The Audit Findings for NHS Bristol Clinical Commissioning Group

Transcription

1 The Audit Findings for NHS Bristol Clinical Commissioning Group Year ended 31 March May 2015 Barrie Morris Engagement Lead T E Barrie.Morris@uk.gt.com Hannah Jones Audit Manager T E Hannah.Jones@uk.gt.com Katie Haines In-charge auditor T E Katie.V.Haines@uk.gt.com 2015 Grant Thornton UK LLP Audit Findings Report 2014/15 Date

2 Private and Confidential NHS Bristol Clinical Commissioning Group South Plaza Marlborough Street Bristol BS1 3NX 21 May 2015 Dear Governing Body of NHS Bristol CCG Grant Thornton UK LLP Hartwell House Victoria Street Bristol BS1 6FT T +44 (0) Audit Findings for NHS Bristol Clinical Commissioning Group for the year ending 31 March 2015 This Audit Findings report highlights the significant findings arising from the audit for the benefit of those charged with governance, as required by International Standard on Auditing (UK & Ireland) 260. Its contents have been discussed with management. As auditors we are responsible for performing the audit, in accordance with International Standards on Auditing (UK & Ireland), which is directed towards forming and expressing an opinion on the financial statements that have been prepared by management with the oversight of those charged with governance. The audit of the financial statements does not relieve management or those charged with governance of their responsibilities for the preparation of the financial statements. The contents of this report relate only to those matters which came to our attention during the conduct of our normal audit procedures which are designed primarily for the purpose of expressing our opinion on the financial statements. Our audit is not designed to test all internal controls or identify all areas of control weakness. However, where, as part of our testing, we identify any control weaknesses, we will report these to you. In consequence, our work cannot be relied upon to disclose defalcations or other irregularities, or to include all possible improvements in internal control that a more extensive special examination might identify. We do not accept any responsibility for any loss occasioned to any third party acting, or refraining from acting on the basis of the content of this report, as this report was not prepared for, nor intended for, any other purpose. We would like to take this opportunity to record our appreciation for the kind assistance provided by the finance team, CSU and other staff during our audit. Yours sincerely Barrie Morris Chartered Accountants Member firm within Grant Thornton International Ltd Grant Thornton UK LLP is a limited liability partnership registered in England and Wales No: OC Engagement Registered office: Grant lead Thornton House, Melton Street, Euston Square, London NW1 2EP. A list of members is available from our registered office. Grant Thornton UK LLP is authorised and regulated by the Financial Services Authority for investment business Grant Thornton UK LLP Audit Findings Report 2014/15 Date 2

3 Contents Section Page 1. Executive summary 5 2. Audit findings 9 3. Value for Money Fees, non-audit services and independence Communication of audit matters 24 Appendices A Action plan B Audit opinion 2015 Grant Thornton UK LLP Audit Findings Report 2014/15 Date 3

4 Section 1: Executive summary 01. Executive summary 02. Audit findings 03. Value for Money 04. Fees, non audit services and independence 05. Communication of audit matters 2015 Grant Thornton UK LLP Audit Findings Report 2014/15 Date

5 Executive summary Executive summary Purpose of this report This report highlights the key issues affecting the results of Bristol Clinical Commissioning Group (the CCG) and the preparation of the CCG's financial statements for the year ended 31 March It is also used to report our audit findings to management and those charged with governance in accordance with the requirements of International Standard on Auditing (UK & Ireland) 260. Under the Audit Commission's Code of Audit Practice (the Code) we are required to report whether, in our opinion, the CCG's financial statements present a true and fair view of the financial position. We are also required to reach a formal conclusion on whether the CCG has put in place proper arrangements to secure economy, efficiency and effectiveness in its use of resources (the Value for Money Conclusion). Introduction In the conduct of our audit we have not had to alter or change our audit approach, which we communicated to you in our Audit Plan dated 25 March Our audit is substantially complete although we are finalising our procedures in the following areas: review of solicitor's response review of the pooled budget information and disclosure obtaining and reviewing the management letter of representation updating our post balance sheet events review, to the date of signing the opinion review of the final version of the financial statements review of the final version of the Annual Governance Statement and Annual Report We received draft financial statements and accompanying working papers at the commencement of our work, in accordance with the national deadline. Key audit and financial reporting issues Financial statements opinion We have not identified any adjustments affecting the CCG's Comprehensive Net Expenditure or the Statement of Financial Position. The draft financial statements for the year ended 31 March 2015 recorded a total comprehensive net expenditure of m for the year, which has remained unchanged following our audit. We have recommended a number of minor adjustments to improve the presentation of the financial statements. Further details are set out in section two of this report. We anticipate providing a unqualified audit opinion in respect of the financial statements (see Appendix B) Grant Thornton UK LLP Audit Findings Report 2014/15 Date 5

