£226 Million. 25 Minutes. No Risks to Escalate

On 16 April 2026, Digital Health and Care Wales called an extraordinary Board meeting. It lasted approximately 25 minutes. Its single substantive item: approval of a five-year Microsoft Enterprise Agreement worth £226,898,772 including VAT. The Board paper's risk field read, in full: "No risks to escalate."

At the moment of that approval, DHCW had been under Welsh Government Enhanced Monitoring for thirteen months — placed at Level 3 for failing to deliver nine major digital programmes. The organisation that could not deliver its core mission approved £226 million of licensing in the time it takes to eat lunch.

The approval is the sharpest example, but it is not the only one. Across DHCW's published accounts, annual report, and governance statements, the same pattern recurs: every disclosure meets the minimum standard. None exceeds it. The detail that would enable scrutiny — supplier names, programme-level spend, the basis for procurement decisions, the reason for regulatory intervention — is consistently absent from the published record. (See What They Don't Publish.)

The 25-Minute Extraordinary Board Meeting

The Microsoft Enterprise Agreement runs from July 2026 to June 2031 — five years. The contract value excluding VAT is £189,082,310. It was approved by direct award under Trustmarque framework agreement P159.07, a Crown Commercial Services vehicle. (DHCW SHA Extraordinary Board paper, 16 April 2026)

The meeting at a glance

• Date: 16 April 2026
• Duration: approximately 25 minutes
• Contract value: £189,082,310 ex-VAT / £226,898,772 inc-VAT
• Term: July 2026 – June 2031 (five years)
• Procurement route: Direct award via Trustmarque framework P159.07 (Crown Commercial Services)
• Risk field: "No risks to escalate."
• Corporate Risk Assessment: N/A
• Quality Impact Assessment: N/A
• Signatories: Chris Moreton (Acting Director of Finance), Sam Lloyd (Executive Director of Operations), Helen Thomas (Chief Executive)
• AI licences embedded: 3,100 Microsoft Copilot licences, approximately £3.5M

The Board paper discloses no competitive basis for the direct award, no alternatives considered, and no per-programme benefit assessment. The Corporate Risk Assessment was marked N/A. The Quality Impact Assessment was marked N/A.

The second signatory on a £226 million, five-year commitment was not a substantive Director of Finance. Chris Moreton signed as "Acting." (For the wider picture of who actually runs DHCW, see Try to Find Who Runs DHCW.)

The contract approved in 25 minutes represents more than one full year of DHCW's total budget of £196.48 million. (DHCW Annual Report 2024-25) It was committed by direct award, with no quality impact assessment and no competitive basis disclosed, during thirteen months of Enhanced Monitoring for programme delivery failure. (For the full financial record, see The Money Furnace.)

Enhanced Monitoring

The Welsh Government's Level 3 Escalation Framework, published May 2025, records: "Following an assessment against the NHS Wales oversight and escalation framework in February 2025, Digital Health and Care Wales (DHCW) escalation level is level 3 for performance and outcomes related to major programmes." (Welsh Government Level 3 Escalation Framework, May 2025)

DHCW was moved directly from Level 1 — routine monitoring — to Level 3 Enhanced Monitoring, skipping Level 2 entirely. This was the first escalation in DHCW's history. (DHCW Annual Report 2024-25)

The Framework names nine programme areas where DHCW must demonstrate delivery: enterprise architecture, the NHS Wales App, Connecting Care, data architecture, diagnostics, GP system migration, medicines and prescribing, intensive care, and cancer informatics. These are the systems every NHS Wales patient encounters. Every one is failing. (See Nine Programmes, Zero Results for the programme-by-programme record.)

An organisation under Enhanced Monitoring for failing to deliver nine major programmes approved £226 million of licensing infrastructure in 25 minutes. The risk field read "No risks to escalate."

The £45.3 Million That Lived Under "Premises"

The Microsoft deal sits within a wider pattern of asymmetric disclosure. DHCW publishes aggregate totals. The detail that would enable scrutiny is withheld.

DHCW's largest single recurring non-staff cost is software licences and maintenance. In 2024-25, that line stood at £48,231,000 — approximately 27% of total operating expenditure. (DHCW Annual Report 2024-25)

Until 2023-24, this cost was not shown under its own name. It sat inside a line called "Premises."

(Sources: DHCW Annual Report 2022-23; DHCW Annual Report 2023-24; DHCW Annual Report 2024-25)

The reclassification was not a DHCW initiative. It followed changes to the NHS Wales accounting manual, aligning to HM Treasury's Financial Reporting Manual (FReM). DHCW's largest single operational cost — £45.3 million at reclassification — was not separately identified in published accounts for at least two years.

The named line now reads: "Computer software licences and maintenance contracts (DHCW only) | 48,231 | 45,326." (DHCW Annual Report 2024-25) There is no sub-breakdown by supplier, system, or contract.

