Financial Management and Internal Control – Follow Up

23 July 2025

R.118/2025

jerseyauditoffice.je

The purpose of the Comptroller and Auditor General (C&AG), fulfilled through the Jersey Audit Office (JAO), is to provide independent assurance to the people of Jersey on the extent to which public money is spent economically, efficiently and effectively and on whether the controls and governance arrangements in place within public bodies demonstrate value for money. The C&AG's remit includes the audit of financial statements and wider consideration of public funds, including internal financial control, value for money and corporate governance.

This report can be found on the Jersey Audit Office website at https://www.jerseyauditoffice.je/

If you need a version of this report in an alternative format for accessibility reasons, or any of the exhibits in a different format, please contact enqu[email protected] with details of your request.

All information contained in this report is current at the date of publication.

The Comptroller and Auditor General and Jersey Audit Office are not responsible for the future validity of external links contained within the report.

All information contained in this report is © Copyright Office of the Comptroller and Auditor General and the Jersey Audit Office, with the exception of extracts included from external sources, which are © Copyright to those external sources.

The information contained in this report is for non-commercial purposes only and may not be copied, reproduced, or published without proper reference to its source. If you require the material contained in the report for any other purpose, you are required to contact [email protected] with full details of your request.

Report by the Comptroller and Auditor General: 23 July 2025

This report has been prepared in accordance with Article 20 of the Comptroller and Auditor General (Jersey) Law 2014.

Contents

Summary  4

Introduction  4

Key findings  5

Conclusions  7 Objectives and scope of the audit 8 Detailed findings

  Overall financial management 9

Overall internal control 17

Risk management  25

Internal audit  30

Financial management and internal control in HCJ 34 Appendix One – Audit Approach  43 Appendix Two – Evaluation of the implementation of previous recommendations 47 Appendix Three – Summary of Recommendations and Areas for Consideration 55

Summary

Introduction

1. Effective financial management and internal control are essential underpinnings for the delivery of economic, efficient and effective public services.
2. Financial management is pivotal in meeting policy aims, monitoring progress against goals and objectives, and ensuring scarce resources are utilised effectively. A lack of sound financial management increases the risk that the States of Jersey will not set the right priorities, deliver on their responsibilities to provide good value for money and exercise their responsibilities to the taxpayer, as set out in the Public Finances (Jersey) Law 2019.
3. Good internal control ensures that operations are efficient, effective and in line with laws and policy objectives. Internal control processes can protect the States of Jersey from fraud, corruption, waste and abuse of resources and help in measuring value for money, assessing risk, and ensuring compliance with laws, regulations and policies.

4. Financial management and internal control processes the States of Jersey to:

• make timely and well-informed decisions

• unlock efficiencies and drive better ways of working;

– when done well – enable  and

• improve financial resilience and enhance their ability to adapt and respond to shocks and disruptions.

5. In September 2019, the then Comptroller and Auditor General (C&AG) issued a report Financial Management and Internal Control. The report followed up on findings from a number of previous reports and evaluated the progress made in implementing agreed recommendations, the extent to which the recommendations as implemented addressed the improvement areas identified and the adequacy of plans for the implementation of any outstanding recommendations. The 2019 report contained 33 recommendations.
6. Since publication of the report in 2019, the Public Finances (Jersey) Law 2019 has been introduced, supplemented by the Public Finances Manual. These provide the framework within which all States transactions must take place.
7. Effective risk management is a significant element within an effective internal control framework. In October 2022, I issued a report Risk Management – Follow

Up. The review followed up recommendations made in 2017 and looked at corporate arrangement as well as arrangements within departments. The report contained ten recommendations, four areas of planned work that should be prioritised and seven areas for consideration. The Government of Jersey has assessed that all ten recommendations have been implemented.

8. This follow up audit has evaluated the effectiveness of, and compliance with, the arrangements put in place by the States of Jersey to establish and maintain effective financial management and internal control.
9. It has evaluated overall arrangements as well as undertaking a more focussed review of how these arrangements operate within the (then) Health and Community Services Department, now Health and Care Jersey (HCJ).

Key findings

10. Only three of the 36 previous recommendations followed up as part of this audit have not been implemented. Seven recommendations have been partly implemented and 26 recommendations have been implemented in full by the States.
11. The financial management and internal control framework has been improved significantly since the introduction of the Public Finances (Jersey) Law 2019 and the Public Finances Manual (PFM). The PFM provides guidance and rules by which to manage finance and internal controls.
12. Government Plans identify growth funding allocated to departmental budgets. There have been examples of growth funding awarded and subsequently built into departmental base budgets for projects that have not been delivered.
13. More generally, aligning budgets to service operational and workforce plans (which are still in development) has the potential to improve the effectiveness of financial management.
14. Under the PFM all departments are required to document a Scheme of Delegation. At the time of my fieldwork all departments apart from HCJ had a Scheme of Delegation in place to ensure proper governance and financial control. A Scheme of Delegation for HCJ was approved on 20 February 2025. The absence of a Scheme of Delegation in HCJ prior to 20 February 2025 represents a significant weakness in financial management and internal control. There is a risk that decisions on finance and procurement have been made by staff who do not have sufficient authority, seniority or experience.

15. A survey of States departments undertaken in June 2024 reported high levels of customer satisfaction, responsiveness and value received from Finance Business Partners. The Group Director for Finance Business Partnering and Analytics has led a programme over the last few years to ensure that Finance Business Partners are upskilled and qualified. A programme to deliver quality and consistency is also in progress and needs to be evaluated and refined as necessary.
16. The IT system Connect Finance was implemented on 1 January 2023. This system provides the framework in which financial management is now operating. Initially the processes for providing financial reporting to budget holders were inefficient and somewhat cumbersome. New reporting functionality has however been developed and implemented from January 2025 with training rolled out across all budget holders. The benefits of improved management information from Connect Finance are therefore only just beginning to be realised.
17. In addition to reporting for internal financial management purposes, the States Assembly has placed specific additional requirements on public reporting. These include reporting on the use of consultants (P.59/2019) and reporting on the top 100 suppliers (P.56/2020). There have however been significant delays in the production and publication of these reports. It is an opportune time to consider whether amendments should be made to reporting requirements to assist in more cost effective production of information on suppliers and use of consultants.
18. I have identified a number of examples that evidence that some Accountable Officers are not consistently meeting the requirements placed on them. The weaknesses identified include the:

• absence of a Scheme of Delegation in place within HCJ prior to 20 February 2025

• level of procurement breaches

• level of non-compliance issues reported year on year; and

• findings from Internal Audit that include the same areas of weakness reported year on year.

19. Significant improvements have been made in the process and documenting of risk in risk registers. However risk management is still in some areas seen as a process of identification and classification, rather than a live document to manage the business risks and mitigations.
20. A paper was submitted to the Executive Leadership Team (ELT) in September 2024 which outlined the Government risk appetite. This had yet to be evaluated at the time of my audit work, and there is still a lack of alignment between the risk

appetite and the Risk Management strategy. Decisions on risk appetite are awaited from ELT and will then need to be reviewed by the Council of Ministers to ensure that the risk appetite reflects resources and priorities.

21. Internal audit is provided by a well-qualified team supplemented by specialist external resources which achieves a good balance between generalist and specialist skills. There have however been some challenges in delivering the internal audit plan.
22. The Government Risk and Audit Committee and the Non-Ministerial Departments Audit Committee contribute to the overall internal control framework. There are opportunities to strengthen the way in which these committees discharge their responsibilities.
23. In each of the last five years HCJ has spent more than the initial budget allocated to the department in the Government Plan (after adjusting for pay awards and excluding COVID-19 pandemic budgets and expenditure). While some of the expenditure increases have been due to the costs associated specific unforeseen events, others relate to more general cost pressures. While it is not possible to quantify the extent to which these financial pressures could have been alleviated by better financial management and internal control it is clear that significant improvements are required in both areas within HCJ.

Conclusions

24. The States of Jersey have taken action to improve financial management and the internal control framework since the publication of my predecessor's report in 2019.
25. Further work is required however to enhance the monitoring of expenditure, to improve compliance with the internal control framework and to deliver benefits from investment in IT systems. In addition, the States should ensure that they implement actions in response to audit recommendations in a more timely manner.

Objectives and scope of the audit

26. This audit has evaluated the effectiveness of, and compliance with, the arrangements put in place by the States of Jersey to establish and maintain effective financial management and internal control.
27. It has evaluated overall arrangements as well as undertaking a more focussed review of how these arrangements operate within HCJ.
28. The report is structured into areas examined as part of the audit, as set out in Exhibit 1.

Exhibit 1: Areas examined as part of the audit

Overall financial

management Overall internal control Risk management

Financial management Internal audit and internal control in HCJ

29. The audit approach and audit criteria used for this review are detailed in Appendix One.

Detailed findings

Overall financial management

30. The Public Finances (Jersey) Law 2019 (the 2019 Law) and the Public Finances Manual (PFM) prescribe the financial management and internal control frameworks for States bodies.
31. I have considered the following aspects of overall financial management:

• leadership, governance and culture

• skills and capabilities

• financial planning; and

• data and management information.

