Provision of a Regional Risk Management System

Interested suppliers are invited to attend a virtual market engagement event to support the Health Boards in developing their understanding of available solutions.

Each supplier will be allocated a 45-minute session. Suppliers are expected to present for up to 25 minutes, followed by a 20-minute question and answer session. The total duration of each session will not exceed the allocated 45 minutes.

The supplier engagement event will be held via Microsoft Teams. Places will be allocated on a first-come, first-served basis. To request a slot, please contact [email protected].

Representatives from the Risk and Assurance Teams of both Health Boards will be in attendance, alongside colleagues from Procurement.

Presentation Expectations

Suppliers are free to structure their presentations as they see fit. However, the Health Boards request that the following areas (1–5) are covered during the presentation, with areas (6–7) provided either within the session or as supplementary information.

Areas for Consideration

1. Solution Overview

• Description of the proposed solution, including key features and functionality
• Examples of typical NHS or public sector deployments

2. Alignment to Requirements

• High-level overview of how the solution aligns with the capabilities and outcomes outlined in supporting document, Solution Overview Requirements.
• Any key assumptions, dependencies, or constraints

3. Implementation Approach

• Approach to delivery, including discovery, configuration, and testing
• Data migration
• Training and onboarding
• Go-live support and indicative timelines

4. Reporting and Analytics

• Standard reports and dashboards included within the solution
• Details on options for customised reporting and analytics

5. Indicative Costs

• High-level cost information, including:

o Licensing

o Implementation

o Training

o Ongoing support and maintenance

Cost ranges are acceptable at this stage

6. Security and Assurance (supplementary)

• Approach to access control, audit, hosting, and system resilience
• Relevant certifications and assurance (e.g. ISO standards, DSPT)

7. Support Model (supplementary)

• Service desk availability and support hours
• Incident management and response
• Change and configuration support
• Release and update approach

Suppliers are encouraged to use practical examples, case studies, and demonstrations where appropriate. All presentations should be delivered within the allocated time, as multiple supplier sessions will be scheduled throughout the engagement event.

Additional Information:

To protect the integrity of any potential future procurement process, the Health Boards wish to make the following clear to interested suppliers:

• This supplier engagement exercise is not part of a formal procurement process. Its purpose is to help the Health Boards understand market interest and capability, and to inform the development of requirements, cost estimates, and potential procurement routes.
• The Health Boards will not be liable for any costs incurred by suppliers in preparing responses or attending engagement activities.
• As this is not a formal procurement exercise, supplier responses will not be formally evaluated or scored. Notes of discussions may be taken, and sessions may be recorded for internal reference.
• Participation in this engagement does not confer any advantage in any future procurement process, nor does it guarantee that a procurement will take place.
• Please note that the details and dates within this notice maybe subject to change.

Appendix A - Provision of a Risk Management System

Solution Overview Requirements

Purpose

At this stage, the Health Boards are seeking high-level information on solutions that may support:

• An enterprise solution to manage risk workflows, including linkage, escalation, associated tools and reporting,
• Strategic risk management related to the Health Boards Board Assurance Framework,
• General corporate and operational risk management,
• Potential inclusion of project risk management, including tools for financial and schedule risk management and modelling,
• A clear journey of recording and monitoring risks and what supporting information could be captured in the system,
• Dashboard and formal reporting including integration with local business intelligence solutions,
• The ability to tailor processes,
• Consideration of additional functionality such as planning/scheduling tools and messaging/alert tools.

The above is not a specification and does not represent a confirmed scope for any future procurement.

High-level system requirements

Both Health Boards operates in a highly regulated healthcare environment and require strong governance, assurance and transparency across strategic corporate, operational/service delivery, information, data protection and major projects risks.

The Health Boards are looking for solutions to be in place to support consistent identification, evaluation, ownership, treatment, tracking and reporting of risks, both in a corporate, operational, strategic (including the Board Assurance Framework) and potentially project environment.

The solution should enable standardised processes and reporting while remaining flexible enough and customisable to support different organisational structures, and provide reliable, auditable reporting for internal governance and external assurance needs. The Health Boards current timeline anticipates implementation by March/April 2027 and go live by no later than November 2027.

Core Risk Management system requirements:

• Risk identification: an intuitive process for staff to raise and record risks in line with Health Board policy,
• Risk register management: create, update, review, escalate and close risks with clear ownership, version history and audit trail,
• Consistent scoring: configurable likelihood/impact matrices, risk appetite/tolerance, inherent vs residual risk, and clear scoring rules,
• Controls and actions: record existing controls, planned actions, action owners, due dates, evidence/attachments and progress tracking,
• Review workflow: configurable review cycles, reminders, approvals, and escalation triggers (e.g., overdue review, score increase, appetite breach),
• Linking and relationships: relate risks to objectives, committees, corporate, operational and strategic risks and potentially programmes/projects,
• Reporting and dashboards: real-time views by operational structure, theme, owner, score, trend, and assurance level; reports exportable in flexible file formats as well the option for risk leads to develop customisable dashboards for their own use,
• Trend and insight: scoring history, heatmaps, movement (improving/worsening), and key themes to support assurance narratives,
• Search and usability: strong search and filters and the availability of standard and customisable reporting templates.

Other system requirements

• Information governance and cyber security: role-based access control, audit logging, secure data storage and transmission, aligned to NHS/Wales information governance expectations (Welsh Health Circular 25/2017), Cyber Security requirements (CE+) and ISO Standards (ISO's 27001),
• Hosting model: preference for a modern hosted (SaaS) solution with clear resilience, backup and disaster recovery,
• Accessibility: an intuitive user experience with accessibility features appropriate for a diverse workforce,
• Configurability: administrators can update matrices, forms, workflows, lists and reporting views without supplier development work,
• Data quality and audit: validation rules, mandatory fields where needed, change history and clear audit trails,
• Interoperability: API and/or integration options (e.g., identity management/SSO and other governance/quality tools where applicable),
• Performance and scalability: responsive performance for Health Board-wide use and growth over time.
• Defined and tested business continuity plans and response times for dealing with issues.

Intended Functional Outcomes of the System:

• One source of truth for risks, reducing duplication and improving confidence in reporting,
• Clear accountability through defined risk owners, action owners, review dates and evidence of oversight,
• Improved governance flow from team/service registers through reporting to corporate and Board assurance,
• Early warning and escalation when risk levels increase, reviews are overdue, controls are weak, or actions are delayed,
• Stronger assurance narratives via trend information, control effectiveness tracking, and consistent reporting,
• Efficiency through reduced manual collation and self-service dashboards for different audiences,
• Automation for reporting, including draw-down of risk registers for committee and Board papers.