southwark clinical commissioning group integrated risk ......nhs southwark ccg believes that good...

Integrated Risk Management Framework

Version 1.1

February 2013

Southwark Clinical Commissioning Group

Policy Classification: Corporate Strategy: Clinical Governance 1

Policy No: 1

Issue No: 1 Author: Southwark CCG Governance team

Date of Issue: March 2013

Page No: 1 of 62 Review Date: March 2014

ENC H

ENC H Printed policies and procedures should not be regarded as current. To view all current SCCG policies and

procedures, refer to the website

The best possible health outcomes for Southwark people 2 | P a g e

Summary of Changes from Previous Version A number of changes have been made to the Integrated Risk Management Framework to reflect the transition to NHS Southwark Clinical Commissioning Group (SCCG). Changes made include: Refreshed roles and responsibilities reflecting the changing organisational

structure for the SCCG Revision of the Terms of Reference for the SCCG Integrated Governance

& Performance Committee Update of appendices showing examples of the Corporate Risk Register

and Board Assurance Framework Update of appendices containing detailed supporting guidance and

revised risk management tools Example of Heat Map for the Board Assurance Risks




Integrated Risk Management Framework

Contents Summary of changes ........................................................................... Page 2

1. Background ................................................................................................. 6

2. Introduction ................................................................................................. 6

3. Statement of intent ...................................................................................... 7

4. Objectives .................................................................................................... 8

5. Consultation ................................................................................................ 9

6. Links to Other Policies ............................................................................... 9

7. Communication and review ...................................................................... 10

8. Accountabilities & Responsibilities ........................................................ 10

9. Stakeholder Partnerships ......................................................................... 16

10. Risk Management Process .................................................................... 17

11. Serious Incidents (SI’s) .......................................................................... 19

12. Risk Acceptability ................................................................................... 20

13. Managing Risk across Organisational Boundaries ............................. 22

14. Annual Governance Statement ............................................................. 22

15. Risk Management Training .................................................................... 22

16. Conflicts of Interest and Risk Management ......................................... 23

17. Safeguarding Adults and Children ........................................................ 23




Appendices

A. Equality Impact Assessment 24

B. Risk Definitions 25

C. CCG Risk Reporting Context 27

D. Board Assurance Framework – example 29

E. Corporate Risk Register – example 30

F. Directorate Risk Register – example 31

G. Heat Map example 32

H. Risk Scoring Matrices 33

I. Risk Appetite Matrix – NHS Southwark CCG 37

J. Integrated Governance & Performance Committee ToR 38

K. Audit Committee TOR 45 L. NQB Review of Early Warning Systems in the NHS 51 M. NHS Southwark CCG Governance Structure 58




1. Background

The Integrated Risk Management Framework for NHS Southwark Clinical Commissioning Group (CCG) has been established to ensure that the principles, processes and procedures for best practice risk management1 are consistent across the organisation and fit for purpose. As outlined in the NHS Southwark CCG Constitution, member practices have delegated their responsibilities for commissioning to the CCG Governing Body. This includes the responsibility for identification and management of all risks, including clinical, corporate, financial, operational and reputational risks. This strategic document will be further updated to reflect any further national guidance. NHS Southwark CCG is committed to the application and embedding of best practice principles across all services and actively communicating these principles with NHS stakeholders in an effort to share best practice risk management activities. This framework document describes the key principles, processes, procedures and responsibilities in place within the CCG.

2. Introduction

NHS Southwark CCG has a responsibility to ensure that the organisation is properly governed in accordance with best practice in corporate, clinical and financial governance. Every activity the CCG undertakes or commissions others to undertake on its behalf brings with it some element of risk which has the potential to threaten or prevent the organisation achieving its objectives. NHS Southwark CCG acknowledges that providing health services is inherently risky and that risk can bring with it positive advantages, benefits and opportunities. SCCG is not aiming to create a risk-free environment, but rather one in which risk is considered as a matter of course and appropriately identified and controlled managed. NHS Southwark CCG believes that good risk management will provide a safer environment and better care for patients. It will also help the organisation to capitalise on opportunities and fulfil its corporate objectives in the short and longer term.

1 The definitions and terms used for risk management are explained in Appendix C.




SCCG is committed to making risk management a core organisational process and ensuring it becomes an integral part of the SCCG’s philosophy, practices and business planning. It is also committed, through the development and systematic review of the Board Assurance Framework (BAF) and Corporate Risk Register (CRR) ensure that identified risks are suitably controlled.

It is essential that risk management is not practised as a stand-alone programme and that everyone understands that they have an important role to ensure risks are managed effectively, in order to enable SCCG to deliver high quality services. NHS Southwark CCG recognises the importance of involving local stakeholders in its risk management process, not only in terms of identifying risk but also in the decision-making and prioritisation process. NHS Southwark CCG is committed to building and sustaining an organisational culture that encourages appropriate risk taking, effective performance management and organisational learning in order to continuously improve the quality of the services provided. This document will be updated to reflect any further national guidance.

3. Statement of intent

Integrated Risk Management Strategic Statement NHS Southwark CCG is committed to the active management of risk within the services it commissions. SCCG’s policy is to minimise risks wherever possible to service users, staff, and members of the public and other stakeholders. This encompasses all types of risk – clinical, financial, corporate, operational and reputational. NHS Southwark CCG is dedicated to establishing an organisational culture that ensures that risk management is an integral part of everything it does. This will be enabled and supported by a comprehensive system of internal controls aligned to management systems, corporate planning, clinician-led commissioning strategy development and objective setting, all to assure the Governing Body that Southwark is doing its reasonable best to protect stakeholders against risks. Risk Appetite Statement NHS Southwark CCG is working toward a ‘mature’ risk appetite. NHS Southwark CCG has no appetite for fraud/financial risk and has zero tolerance for regulatory breaches. NHS Southwark CCG will take considered risks where the long term benefits outweigh any short term losses. NHS Southwark CCG supports well managed risk taking and will ensure that the skills, ability and knowledge are in place to support innovation and to maximise opportunities to further improve services.




The SCCG Governing Body commits to review its risk appetite statement on an annual basis.

In addition to the above Southwark CCG’s Governing Body have agreed to utilise a Risk Appetite Matrix (Appendix I) which assesses the SCCG’s risk appetite and complements other risk management tools. This matrix was initiated and designed with clinical leads at SCCG and the Good Governance Institute. Risk appetite is ‘the amount of risk that an organisation is prepared to accept, tolerate or be exposed to at any point of time’. Risk therefore needs to be considered in terms of both opportunities and threats, and are not usually confined to money. They will invariably also impact on the capability of our organisation, its performance and its reputation. The risk appetite statement provides direction and boundaries on the level risk that can be accepted at various levels of the organisation, how the risk and any associated reward are to be balanced, and the likely response. NHS Southwark CCG is committed to ensuring that risk management forms an integral part of its everyday actions and decision-making processes, and so becomes part of SCCG’s culture. As outlined in the NHS Southwark CCG Constitution, member practices have delegated their responsibilities for commissioning to Southwark CCG’s Governing Body. This includes the responsibility for identification and management of all risks, including clinical, corporate, financial, information, operational and reputation.

4. Objectives

The key objective of this framework is to ensure processes are in place to:

Ensure all risks are identified and managed through a robust Board Assurance Framework and accompanying Corporate and Directorate Risk Registers. These include corporate, strategic, operational, clinical, financial, information and reputational risks.

Integrate risk management alongside quality and governance issues and established local risk reporting procedures to ensure an effective integrated management process throughout SCCG’s activities

Manage clinical and non-clinical risks facing SCCG in a co-ordinated manner so as to enable SCCG to provide high quality support to clinical commissioning leads

Ensure that NHS Southwark CCG Governing Body is kept suitably informed of significant risks facing the organisation and associated mitigation plans.




NHS Southwark CCG will take all reasonable steps to manage risks in order to protect patients, staff and assets from preventable injury, loss and damage, and to ensure benefits realisation of appropriate risk-taking.

5. Consultation

This framework document was developed in consultation with: The member practices of NHS Southwark Clinical Commissioning

Group (SCCG)

SCCG Integrated Governance and Performance sub-group (IGP) of the SCCG.

Chair, SCCG

GP Clinical Commissioning Lead (Governance)

Chief Officer, SCCG

Chief Financial Officer, SCCG

Director of Service Redesign, SCCG

Director of Client Group Commissioning, SCCG

Director of Public Health

Head of Integrated Planning and Performance, SCCG

Head of Governance and OD, SCCG

Risk and Assurance Manager, SCCG

Head of Engagement, SCCG

Information Governance Manager, South London CSU

Lay Member with responsibility for Governance

6. Links to Other Policies

NPSA National Framework for the Management, Reporting and Learning from Serious Incidents (2010)

Conflict of Interest policy

Information Governance framework and policies

Claims policy

Complaints Management policy

Adverse Incidents and Near Miss reporting policy

Serious Incident (SI) policy (in accordance with NHS London SI Reporting Guidance, 2010)

Whistle Blowing Policy

Counter Fraud & Corruption Policy

Health and Safety Policy

Policy on Local Management of CAS (Central Alerting System)




Business Continuity Plan

Communications and Engagement Strategy

Adult and Child Safeguarding Policies

7. Communication and review

This framework and its associated policies will be made available to SCCG’s staff, stakeholders and service users and published on the intranet. The framework will be reviewed at least annually or in the light of new legislation or information which indicates it is not effective.

