Appendix: Observations from our 2017/18 audits of district health boards

Asset management

We have previously commented on the need for district health boards (DHBs) to improve their asset management. Because DHBs rely on their assets to provide health services, managing them requires effective stewardship. Although we have seen some improvement in DHBs’ asset management recently, there is still much work to be done.

In June 2016, we published the report District health boards’ response to asset management requirements since 2009. Given how important DHBs’ assets are to delivering essential health services, we found that DHBs’ asset management was as not as mature as we expected. DHBs appeared to focus more on short-term results and less on how they were going to ensure their ongoing capability to deliver results. We made several recommendations to help DHBs improve their asset management.

During our 2016/17 audits, we saw little evidence that DHBs had addressed these recommendations. However, during our 2017/18 audits, we saw more DHBs improving their asset management practices. Some DHBs have made progress by putting in place foundations for good asset management, for example, preparing clinical services plans that enable strategic asset management decisions.

Long-term investment plans are another important enabler of strategic asset management. In 2017/18, the four Northern Region DHBs completed their integrated Northern Region Long Term Investment Plan.

Some DHBs have gained a better understanding of the condition of their assets, which is important to effectively manage their assets. However, DHBs’ maintenance of assets is still predominately reactive rather than proactively planning for the maintenance requirements of the assets. We also noted that some DHBs have asset management plans that are now due to be refreshed.

We look forward to the completion of the National Asset Management Plan by the Ministry of Health, which we understand will include systems for managing information about DHBs’ critical assets and enable informed decisions about what investments are needed and where. This is a welcome development, as the health sector has needed a more joined-up and evidence-based approach to asset management for some time.

Questions to consider

• Does your DHB know how well its assets meet its current and expected service delivery needs?
• Does your DHB have reliable information about its assets and their condition that supports long-term service delivery?
• Does your DHB use information from asset management planning to inform financial forecasts and strategic planning?

Procurement and contract management

Effective procurement is important for DHBs. We have estimated that up to 60% of DHB expenditure is on procurement. Much of this is for health services purchased by DHBs from other providers.

The procurement environment continues to be uncertain for DHBs. In recent years, national procurement roles have been previously carried out by Health Benefits Limited and healthAlliance FPSC Limited. The national procurement role is currently carried out by NZ Health Partnerships Limited. These organisations have each provided different types and levels of procurement support to DHBs, with corresponding changes required in DHBs’ own procurement capability. Some DHBs also have regional shared-services arrangements for procurement.

Regardless of the national or regional arrangements in place, it is important that DHBs understand their own procurement capability needs, and that procurement carried out by, or on behalf of, each DHB follows good practice. Procurement decisions and processes remain the responsibility of the DHB.

Contract management remains a challenge for DHBs. Many of the services contracted by DHBs might have limited numbers of potential providers or only one viable provider. In these circumstances, more reliance is placed on trust, but this does not reduce the need for effective contract management.

Some DHBs have updated their contract management policies but lack dedicated systems for managing those contracts. In some cases, this has been because some DHBs are waiting for national systems that were expected to offer this functionality. Other DHBs have determined that the investment required to implement contract management systems is not presently justified. DHBs need to consider all investment decisions carefully. It is not our place to form a view on those decisions. We note, however, that DHBs are large organisations and need tools that are appropriate to their scale and complexity.

Questions to consider

• Does your DHB have an up-to-date procurement strategy? The strategy should cover both providers and funder arms and include the DHB’s medium-term procurement and contracting needs.
• Does your DHB have a comprehensive and up-to-date procurement policy(s), guidance, procedures, and templates that cover all its activities and all forms of procurement activity (including contracts with health care providers and non-governmental organisations)?
• How does your DHB get assurance that contracted health care services are providing value for money? Have you tested the market recently?
• Is your DHB’s management of contracts robust enough to ensure ongoing quality service delivery?
• Does your DHB have the right number of staff with appropriate skills, knowledge, and expertise in the right structure to deliver effective procurement and contract management?
• Are you confident that procurement is well co-ordinated between planning, funding, and other parts of the DHB?
• Does the Board get the right level of regular reporting on procurement, contract spending, and other issues so it can carry out its oversight and governance role effectively?

Fraud awareness and prevention

New Zealand’s enviable reputation for a high integrity public service is vulnerable to the actions of a few individuals who can erode trust in the entire system. In 2017/18, we did not see a significant increase in incidences of fraud but, as with previous years, there were some cases where individuals misappropriated DHB funds. In most, the DHB discovered the fraud through its internal controls or a tip off. We were informed of each incident appropriately. However, DHBs need to continue to be active in preventing fraud and vigilant in detecting it. All DHBs should have an up-to-date fraud policy, carry out a thorough and appropriate investigation when fraud is suspected, and notify law enforcement when fraud is identified.

