Financial Management and Internal Control – Follow Up (R.118/2025): executive response

Recommendations

Risk of non- implementation

Risk profile (E,H,M,L)

Other considerations in prioritisation

Is the recommendation agreed?

Improvement theme

(If applicable)

R1 Enhance the management information produced, reviewed and challenged in

respect of departmental expenditure to include:

• regular reporting of procurement breaches and exemptions to Senior Leadership Teams, the Government Risk and Audit Committee and the Non Ministerial Departments Audit Committee; and

• links to operational service and workforce plans.

If procurement breaches and exemptions are not reported to Senior Leadership Teams, the Government Risk and Audit Committee and the Non-Ministerial Departments Audit Committee then those bodies may be unaware of the extent of non-compliance with Public Finances Manual requirements resulting in the potential for sub-optimum value for money and the potential for fraudulent or corrupt transactions.

L

Any additional reporting requirement will require resource to deliver. Officers in departments already have access to the dashboard for Omnitrack (the breaches and exemptions system). It is noted that the development of detailed management information to inform specific operational service and workforce planning would require significant effort and resource. This remains an aspiration for GoJ, but implementation will depend on prioritisation of objectives within departments. However, existing management information that is available in this area, such as the P.59 reporting, will continue to be leveraged to inform decision making.

Agreed in part. As part of the GoJ response to the PAC report on procurement, Commercial Services has undertaken to review reporting provision.

Breaches and exemptions oversight and lessons learned

R2 Review the Terms of Reference of the Corporate Governance Framework Group. In doing so consider:

It the Terms of Reference are not reviewed, there may be a missed opportunity to review how GoJ oversees its

L

It is considered that, in the absence of a wider review of the governance landscape, updating the ToR alone may not achieve the anticipated objectives. Such a review could

Agreed. Whilst accepted, this work may not be prioritised amongst other activity.

Organisational responsibility for corporate governance

• the role it should perform in providing assurance on internal control

compliance; and

• how frequently the Group should meet to ensure it discharges its

responsibilities.

governance arrangements on a strategic level.

then inform any changes to remit of governance groups.

R3 Review and refine the governance questionnaire completed by Accountable Officers and reinstate the questions regarding assurance activities.

If the governance questionnaire is not reviewed, assurance may be lacking that robust departmental and overall governance arrangements are in place, which could have financial and reputational impacts.

M

The governance statement questionnaire has been reviewed for 2025 and the questions requested by the C&AG for reinstatement have been included. However, GoJ is conscious of the benefit of proportionate governance, and it is considered important to achieve appropriate levels of assurance through proportionate activity. Our objective is to deliver a system that adds value but is not eroded to a tick-box exercise.

Agreed and complete. The governance statement template will be reviewed on an annual basis as part of business as usual.

No action as complete.

R4 Change the senior level support arrangements for the Risk and Audit Committee to create a degree of independence from internal audit.

If not implemented, then there is the potential that the support to the Committee is within the scope of Committee's oversight, creating a risk to independent advice and support.

L

In a small jurisdiction it is challenging to establish a governance regime with complete independence We are aware of the current arrangements creating actual issues with independence. However, given the importance of the Risk and Audit Committee in directly overseeing audit functions, there may be an opportunity to improve liaison with the Committee to ensure senior level support is as independent as practically possible and minimise any perceived risks.

Agreed.

Support to Risk and Audit Committee

R5 Strengthen the role performed by the Risk and Audit Committee in respect of reviewing and challenging the action being taken by Government to implement recommendations from internal audit, the C&AG and regulators. In doing so, clarify

If not implemented, then the Risk and Audit Committee may not be able to advise on whether the C&AG and other regulator's recommendations are addressing observed risks, and influence the government to prioritise

L

The Chair of Risk and Audit Committee considers the current process to be adequate, but will continue to review its processes to ensure effectiveness.

This will be supported by the implementation of a system to replace the current tracker, which is currently in the final stages of development. The interface and dashboards

Agreed. The Risk and Audit Committee will be asked to review their activity in this space alongside other priorities in terms of agenda setting.

Oversight of improvement activity and learning

the objectives and expected content of the deep dive sessions undertaken with individual departments.

activity in line with any observations.

have been designed to make it more effective for action owners to provide updates and how tracked activity is being progressed against agreed targets.

R6 Develop the activities of the Non-Ministerial Departments Audit Committee to include an assessment of whether the resources allocated to Non- Ministerial Departments have been used efficiently and effectively in accordance with its Terms of Reference.

If the Non-Ministerial Departments Audit Committee does not consider whether the resources allocated to Non-Ministerial Departments have been used efficiently and effectively, then an opportunity for independent challenge on expenditure may be missed, which in turn may mean opportunities for improvement are missed.

L

The NMD Audit Committee has regularly discussed use of resources with each of the NMDs albeit that this has not been explicitly referred to in correspondence. In future, the Committee will ensure that this issue will be specifically reflected in relevant documents, where it is appropriate to do so.

