Comment / Internal audit: at the heart of system success

The change to the integrated care board (ICB) establishment date to 1 July 2022 provided a number of challenges for clinical commissioning group internal audit providers. These included the need to provide sufficient coverage across the internal control, risk management and governance framework, in a short period of time to deliver a head of internal audit opinion. 

The due diligence guidance and checklist issued by NHS England was a key reference point, including consideration of the key risks associated with cessation and the adequacy of transition plans. At internal audit specialist MIAA, this process was undertaken for 27 CCGs and one shared service organisation, so overall it was quite a challenge! 

A key element of our approach was to develop an internal audit and anti-fraud ICB handover document. This brought together the recommendations from previous internal audit and anti-fraud reviews to be transferred to the ICB, details of investigations and referrals transferring, and also the position relating to significant risks remaining on CCG governing body assurance frameworks at the point of transfer.   

This legacy position is a key element of the ICB internal audit plan, as ICB audit committees seek assurance on the progress of internal audit recommendations that have been transferred from demised organisations together with assurance on the management on legacy risks. 

The development of the ICB internal audit plan was a key element of NHS England’s due diligence checklist. It is important that this plan reflects the change in strategic objectives and direction from CCGs to ICB and that an assessment of the ICB’s risk profile is undertaken. 

Assurances need to be built around the ICB risks. The risk assessment should also consider what core and mandated assurances are required, national and regional risk areas, place-based developments and the ICB’s strategic risks – together with the requirements of the Public Sector internal audit standards.   

NHS England has mandated an internal audit review of ICB financial controls, which is based upon the HFMA’s checklist: Improving NHS financial sustainability: are you getting the basics right? This review is focused on core financial controls and what should be in place to provide assurance to the ICB audit committee on its financial sustainability.   

National and regional risk areas will include areas such as contract management, continuing healthcare, serious incident management oversight, population health management and the quality governance framework. The risk assessment and planning process undertaken by internal auditors will determine the prioritisation of these areas for review within the internal audit plan. 

The internal audit risk assessment will also need to consider the assurance requirements at place and the need for internal audit focus at place level, providing assurance for place boards and the ICB as a whole. 

It is evident that governance remains a key priority area for internal audit focus, particularly relating to board development, committee structures and their effectiveness, conflicts of interests and the development of the ICB assurance framework. Assurances will be required on the operating effectiveness of the governance framework and internal auditors should consider a phased approach to their reviews, as systems and processes are designed and embedded.   

There also needs to be consideration of wider system assurances, including assurances from provider collaboratives and partner organisations. 

Ultimately, in this first year of ICB operation, the internal audit plan needs to remain flexible to allow for responses to emerging challenges that the ICB may face. At the same time, it must remain focused on delivering the head of internal audit opinion to meet the requirements of the Public sector internal audit standards and supporting the ICB’s reporting requirements. There will need to be an ongoing risk assessment process to ensure that the internal audit plan remains focused on the ICB’s key risks and challenges and continues to add value.

Ms Cobain is a member of the HFMA Governance and Audit Committee