Community Pharmacy End‑to‑End Risk Based Assurance

End-to-End Risk-Based Assurance Approach

As part of onboarding to the NHS Buying Catalogue, Community Pharmacy Suppliers are required to demonstrate that their Solution safely supports end‑to‑end clinical and data journeys, bringing together individual Capabilities and related integrations.

An End‑to‑End journey represents a realistic clinical or operational workflow that:

• Begins with a defined trigger (for example, a referral, prescription event, or user authentication)

• Traverses multiple systems, components, and integrations

• Concludes with the correct clinical, operational, and data outcomes being recorded then either shared with appropriate parties or deliberately not shared, in line with policy and user intent.

End-to-End Risk Log

The Solutions Assurance Team has produced a Community Pharmacy End-to-End Risk Log for reference, which captures the key risks that arise across the full journey: from referral receipt, through consultation delivery, including consent and record access, to GP record update and payment claim submission.

Using the End‑to‑End Risk Log

Suppliers are expected to:

• Use the End-to-End Risk Log as an input to their own End‑to‑End test design.

• Develop Supplier‑owned test cases that demonstrate how the risks are mitigated in their solution.

• Design End‑to‑End scenarios that cover multiple risks within a single clinical or operational journey, avoiding one‑to‑one test to risk scenarios.

The test scripts provided by the Solutions Assurance team is not prescriptive. However, Suppliers can seek guidance from the Solutions Assurance team if they are unsure how to achieve the expected items listed.

Test Execution and Assurance

Suppliers must execute their End‑to‑End tests and clearly map them to the risks they mitigate. Test execution will be witnessed by the Solutions Assurance team, who will review the test evidence as part of assurance.

Note: End‑to‑End Risk-Based Assurance complements, and does not replace, other assurance activities such as Capability Assessment, Baseline Standards Assurance, and National Integrations onboarding.