32. I have also evaluated the status of previous C&AG recommendations relating to financial management.

Leadership, governance and culture

33. My follow up audit has assessed whether the States of Jersey have set the right tone from the top to secure strong governance and oversight of finances.
34. The 2019 Law places specific responsibilities on:

• the Minister for Treasury and Resources – who is required to ensure that the public finances of Jersey are regulated, controlled and supervised in accordance with the Law. In doing so the Minister is required to issue the PFM

• the Treasurer – who is responsible for supervising the administration of the Law, ensuring proper stewardship and administration of the public finances of Jersey; and establishing a system of internal auditing (including the designation of an individual as the Chief Internal Auditor); and

• the Principal Accountable Officer – who is responsible for ensuring the propriety and regularity of the finances of States bodies other than Non- Ministerial States bodies and ensuring resources are used economically, efficiently and effectively. The Principal Accountable Officer may appoint accountable officers and delegate functions to them.

35. The PFM has been in place since 2019 and sets out best practice, high level principles and requirements for financial management. Comprehensive arrangements are in place to maintain and develop the PFM. The PFM requirements are mandatory unless an exemption has been approved by the Treasurer or an officer delegated by the Treasurer.
36. If an Accountable Officer (AO) is directed by the Council of Ministers (CoM), a Minister or the Principal Accountable Officer (PAO) to follow a course of action that they consider infringes the requirements of propriety or regularity or their wider responsibility to ensure economy, efficiency and effectiveness, they must request a written Letter of Instruction. Since the PFM was introduced in 2019, 12 Letters of Instruction had been issued up to February 2024. A further Letter of Instruction was issued on 22 June 2025.
37. Departments are required to document a Scheme of Delegation under the PFM. The Scheme of Delegation explains the responsibilities of delegated officers. It ensures that all financial responsibilities have a delegated responsible officer and in doing so reduces risk within the department. At the time of my fieldwork all departments apart from HCJ had a Scheme of Delegation in place to ensure proper governance and financial control. A Scheme of Delegation for HCJ was approved on 20 February 2025. The absence of a Scheme of Delegation in HCJ prior to 20 February 2025 represents a significant weakness in financial management and internal control. There is a risk that decisions on finance and procurement have been made by staff who do not have sufficient authority, seniority or experience.
38. Since 2017 the external auditor of the States of Jersey has been required to provide a specific regularity opinion each year on whether in all material respects:

• the Statement of Outturn Against Approvals properly presents the outturn against the budget approved by the States Assembly for the year and shows whether those totals have been exceeded; and

• the income and expenditure relating to the States of Jersey Core Entities in the Statement of Comprehensive Net Expenditure for the year have been applied to the purposes intended by the States Assembly and the financial transactions recorded in the financial statements conform to the authorities which govern them.

39. The States' external auditors have issued unqualified regularity opinions in all years since 2017 except for 2021 when one transaction that was material in nature did not meet the requirements of the PFM.
40. The Chief Internal Auditor issues an annual opinion. Over the last five years, the annual opinion from the Chief Internal Auditor has reported consistent areas of

weakness in financial management and internal controls. These include weaknesses in respect of:

• IT systems and cyber security

• programme and project management

• estates management and capital maintenance; and

• grants and contracts management.

41. The actions being taken on the areas of weakness reported by Internal Audit and resulting in the qualification have not yet been sufficient to improve the Internal Audit Annual Opinion.
42. The States maintain a log of both exemptions to and breaches of the PFM procurement requirements. Exhibit 2 shows the number of procurement breaches and exemptions raised for the last two years.

Exhibit 2: Number of PFM procurement breaches and exemptions raised in 2023 and 2024

60 50 40 30 20 10 0

Jul-23 Jul-24

Jan-23 Feb-23 Mar-23 Apr-23 May-23 Jun-23 Aug-23 Sep-23 Oct-23 Nov-23 Dec-23 Jan-24 Feb-24 Mar-24 Apr-24 May-24 Jun-24 Aug-24 Sep-24 Oct-24 Nov-24 Dec-24

Breaches Exemptions Source: Treasury and Exchequer analysis of breaches and exemptions

43. In total, there have been 420 recorded procurement breaches in 2023 and 2024, of which 380 were acknowledged retrospectively. There were 649 procurement exemptions recorded for the same period of which 475 were approved.
44. The total value of breaches and exemptions in 2023 was £467 million. This reduced to £214 million in 2024. The departments that previously comprised the

Chief Operating Office recorded the highest number of breaches and exemption requests in both 2023 and 2024 (141 in 2023 and 119 in 2024) followed by the Infrastructure and Environment Department (I&E) (132 in 2023 and 75 in 2024). The average value of breaches and exemptions was highest for I&E in 2023 (£1.7 million) and for HCJ in 2024 (£1.6 million). The reasons underlying the breaches and exemptions recorded in the documentation provided by the Treasury and Exchequer Department include:

• direct award represents better value for money (38%)

• single supplier or bespoke item (18%); and

• urgency (excluding poor planning) (14%).

45. My Report Use of Consultants – Follow Up (March 2024) identified weaknesses in procurement procedures and contract management and made recommendations for improvement. I also identified instances where exemptions had been approved with insufficient evidence to support the exemption. I recommended that Government should enhance the management information produced, reviewed and challenged in respect of expenditure to include:

• the production and maintenance of contracts registers at department and States-wide levels

• regular review and challenge of proposed procurement breaches and exemptions by Departmental Finance Business Partners

• regular reporting of procurement breaches and exemptions to Senior Leadership Teams (SLTs), the Government Risk and Audit Committee and the Non-Ministerial Departments Audit Committee; and

• regular reporting of retrospective supplier approvals to SLTs, the Government Risk and Audit Committee and the Non-Ministerial Departments Audit Committee.

46. While some new processes and procedures have been introduced to enhance controls, this recommendation has yet to be implemented fully.

Skills and capabilities

47. Strong financial management is dependent on professional and technical skills.
48. The majority of staff with professional financial skills sit within the Treasury and Exchequer Department (T&E). This consolidates expertise into one place and is intended to drive consistency. There is an extensive offer in respect of professional accountancy training and continuous professional development as well as internal training in respect of topics such as risk management, PFM and governance.
49. T&E allocates a Finance Business Partner (FBP) or team to each department. For larger departments such as I&E, Children, Young People, Education and Skills (CYPES) and HCJ there is a dedicated FBP team which is managed by a Head of Finance Business Partnering; within these teams, FBPs will manage a directorate or a portfolio of teams. For other smaller departments, the Head of Finance Business Partnering has responsibility for several departments for which there will be a nominated/dedicated FBP. This enables the FBP team to build their understanding of the respective business area and to build constructive relationships with their budget holders.
50. Since 2023, the HCJ operational model has been altered to reflect the establishment of the Financial Recovery Plan Programme; an interim position was appointed as Finance Lead for the programme in HCJ as a member of the Health Department's Executive Team. It was also agreed to increase the capacity of the dedicated Finance Business Partnering Team for HCJ, by increasing the number of staff in the team and the introduction of a Deputy Head of FBP role in this team, in recognition of the additional support and challenge that would be necessary by the establishment of a Financial Recovery programme. The Finance Lead – Change Team is aligned on a part time basis to T&E through the Group Director for Finance Business Partnering and Analytics.
51. The FBPs have specific responsibilities set out in the PFM. These responsibilities include aspects of governance, internal control and reporting and scrutiny. FBPs also have a role in providing support and training to budget holders.
52. The Group Director for Finance Business Partnering and Analytics has led a programme over the last few years to ensure that FBPs are upskilled and qualified and has actively embarked on a programme to deliver quality and consistency. This is still in progress and needs to continue to be evaluated and refined.
53. A survey of States departments undertaken in June 2024 reported high levels of customer satisfaction, responsiveness and value received from FBPs.

54. My predecessor recommended that a full review be undertaken of the Business Partnering model. Now that the refinements to the financial management information systems have been implemented, and automated, the FBPs should have the capacity to deliver the full range of duties set out in the PFM. It may also now be an opportune time to undertake the recommended review of the Business Partnering model.

Financial planning

55. If financial management is to be fully effective it should be integrated with strategic and corporate planning at all levels.
56. The priorities and budget cap are set by the CoM. The strategic finance team within T&E then establishes a high-level framework from which department budgets are constructed. The Executive Leadership Team (ELT) and AOs are advised on issues connected with growth funding and opportunities for savings.
57. My predecessor recommended the enhancement of arrangements for the scrutiny of existing expenditure, including development of a programme of zero-based budget reviews; and ensuring that savings are identified in sufficient time that no unidentified savings are included in the Government Plan when lodged.
58. This recommendation has been partially implemented. The implementation of the programme of zero-based budget reviews was disrupted by the COVID-19 pandemic response. In my report on Efficiency Savings (March 2023) I noted that the arrangements to support the identification of efficiency savings have lacked both granularity and data integrity.
59. I have recently published a Good Practice Guide to Efficiency Savings (June 2025) to assist departments and other organisations in identifying, planning and realising efficiency gains.
60. Government Plans identify growth funding allocated to departmental budgets. Control over the use of growth funding is the responsibility of AOs. There have been examples of growth funding awarded and subsequently built into departmental base budgets for projects that have not been delivered.

