16 26 Review of Board Assurance Framework

Transcription

Subject:
Meeting:
Date of Meeting:
Revised Risk Strategy & current BAF
NHS Milton Keynes CCG Board
24.05.2016
Title: Revised Organisational Risk Management Strategy &
current BAF
Agenda Item: 16/26
From: David Killoran, Chief Finance Officer
Jonathan Elwood, Head of Corporate Services
Purpose of Paper:
The purpose of this paper is to seek Board approval for the revised Risk Strategy
Key Issues for the Board to note:
 That the recent internal Audit on Risk Management identified issues with current risk
management process and the way the risk registers and the BAF are structured.
 That the attached revised Risk Strategy incorporates the recommendations of the internal audit
report.
 The revised strategy will be underpinned by use of dedicated software to manage the risk
registers and the BAF. (Capital funding bids have been submitted for the software)
 If the revised strategy is approved the BAF and Corporate (currently Strategic) Risk Register will
be renewed and refreshed for subsequent meetings.
 The revised Strategy gives the Board, and delegates to CDG, more control over how risk is
managed within the CCG.
 The revised Strategy requires that all papers submitted to the Board and its sub-committees
have a cover sheet which sets out key issues within the paper and any risks which have been
identified. (This and the paper on Auditor Procurement are examples of a suggested cover
sheet).
 That the reporting cycle for the BAF will be quarterly (The Board may amend this frequency if
required).
What risks may there be around this topic/what risks have been considered and mitigating action put
in place:
 Non identified
Actions required by the Governing Body:
 To approve the revised risk strategy.
 To note the current BAF and recognise that it will be amended following approval of the revised
Strategy.
 To identify any information not currently within the BAF that the Board would like to see
included in a revised BAF.
Conflicts of Interest:
 No conflicts of interest are currently identified.
Associated Documents:
 Revised Risk Management Strategy
 BAF as at 18 April 2016
 BAF summary sheet
Enc No 16/26
Enc No 16/26
Organisational Risk Management Strategy
2016-18
Author:
JPE
Owner:
Document Status:
Draft v0.1
Date:
15.03.2016
Revision History
Version
number
Date
Reviewer
Change Reference & Summary
0.1
15.03.2016
JPE
First draft
0.2
0.3
1.0
For use in (area)
NHS Milton Keynes CCG
For use by (staff groups)
All staff
For use for (patients/staff/public)
Enc No 16/26
RISK MANAGEMENT STRATEGY
NHS MILTON KEYNES CCG
Contents
1
Risk Management Strategy Statement ..................................................................................................3
2
Introduction ...........................................................................................................................................3
3
Risk Management Overview ..................................................................................................................3
4
Purpose and Objectives of the Risk Management Strategy ..................................................................4
5
NHS Milton Keynes CCG Strategic Plan 2014-16 ...................................................................................5
6
Roles and Responsibilities .....................................................................................................................6
7
NHS Milton Keynes CCG Risk Register ...................................................................................................8
8
Risk Process............................................................................................................................................9
9
Risk Appetite ........................................................................................................................................12
10 Reporting and Assurance .....................................................................................................................13
11 Training ................................................................................................................................................14
12 Appendix A: Risk Management Accountabilities .................................................................................15
Page 2 of 15
Page 2
of 15
Enc No 16/26
1 Risk Management Strategy Statement
This document sets out the overarching strategy for the management of internal and external risk by NHS
Milton Keynes CCG. It provides the framework for the continued development of risk management
processes throughout the organisation and describes levels of accountability, processes and frameworks.
The Risk Management Strategy aims to deliver a pragmatic and effective multidisciplinary approach to risk
management, which is underpinned by a clear accountability structure.
This Risk Management Statement and the effectiveness of the risk strategy will be subject to on-going
review and, where necessary, amendment.
2 Introduction
NHS Milton Keynes Clinical Commissioning Group (MK CCG) is committed to the implementation of a risk
strategy that develops and maintains an open and proactive culture associated with all aspects of risk
management to minimise risks to all its stakeholders through a comprehensive system of internal controls.
This formalised strategy communicates how risk management will be implemented throughout MK CCG
whilst providing potential for flexibility, innovation and best practice of its strategic objectives.
The aim of the risk management process is to provide a systematic and consistent integrated framework
through which MKCCG’s strategic objectives are pursued. This involves the identification of risks; threats and
opportunities, to achieving these objectives and taking steps to mitigate these risks.
Risk management is the responsibility of all staff at the CCG, with risk being embedded into operational
activity and strategy at all levels of the CCG. Risk management underpins the CCG’s objectives and enables
the CCG to prioritise its risks so as to direct resources for managing risks effectively. As part of this the CCG
undertakes to ensure that adequate provision of resources, including financial, personnel and information
technology is, as far as is reasonably practicable, made available.
3 Risk Management Overview
Risk is commonly defined as:
‘an uncertain event, (or set of events) which, should it occur, will have an effect on the achievement
of objectives’
This is described and measured in terms of the ‘likelihood’, i.e. the probability of something happening, and
the extent of the ‘impact’ from the possible consequences. In MKCCG a risk may be looked upon as anything
which has the potential to damage or threaten the achievement of the strategic and operational objectives
or the reputation of the CCG and its work.
3.1
Definitions of terms used:
Term
Definition
Action
Assurance
Measures taken, or to be taken, to prevent, reduce, or transfer the risk.
The information and evidence provided or presented which is intended to
Page 3 of 15
Page 3
of 15
Enc No 16/26
Board Assurance
Framework (BAF)
Control
Corporate risk
Inherent risk
Infrastructure Risk
Programme Risk
Project Risk
Residual Risk score
Risk
Risk appetite
Risk Management
Target Risk Score
induce confidence that a risk is being managed within the rating set.
This refers to the wider systems and processes of governance which are in
place to provide the Board with assurance regarding the achievement of its
strategic objectives. The phrase also refers to the document or report
generated in an attempt to capture these assurances.
The Strategies, Processes & Protocols used to support risk mitigation.
Those risks that, if realised could fundamentally affect the way in which the
CCG exists or commissions services in the next 1-5 years. These risks may
have a detrimental effect on the CCG’s achievement of its key business
objectives.
These risks may lead to material failure, loss or lost opportunity.
The exposure arising from a specific risk before any action has taken place
to manage it.
Those risks that, if realised, could affect the way in which the CCG operates
or commissions services in the next year. This could include failure to
achieve business/organisational objectives due to human error, system
failures and inadequate procedure and controls.
These risks, if realised, will have a detrimental effect on the organisations
key business processes and activities that underpin the delivery of the
CCG’s business objectives.
The risk realisation will lead to material failure, loss or lost opportunity.
Those risks that, if realised, could affect the way in which the CCG operates
or commissions services in the next year.
Risks concerned with transforming high-level strategy into new ways of
working to deliver benefits to MK CCG.
These risks, if realised, will have a detrimental effect on the organisations
key business processes and activities that underpin the delivery of the
CCG’s business objectives.
Those risks that, if realised, could affect the way in which the CCG delivers
the specific project.
The risk realisation could lead to project failure, but more than likely lead to
inefficiency or ineffectiveness in completion of the project.
The risk remaining after the risk controls/mitigations has been applied.
An uncertain event or set of events which, should it occur, will have an
effect on the achievement of objectives (or strategy).
MK CCG’s unique attitude towards risk taking, which in turn dictates the
amount of risk that is considered acceptable.
The systematic application of principles, approach and processes to the
task of identifying and assessing risks, and then planning and
implementing risk responses.
The highest risk deemed acceptable for any particular risk, aligns with the
CCG’s risk appetite.
4 Purpose and Objectives of the Risk Management Strategy
This Risk Management Strategy aims to provide a common framework for risk management within MK CCG to
ensure that all risks are appropriately and systematically assessed, managed, monitored and reviewed.
Page 4 of 15
Page 4
of 15
Enc No 16/26
The task of the organisation is to effectively identify, analyse and respond to these risks so as to maximise
the likelihood of the organisation achieving its vision and in doing so ensure the best use of available
resources.
Within health care some exposure to risks or risk taking may be necessary; however, this must be managed
within a clear risk management methodology that enables:







the facilitation of identification, recording and management of risk at all levels within the CCG,
across all departments and projects;
consistent risk measurement so that risk priorities can be graded using reliable impact and likelihood
scores;
an established risk appetite of the CCG, an understanding of the type of risk and level of risk
exposure that can be tolerated by the MK CCG;
suitability of mitigation and control that is comparable to the level of risk;
appropriate mechanisms to ensure that risks can be escalated to a level of management that can
effectively respond to them;
the on-going monitoring of the effectiveness of mitigation and control; and
the provision of assurance to responsible boards.
The Risk Management Framework should be suitably robust and transparent to support the on-going
business of the organisation whilst being proportionate and reasonable to facilitate innovation in the
commissioning of high quality health care.
5 NHS Milton Keynes CCG Strategic Plan 2016-18
NHS Milton Keynes Clinical Commissioning Group (MK CCG) has delegated responsibility in 2016‐2018 for
commissioning services in excess of £260 million. It has a geographic area of responsibility that covers all the
wards in Milton Keynes Local Authority plus the wards of Great Brickhill and Newton Longville which are in
Aylesbury Vale. Its members are 27 general practices organised into 4 neighbourhood groupings,
geographically based in the north, south, east and west of Milton Keynes. Milton Keynes CCG is largely (95%)
co‐terminus with Milton Keynes Council and has a registered population of c255,000. The CCGs main acute
provider is Milton Keynes Hospital NHS Foundation Trust. Mental Health & Community Services are provided
locally by Central Northwest London NHS Foundation Trust.
The NHS Milton Keynes Strategic Plan sets out the medium to long term aims as being to reduce early deaths
and tackle major diseases, to improve wellbeing and to Reduce Health Inequalities.
The CCG has organised delivery of its strategic approach and commissioning priorities through four
interdependent Clinical Programme Boards, plus the Clinical Executive. It has set out its values/principles
which will underpin its approach to achieving the vision as:‐




Commission services which are value for money
Involve clinical leadership to make a real difference
Improve quality and safety to positively impact on clinical outcomes and patient experience
Develop effective engagement with stakeholders
The CCG is committed to commissioning a greater proportion of activity in community and home settings to
support the required rebalancing of the health economy away from local acute services. This is necessary to
support acute provider sustainability and to ensure that services are delivered in the best location. The CCG
is also looking to understand where other care providers can offer support to the population at least as
Page 5 of 15
Page 5
of 15
Enc No 16/26
effectively as statutory providers. Greater emphasis on prevention and self‐care are important long term
strategies for the CCG. Helping those with long term conditions to take more responsibility for managing
their care and using support networks outside of the NHS are important future options, and are reflected in
the joint Better Care Fund Plan submission that sits alongside this plan. For those requiring on‐going health
and social care it will be important to further strengthen links between the statutory commissioners –
working closely through the Joint Commissioning arrangements.
6 Roles and Responsibilities
All staff members and contractors working for MK CCG have a responsibility to the organisation’s risk
strategy. Particular responsibilities dependent on role are as below.
6.1 Employees (including contractors and temporary staff)
All MK CCG staff are required to report risks they identify as part of their day-to-day work.
Any employee who identifies a risk to themselves or another person is responsible for ensuring that it is
reported through the incident reporting process. Any employee who identifies an immediate or direct risk to
the safety of themselves, a patient or another person has responsibility for managing the immediate situation
until it has been reported to an appropriate manager. All employees are responsible for ensuring that they
attend all training relevant to their role and do not work beyond the level of their competencies.
6.2 Senior Managers
All managers are accountable and empowered to manage the risks within their area of responsibility.
Managers must ensure that all foreseeable risks are identified for their area/s of responsibility and are
recorded on the appropriate MK CCG Risk Register. Where risks cannot be managed within their remit,
Managers must escalate to the next level, or to the more appropriate area for its management, and ensure
that the escalation of the risk is accepted and managed appropriately.
The Risk Registers are dynamic documents and must be kept up to date.
Managers are responsible for ensuring that any staff they manage notify them of risks within their areas of
responsibility, that there are processes in place to manage the risks, and where appropriate discussed at team
meetings.
6.3 Project Managers (PM)
Where staff are acting as project managers for a particular piece of work, it is their responsibility to ensure
that project risks are captured and managed as part of the role. This involves not only maintaining an
accurate log, but also keeping the SRO informed and alerted to any material changes in risk status
Where a risk cannot be managed within the project, the PM must escalate to programme level, and ensure
that the escalation of the risk is accepted and managed by that programme. Please see Appendix B for process
map.
6.4 Programme Managers (PgM)
Staff acting as programme managers are responsible for ensuring that this level of risk is captured and
managed as part of the role. This involves not only maintaining an accurate log, but also keeping the GP
Clinical Lead informed and alerted to any material changes in risk status.
Page 6 of 15
Page 6
of 15
Enc No 16/26
Where a risk cannot be managed within the project, the PgM must escalate to Corporate level, and ensure
that the escalated risk is accepted and managed by the CDG.
6.5 The Programme Management Office (PMO)
The PMO provides advice, guidance, tools and education on all aspects of risk management, particularly to
the Programme Boards. It has a facilitative role in the process of risk management but is the keeper of the
master project risk log, and will ensure that the quality of the log, process and tools meet the needs of the
CCG.
6.6
Corporate Services Manager
The Corporate services Manager will have day to day responsibility for ensuring that the Corporate Risk
Register and the BAF are managed dynamically and reported to the appropriate meetings of the Board and
its sub committees.
6.7 Chief Financial Officer (CFO)
The Chief Financial Officer has overall responsibility for the management of risk within Milton Keynes CCG and
has specific responsibility for risks associated with investment decisions (including capital), and financial
management.
6.8 Chief Officer (CO)
The Chief Officer is accountable to the Board for the management of risk within the organisation. Whilst this
accountability is not delegable, management of this function is delegated to the CFO on a day to day basis.
6.9 Commissioning Delivery Group (CDG)
The purpose of the CDG is to receive and review the Corporate Risk Register, to provide assurance to the CO
and CFO that the risk management strategy and process is being maintained. The CDG will review any new
or existing risk where a rating of 8 or more is reached. The CDG will review the BAF and make
recommendations on individual risks prior to its presentation to Board.
6.10 Audit Committee
The Audit Committee is responsible for commissioning audits of the robustness and effectiveness of the risk
management processes and provides the Board with assurance that risks are being managed appropriately.
The Audit committee will review the Corporate Risk Registers and the BAF.
6.11 Board
The Board is responsible for the performance of the organisation and needs to be simultaneously
entrepreneurial and driving the business forward whilst keeping it under prudent control. It needs to strike a
balance between controls, assurance and strategy, risk-taking and delivery. The Board, therefore, has to rely
on assurances that the constituent parts of the organisation are doing what they need to do and functioning
as they should. The assurances provided to the Board should make them confident about the organisations
current (and potential future) position and strengthen their decision-making. Where the assurances do not
generate confidence about the current position the Board should monitor the perceived weaknesses and seek
further assurances until confidence regarding the current position is achieved and a sound basis for decisionmaking is in place. The Board will review the BAF on a quarterly basis to ensure that they are sighted on all
Page 7 of 15
Page 7
of 15
Enc No 16/26
risks rated high or above and can have confidence in the controls in place to support achievement of strategic
objectives; the actual performance against strategic objectives; and the totality of their risks, as well as how
they impact on the achievement of strategic objectives.
7 NHS Milton Keynes CCG Risk Registers
The CCG’s 3 principle tools for reporting and managing risks are the Governing body Assurance Framework,
The Corporate Risk Register and Directorate/programme/project Risk Logs:
7.1 Governing Body Assurance Framework
The Governing Body Assurance Framework (BAF) is a tool to enable the Governing Body to satisfy itself that
significant risks are being appropriately managed. The MK CCG BAF contains all Corporate risks rated at 12
and above.
The purpose of the BAF is to:






Identify for the Board the main risks to achieving MK CCG’s Corporate objectives;
Assure the Board that the identified risks are being effectively managed;
List and evaluate the mitigations in place to the reduce the likelihood or impact of the risk;
Summarise the actions that further mitigate the likelihood or impact of the risk;
Summarise the controls, assurances and gaps relating to each main risk
Identify the and Target risk scores assigned to each risk.
7.2 Corporate Risk Register
The Corporate Risk Register includes all high level strategic and operational risks (8+) identified as potentially
affecting MK CCG’s corporate objectives. These risks are monitored at Governing Body Committee (CDG and
Audit) level and are identified from Directorate/Service/Project/Programme Risk Logs. These are based on
documented risk assessments and may be linked to incidents, audits, external assessments or other
qualitative information. The Corporate Risk Register is compiled and maintained by the Corporate Services
Team. Strategic risks scoring 12+ will be automatically escalated to the BAF.
7.3 Directorate/Programme/Project Risk Logs
Directorate/Programme/Project Risk Logs provide a local record of all potential or actual risks within the
directorate. Actions to mitigate these risks will be managed by the respective director in conjunction with
the appropriate senior lead. Directorate Risk Registers are compiled and maintained by locally nominated
Service Risk Champions/Co-ordinator. Risks scoring 8+ should be escalated to the Corporate Risk Register
and agreed by a Committee of the Governing Body. Directorate Risk Registers should be maintained and
monitored via Directorate meetings.
The NHS Milton Keynes CCG Risk Register is managed using dedicated risk software (?4Risk?). The software
maintains a dynamic database of all the risks identified within the CCG. It will escalate risks to appropriate
levels and require manager input within the parameters set and approved by the Board.
A risk owner must be identified and named as part of the assessment process. The risk owner must ensure it
is managed dynamically, i.e. actioned, monitored and reviewed, appropriately.
Page 8 of 15
Page 8
of 15
Enc No 16/26
The risk register, or parts thereof, may be subject to a Freedom of Information request. To be meaningful the
risk register may contain sensitive or confidential information and therefore the document should be checked
and referred to the Head of Corporate Services before responding to any such request.
The risk register architecture will be identified once the software is in place [ ].
8 Risk Process
Risk management must be an intrinsic part of any organisation’s operation. In order to facilitate timely and
appropriate capturing and management of risk, any process must be simple to understand and undertake,
and must be meaningful for the stakeholders involved.
There are four primary risk management processes:
 Identification
 Assessment
 Planning
 Implementation
These are carried out in sequence, as one step is dependent on the previous. The entire process will be
repeated several/many times in the lifecycle of an activity.
8.1 Risk Identification and Assessment
A scoring grid is used in order to assess and grade the identified risks, so that the organisation/programme
or project can apply particular controls, and to re-assess the effect of this at periodic intervals. The grid is
described in terms of probability and impact where:
Probability is the evaluated likelihood of a particular threat or opportunity actually happening.
Impact is the estimated severity of that particular threat or opportunity should it occur.
There are a number of ways to respond to a risk, and these will depend on the nature of the risk, and
whether it is a threat or an opportunity. These are:





Treat:
Terminate/Remove
Transfer
Tolerate
Share
introduce a control that results in a reduction of the risk;
change an aspect of the activity that removes the risk;
a third party takes responsibility for the risk;
a conscious decision to retain the threat;
share the risk with others;
8.2 Inherent, Residual Risks & Risk Target
Inherent Risk is the risk identified prior to any controls or mitigation being applied. It could also be termed
gross risk.
Residual Risk is the risk that exists after controls or mitigation are applied. Risk responses, i.e. controls, may
not be fully effective, in that they do not or cannot, remove a risk completely. If the original risk was
significant, and the risk response is only partially successful, the residual risk could be considerable.
Page 9 of 15
Page 9
of 15
Enc No 16/26
In terms of managing and reporting risks, the residual risk shows how effective the controls can be, and what
actions have occurred to ensure they have been applied. Whilst risks of both forms should be kept under
review, it is the residual risk that will provide the most meaningful information to the organisation.
The scoring for the residual risk must reflect the post-control position, i.e. the probability and impact
assuming the controls are effective.
Risk Target is the maximum acceptable score for an individual risk set within the parameters of the CCG’s
Risk Appetite. The Risk Target for each identified risk will be set by the CDG on behalf of the Board
8.3 Criteria for scoring the risk
NHS Milton Keynes CCG has previously agreed the following categories and definitions:
8.3.1 PROBABILITY/LIKELIHOOD
Level
Descriptor
Description
1
Rare
The event is not expected to occur apart from in exceptional
circumstances.
<11%
2
Unlikely
The event might occur at some time.
11%-30%
3
Moderate
The event will occur at some time.
31%-70%
4
Likely
The event will occur in most circumstances.
71%-90%
5
Imminent
The event is certain to occur
>90%
8.3.2 IMPACT
Impacts on an organisational activity should be considered in terms of the organisational objectives, and
therefore the impact on
 Costs
 Timescales
 Quality
 Population Health and Wellbeing
 Injury – Physical and Psychological
 Patient/Public satisfaction
 Reputation
 Compliance
The range selected for each band should suit the programme, project or operation being conducted, and
reflect the business sensitivity in terms of the objectives. It is important the same range be applied across a
risk log worksheet to show consistency and equitable assessment. See Roles and Responsibilities above.
Page 10 of 15
Page 10
of 15
Enc No 16/26
The following table sets out the banding guidance. But as mentioned above, specific projects may require
specific banding, which must be clearly shown on the relevant log.
Descriptor
1
2
3
4
5
Insignificant
Minor
Moderate
Major
Catastrophic
Population Health & Low Prevalence of
Wellbeing
minor ailment
High prevalence of
minor ailment
Significant impact on quality of Low prevalence of life
life
threatening condition
Minor injury or
illness, first aid
treatment needed
High prevalence of life
threatening condition
Injury (Physical /
Psychological)
Minor injury not
requiring first aid
or no apparent
injury
RIDDOR/ Agency reportable
Major injuries or long term
incapacity / disability (loss of
limb)
Death or major permanent
incapacity
Patient/ Public
Satisfaction
Unsatisfactory
Unsatisfactory
Mismanagement of patient
patient experience
patient experience – care, short term effects (less
not directly related
readily resolvable than a week)
to patient care
Serious mismanagement of
patient care, long term effects
(more than a week)
Totally unsatisfactory patient
outcome or experience
Costs
<5% over budget
Cost variation or
Cost variation or
cost pressure
pressure can be
almost insignificant managed within
existing resources
5-10% over budget
Cost variation or pressure
cannot be contained within
existing resources and is a
considerable threat
10-25% over budget
Cost variation or pressure
cannot be contained within
existing resources and requires
urgent Board action
>25% over budget
Cost variation or pressure will
result in cessation of service or
organisation
Timescales
Increase in
timescale by less
than 2 weeks
Increase in timescale by
between 2and 6 months
Increase in timescale by more
than 6 months
The activity will never be
achieved
Quality
Reputation
Compliance
Increase in
timescale by
between 2 weeks
and 8 weeks
Minimal impact on
Quality affected but
quality,
has minor impact
unnoticeable
The impact is
noticeable but is
Minimal impact on
recoverable with
the organisation/
minor
service's reputation
communications/
actions
Compliance will be Shortfall in
achieved with
ancillary
minimum activity requirements
Moderate impact on quality of Major impact on quality of
service or product
service or product
Quality cannot be achieved
The reputation of the
The reputation of the
organisation/service is
Confidence in the
organisation/service is
significantly damaged and will organisation/service is
damaged but can be recovered
require major investment of
irrecoverable
fully
resources to recover it
Shortfall in multiple
requirements or any of the
critical requirements
Major shortfall in critical
requirements
Compliance cannot be achieved
8.4 The Risk Matrix
The risk matrix is used to grade and prioritise risks so that MK CCG can be aware of its exposure to threat, and
the degrees of confidence it has concerning certain mitigating (controlling) activities.
When a risk is first identified, i.e. the inherent risk, it is initially rated in terms of its impact and probability.
The matrix below is used to derive a score – simply a factor of one multiplied by the other. A traffic light
system is applied to that score, and generates a colour, red, green or amber, depending on that score.
Page 11 of 15
Page 11
of 15
Enc No 16/26
IMPACT
The actual values and therefore the colours they generate have been set by the CCG, and applied to all risks,
inherent or residual. Its values are derived from the risk appetite that the organisation demonstrates overall,
although all risks are assessed on a risk by risk basis.
5
5
10
15
20
25
4
4
8
12
16
20
3
3
6
9
12
15
2
2
4
6
8
10
1
1
2
3
4
5
1
2
3
4
5
LIKELIHOOD
Red rated risks are those that require immediate attention, or those that must be monitored most closely.
Amber risks are medium and require monitoring to ensure that they do not increase in score to red, green
are those that are either fully mitigated or have lowest likelihood/impact.
8.4.1 High Risks (scores of 12 and above)
High (Red) Risks are those that have a score of 12 and above. Projects, Programmes or other corporate
structures identifying such a risk should notify the next higher level of governance.
8.4.2 Medium Risks (scores between 4 and 11)
Medium (Yellow) Risks are those that have a score of between 4 and 11. Projects, Programmes or other
corporate structures identifying such a risk should notify the next higher level of governance.
8.4.3 Low Risks (score of 3 or less)
Low risks are those that have both a low likelihood of occurring, and a low impact should they do so. They
usually fall into the ‘Tolerate’ management group.
9 Risk Appetite
NHS Milton Keynes CCG is not risk averse but recognises that bold decisions with the potential to make a real
difference can also carry high risks. This should not deter from making the decision, but should be considered
before making an informed decision.
The CCG Board will determine the level of risk that MK CCG is prepared to accept in relation to an
event/situation, after balancing the potential opportunities and threats a situation presents. It represents a
balance between the potential benefits of innovation and the threats that change inevitably brings.
Page 12 of 15
Page 12
of 15
Enc No 16/26
Decisions or actions that may have high risks should be discussed at CDG and, if relevant, the Board, to agree
how the risks will be proactively managed and contained. All papers submitted to the Board and any Board
sub-committee must have a section within the cover sheet which highlights any risks contained in the subject
being discussed.
NHS Milton Keynes CCG accepts that no system can be totally risk-free and that there are occasions when it
will have to accept a degree of risk in the course of its undertakings. For each assessed risk the managed risk
level must be considered for acceptability. The following prompts can be asked:



Can we tolerate the possibility of the risk actually happening?
If not, do we want or need to do more?
Will the cost of managing the risk outweigh the benefit?
10 Reporting and Assurance
The various governance structures within the CCG should receive, review and act on risk reports pertinent to their
areas of responsibility. Thus, a fundamental aspect of risk management is the timely communication of risk
information to enable informed decisions. All significant planned organisational activities should be accompanied
by a risk report. The frequency of such reports is to be decided by each governance structure, but consideration
must be given to the time between the report’s construction and its review, the feedback process, and the
interdependencies.
10.1 CCG Board
The Board will receive the BAF (Quarterly) which details the risks on the Corporate Risk Register rated 12 or
above and details the assurances and gaps in relation to each identified risk.
10.2 Audit Committee
The Audit Committee will receive a copy of the BAF and the Corporate Risk Register. This will be used to inform it
of the key risks facing the organisation and allow it to plan internal audits more effectively.
10.3 CDG
The CDG will receive a copy of the BAF and the Corporate Risk Register. The CDG will receive papers relating
to specific risks and seek assurance in how risks are being managed within the organisation. The CDG will
determine whether new risks or newly scored risks, reported as 8 or above, should retain the rating assigned.
10.4 Programme Boards
Each Programme Board must manage and review its own risk log. In practice, it is the responsibility of the
SRO and Programme Manager to ensure that risks are current and that programme board members are
apprised of any significant or changing risks, usually at the relevant programme board meeting.
10.5 Executive Management Team (EMT)
EMT receives the risk log, in order to understand, the risks within each Director’s area of responsibility. EMT
is also responsible for the training and processes within the Directorates.
Page 13 of 15
Page 13
of 15
Enc No 16/26
11 Training
The Chief Financial Officer is responsible for ensuring staff are able to comply with this strategy and identify,
assess and manage risks within their areas of responsibility.
The PMO and Corporate Services Team support the CFO by providing an appropriate level of training where
required, ensuring that risk management is a key skill within the organisation.
Page 14 of 15
Page 14
of 15
Enc No 16/26
12 Appendix A: Risk Management Accountabilities
Body
The Board
Accountable
position
Accountable to
Board Chair
Board
Duties
Review the Board Assurance Framework (Quarterly).
Request any changes if thought appropriate. Endorse or
change recommended treatment of significant risks.
Audit
Committee
Audit
Committee
Chair
Board
Commission internal audit of risk management maturity
and monitor agreed actions.
Use risk registers to inform the annual internal audit
programme to provide the Board with assurance that
robust controls are in place.
CDG
CDG Chair
Board
Review each risk score and modify where appropriate.
Annually review Risk Register and risk management
procedures of each Programme Board.
Directorates
Relevant
Director
CDG
Maintain an up to date risk register and actively manage
risks within areas of responsibility
Maintain appropriate risk management procedures
(including staff training, active management of risks and
compliance with the risk management strategy).
Senior
Managers/
Managers/
Programme
Managers
Managers
Executive
Management
Team
Comply with the risk management strategy and relevant
risk management procedures, including maintenance of
the risk register Identify, assess and manage risks within
area of responsibility.
Review risks at team meetings, assess and monitor risks
raised by their teams.
Ensure their staff understand and comply with their risk
management responsibilities.
All staff
All Staff
Managers
Be familiar with the risk registers and raise new risks with
line manager.
Take mitigating action as agreed with the line manager.
Be aware of and comply with the risk management
strategy.
Page 15 of 15
Page 15
of 15
Enc No 16/26
Enc No 16/26
Milton Keynes CCG Board Assurance Framework
Date: 18 April 2016
Top 1 of 10 Ranked Risks:
The ranking has been solely based on the residual risk rating:1) CP14 (20) As a result of MKHFT failing to meet the required 95% standard to admit patients. There is a risk that patients will not be treated according to the agreed
pathways in particular the admittance to a stroke ward <4hrs.With the result that the CCG will not meet its commitment to patients.
All 9 remaining risks have been ranked equally with a score of 12.
Risk Patterns:
Strategic area risk dominance is S1. Transforming Community and Primary Care have the most number of risks attributed to these strategic area with 4 residual red risks.
Category risk domains have 30% for 'Finance/VFM' and 40% for 'Quality/Operational'.
Programme areas with the majority of the residual red risks are Strategic (4) and Better Care Fund and Mental Health (2 each) .
ST11, MH04 and MH17 mitigation does not appear to be reducing the impact or likelihood of the risks, it would be assumed that these mitigations are holding the position
of the risk preventing it from worsening or occurring as an issue.
Risk Apportionment to Strategic Area
M1. Supporting Infrastructure & Corporate Process
S3. Quality & Inclusion
S2. Sustainable Hospital services
S1. Transforming Community and Primary Care
0
Programme
Area Risk Domains
0.5
1
1.5
2
2
Children, Young People &
Maternity
Corporate
0
3
Strategic
3.5
4
4.5
Finance /VFM
30%
Quality/
Operational
40%
Care Pathway & Planned
Care
1
1
3
Category Risk
Domain
Mental Health
0
2.5
1
Urgent Care
Health Care Review
2
HR/Skills
10%
Better Care Fund
Commissioning
20%
0
Risk Ranking
25
-1
20
-2
20
Risk Score
-3
15
-4
12
12
12
12
12
12
12
12
12
-5
10
-6
5
-7
0
ST28
ST38
BCF016
BCF018
UC25/
ST03
HCR-R02 ST39 (HCR MH 04
- R16 &
HCR17)
MH17
CP 14
-8
Mitigation Impact
-9
1 of 13
Dashboard
Enc No 16/26
Board Assurance Framework
Type
Gaps in Control
Further
Mitigation?
Outstanding
Actions
As a result of significant recruitment & retention
issues across the MK health & social care system,
including GPs and primary care staff.There is a risk
that staffing requirements are not filled by those
with the right skills and qualifications and there is a Matt Webb
lack of capacity and capability. With the result that
services may be adversely affected and there will
be an impact on service quality, performance and
service delivery.
1 month
5
4
20
4
3
12

