MINUTES OF THE AUDIT COMMITTEE MEETING HELD ON 12 APRIL Vice Principal Finance, Resources & Risk

Transcription

1 MINUTES OF THE AUDIT COMMITTEE MEETING HELD ON 12 APRIL 2016 PRESENT: David Tomlinson (Chair) Steve James Sara Williams In attendance: Ian James Sue Jones Vanessa Howard Lisa Randall (items 44 to 63) Clerk to the Governors Deputy Clerk to the Governors Vice Principal Finance, Resources & Risk RSM (internal auditor) APOLOGIES FOR ABSENCE 44 Apologies were received from Phil Atkins (external), Malcolm Hales (staff) and David Hoose (Mazars, external auditor). PRE-MEETING BETWEEN COMMITTEE AND AUDITORS 45 The Committee and internal auditor met without management present to allow both the opportunity to raise any issues. The auditor confirmed that the audits had gone well and no issues were raised. She advised full co-operation had been received from College staff with reports returned in a timely manner. DECLARATION OF INTERESTS 46 There were no declarations of interests. MINUTES OF THE MEETING HELD ON 24 NOVEMBER Resolved - that the minutes of the meeting held on 24 November 2015 be approved as a correct record and signed by the Chair. Matters arising New IT Infrastructure (Item 27) 48 Installation of the new IT system had been completed and final payments made although a few minor issues had yet to be resolved. South Staffordshire College, Audit Committee, 12 April

2 INTERNAL AUDIT Internal Audit of IT Cyber Security 49 The internal auditor presented the proposed scope for the internal audit of IT cyber security (copy attached to signed minutes). At the last Committee meeting, the governors had requested that the audit be added to the plan for the year as they had been concerned over an increase in the number of news stories reporting incidents of theft of personal data by hackers. The auditor advised that an assessment tool had been developed by the firm for use in colleges and it was proposed that the framework, mechanisms and areas at risk would be included within the audit. The governors felt that the risk relevance included in the document related mainly to financial risk and they asked that this be extended to cover risks to staff, learners and reputation. 50 Discussion followed on the changes to the annual audit plan required to accommodate this additional audit. Management proposed that the planned audit of capital and estates management be deferred until 2016/2017. The intention had been that the audit would focus on the AgriSTEM development, however, members of the Committee were receiving assurance on progress of the project through attendance at some of the Project Steering Group meetings. Governors were mindful of the fact that assurance in this area was important especially in light of the Area Review process and requested that the audit be undertaken early in the 2016/2017 audit cycle. Indeed, for this reason, the scope should include assets and asset valuations and it was noted that the scope of future audits may also need review to take into consideration any implications of the Area Review. 51 Resolved - that the scope for the audit of IT cyber security and internal audit plan for 2015/2016 be approved subject to the changes mentioned above. Internal Audit Progress Report 52 The internal auditor presented the progress report providing an update on the internal audit plan for 2015/2016 (copy attached to signed minutes). The report included executive summaries and action plans for the four internal audits undertaken since the last Committee meeting: - Framework for Commercial Activity - Risk Management Counter-Terrorism and Security Act Key Financial Controls Budgetary Control and Curriculum Planning - Examinations Learner Support and Registration Processes 53 The audit of Framework for Commercial Activity had resulted in reasonable assurance with three medium and three low priority recommendations being made. The recommendations included the establishment of a mechanism for sharing feedback from commercial activities and assessment of the impact of marketing and promotional activity. The audit had also raised awareness of the need for a different approach to debt management compared to that required for learners. Governors asked to be provided with a copy of the procedure relating to commercial debt, for information. 54 The audit of Risk Management Counter-Terrorism and Security Act 2015 had resulted in substantial assurance with two low priority recommendations being made relating to the vetting of external speakers and use of the 3G/4G network on personal devices. The auditor had identified several examples of good practice at the College including training for staff and sub-contractors and liaison with local schools to identify vulnerable learners and those at risk. Governors felt it was important not only to block attempts but to be aware of and monitor any attempts being made and asked that a check on this be included in the audit of IT cyber security. South Staffordshire College, Audit Committee, 12 April

