Cambridge University Reporter


Annual Report of the Audit Committee to the Council, 2007-08: Notice

The Council has received this Annual Report from the Audit Committee. The report is published for the information of the University.

Annual Report of the Audit Committee 2007-08

1 Introduction

1.1 The Audit Committee is required by HEFCE to report annually to the governing body, the Council of the University, and the designated officer (the Vice-Chancellor). Copies of the report and the external auditors' Management Letter must also be sent to the Head of Assurance and Audit at HEFCE.

2 Opinion

2.1 The Committee has monitored the effectiveness of the University's financial and other controls throughout the period and is satisfied that there continues to be strong evidence of the adoption of arrangements throughout the University for promoting economy, efficiency, and effectiveness. The Committee has found that the University and individual institutions are making transparent, strong, and sustained efforts to understand and incorporate the appropriate best practices in VFM, governance, risk management, internal controls, and data reliability. With respect to the governance of the University, the Committee particularly wishes to emphasise the value it places on the importance of clear and assessable arrangements. These must be appropriate and beneficial to a responsible, collegiate, and self-governing higher education and research institution. The Committee recognizes that progress against all criteria should be steady and incremental.

3 Key features

Committee (Chapter 5)

3.1 The terms of reference are included in this year's report as a reminder of the statutory requirements of the Audit Committee.

Professional development (Chapter 6)

3.2 Induction and training continue to be areas where the Committee wishes to make further progress.

Associated bodies and University group financial statements (Chapter 8)

3.3 The Committee is continuing to liaise closely with the audit committees of both institutions.

Business continuity management (Chapter 12)

3.4 The Committee was concerned whether all institutions in the University had effective procedures in place and, in response to a request for progress reports on activities in this area, received appropriate documentation and will monitor further progress in the future.

Data and IT (Chapter 14)

3.5 The Committee was regularly briefed on progress with the development, implementation, and upgrading of the University's major IT projects, with particular attention given to data reliability.

HEFCE assurance (Chapter 16)

3.6 As part of the new Assurance Reviews, representatives of the HEFCE Assurance Service visited the University on 30 June 2008, with the broad conclusions of the interim report being that the HEFCE was able to place reliance on the University's accountability information.

4 Coverage

4.1 This report relates to the 2007-08 financial year (1 August 2007 to 31 July 2008), and provides the opinion of the Audit Committee as to the extent to which reliance can be placed on the internal control and reporting systems of the University. The opinion is based on the Committee's consideration of the internal auditors' annual report, a draft of the external auditors' Management Letter, and other work commissioned by the Committee during the year. Even though the period covered coincides with the financial year and thus ends on 31 July 2008, developments between 1 August 2008 and the publication date of the report have been taken into account, and this has been indicated, where applicable.

5 Committee

Terms of reference

5.1 The Committee's duties, as laid out in Statutes and Ordinances, 2008 (p. 942), are:

(a) to keep under review the effectiveness of the University's internal systems of financial and other control;
(b) to advise the Council on matters relating to the external and internal auditors, including their appointment, the provision by the auditors of any additional services outside the scope of their regular responsibilities, the remuneration of the auditors, and any questions relating to the resignation or dismissal of auditors;
(c) to ensure that sufficient resources are made available for internal audit;
(d) to approve proposals for internal audit put forward by the internal auditors;
(e) to review annually with the external auditors the nature and scope of the external audit;
(f) to consider any reports submitted by the auditors, both external and internal;
(g) to monitor the implementation of any recommendations made by the internal auditors;
(h) to satisfy themselves that satisfactory arrangements are adopted throughout the University for promoting economy, efficiency, and effectiveness;
(i) to establish appropriate performance measures and to monitor annually the performance and effectiveness of the external and internal auditors;
(j) to consider, in consultation with the external auditors, (i) any financial statements annexed to the abstract of accounts, including the auditors' report, and (ii) any statement provided by the Council on the governance of the University;
(k) to ensure that all significant losses are properly investigated and that the internal and external auditors, and where appropriate the Higher Education Funding Council for England, are informed;
(l) to oversee the University's policy on fraud and irregularity, and to ensure that they are informed of any action taken under that policy;
(m) to make an annual report to the Council, the Vice-Chancellor, and the Higher Education Funding Council for England;
(n) to receive reports from the National Audit Office and the Higher Education Funding Council for England, and to advise the Council thereon;
(o) to forward minutes of their meetings to the Council.

