Corporate report

UKHSA Advisory Board: Audit and Risk Committee minutes

Updated 28 January 2025

Title of paper: Audit and Risk Committee minutes

Sponsor: Cindy Rampersaud

1. Recommendation

The Advisory Board is asked to note the minutes of 10 September 2024 meeting of the Audit and Risk Committee. The minutes were agreed on 9 December 2024.

2. Minutes (confirmed), Audit and Risk Committee, 10 September 2024

Present at the meeting were:

• Cindy Rampersaud – Non-Executive Member of UKHSA Advisory Board (Chair)
• Sir Gordon Messenger – Non-Executive Member of UKHSA Advisory Board
• Jon Friedland – Non-Executive Member of UKHSA Advisory Board
• Simon Blagden – Non-Executive Member of UKHSA Advisory Board

In attendance were:

• Andy Brittain – Director General Finance, DHSC
• Dame Jenny Harries – Chief Executive
• Luke Heath – interim Chief Financial Officer
• Jac Gardner – Chief People Officer
• Steven Riley – Director General Data, Analytics and Surveillance
• Emma Reed, Director Emergency Responses and Health Protection, DHSC
• Donald Shepherd – Director of Finance
• Alex Sienkiewicz – Director of Corporate Services
• 21 attendees had their name and title redacted

3. 1. Introductions and apologies

24/135 The Chair welcomed all attendees to the meeting and introduced Luke Heath, the interim Chief Finance Officer at UKHSA.

No declarations of interest were given in respect to the Audit and Risk Committee agenda.

4. 2. Minutes of the previous meeting

24/137 The minutes from the last meeting on 4 June 2024 (enclosure ARC/24/038) were agreed with one amendment made.

5. 3. Matters Arising

24/138 The action list (enclosure ARC/24/039) was noted and the Committee asked that actions 85 and 123 not be closed yet.

24/139 Discussing action 113, the Committee felt that the Science and Research Committee should have greater input on matters of audit and risk relating to Science. The next iteration of the Strategic Risk Register would be prepared for discussion at the next meeting of the Science and Research Committee, taking place in November. (Action: Name redacted)

6. 4. Corporate Governance Update

24/140 The Audit and Risk Committee noted an update from the Chief People Officer and [Title redacted] on developments in UKHSA’s senior leadership structure and governance arrangements.

24/141 The following points were reported in the update:

• a review of the SCS structure and roles at UKHSA was being undertaken with the aims of improving the functionality of the organisation and achieving faster and better decision-making
• in May-June the proposed structure had been designed by eight nominated Directors from across all areas
• in July-August there was a 45-day consultation period for SCS with others also invited to feedback their comments. There had been approximately 150 responses
• during week commencing 23 September, with the central design team having reviewed feedback, individual consultation would begin
• there would be a transition period to secure the new leadership team under the 4-Director General model and there was expected to be some recruitment to do.
• efforts had been made to minimize risk and retain stability
• two other areas in transition were the Harlow team and the CVU and vaccine and countermeasures teams. This was targeted to complete in a similar timeframe
• the change would not just be about structure but also ways of working, leadership, and how Groups worked together

24/142 The Committee was interested in whether there was any risk that the developments would impact UKHSA’s delivery at a time that UKHSA faced other pressures such as the response to mpox. The Committee was assured that thought had been given to this; there was scope to postpone the internal changes if needed, although this would come at the cost of prolonging uncertainty for staff. The Committee was also reminded that roles at Grade 6 and below were not directly impacted.

24/143 The DHSC Sponsorship team confirmed the Department’s interest in and support of the changes and the Committee was assured that UKHSA and DHSC had been in communication about the work since it began.

7. 5. Finance Update

7.1 Latest financial position

24/144 The Audit and Risk Committee noted an update from the interim Chief Finance Officer on the latest financial position (enclosure ARC/24/040) in which the following key points were made:

• the core RDEL was £34.7million over-budget, a slight reduction since the paper was submitted due to actions taken
• the main drivers of the overspend were new, unexpected budget pressures, notably the public sector pay awards and savings targets
• the Executive Committee was working on savings options to bring UKHSA as close to the budget as possible
• further support from DHSC would be needed and discussions would follow.
• the core CDEL was also overcommitted. This would be addressed in turn, but was of less concern

24/145 The Committee asked whether there was a risk that efforts to correct the RDEL would push problems into the following year. It heard that the executive were mindful of this and trying to make the right long-term decisions. The Committee was assured that thorough consultation on Groups’ costs was underway to make the delta as accurate as possible and ensure all budget-holders had the information they needed. The quality and availability of data was good but with room for improvement.