3 55 The audit of Key Financial Controls Budgetary Control and Curriculum Planning had resulted in substantial assurance with no recommendations for improvements being made. The key control framework was well designed and its application was strong. The auditor emphasised the importance of ensuring strong links between finance and curriculum planning, especially in light of constant changes to funding, and she assured the Committee that such links were in place at this College. 56 The audit of Examinations Learner Support and Registration Processes had resulted in reasonable assurance with three medium and one low priority recommendations being made. The recommendations related to general workplace risk assessments, late registrations, completion of exam support documentation and formal approval of the exams procedure. The outcome of the audit emphasised the need to tighten up on adherence to procedures. Internal Audit Benchmarking Report 57 The Internal Audit Benchmarking Report providing data based on assurance reports issued to other Further Education clients was received (copy attached to signed minutes). The reasons for the fall in audits resulting in substantial' assurance and the increase in those resulting in reasonable assurance were discussed. This may be due to the fact that, at the request of College management, areas for audit were selected on the basis of where best value could be obtained, for example the audits of the new IT network and Counter Terrorism. It was recognised that some areas had higher levels of risk attached to them and perhaps some level of weighting should be applied to the audit opinion. The internal auditor undertook to provide further information on the assurance opinions on previous audits. AUDIT OF SUB-CONTRACTING PROVISION 58 The report on the audit of sub-contracting provision, a new Skills Funding Agency (SFA) annual requirement, was received (copy attached to signed minutes). The financial statements auditor had been commissioned by the SFA to undertake the audit. The report contained key findings, areas for improvement and an action plan. The auditor did not offer an opinion on the outcome of the audit but management felt that the report provided satisfactory assurance on the systems and controls in place to manage sub-contracts delivering education and training. 59 There were four recommendations arising from the audit, three significant and one housekeeping. These related to pre-contract checks, a contingency plan in the event of a sub-contracting failing to deliver on contracted arrangements, quality assurance checks and a review of policies and procedures. The actions would be added to the Committee s rolling report for monitoring purposes. AUDIT COMMITTEE ROLLING REPORT 60 The Committee received the rolling report providing an update on progress made in implementing audit recommendations (copy attached to signed minutes). The report included all levels of recommendations including low level recommendations and those resulting from advisory audits. One high level recommendation due for implementation in July 2016 related to the implementation of a backup and restore system and was partially complete. Completion of another action point relating to the update of the IT Disaster Recovery Plan had been delayed but would be undertaken now that the new IT system had been implemented. The newly appointed Assistant Director of Quality had been tasked with taking forward the action points associated with quality and the new lesson observation process. Some departments were successfully using the new system to create and monitor inventory, an advisory recommendation arising from the audit of inventory records. South Staffordshire College, Audit Committee, 12 April

4 Procedures for completion of staff contracts had been tightened and it was suggested that completion of a signed contract could be added to the staff induction checklist. THE RURAL ENTERPRISE ACADEMY SERVICE LEVEL AGREEMENTS 61 Service level agreements between the Rural Enterprise Academy and the College had been developed for financial, HR and clerkship services. The Clerk advised that the consideration of these service level agreements was strictly outside the terms of reference of the Committee and that they should be submitted to the Board for approval. However, the governors were invited to forward any comments they might have to the Vice Principal. RISK MANAGEMENT Risk Register and Action Plan 2015/ The Risk Register and Action Plan for 2015/2016 was received (copy attached to signed minutes). For 2015/2016, eight significant key business risks had been identified and 35 actions identified to mitigate these risks. The Register and Action Plan had been updated and submitted to the Board at its meeting on 29 February, no further update had been undertaken in the interim period. 63 Staff training on PREVENT was progressing well with 83% of staff having completed their training. Advice had been sought from the Environmental Health Officer in relation to events involving the public to mitigate the risk of the public catching diseases from animals. The use of the Pro-Monitor system for monitoring learner performance was proving very effective with 73% of learners on track for completion of assessments on schedule. Governors were interested in receiving more information on the Pro-Monitor system. RE-APPOINTMENT OF INTERNAL AND EXTERNAL AUDITORS 64 The Committee considered the re-appointment of the internal and external auditors and analyses of their performance, completed by College management, were received (copies attached to signed minutes). The contract for the internal auditor had been extended for the current year but the Committee was mindful that it would be preferable not to change the audit service providers during the Area Review process. The Committee however proposed that, although satisfied with the service, it should consider implementing the tender process for the appointment of the internal audit service for 2017/2018 at its November 2016 meeting. 65 In respect of the financial statements & regularity audit service, the audit for the 2014/2015 accounts had not gone quite as smoothly as the previous year and one issue had been raised with the audit partner in respect of timeliness of the issue of reports. Nevertheless, the service was regarded as satisfactory. 66 Resolved - that the Board be RECOMMENDED to approve: OUTCOMES FOR LEARNERS 1. the re-appointment of RSM as internal auditors for 2016/17 2. the re-appointment of Mazars as external auditors for 2015/ Governors considered how the discussions and decisions during the meeting might impact on learners. The audits, especially those relating to Counter-Terrorism, Budgetary Control and Curriculum Planning, Examinations and sub-contracting provided reassurance that controls were in place to manage risks for the benefit of the learners. The planned audit South Staffordshire College, Audit Committee, 12 April

5 of cyber security would provide additional reassurance. The Risk Register and Action Plan ensured that key risks were monitored and actions implemented to mitigate the risks. The new Pro-Monitor system had already had a positive impact on learner performance and enabled staff to make early interventions when necessary to support learners. Training on PREVENT would help staff identify those learners at risk of radicalisation. DATE OF NEXT MEETING 68 Tuesday, 28 June 2016 at 9.30am. Chair Date South Staffordshire College, Audit Committee, 12 April