Membership

5.2 As noted in last year's report, Dr Jonathan Nicholls, formerly Registrar and Secretary of the University of Birmingham, took over as Registrary and ex officio Secretary of the Committee, with effect from 1 October 2007.

5.3 Mr Donald Hearn, who had been a member in class (d) since 2002, has been succeeded by Dr Susan Lintott, Bursar of Downing College, with effect from 1 January 2008.

5.4 Dame Veronica Sutherland, who had been a member in class (b) since 2007, retired as President of Lucy Cavendish College and vacated her position on the Council and her membership of the Committee with effect from 31 July 2008. She was replaced by Dr Liba Taub, a member of the Council, until 31 December 2008, pending a longer-term replacement once the results of the current elections to the Council are known.

5.5 The Committee reviewed its structure and quoracy arrangements during the period under review, but decided, after careful consideration of the relevant issues, to recommend to the Council that no changes to the quoracy arrangements should be made for the time being.

Meetings

5.6 In accordance with guidance issued by HEFCE's Audit Committee Development Group, members of the Committee are now asked at the start of each meeting to declare any interest they might have in relation to points on the agenda; the Committee recommended to the Council that this policy should be implemented by all statutory committees of the University.

5.7 The Committee continues to track business through a 'table of business in progress' and is considering a work plan for future meetings on a regular basis.

6 Professional development

6.1 Induction and training continue to be areas where the Committee wishes to make further progress.

6.2 Two separate workshops were held during the period, on 30 January 2008 and on 29 May 2008, and a seminar after the normal meeting on 20 November 2008. The programme of the first event focused on the conduct of internal audit reviews in Faculties and Departments, the HEFCE Assurance Visit on 30 June 2008, and the HEFCE consultation on the revisions to the Financial Memorandum. During the second workshop, the nature and purpose of the internal audit function were considered and discussed in depth, as was, more specifically, the draft plan for 2008-09.

6.3 Having completed the self-assessment in the CUC guidance in consultation with the internal auditors, the Committee noted that the standard of its performance was generally good, but that it was important to have induction programmes for new members and to continue drawing members' attention to relevant courses and to other development opportunities.

6.4 The chairs of the audit committees of Cambridge Assessment and of CUP were invited to the workshop in May and will be invited to future workshops where the programme is likely to be of interest to them.

7 Finance Committee

7.1 The two Committees continued to exchange minutes to keep themselves informed of each other's business. The Audit Committee took particular interest in the establishment of a Business Sub-Committee of the Finance Committee to deal with routine or non-controversial items of business, thereby allowing the Finance Committee to meet less frequently and to focus its attention on strategic issues.

Investment Office

7.2 The Audit Committee was reassured by the Director of Finance that the Investment Office was taking a long-term view of its investment strategy and that stock market fluctuations were monitored very carefully so that the University was not exposed to unnecessary risks. The Committee decided that the Investment Office should be audited annually, with the focus on different aspects of its activities every year.

Pensions

7.3 The Committee received a satisfactory follow-up certification relating to the pensions administration and ensured that the Trustees were made aware of the report.

Foreign currencies

7.4 The Committee was reassured to note that due consideration was given, across the University, as well as in CUP, to the need for hedging and that there was heightened awareness of the risks associated with exposure to foreign currencies and banks.