Data and management information

61. Effective financial management requires financial reporting that is timely and meets user needs. The use and development of data to improve the quality of financial management information systems and processes should be an ongoing activity.
62. The IT system Connect Finance was implemented on 1 January 2023. This system provides the framework in which financial management is now operating. Initially the processes for providing financial reporting to budget holders were inefficient and somewhat cumbersome.
63. New reporting functionality has however been developed and implemented from January 2025 with training rolled out across all budget holders. The benefits of improved management information from Connect Finance are therefore only just beginning to be realised.
64. In addition to reporting for internal financial management purposes, the States Assembly have placed specific additional requirements on public reporting. These include P.59/2019 reporting on the use of consultants and P.56/2020 reporting on the top 100 suppliers. There have however been significant delays in the production and publication of these reports. The most recent published P.59/2019 report was for the year ended 31 December 2023 and was published in October 2024. The most recent published P.56/2020 report was for the year ended 31 December 2022 and was published in September 2023.
65. In my Report Use of Consultants – Follow up (March 2024) I recommended that Government streamline the process for compiling the P.59/2019 reports and consider whether to recommend amendments to the report requirements to the States Assembly to assist in more cost effective production. It is an opportune time to consider whether amendments should be made to reporting requirements to assist in more cost effective production of information on suppliers and use of consultants.

Evaluation of the implementation of previous recommendations

66. I have followed up the current status of the recommendations relating to financial management made in my predecessor's report on Financial Management and Internal Control (September 2019). Appendix Two contains more information. It is pleasing to see that the majority of previous recommendations have been implemented with ten recommendations fully implemented and four recommendations partly implemented. Only two of the recommendations followed up as part of this audit had not yet been implemented. More work is required to provide challenge and assurance over departmental expenditure.

Recommendation

R1  Enhance the management information produced, reviewed and challenged in

respect of departmental expenditure to include:

• regular reporting of procurement breaches and exemptions to Senior Leadership Teams, the Government Risk and Audit Committee and the Non - Ministerial Departments Audit Committee; and

• links to operational service and workforce plans.

Areas for consideration

A1  Consider undertaking a review of the Finance Business Partner model to ensure

that Finance Business Partners are able to fulfil the role as set out in the Public Finances Manual.

A2  Consider how to identify real efficiency savings by using performance data linked

to financial data.

Overall internal control

67. I consider the following aspects of internal control within this section:

• overall corporate governance and internal control framework

• compliance with the corporate governance framework; and

• the role and functions of audit committees.

68. I consider risk management and internal audit (both of which form part of the overall governance and internal control framework) in the subsequent sections of this report.

Overall corporate governance and internal control framework

69. A States of Jersey Corporate Governance Framework is in place which documents nine principles of good governance, each with a number of underlying statements that provide further detail. Against each of the underlying statements are recorded the Laws, policies, codes of practice (including the PFM) and other arrangements that, taken together, make up the overall Framework.
70. The Framework is managed by a cross-departmental group of senior officers (Corporate Governance Framework Group), that is expected to meet at least quarterly to agree changes and consider how the Framework may be used in practice. The Terms of Reference for the Corporate Governance Framework Group state that its purpose is to agree and progress all matters relating to documentation and maintenance of the Corporate Governance Framework ("the Framework") for the States of Jersey'.
71. The Corporate Governance Framework Group (CGFG) has a number of more detailed responsibilities which cover the maintenance and assessment of the effectiveness of the Framework, including training. During 2023 and 2024 the CGFG only met on three occasions. At the time of my fieldwork, the most recent meeting was held on 11 July 2024 when there was insufficient time to complete all items on the agenda.
72. As currently constituted the CGFG is not undertaking activities that assess the effectiveness of the Corporate Governance Framework. I understand that officers are considering a refresh of the CGFG's Terms of Reference with a view to re- purposing the CGFG. I welcome this development and consider that a newly constituted CGFG could ensure more action is taken on areas of weak governance.

73. The PFM is a critical part of the overall internal control framework. It provides detailed and thorough principles, requirements and guidance on all aspects of financial governance and internal control.
74. Comprehensive arrangements are in place to maintain and develop the PFM. The Public Finances Manual Management Group (PFMMG) meets regularly to assess and propose changes to the PFM. All proposed changes are consulted on before being recommended to the Treasury and Resources Minister for approval.
75. A training programme is in place on the PFM that can be accessed by AOs and other staff with finance responsibilities.

Compliance with the Corporate Governance Framework

Accountable Officer responsibilities

76. The PFM places specific responsibilities on AOs in terms of compliance activities. These include that AOs must:

• ensure that there are procedures in place to ensure proper control and assurance frameworks exist throughout the States Body. Internal and external audit findings assess and test internal controls and performance, and these audit findings should be used in conjunction with other measures to continually improve internal controls and performance

• be aware of their roles and responsibilities as set out in their appointment letters. In addition, they must always ensure that the standard of financial management is in compliance with the provisions of the 2019 Law, the PFM and any additional policies. Where a deviation from policy may be required, the decision and rationale should be documented and appropriate approval obtained through the use of the exemption and breach processes where necessary

• promote prudence and the economic, efficient and effective use of all resources at all times, and in particular by ensuring the prevention and detection of fraud, error and wasteful practices as well as correcting them as appropriate and the establishment and maintenance of sound systems of internal control that support the achievement of the set policies, aims and priorities. The systems of internal control are designed to respond to and manage the whole range of risks that an organisation faces

• ensure that there is a standard of financial management in their area of responsibility which meets or exceeds the requirements of the Government of Jersey Financial Reporting Manual and the PFM; and

• document and operate a Scheme of Delegation for their States Body which segregates duties as appropriate for authorisation relating to expenditure transactions. The Scheme of Delegation must also specify who is able to sign contracts. The Scheme of Delegation must be submitted to the Treasurer for approval.

77. I have identified a number of areas where there are examples of evidence that some AOs are not consistently meeting the requirements placed on them. The weaknesses identified include the:

• absence of a Scheme of Delegation in place within HCJ until February 2025

• level of procurement breaches (as outlined in Exhibit 2)

• level of non-compliance issues reported year on year in AO governance statements; and

• findings from internal audit that include the same areas of weakness reported year on year.

Annual Governance Statements

78. Each AO is required to complete an Annual Governance Statement questionnaire that asks how the Framework is applied in their area of responsibility, and the grounds supporting their belief that they comply with requirements contained in the Framework. As part of the questionnaire AOs are required to complete a declaration that they have complied with their appointment as set out in their AO appointment letter and the Public Finances (Jersey) Law 2019; or express any deviations from that which have been made known or otherwise to the PAO.
79. I have identified two areas of weakness in the 2024 Annual Governance Statement questionnaire:

• Question 6.1 asked if the AO has complied with the Public Finances (Jersey) Law 2019 and Manual (including completion of any breaches and exemptions) during the year. It only requires the AO to provide the number of breaches and exemptions in answer to the question. It does not require information regarding compliance with all requirements of the PFM.

• Question 14.1 in the 2023 questionnaire was removed from the 2024 questionnaire. It asked whether any other assurance work has been carried out to ensure that systems of internal control are adequate in principle and

complied with in practice, since the last governance statement. The result of this removal is that the assurance work carried out by a department is not now recorded in the questionnaire.

80. The completed questionnaires form part of the body of evidence used for the Governance Report included in the States of Jersey Annual Report and Accounts. The Governance Report is signed by the PAO and the States Treasurer.
81. While AOs are acknowledging in their governance questionnaires that there are clear non-compliance issues, it is much less clear what action is being taken, and who is taking it, to address the weaknesses identified. Progress with completion of governance questionnaires is reviewed by the CGFG. The Terms of Reference for the CGFG do not require it to review the questionnaires and to review any action being taken to rectify the weaknesses in corporate governance and internal control identified by the questionnaires. My review of completed questionnaires noted that the same weaknesses are generally reported on successive questionnaires.

Principal Accountable Officer (PAO) responsibilities

82. The PFM places specific responsibilities on the PAO in respect of the governance framework. These include:

• ensuring the propriety and regularity of the finances of States Bodies (other than the Non Ministerial Bodies), specified organisations and States Funds

• ensuring that the resources of States Bodies (other than the Non Ministerial Bodies), specified organisations and States Funds are used economically, efficiently and effectively

• ensuring that Accountable Officers carry out the functions allocated to and expected of them

• carrying out the functions of an Accountable Officer where an appointee is unable to meet their obligations

• obtaining written authority from the Chief Minister, Minister or Council of Ministers before taking an action which is considered to be inconsistent with the proper performance of the functions of the Principal Accountable Officer.

83. At the end of each financial year, the PAO must sign off the States of Jersey's overall Governance Statement. The PFM states that this shall be an amalgam of responses received from Accountable Officers'. The PFM also requires the PAO to take note of the Governance Statements signed by the individual AOs'.
84. While there are procedures in place for review of AOs' governance statements by the CGFG I did not identify robust procedures to ensure remedial action is

undertaken to rectify weaknesses and did not identify specific consequences or sanctions associated with the lack of effectiveness in internal controls and lack of compliance being observed and reported.

Audit Committees

85. There are two audit committees in place as part of the overall internal control assurance framework:

• Government Risk and Audit Committee; and

• Non-Ministerial Departments Audit Committee.

Government Risk and Audit Committee

86. The Government Risk and Audit Committee has been established as a non - statutory body to support the Government of Jersey in delivering its responsibilities for risk management, internal control, governance and audit. The Committee's role is to review and provide independent advice to the Chief Executive, as PAO, Minister for Treasury and Resources, Treasurer and, in exception, the CoM, on the completeness, reliability and integrity of assurances as they relate to their responsibilities under the Public Finances (Jersey) Law 2019 and as set out in the PFM.
87. The Committee acts in an advisory role as an internal assurance body and supports the Government of Jersey to fill its governance responsibilities, providing oversight of the Internal and External Audit and Risk Management functions. The Committee also provides a source of assurance to the Government of Jersey that is taken into account as part of the preparation of the Annual Report and Accounts.
88. As such the Committee is a critical element of the overall arrangements for ensuring sound internal control. It does this over the course of the year by scrutinising elements of governance and obtaining assurances where appropriate.
89. The administrative support to the Committee is currently managed by Internal Audit and the Chief Internal Auditor is the key senior point of liaison for the Committee. One of the roles of the Committee however is to provide oversight of the internal audit function. It would be more appropriate for the senior point of liaison to be independent of any function over which the Committee has oversight. This would strengthen the role of the Committee and its ability to scrutinise and challenge all sources of assurance.

