BOARD ASSURANCE FRAMEWORK PURPOSE OF THE BOARD ASSURANCE FRAMEWORK The Board Assurance Framework (BAF) provides assurance to the Cwm Taf University Health Board on the delivery of its core purpose Cwm Taf Cares supported by its 5 Organisational objectives, outlined within its 3 Year Integrated Medium Term Plan (IMTP) 2015-18 and through robust risk management processes. The 5 objectives being: To improve quality, safety and patient experience. To protect and improve population health. To ensure that the services provided are accessible and sustainable into the future. To provide strong governance and assurance. To ensure good value based care and treatment for our patients in line with the resources made available to the Health Board. The BAF has been developed by the Board, following a workshop discussion at its Development Board in December 2014 and is informed by the The Good Governance Guide for NHS Wales Boards (2014), Academi Wales. The BAF supports the Accountability Report which includes the Annual Governance Statement (AGS), which are the subject of annual review by the Wales Audit Office (WAO) as part of the Structured Assessment process. The UHB purpose is achieved through its 5 organisational objectives and its priorities, which are calibrated against principal risks. The BAF is designed to support the Board to deliver its Strategy as outlined within its 3 Year Integrated Medium Term Plan and has been refreshed to align with its 2016-2019 refreshed IMTP. The framework also serves to inform the Board on principal risks threatening the delivery of the UHB s objectives. The BAF aligns principal risks, key controls, its risk appetite and assurances on controls alongside each objective. Gaps are identified where key controls and assurances are insufficient to mitigate the risk of non-delivery of objectives. This enables the Board to develop and monitor action plans intended to close the gaps.
The BAF established from the 2015-2018 Integrated Medium Term Plan (IMTP) is reconciled against the Corporate, Directorate and Locality Risk Registers, developed through the Management Executive and reviewed by the Board/Sub Committees of the Board for coverage and consistency with regard to the principal risks. The ongoing maturity of the UHB and its related working arrangements provide a timely opportunity to implement and sustain the Board Assurance Framework, along with the Board s other governance and assurance processes e.g. Standing Orders and the Scheme of Delegation. It is important also to align the BAF with the Health Board s Performance Management Framework, currently in draft and being developed for use within the Health Board, which will connect with and to Welsh Government and Health Board performance management / monitoring arrangements.
Board responsibility for the BAF Health Boards have many competing challenges to consider in delivering services to the communities they serve. Exhibit 6 Challenges facing NHS Boards More people with long term conditions Financial pressures Shifts in care settings Ageing population Rising public expectations Value for money expectations Boards of NHS Organisations Stronger focus on prevention & well being Performance targets Workforce planning challenges Technological advances in treatments Source: Adapted from NHS Leadership Academy 2013 It is the responsibility of the Board to: Determine its Strategic direction and related objectives; Identify the principal risks that threaten the achievement of these objectives; Agree its risk appetite recognising the interdependencies of objectives and the impact of mitigating risks on one may adversely impact on others; Agree the key strategic and operational plans that will deliver those objectives and which encompass the controls and actions in place to manage the identified risks; Monitor delivery through robust performance and assurance arrangements;
Ensure that plans are in place to take corrective action where there is minimal assurance or gaps in assurance where agreed objectives may not be fully delivered; Sustain and uphold dynamic risk management arrangements (in particular an up to date and well maintained risk register). The Audit Committee has oversight on behalf of the Board on: the adequacy of the assurance processes the effectiveness of the management of principal risks In line with current arrangements, each principal risk is designated to a Board Sub-Committee which has responsibility on behalf of the Board to seek assurance that those risks are being managed in accordance with the agreed risk appetite and approved plans. Assurance provides Board members with the evidence that the Health Board is operating effectively, achieving desired outcomes, delivering on its strategic vision, meeting its strategic objectives through effective risk management, in a manner which upholds the Citizen Centred Principles and is in accordance with all statutory requirements. (Audit Committee Handbook 2012)
THE ASSURANCE FRAMEWORK IN ITS OPERATIONAL CONTEXT At a high level, the following schematic represents the Board Assurance System. GOALS AND OBJECTIVES Strategic goals, objectives agreed through 3 year Integrated Business Plan REPORTING - Reports to Board, Committee & Welsh Government - Annual Report, Governance, Quality and Financial Statements ASSURANCE SYSTEM RISKS - Principal risks identified from IMTP & Risk Registers - Board determines its risk appetite - Ongoing review and monitoring through risk register ASSESSMENT - Internal & External reports and recommendations - Performance indicators and analyses - Review of assurance framework - Observational findings ASSURANCES - Performance measures - External, internal and clinical audit - Regulatory and inspection agencies - Delivery and action plans - Board & Committee reports - Stakeholders CONTROL ARRANGEMENTS - Operational plans - Performance Framework - Scheme of delegation - Policies and procedures - Action plans - Clinical / Corporate Business meetings Organisational Goals/Objectives Organisational goals and objectives are fully described in the 3 year Integrated Business Plan. These plans are rooted in the Citizen Centred planning principles for Wales and encompass Welsh Government and local priorities for improvement and change. Safe Care, Compassionate Care issued by Welsh Government in January 2013 also requires Boards to seek assurances against the following questions: Are we providing safe care? Are we meeting required standards of effective care?