Agreed. This will be built into working practices of NMD Audit Committee.

Non ministerial resource allocation

R7 Finalise the articulation and implementation of the Government risk appetite statements

If not approved by Executive Leadership Team and Council of Ministers (COM) then it may be difficult to achieve key stakeholder understanding of both strategic and operational risk-based priorities, and risk appetite may not match risk response, resulting in increased risk exposure and/or an imbalance of effort to mitigate vs potential tolerance.

M

Internal discussions to promote finalising the GoJ risk appetite statements will continue. It is important to note, however, that these are strategic aspirations in relation to the level of potential risk control, and that therefore immediate changes to risk profile are not likely as many involve programmes of work. T&E will support risk owners to identify the highest risks to address and consider whether additional investment is required to control risk in line with appetite and plan accordingly.

Agreed.

Better define risk appetite

R8 Require departments to evidence that they are undertaking regular reviews of the effectiveness of their control environments and actions in reducing risk scores,

If departments are not reviewing their control environments regularly then risks may not be appropriately mitigated, resulting in potential risks to service delivery, financial

M

There are a number of systems already in place to identify whether AOs are regularly reviewing their control environments with a view to identifying areas for improvement, where appropriate and proportionate. The Governance Statement process involves a review of departmental systems of

Not agreed.

No action at this time.

including testing of existing controls.

loss, litigation and higher insurance claims.

governance and includes a self- assessment of whether systems of internal control are adequate in principle and complied with in practice, which has been reintroduced in line with R3 above. In addition, metrics embedded within the Enterprise Risk Management system enable oversight of effectiveness of risk controls. The central risk team continues to promote active risk management with departments. As part of this, controls are reviewed and monitored, and deep dives undertaken and shared for key risks, with departments having a priority focus on risks recorded on the corporate risk register.

R9 Align the Internal Audit year more explicitly to the States' financial year to provide greater clarity on the internal audit activity contributing to the Chief Internal Auditor Annual Opinion.

If the Internal Audit year does not align with the States' financial year, then the Annual Opinion for the previous year is less likely to be reported in a timely way, with the impact that it may not effectively inform the published key governance risks in the Annual Report and Accounts and noncompliance may not be addressed in a timely manner by the organisation and effective prioritisation undertaken.

M

The CIA annual opinion is at the 31 December as are the States of Jersey accounts. Inevitably, some audit work is planned post year end, as per external audit, which is standard audit practice, however quarterly reporting is provided to the executive and Risk and Audit Committee.

In response to the recommendation, the CIA will provide the Annual Opinion in line with the timelines for the Chief Officer Governance Statements, enabling this information to effectively inform the SoJ Governance Statement in the Annual Report and Accounts.

Agreed.

Internal Audit Quality Assurance and Improvement Plan

R10 Produce a formal three- year internal audit strategy that is updated annually.

Without clear visibility of a rolling strategy, stakeholders may not be aware of the alignment of long-term priorities and assurance.

M

Whilst the Chief Internal Auditor presents a three-year plan and strategy to Risk and Audit Committee and the executive, we will review how to make further improvements.

Agreed.

Internal Audit Quality Assurance and Improvement Plan

R11 Enhance the format and content of the reporting of

If the Risk and Audit Committee do not have

M

The RAC already receives reports in respect to audit plan progress and detailed analysis is

Agreed.

Internal Audit Quality

internal audit activity against the internal audit plan to ensure that there is clarity on the progress against the planned work programme including the use of allocated resources.

adequate visibility of resource usage and progress against the Internal Audit plan, there could be a reduced ability to deliver timely audit reports and to realign resources to priority audits, which could compromise the effectiveness of the Internal Audit function.

held for co-sourced providers. The recommendation made by the C&AG shall be implemented to further improve the monitoring of progress against the plan.

Assurance and Improvement Plan

R12 Update the whistleblowing operational procedures so that the Chief Internal Auditor only undertakes investigations relevant to her role.

If not implemented there is a risk that the current process may lead to an unmanageable workload for the Chief Internal Auditor, which diverts attention from principal audit duties

M

The whistleblowing process is under review and extensive consultation has been undertaken, including with Unions. Further additional individuals will be added as named persons on the policy, which, although not the objective of the review, will serve to protect the time of the Chief Internal Auditor for audit purposes.

Agreed.

Resourcing for whistleblowing policy

R13 Ensure that the HCJ Financial Recovery Plan is updated to address the weaknesses identified in this report, including:

• a focus on the actions to be taken to manage rising costs of social care and mental health packages, high-cost drugs and off Island contracts and to better control permanent staff vacancies through establishment control and productivity to avoid excess overtime

• a focus on specific actions to realise the efficiency savings identified by benchmarking services

If not implemented, spend may continue to increase beyond an affordable level. The impact of this would be a reduction on patient services.

