The Vice-Chancellor has received the final report of the HEFCE Assurance Review of the University that took place on 30 June 2008. The Council has agreed to publish the report for the information of the University.
Date of visit: 30 June 2008
Final report: 20 February 2009
Paul Greaves, Head of Assurance
1. A HEFCE Assurance Review took place at the University of Cambridge on 30 June 2008. A follow-up telephone conversation with the University's external auditor took place on 10 July. The aim of the review, as set out in 'HEFCE Assurance Service work in higher education institutions' (Circular letter 25/2006) was to examine how the University exercises accountability for the public funding which it receives.
2. The University is required to demonstrate to HEFCE, through its various returns, that:
3. The returns on which HEFCE places reliance include:
4. In undertaking an Assurance Review we may conclude one of the following:
5. Our overall conclusion is that we are able to place reliance on the University of Cambridge's accountability information. This will be strengthened by a new annual process that has been introduced to provide additional assurance on the use of public funds given that the University does not currently have a lay majority on its Council.
6. This section of the report sets out our findings from the Assurance Review, including observations by exception.
7. The Council, which meets nine times a year, understands its responsibility for ensuring that the University complies with the accountability requirements set out in the HEFCE Financial Memorandum (FM). It has a clear understanding of the key risks for the University and these form the background to many of the items discussed; often these items are also discussed in more detail at other committees (finance, audit, risk, etc) and various Council members are also either members of those committees or attend their meetings. It actively considers significant audit findings reported by the Audit Committee.
8. The University's corporate governance has been evolving now for a number of years. We welcome the latest changes that have been agreed, including the decision to appoint a deputy chair of the Council, which is a significant development given that the role of chair is filled by the Vice-Chancellor. The presence of a deputy means that the Council will be subject to effective chairing in the Vice-Chancellor's absence and it provides the opportunity for the Vice-Chancellor to stand down as chair should there be an actual or perceived conflict of interest.
9. We also welcome the decision to increase the number of lay members on the Council to four although this still leaves the Council with a minority external membership. The FM places responsibilities on the governing body of an institution and in the University's case this means the executive governing body, the Council, not the statutory governing body, the Regent House. For the sake of this argument it is irrelevant which entity is deemed to be the governing body since neither of them - Council or Regent House - has an external majority.
10. Our position on the corporate governance arrangements of the institutions that we fund, is that we expect those arrangements to correspond to the standards set down by the Committee of University Chairmen (CUC) in their Guide for Members of Higher Education Bodies in the UK (2004) and our position remains the same, regardless of whether individual institutions are members of CUC or not, as is the case with this University. We do not expect full compliance with the Guide but we do endorse the CUC Governance Code of Practice (CUC Code) which expects institutions to comply with its precepts or explain why they do not. One of the precepts is that 'the governing body shall have a majority of independent members, defined as both external and independent of the institution'. For the HEFCE, this requirement for a lay majority is particularly important and whereas, to repeat, we do not demand compliance with the Code, it is a requirement which we feel compelled to press either for compliance with by institutions or for alternative arrangements which produce the same effect.
11. Our position is that the taxpayer invests every year a large sum of money in the University (2006-07: over £290 million of total public funds - not just HEFCE). We have an accountability framework which enables the University to demonstrate how it is using the funds and that it is achieving value for money. But an expectation underlying that framework is that the governing body which oversees the use of our funds will be independent and not be potentially conflicted in how and where those funds are used. In the case of this University, with its Council dominated by people from within the collegiate University, those members have a potential vested interest in the application of the funds and are not demonstrably acting primarily on behalf of the public interest. This is in contrast to almost every other HEI in the country and in contrast to the bulk of publicly funded bodies in all sectors.
12. We understand the University's position which is that it sees itself as a self-governing academic community and we accept that its excellent performance should not be undermined by change for change sake. But we are also confident that our interests and those of the public would be better served by having strong oversight of public investment to the same extent that other HEIs have. In our review, we therefore asked the University to reflect on and explain to us how its new governance arrangements for the receipt and use of substantial sums of public money could provide adequate and broad oversight that can be relied upon by third parties. We asked the University to consider whether it could identify any potential changes to improve accountability and it proposed that a new annual accountability exchange should be introduced in which the Chair of the Audit Committee on behalf of the University would meet with the HEFCE Designated Officer or his representatives to reinforce existing assurance arrangements and provide additional direct assurance about the use of funds. The University proposes that the chair of the Audit Committee, who is an external member of the University Council, would consult with the other external members of the Council, the Finance Committee and the Audit Committee itself before this discussion.