24/146 The Chief Executive explained her wish to be clear what funds were needed to cover delivery of UKHSA’s core remit, as set by the Government, and beyond which more support would be needed. Higher levels of preparedness required more investment. It was noted that DHSC would require taut proposals on what support was needed and updates on any impact on delivery. The Committee was assured that UKHSA was working well with counterparts in the Department and would communicate on this.

24/147 The Committee recognised a need for capital investment in science facilities. Discussions on the way forward were underway with Ministers of the new government.

24/148 The Committee was interested in whether there were opportunities to find efficiency savings through better partnering with other organisations. It was assured that UKHSA was proactively looking for opportunities, notably on cyber, but any options would need careful review.

7.2 Progress update on 2023-24 Annual Report and Accounts and update on the accounting and audit of the Covid Vaccines Unit (CVU)

24/149 The Audit and Risk Committee noted and commented on a progress update on the Annual Report and Accounts 2023-24 (enclosure ARC/24/041) and an update on accounting and audit of the CVU (enclosure ARC/24/042).

7.3 CVU update

24/150 PwC attended the meeting to provide an update on their review of the CVU model(s). The following key points were reported:

• no issues had been identified by the ‘priority 1’ procedures performed. Lower priority issues were identified and had all been fed back
• assumptions had been reviewed and validated and the mechanics of the model had been scrutinised
• the review procedures were complete with no major errors identified and UKHSA management indicated that all minor points were addressed
• some improvements to future models had been suggested on the basis of this work

24/151 The NAO requested further meetings with PwC on detail of the work, noting that while they were unable to rely on this for audit purposes it was helpful information. It was agreed to aim to do this ahead of the stock check in November.

7.4 Annual Report and Accounts

24/152 The Deputy Director, Financial Operations & Control provided an update on preparation of the 2023-24 report and accounts.

24/153 It was reported that while the majority of the work was proceeding as planned, the audit of the CVU for 2023-24 and the audit of opening balances from 2022-23 were both behind schedule. A checkpoint meeting was scheduled for later that day to address that. The matter was discussed further under the NAO update.

24/154 It was reiterated that it remained critical to close the accounts in November as planned, recognising knock-on effects for the following year’s report. If the actuals that came out in November were substantially different to the forecast it would not be possible to lay in November. A check was planned in mid-to-late October so that an update could be made at that point if needed.

24/155 Discussion followed on the anticipated outcome of the annual report. The interim Chief Finance Officer clarified that a limitation of scope was unavoidable but if all went as planned with no issues it was possible that there would not be a disclaimer.

24/156 The Committee requested an update on the planned timeline for signing off the accounts and an update against points raised at the July pageturner for assurance that those had been addressed. (Action: Name redacted)

7.5 Finance and Controls Improvement Programme (FCIP) report

24/157 The Audit and Risk Committee noted an update from FCIP Board presented by the interim Chief Finance Officer (enclosure ARC/24/043), which included an update on key milestones and risks of the FCIP and an update on the progress of the annual report and accounts.

24/158 It was further reported that, with the support of the Executive Committee, the interim Chief Finance Officer was carrying out a refresh of the programme with the aim of raising the standards of the finance function. All actions in the existing programme would be covered but KPIs would be reviewed and the name was likely to change to reflect that the scope went beyond finance. Customers and stakeholders would be engaged on this work. The Committee welcomed this and encouraged the inclusion of qualitative KPIs to capture cultural change.

