Asbestos Management. Final Internal Audit Report 2018/19. Powys Teaching Health Board. NHS Wales Shared Services Partnership

Transcription

1 Final Internal Audit Report 2018/19 NHS Wales Shared Services Partnership Audit and Assurance Services Reasonable Assurance - + Previous rating: 2012/13 Limited Assurance

2 Report Contents CONTENTS Page 1. Introduction and Background 4 2. Scope and Objectives 4 3. Associated Risks 5 Opinion and Key Findings 4. Overall Assurance Opinion 5 5. Assurance Summary 7 6. Summary of Audit Findings 7 Conclusion and Recommendations 7. Summary of Recommendations 11 Appendix A Appendix B Management action plan Audit assurance ratings Review reference: SSU_PTHB_1819_05 Report status: Final Fieldwork commencement: 23 May 2018 Fieldwork completion: 19 September 2018 Draft report issued: 20 September 2018 Management response received: 12 October 2018 Updated draft report issued 23 October 2018 Executive approval received 30 October 2018 Final report issued: 31 October 2018 Auditor/s: NWSSP: Audit & Assurance - Specialist Services Unit Executive sign off: Distribution: Committee: Hayley Thomas, Director of Planning & Performance Wayne Tannahill, Assistant Director of Estates & Property Cefin Francis, Estates Officer: Building [Asbestos Manager] Mandy Collins, Board Secretary Audit Committee NHS Wales Audit & Assurance Services Page 2

3 Report Contents ACKNOWLEDGEMENT NHS Wales Audit & Assurance Services would like to acknowledge the time and co-operation given by management and staff during the course of this review. Please note: This audit report has been prepared for internal use only. Audit & Assurance Services reports are prepared, in accordance with the Service Strategy and Terms of Reference, approved by the Audit Committee. Audit reports are prepared by the staff of the NHS Wales Shared Services Partnership Audit and Assurance Services, and addressed to Independent Members or officers including those designated as Accountable Officer. They are prepared for the sole use of the Powys teaching Health Board and no responsibility is taken by the Audit and Assurance Services Internal Auditors to any director or officer in their individual capacity, or to any third party. NHS Wales Audit & Assurance Services Page 3

4 Final Internal Audit Report 1. Introduction and Background The Asbestos Management audit was commissioned in order to evaluate the controls and practices in place within Powys teaching Health Board (the thb) to ensure that the key asbestos regulatory requirements (Control of Asbestos Regulations 2012) were adequately addressed and appropriate management arrangements were embedded within the organisation. The thb had recently commissioned independent surveys across all of its the sites to determine the most up to date material and priority assessments of the known Asbestos Containing Materials (ACMs) within the buildings; hence fulfilling their duty of care. 2. Scope and Objectives The review was undertaken to determine the adequacy of, and operational compliance with, the systems and procedures of the thb, taking account of relevant NHS and other supporting regulatory and procedural requirements, as appropriate. The audit evaluated the systems and controls in place within the thb with a view to delivering reasonable assurance to the Audit Committee that risks material to the objectives of the areas covered were appropriately managed. Accordingly, the focus of the audit was directed to the following areas: Governance to ensure appropriate executive ownership and that a suitably qualified individual had been allocated day-to-day management of asbestos. An approved Asbestos Policy had been implemented and operated effectively. Identification appropriate surveys had been undertaken to identify the presence of asbestos and the potential exposure risk to staff / public. Records to ensure the thb held a fully comprehensive asbestos register to identify the locations of Asbestos Containing Materials (ACMs) on all sites. Risk Management all high risk ACMs had been identified and escalated to the thb s corporate risk register; including proposed action. Action Plans the thb had a range of management plans in place to address how ACMs are managed in each premises. Operational Delivery compliance with Control of Asbestos Regulations 2012 was demonstrated through operational activities including e.g. o Plans of Work; o Licensing of Work with Asbestos; o Notification of Work with Asbestos; NHS Wales Audit & Assurance Services Page 4