Are we improving user experience? Are we providing efficient services within resources? Are we engaging the workforce? Are we providing accessible and equitable services? Are we improving population health? There is close alignment with these and the 5 UHB objectives described in the IMTP and referenced earlier in this document. These five goals will be used as the basis of the BAF as these objectives span the breadth of organisational responsibilities - the IMTP describes both the what and the how the Board will wish to seek assurance on delivery. Wellbeing of Future Generations Act 2015 The Wellbeing of Future Generations Act (2015) requires all public bodies to demonstrate that we are improving social, economic and environmental wellbeing, whilst also looking to the future, planning for the long term and ensuring that we don t compromise the ability of future generations to be able to do the same. This is called sustainable development. Welsh Government has set out 7 Wellbeing Goals: 1. A prosperous Wales 2. A resilient Wales 3. A healthier Wales 4. A more equal Wales 5. A Wales of cohesive communities 6. A Wales of vibrant culture and thriving Welsh language 7. A globally responsible Wales The University Health Board, in partnership with other public bodies and stakeholders, will have to demonstrate how we are contributing to these goals and follow 5 Sustainable Development principles namely: 1. Long term 2. Integration 3. Collaboration 4. Involvement and 5. Prevention The UHB approach will be included within the refreshed IMTP for 2017-20 prior to its submission at the end of March 2017.
Social Services and Well-being (Wales) Act 2014 The Act imposes duties on local authorities, health boards and Welsh Ministers that require them to work to promote the well-being of those who need care and support, or carers who need support. The Social Services and Well-being (Wales) Act changes the social services sector: People have control over what support they need, making decisions about their care and support as an equal partner New proportionate assessment focuses on the individual Carers have an equal right to assessment for support to those who they care for Easy access to information and advice is available to all Powers to safeguard people are stronger A preventative approach to meeting care and support needs is practise Local authorities and health boards come together in new statutory partnerships to drive integration, innovation and service change The implementation of the Social Services & Well-Being (Wales) Act 2014, which directs development of a more sustainable range of integrated services, will need to take into consideration partnership governance and assurance working across partner organisations. Identifying the risks of achieving UHB objectives Against each organisational objective, there will need to be an assessment of the principal risks of achievement prospectively as an integral aspect of the Board s planning processes. Approval of the UHB and Directorate IMTPs and any related operational / delivery plans will also align to the UHB s risk appetite and the ways by which the objectives will be delivered. The appetite being indicated as a target risk score. The BAF will be updated on a quarterly basis to reflect the periodic review of Corporate, Directorate and Locality risk registers exception reports will be focussed on deviation from agreed acceptable risk for consideration by management and the relevant assuring Board Committee. The process by which Directorate risks are considered for inclusion in the BAF will also be strengthened to ensure there is Ward to Board visibility of risk management.
