Universities: 2016 Audit Snapshot

Conclusion

Financial sustainability, reporting and internal controls in the university sector are generally sound. There are opportunities to build on what has been achieved and improve further.

Findings

Audit opinions

We issued audit opinions to 55 of the 59 university sector entities on their financial reports for the year ended 31 December 2016. We had yet to complete our audits of the remaining four entities at the date of this report.

All but three of our opinions were clear. We qualified the 2016 financial reports of Deakin University, the University of Melbourne and the Australian National Academy of Music (ANAM). We also qualified the 2015 ANAM financial report after our report Universities: 2015 Audit Snapshot was tabled in Parliament.

In our opinion, the accounting for grant revenue in these four financial reports does not comply with the requirements of Australian Accounting Standards.

Revenue recognition is a longstanding issue in the university sector. New accounting standards, which adopt a different approach to revenue recognition and measurement, are due to apply in coming financial years. This is an opportune time for the sector to review and realign their revenue accounting policies, as they will need to do a significant amount of work to be able to comply with these new standards.

Internal controls

To the extent we tested them, we assessed the internal financial controls at the universities to be adequate for reliable financial reporting. We raised 47 internal control issues across the eight universities. Most of these issues related to their information technology environments.

Universities are taking corrective action on the issues we report to them, with 80 per cent of issues from prior years resolved in 2016.

This year we conducted a focused review of the fraud control frameworks at universities—an important element of their internal control environment.

The universities take a comprehensive view on what constitutes fraud, consistent with Australian standards. They have up-to-date and sound policies and procedures in place to manage their fraud risks.

Most had in place all of the key elements we would expect to see in an effective fraud control framework, but there were some important components missing:

• none of the eight universities has a documented fraud control plan in place
• no university has training in place to ensure that contractors and volunteers are aware of their codes of conduct and policies relating to fraud
• most universities have not complied with their legislative reporting requirements for reporting fraud to the Auditor-General.

Financial sustainability

The university sector as a whole remains financially strong. Assets in the sector totalled $20.8 billion at 31 December 2016 compared with liabilities of $4.8 billion.

The universities have large cash and investment holdings and relatively low debt. The composition of their balance sheets has shifted over the past five years, with universities investing their surplus money in more long-term instruments for better returns.

At the same time, universities have taken on more debt to fund capital investment. This has caused the short-term liquidity ratio for the sector to decline, although the ratio remains above one, which means the sector has enough liquid assets to meet current obligations as they arise.

The universities' strong financial performance is underpinned by year-on-year growth in student enrolments, which has led to revenue growth. However, the net result margin at the sector level is declining. This indicates that universities could do more to identify opportunities to improve their cost‑effectiveness and efficiency.

To cater for the growth in enrolments, the rate of capital investment in the sector has grown since 2014. The sector has taken advantage of low interest rates, and has increased its borrowings to fund capital projects.

Despite this, we noted that for three of the eight universities the expenditure on renewing and maintaining their physical assets in 2015 and 2016 was lower than the assets' decline in value through use. If this trend continues over a longer term, those universities face an increased risk that their assets may not be in a suitable condition to meet operational needs.

Recommendations

We recommend that universities:

1. prepare for the new accounting standards for revenue by:

• working together to share technical advice and implementation issues
• updating their policies, process and systems as required (see Section 2.2)

2. strengthen their fraud risk management by:

• documenting a fraud control plan as part of their risk management framework
• making contract staff and volunteers aware of their codes of conduct and policies on fraud through training
• reporting all significant and systemic frauds to the Auditor-General as soon as they become known (see Section 3.2.2)

3. review their long-term plans for asset renewal and replacement to satisfy themselves they will be able to be maintained and replaced when needed (see Section 4.2).

Responses to recommendations

We have consulted with the Department of Education and Training and the eight public universities in Victoria, and we considered their views when reaching our audit conclusions. As required by section 16(3) of the Audit Act 1994, we gave a draft copy of this report to those universities and asked for their submissions and comments.

The following is a summary of those responses. The full responses are included in Appendix A.

We received four submissions from the sector and a response from the Department of Education and Training. The Department of Education and Training and La Trobe University accepted our recommendations and provided details about how they will be addressed.

Deakin University and the Australian National Academy of Music do not agree with our interpretation of the nature of their revenue that led to their reports being qualified. This is discussed further in Part 2 of the report.

Victoria University highlighted that their liquidity ratio has decreased due to their change in investment strategy, which is consistent with our comments on the sector in Part 4.

1.1 Sector overview

Eight universities and their 51 controlled entities make up the public university sector in Victoria. Collectively, they make a significant contribution to the state and national economy through their principal activities of higher education and research.

