Business continuity

The NHS needs to plan for and respond to a wide range of emergency incidences that could affect health or patient care. Although DHCW is not formally named in the Civil Contingencies Act 2004, as a categorised “responder” under the Act, the Welsh Government has recognised the importance of DHCW in emergency and business continuity planning on a Pan Wales basis. To this end, the Welsh Government has formally included DHCW within the new Wales Resilience Framework and has instructed DHCW to act as a Category 1 responder until such time as DHCW can be legally included into the Civil Contingencies Act as it applies to Wales.

Extract from the Wales Resilience Framework reads:

“Category 1 and/or Category 2 Responders 1.10
As defined by the Civil Contingencies Act 2004, including Digital Health and Care Wales, who have been directed by Welsh Government to undertake the duties of a Category 1 responder, even though it is not formally identified as a Category 1 responder under the Civil Contingencies Act 2004.”

The Welsh Government has previously instructed Digital Health Care Wales (DHCW) to continue engagement and participation in emergency and contingency planning for Wales. As such, DHCW was formally directed (under the powers of the NHS Wales Act 2006) to continue to carry out a number of activities aligned to the Civil Contingencies Act, hence DHCW has much already in place to satisfy the Civil Contingencies Act and will work with its multi-agency partners to further build resilience processes and response plans that fully satisfy the Civil Contingencies Act. DHCW is now also working toward the ISO 22301 Business Continuity International Standard.

DHCW has continued its collaborative approach to business continuity and emergency planning through active membership of planning groups:

The Welsh Health Emergency Planning Advisory Group.

Welsh Health and Social Services System Resilience and Planning Group.

The DHCW Emergency Planning Lead now represents the organisation on the four Welsh Local Resilience Forums. This will aid in satisfying the requirement to collaborate, plan, share information, and jointly exercise resilience plans on a multi-agency basis.

The role of the Board

The Board has been constituted to comply with the Digital Health and Care Wales (Membership and Procedure) Regulations 2020. In addition to responsibilities and accountabilities set out in terms and conditions of appointment, Independent Members have worked with the Chair to agree their Board Champion roles. A detailed Board Champion Annual Report was shared at our Board Meeting in January 2024.

The Board is made up of Independent Members and Executive Directors.

During 2023/24, Board development and briefing sessions took place that included a focus on the following elements of governance:

Programme Governance Independent Review

Radiology Information Systems Procurement Full Business Case

Stakeholder Engagement Management

Communications Strategy

Primary Care Strategy

Welsh Government Health and Care Digital Strategy

DHCW Long Term Strategy x 5

IMTP 2024-25 Plan

Stakeholder Messaging

DHCW Role in Care

Duty of Quality

IMTP 2025-27 x 2

Draft Accounts 2022-24

Cyber Awareness

Digital Services for Patients and the Public

Eyecare Digitisation Programme

Joint International Board learning session with UMASS Memorial Health

Structured Assessment 2023

IMTP Financial Context 2024/25

DHCW continued its partnership with Deloitte as our Board Development partner during 2023-24, and the Board held the following workshops with Deloitte during the period:

Good Governance

Board Skills Matrix

Strategy Workshop

Board Organisational Development Conclusion

We are looking forward to taking the learnings and opportunities from this work forward in 2024-25. Full membership of the Board is outlined in Appendix 1. Below is a summary of the Board and Committee structure. This is reflective of the proposed structure in the DHCW model standing orders.

During 2023-24, the DHCW, with the support of Welsh Government, commissioned an independent review into Programme Governance Arrangements. The main recommendation from the report was to simplify governance arrangements to include streamlining lines of accountability, ensuring greater clarity on roles and responsibilities, allowing DHCW-hosted programmes to operate in an open and transparent manner.

The DHCW Chair and Chief Executive Officer agreed to establish a sub-committee of the DHCW Board, the Programmes Delivery Committee, to provide assurance and scrutiny on the delivery of major DHCW-hosted programmes in an open and transparent manner. This was approved by the SHA Board in November 2023.

