Comment / Financial sustainability – lessons from the checklist audit

It was clear that internal auditors needed to take a consistent approach to support sharing of best practice and lessons learnt. This was essential both following the initial submission of the self-assessment and then following the internal audit reviews. As such, The Internal Audit Network (TIAN) – a network of NHS-based internal audit providers – worked collectively, providing feedback to NHS England on the proposed approach for the internal audit, which was then adopted across all its providers’ clients. 

The first milestone in the process was the submission of the self-assessments in September 2022 and TIAN undertook a benchmarking exercise based upon the self-assessments of the 103 TIAN organisations.  This identified clear differences across the scoring, with integrated care boards scoring themselves lowest, while ambulance and acute providers scored themselves highest on average.  Average scores across the 72 checklist questions ranged from 2.85 to 4.76, with higher scores in the finance governance framework theme and lower scores in the cost improvement and efficiency plan theme.

The second milestone was the completion of the internal audit reviews (November 2022). MIAA worked collectively with 360 Assurance, collating the audit results across their clients.  The reviews highlighted areas of good practice, such as: organisations using the self-assessment as a development exercise and an opportunity to stocktake against financial controls and governance; the adoption of a team approach to complete the exercise; strong oversight from the audit committee; and taking the opportunity to benchmark across peers.

Both MIAA and 360 Assurance found that the significant majority of organisations’ self-assessments against the NHS England mandated areas for internal audit review were deemed to be reasonable. 

The areas which had the most ‘5’ scores, indicating mature arrangements, included board agreement of the annual budget, board reporting and financial governance framework.

Good practice highlighted from the budget agreement included material changes and iterations being reported to the board, showing the assumptions that these were based on.  Other high points inlcuded clear budget setting timetables, which were communicated to budget holders with good lead times, and detailed assurance reports from finance committees to the board. 

For the mandated question relating to board reporting and the capture of financial risks, good practice included:

• having a dedicated agenda item for financial risks at risk management committees
• recording a range of financial risks on risk registers
• providing clarity on the escalation process for financial risks when the risk score exceeded an agreed level
• showing evidence of discussion and update of risks and actions.

There was strong evidence submitted in relation to independent assurance of financial governance arrangements.  This included regular reporting to audit committees of internal and external audit actions. Good practice organisations also reviewed and reported non-purchase order spend – and whether it was in line with agreed expectations –  and standing financial instruction breaches through the audit committee. Further good practice saw internal audit being used as third-line assurance with a programme of reviews to assess compliance of first- and second-line assurances and use of a monthly financial governance checklist to assess compliance with financial governance arrangements.

One of the key themes throughout the process has been the role of the audit committee and, in the higher scoring submissions, there was demonstrable evidence of audit committee oversight.  Challenge questions for audit committees include:

• did the audit committee have sufficient oversight of the assessment process?
• is the audit committee assured that the actions identified both as part of the self-assessment and internal audit are being progressed?
• did the internal audit review identify any areas for review and development against the scores and the benchmarked scores?
• are there any themes in the checklist where the organisation is scoring lower than the benchmark and where a deep dive could help to improve control arrangements?
• are there any areas where a revisit would be beneficial to ensure controls have improved?

Systems and providers have responded to the self-assessment in different ways – some finding it more useful than others. But there is a good argument for undertaking the exercise on a regular basis. For some this will be a case of confirming that sound controls are in place. But it will also help to show where improvements could be made.

Louise Cobain is executive director of assurance at MIAA. This blog was written in conjunction with Leanne Hawkes (pictured right), managing director, 360 Assurance and chair of TIAN.

Improving NHS financial sustainability: are you getting the basics right?

A TIAN briefing on the audit outcomes can be found here.