90. The Committee is required to advise on the adequacy of the arrangements put in place to assess and respond to the findings and recommendations contained in reports issued by the C&AG, Public Accounts Committee, regulatory bodies and on the results of internal audit work. There is an opportunity however to strengthen the approach adopted by the Committee in these areas. The Committee receives presentations from different departments at each meeting. These presentations do not focus sufficiently on key areas of risk and on key control weaknesses identified by internal audit and external audit, regulators and the Public Accounts Committee.

Non-Ministerial Departments Audit Committee

91. This Committee is a non-statutory body established voluntarily by the Non - Ministerial Departments (NMDs) following a recommendation made by my predecessor in 2019.
92. The Committee's remit covers seven very different and unique NMDs, each of which has operational independence from the Government and from each other. Its role is to consider whether each NMD (considered independently of the other NMDs) has used and is using the resources allocated to it economically, efficiently, and effectively and to consider whether satisfactory governance arrangements, including risk management, are in place.
93. The establishment of the Committee and the work it has undertaken to date is a welcome enhancement to the internal control environment within the States of Jersey. The Committee has sought to progress a number of areas with each of the NMDs. The Chair has written to each of the NMDs setting out progress to date and opportunities to strengthen arrangements in place. The establishment of the Committee has contributed to closer working between NMDs.
94. The responsibility of the Committee under its Terms of Reference to assess whether the resources allocated to NMDs have been used efficiently and effectively has not been addressed in the work undertaken to date. Some of the NMDs have voluntarily implemented external oversight and/or inspection arrangements, for example the Lexcel assessment of the Law Officers' Department and the Probation Board's oversight of that service. Any work undertaken by the Committee should, where relevant, draw on other arrangements already in place and should not require additional resources.
95. The Minister for Treasury and Resources and the States Treasurer have responsibilities under the 2019 Law for ensuring that the public finances of Jersey are regulated, controlled and supervised in accordance with this Law. Holding periodic meetings between the Committee and the Minister for Treasury and Resources or the States Treasurer would help to provide advice and assurance to

the Minister and the Treasurer to support the Governance Report in the States of Jersey Annual Report and Accounts.

Status of previous recommendations

96. I have followed up on the current status of the recommendations relating to internal control made in my predecessor's report on Financial Management and Internal Control (September 2019). Appendix Two contains more detail. It is pleasing to see that the majority of previous recommendations have been implemented with seven recommendations fully implemented, two partly implemented and only one not yet implemented.

Recommendations

R2 Review the Terms of Reference of the Corporate Governance Framework Group.

In doing so consider:

• the role it should perform in providing assurance on internal control compliance; and

• how frequently the Group should meet to ensure it discharges its responsibilities.

R3 Review and refine the governance questionnaire completed by Accountable

Officers and reinstate the questions regarding assurance activities.

R4  Change the senior level support arrangements for the Risk and Audit Committee

to create a degree of independence from internal audit.

R5  Strengthen the role performed by the Risk and Audit Committee in respect of

reviewing and challenging the action being taken by Government to implement recommendations from internal audit, the C&AG and regulators. In doing so, clarify the objectives and expected content of the deep dive sessions undertaken with individual departments.

R6  Develop the activities of the Non-Ministerial Departments Audit Committee to

include an assessment of whether the resources allocated to Non-Ministerial Departments have been used efficiently and effectively in accordance with its Terms of Reference.

Area for consideration

A3  Consider how the Non-Ministerial Departments Audit Committee could provide

assurance to the Minister for Treasury and Resources and the States Treasurer to support the Governance Report included in the States of Jersey Annual Report and Accounts.  

Risk management

Risk Strategy

97. Risk is inherent in all activities across the States of Jersey and risk management is an integral part of the Government's corporate governance arrangements. Risk management plays a key role in helping the Government to deliver its strategic objectives. It helps to ensure that decision making is better informed, precious resources are used efficiently and effectively and that unwelcome surprises are avoided. Good risk management is a key part of everyday business.
98. In 2017 the then C&AG reported on risk management and made a number of key recommendations. I published a follow up report in October 2022 and much of the Government's risk management work plan for 2023 and beyond has focussed on the recommendations set out in my 2022 report. Significant progress has been made in a number of areas with nine recommendations implemented and one recommendation partly implemented. In particular:

• information has been tailored and provided to strategic groups including CoM, ELT and the Risk and Audit Committee to present key messages more effectively at a strategic level and on a more timely basis. In doing so, the quarterly data pack has been streamlined to focus on the risk management of delivery of strategic priorities. The format and timing of the data packs has been improved considerably and real time reporting is now possible

• more effective arrangements have been implemented to consider and integrate risks in States owned entities and arm's length bodies into the Corporate Risk Register; and

• an action plan was developed to implement and monitor delivery of the Risk Management Strategy particularly around the key objectives, success measures and outcomes identified.

99. In response to the recommendation on risk appetite, and the need for an annual review, a paper was submitted to ELT in September 2024 which outlined the Government risk appetite. This had yet to be evaluated at the time of my audit work, and there is still a lack of alignment between the risk appetite and the Risk Management strategy. Decisions on risk appetite are awaited from ELT and this will need to be reviewed by CoM to ensure that the risk appetite reflects resources and priorities.

100.  The only outstanding recommendation concerns further work on the competency

framework in order to ensure that staff have the essential knowledge and skills to

manage risk effectively within the organisation and contribute to a strong risk culture.

101.  In September 2023, the Government published its Risk Management Strategy

which sets out the policy, strategy and objectives, details of the Enterprise Risk Management (ERM) system, and the roles and responsibilities. The ERM system is set out in detail for all staff to use and the Risk Manager has set up an ERM hub to facilitate its use, coupled with training courses to assist users' understanding.

Risk identification

102.  Government of Jersey risks are categorised into three main areas:

• Emergency risks – the Jersey Emergency Risk Register (formerly the Community Risk Register) identifies and assesses the most serious risks facing Jersey or its interests overseas. It categorises risks under six themes: Security, Technology and Cyber Security, Geopolitical, Environmental, Societal and Biosecurity.

• Corporate risks - the Corporate Risk Register identifies those risks that could materially threaten the Government of Jersey's business model, future performance, or prospects. These are strategic, emerging, or exceptional risks. This includes financial risk, service delivery, reputational, legal, and regulatory, (for example, Health and Safety), people, economic, social, and environmental.

• Departmental risks – departmental risk registers record operational and strategic risks at service level and are intended to have a strategic golden thread with the corporate and emergency risk registers. Risks can be escalated from departmental level to corporate or emergency level depending on the severity of the impact and likelihood.

103.  Guidance on how risks are scored and escalated/de-escalated is set out in the

strategy. To supplement this, a departmental risk group includes representatives of each of the Government departments' management teams, NMDs, and other relevant interested parties such as corporate experts on internal audit, insurance, health and safety, business continuity and information security. The departmental risk group keeps the Corporate Risk Register under review and scrutinises departmental risk registers for new and emerging risks. It also communicates and evaluates corporate risks identified by ELT that are crosscutting in nature, to understand their impact on services and departments. The processes adopted by the departmental risk group appear to be working relatively well.

104.  Significant improvements have been made in the process of documenting of risk

in risk registers. However, the risk registers are quite complex and contain a great deal of data, and there is an opportunity to refine the narrative and detail to make them more user friendly as a management tool. Risk management is still in some areas seen as a process of identification and classification, rather than a live document to manage the business risks and mitigations.

105.  Risk registers are often on leadership agendas, including ELT, for noting rather

than a full discussion about what has emerged, reduced or changed, and precisely how well the register is being managed.

106.  One area that would benefit from further attention, is the service performance

framework. This framework should support the management of risk mitigations and ensure there are specific actions attached to mitigating risks. Departments are not measuring whether their mitigation measures are effective and reducing the risk scores and there is a lack of performance measures and balanced scorecards in place to measure how the risks are being managed.

107.  My predecessor recommended that risk escalation arrangement for NMDs should

be finalised. While work has been on-going, this is yet to be embedded in all departments and more maturity is needed in the use of risk assessments to support the management of activities.

Risk appetite

108.  Risk appetite is best summarised as the amount of risk the Government of Jersey is

willing to accept and is about looking at both the propensity to take risk and the propensity to exercise control. As a diverse Island with responsibility for several critical services to Islanders, the Government recognises that the appetite for risk will vary according to the activity undertaken and hence there will be different appetites and tolerances for risk depending on the type of risk.

109.  By understanding and defining its appetite, the Government will be able to

actively manage its risks to better protect, grow and provide improved services to Islanders. When produced, the Government's Risk appetite statement should support its decision making, provide clarity over priorities and risks that it is willing to carry and evidence the effective use of resources.

110.  Following the initial paper on risk appetite presented to ELT in September 2024,

further work is now needed at a senior level to clarify risk appetite. There are many examples where the risk appetite has been classified as low (indicating that resources and mitigations should be actioned to ensure it is managed conservatively), but the link to achieving strategic objectives is not clear.