Quality\Operational
No
No
No
As a result of MKC having to reduce their budget
by 25% over the next two yearsThere is a risk that
potentially impacting supporting services.With the
Donna Derby
result that Preventative services organisations
such as Public Health are subject to normal council
cuts with adverse effects on health promotion.
1 month
5
3
15
4
3
12

Finance/VFM
No
No
No
1-3
months
4
4
16
3
4
12

Quality\Operational
No
No
No
1-3
months
4
4
16
3
4
12

Finance/VFM
No
No
No
Mark Cox
4
5
20
3
4
12

Quality\
Operational
No
No
No
1-3
months
5
5
25
3
4
12

HR/Skills
No
No
No
1-3
months
4
4
16
3
4
12

Commissioning
No
No
No
MENTAL HEALTH - As a result of financial pressures
within secondary mental health services. There is a
risk that provider unable to deliver contracted
Donna Derby / Mick 1-3
services .With the result that unable to meet
Hancock
months
statutory duties, increased risk of service noncompliance, risk to patient safety, poor outcomes
for service users and carers.
3
4
12
3
4
12

Finance/VFM
No
Yes
No
4
3
12
4
3
12

Commissioning
No
Yes
No
5
4
20
5
4
20

Quality\
Operational
No
Yes
No
High-level potential risks that are unlikely to be
fully resolved and require on-going control
Accountable
Director
BETTER CARE FUND - As a result of increased
pressure across the health and social care system
.There is a risk that limited capacity with
Donna Derby/Mick
community packages and recruitment of care
Hancock
staff.With the result that delayed transfers of care
will increase as well as more emergency
admissions.
BETTER CARE FUND - As a result of increasing
emergency and non-elective admissions to hospital
.There is a risk that the CCG will need to pay for
Mick Hancock
both the increase in Acute activity and the BCF
schemesWith the result that the CCG goes into
financial deficit.
UC25/ ST03
As a result of lack of sustainability of A&E
improvements.There is a risk that A&E service
provision may deteriorate.With the result that
patients will receive a lower quality of care.
HCR-R02
HEALTH CARE REVIEW - As a result of poor
relationships and engagement with senior leaders
and clinicians.There is a risk that that there lack of
progress at pace and increasing lack of confidence Matt Webb
in local NHS transformation.With the result that
programme governance and decision-making
cannot be agreed.
Donna Derby
HEALTH CARE REVIEW - As a result of the lack of
pace of the transformation work to support acute
reconfiguration via the Health Care Review. There
ST39 (HCR is a risk that the outcome of the review will be
R16 &
Matt Webb
insufficient to deliver medium and long term
HCR17)
service and financial stability.With the result that
the recommendation of the review could not be
implemented.
MH 04
Trend - change
form last period
The CCG will commission acute
services from the most
appropriate provider that are
high quality and accessible.
RAG Status
S2. Sustainable Hospital
services
Likelihood
BCF018
Impact
S1. Transforming Community
and Primary Care. The CCG will
commission a greater
proportion of activity in
community and home settings
ST38
with greater emphasis on
prevention and self care across
all population groups and
empower those with long term
conditions to take more
responsibility for managing
their care and use support
networks.
BCF016
RAG Status
ST28
MH17
CP 14
Residual
(After)
Mitigation
Likelihood
Risk ID
Proximity
Strategic Area
Inherent
(Before)
Mitigation
Impact
Residual Red RAG'd Risk
Description
MENTAL HEALTH - As a result of local authority
budget cuts - in particualr adult social care and
children's services. There is a risk that services
Donna Derby / Mick 1-3
which support prevention, early intervention and
Hancock
months
recovery are reduced or stopped. With the result
that Increased risk of people needing health/crisis
services.
CP & PC - As a result of failing to meet the
standard of admitting 95% of relevant patients to
an acute stroke ward within 4 hours of
arrival,There is a risk that patients will not be
Donna Derby
1 month
treated according to the national stroke
standardsWith the result that the CCG will not
meet its commitment to patients to deliver high
quality healthcare.
Page 2 of 13
Risk Summary
Enc No 16/26
12

 
1-3
months
12

 
Mark Cox
12
HEALTH CARE REVIEW - As a result of poor relationships and
engagement with senior leaders and clinicians.There is a risk that that
there lack of progress at pace and increasing lack of confidence in
Matt Webb
local NHS transformation.With the result that programme governance
and decision-making cannot be agreed.
1-3
months
12
HEALTH CARE REVIEW - As a result of the lack of pace of the
transformation work to support acute reconfiguration via the Health
ST39 (HCR Care Review. There is a risk that the outcome of the review will be
R16 &
Matt Webb
insufficient to deliver medium and long term service and financial
HCR17)
stability.With the result that the recommendation of the review could
not be implemented.
1-3
months
12
MH 04
MENTAL HEALTH - As a result of financial pressures within secondary
mental health services. There is a risk that provider unable to deliver
Donna Derby / 1-3
contracted services .With the result that unable to meet statutory
Mick Hancock months
duties, increased risk of service non-compliance, risk to patient
safety, poor outcomes for service users and carers.
12
MH17
MENTAL HEALTH - As a result of local authority budget cuts - in
particualr adult social care and children's services. There is a risk that
Donna Derby / 1-3
services which support prevention, early intervention and recovery
Mick Hancock months
are reduced or stopped. With the result that Increased risk of people
needing health/crisis services.
12
CP 14
CP & PC - As a result of failing to meet the standard of admitting 95%
of relevant patients to an acute stroke ward within 4 hours of
arrival,There is a risk that patients will not be treated according to the Donna Derby
national stroke standardsWith the result that the CCG will not meet
its commitment to patients to deliver high quality healthcare.
20
BETTER CARE FUND - As a result of increased pressure across the
health and social care system .There is a risk that limited capacity
with community packages and recruitment of care staff.With the
result that delayed transfers of care will increase as well as more
emergency admissions.
Donna
Derby/Mick
Hancock
1-3
months
BCF018
BETTER CARE FUND - As a result of increasing emergency and nonelective admissions to hospital .There is a risk that the CCG will need
to pay for both the increase in Acute activity and the BCF
schemesWith the result that the CCG goes into financial deficit.
Mick Hancock
UC25/
ST03
As a result of lack of sustainability of A&E improvements.There is a
risk that A&E service provision may deteriorate.With the result that
patients will receive a lower quality of care.
Donna Derby
HCR-R02
S2. Sustainable Hospital services
Page 3 of 13
1 month


  


         

          


 

     
 
   


Mar-16
 
12
Feb-16
Aug-15
       
1 month
Jan-16
Jul-15

As a result of MKC having to reduce their budget by 25% over the
next two yearsThere is a risk that potentially impacting supporting
services.With the result that Preventative services organisations such Donna Derby
as Public Health are subject to normal council cuts with adverse
effects on health promotion.
S1. Transforming Community and
Primary Care. The CCG will
commission a greater proportion of
activity in community and home ST38
settings with greater emphasis on
prevention and self care across all
population groups and empower
those with long term conditions to
take more responsibility for
managing their care and use
BCF016
support networks.
Dec-15
Jun-15
  
