Audit Committee Minutes 13 November 2019

Minutes of the meeting of the Cardiff University Audit Committee held on Wednesday 13 November 2019 in room 0.51, Main Building at 9:30

Present:             Mr Michael Hampson (in the Chair), Mr Dónall Curtin, Dr Janet Wademan and Ms Agnes Xavier-Phillips [minute 747-763].

In Attendance:    Mr John Britton, Ms Deborah Collins, Mr Ian Davies [except minute 763-763.6] Ms Katy Dale, Mr David Edwards [minute 755 only], Ms Clare Eveleigh, Ms Alison Jarvis, Ms Faye Lloyd, Ms Alex Payne (Minute-taker), Ms Lynn Pamment [except minute 763-763.6], Professor Colin Riordan [minute 747-760] Mr Richard Walters, Mr Robert Williams.

Apologies: Mr Paul Benjamin (Audit Committee Member), Ms Wendy Wright (Senior Internal Auditor).

747           Preliminaries

Noted

747.1        that the lateness of receipt of the Annual Report & Financial Statements and associated papers for consideration at this meeting was acknowledged, and that the Chair considered this situation unacceptable;

747.2        [Redacted]

747.3        that the discussions in respect of this judgement were concluded very recently following the meeting of the Policy & Resources Committee during the preceding week, and the Chief Financial Officer (CFO) took responsibility for the late delivery of these papers;

747.4        that the Chair of the Audit Committee advised that he would only expect the Members of the Committee to endorse the Annual Report & Financial Statements subject to the receipt of further comments outside of the meeting, before presentation at Council;

747.5        [Redacted]

748           Minutes of the previous meeting

Noted

748.1        that the minutes of the previous meeting had been presented in full to Members of the Committee only, as there was an ongoing issue around the preparation of minutes for publication;

748.2        that the minutes were therefore not ready to be reviewed for agreement, as they had not been finalised;

748.3        that it was agreed that going forward it would be helpful to receive the Decisions & Actions log as a part of the Meeting Books and papers distributed for each meeting of the Audit Committee;

748.4        reference to the previous discussion around ensuring that the Audit Committee was acting in line with its Terms of Reference, and restatement of the importance of fulfilling its role and function;

748.5        that the Head of Internal Audit had contributed to this work as much as possible, and that Governance Services would follow up this matter with the Chair of the Audit Committee directly;

Resolved

748.6        that the minutes of the meeting held on the 03 October 2019 should be finalised in line with publication requirements and presented to the Audit Committee and attendees for agreement as soon as practicable;

748.7        that with the Chair, the Governance Services Team would review the Committee’s Terms of Reference to ensure that all matters have been built into its annual schedule of activity.

749 Matters Arising from the Minutes

There were no matters arising from the minutes.

750 Declaration of Interests

Noted

750.1        that the members of the Audit Committee had been asked to ensure that their Disclosure of Interest forms were up to date and included all affiliations and commitments;

750.2        that it was requested that a rationale be given for the need to include all affiliations and commitments even where it was unlikely that a conflict of interest would arise;

Resolved

750.3        that the matter of receiving updated Disclosure of Interest forms where necessary, and providing the rationale requested, would be progressed by the Governance Services Team.

751 Risk Register and Risk Appetite Report

Received and considered for debate paper 19/183B ‘Risk Register and Risk Appetite Report’. Professor Colin Riordan, Vice-Chancellor, was invited to speak for this item.

Noted

751.1        that the University will do everything it can to mitigate the impact of the industrial action, and that it is possible that the University will be liable to compensate students if they do not meet their learning outcomes;

751.2        that a University-wide Industrial Action Contingency Group oversees this activity and considers the areas of greater risk, and what areas of activity will most likely be affected;

751.3        that a lesson learnt from previous strike action was to maintain communication with the students, even when there wasn’t anything specific to update and where nothing had changed;

751.4        the University’s funding model, and the mitigations in place around the University’s financial sustainability - that this was considered as a part of the annual financial planning and could be communicated to the Committee;

751.5        that progress had been made against the actions associated with the student well-being risk and its mitigations;

Resolved

751.6        that the detail in respect of the University’s financial sustainability and mitigations against its funding model would be communicated to the members of the Audit Committee;

751.7        that following debate, the Risk Register and Risk Appetite report was endorsed by the Audit Committee for progression to Council on the 25 November 2019.