24/159 The Committee was interested in the future of the MaPs workstream and whether UKHSA might be able to get support with this from any current users of MaPs. It heard that the MaPs budget was not being recommended as a savings option. It also heard that other government organisations did use MaPs and that the Government Finance Function had plans to move everyone onto the same system. The Committee requested a further update on this. (Action: Luke Heath)

8. 6. National Audit Office (NAO) Update

24/160 The Director of Engagement, National Audit Office provided the latest update covering a progress update on the financial statements audit 2023/24 (enclosure ARC/24/044) and an update on the audit planning report on the 2023-24 financial statements audit (enclosure ARC/24/045).

8.1 Progress update on the financial statements audit 2023/24

24/161 It was reported that there had been some delays to balance sheet sampling but work was underway to mitigate the risk.

24/162 The final stock-takes were scheduled for 14-15 November. The Committee asked about this risk of slippage, noting that this was very close to the deadline for signing the accounts. The NAO explained that they were limited by the available dates for warehouse access but that based on previous experience they did not anticipate issues with logistics in this part of the process.

24/163 Regarding audit of the CVU, the NAO was confident of completing the 2023-24 audit as long as focus was maintained. To ensure this, it might be necessary to deprioritize work on the 2022-23 opening balance. If so, that was expected to further guarantee a limitation of scope but not of itself trigger a disclaimer. The Director General, Finance, DHSC requested a separate meeting to understand the situation and implications in full.

24/164 Regarding the wider prospect of a disclaimer on the 2023-24 accounts the NAO confirmed that this was still possible if significant errors were identified in the remainder of the sampling work. However there was some reassurance that UKHSA had already done a lot of work on the areas of greatest concern.

8.2 Audit planning report on the 2023-24 financial statements audit

24/165 The report presented small adjustments to the NAO’s proposed approach for the audit of the 2023-24 financial statements. Notably, some risks had been made more specific and materiality had been reduced because it had been based on an exception.

24/166 The Committee noted the report including the updated assessment of the risks of material misstatement to the financial statements, management’s response, and the NAO’s proposed audit plan to address the risks. The Committee had no further comments or concerns to raise on these.

9. 7. Government Internal Audit Agency (‘GIAA’) Update

24/167 [Title redacted] presented the draft annual internal audit report and opinion 2023/24 (enclosure ARC/24/046) and a progress report against the internal audit plan for 2024/25 (enclosure ARC/24/047).

9.1 Draft annual internal audit report and opinion 2023/24

24/168 The Committee noted the update on the draft internal audit report and opinion. Key points of the update included:

• the report was in draft awaiting finalisation of the last two internal audit reports from that year and comments from UKHSA on the overarching report, which would then be completed for inclusion in UKHSA’s annual report and accounts
• as previously discussed the opinion was expected to be ‘limited’
• common themes contributing to limited audit opinions in recent years persisted
• UKHSA’s effort to close outstanding audit actions was recognised and improvements had been made. However, a small proportion of actions, some from 2021-22 or pre-dating UKHSA’s formation still could not be closed due to lack of evidence

24/169 Discussion followed on outstanding actions with the following points made:

• [Information redacted in accordance with the Freedom of Information Act 2000]
• The Committee recognised progress made and asked that the next update provide a named accountable person and completion timeline against all remaining outstanding actions that were high-priority

9.2 Progress report – internal audit plan 2024-25

24/170 The Committee noted progress against the 2024/25 plan.

24/171 Discussion followed on the balance of audits across the organisation, with the Committee questioning whether there should be a greater proportion focused on science as opposed to corporate areas. [Title redacted] explained that there was already extensive second-line assurance on clinical quality and that the audit plan reflected the risk profile and audit history of the organisation. However, it was agreed that it would be helpful to further consider UKHSA’s assurance map, and in particular those sources of assurance on the science side. (Action: Name redacted)

10. 8. Assurance update

24/172 The Director of Corporate Services presented an update on delivery of internal audit recommendations (enclosure ARC/24/048). This was also discussed under the Internal Audit item.

24/173 The Committee noted the update on progress on managing UKHSA’s audit actions generally and the action taken to address overdue actions.

24/174 The Committee also noted the findings from the analysis of the impact of open audit actions on strategic and other risks.

11. 9. UKHSA Strategic Risk Register (SRR)

24/175 The Director of Corporate Services introduced the paper (enclosure ARC/24/049) which provided an overview of the principal risks facing UKHSA as identified by the Executive Committee on 1 August 2024 and an update on the successful pilot of UKHSA’s new risk management software tool.