8. Accountabilities & Responsibilities

8.1 NHS Southwark SCCG Governing Body

NHS Southwark CCG Governing Body (SCCC) are responsible for setting the strategic direction for risk and overseeing the integrated risk management arrangements across the organisation. The SCCG delegates the management of risk to the Integrated Governance & Performance Committee (IG&P). The SCCC will receive Risk Reports including the Board Assurance Framework and the Corporate Risk Register. The SCCC will: review and agree the CCG’s principal objectives receive assurance through reports from the Integrated Governance

and Performance Committee to ensure the embedded risk management process is operating effectively as a key element of the CCG’s Assurance Framework.

receive and action any matters of significant concern escalated by the Integrated Governance and Performance Committee in relation to integrated risk management, organisational, corporate and clinical governance.

The Membership of the SCCG Governing Body includes a Clinical Lead with portfolio for Governance, Risk Management & Quality. In addition, there is a Lay Member with a lead for Governance & Risk Management.

8.2 Integrated Governance & Performance Committee (IG&P)

Corporate risks comprise elements of financial, clinical and non-clinical activity, including financial, strategic, operational and hazard related activities. It is therefore necessary to provide an arena in which these issues can be discussed and developed by their appropriate lead whilst eliminating either too much overlap or the potential for omission.




The Integrated Governance & Performance Committee (IG&P) is responsible for the oversight of all risk and for implementing the strategic direction for risk within the organisation, on behalf of the Governing Body. The IG&P receives information and reports to ensure a strategic overview of SCCG performance and subsequent action planning with regard to clinical risk and quality. The IG&P is responsible for receiving and monitoring the Board Assurance Framework, Corporate Risk Register as well as monitoring action plans arising from internal and external inspection or those arising from incidents, including Serious Incidents (SI’s), claims or complaints. It will provide both routine and annual reports to the Governing Body. It will provide reports and detail to the SCCG Governing Body. The Membership of the IG&P includes GP-clinical lead representation for Governance and Risk Management, in addition to a lay member lead for Governance/Risk Management. The IG&P will undertake: To oversee the Integrated Risk Management Framework across

SCCG

To put into place systems, policies and procedures that help SCCG to effectively prioritise and manage risk management issues and proactively identify any early warnings of a failing service.

To ensure compliance with relevant regulatory, legal and code of conduct requirements as set out in relevant guidance

To scrutinise and challenge the Corporate Risk Register and Board Assurance Framework

To ensure that the appropriate funding required for risk management issues is identified to the SCCG and to support risk management training and education.

Terms of Reference for the IG& P are included in Appendix J.

8.3 Other Committees/Sub-Groups

SCCG is made up of a number of committees, sub-groups and specialist forums, some permanent and some for specific activities, which report either directly to the SCCG Governing Body or to the appropriate SCCG Committee. The structure of these and their Terms of Reference is available on the website.

8.4 Individual Accountabilities and Responsibilities

This section gives details of the individual roles and capacity to deliver integrated risk management.




8.4.1 Chair The SCCG has overall responsibility for governance within SCCG. The Chair is a member of the IG&P

8.4.2 Chief Officer The Chief Officer is the Accountable Officer for the SCCG and has overall executive responsibility for risk management. This responsibility is delegated to named SCCG Directors for implementation. The Chief Officer is a member of the IG&P.

8.4.3 Lay Members Lay Members provide a strategic and impartial external view of governance ensuring the CCG behaves with the utmost probity at all times. One Lay Member has a specific role for governance including audit, risk management, remuneration and managing conflicts of interest. 8.4.4 Clinical Leads for BAF risks Every risk on the Board Assurance Framework will be assigned both an executive and a clinical lead, usually the portfolio lead for the workstream. 8.4.5 Chief Financial Officer The Chief Financial Officer has delegated responsibility for all aspects of financial risk regarding NHS Southwark CCG’s financial arrangements and statutory obligations, and for management of all aspects of non-clinical risk and corporate risk regarding all other SCCG activity. The CFO is also the Senior Information Risk Owner (SIRO).

8.4.6 SCCG Directors

Each Director is responsible for ensuring that there are appropriate local risk management systems in place in their area. As a minimum this includes delegated responsibility to ensure preparation and review of a Directorate/ risk register/action plan and an appropriate method through which significant risks are brought to their attention. The responsibility is to ensure that robust, integrated and coherent risk management arrangements which comply with legal requirements and good practice are in place and adhered to across SCCG. SCCG Directors additionally have responsibility for ensuring all shared partnership services (received or provided) are managed to minimise risk.




A summary of their responsibilities includes: Providing risk management leadership and sponsorship across SCCG

Reporting to the Governing Body on all aspects of risk performance and compliance

Ensuring that there is clear leadership and accountability for risk management in all service areas

Engaging the support and resources of SCCG in delivering the Integrated Risk Management Framework

Ensuring that there are formal mechanisms in place to assess and improve patient, staff and organisational safety

Ensuring that all staff within SCCG are provided with appropriate information and training to enable them to work safely and protect patients from harm

Ensuring that sufficient resources to provide safe systems of work and that suitable and sufficient risk assessments are carried out, documented, entered onto and monitored through the Directorate Risk Register

Ensuring that action plans to mitigate risks are appropriate to the level of perceived risk and that effectiveness of such mitigation is monitored and acted upon

Ensuring that objectives within service development plans, QIPP, business plans and appraisals and other documents consider the effect of risks and that a comprehensive risk management process is undertaken to mitigate the effects.

8.4.7 Head of Governance & OD

The Head of Governance & OD is responsible for developing and creating a risk aware culture and ensuring that this is reflected in all aspects of organisational business. They are also responsible for delivering an annual review of the risk appetite statement and supporting the Governing Body to identify and manage risks as part of good governance.

8.4.8 Corporate Governance Manager

The Corporate Governance Manager is responsible for -

developing and promoting a risk aware culture across SCCG supporting Directors and staff in their identification and continuous

management of risk co-ordinating the Corporate Risk Register & Board Assurance

Framework to facilitate consistency of risk reporting ensuring internal and external risks are adequately reported to forums

including IG&P, SCCC, Audit Committee etc providing specialist risk management knowledge




supporting appropriate development for the Governing Body.

8.4.9 Managers’ Responsibilities

Managers are responsible for managing risks in their area of responsibility. All managers at SCCG are responsible for ensuring that appropriate and effective risk management processes are in place within their designated area, that employees made aware of the risks within their work environment and of their personal responsibilities, and that all necessary risk assessments are carried out, in liaison with relevant advisors where necessary. Managers must ensure that all staff have the necessary information and training to enable them to work safely and to comply with SCCG’s internal control systems. In situations where significant risks have been identified and where local control measures are considered to be potentially inadequate managers have a dual responsibility both in raising the issues with relevant senior management, and in continuing to work with senior management in managing the risk. A risk that is passed up the line management chain does not relieve a line manager of its on-going responsibility – responsibility is shared. Managers and service leads must ensure that:

They have adequate knowledge of and/or access to all legislation

relevant to their area of responsibility and as advised by appropriate experts, ensure that compliance with such legislation is maintained

Adequate resources are made available to provide safe systems of work. This will include making provision for risk assessments, appropriate control measures, raising outstanding concerns, ensuring safe working procedures/practices and continued monitoring and revision of the same.

Staff undertake the training required (e.g. Risk Awareness, Health and Safety, Fire, Information Governance, Management of Patient Identifiable Data, Safeguarding, Equalities & Diversity, etc.).

Relevant statutory and contractual professional registrations are kept up to date

Greater risk management awareness is promoted amongst all staff through leading by example, and ensuring that only trained, competent staff are responsible for assessing risks and determining adequate control measures within the working environment

Performance and health/safety standards are monitored including risk assessments, safe systems of work, use of personal protective equipment etc. ensuring that these are reviewed and updated regularly and the level of compliance with all agreed internal controls




Adequate provision is made to ensure fire and other emergencies are appropriately dealt with in line SCCG policies. (NB: see SCCG Major Incident Plan as part of the SCCG Business Continuity Plan).

8.4.10 Responsibilities of all Employees

All employees must:

Report all incidents/accidents and near misses using the NHS

Southwark CCG Incident Reporting Policy.

Be aware that they have a statutory duty to take reasonable care for their own safety and the safety of all others that may be affected by their actions or inaction

Comply with the Heath & Safety at Work Act 1974, SCCG rules, regulations and instructions to protect the health, safety and welfare of anyone affected by SCCG’s business.2

Be familiar and comply with the SCCG Integrated Risk Management Framework, Service/Department procedures, local arrangements for safe systems of work, other internal arrangements and controls

Neither intentionally nor recklessly interfere with, misuse or fail to use when required, any equipment provided for the protection of safety and health as pursuant to the Health & Safety at Work Act (1974)

Be aware of emergency procedures e.g. resuscitation, evacuation and fire precaution procedures etc. relating to their particular Service/Department locations.

