Now, I’m here to talk about good governance. And, as Auditor General for Wales, I’m sure you can hazard a guess at what I think about it. But, the main message I want to get across today is that good governance is not just a matter of setting up systems or checklists, or doing things by the book. It’s about thinking. That may be disappointing to some of you and, I agree, it is often easier to go through a checklist. But good governance is something that should be instinctive.

What is Governance?
Let’s start with some definitions of good governance. According to the Cadbury Committee Report, published in 1992, Governance is “the system by which organisations are directed and controlled.”

This is a general and comprehensive description, reflecting the fact that governance is linked to every aspect of an organisation. But what is the purpose of governance? Well, according to the Independent Commission for Good Governance in Public Services, the function of governance is:

“To ensure that an organisation fulfils its overall purpose, achieves its intended outcomes for citizens and service users, and operated in an effective, efficient and ethical manner.”

The issue of Governance has received significant attention in recent years partly through things like the Nolan Principles, the Public Interest Disclosure Act and the Combined Code. Legislation and codes like these have been introduced to address a series of high profile scandals which have resulted over the last twenty years through poor governance.

The principles of good governance
The primary purpose of public audit is to promote improvement, but from time to time we do look at scandals. However, I do not want to give you the impression that the main thrust of the Wales Audit Office is investigating scandals or pointing the finger of blame.
Our focus on good governance is to encourage organisations to improve themselves. And this can be achieved by following six principles of good governance, as set out by the Independent Commission for Good Governance in Public Services. They are:

• Performing effectively in clearly defined functions and roles.
• Developing the capacity and capability of the governing body to be effective.
• Taking informed, transparent decisions and managing risk.
• Promoting values for the whole organisation and demonstrating good governance through behaviour.
• And focusing on the organisation’s purpose and on outcomes for citizens and service users.
• Engaging stakeholders and making accountability real.

Like most principles, they are easy to read, but what do they really mean? Well, I hope to illustrate what they mean by showing you some famous ‘scandals’ - or failures of good governance - and highlighting what relevance they have for the NHS in Wales.

Nick Leeson - what went wrong?
Nick Leeson’s trading on the Singapore Stock Exchange famously brought down Barings Bank. After the collapse, the Bank of England commissioned an investigation and produced a long and complex report. The whole report can be summed up in an Appendix, which shows 3 pictures of different organisational charts, on three dates in the same year. Because functions and roles in Barings were so far from being clearly defined, the Inquiry found it difficult to establish who was responsible for what. The principle of good governance - “performing effectively in clearly defined functions and roles” - wasn’t applied here.

Now, this couldn’t happen to the NHS could it? Well, actually, it could. In November 2005, a report to the Treasury on fraud in Government departments, including the NHS, found that:

“In value terms the most significant frauds arose because the activities of some staff were not monitored closely enough or because there was a lack of segregation of duties between functions such as requisitioning, ordering and payment.”

This is a very traditional failing, which good governance would easily eliminate.

Robert Maxwell - what went wrong?
On paper, the governing body of Maxwell companies looked fine, ticking all the boxes. But the problem was that it had Robert Maxwell at the top. He was a huge man in terms of size, personality, intelligence and capacity for mischief. So, what went wrong?
Well, it would seem that principle number 2 was missing. That is:
“Developing the capacity and capability of the governing body to be effective.”

This couldn’t happen in the NHS? Surely not! Well, that’s not what a survey by the Royal Society for the Encouragement of Arts, Manufactures and Commerce found in 2003. It concluded that:

“NHS board management was guilty of tokenism, lack of focus and cohesion, and confusion about its roles and responsibilities and the legislative framework within which it operated. Boards were inadequately skilled, particularly in information technology, and age biased, relying heavily on people who a re retired or not employed. Vacancies were rarely advertised and appointments sometime completely random.”

An ineffective board is worse that not having one at all.

The Bank of Credit and Commerce international - what went wrong?
The BCCI was founded in the 1970s and developed at great pace. It had a lot of cash and was offering great levels of return. This seemed too good to be true and it was. The bank was being run as a large scale fraud by top management in a way that was particularly difficult for auditors to pick up. When it collapsed, total losses ran into thousands of millions of pounds.
It would, therefore, appear that Principle 3 wasn’t being applied:
“Taking informed, transparent decisions and managing risks.”