The Board provides leadership and direction to the organisation and has a key role in ensuring the organisation has sound governance arrangements in place. The Board also seeks to ensure the organisation has an open culture and high standards when conducting its work. Together, Board members share corporate responsibility for all decisions and play a key role in monitoring the performance of the organisation. All Board meetings during 2023/24 were appropriately constituted with a quorum. The key business and risk matters considered by the Board during 2023/24 are outlined in this statement and further information can be obtained from meeting papers available on our website.

Role of the Committees

The Board has four committees, the Audit and Assurance Committee, Remuneration and Terms of Service Committee, Digital Governance and Safety Committee, and the Programmes Delivery Committee. These committees are chaired by the Chair or Independent Members of the Board and have key roles in relation to the system of governance and assurance, decision-making, scrutiny, and in assessing current risks. The committees provide assurance and key issue reports to each Board meeting to contribute to the Board’s assessment of assurance and to provide scrutiny on the delivery of objectives.

The Board is responsible for keeping the committee structure under review and reviews its standing orders on an annual basis. The Board will consider whether any changes are needed during 2024/25 in line with the Board’s governance framework and priorities of the Integrated Medium-Term Plan. DHCW is committed to openness and transparency with regard to the way in which it conducts its committee business. The DHCW Board and its committees aim to undertake the minimum of their business in closed sessions and ensure wherever possible business is considered in public with open session papers published on DHCW’s website. Information received in closed session meetings is undertaken because of the confidential nature of the business. Such confidential issues may include commercially sensitive issues, matters relating to personal issues, or discussing plans in their formative stages. In addition, the Annual Committee and Advisory Group Annual Reports give an overview of the activity undertaken across the year and can be found here:

Audit and Assurance Committee

Digital Governance and Safety Committee

Remuneration & Terms of Service Committee

Local Partnership Forum

There is no Programmes Delivery Committee Annual Report for 2023-24 as the Committee was established during the later part of the financial year with only two meetings held, therefore the first annual report for the Committee will be produced in 2024-25.

Audit and Assurance Committee

An important Committee of the Board in relation to this Annual Governance Statement is the Audit and Assurance Committee. The Committee keeps under review the design and adequacy of DHCW’s governance and assurance arrangements and its system of internal control. During 2023/24, key issues considered by the Audit and Assurance Committee relating to the overall governance of the organisation included:

Revisiting its terms of reference, which will be kept under regular review

Approving the Internal Audit Plan for 2023/24 and keeping under review the resulting Internal Audit Reports. Noting key areas of risk and tracking the management responses made to improve systems and organisational policies

Ensuring effective financial systems and controls procedures are in place

Monitoring the risk management systems

Monitoring standards of behaviour, including declarations of interests, gifts, hospitality and sponsorship

Developing arrangements to work with Audit Wales (AW), and considering the 2023 Structured Assessment and Audit Wales’s 2023-24 Audit Plan

Monitoring progress on the development of the Welsh Language Scheme for DHCW

Approving and reviewing DHCW’s Legislative Assurance Framework

Developing and endorsing new policies, strategies and framework in support of good governance and appropriate control

Remuneration and Terms of Service Committee

The Remuneration and Terms of Service Committee considers and recommends salaries, pay awards, and terms and conditions of employment for the Executive Team and other key senior staff. During 2023/24, key issues considered by the Remuneration and Terms of Service Committee included:

Performance of Executive Directors against individual objectives

Executive Team structure

Ratification of Executive Team posts

Review of DHCW leavers data

Digital Governance and Safety Committee

The Digital Governance and Safety Committee advises and assures the Board with regard to the quality and integrity, safety, security, and appropriate use of information and data to support health and care delivery and service improvement and the provision of high-quality digital health and care. Key issues considered by the Committee in 23/24 relating to their remit included:

Revisiting its terms of reference, which will be kept under regular review

Cyber Security arrangements

Incident review and organisational learning

Information Governance

Information Services Assurance

Informatics Assurance

Research and Innovation Assurance

Programmes Delivery Committee

The Programmes Delivery Committee advises and assures the Board with regard to how programmes are delivered, in particular that they have regular and proper governance, have robust control processes and reporting, and are demonstrating good planning, management and delivery.

