Audit Minutes 03 Oct 2019

Minutes Of The Meeting Of The Cardiff University Audit Committee Held On Thursday 03 October 2019 In Room 0.51, Main Building At 10:00am

Present: Mr Michael Hampson (Chair), Mr Paul Benjamin, Mr Dónall Curtin, Dr Janet Wademan and Ms Agnes Xavier-Phillips.

In Attendance: Mr John Britton [Item 725-745.3], Ms Deborah Collins, Mr David Edwards [Item 725-731.31], Ms Alison Jarvis [Item 725-745.3], Ms Faye Lloyd [Except item 746], Mr Paul Merison [Item 725-731.31], Mr Rob Williams [Item 725-745.3], Ms Wendy Wright [Item 725-745.3], Ms Alex Payne (Minute-taker).

Apologies:  Tania Deitch, Lynn Pamment (PricewaterhouseCoopers), Ian Davies (PricewaterhouseCoopers), Vice-Chancellor, Ms Clare Eveleigh.

725 Preliminaries

NOTED

725.1 that Dónall Curtin and Paul Benjamin were welcomed to the meeting as new members of the Audit Committee. David Edwards (Director of IT at Cardiff University), and Paul Merison (Internal Auditor at TIAA) were welcomed to the meeting as observers;

725.2 that the recent induction and training activity arranged for Audit Committee members was well received and timely, given that there were two newly appointed members of the Committee;

725.3 that the Chair of the Committee asked if all members and officers could observe and abide by considerate meeting conduct;

725.4 that thanks were extended to Tania Deitch, the outgoing Head of Governance Services, for all that she has done to support the Committee over the last year.

726 Minutes of the Previous Meeting

NOTED

726.1 that the minutes of the meeting held on the 12 June 2019 (19/36B) were agreed to be a true and accurate record of the meeting, and as such approved;

726.2 that clarity was sought in respect of reference in the meeting record to the ‘Chair’. It was considered such that in respect of Committee minutes the ‘Chair’ referenced the Chair of that Committee, and not the Chair of Council.

RESOLVED

726.3 that the minutes of the meeting held on the 12 June 2019 (19/36B) were agreed to be a true and accurate record of the meeting, and as such were approved and should be signed by the Chair.

727 Matters Arising from the Minutes

727.1 Matters arising from the meeting held on the 12 June 2019 [710.4]

NOTED
that in respect of an action from the previous meeting, the Portfolio Scrutiny Group’s Chair’s Report would be received at the next meeting of Audit Committee in November 2019.

728 Declaration of Interests

NOTED

728.1 that there were no declarations of interest made in respect of the business;

729 Committee Membership

Received and considered for debate and decision paper 19/37B, ‘Committee Membership’. Deborah Collins, Chief Operating Officer & University Secretary, was invited to speak for this item.

NOTED

729.1 that it was timely to review constitutional requirements of the Audit Committee in respect of membership, and the proposals within the paper were considered in turn;

729.2 that the proposal in respect of Ordinance 10B 1.2, the design of the committee and the skills required, was reviewed. The Committee were asked to consider whether it was appropriate for its constitution to prescribe that only one member of the Committee was required to have professional experience in finance, accounting and auditing;

729.3 that it was important to be able to accommodate and transact the required business, and that there should be at least one member with such skills. That the consensus was for there not to be a constitutional requirement for the minimum to be greater than one;

729.4 that it was considered unnecessary to amend the Terms of Reference in order to prescribe that more of the Committee members must have these skills, and as such the provision should remain unchanged;

729.5 that the proposal in respect of Ordinance 10B 1.4, in respect of the provision that the Vice-Chancellor may be invited to attend meetings of the Committee when it’s deemed appropriate, was discussed;

729.6 that it was necessary for the Vice-Chancellor to attend the meeting of Audit Committee held in November each year in order to transact the Annual Report & Financial Statements, but that it would not necessarily be appropriate for the Vice-Chancellor to always be in attendance;

729.7 that it was considered inappropriate to amend the Terms of Reference in order to prescribe that the Vice-Chancellor should attend meetings of Audit Committee, and as such the provision should remain unchanged;

729.8 that the proposal in respect of Ordinance 10B 4.2 (ii), in respect of the provision which stipulates the attendance of the Director of Strategic Planning & Governance to attend all meetings of the Committee, was discussed;

729.9 that over the coming academic year this role will cease to be responsible for Governance Services, and therefore it will not be necessary for the Director of Strategic Planning & Governance to attend Audit Committee;