The universities provide higher education services to both domestic and international students. Enrolments have grown steadily by around 4 per cent each year since 2012, and there were about 370 000 students enrolled in 2016.

Over the past five years, foreign students have consistently accounted for around 30 per cent of total enrolments. As most foreign students pay full fees, they are a significant source of revenue for most universities.

The sector has progressively increased its international operations in an effort to diversify and broaden its reach to international students. This includes establishing overseas offices and campuses, developing partnerships with foreign higher education providers, and offering distance learning and cloud-based options.

The research conducted by the sector contributes to expanding knowledge and improving efficiency, with broad and far-reaching benefits. Higher Education Research and Development statistics show Victoria had the second highest expenditure—behind New South Wales—on higher education research and development in 2014.

Aside from research and education, universities also engage in a number of other income-generating activities, including providing student accommodation, health and fitness facilities and other services, to supplement and support the experiences of their staff and students.

To fund their operations, the sector relies primarily on student fees and government funding. Figure 1A provides an overview of the sector's operations.

Figure 1A

Overview of the university sector

(a) 2016 student enrolment and completion data was not available as at 10 May 2017.

(b) excludes postgraduate research awards.

Source: VAGO and the Australian Government Department of Education and Training Higher Education Statistics Data Cube (uCube).

1.2 Legislative and financial reporting framework

The universities and their controlled entities are subject to a range of accountability and reporting frameworks, with many and varied reporting requirements. As a result, universities' financial reporting is complex.

At the state level, universities fall within the definition of a public body under the Financial Management Act 1994 (FMA). As a result, they must comply with the reporting and other requirements of the FMA, particularly in the preparation of their annual financial reports.However, the universities are not controlled by the state of Victoria, and their financial results are not part of the state's annual financial report.

From the perspective of the Commonwealth, universities:

• are registered with the Federal Tertiary Education Quality and Standards Agency, and are therefore subject to the regulation of the Tertiary Education Quality and Standards Agency Act 2011 (TEQSA Act)
• receive the majority of their grant funding from the Commonwealth Government, and fall withinthe scope of any legislation associated with this funding, including the Higher Education Support Act 2003 (HESA Act).

The TEQSA and HESA Acts, and many of the funding agreements for research and other grants, also impose financial reporting requirements on the universities. The Commonwealth requires some of these reporting requirements to be included in universities' annual financial reports. As a result, the disclosures in universities' annual financial reports exceed the requirements of the Australian Accounting Standards.

Many universities and their controlled entities are registered charities with the Australian Charities and Not-for-profits Commission. This means they have further reporting obligations under the Australian Charities and Not-for-profits Commissions Act 2012.

1.3 What we cover in this report

In this report, we provide information on the outcomes of our financial audits of the eight Victorian universities and their 51 controlled entities for the year ended 31 December 2016. The financial results of controlled entities are consolidated into those of their respective parent entities, and we do not discuss them separately in this report.

We identify and report on the key matters arising from our audits, and provide an analysis of the information included in the universities' financial reports.

Figure 1B outlines the structure of this report.

Figure 1B

Report structure

Source: VAGO.

Appendix B provides a list of all 59 entities included in this report, and details the financial audit opinions issued for the year ended 31 December 2016.

We carried out the financial audits of these entities under section 8 of the Audit Act 1994 and Australian Auditing Standards. Each entity pays the cost of its audit.

The cost of preparing this report was $125 000, which is funded by Parliament.

2.1 Financial report audit opinions

Independent audit opinions add credibility to financial reports by providing reasonable assurance that the information reported is reliable and accurate. A clear audit opinion confirms that the financial report presents fairly the transactions and balances for the reporting period, in keeping with the requirements of relevant accounting standards and applicable legislation. We carried out our financial audits of the university sector entities in accordance with the Australian Auditing Standards.

Figured 2A outlines the status of the sector's financial audits, and the types of opinions issued to each entity.

Figure 2A

Status of the sector's 2016 audit opinions as at 31 May 2017

Source: VAGO.

We issued clear audit opinions for the financial year ended 31 December 2016 to six universities and 46 controlled entities.

The 2016 audit opinions of the following entities were modified (qualified) because in our opinion the recognition of grant revenue did not align with the requirements of the Australian Accounting Standards:

• The University of Melbourne
• Deakin University
• Australian National Academy of Music (ANAM).

We also modified our audit opinion on the 31 December 2015 financial report of ANAM, which was issued after our report Universities: 2015 Audit Snapshot was tabled in Parliament.

The qualified financial reports of these entities treat grant income as a liability and they do not include it as revenue until they provide the services required by the grant.