The Committee will also provide assurance to the Board on the delivery of programmes as a portfolio, prioritised allocation of resources, programmes' impact on wider DHCW delivery, and transition of programmes' activity to live services which are sustainable in the longer term. Key issues considered by the Committee in 23/24 relating to their remit included:

Refining and agreeing the Committee terms of reference which will be kept under regular review

Programmes Assurance

Portfolio Assurance

Governance (including reviewing which programmes are in scope of the Committee)

Effectiveness Self-Assessment

The Board and Committees of the Board undertook a self-assessment for 2023/24 between January and March 2024, and the findings were discussed at the relevant committee meeting and reported to the SHA Board. There was no Programmes Delivery Committee self-effectiveness survey for 2023/24 as the Committee was established during the later part of the financial year with only two meetings held, therefore the first Committee self-assessment will be undertaken in 2024-25.

The Audit and Assurance Committee questionnaire was based on the Audit Committee Handbook and circulated to Committee members and attendees.

The SHA Board, Digital Governance and Safety Committee, Remuneration and Terms of Service Committee, and Local Partnership Forum questionnaires were based on the composition, establishment, and duties, then Board, Committee, and Advisory Group leadership and support questions of the Audit and Assurance Committee.

Membership of the Board and its Committees

Appendix 1 outlines the membership and attendance of the Board and its Committees for the period 1 April 2023 to 31 March 2024. Members undertake a range of other activities on behalf of the Board including Board Development and Briefing Sessions, and a range of internal and external meetings.

Any proposed changes to the structure and membership of Board committees requires Board approval. The Audit and Assurance Committee and Digital Governance and Safety Committee together with the Programmes Delivery Committee, has considered its own terms of reference and recommended changes to the Board. The Board will ensure that terms of reference for each committee are reviewed annually to ensure the work of committees clearly reflects any governance requirements, changes to delegation arrangements or areas of responsibility.

All committees and advisory groups of the Board have developed annual reports of their business and activities which were received and noted in March 2024. The lead officers are included in Appendix 2 and the schedule of Board and Committee meetings 23/24 is included at table Appendix 3.

Local Partnership Forum

The DHCW Local Partnership Forum (LPF) provides the formal mechanism for social partnership within DHCW as well as providing a vehicle for engagement, consultation, negotiation and communication between trade unions and DHCW management. During 2023/24, the LPF has met quarterly and focussed on both strategic and practical issues including culture, values & behaviours, staff recognition, wellbeing, new ways of working & welfare, organisational development, employment policies and equality and diversity.

The purpose of the system of Internal Control

DHCW’s Board system of internal control is designed to manage risk to a reasonable level rather than to eliminate all risks; this has been articulated in DHCW’s risk appetite statement. It can therefore only provide reasonable and not absolute assurances of effectiveness.

The system of internal control is based on an ongoing process designed to identify and prioritise risks to the achievement of the policies, aims, and objectives. It also evaluates the likelihood of those risks being realised and the impact should they be realised, and to manage them efficiently, effectively, and economically. The system of internal control has been in place for the year ended 31 March 2024 and up to the date of approval of the annual report and accounts.

The Board Assurance Framework was reviewed and approved by the Board in May 2023. The Board Assurance Framework identifies all the key controls and lines of assurance to be reported to the Board. Our Board Assurance Framework annual reporting cycle can be seen below.

We use the BAF system and process to monitor, seek assurance, and ensure that shortfalls are addressed through the scrutiny of the Board and its Committees. Oversight of our Corporate Risk Register system is provided through the scrutiny and monitoring of the Board and its Committees.

Key controls are defined as those controls and systems in place to assist in securing the delivery of the Board’s strategic objectives. The effectiveness of the system of internal control is assessed by our internal and external auditors.

