Office for Environmental Protection
Annual Report and Accounts for the year to 31st March 2023

The Accounting Officer is responsible for maintaining a system of internal control that supports the achievement of the OEP’s policies, aims and objectives, while safeguarding public funds and departmental assets. This is in accordance with the responsibilities assigned in the HM Treasury publication Managing Public Money.

This governance statement describes how these duties have been carried out by the Accounting Officer and the supporting structure in place in the period.

During 2022/23 our governance arrangements and broader controls continued to develop as we established our operations and matured the controls and assurance framework which supports our work. The Accounting Officer ensured that proportionate controls were in place, and that these were applied in a system of effective governance. Please see Financial governance and control section below.

The framework document which sets out the governance, accountability and funding arrangements between the OEP, Defra and DAERA was in negotiation in the period, and remains in negotiation at the date of publication. In the absence of a framework document, the OEP followed relevant guidance and standards including Managing Public Money and Cabinet Office Spend Controls. We also developed plans to and then followed the intended requirements of the framework document where these were agreed in principle, ahead of the formal agreement to the framework document by all parties. Many of the likely expectations of the framework document were in place throughout the period, or put in place during the year.

Our internal governance framework has been designed to comply with HM Treasury’s Code of Good Practice for Corporate Governance, as is appropriate for an independent non-departmental public body, and consistent with the provisions for our governance in the Environment Act 2021. Our operations are designed to comply with the mandatory requirements of the relevant government functional standards.

Our arrangements differ in limited circumstances. The board has decided not to constitute a nominations committee, and instead consider such matters itself. The Head of Finance and Corporate Services was the senior officer responsible for finance throughout the period, and held the role of Finance Director envisaged by Managing Public Money. They had a right of attendance at all meetings of the board, and to give advice to the Accounting Officer or the board at their discretion at any time. The board decided on these arrangements to reflect the size and nature of the OEP and the complexity of our operations.

During the year, the arrangements for our governance were reviewed by Defra under the Cabinet Office’s Arm’s-length Body Review programme. It found the OEP to be in good health, with plans in place to meet the minimum requirements of an Arm’s-length Body. The 12 recommendations of this review are published. Our approach to governance, strategy and performance management has also been audited by our internal auditors in the period.

The board

The board is The legal authority of the OEP. The Environment Act 2021 sets out how its members are to be appointed.

The Chair and two to five non-executive board members are appointed by the Secretary of State for Environment, Food and Rural Affairs in England. One non-executive member is appointed by the Department of Agriculture, Environment and Rural Affairs in Northern Ireland.

Natalie Prosser, the first permanent Chief Executive was appointed by the Chair on 1 May 2022. Future Chief Executives are to be appointed by the board.

The board must also appoint one to three employees as executive members. The board has decided to appoint one executive member, and for that to be an executive director of the OEP. This appointment will be made for a six-month period in rotation between the executive directors, with the exception of the General Counsel. During his secondment to the role of Chief Insights Officer, Professor Robbie McDonald is not eligible to be appointed as an executive member of the board. The executive member of the board is therefore either the Chief of Staff or the Chief Regulatory Officer in rotation.

In the period, the board was formed by:

* These appointments were made on a designate basis before the OEP was legally created, and became appointments to the board of the OEP on 17 November 2021, when the OEP was legally created.

~ Natalie Prosser was a member of the board in the role of Interim Chief Executive until her appointment as Chief Executive on 1 May 2022

# This appointment has no determined end-date. The OEP Chief Executive is an ex-officio member of the board.

The board held seven ordinary and eight extraordinary meetings and one workshop in the period from 1 April 2022 to 31 March 2023. Minutes and papers of board meetings are published on our website, ordinarily within two months of being approved by the board.

The regular business of the board included: agreeing minutes from previous meetings and the matters arising; considering a report of the Chief Executive setting out progress in delivering our strategic objectives; considering reports about finance and risk and other matters escalated by the Chief Executive.

In addition, the board regularly considered decisions reserved to it in law, or under our delegation policy. This includes approval of our annual report to Parliament on progress in improving the natural environment in England; advice to Ministers, or departments of the Northern Ireland Executive; considering strategically significant decisions to begin any investigation into a potential failure to comply with environmental law by a public authority, and receiving reports on the progress of such investigations; considering the objectives and scope of reports initiated into the implementation of environmental law, and; approving our strategy and enforcement policy, annual report and accounts, corporate plan and budget, and significant policies, contracts and other corporate matters.