5 Final Internal Audit Report o Information, Instruction and Training; o Prevention or Reduction of Exposure to Asbestos; o Use and Maintenance of Control Measures; o Provision and Cleaning of Protective Clothing; o Arrangements to deal with Accidents, Incidents and Emergencies; and o Air Monitoring. 3. Associated Risks The potential risks considered during the review were as follows: Lack of visible Executive support and coordination of asbestos issues. Asbestos issues are not adequately identified and understood. Records are inadequate to allow effective decision making. Management actions are ineffective or inappropriate. The thb duties are not discharged in accordance with regulations. OPINION AND KEY FINDINGS 4. Overall Assurance Opinion We are required to provide an opinion as to the adequacy and effectiveness of the system of internal control under review. The opinion is based on the work performed as set out in the scope and objectives within this report. An overall assurance rating is provided describing the effectiveness of the system of internal control in place to manage the identified risks associated with the objectives covered in this review. Sound governance arrangements were noted within the thb in respect of asbestos management; with asbestos risks reported to the Asbestos Management Working Group [higher risks also reported to the Estates Compliance Group] and collation of data from the external re-inspection survey being finalised. Updated training on asbestos awareness and nonlicensed works had also been delivered to key members of the Estates department. However, the audit identified a number of control weaknesses including: The need to formally ratify the updated Asbestos Policy; The period of time that had elapsed since completion of previous management survey and re-inspection surveys; The absence of management review, and regular/timely update of the Asbestos Register; NHS Wales Audit & Assurance Services Page 5

6 Final Internal Audit Report Review and enhancement of the highlight reports presented to both the Asbestos Management Working Group and the Estates Compliance Group; Training undertaken by the Deputy Asbestos Manager; and The lack of retention of supporting documentation for permits to work. The on-going work being progressed to implement changes is acknowledged (specifically the implementation of a database as the thb s asbestos register [accessible to all]). Accordingly, the level of assurance given as to the effectiveness of the system of internal control in place to manage the risks associated with Asbestos Management is assessed as Reasonable Assurance. Management actions taken to address the weaknesses identified will be reviewed and affirmed at the Estates Assurance Follow Up audit scheduled for Q4 2018/19. RATING INDICATOR DEFINITION Reasonable Assurance The Board can take reasonable assurance that arrangements to secure governance, risk management and internal control, within those areas under review, are suitably designed and applied effectively. Some matters require management attention with low to moderate impact on residual risk exposure until resolved. The overall level of assurance that can be assigned to a review is dependent on the severity of the findings as applied against the specific review objectives and should therefore be considered in that context. NHS Wales Audit & Assurance Services Page 6

7 Final Internal Audit Report 5. Assurance Summary The summary of assurance given against the individual objectives is described in the table below: Assurance Summary 1 Governance 2 Identification 3 Records 4 Risk Management 5 Action Plans 6 Operational Delivery * The above ratings are not necessarily given equal weighting when generating the audit opinion. Design of Systems/Controls The findings from the review have highlighted two issues that were classified as weaknesses in the system control/design for asbestos management. Operation of System/Controls The findings from the review have highlighted six issues that were classified as weaknesses in the operation of the designed system/control for asbestos management. 6. Summary of Audit Findings The key findings are reported within the Management Action Plan (Appendix A). Governance Sound governance arrangements were noted operating within the thb in respect of asbestos management. The Asbestos Management Working Group reports to the Estates Compliance Group; which in turn reports to the Capital & Estates Improvement Group. This Group is directly accountable to the Board through the Finance, Planning & Performance Committee, providing effective linkage to the Executive for purposes of assurance and governance. Reporting of appropriate content reflecting the risks and issues was evident at the time of the audit, and all meetings were confirmed as being quorate NHS Wales Audit & Assurance Services Page 7

8 Final Internal Audit Report [as determined within the relevant terms of reference for both the working group and the compliance group] during the period of review. The Asbestos Policy had recently been updated for the thb standard template. However, it had not been formally ratified (recommendation 1). The procedures had recently been updated with the new version approved by the Asbestos Management Working Group. The operational procedures reflected the requirements of the Control of Asbestos Regulations (CAR) 2012 and Section 4 of the Approved Code of Practice (ACOP) L143. However, we have made recommendations relating to enhanced content and co-ordination of review at any future update of the Policy (recommendation 2). Training on asbestos awareness and non-licensed works was delivered to selected members of the thb s Estates team in January However, it was noted reminders to refresh training are not issued via ESR (recommendation 3). Furthermore, there was no evidence to confirm that the Deputy Asbestos Manager had received training following their appointment to the role [November 2017] (recommendation 4). Whilst the recently completed management review of the Operational Asbestos Management Plan was noted, enhancements to the document were required. Therefore, reasonable assurance has been determined in this area. Identification A full management survey was last completed in Discussions with the Asbestos Manager noted that such a survey is not expected to be repeated by the thb until all proposed refurbishment work has been completed across the sites. As stated in CAR 2012; the time between inspections will depend on the type of material, where it is and what condition, but it should be at least every 6 to 12 months. The current asbestos register is populated with data from the 2015 re-inspection exercise; therefore not meeting the requirements of the regulations (recommendation 5). The 2018 re-inspections were being completed at the date of this audit by an external UKAS (UK Accreditation Service) accredited surveyor, with the use of a new externally hosted database to record the results (full completion May 2018). More detailed refurbishment or demolition surveys had been undertaken on sites as required. Noting the recent completion of re-inspections surveys across the thb s sites, we have determined reasonable assurance in this area. NHS Wales Audit & Assurance Services Page 8