Capacity to handle risk

The Chief Executive/Accountable Officer has overall responsibility for the management of risk, but the SHA’s lead for risk is the Board Secretary. This means leading on the design, development, and implementation of the Risk Management and Board Assurance Framework Strategy and Board Assurance Framework

DHCW’s risk appetite statement, set out below, describes DHCW’s approach to risk management and the risks it is prepared to accept or tolerate in the pursuit of its strategic goals:

DHCW must take risks to achieve its strategic aims and deliver beneficial outcomes to stakeholders.

Risks will be taken in a considered and controlled manner.

Exposure to risks will be kept to a level of impact deemed acceptable by the Board.

The acceptable level may vary from time to time and will therefore be subject to at least annual review and revision.

Any risk outside our agreed appetite may be accepted and will be subject to a governance process to ensure visibility and management.

Some particular risks above the agreed risk appetite may be accepted because:

• the likelihood of them occurring is deemed to be sufficiently low

• they have the potential to enable realisation of considerable reward/benefit

• they are considered too costly to control given other priorities

• the cost of controlling them would be greater than the cost of the impact should they materialise

• there is only a short period of exposure to them

• mitigating action is required by an external party

DHCW’s risk appetite considers its capacity for risk, which is the amount of risk it is willing to accept in pursuit of its objectives having regard to its financial and other resources, before a breach in statutory obligations and duties occurs.

The risk tolerance gives guidance regarding escalation for risks across its activities, the below infographic provides details on the risk domains identified and agreed by the DHCW Board, associate appetite, tolerance levels and sets the expectation of the Board regarding the number of key controls when reviewing Corporate Risks in those categories in the Board Assurance Report.

1. None

   Hungry

   Risk with rating 25 of above are escalated for consideration to report to the Board
2. Development of Services

   Open

   Risk with rating 20 of above are escalated for consideration to report to the Board
3. Corporate Social Responsibility

   Moderate

   Risk with rating 15 of above are escalated for consideration to report to the Board
4. Financial, Reputational Safety and Wellbeing, Service Delivery Reputational, Information - Access and Sharing

   Cautious

   Risk with rating 12 of above are escalated for consideration to report to the Board
5. Compliance, Information - Storing and Maintaining, Citizen Safety

   Adverse

   Risk with rating 9 of above are escalated for consideration to report to the Board

All risks will be clearly linked to organisational objectives with a line of sight to the Board Assurance Framework. Our Board Assurance Framework has five principal risks, these were discussed in detail with the Board and approved in May 2023. In addition, in July 2022, the Board approved DHCW’s risk appetite for each principal risk. Work was undertaken by the Board throughout the year to define the principal risks to the strategic objectives.

Current principal risks against our strategic missions

During 2023/24 due to the economic crisis the financial risk profile of DHCW has seen a significant increase in risks identified that have the potential to impact our achievement of objectives and deliverables across the last year and potential to impact greatly on our achievement of objectives in the next financial period. These range from investment for digital developments to staffing levels.

A competitive workplace market along with evolving hybrid working options have also posed a risk to the organisation across the last 12 months and will continue to do so for the foreseeable future. Our People and Organisational Development team have provided mitigation to this by increasing their network of resources and adapting our hybrid working policy to enable engagement with resources outside of our immediate community, further work is required to ensure we have a rich and diverse knowledge and skillset amongst our workforce and continue to develop the talent pool currently in place.

During 2023-24 there has been an increased risk and threat of Cyber-attack. As an organisation we recognise this will be a long-term risk and emerging threats will continue to increase in intensity and intelligence; we have as an organisation undertaken extensive evaluation of our current risks, key controls and assurances to identify a significant Service Improvement Plan offering assurance and protection to both our organisation and also the wider NHS Wales Domain.

Risk management framework

The Board sees active and integrated risk management as key elements of all aspects of our functions and responsibilities to support the successful delivery of our business. The Board and its Committees identify and monitor risks within the organisation.

Risks are escalated to the Board as appropriate. At an operational level Executive Directors are responsible for regularly reviewing their Directorate Risk Registers and for ensuring that effective controls and action plans are in place and monitoring progress.