Comply with mandatory training programmes.

8.4.11 Independent Contractors & Acute providers

Independent contractors are bound by statutory obligations as employers (e.g. to comply with Health and Safety at Work Act 1974, Environment Act, COSHH Regulations). In addition all clinicians are responsible to their professional bodies for their clinical practice. As such, independent contractors need to ensure that they are managing clinical and non-clinical risks appropriately. Independent contractors must comply with their regulatory bodies and respective standards of professional practice. For GPs this includes compliance with the incident investigation and reporting systems of their employing or contracting body. (GMC standards: Good Medical Practice)

2 expert health and safety guidance is delivered to SCCG staff both by the Local Authority (via SCCG’s tenancy at Tooley Street Local Authority offices) and by expert health and safety contractors, Facilities Management Services (FMS). Provision of services from FMS is governed by a Service Level Agreement.




The role of the NHSCB includes managing the performance of independent clinical contractors, including those in Southwark and to ensure appropriate risk management practices are in place as required. Independent contractors as providers of commissioned services will be required to manage risk in accordance with the NHSCB risk management model. Acute providers’ risk management systems are monitored through their Quality Monitoring meetings and Risk/Governance Committees. All Trusts use a reporting system such as Datix which provides information for analysis to the National Reporting & Learning System. 8.4.12 Risk Management Specialists

There are a number of risk management specialists in Southwark CCG who add to the capacity of the roles above including:

Chief Financial Officer: Financial Risk Lead and Senior Information

Risk Officer (SIRO)

Safeguarding Leads: Specialist leads for clinical risks (Adults & Children)

Director of Client Group Commissioning: Caldicott Guardian

Head of Governance & OD: Lead for all aspects of clinical & non-clinical governance; aspects of risk management and quality; SI reporting and incident management; and Governing Body development on risk management

From 01 April 2013 – Local Authority Public Health Emergency Planning Manager: Lead for all aspects of Business Continuity Planning and Emergency Response & Resilience.

Information Governance Manager (CSU): Lead for Information Governance related activities in Southwark CCG

Health & Safety3: All health & safety related matters including incident reporting and analysis, inspections and related audit

Head of Membership & Engagement, SCCG: Lead for all media related enquiries

South London Commissioning Support Unit Complaints & PALS Service: Lead for all complaints issues and Patient Advisory & Liaison Services.

9. Stakeholder Partnerships

NHS Southwark CCG recognises that in order for risks to be effectively managed and for the quality of services to continuously improve, it is

3 FMS




necessary to work closely and collaboratively with a wide range of partner organisations.

To this end, SCCG will endeavour to involve partner organisations in aspects of risk management as appropriate. Such organisations include those the organisation shares premises/assets with, jointly delivers services with, and those which the organisation needs to work closely with, including NHS CBL, NHS Trusts, Local Authority, the police, statutory and voluntary bodies and patient representative groups.

This framework recognises the potential inherent risks of shared service arrangements, including those services provided by the Commissioning Support Unit (CSU). The provision of these services is collectively managed to ensure quality and effectiveness, and are underpinned through an SLA.

10. Risk Management Process

Source: Australian Standard AS/NZS: 4360/1999

NHS Southwark CCG has adopted the Australia/New Zealand (AS/NZS 4360/1999) standard which is internationally recognised standard providing a generic model for the identification, analysis, prioritisation, treatment, communication and monitoring of risks across clinical and non-clinical services and activities at local and corporate level. There are 7 stages to managing risk in this model as shown above:




1. Establish the context

2. Identify hazards

3. Analyse risks

4. Prioritise risks

5. Treat risks

6. Monitor and review

7. Communicate and consult

This applies to all risk including corporate, financial, clinical, operational and reputational risks. Each stage of the risk management process should be documented in order to:

demonstrate the process is conducted properly

provide evidence of systematic approach

provide a record of risk and to develop SCCG’s knowledge of risk

provide relevant decision makers with a risk management plan for approval, etc.

provide an accountability mechanism and tool

facilitate review and monitoring

provide an audit trail

share and communicate information.

10.1 Risk Scoring

A risk score is achieved by multiplying an individual likelihood (probability) score with an individual severity (impact) score:

Likelihood X Impact = Risk Score The CCG risk scoring matrices are consistent with the NPSA guidelines (January 2008) and are aligned to the CCG adopted AS/NZS 4360:1999 risk management standard. Risk matrices for calculating an overall risk score can be found in Appendix H. A specific risk matrix for Personal Data related incidents is included in Appendix H(iii).




10.2 Risk Grading When considering risk, it is vital to have a qualitative method of defining risk that enables prioritisation and appropriate action. Prioritisation can be achieved by applying the risk grading matrix below. The risk matrix adopted by the CCG is consistent with guidelines provided by the NPSA4. A summary of the potential ‘grades’ of risk issues, based on a risk score, are noted below, where:

Grade Definition Risk Score Red Extreme Risk 15-25 Amber High Risk 8-12 Yellow Moderate Risk 4-6 Green Low Risk 1-3

Risks which attract the highest scores are therefore graded ‘red’ and warrant immediate attention by relevant personnel. Appendix C provides a schematic overview of the CCG risk reporting and escalation process.

11. Serious Incidents (SI’s)

The principal definition of a Serious Incident (SI) is something out of the ordinary or unexpected, with the potential to cause serious harm and/or likely to attract public and media interest that occurs on NHS premises or in the provision of an NHS or a commissioned service. CCGs have responsibility to ensure providers are delivering safe services and, should an SI occur, have investigated it in a thorough and robust manner. NHS Commissioning Board, CCGs, and the Trust Development Agency are advised to share information about SIs with partner organisations in local and regional Quality Surveillance Groups5i who can assist in triangulating other quality-related information and formulating appropriate responses, such as triggering a Risk Summit or keeping the provider under regular review

4 National Patient Safety Agency 5 5. National Quality Board (January 2013). How to establish a Quality Surveillance Group. Available at http://www.dh.gov.uk/health/2013/01/establish-qsg/




NHS Southwark CCG will report SI numbers and themes through the IG&P to the Governing Body; and participate in Quality Surveillance Groups and other forums to ensure learning is shared, best practice is promoted and providers take necessary action to ensure patient safety. NHS Southwark CCG has produced guidance on local Incident Reporting (available to staff via the local Intranet portal). Procedures including timescales and risk grading are included in this policy. A risk grading matrix specific to Information Governance SI’s has been provided. A copy of the risk grading matrix for SI’s relating to personal data can be found in Appendix H(iii).

12. Risk Acceptability

NHS Southwark CCG determines the ‘acceptability’ of a risk based on the quality of information provided to relevant personnel. Risk reporting procedures, risk registers and regular monitoring and review of these processes ensures that up to date risk information is available for SCCG to make risk-informed decisions. In particular, the scoring and grading of risks permits risk issues to be prioritised for their perceived importance. SCCG has established reporting procedures for reporting any new ‘red’ risk issues to the Integrated Governance & Performance Committee (IG&P). In addition, any significant risk that may threaten the achievement of SCCG’s objectives are highlighted and presented in Quarterly updates to the same Committee. Risk information is structured and includes details on the description, causes, controls, score and agreed action plans for all risks presented to the IG&P. The monitoring of such risks can therefore be undertaken and the effectiveness of risk performance measured over time.

12.1 Board Assurance Framework (BAF)

The Board Assurance Framework is a tool designed to provide the NHS Southwark CCG Governing Body, Audit Committee and IG&P with assurance that the organisation is effectively managing or has plans in place to manage risks which may threaten achievement of the organisational annual objectives. The Board Assurance Framework consists of principal risks directly affecting the corporate objectives as well as those risks escalated from Corporate Risk Register by the IG&P Committee.




It also provides a structure for documenting evidence to support signing the Annual Governance Statement, and forms part of the annual audit review. Appendix C provides the contextual overview of the risk reporting process, including the BAF. An example of the BAF is presented in Appendix D.

12.2 Corporate Risk Register (CRR) The Corporate Risk Register (CRR) includes risks that are escalated from Directorate Risk Registers:

due being rated ‘red’ residual i.e. after current controls are in place, thus warranting the attention of the Integrated Governance and Performance Group for scrutiny and decision,

and could directly affect the delivery of a Corporate/ Principal objective.

All Corporate Risk Register risks will be linked to the Board Assurance Framework. An example of the CRR is presented in Appendix E. 12.3 Directorate Risk Registers NHS Southwark CCG has established and embedded a tripartite risk reporting process, including the Board Assurance Framework (BAF), Corporate Risk Register (CRR) and Directorate Risk Registers (DRR). Appendix C provides a contextual overview of this reporting process. Directorate Risk Registers are supported by individual team/project Risk Registers. An example of the DRR is presented in Appendix F 12.4 Risk Register Reporting and Review Monthly risk reports from the Corporate Risk Register and quarterly review of the Board Assurance Framework (BAF) will be presented to the Integrated Governance & Performance Group (IG&P). Directorate Risk Registers (DRR): Each functional unit will review its Risk Register on a monthly basis. New risks will be presented to the Senior Management Team which will determine if the risk needs to be managed on the Directorate Risk Register or reported on the Corporate Risk Register. All types of risks are to be included i.e. financial, corporate, clinical, operational and reputational risks. Red risks will be escalated to the Corporate Risk Register (CRR). Corporate Risk Register (CRR):




The Corporate Risk Register provides an organisational-wide summary of significant risks across all Directorates and functional units. The CRR will be updated monthly by the Governance team preceding discussion at the IG&P.