9 Final Internal Audit Report Records As noted above, the thb was in the process of collating the output of the re-inspection surveys onto an externally hosted database. The database will facilitate access to up-to-date asbestos information by thb staff and contractors, where appropriate. The existing asbestos register [spreadsheet based] remained available (whilst noting the out-dated content). There was minimal evidence to suggest that the content had been regularly reviewed and updated by the Asbestos Manager, or that it was widely shared / discussed within the established governance arrangements (recommendations 6 & 7). However, it is recognised that the implementation of the database will allow live updates and changes to the register between re-inspection. A process document had been produced to support the update process. The procedures state that for external contractors, a copy of the Asbestos Register along with any refurbishment and demolition surveys will be made available as part of the tender documentation. Further to this, the thb had developed an Information for Contractors leaflet to be issued upon commencement of works at thb premises. The requirement for contractors to review the site specific register prior to commencing works was included within the booklet. There was no evidence to confirm that contractors had complied with these requirements; nor was there evidence of checking by the Asbestos Manager [or appropriate deputy] to ensure conformity (recommendation 8) Noting the lack of evidence to confirm the regular review of the asbestos register, limited assurance has been determined. Risk Management Asbestos specific risks were included within the highlight reports prepared for the Asbestos Management Working Group; the reports were also included on the agenda for the Estates Compliance Group and the Capital & Estates Improvement Group. Asbestos specific risks were not included on the Corporate Risk Register; rather implied with the section Safety; inadequate and non-compliance estate in some areas. Whilst the risks included in the highlight reports had appropriate mitigating actions recorded, the frequency of their detailed review was not apparent. Risks were included consecutively yet commentary provided stated work to address was complete. Only current risks should be portrayed on the highlight reports with a summary of changes / movements highlighted and appropriate timescales included. Discussions with management noted that the highlight reports are used across a suite of compliance topic areas and are subject to regular review in terms of content and presentation. However, whilst the report is NHS Wales Audit & Assurance Services Page 9

10 Final Internal Audit Report considered to meet the key criteria in its current form, management agreed that the generic document will be reviewed to demonstrate direction of travel and achievable target dates; therefore no audit recommendation has been raised. While the need for enhancements to the highlight reports has been noted, noting coverage of asbestos specific risks within a highlight report presented to an appropriate committee, reasonable assurance has been determined in relation to controls this area. Action Plans As reported at the Estates Compliance Group meetings, due to the aging estate in Powys, it is always a risk that asbestos may be found when works are undertaken at thb premises. The required actions for all identified Asbestos Containing Materials were maintained within the asbestos register. However, as per recommendation 6, regular review was not evidenced, with data having been populated with 2015 re-inspection data and no evidence of subsequent updates. At the date of this audit, data from the 2018 re-inspection exercise was being entered onto a database hosted by the inspection company. The database will facilitate the production of enhanced management information in future. There was no specific asbestos management funding allocated within the discretionary capital programme; rather it was incorporated into monies ring-fenced for estate compliance schemes. The thb stated that such schemes were for the mitigation of high risks, however, the internal categorisation of funds were sufficiently flexible to accommodate changing priorities. Noting the above, reasonable assurance has been determined for this area. Operational Delivery Non notifiable, non-licensed work is undertaken by members of the thb Estates team; for which appropriate training had been provided. Other scopes of asbestos work [notifiable non-licensed; licensed and removal / remediation works], are contracted to licensed contractors. No central listing was maintained recording where work on asbestos containing materials had been performed, nor was this information reflected within the asbestos register (recommendation 6). A review of the work processes has been undertaken through reference to the permit to work system that was in operation [noting that this only allowed review where permits have been recorded as awarded]. NHS Wales Audit & Assurance Services Page 10