12
Nov-15
May-15

1 month
Oct-15
Apr-15
 
Owner
As a result of significant recruitment & retention issues across the MK
health & social care system, including GPs and primary care
staff.There is a risk that staffing requirements are not filled by those
with the right skills and qualifications and there is a lack of capacity
Matt Webb
and capability. With the result that services may be adversely
affected and there will be an impact on service quality, performance
and service delivery.
Sep-15
Mar-15

High-level potential risks that are unlikely to be fully resolved and
require on-going control
Feb-15

Risk ID
ST28
The CCG will commission acute
services from the most appropriate
provider that are high quality and
accessible.
Trend - change form last period
Jan-15
Strategic Area
Residual RAG
Score
Residual Red RAG'd Risk Description
Proximity
Residual Risk Trends
  
 


Risk Trends
Enc No 16/26
Inherent risk
Residual Risk
04/03/2015
N/A
ST28
1 month

Imapct
Date Opened
Project ID
Risk ID
Proximity of risk
Trend
Risk Scoring
Date Last Reviewed:
Days Open
Accountable Director
Domain Type
Assurance Impact
5
10
15
20
25
4
3
2
1
8
6
4
2
12
9
6
3
16
12
8
4
20
15
10
5
17/02/2016
351
Matt Webb
Quality\Operational
4
A reduction in likelihood & impact . The
mitigation is reducing the probability of the
risk happening and the impact of the risk.
Likelihood
Risk Description
Consequences
Contributory Factors
Rationale for Risk
Appetite
Responsible Committee
Controls
What are we currently
doing about the risk?
Further controls need?
Assurance Actions &
Updates
As a result of significant recruitment & retention issues across the MK health & social care system, including
GPs and primary care staff.There is a risk that staffing requirements are not filled by those with the right skills
and qualifications and there is a lack of capacity and capability.
With the result that services may be adversely affected and there will be an impact on service quality,
performance and service delivery.
1) Private sector providing higher salaries and recently incentives plus limited pay increases
2) Risk of constant change
MK CCG focuses on commissioning quality service, improving operability
Senior Management Team
- Workforce Development issues for MK acknowledged at CCG strategic level
- Programme Boards raising and monitoring this risk
- Monitoring and investigation of serious incidents in provider services will flag staffing related incidents
- Contract management
- Work force Development Strategy
No
17/02/16 - Risk score increased from 12 to 16 as this is proving a risk for a number of Boards (MH&LD and BCF)
now. No whole system agreement has yet been reached regarding funding to engage a Strategic Workforce
Planner. HETV postponed January's meeting. Jill, Alexia and Hilary to meet with them soon to seek funding
opportunities. MKUHFT have employed a Strategic Workforce Planner purely for the hospital; Jill to meet with
them next week.
04/12/15 - Awaiting on confirmation from CNWL & MKUHFT regarding funding to engage a strategic
workforce planner. A decision is expected by 15/12. Jill, Alexia and Hilary are also meeting with the Health
Education Thames Valley (HETV) on 20/01/16 to request their support by commissioning a piece of work
around this.
Assurance
(How do we know our
There is email evidence that this has been raised with the System Leads of the providers.
controls are having an
impact i.e.
indicators/KPI?)
Further Mitigating
Actions Need?
No
(What could we do more
of?)
Outstanding Actions and
No
Completion Dates?
Contingencies
(What actions will we
take if the risk becomes
an issue?)
ST28
Page 4 of 13
Enc No 16/26
Date Opened
Project ID
Risk ID
Proximity of risk
Trend
Risk Scoring
04/11/2015
N/A
ST38
6-9 months

Imapct
Inherent risk
Residual Risk
Date Last Reviewed:
Days Open
Domain Type
Assurance Impact
5
10
15
20
25
4
3
2
1
8
6
4
2
12
9
6
3
16
12
8
4
20
15
10
5
17/02/2016
106
Donna Derby
Finance /VFM
3
There has been no reduction impact, but
there has been a reduction in likelihood.
Likelihood
Risk Description
Consequences
Rationale for Risk
Appetite
As a result of MKC having to reduce their budget by 25% over the next two yearsThere is a risk that potentially
impacting supporting services.
With the result that Preventative services organisations such as Public Health are subject to normal council cuts
with adverse effects on health promotion.
1) MKC and MKCCG target reductions in expenditure
MK CCG focuses on commissioning quality service, which meet national requirements which work with MKC's
portfolio.
JCT, MKC & MK CDG
* Monitor through monthly Better Care Fund Programme Boards and six weekly Joint Commissioning Boards.
Controls
* Nationally, local authorities will be given new powers to increase council tax by up to 2% in a bid to tackle social
care funding.
Assurance Actions &
Updates
No
17/02/16 - (LMac) Risk reviewed and remains relevant. Additional Assurance added.
26/11/15 - (DD) Monitoring budget setting rounds through the Joint Commissioning Board. MKC consultative
phase for budget setting.
There is greater joint working around BCF and Joint Commissioning.
Update at the next Joint Commissioning Board on the 10/12/15.
Section 75 agreement has been agreed and signed off for the Better Care Fund which will be minuted.
Financial monitoring
Assurance
(How do we know our
impact i.e.
indicators/KPI?)
Further Mitigating
Actions Need?
No
of?)
No
Completion Dates?
Contingencies
an issue?)
ST38
Page 5 of 13
Enc No 16/26
Date Opened
Project ID
Risk ID
Proximity of risk
Trend
Risk Scoring
05/11/2015
N/A
BCF016
1-3 months

Imapct
Inherent risk
Residual Risk
Date Last Reviewed:
Days Open
Domain Type
Assurance Impact
5
10
15
20
25
4
3
2
1
8
6
4
2
12
9
6
3
16
12
8
4
20
15
10
5
27/01/2016
105
Donna Derby/Mick Hancock
Quality \Operational
4
There has been no reduction impact.
Likelihood has reduced.
Likelihood
Risk Description
BETTER CARE FUND - As a result of increased pressure across the health and social care system .There is a risk that
limited capacity with community packages and recruitment of care staff.
Consequences
With the result that delayed transfers of care will increase as well as more emergency admissions.
Rationale for Risk
Appetite
1) MKC and MKCCG are committed to provide quality services within the finanical constraints
portfolio.
JCT, MKC & MK CDG
A considerable amount of work is being done to address this;
Controls
- Discussions at SRG Planning Networks
- Getting People Home project
- Discharge to Assess project
- BCF Schemes such as Recouperation Pathway
- MKC are looking at home care provision in a different way, more specialist home care
- In November a new contract was implemented for additional carer hours.
Assurance Actions &
Updates
No
27/01/16 - (VP) BCF PB agreed on 16/01 that this risk could be closed on the BCF Risk Register as long as it is
mitigated elsewhere. Due to the level of this risk it does appear on the Strategic risk register. It is also a system
wide risk not just a risk to the BCF. Requires further discussions with Head of PMO before closure on BCF Risk
Register.
Budgets and financial controls
Assurance
(How do we know our
impact i.e.
indicators/KPI?)
Further Mitigating
Actions Need?
No
of?)
No
Completion Dates?
Contingencies
an issue?)
BCF016
Page 6 of 13
Enc No 16/26
Date Opened
Project ID
Risk ID
Proximity of risk
Trend
Risk Scoring
05/11/2015
N/A
BCF018
1-3 months