6 Executive summary Regularity opinion As well as an opinion on the accounts, we are required to give a regularity opinion on whether expenditure has been incurred 'as intended by Parliament'. Failure to meet statutory financial targets automatically results in a qualified regularity opinion. We are pleased to report that, based on our review of the CCG's expenditure we propose to give an unqualified regularity opinion. Value for money conclusion We are pleased to report that, based on our review of the CCG's arrangements to secure economy, efficiency and effectiveness in its use of resources, we propose to give an unqualified VFM conclusion Further detail of our work on Value for Money is set out in section three of this report. Agreement of Balances and Whole of Government Accounts (WGA) Our audit work has identified the following variances in the NHS agreement of balances (AoB) process: Payables with Public Health England: The CCG is reporting 638k less than PHE is reporting for their receivables figure. Expenditure with North Bristol NHS Trust: The CCG is reporting 1,826k higher than NBT is reporting for their income figure. Expenditure with University Hospitals Bristol NHS FT: The CCG is reporting 1,448k higher than UHB is reporting for their income figure. The variances described are not material to the CCG's financial statements, however we have gained valid explanations supported by evidence for each of the variances. We are satisfied with the position that the CCG is reporting with each of these bodies. Controls Roles and responsibilities The CCG's management is responsible for the identification, assessment, management and monitoring of risk, and for developing, operating and monitoring the system of internal control. Our audit is not designed to test all internal controls or identify all areas of control weakness. However, where, as part of our testing, we identify any control weaknesses, we report these to the CCG. Findings Our work has not identified any control weaknesses which we wish to highlight for your attention. A number of control weaknesses were reported in the prior year which are commented on in the 'Internal controls review of issues raised in prior year' section of the Audit Findings report Grant Thornton UK LLP Audit Findings Report 2014/15 Date 6

7 Executive summary The way forward Matters arising from the financial statements audit and our review of the CCG's arrangements for securing economy, efficiency and effectiveness in its use of resources have been discussed with the Chief Finance Officer We have made a small number of recommendations, which are set out in the action plan. Recommendations have been discussed and agreed with Chief Finance Officer and the finance team. Acknowledgement We would like to take this opportunity to record our appreciation for the assistance provided by the finance team, CSU and other staff during our audit. The finance team have been particularly efficient when responding to our audit queries, providing information promptly at the beginning of the audit and responding to additional queries in a timely manner. Working papers were of a very high standard. Grant Thornton UK LLP May Grant Thornton UK LLP Audit Findings Report 2014/15 Date 7

8 Section 2: Audit findings 01. Executive summary 02. Audit findings 03. Value for Money 04. Fees, non-audit services and independence 05. Communication of audit matters 2015 Grant Thornton UK LLP Audit Findings Report 2014/15 Date

9 Audit findings Audit findings against significant risks "Significant risks often relate to significant non-routine transactions and judgmental matters. Non-routine transactions are transactions that are unusual, either due to size or nature, and that therefore occur infrequently. Judgmental matters may include the development of accounting estimates for which there is significant measurement uncertainty" (ISA (UK&I) 315). In this section we detail our response to the significant risks of material misstatement which we identified in the Audit Plan. As we noted in our plan, there are two presumed significant risks which are applicable to all audits under auditing standards. Risks identified in our audit plan Work completed Assurance gained and issues arising 1. Improper revenue recognition Under ISA (UK&I) 240 there is a presumed risk that revenue may be misstated due to the improper recognition of revenue. Auditors may rebut this presumption depending on the circumstances of the client. We have rebutted this presumption for Bristol CCG because: revenue does not primarily involve cash transactions revenue is principally an allocation from NHS England Bristol CCG have reported a year end surplus of 6.4m We therefore do not consider this to be a significant risk for Bristol CCG. Our audit work has not identified any issues in respect of revenue recognition. As part of our audit work we have completed; a review of revenue recognition policies 2. Management override of controls Under ISA (UK&I) 240 there is a presumed risk that the risk of management over-ride of controls is present in all entities. We have undertaken the following work in relation to this risk: Review of entity controls Review of accounting estimates, judgements and decisions made by management Testing of journals entries and journal procedures in place Review of accounting estimates, judgements and decisions made by management Review of unusual significant transactions. Our audit work has not identified any evidence of management override of controls. In particular, the findings of our review of journal controls and testing of journal entries has not identified any significant issues. We set out later in this section of the report our work and findings on key accounting estimates and judgements Grant Thornton UK LLP Audit Findings Report 2014/15 Date 9