11 Final Internal Audit Report Eight permits were recorded as awarded between the period July 2017 to May However, deficiencies were noted in relation to risk assessments and plans of work (e.g. risk assessments were not completed for internal staff, and plans of work were not found across the sample). These issues related to retention of documentary evidence, rather than actual working practices (recommendation 9). As indicated previously, a Contractors Information leaflet was provided to each external contractor upon appointment; which stated that the contractor must ensure that the register (site asbestos register) has been consulted prior to commencement of work and that there is documented evidence of such consultation. No documented evidence of this consultation was identified (see recommendation 8). While internal members of staff were appropriately trained for their designated work, improvements were required in the retention of documentation [both internal and external operatives]. Therefore, limited assurance has been determined for this area. 7. Summary of Recommendations The audit findings, recommendations are detailed in Appendix A together with the management action plan and implementation timetable. A summary of these recommendations by priority is outlined below: Priority H M L Total Number of recommendations Actioned since fieldwork Total NHS Wales Audit & Assurance Services Page 11

12 Management Action Plan Finding: Policy and procedures The thb had an Asbestos Policy ( policy ) in place accessible to all members of thb staff which was underpinned by the Asbestos Management Plan ( the procedures ). The policy had recently been updated to reflect the thb standard template. However, it had not been formally ratified. The procedures had recently been updated within the required time-frame, with the new version approved by the Asbestos Management Sub Group in June 2018 (in advance of the listed August 2018 review date). It was evident from audit review of this document that further information was required within the procedures relating to disposal of asbestos materials and associated records for example: Waste Consignment note and length of retention [in accordance with HSE EM9: Disposal of Asbestos Waste] Assurances relating to a clean site following works or demolition; Personal Protective Equipment ( PPE ) record keeping. Recommendations 1 & 2 Risk Members of staff not following current procedure / protocol. Priority level 1. The updated Asbestos Policy will be formally ratified (O). Low 2. The Asbestos Management Plan will be re-reviewed to ensure requirements of the Regulations are appropriately reflected within the operations of the thb and such reviews co-ordinated with Policy reviews (O) Low NHS Wales Audit & Assurance Services Appendix A

13 Management Action Plan Management Response 1. The updated policy will be formally approved. 2. Asbestos Management Plan (AMP): this describes the safe processes undertaken by the health board when managing asbestos and is backed up by more detail in CAR Further notes will be added as follows: Responsible Officer/ Deadline Asbestos Manager 1. November October 2018 Waste Consignment Note: waste transfer note will be added for completion by internal staff on non-licensed work. Amendment will be incorporated. Clean site following works: we would produce reassurance air tests where required but this is covered by the analyst involvement in licensed work under 11.3 [removal and remediation works]. PPE record keeping: the Health Board keeps records and these are available. All PPE issued to staff is recorded, whether asbestos related or otherwise, as part of good health & safety practice. NHS Wales Audit & Assurance Services Appendix A

14 Management Action Plan Finding: Training Regulation 10 of the ACOP requires employers to make sure that anyone liable to disturb asbestos during their work, or who supervises such employees, receives the correct level of information, instruction and training to enable them to carry out their work safely and competently and without risk to themselves and others. Training must be: a) Given at regular intervals; b) Adapted to take account of significant changes in the type of work carried out or methods of work used by the employer; and c) Provided in manner appropriate to the nature and degree of exposure identified by the risk assessment, and so that the employees are aware of: i. The significant findings of the risk assessment; and ii. The results of any air monitoring carried out with an explanation of the findings. Whilst 16 members of the thb Estates team received non-licensed work training in January 2018, it was noted that ESR doesn t issue automatic reminders to ensure staff keep up to date with their training. Furthermore, whilst the Deputy Asbestos Manager holds the BOHS (British Occupational Hygiene Society) P405 qualification [Management of Asbestos in Buildings] there was no evidence to confirm that refresher training was received post appointment [November 2017]. Risk Staff may not be appropriately trained therefore increasing the risk of exposure to both themselves, patients, visitors and other members of the thb. NHS Wales Audit & Assurance Services Appendix A

