Audit Committee Minutes 10 June 2020

Minutes of the meeting of the Cardiff University Audit Committee held on Wednesday 10 June 2020 by Zoom, at 9:00

Present:             Mr Michael Hampson (Chair), Mr Paul Benjamin, Mr Dónall Curtin, Dr Janet Wademan and Ms Agnes Xavier-Phillips.

In Attendance:    Professor Colin Riordan [Minutes 804-809], Mr John Britton [Minutes 804-813], Mr Jason Clarke, Ms Katy Dale (Minute-taker), Mr Ian Davies, Mr David Edwards [Minute 814], Ms Clare Eveleigh, Mr Ian Howes [Minute 815], Ms Rashi Jain, Ms Alison Jarvis, Ms Faye Lloyd, Mr Paul Merison [Minute 814], Ms Lynsey Myles [Minute 815], Ms Alex Payne, Ms Claire Sanders, Mr Robert Williams, and Ms Wendy Wright.

804  Preliminaries

Noted

804.1        that Jason Clarke and Ian Davies, representatives from PricewaterhouseCoopers were welcomed to the meeting;

804.2        that Rashi Jain, Acting University Secretary, was welcomed to her first meeting of the Committee;

804.3        that members of the Internal Audit team were welcomed to the meeting.

805 Minutes from the Previous Meeting

Received and considered for debate papers 19/662B, ‘2020-02-19 Minutes of the Audit Committee’ and 19/663B ‘2020-04-23 Minutes of the Audit Committee’. The Chair was invited to speak to this item.

Noted

805.1        that within item 783.3 in the minutes from the meeting held on the 19 February 2020, the phrase university-wise be corrected to university-wide.

Resolved

805.2        the minutes of the meeting held on the 19 February 2020 and 23 April 2020 were approved as a true and accurate record, subject to the above correction.

806 Declarations of Interest

There were no declarations of interest received.

807 Risk Register

Received and considered for debate paper 19/664B, ‘Risk Register’. The Vice-Chancellor was invited to speak to this item.

Noted

807.1 [Redacted]

807.2 [Redacted]

807.3 [Redacted]

807.4 [Redacted]

807.5 [Redacted]

807.6 [Redacted]

807.7 [Redacted]

807.8 [Redacted]

807.9 [Redacted]

807.10 [Redacted]

807.11 [Redacted]

807.12 [Redacted]

807.13 [Redacted]

807.14 [Redacted]

Resolved

807.15 for the Governance Services Team to commence a review of the Terms of Reference for the Committee in line with the revised remit;

807.16 for further time to be given to matters of risk management at future meetings, given this is now a core function of the Committee.

808 Live Incidents

Received and considered for debate paper 19/665B, ‘Live Incidents’.

Noted

808.1 [Redacted]

808.2 [Redacted]

808.3 [Redacted]

809 Recasting The Way Forward

Received and considered for debate paper 19/666B, ‘Recasting the Way Forward’.

Noted

809.1        that the document would be going out for wider consultation imminently and a final version issued to Council for approval in July;

809.2        that the Vice-Chancellor left at the end of this agenda item.

810 Matters Arising from the Minutes

Received and considered for debate papers 19/658B, ‘2019-10-03 Actions and Decisions Log’, 19/659B, ‘2019-11-13 Actions and Decisions Log’, 19/660B, ‘2020-02-19 Actions and Decisions Log’, and 19/661B ‘2020-04-23 Actions and Decisions Log’. The Chair was invited to speak to this item.

Noted

810.1        that the Committee would review outstanding actions at each meeting;

810.2        that in relation to outstanding actions from the October 2019 meeting:

.1     that an update on the fact-finding request for the acceptance of                        hospitality would be covered via agenda item 23;

.2 that in relation to item 9.2, initial work on trialling a revised version of the Tracker had been undertaken and further information on this would be provided via agenda item 19;

810.3        that in relation to outstanding actions from the November 2019 meeting:

.1 the actions in relation to minutes of the previous meeting had been completed;

.2 that in relation to item 6, this was now complete;

810.4        that in relation to outstanding actions from the February 2020 meeting:

.1 that the ASSUR report would be issued to the Committee;

.2 that consideration of how to approach a more detailed consideration of risk would be discussed at the in camera meeting;

.3 that a discussion was held in relation to provision of an assurance framework for Transforming Cardiff;

.4 that the paper issued to Policy & Resources Committee had been shared with the Committee;

.5 that a strategy for the development of finance was covered under agenda item 20.