10 Audit findings Audit findings against other risks In this section we detail our response to the other risks of material misstatement which we identified in the Audit Plan. Recommendations, together with management responses are attached at appendix A. Transaction cycle Description of risk Work completed Assurance gained & issues arising Secondary Care Commissioning Contract costs not accounted for properly We have undertaken the following work in relation to this risk: Our audit work has not identified any significant issues in relation to the risk identified. Documentation of our understanding of processes and key controls over the transaction cycle Walkthrough of the key controls to confirm our understanding of the system. Substantive testing of secondary healthcare costs including agreement of outturn against block and activity based contracts. Secondary Care Commissioning Activity variation adjustments to expenditures not correct We have undertaken the following work in relation to this risk: Our audit work has not identified any significant issues in relation to the risk identified. Documentation of our understanding of processes and key controls over the transaction cycle Walkthrough of the key controls to confirm our understanding of the system. Substantive testing of secondary healthcare variations including agreement of year end positions with the main acute providers. Secondary Care Commissioning Invoiced non contract costs not accounted for properly We have undertaken the following work in relation to this risk: Our audit work has not identified any significant issues in relation to the risk identified. Documentation of our understanding of processes and key controls over the transaction cycle Walkthrough of the key controls to confirm our understanding of the system. Substantive testing of invoiced non contract costs Grant Thornton UK LLP Audit Findings Report 2014/15 Date 10

11 Audit findings Accounting policies, Estimates & Judgements In this section we report on our consideration of accounting policies, in particular revenue recognition policies, and key estimates and judgements made and included with the CCG's financial statements. Accounting area Summary of policy Comments Assessment Revenue recognition Revenue in respect of services provided is recognised when, and to the extent that, performance occurs, and is measured at the fair value of the consideration receivable. When income is received for a specific activity that is to be delivered in the following year, that income is deferred. Revenue recognition policy is deemed to be appropriate under relevant accounting framework Green Judgements and estimates Key estimates and judgements include Prescribing and other accruals Estimates deemed to be appropriate under relevant accounting framework Review of estimates in the accounts did not identify any issues. Green Going concern The Governing Body have a reasonable expectation that the services provided by the CCG will continue for the foreseeable future. For this reason, they continue to adopt the going concern basis in preparing the financial statements. We have reviewed the Governing Body's assessment and are satisfied with management's assessment that the going concern basis is appropriate for the 2014/15 financial statements. Green Other accounting policies The CCG has adopted the standard accounting policies for the NHS as set out in the manual for accounts. We have reviewed the CCG's policies against the requirements of the Manual for Accounts. A number of accounting policies were included within the statement of accounts which were not applicable to NHS Bristol CCG. A recommendation has been made and agreed for these to be removed. Amber Assessment Marginal accounting policy which could potentially attract attention from regulators Accounting policy appropriate but scope for improved disclosure Accounting policy appropriate and disclosures sufficient 2015 Grant Thornton UK LLP Audit Findings Report 2014/15 Date 11

12 Audit findings Other communication requirements We set out below details of other matters which we, as auditors, are required by auditing standards to communicate to those charged with governance. Issue Commentary 1. Matters in relation to fraud We have previously discussed the risk of fraud with the Audit Committee. We have not been made aware of any other incidents in the period and no other issues have been identified during the course of our audit procedures. 2. Matters in relation to related parties 3. Matters in relation to laws and regulations We are not aware of any related party transactions which have not been disclosed We are not aware of any significant incidences of non-compliance with relevant laws and regulations. 4. Written representations A standard letter of representation has been requested from the CCG. 5. Confirmation requests from third parties We have obtained direct confirmations from the National Audit Office for bank balances We requested management to send letters to those solicitors who worked with the CCG during the year. As at 18 May a reply has been received from Bevan Brittan, however this was not sufficient for audit purposes.. We have requested management to follow up the outstanding updated response. 6. Disclosures Our review found no material omissions in the financial statements 2015 Grant Thornton UK LLP Audit Findings Report 2014/15 Date 12