15 Management Action Plan Recommendations 3 & 4 3. The Asbestos Manager will work with members of the Estates Admin team to ensure that appointment(s) are made with external training providers in sufficient time (O). 4. Training will be a standing item on the Asbestos Working Group agenda as a reminder to confirm compliance / expectations (including Deputy Asbestos Manager training) / additional training needs arising from any recent work undertaken outside of the presumed training needs analysis (including usage and maintenance of specialist equipment) (O). Management Response 3. The means of electronic prompts for external training appointments will be improved. 4. Training is now a standard agenda item for the Asbestos Working Group. Priority level Low Low Responsible Officer/ Deadline 3. Asbestos Manager October Actioned since fieldwork NHS Wales Audit & Assurance Services Appendix A

16 Management Action Plan Finding: Completion of surveys It was noted that the last re-inspection survey was undertaken during 2015 with a full management survey last completed in Discussions held with the Asbestos Manager noted that a full management survey was not expected to be repeated until all proposed refurbishment work had been completed i.e. Llandrindod Wells redevelopment and Machynlleth. Whilst this may be a reasonable direction to take, the duration between surveys had not been in line with expectations i.e. inspection of ACMs every 6 to 12 months. While it is recognised that certain areas may be held over by exception and for stated reasons, the updated Operational Asbestos Management Plan (section 7.5) states that all known ACMs, as identified by the asbestos register, will be re-inspected on a frequency dictated by the risk score but will not exceed 12 monthly intervals. The findings will be used to update the asbestos register and will be further used to prioritise management actions. Recommendation 5 Surveys will be undertaken in a timely manner and in accordance with the thb s Operational Asbestos Management Plan. (O) Risk Management information held does not provide an up to date position regarding ACMs at the respective sites. Priority level Medium Management Response All 2017/18 re-inspections are now complete. The further annual re-inspections will be tendered to comply with required intervals. Responsible Officer/ Deadline Asbestos Manager Inspections scheduled January to May 2019 NHS Wales Audit & Assurance Services Appendix A

17 Management Action Plan Finding: Asbestos Register The thb s Operational Asbestos Management Plan stated (page 25) that the Asbestos Manager will update the register based on sampling, refurbishment or remedial works carried out and on information gained during PPM and inspections. Whilst a (spread-sheet based) asbestos register was retained, there was minimal evidence to suggest that the content was regularly reviewed and updated (noting the data held was populated from the 2015 re-inspection survey). The output of the re-inspection surveys completed, during the course of the current audit, was in the process of being populated onto an externally hosted database, which was scheduled to replace the extant register. ACOP 4 (para 143) states that as a minimum, the management plan, including records and drawings, should be reviewed every 12 months. It should also be reviewed if there is a reason to believe that circumstances have changed (e.g. there is a change of use of building, work being undertaken, ACMs removed or repaired etc.). The plan, including records and drawings, should then be updated accordingly. Review of permits to work and incidents reported through the Asbestos Management Working Group and Estates Compliance Group [from April 2017 to date] logged amendments to buildings due to work having been performed; however, the spread-sheet based register had not been similarly updated. Accordingly asbestos risks now deemed as closed still had actions recorded as manage and/or encapsulate. Risk Lack of awareness of location of ACMs within thb premises. NHS Wales Audit & Assurance Services Appendix A

18 Management Action Plan Recommendations 6 & 7 6. Management will ensure that the newly implemented Asbestos Register (database) will be updated in a regular/timely manner following survey and / or conclusion of any work completed, in conjunction with the Asbestos Register while both documents remain extant. (O) 7. The Asbestos Register will be a standing agenda item for the Asbestos Management Working Group to facilitate awareness of changes/amendments; the summary of which will be reported the Estates Compliance Group. (O) Management Response 6. New electronic Asbestos Register database is now active; Environtec engaged to update TEAMS database. A flow chart indicating the process has been provided which will be added to the Asbestos Management Plan. 7. The changes will be ed to Environtec following acceptance by the Asbestos Manager and Deputy; and copied to a central admin address. The log will be created for inclusion in the Asbestos Working Group agenda. Priority level Medium Medium Responsible Officer/ Deadline Assistant Director of Estates & Property / Asbestos Manager 6. November December 2018 NHS Wales Audit & Assurance Services Appendix A

