Audit Committee 24 June Internal Audit Report Health & Safety. Executive summary and recommendations. Introduction

Transcription

1 Audit Committee 24 June 2009 Internal Audit Report Health & Safety Executive summary and recommendations Introduction As part of the internal audit programme for 2009/10 PKF undertook a review of Health & Safety within HPC. The attached report which includes a management response was agreed with the Executive in June Decision The Committee is asked to discuss the report. Background information None Resource implications None Financial implications As budgeted for in the 2009/10 Financial year Appendices Appendix 1 Report from PKF Date of paper 11 June 2009

2 Employees' Health & Safety Management Review 2009/10

3 Contents 1 Introduction and scope Executive summary Detailed findings Action plan Assurance definitions Project timescales Date project commenced 19/05/09 Date field work completed 05/06/09 Date draft report issued 10/06/09 Date final management comments received 10/06/09 Date final report issued 10/06/09

4 1 Introduction and scope 1.1 In accordance with the 2009/10 internal programme for the Health Professions Council ( HPC ) that was agreed with the Audit Committee in February 2009, we have undertaken a review of the management arrangements over employees health & safety in operation at the HPC. Scope of our work 1.2 As specified in our audit programme the aim of this project was to provide assurance to the HPC regarding its risk management arrangements over employees health & safety. 1.3 We therefore reviewed the HPC s arrangements for the managing the organisation s key risks in relation to this area. Specifically these included: Policies and procedures; Health & safety risk assessments undertaken by specialist contractors; Incident reporting; and Insurances. 1.4 The work was carried out primarily by holding discussions with relevant staff and management, reviewing any available documentation and undertaking detailed testing on a sample basis, where required. The audit fieldwork was undertaken in May and June This report has been prepared as part of the internal audit of the Health Professions Council under the terms of the contract for internal audit services. It has been prepared for the Health Professions Council and we neither accept nor assume any responsibility or duty of care to any third party in relation to it. 1.6 The conclusions and recommendations are based on the results of audit work carried out and are reported in good faith. However, our methodology is dependent upon explanations by managers and sample testing and management should satisfy itself of the validity of any recommendations before acting upon them. Introduction and scope 1

5 2 Executive summary 2.1 This report summarises the work undertaken by PKF within the agreed scope of our review of the management arrangements over employees health & safety in operation at the HPC. The work was performed as part of our agreed internal audit plan for 2009/10. Background 2.2 Health & safety law places duties on organisations and employers. Directors can be personally liable when these duties are breached. Members of the board (or Council in the case of the HPC) have both collective and individual responsibility for health & safety. Our assessment 2.3 Based on the audit work carried out we concluded that the HPC s management arrangements over employees health & safety were satisfactory and operating effectively at the time of our review. Principal findings 2.4 Executive responsibility for health & safety and fire safety at senior management level rests with the Chief Executive and Registrar supported by the Director of Finance and the Facilities Manager (Safety Officer). Ultimate responsibility rests with Council. 2.5 A Safety Group (currently the Fire and Safety Team FAST ) has been established to coordinate and review risk assessments, incident reporting, health & safety audits and workplace inspections and to update the organisation s policy and procedures where appropriate. 2.6 However, in view of the overall responsibilities of Council for health & safety we believe that members should be provided with details of the incidents that have arisen at least annually. This would ensure that they were kept better informed of the nature and extent of health & safety issues for which they have given delegated responsibility to the Chief Executive and Registrar. We have therefore raised a recommendation in relation to this matter. 2.7 The HPC has a risk assessment in place prepared by appropriate technical specialists and has procedures for monitoring the heath & safety impact of any ongoing developments to its premises and for undertaking workplace inspections. 2.8 However, the Health & Safety Executive ( HSE ) recommends that a formal review of the health & safety risk assessment should be undertaken at least annually. We have therefore raised a further recommendation in relation to this matter. Executive summary 2

6 2.9 We noted that the HPC has comprehensive employees liability insurance with AIG UK Limited for any personal accidents that may arise to its employees during eth course of their work and in travelling on HPC business We have not therefore raised a recommendation in relation to this area We wish to thank all members of staff for their availability, co-operation and assistance during the course of our review. PKF (UK) LLP June 2009 Executive summary 3