The Microsoft Enterprise Agreement is almost certainly a renewal — DHCW and its predecessors have run on Microsoft infrastructure for years. The value of the previous contract has never been published. Whether the new agreement represents a cost increase, a like-for-like renewal, or a reduction is unknown, because the supplier breakdown within the £48.2 million line has never been disclosed. The one figure the public can see — £48.2 million, total, no names — will continue to be the only figure available.

In the same Annual Report, Thomas wrote: "quality is at the heart of everything we do, demonstrated by our ISO Standards and the achievement of a financially balanced position including recurrent savings." (DHCW Annual Report 2024-25, foreword)

27% of DHCW's operating expenditure. Unnamed in published accounts for at least two years. Still disclosed as a single total, with no supplier breakdown.

£325,000. Or £8.9 Million.

The pattern extends to consultancy.

The 2024-25 Annual Report states: "During 2024/2025 the SHA spent £0.325m of its revenue funding on external consultancy services, this is a decrease of 57% from 2023/24." (DHCW Annual Report 2024-25)

A separate Freedom of Information response — FOI/5854154, provided April 2025 — discloses 49 external consultancy contracts totalling £8,943,015 from 2019 to 2026. (FOI/5854154, signed Marcus Sandberg, IG Assurance Manager)

Consultancy: two figures

Source	Figure
DHCW Audited Accounts 2024-25	£325,000
FOI Consultancy Register FOI/5854154 (2019–2026)	£8,943,015

Three firms account for more than half: Gartner (£2.07M), Channel 3 Consulting (£1.53M), and KPMG (£1.28M). For the full breakdown, see £8.94 Million on Consultants.

The mechanism is in the accounts' own words:

"For the purpose of the statutory accounts, consultancy is defined as time limited/ad-hoc assignments related to the provision of professional and strategic advice and not directly attributable to activities delivering digital products." (DHCW Annual Report 2024-25)

If a consultant advises on delivering a digital product — which is almost everything a digital health agency pays consultants to do — DHCW does not classify the spend as "consultancy." The £8.94 million disclosed under FOI does not contradict the £325,000 in the accounts. Both are true within DHCW's own definition. The definition is the mechanism.

Additional contracts — CGI, Mozaic, Capacitas, Kainos, and Tektology — do not appear in the FOI Register at all. The gap between audited accounts and FOI disclosure is not explained in either document. (For the full pattern of FOI refusal, see Six FOI Requests. One Identical Refusal.)

The Annual Report That Could Not Complete the Sentence

On 26 June 2025 — 107 days after DHCW was placed at Level 3 — Thomas signed the Governance Statement as Accountable Officer. That statutory document contains the following sentence:

"The rationale for the decision to increase the escalation status was the ongoing challenges with pace and delivery on key national priorities, including:"

(DHCW Annual Report 2024-25, Governance Statement)

Nothing follows. The sentence ends at a colon. The specific failures that triggered Level 3 are not provided.

The same Annual Report's internal audit summary records thirteen named audit subjects, then states: "There were five further reports issued before the year end that have been taken into account for the opinion, but will be reported to the Audit and Assurance Committee during 2025/2026. These include four allocated Reasonable assurance and one Limited assurance." (DHCW Annual Report 2024-25) Every other audit in the published table is named. The one carrying Limited Assurance — the worst finding — is the one whose subject is withheld.

Four Raising Concerns cases are recorded with no themes, no outcomes, no learning.

DHCW's Annual Quality Report 2025 — the formal quality compliance document covering the year Level 3 was imposed — contains zero references to Level 3, Enhanced Monitoring, or any of the nine programme failures named in the Welsh Government's Escalation Framework. The Annual Report cites this document as evidence of quality compliance. (DHCW Annual Quality Report 2025; DHCW Annual Report 2024-25)

And 107 days after Level 3 was imposed, the Governance Statement concludes: "As indicated throughout this statement and the Annual Report, there are no control issues or significant governance issues that have arisen in 2024/25." (DHCW Annual Report 2024-25, Governance Statement)

The blank escalation rationale is two pages earlier in the same statutory document.

The sentence does not finish.

What the Next Senedd Can Do

Wales elects a new Senedd on 7 May 2026. The incoming Health and Social Care Committee has the power to compel DHCW to publish:

• The Board paper basis, alternatives considered, and quality-impact assessment for the 16 April 2026 £226 million Microsoft Enterprise Agreement.
• The terms and justification for the direct-award procurement route under Trustmarque framework P159.07.
• A per-supplier breakdown of the £48.2 million annual software licensing and maintenance line.
• The subject of the Limited Assurance audit finding recorded in the 2024-25 internal audit summary.
• The Welsh Government Remit Letter of 14 March 2025.

£226 million. 25 minutes. "No risks to escalate." The Committee has the power. The public is entitled to ask what the risk field should have said.

CareNHS invites responses from DHCW, the Welsh Government, Helen Thomas, Chris Moreton, Sam Lloyd, and Audit Wales. If received, we will publish them in full.