Chronology of Finance Committee and Audit Committee meetings in November

7.5 The Committee agreed that there was no longer a need for its members to observe the Finance Committee's consideration of the Financial Statements at a joint meeting in November. Instead, it was decided that in future only the Chairman would attend the Finance Committee meeting and that the Audit Committee would consider the Financial Statements at a subsequent meeting.

8 Associated bodies and University group financial statements

Cambridge University Press (CUP) and Cambridge Assessment

8.1 The Committee was pleased that co-operation with CUP, particularly over the preparation and inclusion of their accounts, had been further enhanced.

8.2 As in previous years, the audit committee of Cambridge Assessment (formerly UCLES) sent its annual report to the Committee.

8.3 The Committee is continuing to liaise closely with the audit committees of both institutions.

9 Financial control

9.1 Internal controls during the period in question continued to be monitored carefully and the improvement noted in the report for 2006-07 was sustained. The Council was informed by HEFCE that the University of Cambridge was not among the universities 'at higher risk' and this opinion was further endorsed following the Quinquennial Assurance Visit (see paragraphs 16.3 and 16.4, below).

9.2 The Committee introduced 'Fraud' as a standing agenda item, giving the senior officers the opportunity to draw the Committee's attention to fraud and to so-called 'near misses'. There were no material instances of fraud and the Committee was reassured by the monitoring arrangements in place.

10 Governance

10.1 The Committee was kept informed of the work done by the Council on governance issues and welcomed the decision by the Regent House to propose a change to the Statutes to bring the total of external members on the Council to four as well as the introduction of a Deputy Chairman for the Council who would take the chair in the absence of the Vice-Chancellor or when it would be inappropriate for her to exercise her chairmanship.

11 Risk management

11.1 The Committee continued to receive the minutes and reports which the Risk Steering Committee submitted to the Council, as well as receiving an internal audit report on risk management arrangements in the University. While recognizing the need for the further embedding of risk management, for example, in the areas where risks are shared with the Colleges, the Committee noted that the relative priority ranking in the risk register was being closely monitored and that good progress had been made in the area of risk management over the last few years.

12 Business Continuity Management

12.1 The Committee had been concerned whether all institutions in the University had effective business continuity procedures in place and, in response to a request for progress reports on activities in this area, received the University policy on continuity management, the implementation plan covering all institutions, and the training schedule, which included, where appropriate, the Colleges. The Committee would want to see work on business continuity to continue.

13 Value for money (VFM)

13.1 The Pro-Vice-Chancellor (Planning and Resources), as Chairman of the VFM Committee, reported on VFM developments at each meeting. The circulation of a questionnaire by the VFM Committee to all Faculties, Departments, and other institutions raised the awareness of VFM throughout the University, and the Committee was pleased that the new status of the Purchasing Working Group as a group of the VFM Committee had improved the linkage between VFM and procurement activities.

13.2 Several of the internal audit reports focused on VFM, for example, the reports on property transaction costs and on temporary employment agencies. The Finance Division report on purchasing and procurement and the EMBS report on utilities and energy procurement were also received and considered by the Committee. The internal auditors consider VFM aspects in their reviews, where appropriate.

14 Data and IT

14.1 The Committee was regularly briefed on progress with the development, implementation, and upgrading of the University's major IT projects, specifically CUFS, CamSIS, and CHRIS, with particular attention given to data reliability. The Director of the Management Information Services Division (MISD) attended one of the meetings to advise the Committee on IT issues raised in the external auditors' Management Letter.

14.2 There were several internal audit reports with substantial IT elements, among them identity management, information systems business continuity planning, and procedures for HESES returns, and it was decided that internal audit plans should always include some work on data quality. In addition, the Committee received copies of the correspondence between HEFCE and the University relating to HESA, HESES, RAS, and similar returns.

14.3 As appropriate, the Committee drew the Council's attention to specific points raised in audit reports and asked the Information Strategy and Services Syndicate (ISSS) to consider particular reports which covered IT issues across the responsibilities of the Computing Service and the Management Information Services Division.