But this couldn’t happen in the NHS? you ask. Sadly, following the deaths of ten women at Northwick Park Hospital, a Health Commission report found that:

“The systems and processes for the management of risk in maternity services were not effective.”

The management of risk is another newly fashionable term. And, again, talking about it isn’t enough.

Bristol Royal Infirmary - what went wrong?
The fourth principle of good governance talks about “promoting values for the whole organisation and demonstrating good governance through behaviour.”
In the case of the ‘Bristol heart babies scandal’, behavioural issues were crucial.
Could this happen again elsewhere in the NHS? Well, a Unison Survey of NHS staff in 2003 found that:

“A third of staff who had blown the whistle on a patient safety concern said they suffered some personal comeback.”

Now, the Auditor General for Wales is a statutory recipient of public interest disclosures. I do get people writing in, but not many. What is worrying is that this Unison survey found that a third of staff had suffered personal comeback. It means that the number of people who fear the risk of personal comeback is probably even higher.
There is a real feeling in the public service, not just the NHS, that you cannot blow the whistle. And we all have a duty to do whatever we can to make sure this sort of thing doesn’t happen in our workplace.

The Crown Agents - what went wrong?
This was a very strange public body established in the early nineteenth century by Royal prerogative. Its business was to procure goods and services required by colonial governments. By the late 1960s it decided it could make more money by moving into banking. The Crown Agents’ banking business expanded and did fantastically well. Then came the first oil price hikes and the London property market collapse. Because the organisation had been lending to property companies, the business failed overnight, with £212 million worth of losses.
Where was the principle - “focusing on the organisation’s purpose and on outcomes for citizens and service users”?
Crown Agents had taken themselves into an entirely new business and had allowed themselves to be diverted into a business where they had no relevant skills at all.

Could this happen in the NHS? Well, large numbers of NHS bodies in England and Wales are in financial deficit and are reliant on significant income generation targets to meet their SCEP targets. Income generation schemes are becoming increasingly more ambitious. But getting out of deficit by using increasingly creative means brings with it plenty of risks.

Fiddling the figures: Surrey and Sussex - what went wrong?
There is a term you may be familiar with - “aggressive profit management”. In the case of waiting list figures in England, my National Audit Office colleagues 5 years ago uncovered evidence of figures being fiddled. Now, we all understand the pressures people are under when there is strong political focus on targets and that people will be tempted to do strange things. But the following principle should always be applied: “engaging stakeholders and making accountability real”. 

The Chairman of the Public Accounts Committee, Edward Leigh, said in 2002:

“Deliberate manipulation of waiting lists undermines public confidence in the NHS. There is more and more pressure being put on officials, they are worried they are going to get their knuckles rapped and this is what happens.”

Could the ‘scandal’ at Surrey and Sussex happen elsewhere in the NHS? Well, a 1994 Audit Commission report on probity in the NHS quoted from a survey of NHS Board members, which found that half of them felt that it was acceptable to ‘break the rules’ if they believed that it was in the interest of the NHS.

The Millennium Dome - what went wrong?
Which principles of governance were not adhered to here? A lot! From the point of view of the auditors, the way the Dome was established was very odd. It took months to work out who was accountable for what. There were grossly overlapping functions and roles. There was varied behaviour being displayed, with a huge focus on getting the Dome built on time, but not much on what should go inside it. And, the forecasting of risks was not properly managed.

All the ‘scandals’ I have listed today should, I hope, make you think about your work. They do apply to the NHS, as do the principles of good governance.
There is, of course, a dilemma in practice. Looking internally, you want people in complex organisations to exercise skills and creativity but we want to avoid scandals. Getting the balance right is what we are all paid for.
I will leave you with a quote from the Chief Executive of the NHS Appointments Commission, Roger Moore:

“The NHS has more devolved authority than it has ever had before. With all change comes a level of risk. That risk can only be accepted safely and securely within a framework and that framework is governance.”

Thank you.