13. Managing Risk across Organisational Boundaries

It is often at the interface between organisations that the highest risks exist, and clarity about responsibilities and accountabilities for them most difficult to ascertain. Only by working closely and collaboratively with partner organisations can these be identified, managed and afforded an appropriate priority within the SCCG risk action plan. NHS Southwark CCG will strive to actively involve partner organisations in all aspects of integrated risk management as appropriate.

14. Annual Governance Statement

It is anticipated that the SCCG Chair and Chief Officer will sign an Annual Governance Statement on behalf of the Governing Body, stating that the requirements below are in place, that controls are working effectively, based on advice from the Audit Committee, SCCG Integrated Governance & Performance Group and other external sources. This is subject to national guidance. The Annual Governance Statement requires the SCCG Governing Body to have in place:

Clear objectives which provide the framework for all organisation

activity Structured risk identification systems covering all risks Robust control in place for the management of risk Appropriate monitoring and review mechanisms, which provide

information and assurance, (see risk definitions Appendix B) that the system of risk management across the organisation is effective.

15. Risk Management Training

To enable the Integrated Risk Management Framework to be effective, training will be provided for staff. This will include:

Introduction to and refresher training for risk management and

governance as appropriate to the roles and responsibilities within SCCG and in respective roles in support of the SCCG




Inclusion in an induction pack for new Governing Body members.

The provision of appropriate resources to provide Governing Body development on Board Assurance and risk management.

16. Conflicts of Interest and Risk Management

"A 'conflict of interest' involves a conflict between public duty and private interests of a public official, in which the public official has private interests which could improperly influence the performance of their official duties and responsibilities."6 NHS Southwark CCG recognises that identifying and declaring conflicts of interest is an important step in managing them appropriately. In the context of risk management decisions, NHS Southwark CCG is committed to the appropriate management of any associated risks, in the interest of the population it serves. In October 2012 the NHS Commissioning Board published guidance7 to be used by CCGs when commissioning services for which GP practices could be potential providers. This document sets out additional safeguards including: arrangements for declaring interests; maintaining a register of interests; excluding individuals from decision-making where a conflict arises;

and, engagement with a range of potential providers on service design.

NHS Southwark CCG has embraced the guidance and a Conflict of Interest policy has been ratified by the Governing Body. This is published on the SCCG website.

17. Safeguarding Adults and Children

Safeguarding vulnerable children and adults at risk is a core commitment of NHS Southwark CCG. The Chief Officer holds the local accountability for safeguarding and there are robust arrangements in place within NHS Southwark CCG to support safeguarding practice across NHS providers. A nominated GP Clinical Lead for Safeguarding provides clinical leadership, and advice and support for primary care. Strategic partnerships are strong with all key stakeholders including the Local Authority and there is full NHS Southwark CCG participation in the

6 OEDC 2003, Guidelines for Managing Conflicts of Interest in the Public Service, OECD, Paris, paragraph 10

7 http://www.commissioningboard.nhs.uk/files/2012/09/c-of-c-conflicts-of-interest.pdf




Adult Safeguarding Partnership, Children’s Trust Board and Southwark Safeguarding Children Board (SSCB). The Chief Officer chairs the NHS Southwark CCG Executive Safeguarding Committee, which has representatives from both health and social care, which reports to the IG&P committee. Key safeguarding action plans that link to SSCB, Ofsted and CQC Inspections, Serious Care Reviews (SCR) and Internal Management Reviews (IMR) are in place. Annual safeguarding reports for both children (Section 11) and adults at risk are quality assured by the IG&P committee at NHS Southwark CCG. The safeguarding children report is presented to the Southwark Safeguarding Executive Board (SSCEB) and the adult safeguarding report is presented at the Adult Safeguarding Partnership Board. This ensures that the organisation fully compliant with both children’s safeguarding requirements as set out in Working Together to Safeguard Children and the Royal College of Paediatrics and Child Health Intercollegiate document 2010 in regards to training health staff to the correct level required for their professional role and responsibilities, and in line with government policy on safeguarding adults at risk. Commissioning standards have been developed to ensure that all providers have safeguarding embedded in their service delivery plans.




Appendix A - Equality Impact Assessment Tool

To be completed and attached to any procedural document when submitted to the appropriate committee for consideration and approval. Yes/No Comments

1. Does the policy/guidance affect one group less or more favourably than another on the basis of:

• Age N

• Disability

N

• Gender Reassignment N

• Marriage and Civil Partnership N

• Pregnancy and Maternity N

• Race N

• Religion or Belief

N

• Sex N

Sexual Orientation

N

2. Is there any evidence that some groups are affected differently?

N

3. If you have identified potential discrimination, are there any exceptions valid, legal and/or justifiable?

NA

4. Is the impact of the policy/guidance likely to be negative?

NA

5. If so can the impact be avoided? NA

6. What alternatives are there to achieving the policy/guidance without the impact?

NA

7. Can we reduce by taking action?

NA




APPENDIX - B Risk Definitions

1. Risk

Risk is the chance of something happening that will have an impact on the achievement of the organisation’s objectives and the delivery of high quality patient care. It can be any type of risk including corporate, clinical, financial, operational or reputational.

2. Risk Management

Risk management is “a logical and systematic method of establishing the context, identifying, analysing, evaluating, treating, monitoring and communicating risks associated with any activity, function or process in the way that will enable organisations to minimise losses and maximise opportunities.” (Australian Standard, Risk Management AS/NZS 4360:1999).

3. Significant Risks are those risks which, when measured according to SCCG’s risk grading tool are assessed to be high. The Southwark Clinical Commissioning Group, supported by the Integrated Governance & Performance Committee (IG&P), will take an active interest in the management of significant risks.

4. Acceptable Risks are those risks which have been identified and

measured according to the risk grading tool and for which risk mitigation action plans have been developed. Such risks are deemed to be acceptable according to the risk appetite of NHS Southwark CCG, a delegated committee or Directorate, depending on the nature and grade of the risk. Acceptable risks should be monitored, reviewed and entered onto the appropriate risk register. By this definition an unacceptable risk is one where such a risk is rated above the risk appetite of SCCG.

5. Risk Appetite is the level, amount or degree of risk that SCCG or a

particular delegated authority is willing to accept. Risk Appetite is measured through the Risk Maturity Matrix (Appendix I)

6. Controls:

Mitigating mechanisms that are currently in place.

Examples of controls include: Committees in place, monthly/ quarterly reports to committees, approved business or project plans or business cases, approved HR/ Finance resource, budget, approved contingency plans/ budgets.

7. Sources of Assurance:

These will be Examples include: Meeting minutes where controls have been agreed and scrutinised for efficiency, plans that have been submitted or approved, policies, Commissioning intentions or strategy.




8. Gaps in Controls and Assurances Gap in control is mitigation that is required to bring the risk down further but not currently in place currently. Gap in assurance reflects insufficient evidence that the control is in place or in effect.

9. SMART Actions Actions will be determined by gaps in controls and assurances, i.e. mitigation that is further required to bring the risk to a tolerable level.

10. Classification of Assurance:

Full assurance - a sound system of controls has been effectively applied and manages the risks to the achievement of the objectives Significant assurance - a sound system of controls has, for the most part, been consistently applied, minor inconsistencies have occurred but there is no evidence to suggest that the system’s objectives have been put at risk Limited assurance - gaps in the application of controls as designed by management put the achievement of objectives at risk Negative assurance - gaps in the application of controls as designed by management have opened the system to risk of significant failure to achieve its objectives and left it open to abuse or error.


FOR ASSURANCE

quarterly

Integrated Governance and Performance Committee

(IG&P)

Finance and Business Directorate

Risk Register

Public Health Directorate Risk

Register

Client Group Commissioning Directorate Risk

Service Redesign Directorate Risk

Register

Southwark Clinical Commissioning Committee

(SCCC)

Risks deemed significant for inclusion on the BAF

Risks rated red on the Corporate Risk Register

quarterly

FOR SCRUTINY AND CHALLENGE

monthly Corporate Risk

Register

Board Assurance Framework

Strategic risks against corporate objectives

monthly

Appendix Ci - NHS Southwark CCG Risk Reporting and Management Structure


Appendix Cii SCCG Risk Reporting Context


Appendix D: NHS Southwark CCG Board Assurance Framework Example


Appendix E: NHS Southwark CCG Corporate Risk Register Example


Appendix F: NHS Southwark CCG Directorate Risk Register Example An example completed Directorate Risk Register entry is included below for guidance:


APPENDIX G – EXAMPLE OF HEAT MAP FOR BOARD ASSURANCE RISKS


Appendix H (i): Risk Scoring Matrices The matrix below represents the possible combined risk scores based on a measurmenet of both the likelihood (probability) and severity (impact) of risk issues. A combination of likelihood and severit score provides the combine risk score.