Data and information were provided to the board within the formal reports it received. This included information on complaints received, risks, progress in delivering our corporate plan and certain other performance information. All information provided to the board was scrutinised and assured by the executive leadership in advance. The board judged the information it received proportionate and of appropriate quality.

Committees of the board

In the period there was one committee of the board, the audit and risk assurance committee (ARAC)

The ARAC is a permanent sub-committee of the board to support it and the Chief Executive as Accounting Officer in their responsibilities for risk, control and governance. It also oversees internal and external audit arrangements covering both financial and non-financial systems.

The ARAC met five times in the period. It is chaired by Dr Paul Leinster CBE and Professor Dan Laffoley is a second non-executive board member. An independent member is also appointed to the ARAC to bring expertise relevant to the ARAC’s remit. The Head of Internal Audit and external auditor also routinely attended and reported to the ARAC.

The regular business of the ARAC included: agreeing minutes from previous meetings; considering an action tracker; considering the risk report; considering deep dives into areas of strategic risk in accordance with a programme decided by the ARAC; considering reports from our internal and external auditors; considering reports on health and safety, mandatory training completion, fraud, security and whistleblowing.

In addition, the ARAC considered other business. This included recommending the annual report and accounts to the board for approval; considering the audit planning report; considering the internal audit opinion; considering significant policies relevant to its work, including financial policies and procedures and the business continuity policy.

Board effectiveness

The board appointed an independent consultant to review its effectiveness in accordance with Cabinet Office and other relevant guidance and good practice. The board decided to conduct an independent review after its first year of operation to provide early independent assurance of its own effectiveness.

The review reported that the board is working well and showing the attributes of an effective board. The board endorsed the findings of the review and agreed a plan to improve its effectiveness, in response to its recommendations. Areas of focus include ensuring sufficient time for the board to focus on its most strategic discussions, and to develop a medium-term plan to consider strategic questions as to how the OEP can best secure the impact we intend.

Board and committee attendance, and significant interests

The board has adopted a governance framework to govern its business. This includes a code of conduct for the board consistent with the seven principles of public life and the code of conduct for board members of public bodies.

Members’ attendance at the board and committees on which they served is shown below:

* denotes the chair.

Executive Directors not appointed to the Board, the Head of Finance and Corporate Services, Head of Communications and Strategic Engagement and the Head of Business Strategy and Planning routinely attend meetings of the Board, workshops and relevant committee meetings. Other staff members attend to support the consideration of business before the board.

Every 12 months, board members and executive directors are required to complete a declaration of interests in which they must disclose any financial and non-financial interests of their own, their partner or any immediate family members. In addition, any new interests are required to be declared as they arise. Where a member’s interest may represent a conflict, arrangements are put in place by the Chair to manage the risk.

As a further safeguard, at the start of each board meeting, members are asked to declare if they have any interests which they believe conflict with any item on the meeting agenda. This is recorded in the minutes.

The directorships and other significant interests of members of the board and its committees are shown below. During the year, Julie Hill MBE and Dr Paul Leinster CBE were recused from discussions and decisions relating to certain items of the Board’s business in light of their previous roles as a board member and Chief Executive of the Environment Agency respectively.

The directorships and other significant interests of executive directors who are not members of the board are as follows:

Executive governance

The Chief Executive established an executive committee to advise her in the discharge of her delegated authority from the board, to provide a forum for assurance, scrutiny and challenge of recommendations and information provided to the board and to provide leadership for the business of the OEP.

The executive committee is constituted by the Chief Executive, the executive directors, the Head of Business Strategy and Planning, the Head of Finance and Corporate Services and the Head of Communications and Strategic Relations. The Northern Ireland Lead attends the executive committee for all business connected with our functions in relation to Northern Ireland. The Data Protection Officer has the right to attend the executive committee.

The business of the executive committee included the assurance of information provided to the board and the analysis supporting recommendations for the decisions of the board. It also regularly considered finance, organisational performance and risk.

Risk management

Our risk framework defines the approach to identify, manage and report on risk decided by the board, and scrutinised by the ARAC. It is based on HM Treasury’s Orange Book:  Management of Risk – Principles and Concepts. Our internal auditors reported substantial assurance in their audit of our risk management arrangements during the year.