Based on recent trends, situations where DHBs are most vulnerable are when staff are handling cash or there is insufficient segregation of duties for revenue and expenditure. We have also seen throughout the public sector an increase in cyber fraud, such as “whaling” or “phishing” scams. Ensuring that sufficient and appropriate controls are in place will help mitigate the risk of fraud occurring. Staff with delegated authority for expenditure need to exercise robust reviews before approving payments. It is crucial that staff at all levels in the organisation, especially those who process revenue and expenditure, understand their responsibility to report bad behaviour where they see it and know how they can do this.

DHBs might find the Fraud Control Improvement Kit useful, which was prepared by the New South Wales Audit Office.² This can be used to evaluate processes for mitigating fraud and corruption.

Questions to consider

• Is your DHB’s fraud policy up to date?
• Has your DHB carried out a risk assessment of where it is most vulnerable to fraud? Have controls been implemented to mitigate risks?
• Does your DHB have a programme of fraud awareness that might include regular reminders to staff about the fraud policy and their responsibilities?

Holidays Act 2003 compliance

In 2017/18, every DHBs’ audit report included a paragraph drawing attention to the Holidays Act 2003 (the Act) and the potential significant liabilities from non-compliance with the Act. It is now three years since we first reported on this matter for DHBs and it is not yet resolved. This creates uncertainty in DHBs’ financial statements and is a real cost to employees, who might not have received the pay that they were entitled to.

We appreciate that the issues are complex but they can be resolved. The longer this situation continues, the greater the potential liability is for DHBs, adding to an already strained financial situation. We understand that work is being carried out at a national level to address the problem, but it is unlikely to progress fast enough for the problem to be resolved in 2018/19. We expect this to be a priority for the DHBs in 2019/20.

As well as determining how much might be owed for holiday pay not previously paid, we recommend that DHBs test the configuration of their systems and processes to ensure that the correct payment is made from the outset. This will prevent liability in the future.

Statements of performance expectations

In 2017/18, we noted that several DHBs had not completed their Statement of Performance Expectations (SPE) in time to meet the requirements of the Crown Entities Act 2004. For some DHBs, the SPE was still not finalised by the time the annual report was signed. For those DHBs’ annual reports, we added a paragraph emphasising the matter in the audit report.

SPEs are important accountability tools. They help Parliament and the public understand what a DHB intends to achieve during the year and how much it intends to spend. Failing to meet the time frames means that people are deprived of information that they are entitled to.

Combining DHBs’ annual plans with SPEs might have contributed to this situation. We are aware that annual plans can take some time to be agreed, and that there is no legislative deadline for doing so. Because of this, it would make sense for SPEs to be prepared and presented to Parliament separately from the annual plan, unless DHBs are confident that the annual plan will also be finalised in time to meet the SPE requirements.

Asset valuations

Asset valuations can be challenging for DHBs because of the number and value of their assets. DHBs need to revalue land and buildings regularly to ensure that the carrying value of the asset reflects fair value. Because hospitals are usually located in central areas with high population, land values can change significantly and quickly. This means that DHBs need to frequently consider whether a revaluation is needed instead of having a scheduled revaluation every three or five years.

Another factor that has become important after the 2016 amendments to the Building Act 2004 is seismic assessment of buildings. The results of these assessments have created valuation challenges for some DHBs. In 2017/18, this resulted in a qualified audit opinion for one DHB because it was unable to quantify the effect of an adverse seismic assessment on the value of the hospital. DHBs should ensure that seismic assessments are done before valuations, so the assessment results can be reflected in the valuations.

Information systems and technology

It is essential that the information systems and technology supporting financial management are secure and well managed. Continual reviews and vigilance are needed because of the large amount of DHB spending and because the environment changes quickly.

In 2017/18, we continued to find that many DHBs needed to improve security by strengthening passwords and ensuring that privileged and administrator access is restricted to those who need it. Ensuring that non-active accounts are deleted is another important step that should be more widely applied.

Several DHBs also need to prepare or update disaster recovery plans for their information systems. Given the extent to which DHBs rely on these systems, an up-to-date disaster recovery plan is essential.

Some DHBs rely on shared services providers for their information systems services. It is just as important for these DHBs to be satisfied that information and processes are secure, because responsibility remains with the DHB.

Questions to consider

• What is your level of confidence that your DHB’s information systems will be able to support the delivery of services in a reasonable time frame after a disaster?
• How secure are your DHB’s systems, and how do you ensure that you maintain information security at an appropriate level?
• What are you doing to ensure that your DHB’s information service providers have the protections and controls in place to protect your information?

2: The Fraud Control Improvement Kit is available on the New South Wales Audit Office’s website at www.audit.nsw.gov.au.