13. The University's proposal is a relatively modest extension to its public accountability but it will have value in the format agreed during this review. In the accountability exchange process, the HEFCE's Assurance Consultant will derive additional assurance about the University's accountability in dialogue with the Audit Committee Chair, Registrary and other senior officers as appropriate bearing in mind the issues of interest in each particular year. We will review the effectiveness of this process in three years' time.
14. Our primary interest is in the stewardship of our funds but our broader position on a lay or non-executive majority follows the current consensus across all sectors. We believe that lay majorities are the norm, and we are confident that debate and decision making in a university is informed and refreshed by the ideas that outside individuals bring, especially those with experience and expertise from society, business and the professions. We therefore asked the University to set down how its governance arrangements compare with those set out in the CUC Code and with those of its peer institutions, to highlight the differences, and to explain how its secures the external stimulus that is so vital for any organisation of its standing. The University provided a comprehensive response to this challenge, explaining how its traditions of transparency and scrutiny should give confidence to the outside world in its use of funds; pointing to the checks and balances afforded by its governance structure, including the additional oversight and challenge afforded by the Regent House; and detailing a range of points in the governance and management structure in which external involvement takes place. The University stressed that its governance arrangements have been evolving over a number of years; our expectation is that this will continue.
15. The University will prepare a revised Statement of Primary Purposes in the light of this Report and this will be published as part of the Corporate Governance Statement in the University's annual financial statements and on the internet - again improving compliance with the CUC Code.
16. We agreed with the University that the corporate governance statement should report explicitly that it is an exempt charity and, as a matter of good practice, should list the trustees. The University accepts that the members of the University Council are the trustees and are therefore responsible for ensuring compliance with charity law. Greater transparency about this in the corporate governance statement may aid public understanding of the relationship between the Regent House and the Council. Like all charities, the University is now subject to the public benefit test introduced by the Charities Act 2006 and management understand the need to consider the impact of this, particularly given the significant commercial income that it receives.
17. We commend the recently introduced practice of checking for and recording declarations of interest at the start of all meetings of key committees.
18. The Council oversees the development of University strategic plans, a process that has involved the wide engagement of staff throughout the University using Discussions and other vehicles to ensure wide engagement. The Council has used recent strategic meetings (which are separate from its regular meetings) to embark on an 'imagining' process to develop ideas for future strategic directions that take account of key external trends and possibilities in the context of (likely) available resources. This will provide a high-level framework for engaging the rest of the University in the next strategic plan. It will also enable the University to develop its use of key performance indicators as an aid to monitoring performance relative both to its own targets and to the performance of a group of competitor universities in the UK and worldwide. We were pleased to learn about the University's development of an environmental sustainability toolkit. This will be of direct value to the University, and will also enable international comparisons with the other members of the International Alliance of Research Universities.
19. Five of the Committee's nine members - including the Chair - are external to the University. The Chair considers that the length of engagement of the external members, together with the insights of the academic members, means that all members have or develop a good understanding of the University and its risks and processes. To help with this, the Committee has periodic workshops on new or changing issues. In spite of its relatively large membership, the Committee has been occasionally inquorate. We note that this has been recognised and is being kept under review. The Vice-Chancellor makes a report to and attends the Committee once each year. The Pro-Vice-Chancellor (Planning and Resources) - who has responsibility for risk management and for value for money - attends all meetings.
20. It is clear that the Committee (which meets six times each year, usually for three hours) is conscientious about its responsibility to keep the effectiveness of risk management, control and governance under review. All internal audit assignment reports, the internal audit annual report and the external auditor's reports and management letter are considered by the Committee. We were interested to learn that each internal audit report is assigned for detailed consideration by a member, who then presents the findings to the Committee. We were assured that this leads to well-informed discussion of key issues raised in the reports. It is unusual in the sector for audit committees to consider every internal audit report in full, and this is something the Committee may wish to review periodically. On occasion, relevant managers attend meetings to discuss internal audit findings.
21. Senior staff and auditors described the Committee as being well-prepared to challenge them about audit findings, recommendations and implementation plans, and about risk management issues. The Committee monitors the implementation of audit recommendations via follow-up work by the internal and external auditors, and considers that management respond appropriately to recommendations.