7 3 Detailed findings Background 3.1 The HPC has a general legal duty to ensure the health & safety of its employees at all workplaces, and in every aspect, related to its work. This is required by Section 2(1) of the Health and Safety at Work Act 1974 (there are similar requirements in Section 3 in respect of risks to non-employees such as visitors and volunteers). 3.2 Specific regulations made under this Act that the HPC needs to comply with (where appropriate) include: Health and Safety at Work Act 1974; The Management of Health and Safety at Work 1999; Safe Use of Work Equipment, Provision and use of Work Equipment 1998; Manual Handling Operations 1992; Workplace (Health, Safety and Welfare)1992; Personal Protective Equipment at Work 1992; Health and Safety (Display Screen Equipment) 1992; and Regulatory Reform (Fire Safety) Order Health & safety law places duties on organisations and employers. Directors can be personally liable when these duties are breached. Members of the board (or Council in the case of the HPC) have both collective and individual responsibility for health & safety. 3.4 Larger public and private sector organisations need to have formal procedures for auditing and reporting health & safety performance. If a health & safety offence is committed with the consent or connivance of, or is attributable to any neglect on the part of, any director, manager, secretary or other similar officer of the organisation, then that person (as well as the organisation) can be prosecuted under section 37 of the Health and Safety at Work Act In extreme cases, those found guilty are liable for fines and potentially imprisonment. More recent legislation regarding corporate manslaughter also needs to be considered carefully. 3.5 The HPC s health & safety risks arise primarily at its Head Office in Kennington, although some fitness to practise hearings or conference activity may take place off site. The impact of not managing these risks effectively may be an injury or death of an employee or visitors to the building and contractors. Detailed findings 4

8 Key risk 3.6 The HPC has identified the health & safety of its employees as a high inherent risk in its February 2009 risk register. 3.7 The focus of our work was therefore upon the arrangements to manage the health & safety of the HPC s employees. Other arrangements for the protection of visitors and contractors were outside the scope of this review. 3.8 The key management controls that the HPC is relying upon to manage the health & safety of its employees are as follows: Policies and procedures; Health & safety risk assessments undertaken by specialist contractors; Incident reporting; and Insurances. 3.9 The findings of our review of these controls and health & safety risk management in general are set out below. Findings Policies and procedures 3.10 Following a detailed review by the Finance and Resources Committee, the HPC s health & safety policy was adopted by Council in September The policy was developed with the advice of external health & safety consultants Lawrence Webster Forrest ( LWF ) The policy states that the HPC undertakes to comply with statutory health & safety and fire safety requirements and that the HPC is responsible to ensure that there are sufficient arrangements in place for the safety of all employees and visitors and other building occupants in each of the buildings and premises it occupies. The policy brings together the HPC s policies on Security, Fire Procedures, Smoking and First Aid that were previously included separately in the Employee Handbook Executive responsibility for health & safety and fire safety at senior management level rests with the Chief Executive and Registrar supported by the Director of Finance and the Facilities Manager (Safety Officer). Ultimate responsibility rests with Council A Safety Group (currently the Fire and Safety Team FAST ) has been established to coordinate and review risk assessments, incident reporting, health & safety audits and workplace inspections and to update the organisation s policy and procedures where appropriate. Detailed findings 5

9 3.14 We noted that this group met twice during 2008/09 and is scheduled to meet again shortly. The group comprises the nominated health & safety representatives for each department and the fire wardens and those responsible for health & safety within the HPC We understand that training in health & safety matters was provided to these individuals by the Facilities Manager during 2008/09. This is to be followed up by a further programme of training to be provided by LWF during At each meeting of the Finance and Resources Committee, an update on health & safety matters is provided in the Facilities Management report. This report is also included in the Management Information Pack for Council, presented by the Chief Executive Based on our review work and discussions with management we understand that very few health & safety incidents have arisen in recent years at the HPC. During 2008/09 we are advised that only two relatively minor incidents arose. However, in view of the overall responsibilities of Council for health & safety we believe that members should be provided with details of the incidents that have arisen at least annually. This would ensure that they were kept better informed of the nature and extent of health & safety issues for which they have given delegated responsibility to the Chief Executive and Registrar We have therefore raised the following recommendation. Recommendation R1. Council should be provided with details of the number and type of health & safety incidents that have arisen at the HPC at least once annually. Health & safety risk assessments 3.19 A health & safety risk assessment covering the HPC s activities was undertaken by external health & safety consultants LWF in 2007 when the organisation s health & safety policy was developed. Health & safety audits and work place inspections are to be undertaken by the Facilities Manager or nominated representatives in accordance with the risk assessment. The completion of these audits is monitored through the FAST group Since the risk assessment was undertaken, there have been significant structural changes made to the HPC s Head Office, which were the subject of our previous reports on Stannary Street. A further phase of works is currently underway. Through the procurement and design processes for this work health & safety issues have been given a high priority and we noted that the contractors are required to report on health & safety issues in their monthly progress report. The Facilities Manager is responsible for issuing contractors with Permits to Work or Hot Work Permits (if required) and specific contract conditions pertaining to health & safety and fire safety prior to commencement of work. Detailed findings 6

