Corporate report

UKHSA Advisory Board: Audit and Risk Committee minutes

Updated 16 November 2022

Date: Wednesday 16 November 2022

Sponsor: Ian Peters

Purpose of the paper

The purpose of the paper is to provide the Advisory Board with minutes of the 11 July 2022 meeting of the Audit and Risk Committee. The minutes were agreed on 11 October 2022.

Recommendation

The Advisory Board is asked to note the minutes of 11 July 2022 meeting of the Audit and Risk Committee.

Minutes (unconfirmed), UKHSA Audit and Risk Committee, Monday 11 July 2022

Present at the meeting were:

• Ian Peters – Chair of UK Health Security Agency (UKHSA) Advisory Board (Chair)
• Simon Blagden – Non-Executive Member of UKHSA Advisory Board
• Sir Gordon Messenger – Non-Executive Member of UKHSA Advisory Board

In attendence were:

• Head of Sponsorship UKHSA

• Governance and Business Manager

• Board Secretary

• Jenny Harries – Chief Executive

• Government Internal Audit Agency

• Jac Gardner – Chief People Officer

• National Audit Office

• Lead Assurance Advisor

• Deputy Director, ICT

• Emma Reed – Director, Emergency Response and Health Protection

• Government Internal Audit Agency

• Andrew Sanderson – Director General, Finance, Commercial and Corporate Services

• Head of Governance

• Alex Sienkiewicz – Director of Corporate Services

• Lead Risk Advisor

• Deputy Director, Finance Operations

• Hamza Yusuf – Director of Strategic Finance

Apologies from:

• Government Internal Audit Agency

Introductions and apologies

22/001 The Chair welcomed all attendees to the first meeting of the UKHSA Audit and Risk Committee. Apologies had been received from the Head of Internal Audit, Government Internal Audit Agency.

22/002 The Chair reported that he had agreement with the Department of Health and Social Care (DHSC) to Chair the Audit and Risk Committee as a pragmatic and interim measure, pending the recruitment of the substantive postholder. He confirmed that the formal recruitment campaign would be commencing the following week.

22/003 As this was the first meeting, it was recognised that a number of papers had been shared for framing and context setting purposes, and the agenda and work of the committee was expected to evolve in the future.

Terms of reference

22/004 The Audit and Risk Committee agreed the terms of reference (enclosure ARC/22/001).

22/005 These had been developed based on the guidance as set out in Annexe D of the HM Treasury Audit and Risk Committee handbook with additions added by UKHSA to ensure the arrangements reflected the framework document with DHSC.

UKHSA assurance framework

22/006 The Chief Assurance and Risk Officer introduced the paper setting out UKHSA’s assurance framework (enclosure ARC/22/002). This provided an introduction to assurance, audit and compliance arrangements that were currently in place or being established across UKHSA.

22/007 UKHSA had in place a ‘3 lines of defence’ model for corporate assurance. Assurance was also closely linked to risk management and incident management arrangements and processes. It was also confirmed that UKHSA aimed to adhere to government functional standards.

22/008 A discussion of the Audit and Risk Committee raised that given the breadth of UKHSA’s remit and responsibilities, how it would manage or recognise any gaps in its assurance arrangements and framework. It was recognised that the initial paper set out the arrangements as they currently were and the next steps of work for the team would be to set out how gaps would be identified and managed. The Government Internal Audit Agency offered to provide support as this progressed, given their experience of supporting organisations across government.

22/009 An update was also provided on internal audit actions, which were marked as overdue. It was recognised that the small, central team were closely following these up and would continue to provide support to teams to ensure that these were closed in an appropriate and timely way.

22/010 The Audit and Risk Committee were content to note the report and requested that further work take place to work with relevant teams to improve the closure of internal audit actions.

Governance report

22/011 The Director of Corporate Services introduced the governance report (ARC/22/003) which set out a high-level overview of governance activity related to UKHSA as a frontline delivery organisation.

22/012 The report demonstrated the breadth of UKHSA’s role and responsibilities. While this provided useful context, it was recognised that it would be important for the Audit and Risk Committee to use its time to focus on specific areas of risk. It was also highlighted that members of the Audit and Risk Committee would be able to provide specific input and advice to colleagues and teams as they addressed these areas.