Likelihood x Severity = Risk Score

An example risk score calculaiton has been provided below, where: Likelihood = Possible (3); Severity = Major (4); therefore:

(Likelihood) 3 x 4 (Severity) = 12

The risk score can then be compared to the risk matrix below and a ‘colour’ or ‘grade’ can be determined. In the example above, a risk score of 12 would be graded as ‘amber’ (moderate). Consequntally, the CCG can then prioritise mitigation actions based on an understanding of the nature of the risk presented. Risk Scoring Matrix

Likelihood

1 2 3 4 5

Rare Unlikely Possible Likely Almost certain

Sev

eri

ty

5 Catastrophic 5 10 15 20 25

4 Major 4 8 12 16 20

3 Moderate 3 6 9 12 15

2 Minor 2 4 6 8 10

1 Negligible 1 2 3 4 5


Individual Risk Scoring Matrices Two risk matrices are available which, when combined, provide an overall risk score. These matrices include a likelihood matrix and a severity matrix: Appendix H (ii): Likelihood Matrix Likelihood (Probability) Score

1 2 3 4 5

Descriptor Rare Unlikely Possible Likely Almost certain

Frequency How often might it/does it happen

This will probably never happen/recur

Do not expect it to happen/recur but it is possible it may do so

Might happen or recur occasionally

Will probably happen/recur but it is not a persisting issue

Will undoubtedly happen/recur, possibly frequently

Frequency Time-frame

Not expected to occur for years

Expected to occur at least annually

Expected to occur at least monthly

Expected to occur at least weekly

Expected to occur at least daily

Frequency Will it happen or not?

<0.1% 0.1 to 1% 1 to 10% 10 to 50% >50%

Several different descriptors of likelihood (probability) are available for use by the CCG, permitting flexibility in the application of likelihood scoring to particular risk scenarios.


Appendix H (iii): Severity Matrix Severity (Impact) Score

1 2 3 4 5

Descriptor Negligible Minor Moderate Major Catastrophic Impact on the safety of patients, staff or public (physical / psychological harm)

Minimal injury requiring no/minimal intervention or treatment. No time off work

Minor injury or illness, requiring minor intervention Requiring time off work for >3 days Increase in length of hospital stay by 1-3 days

Moderate injury requiring professional intervention Requiring time off work for 4-14 days Increase in length of hospital stay by 4-15 days RIDDOR/agency reportable incident An event which impacts on a small number of patients

Major injury leading to long-term incapacity/disability Requiring time off work for >14 days Increase in length of hospital stay by >15 days Mismanagement of patient care with long-term effects

Incident leading to death Multiple permanent injuries or irreversible health effects An event which impacts on a large number of patients

Adverse publicity/ reputation

Rumours

Potential for public concern

Local media coverage – short-term reduction in public confidence Elements of public expectation not being met

Local media coverage – long-term reduction in public confidence

National media coverage with <3 days service well below reasonable public expectation

National media coverage with >3 days service well below reasonable public expectation. MP concerned (questions in the House) Total loss of public confidence

Business objectives/ projects

Insignificant cost increase/ schedule slippage

<5 per cent over project budget Schedule slippage

5–10 per cent over project budget Schedule slippage

Non-compliance with national 10–25 per cent over project budget Schedule slippage Key objectives not met

Incident leading >25 per cent over project budget Schedule slippage Key objectives not met

Personal Identifiable Data (SI)**

Damage to an individual’s reputation. Possible media interest e.g. celebrity involved Potentially serious breach. Less than 5 people affected or risk assessed as low e.g. files were encrypted

Damage to a team’s reputation. Some local media interest that may not go public Serious potential breach & risk assessed high e.g. unencrypted clinical records lost. Up to 20 people affected

Damage to a service reputation. Low key local media coverage Serious breach of confidentiality e.g. up to 100 people affected

Damage to an organisations reputation. Local media coverage Serious breach with either particular sensitivity e.g. sexual health details or up to 1000 people affected

Damage to NHS reputation. National media coverage Serious breach with potential for ID theft or over 1000 people affected


Four example severity indicators are provided above, including: patient/staff/public safety; reputation; business objectives; and personal identifiable data (SI) **. As noted for likelihood indicators, the availability of alternative severity indicators permits flexibility in the judgement of the impact of a risk event on the CCG. More indicators are available and these are all provided both in guidelines designed for all colleagues in engaging in the risk management process, as well as copies attached to each Directorate and Unit Risk Register. **Grading Serious Incident’s (SI’s) relating to Personal Identifiable Data: The definition of a Serious Incident in relation to Personal Identifiable Data may include any incident involving the actual or potential loss of personal information that could lead to identity fraud or have other significant impact on individuals should be considered as serious. This definition applied irrespective of the media involved and includes both loss of electronic media and paper records. A risk severity matrix has been issued by the Department of Health (DoH) Gateway 9571 (February 2008) which includes a range of potential risk severity score from 0-5 inclusive. The adopted risk scoring matrix included in the framework document has a range of 1-5 inclusive. The CCG has amalgamated the two severity matrices into one (see above). It should be noted that any Personal Identifiable Data SI scoring ‘0’ would not be reported to the London Strategic Health Authority – NHS London. A score of ‘0’ would represent: No significant reflection on any individual or body Media interest very unlikely Minor breach of confidentiality Only a single individual affected.

Such incidents attracting a score of ‘0’ would be nonetheless be entered onto the relevant risk register for monitoring purposes and audit. The Incident Reporting Policy (including SI’s should be referred to in such instances as described above).


Appendix I: Risk Appetite Matrix – NHS Southwark CCG


APPENDIX J Southwark Clinical Commissioning Group

INTEGRATED GOVERNANCE AND PERFORMANCE COMMITTEE - TERMS OF REFERENCE

1. Introduction

1.1. The Integrated Governance and Performance Committee (the “Committee”) is

established in accordance with NHS Southwark Clinical Commissioning Group’s (the “CCG’s”) constitution. These terms of reference set out the remit, membership, responsibilities and reporting arrangements of the Committee and shall have effect on it incorporate of the CCG’s constitution.

1.2. The Committee will provide oversight of the activities of the CCG and of

providers in respect of the following areas:

Finance QIPP Performance Quality Safety

1.3. In addition the Committee will assure the effective functioning of the following

areas for both the activities of the CCG and of its main contracted providers. The Committee will form sub-committees, to assist, as required in respect of:

Safeguarding Information Governance Equality and Diversity and the Equality Delivery System

1.4. The Integrated Governance and Performance Committee will act as the

leadership forum for the Board Assurance Framework and the corporate risk registers.

1.5. The Committee will act as the quality committee for the borough. Within this the

Integrated Governance and Performance Committee will operate as the designated committee for issues relating to the quality of commissioned care to be reviewed and acted upon.

1.6. Working through the CCG senior management team, the Committee will play

an active role in shaping and responding to the agenda of Southwark’s Localities in relation to matters that fall within its remit.

2. Committee Membership 2.1 The membership of the Committee is below:

a. CCG Lay Member from the Governing Body – Committee Chair


b. Chief Officer, Southwark CCG – Committee vice-Chair c. GP Representative from the Governing Body (Finance) d. Three other GP Representatives from the Governing Body e. Chief Financial Officer, Southwark CCG f. Director of Client Group Commissioning, Southwark CCG g. Director of Service Redesign, Southwark CCG h. Head of Performance, Planning & QIPP, Southwark CCG i. Head of Organisational Development & Governance, Southwark CCG j. Member of Health Watch

2.2 The Integrated Governance & Performance Committee will be supported by:

a. Corporate Governance Manager, Southwark CCG 3. Duties 3.1. The over-arching duty of the Committee is to act to oversee governance in a

way that is truly integrated: where all aspects of commissioning and provider activities are scrutinised using an approach that considers finance, quality, safety and performance together.

3.2. To oversee the integrated governance of the CCG and give assurance to the

Governing Body that actions and plans put in place by the CCG are appropriate, adequate and followed through as planned.

3.3. Act as an advisory forum to enable the Governing Body to manage the

performance, QIPP delivery, safety and quality of the major acute, community and mental health providers.

3.4. Enable the Governing Body and the Chief Officer to effectively perform their

roles through consideration and review of the CCG’s position with respect to performance, finance, quality and safety.

3.5. Oversee the procedures for identifying, investigating and learning from serious

incidents and for safeguarding children and vulnerable adults. 3.6. Operate with responsibility for investigation and formal closure of serious

incidents on behalf of the CCG. 3.7. Receive reports on the activities of the CCG’s strategic programme boards:

a. Lambeth & Southwark Planned Care Board b. Lambeth & Southwark Unscheduled Care Board c. Mental Health Programme Board d. Southwark Staying Healthy & Prevention Programme Board e. Lambeth & Southwark Medicines Management Programme Board f. KHP Integrated Care Pilot Programme Board


3.8. To receive annual reports covering aspects of integrated governance (including information governance), consider them and make recommendations in respect of them to the Governing Body.