729.10 that it was agreed necessary to return to this requirement of the Terms of Reference at a future date, and that advice would have to be sought accordingly, and as such the provision should remain unchanged;

729.11 that the proposal in respect of Ordinance 10B 4.2 (v), in respect of amending the Terms of Reference to strengthen the attendance of the external auditors, was discussed;

729.12 that the benefit of the external auditors being in attendance at all meetings of the Audit Committee was considered;

729.13 that it was considered unnecessary to amend the Terms of Reference in line with this proposal, as the benefit of having the External Auditors in attendance at all meetings was not considered essential, and as such the provision should remain unchanged;

RESOLVED

729.14 that it was considered unnecessary to amend the Terms of Reference, Ordinance 10B 1.2, in order to prescribe that more of the Committee members must have these skills, and as such the provision will remain unchanged;

729.15 that it was considered inappropriate to amend the Terms of Reference, Ordinance 10B 1.4, in order to prescribe that the Vice-Chancellor should attend meetings of Audit Committee, and as such the provision should remain unchanged;

729.16 that it was agreed necessary to return to the requirement of the Terms of Reference prescribed by Ordinance 10B 4.2 (ii), at a future date, and that advice would have to be sought accordingly;

729.17 that it was considered unnecessary to amend the Terms of Reference, Ordinance 10B 4.2 (v), in line with this proposal, as the benefit of having the External Auditors in attendance at all meetings was not considered essential;

730 Progress Report: 2018/19 & 2019/20 Internal Audit Programe

Received and considered for decision paper 19/38B, ‘Progress Report Against Internal Audit Programme 18/19 and 19/20 Audit Programme’. Faye Lloyd, Head of Internal Audit, was invited to speak for this item.

NOTED

730.1 that there are two internal audit programmes running concurrently, and that two of the 2018/19 internal audits carry the ‘advisory’ status, which should not impact the annual opinion;

730.2 that there continue to be issues around the timeliness of management responses to internal audit reports, but that the position has improved since the last meeting of the Committee;

730.3 that the current figures were agreed to be unacceptable, and that it was vital  to address the cultural issues around the timeliness of management responses;

730.4 that there was a discussion around the appropriateness of the requirement for a management response to be returned within ten working days, and whether a fifteen-day turnaround would be more manageable;

730.5 that this matter has been a persistent issue. The timeliness and the quality of the responses is of paramount importance, and as such it’s vital to understand if there are other factors influencing response times;

730.6 that in response to a question around engagement with other institutions, the Internal Audit function does engage with colleagues in other Russell Group universities, and that a ten-working day response time is not unusual;

730.7 that in the planning process for an internal audit, and subsequently within the respective Terms of Reference, the Internal Audit team are very clear of what is expected, and the timescales involved;

730.8 that the Head of Internal Audit felt that there was a culture of non-compliance across the organisation, and that extending the response time wouldn’t necessarily resolve the problem;

730.9 that this issue was acknowledged and accepted by the Chief Operating Officer & University Secretary, and that the University Executive Board (UEB) now has a greater focus on the issue;

730.10 that at the next meeting of the Committee there would be an update in respect of a newly created group which will bring together governance, risk and assurance; and that this newly created group would aim to address such issues, and work to improve the organisational culture;

RESOLVED

730.11 that at the next meeting of the Committee there would be an update in respect of a newly created group which will bring together governance, risk and assurance.

731 Discussion Points for Internal Audit Assurance Reports

Received and considered for debate paper 19/39B, ‘Discussion Points for Internal Audit Reports’. Faye Lloyd, Head of Internal Audit, was invited to speak for this item.
David Edwards, Director of IT, and Paul Merison, Director of ICT Audit at TIAA, were in attendance and provided an update in respect of the recent IT audits of which they were involved.

NOTED

Operational Review of IT Asset Management

731.1 that there is currently a wider University network refresh project underway, and that the University are reviewing how to improve the security arrangements around identity and access management in the network;

731.2 that that there are significant risks associated with the implementation of the network refresh, and that it is important to improve the University’s current position.