22/013 Governance also had important links to organisational culture, ensuring it responds appropriately to risks. It was reported that work was underway to refresh the current strategic risk register, both from a top-down approach with the Executive Committee and to ensure alignment with the forthcoming UKHSA strategy.

22/014 It was recommended that future areas of focus for the Audit and Risk Committee included cyber security. In particular this should include a deep dive review of the current arrangements in UKHSA, and the relevant links to the national cyber security centre. This would be added to the forward look.

22/015 The Audit and Risk Committee noted the governance report for July 2022. (Steven Riley, [name redacted])

Update on the serious untoward incident investigation into the misreporting of COVID-19 PCR test results by Immensa in September and October 2021

22/016 The Chief Executive introduced the paper (enclosure ARC/22/004) which set out the process used in the investigation of the serious untoward incident (SUI) that UKHSA declared about the misreporting of COVID-19 PCR test results by Immensa in September and October 2021.

22/017 UKHSA had established a panel to undertake a SUI investigation in line with the organisation’s policy and procedures. A copy of the policy and guidance would be shared with members of the Audit and Risk Committee. The investigation focused on the role of the management systems in place within UKHSA and in line with the procedure would produce a timeline, undertake a root cause analysis and make recommendations on lessons to be learned. (Alex Sienkiewicz)

22/018 It was confirmed that UKHSA was committed to publishing the final report once it had been finalised.

22/019 The Audit and Risk Committee noted the update.

Losses and special payments for quarters 3 and 4

22/020 An update was provided on the losses and special payments for quarters 3 and 4 (enclosure ARC/22/008).

22/021 The Audit and Risk Committee noted the paper, and in particular that the 2021 to 2022 financial period was still within the exceptional circumstances due to the ongoing pandemic. It was anticipated that further losses would be expected in 2022 to 2023 as UKHSA continued to ramp down as part of the living with COVID-19 strategy.

22/022 While recognising this, the Audit and Risk Committee requested that a future discussion be scheduled to consider lessons learned from these contractual arrangements. This would be added to the forward look. (Sarah Collins, [name redacted])

UKHSA workforce ramp down

22/023 The Chief People Officer introduced the paper setting out the context of the reductions in UKHSA’s workforce during the financial year 2022 to 2023 (enclosure ARC/22/005). It also set out the mechanisms in place to plan and monitor the progress of reductions at organisational and group level, along with progress to date.

22/024 It was recognised that UKHSA’s workforce profile was undergoing significant change, in response to 3 major challenges for the future financial year. These included:

• the need to establish UKHSA’s enduring role
• implementing the government’s living with COVID-19 strategy
• implementing the UKHSA budget as it was agreed in March 2022

22/025 The skill mix of the UKHSA workforce was also unusual when compared to the broader civil service. This was a consequence of rapidly scaling up the response to the COVID-19 pandemic and the highly specialised nature of many UKHSA roles.

22/026 Understandably, the challenges regarding the budget settlement and the impact on recruitment had caused a period of uncertainty for staff which was a key concern for the executive.

22/027 It was confirmed that there was a clear process in place for managing the ramp down, including weekly reporting to the Executive Committee to monitor and track progress.

22/028 The Audit and Risk Committee noted the update and thanked the team for their work to date. While this represented a significant challenge to the organisation, the work demonstrated that these risks were well-managed.

Technology resilience update

22/029 The Deputy Director, Head of Workplace, Hosting and Service Management introduced the paper (enclosure ARC/22/006) setting out the current arrangements in response to the resilience of UKHSA technology services and the strategy to improve these through a comprehensive programme of transformation.

22/030 An update was provided on the Colindale data centre incident which was caused by complete power outage in the north west region of London. The generators did not start up as expected which caused the data centres to suffer a complete power failure, with the majority of services hosted at the site unavailable. Resilience measures did ensure the continuity of some services via the data centre at Porton Down.

22/031 A full incident investigation had taken place, with further work expected to take place, including a full electrical review of the site which was planned.

22/032 The Audit and Risk Committee noted the update and thanked the team for their work to date, including the work to streamline and bring together the complex arrangements from predecessor organisations into UKHSA.

Accounting update

22/033 The Deputy Director of Finance, Operations introduced the accounting update (enclosure ARC/22/009). This included progress on financial accounting issues and requirements.