14.4 Paul Greaves, Head of Assurance at HEFCE, gave a presentation to the Committee in November 2008 on, inter alia, the Funding Council's approach to assuring the reliability of data, with particular reference to the responsibilities of audit committees in higher education.

15 Estate

North West Cambridge

15.1 The Committee took a particular interest in the risks connected with the North West Cambridge Project and received regular progress reports on the appointment of the Director and the governance arrangements of the project.

Office of Fair Trading (OFT)

15.2 In response to a question asked by a member of the Council, the Committee sought reassurance about the possible effect on Cambridge following the allegations by the OFT over collusion in the construction industry. The Committee was assured that there had been no impact on the University.

16 HEFCE assurance

16.1 During 2007-08, the Committee received copies of HEFCE's accountability framework, of the Annual Report on corporate governance, internal control and risk management, the accounts direction for the 2007-08 financial statements, the guidance on the new system for exchequer interests and on data assurance, and the revisions to the Financial Memorandum. It also received copies of correspondence with the University on the Training and Development Agency for Schools, the Research Activity Survey, and the Research Qualification Rate action plans. In addition, the Committee considered the Handbook for members of audit committees in higher education institutions which had been issued by the CUC.

Internal audit reporting and procedures

16.2 The Committee continued to work hard on improving practice, particularly in the area of internal audit. During two of the workshops (see also paragraph 6.2 above), the Committee addressed, among other issues, questions of the appropriateness of the scope of each audit visit, the quality of the work undertaken, the extent of the cover of the fundamental risks on the University's risk register, and value added by the internal audit function. The following changes were introduced:

Individual audit reports are scrutinized very carefully by the Committee. All members receive all reports, with each report being introduced by a member at a meeting. If there are concerns, the Chairman draws the Council's attention to them and, where necessary, the Head of an institution where there are outstanding issues of a serious nature is asked to respond to the Committee.

HEFCE Quinquennial Assurance Visit

16.3 As part of the new HEFCE Assurance Reviews, representatives of the HEFCE Assurance Service visited the University on 30 June 2008, holding meetings with the Vice-Chancellor, the Chairman of the Audit Committee, the Registrary, the Director of Finance, and the Internal Auditors. An interim report was issued on 2 September 2008, and has been considered by the University Council. The Council's comments are being submitted to HEFCE, which will consider them and will then in due course issue an amended or final report, which will be published by HEFCE.

16.4 The Committee noted that the broad conclusion of the report was that HEFCE was able to place reliance on the University's accountability information. Positive suggestions had been made about the arrangements for Cambridge Assessment and CUP, and some matters of governance and management had been raised for the University to comment.

17 Internal audit

Internal audit provision

17.1 Grant Thornton UK LLP continued to provide the internal audit service for the University. During the year, Mr Lees took over as Internal Audit Partner from Mr Golding, and Mr Golding succeeded Mr Shanbury as Relationship Partner.

17.2 Information on costs and fees charged for 2007-08 is listed in Annexes B(ii) and B(iii). The Committee again considered value for money and risk in approving the budget and was confident that the service provided during the period in question represented good value for the University.

17.3 The contract with Grant Thornton UK LLP runs until 31 July 2009 and there will be a market testing exercise before the appointment of internal auditors from 1 August 2009.

Internal audit reports

17.4 Annex B(i) provides a list of audit reports submitted to the Committee between November 2007 and November 2008.

17.5 Both of the two reports brought forward from 2006-07 have been finalized. Of the 30 audits planned for 2007-08, three (on 'North West Cambridge planning', on the 'Payroll', and on the 'University card system') were postponed at the request of the University and will be completed during 2008-09; one (on 'Space management') is still in progress. Only two of the seven ad hoc pieces of work requested during 2007-08 (the follow-up report on the 'University Farm' and a VFM report on 'Minor Works') were not ready for submission to the Committee for its meeting on 20 November 2008.

