Digital

We help clients establish proportionate governance across the full lifecycle of AI and emerging technology,
from initial proposal and procurement through implementation, operation, significant change and retirement.

We review whether the organisation has visibility of its AI systems, automated processes and connected
technologies, including tools acquired locally or accessed directly by staff. This helps identify unclear
ownership, inconsistent approval and technology operating outside established governance arrangements.

Our advisory work can consider the strength of business justification, procurement and supplier due
diligence, information governance, data protection, cyber security and clinical safety. Where the technology
may affect clinical or operational decisions, we also consider how the organisation evaluates accuracy, bias,
false or inconsistent outputs, human oversight and the consequences of system failure.

A key part of the service is determining whether accountability remains clear. We examine who owns the
technology, who approves its use, how users challenge its outputs and how concerns are escalated. This is
particularly important where professional judgement must remain central to decisions affecting patients or
services.

Assurance does not end at implementation. Our work can examine whether performance, incidents,
complaints, user feedback, supplier changes and emerging risks are monitored after deployment. It can also
cover Robotic Process Automation, Internet of Medical Things, generative AI and AI-supported clinical
systems, with the depth of review matched to the purpose and potential impact of the technology.

As NHS organisations become increasingly dependent on digital systems, a cyber incident
can have consequences far beyond the technology function. It can interrupt clinical services,
limit access to patient information, disrupt operational processes and affect public confidence.

We provide independent assurance over whether cyber risks are understood, appropriately
governed and effectively managed. We examine not only whether controls have been
designed, but whether there is sufficient evidence that they operate in practice and can
support the organisation when a cyber incident occurs.

Our reviews can cover Board and executive oversight, identity and privileged access,
vulnerability and patch management, security monitoring, incident response, business
continuity, disaster recovery and backup restoration. We also assess third-party cyber risk,
including how critical suppliers are selected, contracted, monitored and held accountable for
security and resilience.

Where appropriate, the service can incorporate penetration testing, targeted technical
assessments, mock phishing exercises and cyber awareness sessions tailored to Boards,
clinicians, operational teams and digital specialists.

Digital transformation can improve care, productivity and patient experience, but significant investment does
not automatically deliver successful change. Programmes can lose value where governance is unclear, risks
are not escalated, operational teams are not ready or expected benefits are not measured.

We provide independent assurance throughout the digital transformation lifecycle. We help Boards,
programme sponsors and senior responsible owners understand whether a programme remains controlled,
achievable and aligned with organisational priorities.

At the strategy and mobilisation stage, we assess whether the case for change is supported by clear
outcomes, appropriate ownership, realistic resources and effective governance. We also consider whether
digital priorities align with wider organisational objectives and relevant NHS expectations, including the What
Good Looks Like framework.

During design and delivery, our work can examine programme risk, clinical safety, information governance,
supplier performance, data quality, system testing, workforce readiness, interoperability and dependencies
between digital and operational change. This gives programme leaders an independent view of delivery
confidence before risks become embedded or more costly to resolve.

For Electronic Patient Record and other major system implementations, assurance can be aligned to key
decision points. This may include data migration, user acceptance testing, training, cutover planning,
downtime arrangements, operational readiness and go-live approval. Following implementation, we can
assess whether the system is being adopted as intended, residual risks remain controlled and expected
benefits are being achieved.

Our experts use automated tools to carry out in-depth investigations of your systems and data to help us
understand how efficiently your systems are operating and where key risks may exist.

Through specialist software, we can interrogate your systems as part of our audit work or through an
additional commissioned review. The software also provides access to ‘smart apps’ and machine learning
applications, which can support our testing where appropriate. This allows us to test 100% of the data
population, provide a greater level of assurance, support more efficient testing, and help identify
opportunities to improve cost-effectiveness.

Bespoke workflows can be developed to meet client needs and support continuous system monitoring at an
agreed frequency, providing regular assurance. The software can also combine reports from systems that do
not ordinarily ‘talk to each other’, helping to identify control weaknesses and/or poor application of controls.

Examples include but are not limited to:

• Finance systems including duplicate payments both to Suppliers and Staff/Volunteers.
• Travel expenses paid at the correct rate, emission calculations and duplicate payments.
• Human Resources, duplicate, missing or unusual format of key data fields, across different members of
  Staff/Volunteers.
• Utilisation of services/clinics including frequency and attendance.
• Mandatory training attendance for Staff/Volunteers identifying gaps and poor attendance rates.