13 Audit findings Internal controls review of issues raised in prior year DRAFT 1. Assessment Issue and risk previously communicated Update on actions taken to address the issue There are no formal policies in place for processing journals. In addition, the system allows for selfauthorisation of journals which potentially could lead to fraud or error. We also noted that senior finance team have access to post journals. A policy is now in place at the CCG for journal procedures which covers journal authorisation policies. Chief Finance Officer access to post journals has been removed. 2. During the year pension contributions were deducted from GPs but these had not been paid over to the NHSPA as the CSU thought they would receive an invoice for these. We understand that these payments will be processed in June Confirmed that in 2014/15 pension contributions have been paid over to the NHSPA throughout the year on a timely basis. 3. In progress South West CSU have not provided evidence of recent penetration or vulnerability assessments for either their system or that of Bristol CCG. There is a risk that without periodic intrusion testing to detect weaknesses in security, that vulnerabilities could be exploited by internal and external parties. This could allow unauthorised access to confidential information. Numerous weaknesses are discovered daily in both hardware and software that can compromise the confidentiality, integrity and availability of an organisation's information systems. South West CSU is in the process of establishing a preferred penetration testing partner for testing key systems. the plan and timetable for penetration testing has ben considered in the wider strategic context of the co-location (CoLo) plan for CSU. This plan is to move critical IT infrastructure to a tier 4 data centre. The target date for CoLo is end July IT Penetration testing will be carried out following completion of the CoLo project, and annually thereafter. Assessment Action completed X Not yet addressed 2015 Grant Thornton UK LLP Audit Findings Report 2014/15 Date 13

14 Audit findings Internal controls review of issues raised in prior year DRAFT 4. Assessment Issue and risk previously communicated Update on actions taken to address the issue South West CSU do not have a lockout policy set and do not proactively monitor the security logs (see Issue 5). There is a risk that user accounts could be compromised by allowing internal (staff wanting to gain access to a system they do not have access to by guessing a colleagues password) or external hacking. South West CSU confirms that a lockout policy is now in place. The settings have been updated so that a user is locked out after 3 attempts with an incorrect password in 30 minutes. 5. In progress Logs of information security activity, for example, unauthorised access attempts within Active Directory were not being formally, proactively, and routinely reviewed. Without formal, proactive, and routine reviews of security event logs, inappropriate and anomalous security activity may not identified and/or addressed in a timely manner. The 'Active Directory Monitoring' project commenced in January 2015 with the installation of monitoring software. Implementation of processes will take place after completion of the CoLo project in July this will provide a range of management tools including reports for ITS Security Administration and Information Governance detailing new account configuration, domain administration activity, failed access attempts and unusual activity. Assessment Action completed X Not yet addressed 2015 Grant Thornton UK LLP Audit Findings Report 2014/15 Date 14

15 Audit findings Adjusted Misstatements An adjustment to the draft accounts has been identified during the audit process. We are required to report all non trivial misstatements to those charged with governance, whether or not the accounts have been adjusted by management. The table below summarises the adjustment arising from the audit which has been processed by management. Impact of adjusted misstatements All adjusted misstatements are set out in detail below along with the impact on the key statements and the reported surplus. Detail Statement of Comprehensive net expenditure '000 Statement of Financial Position '000 Impact on comprehensive net expenditure DR NHS Foundation Trust expenditure 286k CR NHS Trust expenditure 286k Misstatement occurred due to two Trusts converting to Foundation Trusts part-way through the financial year. Overall impact Grant Thornton UK LLP Audit Findings Report 2014/15 Date 15

16 Audit findings Misclassifications & disclosure changes The table below provides details of misclassification and disclosure changes identified during the audit which have been made in the final set of financial statements. Adjustment type Value '000 Account balance Impact on the financial statements 1 Misclassification 3,386 Contingent liability A contingent liability was included in the draft accounts for retrospective continuing health claims of 3,386,000. This did not meet the definition of a contingent liability under IAS37 as the liability lies with NHS England. The CCG has therefore updated their accounting policy 1.23 to disclose the current position with regards to CHC claims in Disclosure - Remuneration report The pay multiple ratios within the remuneration report were calculated incorrectly, however the adjustment required was very minor (to two decimal places). A note was added to explain year on year pay multiple variances. 3 Disclosure - Employee benefits Additional information has been included within the staff sickness note as the information was not available when the financial statements were first presented for audit. 4 Disclosure - Remuneration report Where there is a year-on-year fall in the real value of pension benefits, this should be disclosed as nil, rather than as a negative figure. Negative pension figures within the remuneration report were updated to zeros in line with the manual for accounts. 5 Disclosure - Accounting policies A number of inapplicable accounting policies were included within the draft financial statements. 6 Disclosure - - A small number of other disclosure issues were identified within the draft statement of accounts, which have subsequently been updated following our audit review Grant Thornton UK LLP Audit Findings Report 2014/15 Date 16