Imapct
Inherent risk
Residual Risk
Date Last Reviewed:
Days Open
Domain Type
Assurance Impact
5
10
15
20
25
4
3
2
1
8
6
4
2
12
9
6
3
16
12
8
4
20
15
10
5
18/01/2016
105
Mick Hancock
4
There has been no reduction impact.
Likelihood has reduced.
Likelihood
Risk Description
BETTER CARE FUND - As a result of increasing emergency and non-elective admissions to hospital .There is a risk
that the CCG will need to pay for both the increase in Acute activity and the BCF schemes
Consequences
With the result that the CCG goes into financial deficit.
Rationale for Risk
Appetite
portfolio.
JCT, MKC & MK CDG
·
BCF performance measures for emergency and other non-elective admissions is being analysed by the CCG
Controls
Financial
team to understand interdependence with rising costs
·
Contractual
negotiations for action plan to manage activity levels in the Trust
Assurance Actions &
Updates
No
18/01/16 - (WR) The financial analysis has been undertaken which is supporting Director level discussions to
finalise a decision.
11/12/15 - (WR) Financial analysis has been undertaken and further discussion is required with the BI Team to
understand the discrepencies identified.
Budgets and financial controls
Assurance
(How do we know our
impact i.e.
indicators/KPI?)
Further Mitigating
Actions Need?
No
of?)
No
Completion Dates?
Contingencies
an issue?)
BCF018
Page 7 of 13
Enc No 16/26
S2. Sustainable Hospital Services
Inherent risk
Residual Risk
29/02/2012
N/A
UC25/ ST03
1 month

Imapct
Date Opened
Project ID
Risk ID
Proximity of risk
Trend
Risk Scoring
Date Last Reviewed:
Days Open
Domain Type
Assurance Impact
5
10
15
20
25
4
3
2
1
8
6
4
2
12
9
6
3
16
12
8
4
20
15
10
5
01/02/2016
1450
Donna Derby
Quality\ Operational
8
An increase in likehood and impact.
Mitigation may be holding the risk steady,
without may convert into a risk. Or the
Likelihood
Risk Description
As a result of lack of sustainability of A&E improvements.There is a risk that A&E service provision may deteriorate.
Consequences
With the result that patients will receive a lower quality of care.
1) Increase populations in Milton Keynes, which is an aging population
2) Seasonal impacts and weather
Rationale for Risk
Appetite
Quality services are high on the agenda of the CCG agenda
Controls
Assurance Actions &
Updates
System Resilience
The system resilience group has:
- The weekly system resilience group (SRG) meeting and system dashboard means that there is improved information to focus
attention and better manage the issues.
- Evolved a monthly schedule of strategic / operational meetings to deal with issues and escalate as required.
- Contract terms do allow a fine to be imposed - this will be considered if the action plan does not deliver desired effect
- Performance notice issued May 2015, CCG & Trust going through the process to agree a remedial action plan
- Regulatory body inspections and monitoring
No
01/02/16 Month 10 performance = 92.6%
04/01/16 MKUHFT reporting achievement of Q3. YTD 95.3%
23/12/15 Q3 performance 94.5%, Month to date 97.2%
10/12/15 Q3 performance = 94%. Month to date = 96.8%
09/11/15 Warm Up For Winter week commenced. A variant on "Breaking the Cycle" initiatives. MKUHFT prioritise and focus on flow.
Assurance
(How do we know our
Performance report target of 95% of patients are treated within 4hours.
impact i.e.
indicators/KPI?)
Further Mitigating
Actions Need?
Monitor impact of the new changes - trauma ward re-opened
No
of?)
No
Completion Dates?
Contingencies
an issue?)
UC25
Page 8 of 13
Enc No 16/26
Date Opened
Project ID
Risk ID
Proximity of risk
Trend
Risk Scoring
19/11/2014
N/A
HCR-R02
1-3 months

Imapct
Inherent risk
Residual Risk
Date Last Reviewed:
Days Open
Domain Type
Assurance Impact
5
10
15
20
25
4
3
2
1
8
6
4
2
12
9
6
3
16
0
12
8
4
20
15
10
5
13/10/2015
456
Matt Webb
HR/Skills
13
A reduction in likelihood and impact .
Likelihood
Risk Description
HEALTH CARE REVIEW - As a result of poor relationships and engagement with senior leaders and clinicians.There is
a risk that that there lack of progress at pace and increasing lack of confidence in local NHS transformation.
Consequences
With the result that programme governance and decision-making cannot be agreed.
1) Speed of project progression
2) Working across multi organisations
Rationale for Risk
Appetite
Workforce and skills are high on the agenda of the CCG to ensure quality and sustainability of services
Controls
Assurance Actions &
Updates
Health Care Review Board
- Establish frequent formal and informal contact with system leaders
- Embed governance and formal checkpoints so that all parties are cited on plans
No
13/10/2015 SA/KO: Continued support for engagement with clinicians across both local health systems.
17/06/2015 JS: Programme Board discussion - Group agreed that this risk is the biggest risk to the programme at
present given collaborative working.
Assurance
(How do we know our
impact i.e.
Further Mitigating
Actions Need?
No
of?)
No
Completion Dates?
Contingencies
an issue?)
HCR-R02
Page 9 of 13
Enc No 16/26
Date Opened
Project ID
Risk ID
Proximity of risk
Trend
Risk Scoring
04/11/2015
N/A
ST39 (HCR - R16
& HCR17)
1-3 months

Imapct
Inherent risk
Residual Risk
Date Last Reviewed:
Days Open
04/11/2015
106
Matt Webb
Domain Type
Assurance Impact
5
10
15
20
25
4
3
2
1
8
6
4
2
12
9
6
3
16
12
8
4
20
15
10
5
Commissioning
4
A reduction in likelihood but not impact .
The mitigation is reducing the probability of
the risk happening but not the impact.
Likelihood
Risk Description
HEALTH CARE REVIEW - As a result of the lack of pace of the transformation work to support acute reconfiguration
via the Health Care Review. There is a risk that the outcome of the review will be insufficient to deliver medium and
long term service and financial stability.
Consequences
With the result that the recommendation of the review could not be implemented.
1) Speed of project progression
2) Working across multi organisations and communciation
Rationale for Risk
Appetite
Project Management is high on the agenda of the CCG to ensure quality and sustainability of services
Health Care Review Board & SMT
Controls
The work programmes associated with the delivering the primary care and community aspects of the Care Closer
to Home strategy, will need to be aligned to the programme arrangements for the Healthcare review. The work
programmes associated with the delivering the primary care and community aspects of the Care Closer to Home
strategy, will need to be aligned to the programme arrangements for the Healthcare review.
Assurance Actions &
Updates
No
R16-7 updates. 13/10/15 CS/SA: Assurance workshop to be undertaken allowing a greater understanding of the
relationship / decision-making / dependencies between the Care Closer to Home strategy and HCR.
20/05/2015 FC: CC2H strategy being looked at in more detail in page-turning exercise on 26th June led by Alison
Joyner. 22/6/15 Further alignment currently being explored in light of final Care Closer to Home strategy having
now been finalised, this should serve to minimise risk in due course.
Assurance
(How do we know our
impact i.e.
indicators/KPI?)
Further Mitigating
Actions Need?
No
of?)
No
Completion Dates?
Contingencies
an issue?)
ST39
Page 10 of 13
Enc No 16/26
Date Opened
Project ID
Risk ID
Proximity of risk
Trend
Risk Scoring
08/07/2015
N/A
MH 04
1-3 months