3.9. Consider changes to the constitution and governance structure and recommend

appropriate changes to the Governing Body for its consideration; prior to the Governing Body submitting them to the Council of Members for consideration.

4. Remit and Responsibilities

The Committee will operate with responsibility to:

4.1. Act as the formal committee of the Governing Body responsible for monitoring

all aspects of finance, performance and quality assurance. 4.2. Review the CCG’s position against key performance, quality and safety and

financial metrics and recommend action to the Governing Body where the Committee believes appropriate mitigating steps are not in place.

5. Delegated Responsibilities 5.1. The Committee will operate with delegated responsibility to take decisions in

relation to the below stated areas and has delegated authority to form sub-committees.

5.2. Agree CCG action plans to address areas of sub-optimal performance, financial variance or projected QIPP shortfall.

5.3. Approve non-recurrent investments in support of the above to a maximum value of £50,000

5.4. Act with delegated authority from the Governing Body to take decisions on its behalf in relation to specific programmes as directed by the Governing Body.

5.5. Develop and maintain a dispute resolution policy for dealing with disputes

between CCG members. The policy shall contain the ability for disputes to be escalated to the Chair of the Governing Body, the Chief Officer and ultimately to an independent mediator.

6. CCG Assurance 6.1 Assure the Governing Body that there are robust procedures in place to enable

the CCG to deliver:

a. Effective management of finances and financial performance against contracts.

b. Assurance of safety and quality of local services. c. Assurance that national performance targets are being met. d. Recovery plans when finances, quality or performance is off track. e. The effective discharge of duties in regard to safeguarding; equality

delivery system and information governance.


6.2 Receive regular performance and delivery progress reports from the Finance &

QIPP Performance Sub-Committee. The Committee will act to provide oversight of the extent to which projected benefits are being achieved and will assure themselves that the application of any proposed action or recovery plans are sufficient to address identified variance.

6.3 Assure itself that the six strategic programme boards are operating to deliver

agreed service change and are working with commissioned providers and partner to achieve optimal levels of performance across all areas of integrated governance and performance.

6.4 Instruct its Finance & QIPP Performance Sub-Committee to review in detail

matters relating to the CCG’s financial and QIPP performance. The CCG will also instruct the Finance & QIPP Performance Sub-Committee to develop contingency measures and mitigating actions to support full delivery of QIPP.

6.5 Receive appraisals of the current and forecast year end financial position and

position against the QIPP Plan from the Finance & QIPP & Performance sub-committee. This will include plans for mitigating or remedial actions where variance is identified. The Committee should report this to the Governing Body.

6.6 To receive the Board Assurance Framework (“BAF”), corporate and directorate

risk registers and assure itself that mitigations are sufficient. 6.7 To ensure that any issues relating to financial probity or emergent financial

risks are brought to the attention of the Governing Body and Audit Committee.

6.8 To receive, consider and provide formal comment to the Governing Body on the following:

Annual Quality Accounts Controlled Drugs Annual Report Reports on Serious Incidents (SIs) as applicable Patient Experience and Complains Reports Statement of Internal Control / Annual Governance Statement

7. Provider Assurance (Finance, Performance, Quality and Safety) 7.1. To review providers’ performance against key quality and safety measures

and gain assurance that the exceptions are being managed in an adequate way by the appropriate organisation.

7.2. To review the key quality issues identified by clinical leads within each provider

and assure that action is taken. Escalate any concerns or issues to the Governing Body if required.

7.3. To assure the Governing Body that there are robust procedures in place with

providers for the effective management of clinical incidents, for managing infection control, for safeguarding children, young people and vulnerable adults and for the safe and effective prescribing and management of medicines.


7.4. To review the providers’ positions against key performance metrics and

undertake enhanced scrutiny and remedial action planning for any consistently low performing areas.

7.5. To monitor the financial position of major providers, using exception based

reporting to provide scrutiny for any consistently low performing areas. 8 Accountability and relationship with the CCG Governing Body 8.1. The Committee will operate with the delegated responsibility for decision

making from the Governing Body stated in paragraph 4.3 above. The Integrated Governance and Performance Committee will additionally act to undertake an advisory function where decisions may only be taken by the Governing Body. The Committee’s remit determines that it:

a. Operates as a Committee of the CCG Governing Body b. Is instructed by the Governing Body to review in detail matters relating to

the CCG’s financial, QIPP, performance, quality and safety and to coordinate mitigating actions instructing sub-committees to act on its behalf where it deems this appropriate.

c. Acts as an advisory Committee in relation to all aspects of the finance, QIPP, performance, quality and safety.

d. Acts to recommend changes to the CCG’s constitution and governance structure to the Governing Body for its consideration.

8.2 The Committee’s meetings will focus on:

a. Integrated commissioning performance (quality and safety, performance, finance and delivery) within Southwark CCG.

b. Integrated provider performance (quality, safety, performance, finance and QIPP delivery) for Guy’s and St Thomas’ (including Community Services), King’s College Hospital and South London and the Maudsley Foundation Trusts.

c. Issues (including quality) which are brought to the Committee as having the potential to impact on the CCG.

d. Assuring itself that the 6 strategic programme boards are delivering against their agreed annual business and QIPP plans.

9. Sub-Committee 9.1 The Committee will operate with the following sub-committees:

9.1.1 Finance & QIPP Performance sub-Committee 9.1.2 Southwark Safeguarding Executive.

9.2 The Committee will instruct the Finance and QIPP Performance Sub-

Committee to review in detail matters relating to CCG’s financial and QIPP performance and to coordinate mitigating actions with CCG officers on its behalf.


9.3 The Committee will instruct the Southwark Safeguarding Executive – as the appropriate local multi-agency forum – to act as the designated sub-committee responsible for all matters relating to safeguarding in the CCG Area. The Committee will receive reports from the Southwark Safeguarding Executive sub-committee once a quarter and will consider and act, or make recommendations upon them to the Governing Body as appropriate.

10. Reporting arrangements 10.1 The Committee will report on its activities to the Governing Body on a monthly

basis. 10.2 The Committee will produce an annual statement to the Governing Body,

which will set out its key activities over the preceding year. The minutes of the Committee meetings shall be formally recorded and submitted to the Governing Body and will be made publically available on the CCG’s Website.

10.3 Recommendations and issues arising from the work of the Committee will be

reported to the Governing Body as required. 10.4 The Committee will receive an annual work plan from each of the six strategic

programme boards. The Committee will receive status reports including actions, risks and mitigations relating to performance against the agreed work plan.

10.5 The Committee will receive minutes of Locality meetings. 10.6 The Committee will receive minutes from its Finance & QIPP Performance

Sub-Committee. 10.7 The Committee will receive minutes from Southwark Safeguarding Executive.

11 Quorum rules 11.1 The quorum of the Committee is eight members. 11.2 To be quorate the Committee must include

a. at least two GP Representatives from the Governing Body and b. either the Chief Officer or the Chief Financial Officer and c. at least one other CCG Director.

11.3 Members of the Committee will be expected to attend all meetings and, other

than its GP Representatives and the Lay Member, will nominate a deputy as proxy in the event that they are unable to attend.

11.4 The Committee may request support from appropriate members of the Public

Health, the CCG Management Team and senior managers at the South London Commissioning Support Service, as required.


12 Secretary 12.1 The Committee Secretary will be appointed from the CCG Administration Team

and will be responsible for completing minutes of Committee meetings, which will be approved and signed by the Chair or vice-Chair within one week of the relevant meeting.

13 Frequency of meetings 13.1 The Committee will meet monthly. The timing of meetings will be scheduled to

synchronise with the availability of the South London CSS Integrated Performance Report, the Finance & QIPP Performance Committee and the CCG Governing Body so timely information and reporting are available.

13.2 Meetings will last for two hours thirty minutes.

14 Monitoring adherence to the ToR 14.1 The Chair of the Committee will be responsible for ensuring the Committee

abides by these terms of reference.

15 Review 15.1 These terms of reference will be reviewed after six months from April 2013.


APPENDIX K – AUDIT COMMITTEE – TERMS OF REFERENCE

1. Introduction

a. The Audit Committee (the “Committee”) is established in accordance with NHS Southwark Clinical Commissioning Group’s (the “CCG’s”) constitution, Standing Orders and Scheme of Reservation and Delegation. These terms of reference set out the membership, remit, responsibilities and reporting arrangements of the Committee and shall have effect as if incorporated into the constitution. The Committee’s terms of reference are set out below and can only be amended with the approval of the CCG’s Governing Body (the “Governing Body”).

b. The Committee is authorised by the Governing Body to investigate any activity within its terms of reference. It is authorised to seek any information it requires from any employee of the CCG and all employees are directed to cooperate with any request made by the Committee.

c. The Committee is authorised by the Governing Body to obtain outside legal or other independent professional advice and to secure the attendance of individuals and authorities from outside the CCG with relevant experience and expertise if it considers this necessary.

d. The committee will undertake its role with reference to good governance practice, and the seven Nolan Principles for Standards in Public life.