19 Management Action Plan Finding: External Contractors Section 5.8 of the Operational Asbestos Management Plan states that the Maintenance Officers / Charge hands / Estate Managers are responsible for ensuring that all maintenance employees, contract staff and external contractors under their control are made aware of the presence of asbestos containing materials within buildings and that consultation of the asbestos register takes place before any task(s) are undertaken by directly employed staff, contract staff or external contractors. This is also reflected in the Information for Contractors leaflet which was issued prior to the commencement of work. However, compliance with these requirements was not evidenced. Recommendation 8 As per recommendation 6, the newly implemented asbestos database will be updated in a regular/timely manner following conclusion of any work completed and permit access to live data by external contractors. However, the emphasis will remain on the Asbestos Manager to review the accuracy of the content and evidence of provision to contractors for review prior to commencement of work (D). Management Response This response accompanies the one made in 6 with the addition of internal audits being carried out by a member of the administration team on a quarterly basis. Risk Lack of awareness of location of ACMs within thb premises. Priority level Medium Responsible Officer/ Deadline Asbestos Manager December 2018 NHS Wales Audit & Assurance Services Appendix A

20 Management Action Plan Finding: Plans of work & risk assessments As stated in Regulation 7 of the ACOP, an employer must not undertake any work with asbestos without having prepared a suitable written plan of work detailing how that work is to be carried out; and that the employer shall keep a copy of the plan of work at those premises where the work is being carried out for such time as that work continues. Similarly, to ensure full compliance with COSHH (Control of Hazardous Substances) regulations, risk assessments should additionally be completed where five or more individuals are engaged to perform works which may include a risk of contact with asbestos. The thb s Operational Asbestos Management Plan (Appendix 5) stated that a permit to work for non-licensed work must be obtained before any work commences. Section 5.4 stated that the Asbestos Manager has the responsibility to generate and issue the permit to work to licensed contractors for any asbestos removal works ensuring that contractors operate in accordance with the Specification and Method Statement. Evidence was sought to ensure the thb had retained sufficient documentation in respect of asbestos works undertaken, and that permits were appropriately granted. All permits issued between July 2017 and May 2018 were reviewed together with the associated retained paperwork. Eight permits had been issued, all relating to non-licensed work. The following was noted: Risk assessments were evidenced for five of the non-licensed works undertaken, all of which had been prepared by external contractors; Risk Inappropriate action of work undertaken. NHS Wales Audit & Assurance Services Appendix A

21 Management Action Plan Plans of work were not available to support each permit issued. Recommendation 9 Priority level The thb will ensure consistent methods are applied for non-licensed work (D) Low Management Response Agreed. Responsible Officer/ Deadline Asbestos Manager January 2019 NHS Wales Audit & Assurance Services Appendix A

22 Final Internal Audit Report Audit Assurance Ratings Substantial assurance - The Board can take substantial assurance that arrangements to secure governance, risk management and internal control, within those areas under review, are suitably designed and applied effectively. Few matters require attention and are compliance or advisory in nature with low impact on residual risk exposure. Reasonable assurance - The Board can take reasonable assurance that arrangements to secure governance, risk management and internal control, within those areas under review, are suitably designed and applied effectively. Some matters require management attention in control design or compliance with low to moderate impact on residual risk exposure until resolved. Limited assurance - The Board can take limited assurance that arrangements to secure governance, risk management and internal control, within those areas under review, are suitably designed and applied effectively. More significant matters require management attention with moderate impact on residual risk exposure until resolved. No Assurance - The Board has no assurance that arrangements to secure governance, risk management and internal control, within those areas under review, are suitably designed and applied effectively. Action is required to address the whole control framework in this area with high impact on residual risk exposure until resolved Prioritisation of Recommendations In order to assist management in using our reports, we categorise our recommendations according to their level of priority as follows. Priority Level Explanation Management action High Medium Low Poor key control design OR widespread non-compliance with key controls. PLUS Significant risk to achievement of a system objective OR evidence present of material loss, error or misstatement. Minor weakness in control design OR limited noncompliance with established controls. PLUS Some risk to achievement of a system objective. Potential to enhance system design to improve efficiency or effectiveness of controls. These are generally issues of good practice for management consideration. Immediate* Within One Month* Within Three Months* * Unless a more appropriate timescale is identified/agreed at the assignment. NHS Wales Audit & Assurance Services Appendix B