752 HEFCW Institutional Risk Review Letter & University Response

Received and considered for debate paper 19/186B ‘HEFCW Institutional Risk Review Letter and University Response’. John Britton, Director of Strategic Planning & Governance was invited to speak to this item.

Noted

752.1        [Redacted]

752.2        [Redacted]

752.3        [Redacted]

752.4        [Redacted]

752.5        [Redacted]

Resolved

752.6        that following debate the HEFCW Institutional Risk Review Letter and Response was endorsed by the Audit Committee for progression to Council on the 25 November 2019.

753 Risk Management Annual Report

Received and considered for debate paper 19/187B ‘Risk Management Annual Report’. Professor Colin Riordan, Vice-Chancellor, was invited to speak for this item.

Noted

753.1        that the Chair made reference to the recommendations contained within the Powell Review Report, which advised that the Audit Committee should formally be responsible for oversight of risk, and that its Terms of Reference would be reviewed;

753.2        that the Powell Review Report would be formally considered by Council at its meeting at the end of November 2019, after which, and subject to the outcome of this discussion, the University’s constitution would be revised;

Resolved

753.3        that following debate, the Risk Management Annual Report was endorsed by the Audit Committee for progression to Council on the 25 November 2019.

754 Live Incidents

Received and noted paper 19/188B, ‘Live Incidents’. Deborah Collins, Chief Operating Officer (COO) & University Secretary, was available to answer questions in respect of this item.

755 Information Security Incidents

Received for debate paper 19/189B ‘Information Security Incidents’. John Britton, Director of Strategic Planning & Governance was invited to speak to this item. David Edwards, Director of IT, was invited to speak to this item.

Noted

755.1        that the details of the incident were discussed;

755.2        that a two-factor authentication process was being investigated as a means of improving the security of the network, and mandatory staff training requirements were being reviewed;

755.3        that it was vital for the Audit Committee to receive assurance that the University was effectively managing cyber security risks, specifically in terms of resourcing and staff training;

755.4        that the University is in the process of investing in a new IT network which will improve its ability to manage and mitigate such risks, and that the University’s position should improve significantly when the new network is in place;

755.5        that the staff completion rate for mandatory training was at approximately 85% overall but that the completion rate can vary significantly across the University;

755.6        that the Audit Committee’s concerns in respect of this incident were noted, and that an update would be received on this matter at a future date.

756 Reconciliation of the Forecast Outturn vs Statements Year Ended 2018/2019

Received and considered for decision paper 19/198B ‘Reconciliation of the Forecast Outturn vs Statements Year Ended 2018/2019’. Rob Williams, CFO, and Alison Jarvis, Director of Financial Operations, were invited to speak to this item.

Noted

756.1        the contents of the report detailing the University Income & Expenditure during 2018/2019, and that the budget expectation had been exceeded by £13M of additional income;

756.2        that the University expenditure during 2018/2019 increased (against budget) correspondingly – staff costs increased as a result of the increase in student numbers;

756.3        that there was an increase in depreciation across the 2018/2019 financial year of between £3-4M from the budget expectation as a result of the increase on capital expenditure;

756.4        that it would be important to consider the communications around the Financial Statements and the bottom-line position, and that this should be proactively managed;

756.5        that it was important to ensure that the position around the University’s pension liability was accurately communicated in light of the anticipated adjustment to the liability during 2019/2020;

Resolved

756.6        that following debate, the Audit Committee endorsed ‘Reconciliation of the Forecast Outturn vs statements Yr. End 2018/19’ for progression to Council on the 25 November 2019.

757 Judgements for the Financial Statements for the Year Ended 31 July 2019

Received and considered for decision paper 19/199B ‘Judgements for the Financial Statements for the Year Ended 31 July 2019’. Rob Williams, CFO, was invited to speak to this item.

Noted

757.1        that the two material estimates and judgements in the paper were received, the first of which was the University’s pension liabilities in the Universities Superannuation Scheme (USS) and the Cardiff University Pension Fund (CUPF);

757.2        that since the year-end the USS Trustees have approved the 2018 actuarial valuation of the deficit, an outcome of which was that a lower deficit recovery plan had been agreed; however, as this was agreed after the year-end date it cannot be accounted for during 2018/2019;

757.3        that this would make it difficult to understand and correctly interpret the Financial Statements, and that in this instance it could be sensible to review how the sector is communicating such issues to stakeholders;

757.4        the second of the two material judgements, that of the joint venture company in which Cardiff University has invested, Compound Semi-conductors Limited (CSC Ltd);

757.5        [Redacted]