111.  A strategic statement has been published in relation to health and safety and the

risk appetite in this area is classified as low. However, there have been examples where Government has operated outside of its published risk appetite.

Risk assurance framework

112.  Risk management and compliance form an important part of the internal control

framework. A key component of the Government's risk management system is providing assurance on both the overall risk management process and on the effectiveness of the controls put in place to mitigate the impact of the risks identified.

113.  The Government's Head of Risk reports regularly to the Risk and Audit Committee

and attends ELT from time to time. The risk team also interacts with departments and will attend departmental Senior Leadership Teams (SLTs) to seek to ensure that risk management is becoming embedded as part of business as usual' activities.

114.  The Risk and Audit Committee receives regular reports on risk management and

undertakes deep dives into key areas of concern. However, the status of the deep dives is not always clear and would benefit from a more consistent structure and focus.

115.  The Terms of Reference for the Non-Ministerial Departments Audit Committee

include that it may review risk registers and risk management processes or systems. Risk management is however at various stages of maturity in the NMDs and is not reported formally through the Committee. The Chair has written to each of the NMD AOs suggesting that the NMDs:

• participate in peer review sessions, facilitated by the Head of Risk if appropriate, in order to share good practice and learning and accelerate risk management maturity; and

• identify major risks which can usefully be the subject of deep dives at future reviews by the Committee.

116.  I support the implementation of these suggestions and consider that risk

management should become an integral part of the Non-Ministerial Departments Audit Committee agendas.

Status of previous recommendations

117.  I have followed up on the current status of the recommendations relating to risk

management made in my report Risk Management – Follow Up (October 2022). Appendix Two contains more detail. It is pleasing to see that all previous recommendations have been partly or fully implemented with nine recommendations implemented and one recommendation partly implemented.

Recommendations

R7  Finalise the articulation and implementation of the Government risk appetite

statements.

R8  Require departments to evidence that they are undertaking regular reviews of the

effectiveness of their control environments and actions in reducing risk scores, including testing of existing controls.

Internal audit

118.  Internal audit is a key part of any governance framework. The work of Internal

Audit is governed by the Public Finances (Jersey) Law 2019, the PFM and the Global Internal Audit Standards (GIAS) published by the Institute of Internal Auditors. The PFM states that the conduct of work by Internal Audit must be governed by the International Professional Practices Framework (IPPF). The IPPF includes GIAS.

119.  Internal audit in the States of Jersey is provided by an in-house team, headed up

by a Chief Internal Auditor appointed by the Treasurer, and supplemented by out sourced resources in specialist areas.

120.  Internal Audit has a Charter that is developed and presented to the Risk and Audit

Committee each year. This sets out the role and remit of the function including how it will operate and the key deliverables produced by the function.

Planning

121.  Internal Audit is expected under GIAS to prepare a three year overall strategy and

an annual plan, on a risk basis, which represents the audit coverage necessary to support the Internal Audit Annual Report and Opinion.

122.  While Internal Audit has produced indicative lists of audits over a three year

period, it does not produce a formal three year strategy including consideration of the risks that have driven the proposed plan. The Chief Internal Auditor consults with the Treasurer and with ELT on the draft annual plan. The annual plan covers a number of key risk themes and is split into a six month fixed plan and a six month indicative plan, to reflect that the plan may change during the year.

123.  The rolling nature of the internal audit plan has caused some confusion as to

whether the internal audit year is aligned to the States' financial year. Recommendations (including from independent assessments) have previously been made to align the audit year more closely with the States' financial year.

Reporting against the plan

124.  Progress against the internal audit plan is reported to ELT and the Risk and Audit

Committee on a quarterly basis. It is however difficult to track the progress of

specific reviews as the budgeted and actual resources are not included in the progress reports.

125.  During 2024-2025 there was significant slippage in the delivery of the internal

audit plan with many high priority and cyclical audits taking place in the last quarter of the year with reporting sometimes taking place after the year end. Most of the slippage has been caused by requests from departments to defer particular audits. This slippage has placed a degree of pressure on internal audit resources and on the Chief Internal Auditor to provide a timely annual opinion.

126.  Additional pressure has been placed on the internal audit function as a result of

the time spent by the Chief Internal Auditor undertaking whistleblowing investigations. The Chief Internal Auditor is one of a small number of named investigators under the States of Jersey Whistleblowing Policy, but in practice has been the only person who undertakes investigations.

127.  Deferring audits also causes real problems in delivering against the plan, and

particularly for outsourced audits where the availability of appropriate expertise needs to be planned and procured well in advance and any deferring should be avoided where at all possible. More needs to be done across the Government to understand the complexities of delivering a large programme of audits and it should only be under extraordinary circumstances that an audit is deferred.

128.  Internal Audit reports to the Risk and Audit Committee, ELT and relevant SLTs on

overdue recommendations. There is a significant number of overdue recommendations across the Government with wide ranging variability between departments. One department had more than 60 overdue recommendations at the time of my fieldwork.

Internal audit opinion

129.  The Chief Internal Auditor is required to produce an Annual Opinion under GIAS

and this is also a principle under the PFM. The Annual Opinion should be based on the work undertaken during the year or in respect of the year and should include a consideration of actions yet to be taken in respect of previous internal audit recommendations. The opinion should provide assurance over risk and key controls.

130.  The Chief Internal Auditor has qualified her opinion for a number of years with the

issues giving rise to the qualification being fairly consistent year on year. The actions being taken on the areas of weakness reported by Internal Audit and resulting in the qualification have not yet been sufficient to improve the Internal Audit Annual Opinion.

Quality

131.  The GIAS require internal audit functions to have an independent external

assessment at least once every five years. An assessment was undertaken by external assessors in 2020 with the next full assessment due in 2025. The 2020 assessment concluded that the Internal Audit function for the Government of Jersey conformed with the internal auditing standards applicable at that time.

132.  An interim review took place in 2023 that concluded:

The Chief Internal Auditor has put in place a Quality Assurance Improvement Plan (QAIP) to further develop the service as required by internal auditing standards. The findings from the interim review concurs with the status update as included in the internal audit QAIP. Progress has been made with many actions; however some remain open and will need support from the Executive Leadership Team (ELT) and the Risk and Audit Committee (RAC) to deliver fully.

133.  There were some key areas of focus set out in the QAIP which correlate with my

findings from this audit:

• Refocussing the purpose and remit of Internal Audit

• Vision and strategy for the future internal audit function – refine a three year strategy to include:

1. aligning the internal audit plan with the financial and calendar year
2. future skills requirements of the internal audit team
3. plans to implement the use of analytical tools to enhance internal audit coverage
4. how internal audit can support the developing maturity of the second line of defence to provide more consistent assurance

• Follow up and action tracking

• Audit management system

• Resourcing and the role of internal audit – post Integrated Technology Solution implementation

Recommendations

R9  Align the Internal Audit year more explicitly to the States' financial year to provide

greater clarity on the internal audit activity contributing to the Chief Internal Auditor Annual Opinion.

R10 Produce a formal three year internal audit strategy that is updated annually.

R11  Enhance the format and content of the reporting of internal audit activity against

the internal audit plan to ensure that there is clarity on the progress against the planned work programme including the use of allocated resources.

R12 Update the whistleblowing operational procedures so that the Chief Internal

Auditor only undertakes investigations relevant to her role.

Financial management and internal control in HCJ

Financial management

Overall healthcare expenditure

134.  Over the past few years the expenditure of HCJ – formerly Health and Community

Services (HCS) - has increased at a rate greater than general inflation. This is a common pattern seen in a number of jurisdictions for health care services. Successive Government Plans have allocated a higher inflationary uplift (2% above general inflation) to HCJ than is allocated to other departments. Taking 2017 as a baseline for general inflationary uplifts in expenditure and excluding specific COVID-19 pandemic budget expenditure, the gap between general inflationary increased expenditure and actual expenditure has widened over the past two years (Exhibit 6).

Exhibit 6: Increases in HCJ expenditure

£400,000,000 £350,000,000 £300,000,000 £250,000,000 £200,000,000 £150,000,000 £100,000,000 £50,000,000

£0

2020 2021 2022 2023 2024

Actual expenditure Jersey RPI uplifted

Source: Jersey Audit Office analysis

135.  In each of the last five years however HCJ has spent more than the initial budget

allocated to the department in the Government Plan (after adjusting for pay awards and excluding COVID-19 pandemic budgets and expenditure) (Exhibit 7).

Exhibit 7: HCJ expenditure additional to initial Government Plan budgets

2020  2021  2022  2023  2024 £000  £000  £000  £000  £000

Initial Government Plan  221,387  227,435  226,290  249,032  286,235 approved expenditure

Adjustments for carry  -  -  1,500  1,034

forward allocation

Efficiency target  (9,000)  -  -  -  - Transfers to / from other  (2,446)  (3,788)  (3,611)  (54)

departments

Transfers to / from  4,703  (11,167)  -  10,038  - projects

Transfers between capital  (5,411)  -  -  -  - and revenue

Allocation of reserves for  *  1,323  6,828  14,339  16,511 pay award funding

Other budgetary  40,559*  16,614  18,717  28,349  30,671 increases required

Final approved budget 239,792  230,417  249,724  302,792  333,363 Actual outturn  239,728  228,915  246,625  302,792  333,362

* pay award allocation not shown separately in 2020

Source: Jersey Audit Office analysis of States of Jersey Annual Reports and Accounts, States of Jersey Finance Delegation Reports and Ministerial Decision reports

136.  While some of the budgetary increases have been due to the costs associated with

specific unforeseen events, others relate to more general cost pressures. Exhibit 8 contains more details of some of the larger budgetary increases required over the past three years.