Resolved

.6 for the 7 Lenses framework to be shared with the Committee and an update provided to the next meeting on how this had or had not been used in relation to the Transforming Cardiff assurance framework;

.7 for an update report on information security training to be brought to the next meeting.

810.5        that in relation to outstanding actions from the April 2020 meeting:

.1 that a discussion on the annual audit opinion would be covered under agenda item 11.

811 Scenario Planning

Noted

811.1 that the Chief Financial Officer provided an oral update on this item;

811.2 that the Chief Financial Officer and Vice-Chancellor had met with Audit Committee members to provide an update on financial planning;

811.3 that the University had established a task force to review re-opening the campus from September 2020, to determine what could be offered to students;

811.4 that there were no significant changes in income at present; discussions were being held with the Welsh Government on possible stability funding and with the UK Government around research funding;

811.5        that a cost saving target of 10% had been set;

811.6 that an in-depth review of non-pay spend by category was being undertaken and targets for levels of savings within these categories were being set; Schools and Colleges would be tasked with saving a further 20% in non-pay in addition to existing savings targets;

811.7 an updated draft budget would be issued to UEB on 22nd June and then to Policy & Resources Committee on 30th June; this would then be further updated for Council at the start of July.

811.8 that the funding allocation letter from HEFCW was not expected to be issued until after the July meeting of Council.

812 COVID-19 Impact on Welsh Universities: Proposed Actions from HEFCW 10:22

Received and considered for debate paper 19/667, ‘Covid-19 impact on Welsh Universities proposed actions from HEFCW’. Claire Sanders, Interim Chief Operating Officer, and John Britton, Director of Strategic Planning and Governance, were invited to speak to this item.

Noted

812.1 that HEFCW had issued two circulars and one consultation to date;

812.2 that Annex A provided detail of the areas HEFCW have highlighted and assigned a lead and necessary action to each one; this has been shared with UEB and necessary Professional Services leads;

812.3        that although the report suggested a reduction in the burden of monitoring and reporting, this would still need to continue in the background to ensure the information is ready when needed;

812.4 that the timescales for completion of the Camm Review actions had been extended;

812.5 that HEFCW have requested updated cash forecasts for the 20/21 and 21/22 years and these will be issued to Policy & Resources Committee and Council in advance; it was noted HEFCW would provide a consolidated position of the sector to Welsh Government but not the individual detail of each institution.

813 External Audit Plan for the Financial Year Ended 31/07/2020

Received and considered for debate paper 19/668B, ‘Cardiff University External Audit Plan 2019'2020’. Mr Jason Clarke and Mr Ian Davies were invited to speak to this item.

Noted

813.1        that the core work of the External Audit team had not changed, but there was a need to take account of the current situation;

813.2        that additional work was required to review the triennial valuation of the Cardiff University Pension Fund and USS valuation;

813.3        that the team were required to provide their opinion on whether the institution would be a going concern for 12 months from signing;

813.4        that the only bond covenant affecting the University relates to the negative pledge and the University is currently not in breach of this; the University is taking legal advice on what may need to be reported to the market;

813.5        that a key risk relating to going concern has been added to the audit for this year and would be a risk across the sector;

813.6        that any matters regarding the going concern opinion should be raised to the Committee, and it may be necessary to hold an additional meeting of the Committee to discuss;

813.7        that the team were reviewing the risks relating to management override due to the new working environments and risks of further exposure;

813.8        that materiality was set at 1% of revenue and anything over 5% of that 1% would be flagged to the Committee; the team would also raise any smaller errors if felt necessary;

813.9        that the team were presently carrying out interim work to ensure that the audit could be completed on time;

813.10      that the annual paper on fraud will be presented to the Committee in October 2020 to enable time for discussion;

813.11      that John Britton left the meeting during this agenda item.

Resolved

813.12      to recommend to Council approval of the audit fee detailed in the paper.

813.13      for the Chair & Committee members to receive PwC’s technical publications.