757.6        [Redacted]

757.7        that the External Audit Partner asserted the importance of challenging the assumptions underpinning the models to ensure that the correct position has been reached - to be sure of the valuation of this investment;

757.8        that the delay in reaching the final External Audit position was as a consequence of the ongoing discussion in respect of these judgement positions;

757.9        [Redacted]

757.10      that the Chair of the Audit Committee considered that there were lessons to be learnt from this investment, and that it would be beneficial to commission an internal audit to be undertaken in order to inform future activity;

Resolved

757.11      that the Audit Committee requested that an internal audit of the joint venture arrangement to be undertaken, and built into the internal audit programme;

757.12      that following debate, the ‘Judgements for the Financial Statements for the Yr. ended 31 July 2019’ were endorsed by the Audit Committee for progression to Council on the 25 November 2019.

758 Transforming Cardiff Assurance Update

Received and considered for debate paper 19/190B ‘Transforming Cardiff – Progress Report’. Professor Colin Riordan, Vice-Chancellor, was invited to speak to this item.

Noted

758.1        [Redacted]

758.2        [Redacted]

759  Annual Report and Financial Statements for the Year Ended 31 July 2019

Received and considered for decision paper 19/200B ‘Annual Report and Financial Statements for the Year Ended 31 July 2019’. Rob Williams, CFO, was invited to speak to this item.

Noted

759.1        that the ‘Summary of the Group Results’ on page 31 of the Exhibit Book, with the Operating Deficit figure of £8.9M, was reviewed;

759.2        that further work will be undertaken on finalising the text on page 34 of the Exhibit Book, which details the primary risks that the University faced during 2018/2019, and that it was important that the Committee was comfortable with the commentary around the financial outlook;

759.3        that the Committee’s attention was drawn to the ‘Principal Risks & System of Internal Control’ section of the statements on page 38 of the Exhibit Book, and that in approving the Annual Report & Financial Statements the Council was confirming that there was a sound system of internal controls in place;

759.4        that the Committee’s attention was drawn to the main statements from pages 47 to 50 of the Exhibit Book, and particularly to the Balance Sheet on page 49;

759.5        that the content of the report on page 75 of the Exhibit Book – the ‘Related Party Transactions’ – were reviewed; it was asked that Committee members review this page in case of inaccuracies;

Resolved

759.6        the accuracy of the entries on the ‘Related Party Transaction’ page of the statements (page 75 of the Exhibit Book) to be checked by respective parties;

759.7        that the Finance Team will circulate an updated version of the Annual Report & Financial Statements to the Audit Committee, for further comment, and subsequent endorsement, before progression to Council on the 25 November 2019.

760 Report to the Audit Committee on the External Audit for the Year Ended 31 July 2019 (including Management Letter)

Received and considered for decision paper 19201B, ‘Report to the Audit Committee on the External Audit for the Year Ended 31 July 2019’. Lynn Pamment, Audit Partner from PwC, was invited to speak to this item.

Noted

760.1        that PwC are required to complete a series of review procedures to ensure that the statements are compliant subject to which an unmodified audit opinion would be issued;

760.2        that as a conclusion has now been reached in respect of CSC Ltd and the pension liability, it is possible to finalise and re-issue the draft External Audit report;

760.3        that no inconsistencies have been identified in the institution’s internal controls, and the institution is compliant with HEFCW’s Financial Management Code and Memorandum of Assurance and Accountability;

760.4        that the audit risks identified were indicated in the report and that there were no issues of materiality to report. The report displayed on Page 87 of the Exhibit Book would be updated following completion of the audit;

760.5        that there was an error in Appendix one of the report, and that the bottom of the table of the report should have read ‘Total Corrected Misstatements’, not ‘Total Uncorrected Misstatements’, and that this page would be updated;

760.6        that the Committee’s attention was drawn to Appendix three of the report which details the independence requirements incumbent on PwC, and that PwC have declared that they have met the independence requirements;

760.7        that Committee members sought clarity over the definition of ‘Related Parties’ as listed on page 101 of the Exhibit Book, and that it was advised that this was a record of the actual financial transactions between the University and those parties listed;

760.8        that the Committee considered whether adequate assurance had been received from the Executive to enable them to provide assurance to Council that all assurance requirements requested by the External Auditors had been met;

760.9        that the Finance Team could prepare such assurance for the Vice-Chancellor, and that this could be shared with the Audit Committee for their awareness, if required;

760.10      that Dónall Curtin, member of the Audit Committee, expressed concern over this approach if it meant that the Audit Committee did not receive adequate assurance prior to the meeting of Council on 25 November 2019;

Resolved

760.11      that the accounting definition of a Related Party Transaction, referred to within the statements, be provided to members of the Audit Committee to ensure that there were no inaccuracies;

760.12      that a paper detailing the assurances from the University Executive, in fulfilment of each assurance requirement requested by the External Auditors in the Letter of Representation, be issued to members of the Audit Committee;

760.13      the PwC would update and re-submit their report to the Audit Committee for distribution, prior to the presentation of the Annual Report & Financial Statements at Council on the 25 November 2019.