All OEP staff have responsibility for identifying and escalating risks. All decisions of the OEP’s executive committee, board and any board committee are supported by an analysis of risk.

Risks to the OEP’s objectives and strategic goals are escalated to the strategic risk register, which is reviewed by the executive committee regularly, scrutinised by the ARAC in each of its meetings and considered by the board quarterly. Management of operational or delivery risks is delegated to executive directors, and recorded in operational risk registers.

In accordance with the draft framework document, we report relevant risks to Defra and DAERA on a quarterly basis which could have impact beyond the OEP, and which require a wider approach to mitigate and control. These can be escalated within Defra to the appropriate governance forums in which they can be managed.

In its scrutiny of the risk framework, the ARAC has played an active role in developing the way it is implemented. This has included the way risk is recorded, the way risk tolerance has been defined and implemented, improvements to the definition of strategic risks, and assurance on the management of operational risks. This has led to a reduction in the risks managed in the strategic register, to ensure appropriate focus by the executive and board on those risks the board considers most strategic.

The risk environment in which the OEP operates has evolved in the year, as we complete our establishment phase and increasingly exercise our functions. Strategic risks that have been reported in the reporting period include:

Confidence in the OEP is not maintained. This is critical to our credibility and ability to influence for our objectives. We control this risk through the underpinning objective, evidence-led and impartial quality of our work, and our stakeholder engagement and communications strategy. During the year, we also escalated confidence risks relating to particular events, or activities. This included risks arising from the UK government’s failure to set statutory targets at the time required by the Environment Act, and risks relating to confidence in our report scrutinising environmental progress in England.

The independence of the OEP is, or is seen to be, fettered. The independence of our judgements and actions is central to the confidence the public and stakeholders have in us, and the effectiveness of our activities and recommendations. The framework document we are negotiating with Defra and DAERA is a key mitigation.

The OEP’s outputs are not effective. Some of our functions have impact through the effect they have on others. We mitigate this risk through stakeholder engagement, and the objective, evidence-led and impartial basis to our work. We plan to develop the approach we take to measure our impact, over time.

Insufficient resourcing to deliver our strategy and exercise our functions. We were sufficiently funded to fulfil our functions in the period. In the medium term, we aim to mitigate this risk through Defra and DAERA’s review of our long-term resourcing needs as well as our own efficiency. We were provided with some additional resources from Defra for the year 2023/24, and anticipate seeking additional resources for the year 2024/25.

Insufficient capacity and capability to deliver. This has been a notable risk in delivery of our Northern Ireland functions in the period, as we have developed our Northern Ireland operating model and recruited our first Northern Ireland staff. Risks relating to capacity were escalated to the strategic register in relation to our procurement function and our Insights directorate following challenges in planned recruitment. Key mitigations in the period include recruitment, and developing our ability to commission external expertise.

A material underspend to our available resources in year. This risk increased in likelihood during the year as we took decisions which reduced the cost of our long-term office accommodation in Worcester, but delayed expenditure in year. Challenges in recruiting to our Insights team, and delayed expenditure under our evidence programme was also a key driver. We mitigate through active monitoring and prioritisation in year, and through early disclosure of underspend to Defra and DAERA so that funds can be reallocated to other priorities by Defra and DAERA as needed.

Lack of timely or effective cooperation fetters our ability to discharge our statutory duties. Much of our work requires cooperation from public authorities, including through the provision of information. All public authorities have a duty to cooperate with us, set out in the Environment Act. During the year, the likelihood and impact of this risk increased as we increasingly exercised our functions. In mitigation, we began work with Defra to develop further processes and principles to improve effective and efficient cooperation between us.

The wellbeing of the OEP’s staff is impacted. We actively monitor this including through our first people survey and address concerns as required. Mitigation is also linked to completion of our resourcing plans.

A regulatory decision of the OEP is subject to successful legal challenge. We manage this risk through well-defined and structured evidence gathering, judgement and governance and through appropriate internal or external legal advice.

Operational failure as we exercise functions, and undertake tasks for the first time. This strategic risk is the cumulation of individual operational risks managed under our operational risk registers. We mitigate this through completion of our policy, procedure, governance and control framework, and from embedding a continuous learning approach to delivery, such as through lessons learned approaches.

Cyber security or business continuity event. We have controls in place through the contractual arrangements for our information management technology and estate. We developed our business continuity management approach further in year.

