Risky business

As NHS boards turn their thoughts from addressing the immediate crisis towards restoration and recovery, GGI recommends devoting a board seminar session to strategic objectives and thinking through the risk environment ahead.

Today, we publish a new board assurance prompt on the subject of risk appetite for boards, to help guide these important discussions.

With COVID-19 patients likely to be in NHS care for up to six months beyond the successful introduction of a vaccine next year, and with significant social interruption through periods of varied levels of lockdown, everything will have changed. It is indeed new, unprecedented and challenging before it will ever be normal.

This month, McKinsey identified three things that boards must do:

1. Don’t increase management’s burden: a board should just urge management to develop a strategic crisis-action plan to guide the organisation’s response across all relevant time horizons and simply request the same standard reports on the up-to-date scenarios and actions that management reviews.

2. Augment management capacity: interact with stakeholders, governments, regulators, debt holders, employees and regular customers.

3. Frame the post-crisis strategy: how will my industry and my ecosystem be reshaped by this crisis and what strategies should our organisation pursue to emerge as a leader?

Strategic objectives

Changes to strategic objectives and the risk environment will need to be managed through the board assurance framework (BAF), a key document which should be driving the board and committee agendas.

Boards will clearly need to be taking what Professor Mervyn King calls ‘an integrated, collaborative and compromising approach’ to steering their organisation. This fits well with the NHS Long Term Plan, which moves away from an NHS structurally designed to deliver improvements through competition to one based around collaboration within natural health and social care systems.

GGI recommends that as boards move on from emergency governance arrangements there will be as much in terms of working style they will wish to keep as there will be to return to. Think in particular of retaining virtual meetings and the much sought-after nirvana of many NHS chairs, non-executives and executives alike: short, focused agendas and papers.

The BAF is, in GGI’s view, the original invest-to-save scheme for boards. Time spent on getting the various elements of the BAF right will help boards streamline assurance, locate where and how assurance is tested and develop proportionality to board reporting.

Risk appetite

Key to this will be boards taking responsibility for identifying their risk appetite and risk tolerance for each strategic objective and agreeing what is sufficient in terms of controls (management actions to avoid or mitigate risks) and the assurances that the controls are operating effectively.

As soon as practical, and certainly before the end of June 2020, boards should have set aside time for uninterrupted attention to re-asserting or refreshing their strategic objectives and appraising the risk appetite they will need to have a realistic chance of achieving these. They will also need to look at the risk tolerance they are content with accepting and what this means for how assurance and board reporting are accordingly arranged.

Specifically, boards should consider through the lens of risk:

• patient safety
• staff welfare
• decision-making around treatment criteria, specifically involving the rationale for DNAR decisions for patients with COVID-19 – usually this will involve a line of sight to the trust’s ethics committee (or similar forum), which should be residing within the clinical management of the trust
• non-COVID-19 patients – again, guided by the trust’s ethics committee or similar forum
• senior management ‘cover’ and plans for significant person absence through illness
• financial matters – being prepared for later questions that will inevitably come
• cyber risks
• system decisions that may be taken with emergency powers
• the effects of on/off lockdown on staff, patients and suppliers
• people issues, including new normal issues such as home working
• restoration and recovery

It will be important not to regard these issues as just of the moment, but as enduring until at least the end of 2021. Without doing this, boards risk a failure of control or a breach of their control environment.

As a reminder of the various responsibilities around the board risk system and the BAF, GGI uses this diagram.

Call to action: all NHS boards should now set aside a development session in May or June to address the issues in this briefing. GGI has developed new guidance on risk appetite for boards which will help with these sessions and developing a new BAF.

We are keen to hear your views. If this briefing prompts any questions or comments, please call us on 07732 681120 or email us at advice@good-governance.org.uk. We will aim to respond within 24 hours.