H

Rising demand and costs of health and care will need to be addressed: it is recognised that adjustments to the FRP could be beneficial in helping manage these areas of spend.

Agreed.

Financial Recovery Plan, HCJ

• specific actions to be taken to address the deficits in income from private patient activity; and

• specific actions to be taken to improve internal controls and compliance.

R14 Enhance the procedures to document and monitor actions arising from the Care Group support and challenge' meetings.

If not implemented, actions arising from this semi- independent review will not be recorded and monitored, which may mean that opportunities for improvement and efficiency may be missed.

M

The importance of continuing to identify and deliver improvement opportunities is recognised. HCJ will bring together associated information and dashboards, as well as financial information, in order to further improve monitoring and implementation of improvement.

Agreed

Oversight of improvement activity and learning

R15 Improve the use of serious untoward events data to develop documented risk appetite and tolerances. Use this data as a tool in continuous improvement of risk management and service delivery.

If not implemented, HCJ will not learn from incidents and further similar incidents will occur.

H

Significant themes from Serious Incidents will be identified and included on the risk register. By analysing trends and patterns from metrics within the aggregated data we can assess the organisation's actual risk exposure, versus the currently documented risk appetite.

Learning from Serious Incidents will be thematically reviewed quarterly and shared across HCJ to inform quality improvement initiatives to reduce the risk of further similar events occurring, we will be able to refine risk tolerance levels by identifying areas where there are recurring issues within the collated incident data.

Themes from SIs will be considered alongside themes from patient feedback, litigation, safeguarding reviews, incident reporting and mortality reviews. This will inform HCJ Quality priorities for subsequent years in the Quality Account and Annual Plan.

Agreed and partially in place - key themes are identified from Serious Incidents and are captured on the risk register. There is further work to ensure the learning from SIs is disseminated to inform continuous improvement and reduce the risk of further similar incidents.

Oversight of improvement activity and learning

Action theme

Actions

Linked Recs

Target date

Responsible Officer

Financial Recovery Plan - HCJ

 Update the Financial Recovery Plan in order to address various matters, such as:

• Rising costs of care, drugs and off Island contracts
• Efficiency opportunities through benchmarking
• Deficits in income from private patient activity
• Internal control

13

End 2026

Financial Director, HCJ.

Better define risk appetite

 Finalise the articulation and implementation of the Government risk appetite statements, both in respect of strategic priorities and systems of governance to align process with appetite.

7

June 2026

Head of Risk

Oversight of improvement activity and learning

• Develop and deliver an updated system to monitor and effectively report on the delivery of recommendations from various sources of review and audit. Discuss use with the Chair of the Risk and Audit Committee to ensure appropriate oversight of GoJ responses to C&AG and PAC reports.

• Review and implement improved HCJ departmental systems of monitoring the implementation of improvements associated with learning from Serious Incidents.

• Identify themes from Serious Incidents, include on risk registers (as appropriate), communicate learning to reduce risk, consider alongside feedback, litigation, safeguarding reviews, incident reporting and mortality reviews to inform HCJ Quality priorities

5

14 15

By end of 2025

March 2026 March 2026

Head of Corporate Governance

Medical Director, HCJ Medical Director, HCJ

Internal Audit Quality Assurance and Improvement Plan

 In accordance with Internal Audit Standards, deliver a Quality Assurance and Improvement Plan, including:

• Deliver Internal Audit Opinion in line with Chief Officer Governance Statement timeline to inform the Annual Report and Accounts Governance Statement.
• Make improvements to three-year plan and strategy, as well as regular reporting on Internal Audit progress.

9, 10, 11

March 2026

Chief Internal Auditor

Resourcing for whistleblowing policy

 Update the whistleblowing policy with appropriate controls to protect the time of the Chief Internal Auditor for assurance activity.

12

End 2025

Chief People Officer

Organisational responsibility for corporate governance

 Update terms of reference for Corporate Governance Framework Group, considering responsibility for ongoing oversight of strategic governance systems

2

March 2026

Head of Corporate Governance

Breaches and exemptions oversight and lessons learned

 Review Commercial Services reporting provision, to ensure that information available (including to the GoJ Risk and Audit Committee), such as breaches and exemptions, can be appropriately used for identifying and improving processes, and performance management, as appropriate. Where reporting process do not seem to be adding additional value, consider resource/benefit in production of such reports.

1

End 2026

Director, Commercial Services

Non ministerial resource allocation

 The NMD Audit Committee will ensure that records of discussions in relation to NMD resource allocation are specifically reflected in relevant documents, where it is appropriate to do so.

6

End 2025

Director of the Civil Division, Law Officers Department

Support to Risk and Audit Committee

 The Treasurer will review the situation and change the senior level support arrangements for RAC, as appropriate.

4

March 2026

Treasurer of the States