Conflicting compliance data in a hospital estate
A hospital trust manages nine hospitals totalling 1.4 million square metres and approximately 210,000 maintained assets. Its maintenance management system record is 61% complete for safety-critical assets. The statutory compliance register exists as three spreadsheets held by different teams, and the September versions disagreed on the last inspection date for 47 of 320 pressure vessels. Decisions on replacing medical gas systems are taken in email chains and recorded nowhere else. The trust's asset information requirements date from 2014 and specify only that 'asset registers shall be maintained'. The health regulator requires evidence of compliance within 24 hours of a request. The trust plans a transition audit eight months from now and has allocated the time to reformatting documents to the new clause structure, with no gap analysis and no change to the information requirements. One estates manager has already told the transition auditor that the trust 'has always done it this way'.
1. What do the Clause 7 data and information requirements of the 2024 text demand that the 2014 'information requirements' clause did not, and how far does this trust fall short?
Read the worked answer
The 2014 text (7.5) required the organization to specify its information requirements; the 2024 revision treats data and information as a support element that must be fit for the decisions the asset management system has to make, and it sits alongside the new emphasis on decision-making. Expect defined information requirements derived from decision needs rather than a generic duty to maintain registers; assigned ownership and stewardship; quality criteria and monitoring for completeness, accuracy, timeliness and consistency; controls for protection and access; and evidence that the information is actually used. Here the information requirements are a single sentence, there is no owner across the three registers, and 61% completeness for safety-critical assets means compliance and renewal decisions rest on a known-incomplete record. The 47 date disagreements are the strongest evidence, because they show conflict between sources was neither detected nor resolved. Corrective action must address requirements, ownership and quality monitoring, not add a fourth spreadsheet.
2. How does the register conflict connect to risk and to decision-making, and what would you sample to test it?
Read the worked answer
Two threads. First, 6.1: conflicting statutory registers and incomplete safety-critical data are both a risk to the asset management system and an asset-related risk - potential non-compliance and unsafe plant. The auditor checks whether the risk was identified, whether action was planned, and whether the action was proportionate to the consequence. Second, decision-making: medical gas replacements decided in email chains leave no record of criteria, options or rationale. Sample five such decisions and ask what criteria applied, who held authority, what information was used, and whether the decision can be reconstructed by someone who was not involved. If it cannot be reconstructed, the organization cannot show that its criteria are applied consistently or that it learns from outcomes. Be precise about the judgement: missing records are only a nonconformity where the standard requires documented information or where the absence prevents effective operation. Here it prevents traceability, regulatory response within 24 hours, and improvement, so a nonconformity is justified.
3. With eight months available, how should the trust sequence remediation, and on what basis would you defend that sequence to an auditor?
Read the worked answer
Prioritise by risk and by what blocks the transition audit, not by document formatting. Sequence: resolve the 47 conflicting inspection records and establish a single authoritative compliance register with a named owner - this is a legal and safety exposure and any transition auditor will sample it; then derive information requirements from the decisions the trust actually takes, and set data quality measures reported through 9.1; then require recorded criteria and rationale for high-consequence decisions such as medical gas replacement; only then align document structure. The defence is risk-based: reformatting has no effect on intended outcomes, whereas the register conflict can cause a missed inspection and a regulatory failure within the 24-hour response window. Eight months is sufficient if the trust completes a gap analysis against the 2024 text, assigns owners, and covers the new requirements in an internal audit before the transition audit. Stating that the time was spent reformatting would itself evidence that 6.3 planning of changes was not applied.