Appendix: Observations and questions from our 2019/20 audits of district health boards

This appendix provides insights from our work in the health sector, including our annual audits of district health boards (DHBs) and our performance audits of Covid-19 related matters. We also include a series of questions that could form the basis for conversations with management.

Results from our 2019/20 audits of district health boards

Despite the significant disruption caused by Covid-19, we were pleased that our audits did not find any significant deterioration in DHB control environments. DHBs made appropriate disclosures about the effects of Covid-19 in their 2019/20 annual reports. These included suspending some activities (such as planned surgeries) and starting others (such as testing services and supporting managed isolation).

One of the effects of Covid-19 was the deadline for DHBs’ 2019/20 annual reports being changed from 31 October to 18 December 2020. Despite the extended time frame, it was still a challenging audit round. We appreciate the efforts of DHB staff in preparing financial statements and performance information in these circumstances and working co-operatively with our auditors.

Below are some common themes from the 2019/20 audits of DHBs. We have not specifically covered asset management and procurement because these issues have not changed materially since we last wrote to you. However, they remain important functions for all DHBs and are a continuing focus for our audit work.

Holidays Act 2003

It is five years since we first reported on DHBs’ non-compliance with the Holidays Act 2003 and the liabilities arising from incorrect annual leave payments. It was pleasing to see the number of qualified opinions reduce from 19 in 2018/19 to nine in 2019/20. I expect this progress to continue.

However, the aggregate liability reported by DHBs in 2019/20 was $1.1 billion and continues to increase. This is money owed to current and former staff, which, in some cases, goes back more than 10 years. Progressing the payment of the money owed needs to be a high priority.

We note funding in Budget 2021 for the Ministry of Health to help co-ordinate the work to determine how much is owed. It is important that the health sector reforms do not slow progress and that DHBs work together and with the Ministry of Health to resolve outstanding issues and begin making payments to current and former staff.

Financial sustainability

In 2019/20, as in previous years, the question of whether a DHB was a going concern was a significant part of our audits. In 2019/20, we included an emphasis of matter paragraph in 18 DHB audit reports, which drew attention to the DHBs needing financial support from the Crown to meet their financial obligations. The aggregate DHB deficit was $1.049 billion, with only one DHB reporting a surplus and two DHBs reporting a result better than budget. Unbudgeted costs affected these results, in particular the provisions for Holidays Act liabilities, which increased by $386.5 million in 2019/20.

The Ministry of Heath reports a sector-wide deficit of $547 million for the 10 months to April 2021, which includes an additional $189 million for Holidays Act liabilities. The forecast year-end deficit at April 2021 is $740 million, which would be $343 million unfavourable to budget. It is too early to draw any definite conclusions on what these numbers mean, given that final reporting is not complete and results have not been audited. However, it is clear that DHBs continue to find it difficult to operate within their means.

Identifying and monitoring DHBs’ main financial risks will be particularly important in a year where these risks could be exacerbated by a changing environment.

In our letter on the main findings from the 2018/19 audits of DHBs, we noted that the extent and scale of DHB deficits was a problem that required a system response. We had started work looking at how the Ministry of Health and the Treasury supported DHBs to achieve financial sustainability. With the announcement of the health sector reforms, we had to reconsider how best to complete this work. This is because the objectives were focused on the existing relationships between entities, which will be fundamentally changed by the reforms.  

Information systems and information security

During the nationwide lockdown, we observed that DHBs’ information communications technology (ICT) systems generally coped well to allow remote working for back-office staff. Expansion of telehealth services was also successfully deployed in some areas. We did not note any major ICT-related disruptions in DHBs’ operations during the lockdown.

Information or “cyber” security has had a high profile since the recent attack on Waikato District Health Board’s ICT systems. We have noted improvements in recent years in most DHBs’ efforts to improve their information systems security. However, events at Waikato District Health Board show how high the risks are and how important it is for boards to ensure that they are giving enough attention and resources to mitigate them. There are several resources that boards can use for guidance, such as the 2021 edition of the Institute of Directors’ Cyber risk practice guide.¹

Given the pressures in the coming year, it would make sense to reassess your ICT risks in light of the multiple priorities and challenges you are facing (which we describe in the letter).

Performance audits and other work in the sector

Covid-19 vaccine roll-out

DHBs are tasked with administering the Covid-19 vaccinations and the Ministry of Health is responsible for the overall planning and design of the Covid-19 Immunisation Programme. The Covid-19 Immunisation Programme is demanding of DHBs during a period of significant change and ongoing service delivery pressures.

We published our report Preparations for the nationwide roll-out of the Covid-19 vaccine in May 2021. It looks at how ready the Ministry of Health and DHBs are to meet the Government’s vaccination goals. We found that the health sector was working hard to deliver the vaccination programme, but we were not yet confident that everything would be in place to scale up to vaccinate all eligible people by the end of 2021. We also found that the level of detail in DHBs’ plans for administering the vaccine in their communities varied. The short lead-times for developing these plans meant that some DHBs might not have engaged enough with health care providers to determine the best ways to reach certain communities, for example Māori, Pasifika, and people with disabilities. If that continues, there is a risk that the Covid-19 Immunisation Programme will not meet its equity objective to make the vaccine available to everyone.