814 Internal Audit Report: IT Continuity

Noted

814.1 that Mr Paul Merison from TIAA and Mr David Edwards joined the meeting to present on this item;

814.2        that the audit report had been issued and provided limited assurance;

814.3 the key findings from the report related to improving processes within the 12 critical functions and local business continuity plans;

814.4 that given the current situation, there had been no progress on the recommendations to date; however, the situation had provided an opportunity to develop some local business continuity plans and the recommendations would be reviewed in light of this;

814.5 that the IT systems had dealt well with the current situation and lessons learnt had been taken from this;

814.6 that the University had a strong cyber security team and were looking to improve the security of home equipment;

814.7 that TIAA were working with the University to look at technological opportunities and rationalisation post COVID-19, and an update on this would be brought to the next meeting;

814.8 that the University were using TIAA’s external experience and that of other institutions to inform their approach;

814.9 that David was attending his last meeting of the Audit Committee and was thanked for his work for the University;

814.10      the Committee thanked Paul for his work in relation to this item.

814.11      that David Edwards and Paul Merison left the meeting at the end of this agenda item.

Resolved

814.12 for the University Secretary to follow up the comments on the information security training made by a committee member;

814.13      for a paper to be presented to the Committee regarding the considerations given to cyber security during home working.

815 Internal Audit Report: Procurement of Capital Projects

Noted

815.1 that Mr Ian Howes and Ms Lynsey Myles from Deloitte joined the meeting to present on this item;

815.2 that the report had provided an overall rating of no assurance;

815.3        that six key areas for improvement had been identified:

.1 to review the team structure to ensure it has the skills and qualifications required;

.2 to review all risk registers to ensure they are completed and reviewed effectively;

.3 to ensure specifications for tender are signed off and approved in advance;

.4 to ensure effective control over the tender process;

.5 to improve the financial due diligence processes;

.6 to ensure there are clear controls in place to ensure compliance with key regulations;

815.4        that the Chief Financial Officer welcomed the report and accepted there had been a delay in issuing the management response;

815.5 that the team had been working with an external procurement specialist to improve processes and were discussing with the Vice-Chancellor the longer-term actions and strategy;

815.6        that the introduction of the Estates and Infrastructure Sub-Committee had improved processes and approach for more recent projects;

815.7        that there were positive foundations that could be built on to improve the service;

815.8 that an update on implementation of these recommendations would be brought back to a future meeting;

815.9 that there was an element of cultural change required to ensure future issues are raised quickly to the right people;

815.10      that Ian Howes & Lynsey Myles left the meeting at the end of this agenda item.

Resolved

815.11      for the Chief Financial Officer to confirm the question posed to the lawyers in relation to the CIC project and the response.

816  Internal Audit Strategy and Annual Plan 2020/21

Received and considered for debate paper 19/669B, ‘Internal Audit Strategy and Annual Plan 2020/21’. Faye Lloyd, Head of Internal Audit, was invited to speak to this item.

Noted

816.1 [Redacted]

816.2 [Redacted]

816.3 [Redacted]

.1     [Redacted]

.2     [Redacted]

.3     [Redacted]

816.4 [Redacted]

816.5 [Redacted]

816.6 [Redacted]

816.7 [Redacted]

816.8 [Redacted]

Resolved

816.9 for the Head of Internal Audit to provide a programme of audit works that provided a 10% saving; this would be examined by the Audit Committee to determine if this would be presented to Council;

816.10 for the Governance, Risk & Assurance Group (GRAG) to commence work on an assurance map for the institution;

816.11 for the Chair to consider the role of Chief Risk Officer.

817 Progress Report 2019/2020 Audit Programme

Received and considered for decision paper 19/670B, ‘Progress Report 2019/2020 Audit Programme’. Faye Lloyd, Head of Internal Audit, was invited to speak to this item.

Noted

817.1 [Redacted]

817.2 [Redacted]

817.3 [Redacted]

818 Discussion Points for Internal Audit Reports

Received and considered for debate paper 19/671B, ‘Discussion Points for Internal Audit Reports’. Faye Lloyd, Head of Internal Audit, was invited to speak to this item.

Procurement of Capital Projects

Noted

818.1        [Redacted]

IT Continuity

Noted

818.2        [Redacted]

Income Controls (Fee Income Focus)

Noted

818.3        [Redacted]

818.4        [Redacted]

818.5 [Redacted]

UK Research and Innovation (UKRI) Funding Assurance Review

Noted

818.6        [Redacted]

819 UK Research and Innovation (UKRI) Funding Assurance Review

Noted

819.1        that the report was taken as read.

820 Quality Enhancement Review Outcome and Assurance

Received for information paper 19/672B, ‘QER Outcome and Assurance Report’.