17 Section 3: Value for Money 01. Executive summary 02. Audit findings 03. Value for Money 04. Fees, non-audit services and independence 05. Communication of audit matters 2015 Grant Thornton UK LLP Audit Findings Report 2014/15 Date

18 Value for Money Value for Money Value for money conclusion The Code of Audit Practice 2010 (the Code) describes the CCG's responsibilities to put in place proper arrangements to: secure economy, efficiency and effectiveness in its use of resources; ensure proper stewardship and governance; and review regularly the adequacy and effectiveness of these arrangements. We are required under Section 5 of the Audit Commission Act 1998 to satisfy ourselves that the CCG has made proper arrangements for securing economy, efficiency and effectiveness in its use of resources. In 2014/15 we are required to give our VFM conclusion based on two criteria specified by the Audit Commission. These criteria are: The CCG has proper arrangements in place for securing financial resilience. The CCG has robust systems and processes to manage effectively financial risks and opportunities, and to secure a stable financial position that enables it to continue to operate for the foreseeable future. The CCG has proper arrangements for challenging how it secures economy, efficiency and effectiveness. The CCG is prioritising its resources within tighter budgets, for example by achieving cost reductions and by improving efficiency and productivity. Key findings Securing financial resilience We have undertaken a review which considered the CCG's arrangements against the three expected characteristics of proper arrangements as defined by the Audit Commission: Financial governance; Financial planning; and Financial control Overall our work highlighted that the CCG continues to develop robust strategic and operational financial plans and has in place an effective system of financial monitoring and reporting arrangements through the sub-committees to the Governing Body. Challenging economy, efficiency and effectiveness We have reviewed whether the CCG has prioritised its resources to take account of the tighter constraints it is required to operate within and whether it has achieved cost reductions and improved productivity and efficiencies. We note that as at May 2015, the forecast outturn for the full QIPP programme was an achievement of 10.6 million. This represents a shortfall of 6.1 million through underachievement and 4.5 million unidentified QIPP against the 17.4 million requirement. Overall VfM conclusion On the basis of our work, and having regard to the guidance on the specified criteria published by the Audit Commission, we are satisfied that in all significant respects the CCG put in place proper arrangements to secure economy, efficiency and effectiveness in its use of resources for the year ending 31 March Grant Thornton UK LLP Audit Findings Report 2014/15 Date 18

19 Value for Money We set out below our detailed findings against six risk areas which have been used to assess the CCG's performance against the Audit Commission's criteria. We summarise our assessment of each risk area using a red, amber or green (RAG) rating, based on the following definitions: Green Amber Red Adequate arrangements Adequate arrangements, with areas for development Inadequate arrangements The table below summarises our overall rating for each of the themes reviewed: Theme Summary findings RAG rating Key indicators of performance Strategic financial planning Financial governance Financial control Prioritising resources Improving efficiency & productivity The CCG has complied with its statutory financial performance targets and exceeded its forecast surplus. A surplus of 6.4m has been reported in the year-end financial statements. It has effectively managed the in-year financial position with minimal reliance on non-recurrent measures. The CCG has developed a two-year operating plan and five-year strategic plan to 2018/19, including a long term financial model. Both plans are deemed robust and include assumptions based on NHS England planning guidance. Forecasts are subject to risk and sensitivity analysis and regular assessments of future financial viability. The CCG has in place an effective system of financial monitoring and reporting arrangements through the relevant sub-committees to the Governing Body. This ensures that decision-making is based on accurate, frequent and timely financial and performance information. The CCG has adequate arrangements and controls in place to gain assurance over deliverables from the CSU. A dedicated QIPP Performance Management Group has been established in the financial year to monitor progress against QIPP plans. The CCG is fully engaged with a number of partners in the local health economy to manage pooled resources, budgets and determine priorities. It consults and receives input from patients and local residents where possible to determine the quality of services provided and local needs and priorities. We have noted improvements in the financial monitoring of QIPP as mentioned above, however the CCG has reported a significant shortfall in the overall QIPP programme, mainly as a result of over-performance from acute providers within urgent and planned care and unidentified QIPP. Green Green Green Green Green Amber 2015 Grant Thornton UK LLP Audit Findings Report 2014/15 Date 19