22. The Committee discusses reports on risk management, including suggested changes to the risk register, and value for money (VfM) at most meetings. These provide additional evidence for its own annual opinions to the Board. Other than coverage by internal audit, the Committee has not hitherto had a direct role in respect of data returns submitted by the University to HEFCE and other funders.
23. The University is responsible for assuring HEFCE that the autonomous Colleges apply HEFCE funding that passes to them, through the University, for the proper purposes. The evidence for this is collected each year and the University's external auditors review the evidence and report accordingly. This is clearly helpful reassurance, but we suggested that the Committee should also receive from University officers a direct assurance report on the oversight of the Colleges' use of HEFCE funds. Such a direct report could build on work relating to the College's accounts already carried out by the Director of Finance. This potential enhancement was to be the subject of further consideration by the Audit and intercollegiate committees and we look forward to hearing the outcome of those discussions in due course.
24. The Chair of the Audit Committee attends the meeting of the Finance Committee at which the annual financial statements are scrutinised in detail, thus gaining assurance about that process. The Audit Committee itself reviews the financial statements in order to be satisfied that issues within its remit - key estimates, corporate governance reporting, etc - are adequately covered.
25. The Audit Committee used a recent workshop session to carry out a review of its own effectiveness with a mainly positive outcome, including a commitment to continue to improve its processes.
26. The 2006-07 and 2007-08 annual reports to the Council were clear and unequivocal that risk management, control and governance arrangements were effective. However, the scope of the report in terms of its coverage of Cambridge Assessment and Cambridge University Press needs to be clarified (see below).
27. The reports included the Committee's required annual opinion on the adequacy and effectiveness of arrangements for promoting economy, efficiency and effectiveness. The committee derives assurance from VfM work undertaken within the internal audit programme and from other reports received during the year, including its consideration of the annual report of the VfM Committee to Council.
28. The annual report by internal audit to the Council provides brief but comprehensive coverage of the work undertaken during each year, including the overall opinion for each assignment, the number and grade of recommendations, and stewardship information. The activities of Cambridge Assessment or Cambridge University Press, which have separate internal audit arrangements in place, are outside the scope of the report (see below). The report includes the required opinion from internal audit about the adequacy and effectiveness of risk management, control and governance and thus provides the Council with independent assurance on these topics. The opinions in the internal audit annual reports for 2006-07 and 2007-08 were clear.
29. The University's 2006-07 and 2007-08 financial statements state that 'Cambridge Assessment and Cambridge University Press are constituent parts of the corporation known as the Chancellor, Masters and Scholars of the University of Cambridge.' The Syndicates that oversee these two operations have no corporate status separate from the University, but we understand that the nature of the operations means that most of the financial transactions are carried out by separate organisational entities, including subsidiary 'trading companies', using their own financial systems. The financial statements (Note 11) show that in 2007-08 these two operations contributed £397 million (37 per cent) of the University's reported total income of £1,074 million.
30. The two University Syndicates that oversee these substantial operations have audit committees (although that of Cambridge University Press is relatively new). Each Syndicate has appointed both internal and external auditors. At the time of our review both external audit contracts were with the same firm, whereas the internal auditors were different. However, one of the internal audit contracts is with the firm that currently has the external appointment for the University as a whole (we understand that the firm in question provides the services from separate offices and that there is no contact between the two audit teams). We understand how these arrangements have developed but we have reservations about the potential for perceived conflict of interest given that one firm provides external audit services that encompass a material operation for which it holds an internal audit assignment.
31. We are also concerned about the role of the University's Audit Committee in respect of such material operations and about the lack of transparency of the audit arrangements for those operations. Each year, before the Council approves the audited financial statements - which, as noted above, cover the 'whole' University - it considers the opinions on control systems, governance, etc in the Audit Committee's annual report. Yet it would appear that this report relates to only 63 per cent (measured by income) of the University's activities. We recognise that the University's Audit Committee has for some years reviewed an annual report from the Cambridge Assessment Audit Committee - albeit several months after the University's financial statements had been approved and therefore ineffective in relation to the year under review. We understand that a similar process is planned in respect of the Cambridge University Press Audit Committee.