Exhibit 8: Analysis of larger budgetary increases required from 2022 to 2024

Source: Jersey Audit Office analysis of States of Jersey Finance Delegation Reports and Ministerial Decision reports

137.  While it is not possible to quantify the extent to which these financial pressures

could have been alleviated by better financial management and internal control it is clear that improvements are required in both areas within HCJ.

138.  Constructing a budget for healthcare services is a complex process, particularly

where the environment is one of increasing demand and non-pay costs rising at above inflationary levels. There are improvements to be made in the accuracy of budget setting and forecasting processes within HCJ. I note that HCJ has adopted a more robust and evidence-based approach to budget planning for 2025 that builds on a number of the critical foundations that I would expect to see in place.

Causes of underlying financial pressures

139.  A Turnaround Team commenced work in the autumn of 2023 to prepare a

financial recovery programme. The Turnaround Team reported that HCJ's financial position had deteriorated from a £1.5 million surplus in 2019 to a forecast deficit of £29 million in 2023. The Turnaround Team reported that some of the key drivers of the deterioration in the financial position had been:

• inflation

• higher spend on agency staff

• increases in non-clinical staff compared with front line staff

• non-delivery of efficiency targets

• activity and business case pressures: and

• provision of unfunded services.

140.  The HCJ internal financial report for 2023 reported a deficit of £32.5 million

against a budget of £270 million. The deficit in 2023 was reported as being due to:

• staff costs overspend of £11 million

• an overspend on non-pay expenditure of £23.1 million; and

• an income overachievement of £1.6 million with other sources of income offsetting an under recovery of surgical private patients income of £2.7 million.

141.  The staff overspend was reported as being mainly due to more expensive agency

and overtime costs to replace substantive staff vacancies. The non-pay overspend was reported as being due to a variety of reasons, the most significant of which were negative budget pressure across clinical care groups and on and off Island placements for mental health, social care domiciliary care packages and tertiary care.

142.  The initial budget for 2024 approved in the 2024–27 Government Plan was

£286 million excluding pay awards for 2024. This appears to have been optimistic given the projected outturn for 2023 was heading towards £300 million when the Government Plan was approved.

143.  HCJ financial reports indicate a deficit of £28 million for 2024. The deficit in 2024,

which included favourable accounting adjustments of over £5 million, was reported as being due to:

• an overspend in staff costs of £5.4 million

• an overspend in non-pay expenditure of £21 million; and

• income underachievement of £1.5 million (including under recovery of surgical private patient income of £3.8 million offset by other categories of income).

Financial planning and forecasting

144.  The Turnaround Team has undertaken work to identify the causes of the HCJ

deficit and to plan and forecast HCJ expenditure. Despite this work, HCJ continues to incur expenditure in excess of forecast.

145.  The initial FRP Report, published in October 2023, identified drivers of the deficit

from 2019 to 2022 split between:

• operational (inefficient ways of working)

• strategic - including increases in patient air travel costs (although minor compared with the other two categories of expenditure); and

• structural – including non-pay inflation not funded, unfunded activity and a small amount for delayed transfers of care due to a lack of community beds.

146.  The FRP Report identified actions for cost recovery of £25.2 million (10% of

budgeted net expenditure in the Government Plan for 2023-26) by 2025. A comprehensive governance structure was established including a Programme Management Delivery Team, Financial Recovery Steering Group Committee, Change Programme Board and Care Groups support and challenge' meetings. A firm of external consultants was commissioned to help develop and support the programme.

147.  Many of the drivers of the deficit continued throughout 2024. The cost recovery programme for 2024 consisted of many different projects and was set at

£12 million. It became clear during 2024 that many projects were not achieving the targets set. For example, bed capacity was not reduced as planned, theatre utilisation was not at the level planned and there was significant under recovery of private patient income. The recovery plan had to be re-profiled in May to a cost recovery target of £5 million for 2024.

148.  The reporting of the forecast year end deficit during 2024 was too optimistic

during the first half of the year. At Month 2 the financial report to the HCS Advisory Board showed a deficit of £5.1 million and a projected year end deficit of £18 million. The deficit for 2024 was projected to be lower than the deficit in 2023 which was partly due to uncontrolled agency spend.

149.  At Month 3, the deficit to date was reported as £5.4 million with a projected year

end deficit of £18 million. It was reported that the majority of the deficit to date was non-pay (£4.1 million) suggesting that pay was largely meeting targets and was under better financial control.

150.  The Month 4 report highlighted slippage on the FRP of £6 million, although the

projected year end position remained at £18 million. The Month 6 report however shows that the cumulative deficit had risen to £13.9 million with a projected year end deficit of £24.2 million.

151.  By Month 8 the deficit had risen to a cumulative figure of £18.9 million with a

projected year end deficit of £29.5 million. The eventual year end deficit was reported as £27.96 million. This included FRP savings of £8.95 million (against the original target of £12 million).

152.  The rapid manner in which the expenditure appeared to escalate is a cause for

concern. The budget for 2025 is set at £319 million with an expectation that £13.4 million of savings will be delivered. If this is to be achieved it will be important to focus on the rising costs of social care and mental health packages, high cost drugs and off Island contracts, as well as controlling staffing costs through establishment control and productivity.

153.  There has also been a significant deficit on the income received from private

patient activity of nearly £3 million in each of 2023 and 2024 due to lower rates of activity.

154.  The Finance Lead – Change Team has increased the capacity in the Programme

Management Delivery Team (PMDT) for 2025 and has strengthened the arrangements for delivery of the FRP. Care Groups support and challenge' meetings are continuing but these do not always result in clear and concise actions plans which are then monitored. I reviewed the recent actions and decisions logs of the Medical and Surgical Care Groups which in my view did not focus sufficiently on the need to deliver financial savings while maintaining safe patient care.

Linking financial reporting to activity

155.  The HCJ budget included in successive Government Plans is not related directly to

the activities HCJ is expected to perform. The budget is instead related to the previous year budget adjusted for annual increments such as inflation and expectations regarding delivery of the FRP. I have been informed that for the 2026 Budget planning process HCJ plans to link activity, efficiency, and demand and capacity modelling with income and expenditure.

156.  HCJ does not have a clinical strategy for delivery of acute services. I have

recommended previously that such a strategy should be developed and implemented. In addition, HCJ does not have a fully documented workforce plan. Without a strategy for acute services supported by a workforce plan it is difficult to assess the cost and budget requirements to deliver safe, high quality health and care services to Islanders. In 2024, activity undertaken by HCJ had increased in comparison to 2023. The HCJ Advisory Board has adopted a timetable to deliver a clinical strategy and a workforce strategy.

157.  A Person Level Information and Costing System (PLICS) was commissioned in

around 2018. PLICS was updated throughout 2023, however no further resources were identified to undertake this work in 2024. Resources have been reinstated for this work in 2025 with progress being made in filling posts. PLICS has been, and is currently being, utilised to inform healthcare modelling. Some progress has been made but this requires further attention in 2025 to embed fully into day to day decision making.

158.  In summary, while the Government is starting to assess the level of funded

healthcare relative to the activity it can afford across the range of services provided by HCJ (including income from private patient activity) it has not yet set the HCJ budget linked to planned activity.

Internal Control

159.  I have reviewed the corporate governance arrangements in place within HCJ to

assess how effective they have been in providing assurance that the Department is complying with the Government's corporate governance framework and how they contribute to the effective management of the Department.

160.  Successive HCJ AOs have identified consistent areas of weakness in internal control in their governance questionnaires. These areas of weakness include:

• the lack of a Scheme of Delegation – at the time of my fieldwork a Scheme of Delegation to ensure proper governance and financial control was not in place for HCJ. A Scheme of Delegation for HCJ has subsequently been approved on 20 February 2025. The lack of a Scheme of Delegation prior to 20 February 2025 has meant that over 200 staff could requisition goods (and so incur expenditure) on behalf of HCJ

• the number of recommendations from internal audit and external inspection reports that have not been implemented, some of which date back to 2021 or earlier

• the lack of an up to date gifts and hospitality register

• the need to improve processes to document and manage conflicts of interest; and

• the lack of a documented workforce strategy. During 2024 a workforce tactical plan has been created but more work is needed in developing a workforce strategy.

161.  There is a significant body of work that is still required within HCJ to develop and embed a strong internal control framework and a culture of compliance.

Risk Management

162.  Risk registers are in place within HCJ. The Government's Head of Risk has

identified that there are continuing risks in relation to contract management and control of procurement decisions.

163.  HCJ records adverse incident and serious untoward events data and has put in

place procedures to encourage better reporting of this. The SLT receives regular reports on progress but the data is still not linked effectively to risk appetite and tolerance and to actions being taken to avoid future risks and to improve service quality. A risk appetite statement for HCJ was reported to the HCJ Advisory Board in January 2025 following a workshop held at the end of November 2024.

Recommendations

R13  Ensure that the HCJ Financial Recovery Plan is updated to address the weaknesses

identified in this report, including:

• a focus on the actions to be taken to manage rising costs of social care and mental health packages, high cost drugs and off Island contracts and to better control permanent staff vacancies through establishment control and productivity to avoid excess overtime

• a focus on specific actions to realise the efficiency savings identified by benchmarking services

• specific actions to be taken to address the deficits in income from private patient activity; and

• specific actions to be taken to improve internal controls and compliance.