20 Value for Money To support our VFM conclusion against the specified criteria we performed a risk assessment against VFM risk indicators specified by the Audit Commission. and additional indicators identified by ourselves. Following completion of our work we noted the following residual risks to our VFM conclusion: Residual risk identified Summary findings RAG rating Delivery of QIPP and service redesign The underachievement of 10.6million within the QIPP programme in the financial year indicates a significant risk to the overall financial health of the CCG into the financial year. We understand that the QIPP programme for is currently being finalised before submission to NHS England in May We recommend that the CCG reflects upon the challenges and the complications which caused the underperformance of projects in , to work towards ensuring a more deliverable QIPP programme in Amber Our discussions with the Head of Strategic Planning and Head of Performance and Information confirm that significant progress is being made towards embedding QIPP schemes and projects for within the organisations operations Grant Thornton UK LLP Audit Findings Report 2014/15 Date 20

21 Section 4: Fees, non-audit services and independence 01. Executive summary 02. Audit findings 03. Value for Money 04. Fees, non audit services and independence 05. Communication of audit matters 2015 Grant Thornton UK LLP Audit Findings Report 2014/15 Date

22 Fees, non audit services and independence Fees, non-audit services and independence We confirm below our final fees charged for the audit and provision of non-audit services. Fees CCG audit 90,000 Total audit fees (excluding VAT) 90,000 Fees for other services Service Fees Non audit work (excluding VAT) Tax support 5,520 Risk Appetite Workshop 1,700 Total 7,220 Independence and ethics We confirm that there are no significant facts or matters that impact on our independence as auditors that we are required or wish to draw to your attention. We have complied with the Auditing Practices Board's Ethical Standards and therefore we confirm that we are independent and are able to express an objective opinion on the financial statements. We confirm that we have implemented policies and procedures to meet the requirements of the Auditing Practices Board's Ethical Standards Grant Thornton UK LLP Audit Findings Report 2014/15 Date 22

23 Section 5: Communication of audit matters 01. Executive summary 02. Audit findings 03. Value for Money 04. Fees, non audit services and independence 05. Communication of audit matters 2015 Grant Thornton UK LLP Audit Findings Report 2014/15 Date

24 Communication of audit matters Communication of audit matters to those charged with governance International Standards on Auditing ISA (UK&I) 260, as well as other ISAs, prescribe matters which we are required to communicate with those charged with governance, and which we set out in the table opposite. The Audit Plan outlined our audit strategy and plan to deliver the audit, while this Audit Findings report presents the key issues and other matters arising from the audit, together with an explanation as to how these have been resolved. Our communication plan Respective responsibilities of auditor and management/those charged with governance Overview of the planned scope and timing of the audit. Form, timing and expected general content of communications Audit Plan Audit Findings Respective responsibilities The Audit Findings Report has been prepared in the context of the Statement of Responsibilities of Auditors and Audited Bodies issued by the Audit Commission ( We have been appointed as the CCG's independent external auditors by the Audit Commission, the body responsible for appointing external auditors to local public bodies in England. As external auditors, we have a broad remit covering finance and governance matters. Our annual work programme is set in accordance with the Code of Audit Practice ('the Code') issued by the Audit Commission and includes nationally prescribed and locally determined work. Our work considers the CCG's key risks when reaching our conclusions under the Code. It is the responsibility of the CCG to ensure that proper arrangements are in place for the conduct of its business, and that public money is safeguarded and properly accounted for. We have considered how the CCG is fulfilling these responsibilities. Views about the qualitative aspects of the entity's accounting and financial reporting practices, significant matters and issues arising during the audit and written representations that have been sought Confirmation of independence and objectivity A statement that we have complied with relevant ethical requirements regarding independence, relationships and other matters which might be thought to bear on independence. Details of non-audit work performed by Grant Thornton UK LLP and network firms, together with fees charged Details of safeguards applied to threats to independence Material weaknesses in internal control identified during the audit Identification or suspicion of fraud involving management and/or others which results in material misstatement of the financial statements Compliance with laws and regulations Expected unmodified auditor's report Uncorrected misstatements Significant matters arising in connection with related parties Significant matters in relation to going concern 2015 Grant Thornton UK LLP Audit Findings Report 2014/15 Date 24