731.3 that it was acknowledged that the general position is improving, despite there being ongoing issues around the management of some of the University’s IT infrastructure;

731.4 that it was important to consider value for money in such activity, as well as addressing and improving cultural issues around IT assets and systems;

731.5 that all staff are required to undertake mandatory IT training, and that there continue to be challenges around IT security, awareness of threats and how to respond;
Business Continuity Planning (BCP)

731.6 that the resources supporting the delivery of this function is being addressed, and as such the capability in respect of the business continuity plans and sub-plans will be reviewed;

731.7 that the detail in the report in respect of the responsible officers not having signed out of the working time direction, and there being potential national minimum wage implications, was considered;
Fact-finding request: acceptance of hospitality

731.8 that the audit opinion in respect of this investigation was of ‘limited’ assurance;

731.9 that the Chief Operating Officer has discussed the matter with the Deputy Chief Executive Officer of HEFCW, and that a report has been sent to HEFCW – but that a response is yet to be received;

731.10 [REDACTED]

731.11 [REDACTED]

731.12 that there are systematic issues, and the position has been considered by the UEB who are taking the issue, and how to address it, very seriously;

731.13 that it was imperative to review and improve the University’s Financial Regulations, and ensure that the associated policies aligned to the Financial Regulations are robust;

731.14 that it would be necessary for the University to consider how such a project would be resourced, and that it would be important to ensure that such a project involved collaboration across the University’s departments;

RESOLVED

731.15 that it was agreed necessary to receive a proposal in respect of the review of the Financial Regulations at the next meeting of the Committee in November 2019, for consideration;

731.16 that it was agreed necessary for the Committee to receive updates in respect of the matter presented within this audit report, as and when appropriate;

Student Recruitment

731.17 this report was received and noted;

Risk Management Maturity Update

731.18 this report was received and noted;

Data Analytics Capability

NOTED

731.19 that the wider risks associated with GDPR exposure were acknowledged. The Head of Internal Audit advised that there was not one answer to the issues identified, and that there were broader issues around data governance;

731.20 that the Chief Operating Officer & University Secretary felt that the recommendations made from the internal audit had not been addressed as quickly as she would have hoped, but that progress has been made, for example, through the creation of the Cardiff Data Professionals network;

731.21 that there was consideration of how such a piece of work should be approached, and that it would be important to consider how data is recorded, as well as wider business processes;

731.22 that the Director of Strategic Planning & Governance meets with the Chief Information Officer of the Welsh Government on a regular basis, and that the University is open to input from other sectors in respect of best practice;

731.23 that the Chief Operating Officer & University Secretary stated that the University considers improvement of the position a priority, and that the UEB are committed to improving the position;

731.24 that it was important for the Committee to understand how the executive plan to address the issues around data management, and that the plan and associated milestones, once agreed, should be shared with the Audit Committee;

RESOLVED

731.25 that the plan and associated milestones in respect of the data management, once agreed, should be shared with the Audit Committee;

Governance Services

731.26 this report was received and noted;

PCI DSS Update (Follow Up)

Received and considered for debate paper 19/40B, ‘PCI DSS Update – Follow Up – Management Response’. Alison Jarvis, Deputy Director of Finance, was invited to speak for this item.

NOTED

731.27 [REDACTED]

731.28 [REDACTED]

RESOLVED

731.29 that it was considered important to ensure that objectives associated with this work are ‘SMART’, so that that the timescales for actions are clear.

732 Follow Up of Highly Rated Recommendations Report

Received and considered for decision paper 19/41B, ‘Follow Up of Highly Rated Recommendations Report’. Wendy Wright, Senior Internal Auditor, was invited to speak for this item.

NOTED

732.1t hat there were 20 priority one recommendations which are outstanding, and that the UEB will receive the tracker document more regularly, going forward;

732.2 that it was suggested that given the short period of time between receipt of the tracker at this meeting and the next, that it could be more appropriate to next receive the tracker at the February 2020 meeting;

732.3 that there was a discussion around whether it would be helpful to have more detail in respect of the dates that recommendations were expected to have been completed or implemented, within the tracker document;

732.4 that it was agreed that it could be helpful to expand the content of the tracker document, and that it could possibly include a RAG rating, but that it was important to aim to keep papers concise;

732.5 that the Head of Internal Audit would produce an amended version of the tracker document to trial the suggested adaptations, as requested by the Committee;

RESOLVED

732.6 that it was agreed to receive the next update of the highly rated recommendations report (the tracker) at the meeting of Audit Committee in February 2020, as opposed to November;

732.7 that the Head of Internal Audit would produce an amended version of the tracker document to trial the suggested adaptations, as requested by the Committee;

733 Internal Audit Quality Assurance & Improvement Programme

Received and considered for decision paper 19/42B, ‘Internal Audit Quality Assurance & Improvement Programme’. Faye Lloyd, Head of Internal Audit, was invited to speak for this item.

NOTED

733.1 that the proposal was for the external assessment of the Internal Audit function to be repeated for the 2019/2020 academic session, and that a different approach could be considered for 2020/21 onwards;

RESOLVED

733.2 that this approach as presented was agreed, that the external assessment approach should be repeated for 2019/2020 with consideration being given at that point in respect of how to proceed for 2020/21 onwards.