Imapct
Inherent risk
Residual Risk
Date Last Reviewed:
Days Open
Domain Type
Assurance Impact
5
10
15
20
25
4
3
2
1
8
6
4
2
12
9
6
3
16
12
8
4
20
15
10
5
02/12/2015
225
Donna Derby / Mick Hancock
Finance/VFM
0
There has been no reduction impact or
likelihood.
Likelihood
Risk Description
Consequences
Rationale for Risk
Appetite
MENTAL HEALTH - As a result of financial pressures within secondary mental health services. There is a risk that
provider unable to deliver contracted services .
With the result that unable to meet statutory duties, increased risk of service non-compliance, risk to patient
safety, poor outcomes for service users and carers.
portfolio.
JCT, MKC & MK CDG
Negotiations between CCG and CNWL are ongoing but require plan that has been agreed by both parties to
Controls
mitigate this risk.
Assurance Actions &
Updates
No
01/12/015 - (TC) Negotiations progressing but unable to reduce risk until resolution.
04/11/2015 - (TC) Risk increased at request of Programme Board as no clear mitigation at this stage.
05/08/2015 - CNWL revised proposals are being considered by CCG.
Assurance
(How do we know our
impact i.e.
indicators/KPI?)
Further Mitigating
Actions Need?
Yes
of?)
No
Completion Dates?
Contingencies
an issue?)
MH04
To reduce risk rather than holding
Page 11 of 13
Enc No 16/26
Date Opened
Project ID
Risk ID
Proximity of risk
Trend
Risk Scoring
04/11/2015
N/A
MH17
1-3 months

Imapct
Inherent risk
Residual Risk
Date Last Reviewed:
Days Open
Domain Type
Assurance Impact
5
10
15
20
25
4
3
2
1
8
6
4
2
12
9
6
3
16
12
8
4
20
15
10
5
02/12/2015
106
Donna Derby / Mick Hancock
Commissioning
0
likelihood.
Likelihood
Risk Description
MENTAL HEALTH - As a result of local authority budget cuts - in particualr adult social care and children's services.
There is a risk that services which support prevention, early intervention and recovery are reduced or stopped.
Consequences
With the result that Increased risk of people needing health/crisis services.
Rationale for Risk
Appetite
portfolio.
JCT, MKC & MK CDG
CCG needs to be aware where budget reductions will impact on health services and input into MKC budget
Controls
consultation (Dec15 - Jan16).
Assurance Actions &
Updates
No
02/12/15 (TC) - Programme Board to receive briefing on MKC budget and opportunity to comment.
04/11/15 (TC) - Raised by Programme Board due to concerns regarding large scale funding reductions to local
authority.
Assurance
(How do we know our
impact i.e.
indicators/KPI?)
Further Mitigating
Actions Need?
Yes
of?)
No
Completion Dates?
Contingencies
an issue?)
MH17
To reduce risk rather than holding
Page 12 of 13
Enc No 16/26
Date Opened
Project ID
Risk ID
Proximity of risk
Trend
Risk Scoring
28/07/2014
N/A
CP 14
1 month

Imapct
Inherent risk
Residual Risk
Date Last Reviewed:
Days Open
Domain Type
Assurance Impact
5
10
15
20
25
4
3
2
1
8
6
4
2
12
9
6
3
16
12
8
4
20
15
10
5
14/01/2016
570
Donna Derby
0
likelihood.
Likelihood
Risk Description
CP & PC - As a result of failing to meet the standard of admitting 95% of relevant patients to an acute stroke ward
within 4 hours of arrival,There is a risk that patients will not be treated according to the national stroke standards
Consequences
With the result that the CCG will not meet its commitment to patients to deliver high quality healthcare.
Rationale for Risk
Appetite
1) CCG target reductions in expenditure
MK CCG focuses on commissioning quality service, which meet national requirements
Senior Management Team
Treat
Controls
1. Clinical standards are monitored through CQRM.
2. Contract levers in place.
3. Link with Strategic Clinical Network (SCN) and undertake of clinical review.
4. Links with place with SCN to review whole system pathway.
Assurance Actions &
Updates
Assurance
(How do we know our
impact i.e.
indicators/KPI?)
Further Mitigating
Actions Need?
of?)
Completion Dates?
Contingencies
an issue?)
CP14
No
14/01/16 - (HJ) Decision based on the Q2 SSNAP data the overall position has not improved. MK overall SSNAP
score remains significantly below the TVSCN average at 35.2% for both patients and team centred cuminlative
scores. (Likelihood raised from 4 back to 5).
21/12/15 - (HJ) Wording of risk reviewed along with RAG scoring following mitigation and controls.
04/12/15 - (HJ) TVSCN Report received. Met with Bedford & Luton CCG and TVSCN to agree whole system
improvements for stroke care. Options appraisal is going to December Programme Board and January CDG.
Continued focus on improving quality issues through CQRM.
Potentially a new service specification to be created and implemeted. Measurable KPIs to be designed and
embedded in the Service Specification.
Yes
Impact for next year
No
Page 13 of 13
Enc No 16/26
Enc No 16/26
Summary of BAF as at 18th April 2016
Total Red Risks
In terms of risks, the current BAF headlines are:

There are 10 residual red risks. This represents a decrease of one since the last
full iteration of the BAF (as at 29 December 2015).

There is one red risk scoring 20 or above (CP14 – Stroke treatment standard).
This represents a reduction of one high score risks compared to the December
2015 BAF.

The key strategic area being impacted on by red risks is S1 Transforming
Community and Primary Care.

The three programme areas with the highest number of residual red risks are
‘Strategic’ (4), ‘Better Care Fund’ (2) and ‘Mental Health (2).
New Red Risks
There are no new red-scoring risks this reporting period.
Continuing Red Risks
Nine risks previously scoring as red remain unchanged:









UC25/ST03 - impact on quality of care due to unsustainability of A&E
improvements.
ST11 – failure to deliver against business rules due to unplanned financial
pressures.
HCR-R02 – HCR governance and decision-making cannot be agreed due to
inadequate stakeholder engagement and management.
ST28 – service quality impacted due to inability to recruit sufficient staff of
appropriate calibre.
ST38 – potential impact on health promotion and care of budget reductions by
MK Council
MH17 – potential impact on MH health and crisis services of budget reductions
by MK Council
MH04 – impact on statutory and service requirements of financial pressures in
secondary mental health services
BCF016 – impact on Better Care Fund (BCF) objectives of limited capacity in
community care
BCF018 – impact on the Financial Plan of increasing emergency and non-elective
admissions
Changed Red Risks
The scoring of one red risk has been increased following the review of the Risk Register on
14 January 2016. The wording of the risk has also been reviewed:
Enc No 16/26

CP14 (was 16, now 20) As a result of MKHFT failing to meet the standard of
admitting 95% of relevant patients to an acute stroke ward within 4 hours of arrival,
there is a risk that patients will not be treated according to the national stroke
standards with the consequence that the CCG will not meet its commitment to
patients to deliver high quality healthcare.
ST28 (recruitment, capability and capacity) is flagged for review with the expectation that
the risk score will consequently increase (currently scored as 12).
Closed Red Risks
No red risks have been closed in this reporting period. On 19 January 2016 the Better Care
Fund Delivery Group discussed BCF016 (community capacity and recruitment) as above. The
Group has decided to close this risk on the basis there is a high degree of duplication with
ST28 (recruitment, capability and capacity). This change will be reflected in the next
iteration of the BAF.
Other Significant Changes
ST11 (was 20, now 10) - Risk the CCG will not meet it’s financial plan. This risk has been
reviewed and its scoring decreased due to the proximity of year end and continuing positive
forecasts for delivery of the CCGs QIPP Plan and Financial Recovery Plan. This risk was
previously scored at 20 and is now scored at 10. As such, and while the risk will continue to
be monitored, it no longer features in the BAF.

16 26 Review of Board Assurance Framework

Transcription

Similar documents

pdf, 1.15 MB - Sandwell and West Birmingham CCG

new milton advertiser man found dead after inferno destroys flat

Brochure - Center for China and Globalization

Information for Emergency Weekend Appointments Dental Access

college official`s report curry college

YA 50th Anniversary Cover Silver

February 2014 Foundation Forum - Milton District Hospital Foundation

Governing Body - NHS South Tees CCG

Star Wars CCG Collecting Encyclopedia

Oracle® Configuration Controls Governor

jbr staffing

The Golden Label

a thesis

Centricity* Imaging Analytics Real-time Dashboard

DeQuervain`s Stenosing Tenosynovitis