25 Appendices Appendices 2015 Grant Thornton UK LLP Audit Findings Report 2014/15 Date 25

26 Appendices Appendix A: Action plan Priority High - Significant effect on control system Medium - Effect on control system Low - Best practice Rec No. Recommendation Priority Management response Implementation date & responsibility 1 We recommend that the CCG reflects upon the challenges and the complications which caused the underperformance of QIPP projects in , to work towards ensuring a more deliverable QIPP programme in Medium Agreed Chief Finance Officer June We recommend that the CCG continually reviews it's accounting policies ensuring that only applicable and material items are included. It is good practice for the accounting policies to be approved in advance by the Audit Committee. Low Agreed Chief Finance Officer June Management should ensure that tests to identify information security vulnerabilities present at the network perimeter and inside the network are being routinely conducted and that they are provided with evidence that they are happening Low Agreed. Actions in progress as detailed in 'Internal controls review of issues raised in prior year' table on page 13. Chief Finance Officer July Grant Thornton UK LLP Audit Findings Report 2014/15 Date 26

27 Appendices Rec No. Recommendation Priority Management response 4 The logs relating to information security events should be formally reviewed for the purpose of detecting inappropriate or anomalous activity. These reviews should be performed by one or more knowledgeable individuals who are independent of the day-today use or administration of these systems. Low Agreed. Actions in progress as detailed in 'Internal controls review of issues raised in prior year' table on page 13. Implementation date & responsibility Chief Finance Officer July Grant Thornton UK LLP Audit Findings Report 2014/15 Date 27

28 Appendices Appendix B: Audit opinion We anticipate we will provide the CCG with an unmodified audit report INDEPENDENT AUDITOR S REPORT TO THE MEMBERS OF BRISTOL CCG We have audited the financial statements of Bristol CCG for the year ended 31 March 2015 under the Audit Commission Act The financial statements comprise the Statement of Comprehensive Net Expenditure, the Statement of Financial Position, the Statement of Changes in Taxpayers Equity, the Statement of Cash Flows and the related notes. The financial reporting framework that has been applied in their preparation is applicable law and the accounting policies directed by the NHS Commissioning Board with the consent of the Secretary of State as relevant to the National Health Service in England. Governance Statement to identify material inconsistencies with the audited financial statements and to identify any information that is apparently materially incorrect based on, or materially inconsistent with, the knowledge acquired by us in the course of performing the audit. If we become aware of any apparent material misstatements or inconsistencies we consider the implications for our report. In addition, we are required to obtain evidence sufficient to give reasonable assurance that the expenditure and income reported in the financial statements have been applied to the purposes intended by Parliament and the financial transactions conform to the authorities which govern them. We have also audited the information in the Remuneration Report that is subject to audit, being: the table of salaries and allowances of senior managers [and related narrative notes] on page 58 the table of pension benefits of senior managers [and related narrative notes] on page 60 the table of pay multiples [and related narrative notes] on page 59. This report is made solely to the members of Bristol CCG in accordance with Part II of the Audit Commission Act 1998 and for no other purpose, as set out in paragraph 44 of the Statement of Responsibilities of Auditors and Audited Bodies published by the Audit Commission in March To the fullest extent permitted by law, we do not accept or assume responsibility to anyone other than the Clinical Commissioning Group (CCG)'s members and the CCG as a body, for our audit work, for this report, or for the opinions we have formed. Respective responsibilities of the Accountable Officer and auditor As explained more fully in the Statement of Accountable Officer s Responsibilities, the Accountable Officer is responsible for the preparation of the financial statements and for being satisfied that they give a true and fair view. Our responsibility is to audit and express an opinion on the financial statements in accordance with applicable law and International Standards on Auditing (UK and Ireland). Those standards also require us to comply with the Auditing Practices Board s Ethical Standards for Auditors. Scope of the audit of the financial statements An audit involves obtaining evidence about the amounts and disclosures in the financial statements sufficient to give reasonable assurance that the financial statements are free from material misstatement, whether caused by fraud or error. This includes an assessment of: whether the accounting policies are appropriate to the CCG s circumstances and have been consistently applied and adequately disclosed; the reasonableness of significant accounting estimates made by the Accountable Officer; and the overall presentation of the financial statements. In addition, we read all the financial and non-financial information in the annual report which comprises the Strategic Report, Members Report, Remuneration Report and Opinion on regularity In our opinion, in all material respects the expenditure and income reported in the financial statements have been applied to the purposes intended by Parliament and the financial transactions conform to the authorities which govern them. Opinion on financial statements In our opinion the financial statements: give a true and fair view of the financial position of Bristol CCG as at 31 March 2015 and of its net operating costs for the year then ended; and have been prepared properly in accordance with the accounting policies directed by the NHS Commissioning Board with the consent of the Secretary of State as relevant to the National Health Service in England. Opinion on other matters In our opinion: the part of the Remuneration Report subject to audit has been prepared properly in accordance with the requirements directed by the NHS Commissioning Board with the consent of the Secretary of State as relevant to the National Health Service in England; and the information given in the annual report for the financial year for which the financial statements are prepared is consistent with the financial statements Grant Thornton UK LLP Audit Findings Report 2014/15 Date 28