Australian Accounting Standard AASB 1004 Contributions requires these grants to be recorded as revenue when they are received. The effect of this timing difference can be material to the revenue and net result in any given year, and a liability appears in the balance sheet when no obligation to pay that money exists.

These qualifications alert readers of the financial reports to be cautious when interpreting the financial results and financial positions in the qualified reports. The revenue, net result and liability amounts cannot be compared between universities because different recognition principles have been applied for revenue.

These qualified audit opinions are longstanding issues in the university sector.

2.2 Changes to revenue recognition

The accounting standards that set the recognition and measurement principles for revenue are about to change. This represents an opportunity for the university sector as a whole, particularly those entities whose financial reports have qualified audit opinions, to review and realign their policies on revenue recognition.

There are two new accounting standards on revenue:

• AASB 15 Revenue from Contracts with Customers (AASB 15)
• AASB 1058 Income of Not-for-profit Entities.

These standards will apply to the 2019 financial reports, and will supersede the revenue requirements for public sector entities that are currently in AASB 1004 Contributions.

Applying these new standards will require significant work by the universities and their controlled entities. They will need to assess how they recognise and measure all current types of revenue against the principles of the new standards.

To implement AASB 15, universities and their controlled entities will need to review all existing and potential contractual arrangements so that the contractual performance obligations that will drive revenue recognition are clearly defined. They will need to review existing systems to ensure they can capture the performance obligations and the evidence of when they have been satisfied to trigger recognition of revenue. System changes may be necessary and entities will need to allow adequate time for this to occur.

Given universities are large entities—many with devolved contract management responsibilities—the effort required for them to understand, capture and record the required information may be significant.

Staff in functional areas and faculties who will need to interpret and apply the principles in the new accounting standards may need training, and changes to policies and procedures may be required. The financial reporting team should monitor the changes to provide assurance that revenue is being recognised and measured correctly.

The new standards will apply from 2019, and comparative information will need to be disclosed. In effect, this means that all entities will need to recognise and measure revenue numbers against the new requirements for the 2018 financial year.

As a result of these changes, the university sector has only a short time frame to implement the necessary changes in policies, procedures and systems.

We see this as a good opportunity for the sector to work together, and with universities in other states, to share the challenge of implementing these standards, and develop a consistent approach to the treatment of common types of revenue.

3.1 Internal control observations

To the extent we tested them, universities' internal controls for financial reporting were adequate for ensuring their financial reporting is reliable. However, some important internal controls need to be strengthened and financial reporting matters need to be addressed.

During 2016, we identified 47 internal control weaknesses and financial reporting issues, and reported them to management and university audit committees.

Figure 3A shows the risk rating of the issues we identified, excluding the 16 low-risk issues we reported. These low-risk issues were minor control weaknesses or opportunities to improve existing processes or internal controls. We define each risk rating in Appendix C.

Figure 3A

Reported issues by area and risk rating

Source: VAGO.

Forty-two per cent of the issues raised related to the information technology (IT) control environment at the universities. Universities, as with other public sector entities, rely heavily on IT systems. Common areas of concern include poor user access, poor password controls, and weaknesses in disaster recovery programs. Weaknesses in security and automated controls make material errors and fraud more likely and harder to detect.

Status of matters raised in previous audits

As part of our financial audit process, we monitor the resolution of previously reported control weaknesses and financial reporting issues. We provide information to university managers and their respective audit committees about the status of these issues.

Seventy issues remained open at the start of 2016. Encouragingly, 80 per cent of these matters were resolved during 2016.

Figure 3B shows the internal control weaknesses and financial reporting issues raised in previous audits, with the resolution status by risk.

Figure 3B

Prior year issues by resolution status at 31 December 2016

Source: VAGO.

Most unresolved issues relate to IT controls, with universities not properly dealing with the root causes of problems and consequently only partially implementing our recommendations.

The universities' failure to resolve these problems reduces the effectiveness of their internal control environments.

3.2 Fraud controls

Each year we select one area of internal control and perform a more detailed review of the controls and related operating environment. For our 2016 audits we reviewed the fraud control frameworks in place at universities—a key component of the internal control environment.

The risk of fraud is inherent in all entities. When fraud occurs in public sector entities such as universities, public money is lost.

Australian Standard 8001:2008 Fraud and Corruption Control (AS 8001) identifies three clear activities that are considered to be fraud:

• theft of money or property
• deliberate falsification, concealment, destruction or use of falsified documentation
• improper use of information or position for personal financial benefit.

Universities should be alert to opportunities for fraud to occur, given the nature of their business. They need to design and implement frameworks to mitigate any risks as part of their routine risk management activities.