32. The University accepted our reservations about the audit arrangements for the Press and Cambridge Assessment and following our review took steps to develop the reporting route from the two audit committees up to the University Audit Committee. The University also agreed that the internal and external audit arrangements for the two operations, in relation to those for the University itself, should be rationalised. This may take some time to implement although a single external auditor has now been appointed for the University, Cambridge Assessment and Cambridge University Press following a tendering exercise. In the case of the Press, the new external auditor will be appointed for its financial year ending April 2010. In the case of Cambridge Assessment, the external auditor will be appointed for its financial year ending July 2009.
33. The submission of data from the University to HEFCE is important for both funding and accountability purposes. We discussed, and are able to place reliance on, the processes underpinning the HESA and HESES returns to HEFCE. Responsibility for the returns rests with the Registrary. Although the Registrary is the head of the Unified Administrative Service at the University, he is not involved in the detailed work on the returns carried out by the Planning and Resource Office. His review of the returns therefore represents a reasonable segregation of responsibility.
34. We were pleased to learn that the internal audit plan makes provision for occasional reviews of data systems, including TRAC data, although there has been no recent audit of the student number returns to HEFCE. We take this opportunity to emphasise that the new version of the FM (June 2008) requires audit committees to provide an opinion on the adequacy and effectiveness of the arrangements for the management and quality assurance of data submitted to funding bodies. This requirement is intended to apply to reports in 2008 relating to the 2007-08 academic year.
35. In paragraph 18 we have described the University's current approach to corporate planning and the ways in which resourcing and sustainability are addressed in parallel with the development of academic and research strategies. The University's senior managers are all involved in this process which provides the backdrop to these two accountability returns.
36. Both the CPS and AMS are compiled in the Planning and Resource Office - in liaison with both the Finance Division and relevant project managers - before being reviewed and signed by the Registrary. Following discussions during our review, the Planning and Resources Committee will in future scrutinise and provide independent oversight of these two returns.
37. We discussed the TRAC return with the Director of Finance who considers the University's systems to be robust. We noted that internal audit had recently reviewed the systems in advance of the planned Quality Assurance Validation by Research Councils UK. The Director of Finance wishes to make more use of TRAC data for internal resource allocation and for more than research projects, particularly following TRAC for Teaching developments of the last couple of years. We encourage the University to do this, not least in order to understand better the full cost of discretionary activities.
38. We discussed the financial forecasts with the Director of Finance. The University's budget and longer-term forecast are developed iteratively with close oversight by the Finance Committee, which is chaired by the Vice-Chancellor and has a number of external members. The University's resource allocation model distinguishes between 'Chest' allocations of central income (e.g. HEFCE core funding) and budgeted income. During the last year, the University has been making its approach to capital budgeting more sophisticated, with better integration with the developing strategic planning processes described earlier. This will help the University when, as part of the 'single conversation', from 2008 onwards, HEFCE monitors the newly introduced Capital Investment Framework.
39. The University produces comprehensive monthly financial management reports for discussion by senior managers. The Finance Committee considers quarterly reports of the financial performance of the University (but not of Cambridge Assessment, Cambridge University Press, or the University Trusts). The Director of Finance, as a member of the two Syndicates, receives the monthly financial management reports of Cambridge Assessment and Cambridge University Press and would alert the Finance Committee to any material issues. In relation to the University Trusts, the Finance Committee considers periodic investment reports. We understand that Cambridge Assessment and Cambridge University Press have some operational independence from the University (and have commented above on audit arrangements). The University agreed with us that, from a governance and risk management perspective, the Finance Committee and Council should consider whether the arrangements for in-year financial reporting are appropriate and this will be taken forward by the Committee and the two Syndicates.
40. The Vice-Chancellor is the Designated Officer of the University and supplies and signs the return that is required under the FM providing the necessary assurance. The Vice-Chancellor was confident about signing the return, and about submitting the AMS and CPS, because of her close engagement in the main governance and management processes, including chairing the Council and Finance Committee meetings, and her confidence in both the senior managers and the auditors.
41. This final report has been agreed between the HEFCE and the University of Cambridge. It is available under the HEFCE publication scheme. As indicated in the report we expect to conduct an accountability exchange exercise on an annual basis for a three year period although these reviews will not result in published reports.
42. The report has been prepared for HEFCE and for use within the University. It does not include every matter that came to our attention during the review. Whilst we have no objection to the report being made available to third parties, no responsibility is accepted for any reliance third parties may place upon it.