17.6 Of a total of 257 recommendations, the majority were categorized as 'significant' or 'merits attention', with 18 categorized as 'fundamental'. Although it is a requirement that all fundamental recommendations are drawn to the attention of the Council, the Committee felt able to reassure the Council that none of the issues raised by the internal auditors were material to the University as a whole and the Committee is, moreover, confident that improvements agreed in management responses will be made by the time follow-up audits are undertaken.

17.7 The following innovations in internal audit policy and procedures have been introduced:

(i) Heads of audited institutions are now required to attend the initial scoping meeting as well as the closing meeting with the internal auditors and they are more actively encouraged to complete and sign feedback forms for consideration by the Committee;
(ii) in response to feedback, the number of reviews will be reduced, but the fieldwork will be more rigorous;
(iii) departmental reviews will focus on key financial issues;
(iv) in addition there will be a number of topical reviews which will investigate strategic issues in greater depth and involve institutions across the whole University;
(v) audit reports now indicate instances where business processes can be simplified to improve value for money and to the benefit of the institution or activity under review;
(vi) a change in the format of the reports gives a clearer picture of income and expenditure figures;
(vii) an annual internal audit plan covering three years will ensure that all areas are regularly audited.

17.8 Apart from key financial issues, the internal auditors continued to investigate risk management, value for money, internal control, and governance. It was noted that institutions had generally made good progress in these areas, but that there was a clear need to raise performance throughout the University consistently to the high level already achieved in a majority of institutions and activities; a particular area identified where further improvement could be made was business continuity.

18 External audit

External audit provision

18.1 The Committee again formally assessed the performance of the external auditors and concluded that the performance during the audit for the year ended 31 July 2007 had been good. Deloitte & Touche LLP were reappointed as the University's qualified accountants for the audit of 2007-08.

18.2 The Committee was also informed of progress against last year's external audit action plan and noted that this was satisfactory. The Committee received the Management Letter and the Report on the 2008 audit at its meeting in November 2008.

18.3 The current external auditors, Deloitte & Touche LLP, have completed seven years of audit work for the University; HEFCE guidance, and good practice, require that market testing is undertaken before the appointment for the contract starting with the audit 2008-09 is made.

External audit findings

18.4 As part of their testing of controls, the external auditors visited the Department of Chemistry, the Department of German, the Research Centre for English and Applied Linguistics, and Judge Business School, and reviewed financial procedures, as well as IT control, and security policy and procedure.

18.5 The Committee is satisfied that the external auditors were able to assess the control environment as sufficiently reliable for the production of the consolidated financial statements.

19 Other reviews

19.1 Specific projects and individual institutions in the University were again subject to a great number of additional internal and external reviews, covering Health and Safety, VFM, teaching, examining and research, financial, and various other areas. A list covering some of these activities is attached in Annex D.

NIGEL BROWN (Chairman of Audit Committee)

24 November 2008

Annex A

Audit Committee

(i) Membership

Details of the membership of the Committee during 2007-2008 are provided in Table 1.

Table 1

NameNotes
Mr N. Brown (Chairman) External member of the Council
Mr M. Bullock External member
Mr R. Dowling Member of the Council
Professor K. Glover Co-opted member
Mr D. Hearn Co-opted member (until December 2007)
Dr S. Lintott Co-opted member (from January 2008)
Mr N. Martin External member
Mr J. Shakeshaft External member
Mr M. Starkie External member
Dame Veronica Sutherland Member of the Council (until 31 July 2008)
Dr L. Taub Member of the Council (from August to December 2008)

(ii) Meetings

The Audit Committee met six times during 2007-08. Table 2 gives the number of Committee members attending each meeting. Officers attending: Registrary (Secretary of the Committee); Pro-Vice-Chancellor (Planning and Resources) (also Chairman of the Risk Steering Committee and the VFM Committee); Director of Finance; Secretariat Officer (Assistant Secretary). Internal and external auditors were invited to attend all meetings and attended as necessary. Members of the Committee and auditors could call private meetings, held without Senior Officers, at any time. In addition, time was reserved for a private meeting after the first meeting of the Easter Term.