The framework includes strategy to operational tools and provides the working context for the staff in the organisation with regard to the management of risk from identification and scoring through to monitoring.

Other control framework elements

Counter Fraud

In line with the NHS Protect Fraud, Bribery and Corruption Standards for NHS Bodies (Wales), the Local Counter Fraud Specialist (LCFS) and Executive Director of Finance agreed at the beginning of the financial year a work plan for 2023/24 which was approved by the Audit and Assurance Committee in April 2023. Updates on delivering against this work plan have been provided to the Audit and Assurance Committee during 2023/24.

Review of Effectiveness

As Accountable Officer, I have responsibility for reviewing the effectiveness of the system of internal control. My review of the system of internal control is informed by the work of the internal auditors, and the executive officers within the organisation who have responsibility for the development and maintenance of the internal control framework, and comments made by external auditors in their audit letter and other reports.

The Board and its Committees rely on several sources of internal and external assurances which demonstrate the effectiveness of the Special Health Authority’s system of internal control and advise where there are areas of improvement. These elements are detailed above in the diagram of the DHCW Board Control Framework.

The processes in place to maintain and review the effectiveness of the system of internal control include:

Board and committee oversight of internal and external sources of assurance and holding to account Executive Directors and Senior Managers

Executive Directors and Senior Managers who have responsibility for development, implementation and maintenance of the internal control framework and the continuing improvement in effectiveness within the organisation

The oversight of operational risk through the Board and its Committees

Oversight of fraud risk through the Cardiff and Vale Local Counter Fraud team

The monitoring of the implementation of recommendations through the audit tracker overseen by the Audit and Assurance Committee

Audit and Assurance Committee oversight of audit, risk management and assurance arrangements

All Committees of the Board provided an annual report to the March 2024 Board detailing the work undertaken by the relevant Committee within the year and the key decisions taken.

I am satisfied that generally the mechanisms in place to assess the effectiveness of the system of internal control are working well and that the Special Health Authority has the right balance between the level of assurance I receive from my Executives, Board and Board Committee arrangements and DHCW Internal Audit Services.

Internal Audit including head of internal audit conclusion

Internal Audit provide me as Accountable Officer and the Board through the Audit and Assurance Committee with a flow of assurance on the system of internal control. I have commissioned a programme of audit work which has been delivered in accordance with public sector internal audit standards by the NHS Wales Shared Services Partnership. The scope of this work is agreed with the Audit and Assurance Committee and is focussed on significant risk areas and local improvement priorities.

The overall opinion by the Head of Internal Audit on governance, risk management and control is a function of this risk-based audit programme and contributes to the picture of assurance available to the Board in reviewing effectiveness and supporting our drive for continuous improvement.

The programme has been delivered substantially in accordance with the agreed schedule and changes required during the year have been approved by the Audit & Assurance Committee, in addition, regular audit progress reports have been submitted to the Committee. Although minor changes have been made to the plan during the year, the Head of Internal Audit is satisfied that there has been sufficient internal audit coverage during the reporting period in order to provide the Head of Internal Audit Annual Opinion. In forming the Opinion, the Head of Internal Audit has considered the impact of all the audits carried out, summarised in the table below:

The Head of Internal Audit has concluded:

Reasonable Assurance - The Board can take reasonable assurance that arrangements to secure governance, risk management and internal control, within those areas under review, are suitably designed and applied effectively. Some matters require management attention in control design or compliance with low to moderate impact on residual risk exposure until resolved.

In reaching this opinion the Head of Internal Audit has identified that the majority of reviews during the year concluded positively with robust control arrangements operating in some areas. The 2023/24 Internal Audit Plan included audits over key operational deliverables and associated risks, with previous plans incorporating risks associated with the establishment of the Special Health Authority.

From the opinions issued during the year, seven were allocated Substantial Assurance, four were allocated Reasonable Assurance and no reports were allocated a ‘limited’ or ‘no assurance’ opinion. We also issued one advisory report during the year, which has been considered when reaching our opinion.