The Independent Broad Based Anti-Corruption Commission (IBAC) has published a checklist to help public entities assess whether their fraud risk management is better practice. This checklist is included in Appendix E. Figure 3C summarises the key aspects of better practice that should be included in a fraud control framework, based on the checklist.

Figure 3C

Key elements of an effective fraud control framework

Source: VAGO, based on Controlling fraud and corruption: a prevention checklist, IBAC, 2013.

We assessed the fraud risk management framework at the eight Victorian universities against better practice criteria, including the IBAC checklist, AS8001 and the Standing Directions of the Minister for Finance 2016.

3.2.1 Managing the risk of fraud

Most universities have sound policies and procedures in place to manage their fraud risks. Overall, the policies and procedures underpinning the fraud control frameworks are up to date, and there is evidence of recent management review.

All universities defined fraud to include the three components outlined above, consistent with AS 8001. This means the universities have a comprehensive view of fraud.

The following key elements of an effective fraud control framework were evident at most universities:

• corruption prevention principles form part of strategic planning, project planning and business processes
• management, internal audit and audit committees conduct ongoing scrutiny of internal controls
• independent reviews are conducted of the operation and effectiveness of internal controls to prevent, deter and or detect frauds
• a member of management is responsible for fraud control, including communicating to employees the university's commitment to controls, and management's approach to preventing, detecting and responding to fraud and corruption
• fraud control is monitored and reported on at least annually
• procedures are in place to guide the conduct of high-risk activities such as tendering, accounts payable and managing assets
• the university has a policy on the acceptance of gifts and benefits, which it communicates to staff
• pre-employment screening is conducted of qualifications, credit history, criminal history and potential factors that may raise a fraud risk
• credentials of new suppliers and customers are checked.

Although universities have the key elements of a fraud control framework, there is scope for improvement.

3.2.2 Areas for improvement

Documented fraud control plan

Frauds risks are being identified and managed within the strategic risk register at most of the universities. However, none of the eight universities had a documented fraud control plan to support and manage this risk.

A fraud control plan is a key operational document that explains how the university's fraud policy, risk register, and strategies for prevention, detection and response are integrated, and how they are put into practice and reviewed. Fraud control plans should include:

• a summary of the university's major fraud risks, identified by conducting a fraud risk assessment and incorporating knowledge of fraud trends
• treatment strategies or controls in place to mitigate material fraud risks
• roles and responsibilities identified for implementing and monitoring key prevention, detection and response initiatives
• performance measures in place, including procedures for assessing the plan's effectiveness.

A well prepared fraud control plan can provide a university with assurance that they are aware of all major fraud risks, and that they have adequate prevention, detection and response initiatives in place.

Not having a fraud control plan could mean that significant areas of fraud risk are not identified and controlled, putting a university at risk of financial loss.

Practice and culture

Fraud awareness and a university's designated fraud control framework should be communicated to and embedded throughout the university to be effective. Staff must be trained to understand the fraud control framework, and training should be refreshed and delivered periodically to maintain staff awareness.

We found that most universities include fraud awareness and reporting in induction training for new staff. Refresher training is generally provided every two to three years. Specific training is also designed and provided to employees more likely to encounter fraud, such as procurement officers and executives.

To support this, universities should have a code of conduct, and create a culture that supports ethical behaviour. This is in place at all universities, is communicated to employees, and sets out the values employees are expected to uphold.

Universities engage a large number of external resources such as contractors and volunteers. As these external resources are acting on behalf of a university, it is important that they are aware of and trained in the universities' fraud policies—just like directly employed staff members—to reduce the risk of fraud. This would also increase the likelihood of potential fraud being identified and reported.

Currently, no university has fraud training in place for contractors and volunteers. Universities have an opportunity to reduce their risk of fraud in this area.

Reporting of fraud

A reporting system that records all allegations of fraud, investigations and outcomes can provide an overview of the nature, extent and location of fraud that is occurring. It can also form the basis for developing an intelligence capability and risk profiles of potential fraud suspects, and provide data to identify trends.

All universities have in place reporting mechanisms for employees to report suspected fraud and other improper conduct. Most universities also have established procedures for supporting and protecting disclosures as required by the Protected Disclosure Act 2012 (Vic).

Universities, as public bodies under the Financial Management Act 1994, are required to notify the Minister for Finance, their audit committee, the relevant government department and the Auditor-General when they become aware of significant or systemic fraud, whether actual or suspected. This is a new requirement that came in to effect on 1 July 2016. Before this, all instances of fraud, theft or loss had to be reported to the Minister and the Auditor-General annually, subject to certain thresholds.