Table 2

Date of meeting Number of Committee members attending Number of members in classes (a) (Chairman, external member of the Council) and (c) external members
11 October 2007 7 3
22 November 2007 8 5
24 January 2008 7 4
13 March 2008 6 2
15 May 2008 8 4
10 July 2008 6 4

Annex B

Internal audit

(i) Internal audit reports

During the reporting period, detailed reports were considered in relation to the following bodies and issues:

Departments of Applied Maths and Theoretical Physics, Pure Mathematics and Statistics, and Centre for Mathematical Studies

Appraisal processes

Bank accounts management and control

CamSIS governance

CHRIS payroll

Institute of Continuing Education - Diploma in English and European Law (part of 06-07)

Credit control (follow-up)

Criminal records legislation

Development Office (part of 06-07)

Department of Engineering

Faculty of English and Department of Anglo-Saxon, Norse, and Celtic

Financial monitoring and control (part of 06-07)

Farm (follow-up)

Fitzwilliam Museum

fEC (follow-up)

Faculty of Geography and Scott Polar Research Institute

Faculty of History

i-procurement

Identity management

Information systems business continuity planning

Intellectual property rights (IPR) (part of 06-07)

Investment Office

Language Centre

Maintenance expenditure

Department of Medicine

Month-end and year-end procedures

Payments to suppliers

Pension funds (part of 05-06)

Processing of the HESES return

QAV preparedness

QAV validation

RAE preparedness

Risk management arrangements

Student feedback

Telecommunications (follow-up)

VFM - property transaction costs

VFM - agency costs

Wellcome Trust

Regular progress reports

(ii) Grant Thornton UK LLP - fees for internal audit work

30 November 2008 Number of days Cost (including VAT)
Completion of 2006-07 0 0
Audit work in 2007-08 456 £255,016
TOTAL 456 £255,016

Expenditure was within budget.

(iii) Grant Thornton UK LLP - fees for other work relating to 2007-08

Other workFees
n/a  

Annex C

External audit

(i) Deloitte & Touche LLP - fees agreed for audit work in relation to 2007-08

External audit work for the University
Fees (incl. VAT) £154,724

(ii) Deloitte & Touche LLP - fees agreed for other work in relation to 2007-08

Training and Development Agency for Schools £6,697.50
Reports to be signed as external auditors0
Fees (incl. VAT) 0

Expenditure was within budget.

Annex D

Other reviews undertaken in the University between 1 August 2007 and 31 July 2008:

Academic Division

Teaching and learning reviews in the following institutions:

Faculty of Archaeology and Anthropology

Faculty of Architecture

Faculty of Classics

Department of History of Art

Department of Economics

Judge Business School

Department of Physiology, Development, and Neurology

General review:

Review of Teaching and Learning Support Services

Finance Division

Accounts payable and disbursements review undertaken by Rockford Associates

EMBS

Asbestos review and audits

Fire safety audits

Strategic review of the non-operational estate

Human Resources

Annual audit of CPS and the Cambridge Colleges' Federated Pension Scheme

Health and Safety Office

14 Internal safety management audits

26 Food safety audit reviews of businesses run by the University

5 Laser safety audit reviews

9 High-risk waste audits

Research Services Division

RCUK Quality Assurance Visit

136 EC FP6 audits

1 Asia Link audit

16 DTI audits

Secretariat

Review of the Agronomy Unit

Review of the Dental Service

External affairs and communications

Core Literature review

Web review

Internal communications review

Colleges protocol review

News cuttings process and provider review