/individual communities, including failure to resolve celebrity cases. Unfunded pressures greater than 8,000 Incompetence/ maladministration that will undermine public trust or a key relationship for a short period. Example Policy U-turn LIKELIHOOD May well occur during the lifetime of the strategy. May occur during the life of the programme or project. May well happen on a monthly basis. Education providers refusing visits or not submitting data Minor 2 Rare 2 Rare 2 Rare 2 Unfunded pressures over 2,000 Event that will lead to widespread public criticism. Only small chance of occurring in the lifetime of the strategy. Not likely to occur during the lifecycle of the programme of project. Does not happen often - once every six months. Insignificant 1 Inability to conduct visits and monitoring tasks Insignificant 1 Negligible1 Negligible1 Negligible1 A systemic failure for which fails to address an operational requirement Unfunded pressures over 1,000 Event that will lead to public criticism by external stakeholders as anticipated. Extremely infrequent unlikely to happen in a strategic environment or occur during a project or programmes lifecycle. May occur once a year or so in an Extremely infrequent unlikely to happen in a strategic environment or occur during a project or programmes lifecycle. May occur once a year or so in an Extremely infrequent unlikely to happen in a strategic environment or occur during a project or programmes lifecycle. May occur once a year or so in an Date: Ver: a Dept/Cmte: HRD Doc Type: PPR Title: Education Risk Register - Appendices Status: Final Security: Public page 10