22/034 It was confirmed for the financial year 2021 to 2022 UKHSA finance would prepare an annual report and account from 1 April 2021 to 31 March 2022. This would primarily focus on UKHSA activity from 1 October 2021, including the transfer of balances from Public Health England and DHSC. The finance team were also continuing to provide support to DHSC in accounting for NHS Test and Trace spend for the first part of the financial year.

22/035 It was confirmed that the timeline to prepare and lay the accounts was in line with DHSC.

22/036 The key accounting challenges were set out, including inventory and transition arrangements. It was reported that in light of these challenges a qualified audit opinion was expected.

22/037 The Audit and Risk Committee noted the update, and that progress would be reported at future meetings.

Finance update

22/038 The Director, Strategic Finance, introduced the report (enclosure ARC/22/007) which set out UKHSA’s funding settlement and current financial position.

22/039 It was reported that:

• UKHSA was on track with ramping down the COVID-19 testing budget, and was currently predicting an underspend against this budget
• following the delayed budget settlement work on business planning to allocate the core agency budget, alongside finalising the strategic priorities was underway
• delivery against the capital programme was at risk, with mitigations in place by over-programming to meet the plan

22/040 A discussion of the Audit and Risk Committee considered UKHSA’s role in relation to preparedness, and how this would best be reflected in terms of its spend. This included critical issues for the future of the organisation such as laboratory capacity, the future of testing and the role of scientific estate more generally in future.

22/041 A future discussion on these points, and emergency preparedness more generally across UKHSA would be added to the forward look for the Audit and Risk Committee.

22/042 The Audit and Risk Committee noted the report. ([Name redacted])

Government Internal Audit Agency

22/043 The Head of Health Group Internal Audit provided an overview of the role of the Government Internal Audit Agency (GIAA) which provided UKHSA with its internal audit function. Within GIAA there was a team of auditors who worked on an agreed programme of audits.

22/044 An update was provided on the internal audit plan 2021 to 2022 (enclosure ARC/22/010) which was in the final stages of completion. A full report would be presented to the September Audit and Risk Committee.

22/045 Working with the Chief Assurance and Risk Officer it was reported that there were currently 71 internal audit actions which were open. It was confirmed that the number of actions would likely grow given the number of reports which were due to be completed. This was expected and could be managed, but again reinforced the importance of ensuring that realistic timelines were set, and internal actions appropriately closed in a timely manner.

22/046 The Audit and Risk Committee noted the update.

22/047 The proposed internal audit plan for 2022 to 23 was introduced (enclosure ARC/22/011). This had been developed in consultation with members of the Executive Committee and had been agreed by the Executive Committee prior to be shared with the Audit and Risk Committee. It was confirmed that the plan would be kept under review and could be re-prioritised in year if required. It was recognised that further areas for review may be presented throughout the year, and the transfer of the Vaccine Taskforce (VTF) was highlighted as a potential future topic.

22/048 The Audit and Risk Committee endorsed the plan for 2022 to 2023.

National Audit Office

22/049 The National Audit Office provided a brief overview of their work, and the team would continue to attend future Audit and Risk Committee meetings.

22/050 Future meetings would consider further papers on the audit plan. Initial work had taken place to develop this, and some initial work was underway, with there being a clear idea where the key risks were. It was recognised that in year organisational changes, such as the transition of the VTF would bring additional complexity.

22/051 The Audit and Risk Committee noted the update.

Any other business

Audit and Risk Committee forward look

22/052 The Audit and Risk Committee agreed that the following items would be added to the forward look for future meetings;

• Vaccine Taskforce, including the risk profile
• lessons learned, particularly in response to the management of incidents, this would be particularly important in light of the public inquiry
• organisational resilience, including challenges across multiple sites and the proposed science hub programme
• laboratory configuration and operational risk, this would also be a potential topic for a future Advisory Board meeting
• cyber security
• organisational run rate and spend
• commercial re-set and lessons learned
• science hub
• recruitment and skill mix

22/053 A full forward look would be developed for review and endorsement at the next meeting. ([Name redacted])

22/054 The Chair thanked all attendees and colleagues for a positive first meeting. The Audit and Risk Committee acknowledged that this represented good progress in challenging circumstances, but that there was much to do.

22/055 There being no further business the meeting closed at 3.50pm.

Head of Governance
July 2022