Two universities are not maintaining adequate records of all actual and suspected fraud, corruption and other losses, including remedial action planned or taken. Further, only two universities made a report of fraud, thefts and losses to the Auditor-General during 2016.

Given the size and complexity of university operations, this indicates to us that there is insufficient reporting of suspected and actual fraud occurring across the universities, and universities are not complying with their legislative requirements.

In a recent example, an incident of attempted cyber fraud perpetrated by an external party for $3.4 million and instances of contracts worth $0.4 million awarded to undeclared related parties were not reported to the Auditor-General. This limits our ability to effectively assess the risk in the sector when conducting our financial audits.

4.1 Financial position and performance

Universities all have strong financial positions, with significant holdings of cash and investments and relatively low debt. They are using their strong position and their ability to source debt in private markets to try to maximise returns on their investments while increasing their capital development.

The sector's net asset position is strong, with total assets over four times the total liabilities, as shown in Figure 4A.

Figure 4A

Financial position of the university sector, 2012 to 2016

Source: VAGO.

While the sector's financial position has remained relatively stable, the composition of its balance sheet has shifted over the past five years. This shift is due to increased investment in longer-term assets, and greater use of debt to fund capital development.

The liquidity ratio demonstrates some of this shift and is shown in Figure 4B. The sector's short-term liquidity has declined since 2015, and is at its lowest level in the past five years. However, the ratio remains above 1.00, which means there are no immediate concerns about the sector meeting its short-term financial obligations as they become due.

Figure 4B

The university sector's liquidity, 2012 to 2016

Source: VAGO.

The trend in the liquidity ratio indicates that universities are:

• using their excess cash to purchase longer-term investments
• increasing borrowings, including short-term borrowings.

Investing cash in longer-term investments is done with the objective of generating higher returns. Although technically these investments do not meet the definition of current assets, most can still be converted relatively quickly to cash as required.

Borrowings are increasing as universities use this source of money to fund capital investments. These borrowings are largely long-term debt, but a portion will always be due for repayment within the next 12 months.

We observed active monitoring and management of cash flow occurring at most universities. This mitigates the risk that universities will not have money ready to pay their bills as and when they fall due.

Operating results

The sector continues to report net profits, with revenue growth due largely to increased enrolments. The revenue and expenditure for the sector over the past five years is shown in Figure 4C.

Figure 4C

Financial overview of university sector from 2012 and 2016

Source: VAGO.

The net result margin has shown an overall decline over the past five years. The results are shown in Figure 4D.

Figure 4D

The university sector's net result margin from 2012 to 2016

Source: VAGO.

The declining net result margin indicates that the sector may have room to improve its management of costs. This will be particularly important in the future, as the proposed funding changes, if introduced, could affect revenue growth in the sector.

4.2 Capital investment

In response to the growth in student numbers, and to take advantage of student accommodation grants in recent years, many of the universities have increased the rate of investment in their physical assets. There are significant ongoing and planned capital development projects in the sector. This can be seen in the increase in payments for capital expenditure since 2014, shown in Figure 4E.

Figure 4E

Payments for capital expenditure

Source: VAGO.

Although these activities have been historically funded from the universities' own cash reserves, some universities have begun taking advantage of recent low interest rates, and are taking on more debt to fund their projects.

To date, the strong net asset position has enabled the sector to take on more debt without any significant impact on its longer-term sustainability.

The increasing investment in assets is evident in our capital replacement indicator. Through this indicator we consider how much the sector is spending on renewing assets compared to the level of assets consumed, as measured by depreciation. The results since 2012 are shown in Figure 4F.

Figure 4F

University sector's capital replacement indicator, 2012 to 2016

Source: VAGO.

The capital replacement indicator has increased since 2014 and shows a trend of increasing investment. Each year the indicator has exceeded 1.5, which is a strong result. This indicates that the majority of universities' assets are being renewed and maintained so that they retain their intended function.

Although the total sector has achieved good results, the individual capital replacement ratios of three universities have been below 1.0 for the past two years. This is shown in the detailed results in Appendix D.

We consider the capital replacement ratio to be a long-term indicator of sustainability, given that capital replacement can be deferred in the short term. Inadequate expenditure on asset renewal and maintenance may lead to assets, including equipment and infrastructure, deteriorating to a point where they are unsuitable for use.

RESPONSE provided by the Secretary, Department of Education and Training

RESPONSE provided by the General Manager, Australian National Academy of Music

RESPONSE provided by the Vice-Chancellor, Deakin University

RESPONSE provided by the Acting Chief Financial Officer, La Trobe University

RESPONSE provided by the Vice-President Finance and Chief Financial Officer, Victoria University