Performance reporting

Most DHBs present information on their performance clearly and in a way that helps the reader understand what they are trying to achieve and how they are doing it. However, there are inconsistencies in what is reported across the sector. For example, one DHB reported close to 200 performance measures when all reported results (for example, by ethnicity or age) were included, and another DHB reported less than 40 performance measures. This inconsistency can make it difficult to compare information for affected communities and understand how the health system is performing overall.

We analysed performance data in DHBs’ annual reports to see what that might tell us about their performance over time. Figure 1 shows the percentage of DHB performance indicators from their statements of performance that were achieved during a 10-year period. Everything else being equal, the results suggest that DHBs found it increasingly difficult to achieve their targeted performance in the last three years. We acknowledge that the results for 2019/20 were likely affected by the response to Covid-19, but when considered alongside other years the results also appear to reflect a trend of declining performance.

Figure 1
Percentage of performance indicators achieved or substantially achieved by district health boards, 2010/11-2019/20

Figure 2 shows the percentage of performance indicators achieved or substantially achieved by output class during the last five years. This is the period when most DHBs started reporting results in these groupings.

Figure 2
Percentage of performance indicators achieved or substantially achieved by output class by district health boards, 2015/16-2019/20

The output classes with the largest declines were “Prevention services”, which includes services such as immunisation and health promotion, and “Intensive assessment and treatment”, which covers most hospital services and accounts for more than 60% of DHB expenditure. This suggests (again all other things being equal) that DHBs are finding it increasingly difficult to deliver both their core hospital-based services and services designed to prevent people needing hospital care. The only relatively stable output class, in terms of performance indicators achieved, is “Rehabilitation and support services”, which averaged 13% of overall expenditure.

Although our analysis above is superficial and only indicative, performance information is a vital management and governance tool. It helps robust decision-making – including identifying activities that need more focus and attention – and re-prioritising resources. You might want to consider whether your board is receiving the right performance information on a regular basis to help you with these decisions.

Questions for consideration by governance

Integrity

• Has your DHB reviewed the Office of the Auditor-General’s good practice guide Controlling sensitive expenditure: Guide for public organisations and considered changes to existing policies where appropriate?
• As a board, how do you ensure that the “tone from the top” supports a culture of integrity throughout the organisation?
• Do you understand and monitor the key integrity risks for your DHB?

Information systems and technology

• How confident are you that your DHB has a good understanding of the current ICT environment and the attendant risks?
• Is there sufficient oversight, at the board level, of strategic information system projects and key information system risks?
• How are you ensuring that providers of your DHB’s information services have the controls in place to protect your information?

Fraud awareness, prevention, and detection

• Significant organisational change can heighten the risk of fraud. Has your DHB carried out a risk assessment of where it is most vulnerable to fraud, and have you reviewed those areas identified as high risk?
• Are controls operating effectively to mitigate fraud risks?
• Is your DHB’s fraud policy up to date?
• Does your DHB have a programme of fraud awareness that might include regular reminders to staff about the fraud policy and their responsibilities?

Asset management

• Does your DHB know how well its assets meet current and expected service delivery needs?
• Does your DHB have reliable information about critical assets and their condition?
• Do you have, or can you access, the right capability to deliver on significant capital projects?
• Does your DHB use information from asset management planning to inform financial forecasts and strategic planning?

Procurement and contract management

• Does your DHB have an up-to-date procurement strategy? Does the strategy cover both provider and funder arms and include the DHB’s medium-term procurement and contracting needs?
• How does your DHB get assurance that contracted health care service providers are providing value for money? Is your policy on market testing these services appropriate?
• Does your DHB have comprehensive and up-to-date procurement policies, guidance, procedures, and templates that cover all activities and forms of procurement (including contracts with health care providers and non-government organisations)?
• Does your DHB have the right number of staff with the appropriate skills, knowledge, and expertise in the right structure to deliver effective procurement and contract management?
• Does the board get the right level of regular reporting on procurement, contract spending, and other issues so that it can carry out its oversight and governance role effectively?

Covid-19 vaccine roll-out

• How are you monitoring the Covid-19 vaccine roll-out in your district and the risks to achieving the objectives?
• What is your DHB doing to ensure that there is equitable access to the Covid-19 vaccine, including to Māori, Pasifika, people with disabilities, and people living in harder-to-reach communities?

Performance information and management

• Are you confident that, at the board level, you are getting the right information on non-financial performance regularly enough to help with decision-making and prioritising resources?

1: Institute of Directors (2021), Cyber risk practice guide: Five principles for board oversight of cyber risk, at iod.org.nz.