734 Annual Report on Quality Assurance of Data

Received and noted paper 19/43B for debate and decision, ‘Annual Management Report – Data Quality Assurance’. John Britton, Director of Strategic Planning & Governance was available to answer questions in respect of this item.

735 HEFCW Accounts Direction to High Education Institutions for 2018/2019

Received and noted paper 19/44 for information, ‘HEFCW Accounts Direction to Higher Education Institutions for 2018/2019’. Alison Jarvis, Deputy Director of Finance was available to answer questions in respect of this item.

736 Report on External Audit Contract

Received and considered report which was tabled at the meeting (19/53B). Rob Williams, Chief Financial Officer, was invited to speak for this item.

NOTED

736.1 [REDACTED]

736.2 [REDACTED]

736.3 [REDACTED]

736.4 [REDACTED]

736.5 [REDACTED]

736.6 [REDACTED]

736.7 [REDACTED]

736.8 [REDACTED]

736.9 [REDACTED]

736.10 [REDACTED]

736.11 [REDACTED]

736.12 [REDACTED]

RESOLVED

736.13 that the Committee agreed that it was timely to move away from PwC following the completion of the 2019/2020 audit, and that a new audit firm should be sought in respect of 2020/2021 onwards;

736.14 that a plan in respect of the external and internal audit tender activity should be brought to the next meeting of the Committee, in November 2019, for consideration.

737 External Audit Programme Update

Rob Williams, Chief Financial Officer, gave a verbal update.

737.1 that the earlier discussion (minute 736) in respect of the external audit programme and current position was referred to, and that there were no additional comments.

738 Report on Financial Position & Outlook

Received and noted paper 19/45B, ‘Report on Financial Position & Outlook’. Alison Jarvis, Deputy Director of Finance, was available to answer questions in respect of this item.

739 Financial Irregularities

Received and noted paper 19/46B, ‘Financial Irregularities Report’. Alison Jarvis, Deputy Director of Finance, was available to answer questions in respect of this item.

740 Brexit Contingency Planning

Received and noted paper 19/47B, ‘Brexit Contingency Planning’. Deborah Collins (COO & University Secretary) was available to answer questions in respect of this item.

741 Open Employment Tribunals

Received and noted paper 19/48B, ‘Open Employment Tribunals’.

NOTED

741.1 [REDACTED]

741.2 [REDACTED]

741.3 [REDACTED]

RESOLVED

741.4 that the equivalent item would be removed from the business of the future meetings of Audit Committee for the 2019/2020 academic year, and that this would be fed back to paper author, accordingly.

742 Live Incidents

Received and noted paper 19/49B, ‘Live Incidents’. Deborah Collins (COO & University Secretary) was available to answer questions in respect of this item.

743 Serious Incident Reporting

Received and noted paper 19/50B, ‘Serious Incident Reporting’. Deborah Collins (COO & University Secretary) was invited to speak for this item.

NOTED

743.1 [REDACTED]

744 Effectiveness of the University's Public Interest Disclosure Policy

Received and noted paper 19/51B, ‘Effectiveness of the University’s Public Interest Disclosure Policy’. Deborah Collins, Chief Operating Officer & University Secretary, was invited to speak for this item.

NOTED

744.1 that there was a surprisingly low level of disclosures across the University, and that a review of this policy would be undertaken and brought back to the Audit Committee.

745 Review of Business for the Year

Received and considered paper 19/52 for decision, ‘Review of Business for the Year 2019/2020’. Committee Officers were available to answer questions in respect of this item.

NOTED

745.1 that the Chair felt that it was important to be sure that all necessary business, in line with the Committee’s Terms of Reference and the regulatory requirements imposed on the University, had been accommodated within the cycle of business for the year;

745.2 that work had recently been undertaken in order to complete such a task, and that this would be shared with the Committee Chair, for consideration. If considered necessary, the matter would be scheduled for further discussion;

RESOLVED

745.3 that Governance Services would share the work recently completed with the Committee Chair for consideration, and if considered necessary, the matter would be scheduled for further discussion

746 Any Other Business

REDACTED: Head of Internal Audit Remuneration

NOTED

746.1 [REDACTED]

746.2 [REDACTED]

746.3 [REDACTED]

RESOLVED

746.4 [REDACTED]

In-Camera

Following the meeting of the Audit Committee, an in-camera was held. Only the members of the Audit Committee and the Head of Internal Audit were present.