761 Annual Sustainability Assurance Report (ASSUR)

Received and considered for decision paper 19/202B, ‘Annual Sustainability Assurance Report (ASSUR)’. Rob Williams, CFO, was invited to speak to this item.

Noted

761.1        that this report was a regulatory reporting requirement and that it broadly sets out the average cash flow that is required to meet the organisation’s requirements;

Resolved

761.2        that following debate, the Audit Committee endorsed the ASSR for progression to Council for approval on the 25 November 2019.

762 Financial Irregularities Report

Received and noted paper 19/204B ‘Financial Irregularities Report’. Alison Jarvis, Director of Financial Operations, was invited to speak to this item.

Noted

762.1        that in accordance with the definitions provided by the HEFCW Financial Management Code the University has not experienced any reportable fraud or financial irregularities.

763 External and Internal Audit Tender Strategy

Rob Williams, CFO, was invited to speak to this item. Lynn Pamment and Ian Davies, from PwC, were not present for items 763 to 763.6 They returned for item 763.7.

Noted

763.1        [Redacted]

763.2        [Redacted]

763.3        [Redacted]

763.4        [Redacted]

763.5        [Redacted]

763.6        that it was considered to be important for the newly appointed external auditors to have adequate time for induction, given the size and complexity of the contract;

763.7        [Redacted]

764 Progress Report: 2018/2019 and 2019/2020 Audit Programme

Received and considered for debate paper 19/191B, ‘Progress Report: 2018/2019 and 2019/2020 Audit Programme’. Faye Lloyd, Head of Internal Audit, was invited to speak for this item.

Noted

764.1        that Clare Eveleigh, Senior Internal Auditor, was welcomed to her first meeting of the Audit Committee as a new member of the Internal Audit Team;

764.2        the audit programme and Key Performance Indicators (KPIs), and emerging themes presented. The timescale within which management responses are received will continue to be monitored.

765 Discussion Points for Internal Audit Reports

Received and considered for debate paper 19/192B, ‘Discussion Points for Internal Audit Reports’. Faye Lloyd, Head of Internal Audit, was invited to speak for this item.

Noted

765.1        that the 2018/2019 Internal Audit programme is in its final stages, and that the reports presented include one with a mixed assurance rating – in respect of ‘Manage IT Change Acceptance and Transitioning’;

765.2        the importance of monitoring the recommendations from the internal audit reports to ensure that the desired level of maturity is achieved, and that the desired level of maturity on the COBIT self-assessment is three;

Advisory Report: Student Counselling & Well-being

765.3        that the ‘Student Counselling & Well-being’ internal audit report was received, and that throughout the fieldwork for this audit a good level of engagement from the relevant staff was observed;

765.4        that a legacy IT system is continuing to have an impact of this team’s ability to provide management information and therefore manage the services to the best of their ability. That in addition there is no mechanism for reporting to Council via a Committee or Sub-Committee;

765.5        concerns in respect of the oversight of this area of the University’s activity, and that there are issues with the presentation of the University’s Risk Register – the lack of granularity prohibits a deeper understanding of the problems experienced;

765.6        that there are plans in place to mitigate the risks identified, for example the development of the Centre for Student Life, and development of the Client Relationship Management system;

765.7        that there is a broader issue across the University of managing all the system investment decisions, and that it is important to ensure that the University has the required level of maturity to make effective decisions;

765.8        that the University counselling service is externally accredited and the standard and quality of the service is validated through this external accreditation;

Advisory Report: Financial Planning

765.9        that the ‘Financial Planning’ internal audit report was received, and that there has been a significant amount of change in this area;

765.10      that one of the areas which the University must consider further is ownership of the financial forecasts and planning at the lowest levels of operation;

Follow Up Report: IT Innovation

765.11      the contents of the follow up report in respect of IT Innovation was received, and that the finalisation of the digital strategy is critical and thus remains on the tracker;

765.12      that it was suggested that it could be helpful for the Director of IT to be invited to the next meeting of the Audit Committee in order to provide an update in respect of progress against the development of this strategy;

Resolved

765.13      that David Edwards, Director of IT, would be invited to the next meeting of the Audit Committee in February 2020 in order to provide a progress report against the development of the IT Innovation strategy.