R14  Enhance the procedures to document and monitor actions arising from the Care

Group support and challenge' meetings.

R15 Improve the use of serious untoward events data to develop documented risk

appetite and tolerances. Use this data as a tool in continuous improvement of risk management and service delivery.

Appendix One Audit Approach

This audit used a system-oriented approach. The audit used the following criteria: Financial Management

• Leadership, governance and culture: the States of Jersey set the right tone from the top, securing strong governance and oversight.

• Skills and capabilities: the States of Jersey prioritise ensuring the availability of the professional and technical skills and capabilities to enhance the quality of financial management.

• Financial Planning: the States of Jersey ensure that financial planning is integrated with strategic and corporate planning at all levels.

• Data and management information: finance leaders develop and use data to improve the quality of financial management information systems and processes. Financial reporting is timely and meets user needs.

Internal Control

• PFM requirements are clear and meet relevant statutory and regulatory requirements.

• There is an established and effective programme to develop and make improvements to the PFM.

• Appropriate assurance is obtained on compliance with the PFM.

Risk management

• Leadership, governance and culture: the States of Jersey set the right tone from the top, securing strong governance and oversight of risk.

• Skills and capabilities: the States of Jersey prioritise ensuring the availability of the professional and technical skills and capabilities to enhance the quality of risk management.

• Identification, classification and mitigation: the States of Jersey ensure that risks are identified, classified and mitigated effectively.

• Data and management information: leaders use data to improve the quality of risk management information systems and processes. Risk reporting is timely and meets user needs.

Internal audit

• Arrangements in place provide assurance that internal audit fulfils the requirements set out in the Public Finances (Jersey) Law 2019.

• The standards and operating model adopted for internal audit are appropriate and proportionate for the States of Jersey.

The approach included the following key elements:

• the effectiveness of the States' overall arrangements to ensure sound financial management

• the effectiveness of the key elements of the internal control environment with a particular focus on the Public Finances Manual (PFM)

• the effectiveness of risk management arrangements following implementation of previously agreed recommendations; and

• the arrangements to ensure that the internal audit function is operating effectively.

The documents reviewed included:

• Chief Internal Auditor opinions and presentation to ELT on Key Areas of Qualification September 2024

• Corporate Governance Finance Group agendas and minutes 2023-24

• Corporate risk register, corporate risk work plan 2022-24 and quarterly corporate risk register updates to Risk and Audit Committee

• Departmental governance statements 2023 and interim and final 2024

• ELT agendas and minutes 2024

• External Assessment of Internal Audit: Progress with action plan June 2023

• Finance Business Partners internal survey results

• Government corporate governance framework

• Government Plans covering the period 2022-28

• Government risk and insurance strategy

• HCS Advisory Board structure chart, Terms of Reference, agendas and papers 2023-24

• HCS Annual Plan 2024 and budget planning approach 2025

• HCS FRP September/October 2023 report, delivery tracker and update for year end 2024

• HCS Programme Management Delivery Team Standard Operating Procedures December 2024

• HCS Risk Register October 2024

• HCS SLT agendas and minutes 2024

• Internal Audit Charter, 2024 and 2025 Plans and quarterly reports to Risk and Audit Committee 2024

• Medicine Clinical Care Group Actions Log January 2025

• Non Ministerial Departments Audit Committee Terms of Reference and evaluation questionnaires

• Procurement breaches and exemptions report 2022-2024

• Protocol for the Chief Internal Auditor's Reporting Lines and Independence January 2025

• Public Finance Manual Management Group agendas and minutes 2024

• Risk and Audit Committee Terms of Reference and minutes of meetings 2023-24

• Sample of department financial budget reports and schemes of delegation

• Surgical Services Clinical Care Group Actions Log January 2025

• Treasury & Exchequer Risk and Governance SLT agendas and minutes, workforce plan and staff structure

The following people contributed information through interviews or by correspondence:

• Chair Non Ministerial Departments Audit Committee

• Chair Risk and Audit Committee

• Chief Internal Auditor, Interim Deputy Chief Internal Auditor and Contract Internal Auditor

• Chief Officer HCJ and Assistant Chief Executive

• Chief Officer Infrastructure and Environment

• Director of Improvement and Innovation HCJ

• Finance Lead, HCJ Change Team

• Finance Non Executive Director on HCS Advisory Board

• Group Director Finance Business Partnering and Analytics

• Head of Business Partnering (T&E, Economy, External Relations, Digital Services, People Services)

• Head of Finance Business Partners CYPES

• Head of Financial Governance, Treasury and Exchequer

• Head of Corporate Governance, Treasury and Exchequer

• Head of Risk

The fieldwork was carried out by affiliates working for the Comptroller and Auditor General, in September 2024 to April 2025.

Appendix Two

Evaluation of the implementation of previous recommendations

Financial Management

Recommendation Current status  Evaluation

R2 Undertake a  A survey of user departments in  Partly implemented comprehensive structured  June 2024 showed high levels  Following the post-implementation review  of customer satisfaction,  implementation of

of the Finance Business  responsiveness and value from  Connect Finance it Partner model, with input  finance business partners.  may be an

from user departments, to  opportune time to ensure that the full benefits of  carry out a review of the new model are secured. the model.

R3 Ensure that standard  Objectives for Principal  Implemented objectives for financial  Accountable Officers and

management are set for all  Accountable Officers set out in

staff with financial  the PFM

management responsibilities

at each grade.

R5 Prioritise a review of  PFM training programme  Implemented financial management  delivered by Head of Financial

training for non-financial  Governance

managers.

R7 Enhance the  The programme of zero-based  Partly implemented arrangements for the scrutiny  budget reviews was disrupted

of existing expenditure,  by the COVID-19 pandemic.  Tophepreor are tunities to including: development of a  My Report Efficiency Savings  enhance further the

programme of zero-based  (March 2023) identified  arrangements to budget reviews; and ensuring  weaknesses in arrangements.  challenge and that savings are identified in  Savings have however been  scrutinise

the sufficient time that no  identified in subsequent  departmental unidentified savings are  Government Plans.  expenditure. included in the Government

Plan when lodged.

R8 Establish clear plans for  People Strategy and Estates  Implemented completing the People  Strategy completed and

Strategy and Estates Strategy  published.

in sufficient time for them to

be taken into account when

developing the next

Government Plan

R9 Annually report on  Compliance with resourcing  Implemented compliance with the  principles is reported on in the

resourcing principles  Government Plan.

R10 Following adoption of  The Government Plan process  Implemented the Government Plan, ensure  includes specific arrangements

that the proposed formal  for scrutiny and engagement.

review of the preparation of

and engagement around the

Plan is comprehensive and

completed in sufficient time

to inform the next

Government Plan

R11 Reconsider the scope for  Impairments of receivables are  Implemented budgeting for impairments already reflected in the

Government Plan, both in

General Revenues and within

Department cash limits. The

main driver of impairment of

fixed assets is the annual

valuation of infrastructure and

property assets, which can

fluctuate and is driven by many

factors some of which cannot

be estimated reliably.

R12 Prepare, adopt and  Island Outcome Indicators have  Implemented monitor implementation of a  been developed and are  There is however plan to improve the quality of  publicly available.  scope to develop reporting of non-financial  Departments prepare annual  balanced scorecards information both externally  business plans which contain  for individual service and internally.  service delivery measures.  performance which

There is however more scope  link financial and

to develop balanced  non-financial data scorecards that link financial  and support the

and non-financial measures  ongoing assessment more effectively to support the  of value for money. ongoing assessment of value

for money.

R14 Adopt States-wide  Spreadsheets have had to be  Not implemented standards for obtaining  used by each Department for  New central assurance on the integrity of  financial management for staff  arrangements for key spreadsheets used for  model and for reconciling  financial accountability and decision  finance and HR systems. New  management and making.  central arrangements for

financial management and  reporecenrttliny g havbeene reporting have recently been

implemented which should  impshoulemeld rendteudce w  thhice h reduce the need for the use of  need for the use of

so many spreadsheets.  so many

spreadsheets

R16 Establish robust  The PFM Management Group,  Implemented arrangements for consultation  includes user representatives

with users, including those in  and is used to approve both

non-ministerial departments,  new sections and amendments

on finance modernisation  to existing sections on a

setting out a framework to  permanent basis.

determine: when

consultation will take place,

with whom it will take place

and how user views will be

considered.

R19 Ensure that robust  Training and communication  Partly implemented training and communication  plans have been put in place

plans are developed in good  for relevant initiatives. These

time for all major finance  plans have not always been

modernisation initiatives that  sufficiently robust to obtain

require engagement with  sufficient user engagement.

users outside Treasury and

Exchequer.

R30 Periodically review  The structure and capacity of  Implemented internal capacity and  T&E has been reviewed on a

capability within Treasury and  periodic basis since the

Exchequer to sustain the  recommendation was made.

delivery of key corporate

activities.

R31 Implement consistent  Finance modernisation  Implemented and clear arrangements for  programme has now been

the planning, management,  implemented.

resourcing and governance of

all elements of finance

modernisation.

R32 Establish arrangement to  The benefits and costs of  Not implemented report transparently,  finance modernisation

consistently and on a timely  initiatives were not reported

basis on finance  consistently.

modernisation initiatives.

