WIREDGOV

The boards of NHS trusts and foundation trusts in England must be more challenging of the information they receive about the running of their hospitals, according to Taking it on Trust, a new study from the Audit Commission, published today (29 April).

The study examines how the boards of NHS trusts and foundation trusts assure themselves that internal controls are in place and operating effectively.

While hospitals have processes to guard against risks, the controls and assurances are often poorly defined. This makes it difficult for boards to be clear that the assurances they receive are sound, which is essential if they are to keep patients safe and achieve their objectives.

The new report follows recent investigations by the Healthcare Commission into Mid Staffordshire NHS Trust and Birmingham Children's Hospital NHS Foundation Trusts, which found failures in governance arrangements.

The Audit Commission says there are significant gaps between the processes on paper and the rigour with which they are applied. There is much guidance in place, but as with the banking crisis in the UK, this report finds that NHS board members need to understand, question and assess risk on an informed and ongoing basis.

Steve Bundred, Chief Executive of the Audit Commission, said:
'Our evidence suggests that, while processes are in place, many board members at NHS trusts and foundation trusts are not always getting the right information that is needed to go hand-in-hand with the critical nature of work in hospitals. The NHS has, in many cases, been run on trust. But those who are charged with running our hospitals must be more challenging of the information they are given and more sceptical in their approach. Healthcare is inherently risky and complex, and assurance is not easy in the public or private sectors. To do their jobs properly, NHS board members must review their risk management arrangements so that they can be absolutely confident that their trust is providing high quality care by well-trained staff in a safe environment all of the time.'

Bill Moyes, Executive Chairman of Monitor said:
'Monitor relies on boards to be the front line of regulation. For boards to do this requires them not only to have the right information, but also assurance that it is accurate, relevant and reliable. This report identifies some examples of good practice around assurance and systems to support high quality governance, and others where this is not the case. It does not aim to provide another checklist, or more guidance in an area where there is plenty, but rather to paint a picture as to what good assurance may look like. It also encourages boards to pose the question in what way do they assure themselves that this is the case.'

The report found that:

• board assurance processes are generally in place but must be rigorously applied;
• board members are not always challenging enough; and
• the data received by boards is not always relevant, timely or fit for purpose.

The report includes recommendations for the Department of Health, Monitor and the NHS Appointments Commission. Key recommendations for NHS trusts and foundation trusts include the need:

• to review their risk management arrangements, including the way in which risks are reported to the board;
• to review how they identify and evaluate potential sources of assurance;
• for better use of internal audit and clinical audit to provide assurance to the board; and
• for systematic data quality reviews.

Notes to editors

1. Interviews regarding the findings of the 'Taking it on Trust' report are available with Steve Bundred, Chief Executive, or Andy McKeon, MD of Health. Please call 020 7166 2129 and ask for Nigel Watts.
2. The report considers how boards of NHS trusts and foundation trusts get assurance that their internal controls are operating effectively. Internal controls are put in place to mitigate against the risk of the organisation not achieving its strategic objectives. NHS trusts and FTs make self declarations about the operation of their internal controls in their Standards for Better Health declarations and in their Statement on Internal Control.
3. Board Assurance is the process by which boards assure themselves, and demonstrate that they have effective systems in place to manage and mitigate the risks to achieving their strategic objectives. When in document form this would set out the trust's strategic objectives and identify the key risks to achieving the objectives, the controls in place to ensure the risks were being managed and the sources of evidence, or assurance, that the controls were operating effectively. The framework would identify any gaps in controls or assurances and set out actions to close the gap.
4. The most common sources of assurance are internal audit; management reports; reports from inspection bodies and regulators and external audit.
5. The report summarises the history of board assurance; examines the differing governance structures and strategy setting in NHS trusts; considers risk management arrangements and board assurance frameworks and assesses the various sources of assurance over the operation of controls available to trusts.
6. The report highlights areas of good and innovative practice and includes case studies on a number of these. It also highlights a number of areas of weakness and makes recommendations.
7. The Audit Commission is an independent watchdog, driving economy, efficiency and effectiveness in local public services to deliver better outcomes for everyone. Our work across local government, health, housing, community safety and fire and rescue services means that we have a unique perspective. We promote value for money for taxpayers, auditing the £200 billion spent by 11,000 local public bodies. As a force for improvement, we work in partnership to assess local public services and make practical recommendations for promoting a better quality of life for local people.

Definitions

System of internal control

These are the arrangements in place to help increase the likelihood that the objectives of the organisation will be achieved. It is a process designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

• effectiveness and efficiency of operations;
• reliability of financial reporting; and
• compliance with applicable laws and regulations.

Statement on Internal Control (SIC)

The SIC is a document, produced alongside a trust's statement of accounts, which summarises and makes a conclusion on a trust's system of internal control. It summarises the work done to review the system, where assurance has been gained from and identifies any weaknesses and actions required to address the weaknesses. The statement is signed by the trust's chief executive.

Board Assurance Framework (BAF)

The BAF is a framework that trusts are required to put in place to identify the key risks to the trust's achievement of its strategic objectives and how these risks are being managed. In documented form this would usually include:

• the trusts strategic objectives;
• the key risks to achieving the objectives;
• the controls in place to manage the risks;
• the assurances that the trust used to provide evidence that the controls were operating effectively;
• any gaps in the assurances; and
• an action plan to address the gaps.