Any new risks identified during the year will be assigned against the appropriate organisational objective. The Audit Committee will wish to assure itself that any new risks or significant escalation of risk, were reasonably unforeseen at the start of the year. The process can be summarised as follows: Report Purpose Reviewed at Board Assurance Framework - Identify, assess and manage all extreme risks to the UHB s strategic/organisational priorities Board to consider and undertake review of full BAF undertaken via the Audit Committee. Corporate / Quality & Safety Integrated Risk Exceptions Reports Corporate, Directorate, Locality Risk Registers - Delegate key risks to Sub Committees of the Board with responsibility for monitoring and tracking mitigating actions. - Consider and manage risks rated as 12 or more, new risks, increased risks, actions outstanding, risks that remain RED - Identify extreme/high risks and identify new risks, increased risks, actions outstanding. - Identify, assess and outline arrangements to mitigate risks across the Directorate / Locality - Escalate risks and recommended actions where these are rated 12 or more - Submit Risk Register to Directorate meetings - Produce risk based exception report to include mitigating actions to key Committees of the Board Committee Chairs to consider the review of assigned risks at Committee agenda setting/ forward work plans Management Executive to receive and consider bi-monthly organisational risk register reports. Board / delegated sub Committee as appropriate Directorate and Locality Integrated Governance meetings Sub Committees of the Board Control arrangements The IMTP and underpinning operational plans describe the actions and processes to ensure delivery of objectives and the controls in place to manage risk. These controls are wide-ranging from operational plans, project management, policies, procedures, financial management, quality and safety processes etc. to ensure that systems are in place and that staff are equipped to deliver an effective and consistent outcome.
There is not a 1:1 relationship between risks and controls often there may need to be multiple controls in place to mitigate risk and some controls will also manage more than one risk. It must be accepted that there is not always a neat framework and even if controls are in place, consideration needs to be given as to how effective they are and whether it is better to have a smaller number of key controls rather than multiple controls that no-one is properly following as this might give a false impression on the level of assurance. One of the key challenges for the Board is to decide on those controls that it considers are most important and ensure there is a system in place to gain assurance about the effectiveness of the operation of these controls. Assurances The Board needs to assure itself that these controls are effective to manage the principal risks. A good system will bring together and triangulate internal and external assurance sources and should also be a combination of quantitative and qualitative information. The information included within the routine Board Performance report is a fundamental tool in this process, fully aligned through an integrated performance dashboard. Whilst this is the agreed direction of travel, for now, the performance report will be supplemented by other internal and external sources. For each objective, the assurance will come from a variety of internal and external sources. These external sources are extremely important and it is essential that the Board (or relevant Committee) is aware of all sources of such information from regulatory or inspection bodies and are sighted on their conclusions.
Potential (but not exhaustive) sources of assurance include: Internal Sources Performance Management Reports Change management reports * Workforce information & surveys Benchmarking Internal Audit & Clinical Audit reports Board & Committee reports Quarterly progress reports with implementation of IMTP Local counter fraud work Health & Care Standards self assessments Board Member Walkabouts Concerns and compliments Incident reporting (inc. serious incidents) Results of internal investigations Whistle blowing Infection control reports Information governance toolkit selfassessment Patient experience surveys and reports Compliance against legislation (e.g. Mental Health Act, Health & Safety, Fire Safety, Data Protection, Welsh Language, Equality Duty, Employment law) External Sources Population Health information Wales Audit Office reports Welsh Risk Pool Assessment reports Healthcare Inspectorate Wales reports Community Health Council visits Feedback from healthcare and third sector partners Royal College visit reports Deanery visit reports Regulatory, licensing and inspection bodies External benchmarking and statistics Public Service Ombudsman HM Coroner Regulation 28 reports Accreditation schemes National and regional audits Peer reviews Feedback from service users Local networks (eg cancer networks) Investors in People Welsh Government reports and feedback Welsh Government Joint Escalation & Intervention Status * From previous workshops on Board Assurance and the findings from the Mid Staffs review it was agreed that additional and specific measures should be put in place during significant change programmes as these have inherent risks. Assurance Assessment The process for assessing assurance is fundamentally about taking the most relevant evidence together and arriving at informed conclusions to establish a composite sense of assurance. The gaps in assurances are included in the Board Assurance Framework. Where there are gaps in assurance, further controls will need to be identified. When there is a lack of evidence from current sources of information, this will be critical in determining the future work programmes of internal and clinical audit so resources are directed appropriately.
Reporting and Public Disclosure Documents It is intended that the assigned organisational risks will be presented at least quarterly at Committees of the Board for regular review. Directorate integrated exception reports will be presented to Quality, Safety & Risk Committee routinely (either directly or via an assurance sub group) and be used, along with roll out of the Datix Risk module to inform the development and review of the Organisational Risk Register. A full review will be undertaken annually to refresh the document and significant elements of the Annual Accountability Statement, which now includes the Annual Governance Statement, will be referenced to inform the BAF update and vice versa.