766 Internal Audit Annual Report 2018/2019

Received and considered for decision paper 19/193B ‘Internal Audit Annual Report 2018/2019’. Faye Lloyd, Head of Internal Audit, was invited to speak for this item.

Noted

766.1        that the Head of Internal Audit drew the Committee’s attention to Table One in the report which detailed the audit opinions given throughout 2018/2019 and the profile of the recommendations;

766.2        that the work agreed within the 2018/2019 Internal Audit Programme had all been completed, and that the profile of the audit opinions was weighted towards the lower end of the assurance rating;

766.3        that there was no indication that the internal control environment is worsening, but as a result of the risk-based audit approach the programme includes those areas which carry higher risk;

766.4        that the Head of Internal Audit drew the Committee’s attention to Table Two in the report which detailed the follow-up reports published during 2018/2019, and the progress made against the recommendations;

766.5        that the annual Internal Audit Opinion is that the University has adequate and effective arrangements in place for the areas of risk management, control and governance, and value for money and data quality;

766.6        that this position and opinion of the Head of Internal Audit is subject to change in future years if the volume of priority one recommendations continues to increase;

766.7        that the Chair of the Audit Committee expressed concern over the lack of progress against recommendations giving less than satisfactory assurance, and that the University does not seem to be moving at pace;

766.8        that it was suggested by a member that it could be beneficial for a cultural audit to be undertaken across the institution, to better understand and address these issues;

766.9        that the Head of Internal Audit considered that the reasons for the lack of progress centres around their root cause, and that it is common for recommendations to exposure further issues;

766.10      that it is important that the University takes a systematic approach to resolving some of the audit issues, and that the COO has created a Governance, Risk and Assurance Group (GRAG) to aid the response;

Resolved

766.11      that following debate the Internal Audit Annual Report for 2018/2019 was endorsed by the Audit Committee for progression to Council on the 25 November 2019.

767 Review of Financial Regulations

Received for debate paper 19/203B ‘Financial Regulations – Resource & Approach’. Alison Jarvis, Director of Financial Operations, was invited to speak to this item.

Noted

767.1        that the proposal and high-level timeline for the review of the University’s Financial Regulations was received. That discussions had been held previously in respect of the resources required to deliver this review;

767.2        that the review process must be collaborative, as there are multiple policies, procedures and operating practices which must be aligned as part of the review;

767.3        that the Executive are considering the resource requirements to facilitate this review to ensure that the Audit Committee receives assurance that the project can be delivered;

Resolved

767.4        that it would be appropriate to include a progress report of the review of the Financial Regulations, and against the schedule proposed, as a standing item at future meetings of the Audit Committee.

768 Draft Audit Committee Annual Report to Council

Noted

768.1        that the Audit Committee Annual Report to Council had not yet been finalised, and would be completed and distributed for endorsement ex-committee prior to its presentation to Council;

Resolved

768.2        that this would be progressed immediately by the Interim Head of Governance Services, and be distributed to members for endorsement electronically.

769 Agenda for the next meeting

Received for debate and decision paper 19/195B ‘Agenda for the Next Meeting – Audit Committee (19/02/2020)’. This item was led by the Chair of the Audit Committee.

Resolved

769.1        that the agenda for the next meeting of the Audit Committee on the 19 February 2020 as presented, was agreed.

770 UKRI Annual Statement on Research Integrity 2018/2019

Received and noted paper 19/194 ‘2018/2019 Annual Statement on Research Integrity’. This report was received for information only.

771 Complaints Report: Student, Staff & Third Parties 2018/2019

Received and noted paper 19/196B ‘Complaints Report: Students, Staff and Third Parties 2018/2019’. This report was for information only.

772 Compliance Report Against HEFCW Financial Management Code

Received and noted paper 19/197B ‘Compliance Report Against HEFCW Financial Management Code’. This report was for information only.

773 Any Other Business

There was no other business.

In-Camera

Following the meeting of the Audit Committee, an in-camera was held in Friary House. Only the members of the Audit Committee and the Head of Internal Audit were present.