2. Membership

a. The Committee will be appointed by and from members of the Governing Body

and be composed of 3 lay members, and 2 clinical members. One of the lay members will be appointed as the Chair of the Audit Committee and will be the lead on CCG Governance matters. At least one member of the Audit Committee should have significant, recent and relevant financial experience.

b. A quorum will be two lay members and one GP Representative. The Chair of the Governing Body will not be a member of the Committee.

c. Members of the Committee should make every effort to attend all meetings of the Committee and will be required to provide an explanation to the Chair of the Committee if they fail to attend two meetings in a calendar year. If a member fails to attend more than two meetings in a calendar year the Chair of the Committee will consider the appropriate action to be taken, including the option of recommending to the Governing Body the removal of the member from the Committee. The Committee Secretary will monitor attendance by members and report this to the Chair of the Committee on a regular basis.

d. Other officers may also be in attendance at meetings of the Committee, these may include:

The Chief Financial Officer,

Other senior CCG staff as required by the Committee,

Internal auditors,


External auditors,

Counter Fraud service.

3. Duties

a. The Audit Committee will assist the Governing Body with its oversight

responsibilities and will independently and objectively monitor, review and report to the Governing Body on the processes of governance used by the CCG and, where appropriate, facilitate and support through its independence the attainment of effective processes.

b. In fulfilling its responsibilities, the Committee will be supported by the Governing Body’s Integrated Governance Committee which will have a specific focus on the quality of services commissioned by the CCG, and the governance, risk management and internal control systems to ensure that the CCG commissions safe, high quality, patient-centred care.

4. Remit and Responsibilities

a. The Committee undertakes its duties in line with an established annual work plan. The responsibilities of the Committee can be categorised as follows:

Governance, Risk Management and Internal Control b. The Committee shall have overview of the governance and financial activities of

the CCG to ensure that standards and quality of services are maintained within the organisation.

c. The Committee shall review the establishment and maintenance of an effective system of integrated governance, risk management and internal control, across the whole of the CCG’s activities (both clinical and non-clinical), both commissioning and provision of services, which supports the achievement of the CCG’s objectives.

In particular, the Committee will review the adequacy of:

all risk and control related disclosure statements (in particular the Statement on Internal Control together with any accompanying Head of Internal Audit Opinion, external audit opinion or other appropriate independent assurances, prior to endorsement by the Governing Body;

the underlying assurance processes that indicate the degree of the achievement of corporate objectives, the effectiveness of the management of principal risks and the appropriateness of the above disclosure statements;

the policies for ensuring compliance with relevant regulatory, legal and code of conduct requirements;

the policies and procedures for all work related to fraud and corruption as set out in Secretary of State for Health Directions and as required by the Counter Fraud and Security Management Service.

d. In carrying out this work the Committee will primarily utilise the work of internal audit, external audit and other assurance functions, but will not be limited to


these audit functions. It will also seek reports and assurances from directors and managers as appropriate, concentrating on the overarching systems of integrated governance, risk management and internal control, together with indicators of their effectiveness.

Internal Audit e. The Committee shall ensure that there is an effective internal audit function

established by management that meets mandatory NHS Internal Audit Standards and provides appropriate independent assurance to the Committee, Chief Officer and Governing Body. This will be achieved by:

consideration of the provision of the internal audit service, the cost of the audit and any questions of resignation and dismissal;

review and approval of the internal audit strategy, operational plan and more detailed programme of work, ensuring that this is consistent with the audit needs of the organisation as identified in the Assurance Framework and risk map;

consideration of the major findings of internal audit work (and management’s response),and ensure co-ordination between the internal and external auditors to optimise audit resources;

reviewing and monitoring management’s responsiveness to auditor’s findings and recommendations, assuring itself that the management of the CCG have implemented the agreed recommendations of internal audit reports in a timely and effective manner;

ensuring that the internal audit function is adequately resourced and has appropriate standing within the organisation; and

undertaking an annual review of the effectiveness of internal audit.

External Audit f. The Committee shall review the work and findings of the external auditor

appointed by the Audit Commission, or its successor, and consider the implications and management’s responses to their work. This will be achieved by:

consideration of the appointment and performance of the external auditor, by the Audit Commission or its successor;

discussion and agreement with the external auditor, before the audit commences, of the nature and scope of the audit as set out in the CCG’s commissioning plan, and ensure coordination, as appropriate, with other external auditors in the local health economy;

discussion with the external auditors of their local evaluation of audit risks and assessment of the CCG and associated impact on the audit fee;

review all external audit reports, including agreement of the annual audit letter before submission to the Governing Body and any work carried outside the annual audit plan; and

assuring itself that the management of the CCG have implemented agreed recommendations of external audit in a timely and effective manner.


Counter Fraud & Security Management Services g. The Committee will seek assurance from the NHS Counter Fraud and Security

Management team that effective measures are in place that meet NHS and CFSMS requirements. This will be achieved by:

consideration of the provision of the counter fraud and security management services, the cost of these services and any questions of resignation and dismissal;

review and approval of the annual Counter Fraud and Security Management plans ensuring that these are consistent with the needs of the organisation;

ensure management’s co-operation with counter fraud and security management services;

to review the undertakings of counter fraud and security management services, ensuring that effective proactive work is undertaken and any investigation outcomes are appropriately managed in line with the aims of the CCG;

ensuring that counter fraud and security management services are adequately resourced and have appropriate standing within the organisation; and

undertake an annual review of the effectiveness of counter fraud and security management services

Other Assurance Functions h. The Committee shall review the findings of other significant assurance

functions, both internal and external to the organisation, and consider the implications to the governance of the organisation.

i. These will include, but will not be limited to, any reviews by Department of Health Arms Length Bodies or Regulators/Inspectors (e.g. Care Quality Commission, NHS Litigation Authority, etc.), professional bodies with responsibility for the performance of staff or functions (e.g. Royal Colleges, accreditation bodies, etc.).

j. In addition, the Committee will review the work of other committees within the organisation, whose work can provide relevant assurance to the Committee’s own scope of work.

Management k. The Committee shall request and review reports and positive assurances from

directors and managers on the overall arrangements for governance, risk management and internal control.

l. They may also request specific reports from individual functions within the organisation (e.g. clinical audit) as they may be appropriate to the overall arrangements.

Financial Reporting m. The Committee will review the CCG’s annual report and financial statements

before submission to the Governing Body, focusing particularly on:


the wording in the statement on internal control and other disclosures relevant to the terms of reference of the Committee;

changes in, and compliance with, accounting policies and practices;

unadjusted mis-statements in the financial statements;

major judgemental areas; and

significant adjustments resulting from the audit.

n. The Committee will also ensure that the systems for financial reporting to the Governing Body, including those of budgetary control, are subject to review as to completeness and accuracy of the information provided to the Governing Body.

5. Reporting

a. The minutes of Committee meetings should be formally recorded and submitted

to the Governing Body. The Chair of the Committee should draw to the attention of the Governing Body, any issues that require disclosure or require executive action.

b. The Committee will report to the Governing Body annually on its work. Such a report should specifically include:

a summary of the role of the Committee;

the names of all members of the Committee during the period;

the number of Committee meetings and attendance by each member; and

the manner in which the Committee has discharged its responsibilities.

6. Policy and Best Practice

a. The Committee will operate within CCG local policies where these relate to the discharge of its functions.

b. The Committee will operate in accordance with Department of Health guidance and national policy requirements.

7. Conduct of the Committee

a. The Committee will abide by the CCG standards of conduct. Compliance will

be overseen by the Chair of the Committee. b. Committee members will be required to declare any interests they may have in

accordance with the CCG’s Conflict of Interest Policy. c. The Committee agrees to enact its responsibilities as set out in these terms of

reference in accordance with the Nolan Principles for Standards in Public Life.

8. Quorum rules a. To be quorate, membership present must include two Lay Members, and the

Lead GP for Finance (or their deputy portfolio holder). b. The Committee will be supported by appropriate officers of the Southwark

Clinical Commissioning Group as required.


9. Secretary a. The Secretary will be allocated from the Southwark Administration Team. b. The secretary will be responsible for completing draft Committee minutes,

which are signed-off by the Chair or vice-Chair within one week of the meeting.

10. Frequency of Meetings and Attendance

a. Meetings should be held not less than three times a year (to coincide with key dates in the CCG’s financial reporting cycle). The external auditor or Head of Internal Audit may request a meeting at any time if they consider that one is necessary.

b. Governing Body members, or any other individual deemed appropriate by the Committee, should be invited to attend for specific items for which they have responsibility.

c. The Chief Officer should be invited to attend, at least annually, to discuss with the Committee the process for assurance that supports the Annual Governance Statement.

d. There should be at least one meeting a year, or part thereof, where the Committee meets the internal or external auditors without executive board members present. This need not be the same meeting.

e. The Governing Body member with responsibility for corporate affairs will ensure that the CCG provides a Secretary to the Committee and appropriate support to the Chair and committee members. This should include agreement of the agenda with the Chair and attendees, collation of papers, taking the minutes and keeping a record of matters arising and issues to be carried forward and advising the Committee on pertinent areas.