Financial governance and control

During the period, the governance and controls for financial propriety and regularity were subject to transition, as our finance function was established, and the financial policies and procedures developed accordingly.

From February 2022, the OEP implemented its own suite of financial governance and control, including ensuring appropriate segregation of duties within a small finance team. The board approved an updated Financial Scheme of Delegation and associated Finance Handbook in March 2022. The policies continued to be developed during this period and were scrutinised by the ARAC and further varied in May 2022 and during the year. Key financial controls relating to payroll and accounts payable were subject to internal audit in 2022/23, with the internal auditors reporting moderate assurance in each case.

During the year, there were delays in the production of regular monthly management accounts and in carrying out the intended system-led control of bank reconciliations due to challenges in recruiting to the finance team and subsequent delays to the accounting function set up. Most notably, the system generated bank reconciliations were not completed on a timely basis, but instead were batched together. Separate checks were carried out to mitigate against the risks of fraudulent transactions occurring through the bank. At year end, all bank reconciliations were completed. We agreed an action plan in respect of these issues with our external auditors, overseen and scrutinised by the ARAC and Accounting Officer after period end.

Internal Audit

The Government Internal Audit Agency (the GIAA) was appointed to provide the OEP’s internal audit service in March 2022. At that time, the ARAC and Accounting Officer agreed an internal audit plan, informed by our risk profile, for delivery in 2022/23 and an indicative plan for subsequent years.
All seven audits planned for the 2022/23 year were delivered. There were no variations to the plan in year. The GIAA uses four classifications to summarise its opinion of its assurance on the matters subject to audit: substantial, moderate, limited or unsatisfactory.

Individual audits completed in year and the GIAA’s opinion for each are set out below.

We agreed a response to each of the 20 recommendations made during the course of the GIAA’s work during the year. Progress in implementing these was reported to the ARAC. At the end of the year, actions agreed in five instances are completed, nine were not yet due for completion and six were overdue at 31 March 2023. Extensions to the timeline for these actions were discussed by the ARAC.

The Head of Internal Audit annual opinion and report to the ARAC for 2022/23 assessed their assurance of our framework of governance, risk management and control as moderate in its overall adequacy and effectiveness. This means that some improvements are required to enhance the adequacy and effectiveness of the framework.

Whistleblowing

We are committed to high standards of integrity, honesty, objectivity and impartiality in all that we do, including through our arrangements for whistleblowing from our staff. There were no whistleblowing reports in the period.

The OEP became prescribed person in law in Northern Ireland in November 2022 and in England in December 2022. As a prescribed person, the OEP can receive whistleblowing reports from employees of public authorities in England or Northern Ireland who wish to raise concerns about wrongdoing, risk, or malpractice, relating to environmental law at their workplace. There have been no disclosures to the OEP to date.

Information management and data security

We have established policy and procedures to ensure information assets are handled appropriately. All OEP staff were asked to complete information data handling courses within induction processes, and annually. Compliance with such mandatory training is reported to the ARAC.

There were no data security lapses that were deemed to be significant or critical during the period. There were no personal data incidents to report to the Information Commissioners’ Office.

There have been three non-reportable incidents during this period. The ARAC received reports in the year to provide assurance on the management of these and process and actions taken against themes identified. All incidents were resolved and appropriate controls were put in place where necessary.

Business continuity plans

The OEP was established to operate fully remotely during the Covid-19 pandemic and response. Our core information management and technology systems are outsourced and cloud based, with contractual commitments to restore in appropriate timescales in case
of need.

We developed our business continuity policy during the year. This was scrutinised by the ARAC in April 2023, just after year-end and agreed by the Accounting Officer at that time. Full implementation of the policy and associated action plan is now being completed.

Business-critical analytical models

The OEP had no business-critical analytical models in the reporting period. We set out our assessment methods in Annex 2 of our report on progress in improving the natural  environment in England.

Fraud

During the year, we established and implemented our counter fraud policy and fraud response plan. As part of the implementation approach, the GIAA provided training made available to all OEP staff on fraud awareness. This supplemented mandatory training on fraud, bribery and corruption completed by all staff.

A report on fraud was provided to the ARAC in each of its meetings in year. There was no instance of fraud reported during the period.

The OEP did not administer any COVID-19 government support schemes or any grant or other schemes of distribution and there is therefore no related fraud or error to report.