24/176 [Title redacted] reported on changes since the previous SRR report. Key points were:

• two risks had been added and one removed
• work was underway to improve risk training

24/177 The Audit and Risk Committee noted the latest version of the Strategic Risk Register, and discussed the following points:

• [Information redacted in accordance with the Freedom of Information Act 2000]
• the Committee felt that it would be beneficial for the Science and Research Committee to scrutinise the SRR though a ‘science lens’, advise on the risks included and suggest any changes
• the Committee endorsed the scheduling of a proposed workshop between Advisory Board members, the CEO and four DGs (under the new model) to review the SRR in the round

12. 10. Cyber risk

24/178 The Director General, Data, Analytics Surveillance introduced the paper (enclosure ARC/24/050) which provided an update on the cyber risk and measures to manage it.

24/179 The Committee noted the report.

24/180 The update focused on the following key points: [Information redacted in accordance with the Freedom of Information Act 2000.]

24/181 The Committee discussed the possibility of finding efficiency savings by working across the Civil Service and asked what services were available to and taken up by UKHSA.

24/182-24/183 [Information redacted in accordance with the Freedom of Information Act 2000.]

13. 11. Information Governance

24/184 The Director General, Data, Analytics Surveillance introduced the paper (enclosure ARC/24/051), which provided an update on the Information Governance risk at UKHSA.

24/185 The Audit and Risk Committee noted the latest position on UKHSA’s strategic risk on Information Governance and the assurances in place.

24/186 The update focused on the following key points: [Information redacted in accordance with the Freedom of Information Act 2000.]

24/187 The Committee requested a follow-up paper that set out the actions being taken to address the information governance risk and a timeline of progress milestones. The paper should cover related work going on across government and opportunities for collaboration and/or benchmarking, noting that this was likely to be a strategic risk area for most government organisations. The Committee also wanted further information on the alignment and interdependencies of the data strategy and information governance strategy and their alignment with wider policy on health data and public trust. (Action: Steven Riley)

24/188 The Committee agreed the proposal for reporting SIRO metrics to ARC quarterly while expressing a preference for a more integrated reporting solution in the long-term.

14. 12. Audit and Risk Committee Chair Annual Report 2023/24 and Effectiveness Review

24/189 The Chair of the Audit and Risk Committee introduced the Committee’s annual report and effectiveness review (enclosure ARC/24/052), which included proposed recommendations for the coming year.

24/190 The Committee noted the report and summary of the review and agreed the recommendations and implementation for the 2024/25 reporting year as outlined in the paper.

24/191 Points made in discussion were:

• work on the Annual Report and Accounts had dominated agendas but it was hoped that the Committee would soon be able to turn its attention to more strategic activity
• alignment of ARC meetings with the audit and assurance cycle should apply to reporting and metrics as well as cadence
• there was appetite from the Committee to collaborate more with other committees of the Advisory Board, such as was discussed earlier in the meeting regarding input from the Science and Research Committee on risks relating to Science. It was suggested that this should be added as a recommendation (Action: Name redacted)

24/192 The Committee was interested in the progression of the Public Bodies Review. There was no outcome to share with the Committee as yet, and the Committee asked that Advisory Board members be consulted on any potential changes before they were implemented. The Chair stated that under the status quo the Committee was advisory.

24/193 The Committee asked that the paper be shared with the NAO and GIAA. (Action: Jenny Harries)

15. 13. Audit and Risk Committee Forward Look

24/194 The Audit and Risk Committee noted the forward look (enclosure ARC/24/033).

24/195 Further requests were made for updates on science infrastructure, the Spending Review and People, the latter to include a follow-up on the senior leadership restructure. It was also suggested that it would be helpful to have an item on staff engagement once the current staff survey was complete.

24/196 The Chair invited any further changes to be submitted offline.

16. 12. Any other business

24/197 There being no further business the meeting closed at 12:45pm.

24/198 The next meeting would take place on 4 December 2024.

17. 15. For noting

24/199 Background papers from GIAA: [Information redacted in accordance with the Freedom of Information Act 2000.]