AuditBoard Live Webinar banner advert Diligent One Platform World tour ad April 2024 TeamMate ESG advertising banner 2023

Mersey International Audit Agency

Healthcare sector

A lot of their audit work will include aspects of culture such as complaints handling or patient experience but they have not undertaken audit assignments where that is the primary or single focus.  They report their views on behaviours not just processes.


Mersey Internal Audit Agency (MIAA) is an NHS shared service operating predominantly in the northwest of England. It is one of the largest providers of internal audit and related services within the NHS providing audit and assurance services to over 50 health bodies.

What the cultural issues are

The nature of internal audit has changed in the post Mid Staffs (Francis) Inquiry/Keogh review world. 

One of the key themes for improvement, following the NHS Keogh review of 14 hospital trusts in England that had been persistent outliers on mortality statistics, focused on governance and leadership. A concern, which was highlighted in several trusts, was a significant disconnect between what clinical leadership identified as key risks and issues within the organisation and what was happening in wards and departments. 

The internal audit team has piloted a survey to assess this disconnect between Board and ward level staff in relation to their perceptions around the five theme areas highlighted in the Keogh report:

  • patient experience
  • safety
  • workforce
  • clinical and operational effectiveness
  • governance and leadership

Several clients are keen to pilot this survey with the first having been conducted during November 2013 at an NHS Foundation Trust. 

They are sending the survey to Board members, both executive and non-executive directors and to ward managers. The respondents will have 5 days to complete the 10 minute survey. 

The Duty of Candour is for the NHS and its staff to make sure that they tell patients, families, carers and/or advocates if something goes wrong with their care (this is set out in the NHS Constitution). 

Prior to the aforementioned reviews internal audit would look at the system around e.g. duty of candour from a legal perspective, but now they look at it more widely in terms of how they have demonstrated how open and transparent an NHS organisation has been. 

MIAA produced a briefing note containing key questions that Boards and Executives may look to explore to ensure appropriate processes are in place to robustly address their contractual Duty of Candour requirements.  

Internal audit's approach to assessing culture

A lot of their audit work will include aspects of 'culture' but they have not undertaken audit assignments where culture is the primary or single focus. For example, when auditing 'complaints' they will be forming a view on openness and transparency as part of their work.

Internal audit would also look at how the Trust has changed how they deal with complaints post-Francis including how issues are escalated to the Board and how the Board is engaged through, for example, the use of patient stories. Internal audit asks and looks for evidence to show what the board does in response to complaints handling.

They also look at governance arrangements including committee operation. Taken together the totality of work will inform the HIA opinion on matters of leadership, tone at the top and other cultural issues but they have not done a discrete piece of work on culture.

Internal audit looks at an array of targets and indicators such as staff surveys, patient surveys, never events, serious untoward incidents etc., but now do more work around what outcomes the board want from those. They also look at rotas and staff records etc. to build up a picture through joining the dots. 

The auditor now reports on their views e.g. when they saw an elderly person in unnecessary distress, they raised it in their report. This type of evidence needs careful consideration in its interpretation but they do now mention this sort of thing in reports and would not have done before.

There are some reviews such as 'patient experience' where they will be looking at the processes by which health bodies engage with patients which will reflect the culture of the organisation e.g. treating people with dignity.

Health regulators are taking a far less process-driven approach to their methodology and internal audit work is starting to shift in the same direction. For example, they have done an audit on care of the elderly in in which they observed nurse / patient contact on the ward as part of their evidence gathering process. 

Whistleblowing can be a useful area of evidence when coming to judgements around culture but they are cautious as this can often be mixed up with grievances.

Auditing around the financial controls would have previously been the predominant focus of their audit plans.  Now it forms only about a quarter of their work plans.

The audit committee gives a more positive response now if internal audit gives a limited assurance opinion in an area. It automatically will lead to the manager having to explain the issue or problem in person. Boards welcome clinical and cultural issues being included in the agenda. The audit committee can triangulate more effectively as they have a chance to hear from an independent source (internal audit) and then can see if it resonates with what they are hearing elsewhere.

Internal audit looks at board governance and the culture and behaviours at the board not just committee structures. For example it asks:

  • How does the board hold to account?
  • What does it do with concerns that are raised? 

Good organisations ask the internal audit team to come and do this for them. 

Back to practical examples  |  Next: BAE Systems

Content reviewed: 25 August 2023