10 3.21 The premises development works took place throughout 2008 and have continued into The approach adopted by the HPC has been to manage the health & safety impact of any works that have been undertaken as part of the project and contractor management process taking into account the risks highlighted in the organisation s risk assessment The HPC therefore has a risk assessment in place prepared by appropriate technical specialists and has procedures for monitoring the heath & safety impact of any ongoing developments to its premises and for undertaking workplace inspections. However, the Health & Safety Executive ( HSE ) recommends that a formal review of the health & safety risk assessment should be undertaken at least annually. We have therefore raised the following recommendation. Recommendation R2. The HPC should undertake a formal review of its health & safety risk assessment each year in order to meet HSE best practice. Incident reporting 3.23 The nominated health & safety representatives are responsible for recording and reporting all accidents, incidents and near misses to the Facilities Manager. We noted that these were being considered at the meetings of the FAST group. Where there is a possibility that there is legal requirement to report the incident to the Health & Safety Executive ( HSE ), for example under ( RIDDOR ) Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995, we understand that the Facilities Manager liaises with the HSE We have not therefore raised a recommendation in relation to this area. Insurances 3.25 The HPC has comprehensive employees liability insurance with AIG UK Limited for any personal accidents that may arise to its employees during eth course of their work and in travelling on HPC business The maximum limit of cover for any one accident amounts to 15 million with a higher limit set for aircraft accidents. Our review indicated that the insurance is reviewed and renewed on an annual basis. The most recent renewal was undertaken in March 2009 and the covers runs until 31 st March We have not therefore raised a recommendation in relation to this area. Detailed findings 7

11 4 Action plan Ref. Findings Recommendations Priority Management Response Due Date Responsible Officer Policies and procedures R1 In view of the overall responsibilities of Council should be provided with Low Agreed. July 2009 Council for health & safety we believe that members should be provided with details of details of the number and type of health & safety incidents that Chief Executive and Registrar the incidents that have arisen at least have arisen at the HPC at least annually. This would ensure that they were once annually. kept better informed of the nature and extent of health & safety issues for which they have given delegated responsibility to the Chief Executive and Registrar. Action plan 8

12 Ref. Findings Recommendations Priority Management Response Due Date Responsible Officer Risk assessments R2 The HPC has a risk assessment in place The HPC should undertake a Medium Agreed. July 2009 prepared by appropriate technical specialists and has procedures for monitoring the heath & formal review of its health & safety risk assessment each Facilities Manager safety impact of any ongoing developments to year in order to meet HSE best its premises and for undertaking workplace practice. inspections. However, the HSE recommends that a formal review of the health & safety risk assessment should be undertaken at least annually. Action plan 9

13 5 Assurance definitions Assurance Level Definition Sound Satisfactory design of internal control that addresses risk and meets best practice and is operating as intended. Satisfactory Satisfactory design of internal control that addresses the main risks but falls short of best practice and is operating as intended. Satisfactory in Most Respects Generally satisfactory design of internal control that addresses the main risks and is operating as intended but either has control weaknesses or is not operating fully in some significant respect. Satisfactory Except For.. Satisfactory design of internal control that addresses the main risks and is operating as intended in most respects but with a major failure in design or operation in the specified area. Inadequate Major flaws in design of internal control or significant non operation of controls that leaves significant exposure to risk. Assurance definitions 10