R33 In implementing the  The Non-Ministerial  Partly implemented other recommendations in  Departments have an allocated

this report and in  FBP team. Memoranda of

implementing finance  Understanding and Service

modernisation, carefully  Level Agreements are not in

consider the need to adapt  place however between T&E

the approach for Non- and the Non-Ministerial

Ministerial Departments,  Departments as recommended

including in relation to the  by my predecessor in her

support provided. report Non-Ministerial

Departments (December 2019).

Source: Jersey Audit Office analysis

Internal Control

Recommendation Current status  Evaluation R1 Develop and implement  A strong corporate governance  Implemented

the changes to accountability  framework for ensuring

arrangements that are  accountability has been

necessary in order to secure  implemented.

effective accountability whilst  Recommendation in relation to

preserving constitutional  States of Jersey Police

independence of certain  implemented.

bodies, including the States of

Jersey Police.

R4 Monitor the completion of  The completion of appraisals is  Implemented staff appraisals and take  being monitored using an HR

prompt corrective action  dashboard.

where necessary.

R6 Ensure that, as part of the  A Recommendations Tracker  Partly

new corporate arrangements  has been introduced by the  implemented  for monitoring the  Government of Jersey. The  Corporate implementation of  reporting arrangements  governance recommendations,  include regular reporting to the

arrangements are put in place  Public Accounts Committee but  arrrepoanrtgemeing thnets for to facilitate reporting back to  not to Scrutiny Panels.  implementation of

relevant scrutiny Panels on  recommendations progress in implementing  made by Scrutiny recommendations that they  Panels should be have made.  strengthened.

R13 Ensure that there is:  I have reported on the  Partly widespread engagement on  Integrated Technology Solution  implemented and effective challenge of the  in 2021 and 2023. My reports

proposals for an integrated  made a number of

technology solution; and  recommendations including a

effective project management  need to measure and monitor

of its implementation. So that  benefits realisation.

the full benefits of a

significant investment are

secured and risks in

implementation minimised.

R15 Develop and implement  The cross departmental group  Implemented

an overarching framework for  for developing and updating

establishing, communicating  the PFM and governance  Tdheep croartmss ental group and monitoring compliance  framework is operating  for monitoring

with corporate standards in  effectively. The cross  compliance with the areas other than finance.  departmental group for  PFM and

monitoring compliance with  governance

the PFM and governance  framework needs to framework needs to improve

the effectiveness of its  impeffectiroveve thneess of its arrangements.  arrangements.

R17 Ensure that agreed  Agreed management action  Implemented management action detailed  taken.

in this report is taken before

finalising the PFM.

R18 Ensure that the internet  Comprehensive facilities in  Implemented facilitates effective updating,  place.

navigation, searching and

cross-referencing before

using it as the platform for the

PFM.

R20 Ensure that business  Business cases not always  Not implemented cases are prepared for all  prepared for exemptions to the

exemptions to the mandatory  mandatory requirements of the

requirements of the PFM and,  PFM and not routinely reported

in summarised form, routinely  to the Risk and Audit

reported to the Risk and Audit  Committee.  

Committee.

R21 Ensure that a formal  A timetable for review of each  Implemented annual review of the PFM is  section of the PFM has been

undertaken, drawing widely  developed and implemented.

on the views of service

departments and other

central functions interacting

with Treasury and Exchequer

R23 Prioritise recruitment of  The Risk and Audit Committee  Implemented suitably skilled and  has full complement of

experienced members of the  members.

Risk and Audit Committee so

that it can return to quoracy as

a matter of urgency.

Source: Jersey Audit Office analysis

Risk management

Recommendation Current status  Evaluation R1 Tailor information provided to  The format and timing of the  Implemented

strategic groups including CoM,  data packs have been

ELT and the Risk and Audit  improved and can report in real

Committee to present key  time.

messages more effectively at a

strategic level and on a more timely

basis. In doing so, ensure

streamlining of the quarterly data

pack to focus on the risk

management of delivery of

strategic priorities.

R2 Implement more effective  Arrangements have been put in  Implemented arrangements to consider and  place.

integrate risks in States owned

entities and arm's length bodies

into the Corporate Risk Register.

R3 Develop an action plan to  Action plan implemented. Implemented implement and monitor delivery of

the 2022 Risk Management

Strategy particularly around the key

objectives, success measures and

outcomes identified in the key

focus areas.

R4 Formally review risk appetite  ELT has received a paper on  Partly across a range of dimensions on an  Government risk appetite. At  implemented annual basis.  the time of my fieldwork this

had yet to be finalised and had

not been considered by CoM.

R5 Undertake a full review of the  The Corporate Risk Register  Implemented Corporate Risk Register to ensure  was reviewed in response to

consistent interpretation of risks  the recommendation.

that may impact on delivery of

Common Strategic Policy priorities

and the Government Plan.

R6 Review the Managing Risk  Completed.  Implemented section in future Government Plans

to ensure that it reflects high level

risks of delivering the priorities in

the Government Plan rather than a

small sample of risks taken from the

Corporate Register.

R7 Include significant risks that may  Completed.  Implemented impact on delivery of departmental

business plans in these business

plans.

R8 Undertake a full review, led by  The Corporate Risk Register  Implemented ELT of all risks on the Corporate  was reviewed in in response to

Risk Register to confirm that: this recommendation. The

Head of Risk attended a recent

• injustifiedclusion an as a risk and a consistedn scorint  g is  ELT meeting to discuss the interpretation of the guidance Corporate Risk Register

• controls recorded are appropriate and meaningful; and

• recorded mitigating actions are robust and timetables are realistic.

R9 Enhance mechanisms to hold  Deep dives are now taking  Implemented Accountable Officers to account for  place and are presented on a

the effectiveness of mitigating  regular basis to ELT and the

controls and actions recorded on  Risk and Audit Committee

the risk register. In doing so, review

the purpose and operation of the

deep dive' processes operated by

the Head of Risk and the Risk and

Audit Committee to consider their

effectiveness and ensure that they

do not duplicate one another.

R10 Review the Terms of Reference  Completed.  Implemented of the Departmental Risk Group

(DRG) to maximise its effectiveness.

In doing so, clarify the purpose and

corresponding information and

access needs for the DRG as a

resource to add value to the

corporate risk management

framework.

Source: Jersey Audit Office analysis

Appendix Three

Summary of Recommendations and Areas for consideration

Recommendations

R1  Enhance the management information produced, reviewed and challenged in

respect of departmental expenditure to include:

• regular reporting of procurement breaches and exemptions to Senior Leadership Teams, the Government Risk and Audit Committee and the Non Ministerial Departments Audit Committee; and

• links to operational service and workforce plans.

R2 Review the Terms of Reference of the Corporate Governance Framework Group.

In doing so consider:

• the role it should perform in providing assurance on internal control compliance; and

• how frequently the Group should meet to ensure it discharges its responsibilities.

R3 Review and refine the governance questionnaire completed by Accountable

Officers and reinstate the questions regarding assurance activities.

R4  Change the senior level support arrangements for the Risk and Audit Committee

to create a degree of independence from internal audit.

R5  Strengthen the role performed by the Risk and Audit Committee in respect of

reviewing and challenging the action being taken by Government to implement recommendations from internal audit, the C&AG and regulators. In doing so, clarify the objectives and expected content of the deep dive sessions undertaken with individual departments.

R6  Develop the activities of the Non-Ministerial Departments Audit Committee to

include an assessment of whether the resources allocated to Non-Ministerial Departments have been used efficiently and effectively in accordance with its Terms of Reference.

R7  Finalise the articulation and implementation of the Government risk appetite

statements.

R8  Require departments to evidence that they are undertaking regular reviews of the

effectiveness of their control environments and actions in reducing risk scores, including testing of existing controls.

R9  Align the Internal Audit year more explicitly to the States' financial year to provide

greater clarity on the internal audit activity contributing to the Chief Internal Auditor Annual Opinion.

R10 Produce a formal three year internal audit strategy that is updated annually.

R11  Enhance the format and content of the reporting of internal audit activity against

the internal audit plan to ensure that there is clarity on the progress against the planned work programme including the use of allocated resources.

R12 Update the whistleblowing operational procedures so that the Chief Internal

Auditor only undertakes investigations relevant to her role.

R13  Ensure that the HCJ Financial Recovery Plan is updated to address the weaknesses

identified in this report, including:

• a focus on the actions to be taken to manage rising costs of social care and mental health packages, high cost drugs and off Island contracts and to better control permanent staff vacancies through establishment control and productivity to avoid excess overtime

• a focus on specific actions to realise the efficiency savings identified by benchmarking services

• specific actions to be taken to address the deficits in income from private patient activity; and

• specific actions to be taken to improve internal controls and compliance.

R14  Enhance the procedures to document and monitor actions arising from the Care

Group support and challenge' meetings.

R15 Improve the use of serious untoward events data to develop documented risk

appetite and tolerances. Use this data as a tool in continuous improvement of risk management and service delivery.

Areas for consideration

A1  Consider undertaking a review of the Finance Business Partner model to ensure

that Finance Business Partners are able to fulfil the role as set out in the Public Finances Manual.

A2  Consider how to identify real efficiency savings by using performance data linked

to financial data.

A3  Consider how the Non-Ministerial Departments Audit Committee could provide

assurance to the Minister for Treasury and Resources and the States Treasurer to support the Governance Report included in the States of Jersey Annual Report and Accounts.

LYNN PAMMENT CBE Comptroller and Auditor General

Jersey Audit Office, De Carteret House, 7 Castle Street, St Helier, Jersey JE2 3BT T: +44 1534 716800 E: [email protected] W: www.jerseyauditoffice.je