29 Appendices Matters on which we report by exception We report to you if: in our opinion the governance statement does not reflect compliance with NHS England s Guidance; we refer a matter to the Secretary of State under section 19 of the Audit Commission Act 1998 because we have reason to believe that the CCG, or an officer of the CCG, is about to make, or has made, a decision involving unlawful expenditure, or is about to take, or has taken, unlawful action likely to cause a loss or deficiency; or we issue a report in the public interest under section 8 of the Audit Commission Act We have nothing to report in these respects. Conclusion on the CCG s arrangements for securing economy, efficiency and effectiveness in the use of resources Respective responsibilities of the CCG and auditor The CCG is responsible for putting in place proper arrangements to secure economy, efficiency and effectiveness in its use of resources, to ensure proper stewardship and governance, and to review regularly the adequacy and effectiveness of these arrangements. We are required under Section 5 of the Audit Commission Act 1998 to satisfy ourselves that the CCG has made proper arrangements for securing economy, efficiency and effectiveness in its use of resources. The Code of Audit Practice issued by the Audit Commission requires us to report to you our conclusion relating to proper arrangements, having regard to relevant criteria specified by the Audit Commission in October CCG has proper arrangements for: - securing financial resilience - challenging how it secures economy, efficiency and effectiveness. The Audit Commission has determined these two criteria as those necessary for us to consider under the Code of Audit Practice in satisfying ourselves whether the CCG put in place proper arrangements for securing economy, efficiency and effectiveness in its use of resources for the year ended 31 March We planned our work in accordance with the Code of Audit Practice. Based on our risk assessment, we undertook such work as we considered necessary to form a view on whether, in all significant respects, the CCG had put in place proper arrangements to secure economy, efficiency and effectiveness in its use of resources. Conclusion On the basis of our work, having regard to the guidance on the specified criteria published by the Audit Commission in October 2014, we are satisfied that, in all significant respects, Bristol CCG put in place proper arrangements to secure economy, efficiency and effectiveness in its use of resources for the year ending 31 March Certificate We certify that we have completed the audit of the accounts of Bristol CCG in accordance with the requirements of the Audit Commission Act 1998 and the Code of Audit Practice issued by the Audit Commission. We report if significant matters have come to our attention which prevent us from concluding that the CCG has put in place proper arrangements for securing economy, efficiency and effectiveness in its use of resources. We are not required to consider, nor have we considered, whether all aspects of the CCG s arrangements for securing economy, efficiency and effectiveness in its use of resources are operating effectively. Scope of the review of arrangements for securing economy, efficiency and effectiveness in the use of resources We have undertaken our review in accordance with the Code of Audit Practice, having regard to the guidance on the specified criteria, published by the Audit Commission in October 2014, as to whether the Barrie Morris for and on behalf of Grant Thornton UK LLP, Appointed Auditor Hartwell House Victoria Street Bristol BS1 6FT 21 May Grant Thornton UK LLP Audit Findings Report 2014/15 Date 29

30 2015 Grant Thornton UK LLP. All rights reserved. 'Grant Thornton' means Grant Thornton UK LLP, a limited liability partnership. Grant Thornton is a member firm of Grant Thornton International Ltd (Grant Thornton International). References to 'Grant Thornton' are to the brand under which the Grant Thornton member firms operate and refer to one or more member firms, as the context requires. Grant Thornton International and the member firms are not a worldwide partnership. Services are delivered independently by member firms, which are not responsible for the services or activities of one another. Grant Thornton International does not provide services to clients. grant-thornton.co.uk 2015 Grant Thornton UK LLP Audit Findings Report 2014/15 Date