11. Monitoring Adherence to these Terms of Reference

a. The Chair of the committee will be responsible for ensuring that the Committee abides by these terms of reference.

12. Review

a. These terms of reference should be reviewed by the Committee and approved

by the CCG Governing Body at least annually.

b. Any changes to the Audit Committee handbook, issued by the Department of Health, will necessitate an earlier review, to ensure continued compliance.

The best p

Natioin theGuidan FollowiNationaNHS foexpecteReview The NQexistingeffectiv The NQparticufailings100% fcrucial ensurequality

National

possible health

onal Que NHS –nce Docum

ng events al Quality Bor safeguared to unde

w of Early W

QB emphag roles, resvely throug

QB is confilar the role

s in patient failsafe, pathat the ovs provisionof care at

Quality Boa

outcomes for S

ality Bo– Summment (Prese

at mid-StaBoard (NQrding qualierstand theWarning Sy

sises that sponsibilitiehout this p

dent that bes and resp

care. Thatarticularly inverall systen of servicethe failing

ard (2010) Re

Southwark peo

A

oard’s Rmary and

ented to IG

affordshire QB) to revie

ty and preve report andystems and

it is cruciaes and staperiod of ch

by operatioponsibilitiet said, the n one as cem is able es to the porganisati

eview of Earl

ople

Appendix

Review od RelevGG Sept 20

NHS FT tew the systventing sed take it ind its applic

lly importatutory dutiehange.

onally imples will ensuNQB does

complex asto respondopulation aon.

ly Warning S

L

of Earlyance to

011)

he Secretatems and p

erious failurto account

cability to S

ant during tes must be

ementing iure earlier is recognises the NHS. d in a way and secure

Systems in th

y Warnino Southw

ary of Stateprocesses res. All part. This papSouthwark

he transitioe discharge

ts recommidentificatioe that no syIn such cithat safeg

es rapid im

he NHS.

53 | P a g e

ng Systwark CC

e asked thin place in

rts of the Nper summa

CCG.

on to remeed fully an

mendationson of potenystem canrcumstancuards pati

mprovemen

tems CG

e n the NHS are rises the

ember d

s, in ntial be

ces it is ents,

nts in the


1. Quality at the heart of everything we do The most important constant that needs to bind the system together through the period of change ahead is the continued focus on quality as the primary purpose or ‘organising principle’ of everything the NHS does. The definition of quality remains constant – effectiveness, safety and patient experience. Importantly, quality is only achieved if all three of these domains are delivered. The NQB recognises that the pressures on staff working right across the system will be significant during the transition. Throughout this period, it will therefore be critical to make sure that a focus on quality guides every move and decision made. 2. Roles and responsibilities throughout the system The statutory functions, responsibilities and accountabilities of existing organisations remain firmly in place during the transition. They are outlined below. In addition to meeting these roles and responsibilities, all NHS organisations must meet the duties within the Equality Act 2010 and public sector duties. The Figure below schematically sets out the organisational tiers in the NHS and how they interact in respect of safeguarding quality.

The best p

possible health outcomes for SSouthwark peoople

55 | P a g e

The best p

2 (a) O

National

2 (b) C

possible health

Overview

Quality Boa

CCG role

outcomes for S

w of Roles

ard (2010) Re

es and res

Southwark peo

s and Res

eview of Earl

sponsibili

ople

sponsibili

ly Warning S

ities

ities

Systems in th

he NHS.

56 | P a g e


CCGs should be striving to commission innovative, effective high quality care that meets the needs of their local populations. They have a duty to secure continuous quality improvement, in doing so the CCG must have regard to any national standards set such as NICE Quality Standards. CCGs must ensure that they have robust contract monitoring arrangements in place including: clear performance measures and reporting cycles, fit-for-purpose data monitoring systems and regular contract performance meetings. While it is the CQC’s responsibility to make judgements on whether a provider is compliant with registration requirements, the CCG should be able to identify signs of non-compliance at an early stage and should inform the provider and the CQC as appropriate. It is important to recognise that systems and processes alone are not enough to safeguard quality. CCGs should be developing a culture of open and honest co-operation within and between organisations that provide services to their populations. They also need to work collaboratively with SHAs and regulatory bodies to understand and share information on risk through formal and informal mechanisms. Every CCG should have a process for reporting all serious incidents to the CCG Board and have plans for recording ‘Never Events’ in its annual reporting arrangements. It also has a role in working with providers to commission independent investigations if there is a need to do so. The CCG should carry out regular thematic reviews of serious incidents to identify trends and patters across the CCG. In the event of a serious incident, CCGs must ensure continued provision of services to the population and secure rapid improvements in the quality of care at the failing organisation. It is essential for commissioners to utilise intelligence from patients and the public about the services they commission. In addition, CCGs have a duty to publish an annual report detailing how public consultations have influenced their commissioning decisions. 3. Values and behaviours that put patients first: a culture of open and honest co-operation Throughout the transition, the values and behaviours of all those working in the NHS need to remain squarely focussed on putting patients first. An organisation that is truly putting patients first will be one that embraces and nurtures a culture of open and honest cooperation. “Patients, users and carers are the reason for the NHS existing… and as such must be at the centre of all that the NHS and its staff do.”


It is important to work collaboratively across the whole system rather than organisations working in silos. CCGs and SHAs are expected to show leadership in this area. A cultu re of open & honest cooperation � extract from NQB February 2010 report What does a culture of open and honest cooperation look like or mean for the NHS? Healthcare professionals and all NHS frontline staff feel able to raise concerns about the quality of care at an early stage. Clinical teams understanding the quality of service they are providing to patients through routinely measuring and benchmarking their performance with peers across the three dimensions of quality – safety, effectiveness, patient experience. Provider boards see their fundamental role as ensuring high quality care for patients. System managers (CCGs and SHAs) and regulators (CQC and Monitor) work together to share information and intelligence on risk; be seen as a source of advice and support in the event of concerns being raised; and visibly work together to support improvement where potential or actual failures in the quality of care being provided to patients are identified. All parts of the system are actively listening to and proactively engaging with patients and the public to understand concerns. 4. How does NHS Southwark CCG align with the recommendations?

Robust contract monitoring arrangements: quality monitoring embedded into contract processes including CQUINs and provider’s Quality Accounts, hold regular contract monitoring meetings and quality meetings with all main providers.

Incident reporting systems and policy. Incidents reported to the National Reporting and Learning System via Datix and trends analysed. Incidents analysed for themes and reported to the Integrated Governance Group.

Serious Incident policy and processes follow NPSA and NHS London policies: Reported using STEIS system, CCG will lead investigations as appropriate; reported to LCCC via Integrated Governance Group, reported to NHS SEL Cluster via the Quality & Safety Committee. CCG commissions time from Medical & Nursing Directors as appropriate for investigations.

Safeguarding arrangements and systems for both adults and children

Round table meetings with Kings to discuss Kings’ SI’s including monitoring of Never Events.

Corporate Risk Management: Board Assurance Framework, Identification and managing risks of the Transition, Risk Register. Regular reporting on risk and BAF to the Integrated Governance Group.


Annual report of patient experience, Patient & public committee,

Listening and engaging with patients: complaints, PALs, consultation events, AGM.

Pilot for GP revalidation (responsibility now with cluster) & GP appraisal system

Other key policies include: Being Open policy, Investigating incidents, complaints and claims, Learning Lessons policy, Management and analysis of information arising from incidents and complaints, Whistleblowing policy

Collaborative working arrangements with partners, (e.g. memorandum of understanding with Southwark Council ). Development of Health & Well Being Boards.

Issues of Concern and Primary Care Decision Making Panel at NHS SEL Cluster for dealing with issues of concern raised against GPs and nursing staff. Primary Care Performance Reports via cluster Quality & Safety Committee.

Key issues to consider further or keep under review Continue to share intelligence of risks with CQC and Monitor, as necessary

Ensure collaborative working arrangements with partners continue to work well, e.g. providers, council, cluster. In particular, ensure full matrix working with cluster.

Embed NICE Quality Standards into current pathways where available and identify systems for utilising other Quality Standards.

Implement the Equality Delivery System

Finalise the NHS SE London serious incident policy and agree local management arrangements of Serious Incidents.

Ensure clear communication channels on Issues of Concern and continued reporting of issues of concern to the NHSCB

Appendix 1 - Key enhancements to the system since the failures at Mid Staffordshire NHS FT

CQC’s system of regulation through registration of all providers by 2013. This includes their Quality and Risk Profiles for all registered providers, available to commissioners;

CCGs duty to secure continuous quality improvement, In doing so the CCG must have regard to any national standards set such as the NHS Performance Framework and NICE Quality Standards;

Quality Accounts for Providers;

National NHS Performance framework;

Revalidation for doctors;

CQUINs;

NHS Constitution where the NHS makes commitments to the public to continuously drive quality improvement;

NQB’s publication ‘Quality governance in the NHS - A guide for provider boards’


Appendix M - NHS Southwark CCG Governance Structures

southwark clinical commissioning group integrated risk ......nhs southwark ccg believes that good...

Documents