821 Follow Up of Highly Rated Recommendations Report

Received and considered for debate paper 19/673B, ‘Follow-Up of Highly Rated Recommendations Report’. Wendy Wright, Senior Internal Auditor, was invited to speak to this item.

Noted

821.1        [Redacted]

821.2        [Redacted]

821.3        [Redacted]

822  Strategy for Financial Operations

Received and considered for debate paper 19/676B, ‘Strategy for Financial Operations’. Alison Jarvis, Director for Financial Operations, was invited to speak to this item.

Noted

822.1 that the current situation had led to a large amount of business disruption;

822.2 that outstanding actions on the Tracker, especially those identified as priority one, had been kept at the forefront during the move to homeworking to identify the key risk areas;

822.3        that some risk had reduced due to the move to homeworking (e.g. no use of card payment machines); however there had been an increased risk in some other areas (e.g. reliance on use of paper processes);

822.4        that the team were regularly reviewing and reporting on the cash position;

822.5        that in light of the current situation and proposed changes to The Way Forward, the paper presented an interim strategy for key areas of focus over the next 18 months;

822.6        that some existing actions had been inherited and no longer reflected the current risk profile; the team were therefore looking to rephrase these and the management response;

822.7        that thanks were expressed to the Internal Audit team and the Governance Services Team for their assistance in producing this document;

822.8        that work was being undertaken to review the Financial Regulations in line with Ordinances and University policies to ensure these are aligned;

822.9        that there had been a hope to provide a longer-term strategy with proposals for upgrades to technology and future staff structure; however, this had not been possible in the current circumstances;

822.10      that the finance team were aware of the need to ensure technology is of appropriate standard and fits the requirements, especially with the likely move to more homeworking in the future.

Resolved

822.11      for future iterations to provide detail of the desired longer-term direction of the department.

823 Monitoring Risk Management and Internal Control

Noted

823.1        that the Chair shared with the Committee details of the key attributes of a robust financial control compliance framework, as provided in the Board Director Update from Deloitte;

823.2        that the Committee agreed it would be of benefit to review the University’s position against each attribute.

Resolved

823.3        for Governance, Risk & Assurance Group (GRAG) to commence work on mapping the University’s position against each attribute and report back to the next meeting.

824  Financial Irregularities Report

Received for information paper 19/677B, ‘Financial Irregularities Report’. Alison Jarvis, Director of Financial Operations, was available to speak to this item.

Noted

824.1        that no financial irregularities were reported.

825  Serious Incident Reporting

Received and considered for debate paper 19/674B, ‘Serious Incident Reporting’. Rashi Jain, Acting University Secretary, was invited to speak to this item.

Noted

825.1        that the report identified the bodies to which University needed to report a serious incident, and the individual definitions of a serious incident or weakness for each;

825.2        that it was proposed that the next step was to identify the process for reporting these incidents;

825.3        that Rashi Jain left the meeting at the end of this agenda item.

Resolved

825.4        for a proposed framework for reporting of a serious incident be brought to Audit Committee for agreement;

825.5        for any serious incident to be reported to Audit Committee.

826   Audit Committee Key Performance Indicators (KPIs)

Noted

826.1        that the KPIs previously agreed for the Committee were reviewed;

826.2        that it was agreed additional KPIs relating to governance of the Committee may be of benefit;

826.3        that Alison Jarvis and Claire Sanders left the meeting at the end of this agenda item.

Resolved

826.4        for PwC to share with members relevant guidance documents on KPIs and reporting;

826.5        for the Chair to review the documentation provided and liaise with the    Governance Services Team to propose additional KPIs.

827  Any Other Business

Noted

827.1        that Alex Payne was thanked for her hard work for the Committee and wished the best for her future role.

828  Agendas for Cycle 1 2020/2021 – Audit Committee

Received for information paper 19/675B, ‘Agendas for Cycle 1 2020/2021 – Audit Committee’.

Noted

828.1        that the annual Internal Audit opinion, the Fraud and Anti-Bribery report, and those items noted in this meeting would be added to the agenda for the October meeting.

Resolved

828.2        for agenda item 25 of the November meeting be updated to read Hospitality Register.

829 Receipt of Minutes

Noted

829.1        that the minutes of the meeting of the Governance Committee from November 2019 and March 2020 had been received by the Committee;