Results of 2021 Audits: Universities

Number of clear audit opinions 

A ‘clear’ or ‘unmodified’ audit opinion means that we have reviewed an entity’s financial report and believe it is reliable, accurate and complies with relevant reporting requirements.

We provided 38 clear audit opinions on financial reports across the university sector, including for all 8 universities and 30 of the 40 controlled entities (listed in Appendix E). 

FIGURE 1A: Audit opinions delivered for the 2021 period 

Note: Audit opinions for 10 controlled entities are outstanding (see below).
Source: VAGO. 

Audits still in progress 

As at 30 June 2022, our audits of the following 10 controlled entities are still in progress: 

Reporting timeliness: universities

Under the Financial Management Act 1994, universities need to provide certified financial reports to VAGO within 8 weeks of balance date. The Audit Act 1994 then requires us to provide each university with an audit opinion within 4 weeks of receiving their certified financial report. 

In 2021, 7 of the 8 universities met this statutory timeframe. 

The University of Melbourne did not meet this statutory timeframe. This is because management needed more time to assess the financial impact of underpayments to casual academic and professional employees before providing this information for us to audit. We comment on this further in Part 3. 

Reporting timeliness: controlled entities 

Under the universities' respective enabling legislations, their controlled entities need to provide us with their certified financial reports within 12 weeks of balance date. The Audit Act 1994 then requires us to provide each entity with an audit opinion within 4 weeks of receiving their certified financial report. 

In 2021, 30 of the 40 controlled entities met this timeline. As at 30 June 2022, it has taken a median of 17 weeks to finalise the controlled entities’ audited financial reports. This is up from 14.5 weeks last financial year. 

In part, this longer time is because parent universities—and the relevant auditors—have had to divert resources to focus on complex issues arising from our audits.  

Errors in financial reporting  

The nature, number and size of errors in financial reports submitted for auditing are direct measures of their quality. Entities must correct material errors before we can issue a clear audit opinion. 

This year we found 13 errors during the audit process, an increase from 10 in 2020. 

Material uncertainty highlighted 

We highlighted a material uncertainty related to the going concern of RMIT University Indonesia Pty Ltd as at 31 December 2021.  

While the entity’s directors passed a resolution to deregister the company in 2021, there is uncertainty over how long it will take to complete the deregistration process in Indonesia and then in Australia. 

As this uncertainty was adequately described in the financial report, we issued a clear opinion. 

Snapshot 

In 2021 universities collectively generated a net surplus result of $1.2 billion, an increase of $0.9 billion on the $0.3 billion net surplus in 2020. This financial performance was the result of both increased revenue and decreased expenses. 

Overview

The university sector's net result margin improved significantly in 2021, increasing to 10.9 per cent, compared to 2.9 per cent in 2020.

Snapshot 

The Financial Management Act 1994 requires universities to develop effective internal control systems to maintain proper accounts and records. We assess if these internal controls, which include people, systems and processes, are adequate for preparing reliable financial reports.  

We report significant internal control issues to the entity’s management and its audit committee, as required under the Australian Auditing Standards. 

Overall, universities' internal controls remain adequate for reliable financial reporting. However, as in prior years, there are areas for improvement. 

Raising internal control issues 

As required by the Australian Auditing Standards, when we find any internal control issue while auditing a university and/or controlled entity, we advise its management and audit committee. This advice includes: 

• raising new issues 
• giving updates on issues we raised in a prior period that remain unresolved.  

  ---

Trends in control issues 

As shown in Figure 3A, we found more new issues in 2021 than in the prior period while the number of unresolved issues has fluctuated over the last 5 years. 

FIGURE 3A: Number of internal control issues (new and unresolved from prior period) 

Note: We have excluded low-risk issues as these are considered minor issues or opportunities to improve. 
Source: VAGO. 

Increased reliance on IT controls 

The pandemic has made universities even more reliant on IT controls to ensure the security of their systems. This is largely because some manual processing cannot be done remotely.  

This reliance has also grown with the move to remote course delivery, a trend we expect will continue as universities revisit their delivery models to increase market reach. 

Effective IT controls are important because they reduce the risk of unauthorised access and changes to systems, including cyber-attacks. They are essential for the smooth day-to-day operations of entities and reliable financial reporting.  

Increase in IT control weaknesses 

As shown in Figure 3B, this year, we found an increase in both the number and the types of IT control weakness across the universities, with 12 new issues compared to 10 in 2020. 

FIGURE 3B: Number of IT control weaknesses by type 

Source: VAGO.

Policy and procedure weaknesses 

For an entity’s internal controls system to work effectively, it needs comprehensive, up-todate policies and procedures that document the supporting control activities. Entities also need to review their IT policies regularly to ensure they remain relevant. 

We found policies and procedures that were not well established, relating to third party service providers, logs of access to administration/privileged user accounts, business continuity, and disaster recovery. 

An entity is more at risk of unauthorised access to systems, cyber security attacks, and manipulation or loss of data if it has inadequate policies and procedures, as its employees may be uncertain about what procedures they should be following to process transactions or make changes to data, or what levels of access should be restricted for key systems. 

Planning weaknesses 

Effective business continuity planning—or disaster recovery planning—helps an entity respond quickly to a crisis and minimise disruption to their operations. We found that 2 universities need to enhance their testing of business continuity and disaster recovery plans, in order to be able to respond or adapt to unexpected disruptive events and minimise negative impacts. 

User access weaknesses 

Proper controls over privileged and user access management reduce the risk of unauthorised access to systems and underlying data. Unauthorised access can increase the risk of cyber security attacks and the loss of essential and confidential data (student or employee data). This in turn puts a university at increased risk of financial loss and may lead to time lost on restoring key systems/data. 

Consistent with the prior year, we continue to find a high number of deficiencies in this area. 

Logging/monitoring weaknesses 

Audit logging and monitoring controls record who is accessing and making changes in IT systems. Coupled with effective user-access management and authentication controls, they reduce the risk of fraud, errors and data loss. 

We are encouraged to see fewer weaknesses relating to audit logging and monitoring. This indicates that universities have proper processes in place to identify unauthorised changes and investigate them in a timely manner. 

Of the 5 prior-year issues in this category, 4 are now either partly or fully resolved. 

Overview 

In late 2020 the university sector across Australia uncovered issues with wage underpayments, mainly in relation to casual academic and professional staff.  

During 2021, most Victorian universities assessed whether underpayments had occurred and began making back payments to affected staff, in some cases dating back 7 years.  

This issue significantly affected the timing of the University of Melbourne’s financial report preparation and subsequent audit. During 2021, university management undertook an extensive exercise with the assistance of external specialists to assess the extent of the issue. 

As a result of this exercise, the university became aware it had wage underpayments caused by a misinterpretation of conditions in their Enterprise Agreements. This meant casual academic and professional staff had been preparing and lodging timesheets for hours less than their minimum entitlement hours. 

At the time of our audit, university management had undertaken work to estimate a provision for the underpayments to affected staff. When we assessed the completeness and accuracy of this estimated provision, sufficient records to support the estimate for our audit assessment were not immediately available. The collation of evidence by management was a significant process and contributed to significant additional time to prepare and finalise the 2021 financial report, and for us to audit this information. 

There will be further work undertaken by the university in 2022 to finalise the calculation of specific amounts owed to individual staff, and for payments to be made. 

To all universities 

We recommend that all universities, prioritise and respond more promptly to address the internal control issues we raise with them and that their audit committees monitor the timely resolution of these issues.