Audit and Risk Committee minutes 19 June 2025

Minutes of the Meeting of The Cardiff University Audit and Risk Committee Held on Thursday 19 June 2025 at 13:30 via Teams.

Present: Dr Robert Weaver (Chair), Aneesa Ali, and Dr Nick Starkey.

In Attendance: Jon Brown (KPMG), Owen Hadall [minute 1356], Eleanor Hetenyi (KPMG), Victoria Holbrook, Professor Wendy Larner, Sian Marshall, Anne Morgan [minute 1361], Catrin Morgan [minute 1367], Dr Paula Sanderson, Laura Sheridan, Natalie Stewart, and Darren Xiberras.

1349 Welcome and preliminaries

1349.1 All were welcomed to the meeting.

1349.2 The Chair reminded members that the meeting was being recorded to assist with the production of the minutes.

1350  Apologies for absence

1350.1 Apologies were received from Pers Aswani, Clare Eveleigh, Carys Moreland, Suzanne Rankin and Agnes Xavier-Phillips. The meeting was confirmed as quorate.

1350.2 The Chair noted that should the meeting become inquorate, the meeting would proceed and any matters requiring resolution would be considered by chair’s action.

1351 Declarations of Interest

The Chair reminded Committee members of their duty to disclose any potential conflicts of interest. No declarations of interest were received.

1352 Minutes of the previous meeting

The minutes of the meeting held on 28 March 2025 (24/600C) was confirmed as a true and accurate record.

1353 Matters Arising from the Minutes

Received and considered paper 24/601C ‘Matters Arising’. The Chair spoke to this item.

Noted

Minute 1249.5

1353.1 that the KPMG update on artificial intelligence had not yet been scheduled due to lack of time on the agenda; this would be scheduled for the autumn term if possible;

Minute 1251.8

1353.2 that the ‘deep dive’ review of the Regulatory Compliance Risk had been postponed to September to prioritise the deep dive of transnational education (TNE) and Kazakhstan;

Minute 1262.5

1353.3 that it was not a priority for an external effectiveness review of the Committee to be undertaken prior to completion of the modernising governance review;

Minute 1279.8

1353.4  that receipt of the internal control framework had been pushed back to September as it was contingent on the strategic risk refresh which would be received in September;

1354  Items from the Chair

The Chair spoke to this item.

Noted

1354.1 that there were no chair’s actions to report.

1355 Internal Audit Progress Report

Received and considered paper 24/603HC ‘Internal Audit Progress Report’. The Head of Internal Audit spoke to this item.

Noted

1355.1 [Redacted]

Transformation Programme

1355.2 [Redacted]

1355.3 [Redacted]

1355.4 [Redacted]

1355.5 [Redacted]

1355.6 [Redacted]

Resolved

1355.7 for the next update on assurance mapping activity to highlight any gaps identified in relation to the second line of defence and any actions taken to address this.

1356 IT Resource Prioritisation Report

Received and considered paper 24/604HC ‘I. T. Resource Prioritisation Report’. The Assistant IT Director joined the meeting for this item.

Noted

1356.1 [Redacted]

1356.2 [Redacted]

1356.3 [Redacted]

1356.4 [Redacted]

Owen Hadall left the meeting at the conclusion of this item.

1357 Research Income Draft Report

Received and considered paper 24/604HC ‘Research Income Draft Report’. The Chief Operating Officer and University Secretary spoke to this item.

Noted

1357.1 [Redacted]

1357.2 [Redacted]

1357.3 [Redacted]

1358 HE Data Report

Received and considered paper 24/605HC ‘HE Data Report’. The Chief Financial Officer spoke to this item.

1358.1 [Redacted]

1358.3 [Redacted]

1358.4 [Redacted]

1358.5 [Redacted]

1359 Internal Audit Recommendations Tracker, including a review of overdue priority 1 actions

Received and considered paper 24/606HC ‘Internal Audit Recommendations Tracker’. The Head of Internal Audit and Director of Transforming Governance spoke to this item.

Noted

1359.1 [Redacted]

1359.2 [Redacted]

1359.3 [Redacted]

Due diligence

1359.4 [Redacted]

Legal Services provision

1359.5 [Redacted]

Conflicts of interest

1359.6 [Redacted]

Jon Brown (KPMG) joined the meeting

Resolved

1359.7 for the next iteration of the report to include metrics to show the trend of overdue recommendations over a two year period and the length of time that recommendations took to be closed or remained overdue.

1360 Internal Audit Annual Plan 2025-26

Received and considered paper 24/607HC ‘Internal Audit Plan 2025-26’. The Head of Internal Audit spoke to this item.

Noted

1360.1[Redacted]

1360.2 [Redacted]

1360.3 [Redacted]

1360.4 [Redacted]

1360.5 [Redacted]

1360.6 [Redacted]

Resolved

1360.7 to approve the proposed risk-based audit programme for 2025/26 to include an audit of Travel and Expenses in place of Staff Compensation and Benefits which would be rescheduled to the 2026/27 financial year;

1360.8 for data analytics be applied where possible in the 2025-26 planned audits and for audit reports to highlight whether data analytics has or has not been used successfully alongside the reasons for when it has not been possible.

1361 Deep dive: TNE risk evaluation framework, including Kazakhstan

The Head of International joined the meeting for this item. The Chief Operating Officer and University Secretary, and the Head of International spoke to this item.

Noted

1361.1 that TNE numbers were increasing across the sector with a move toward increased postgraduate taught and research activity; that increased TNE activity intended to mitigate the risk associated with reductions in international student numbers, which were expected to continue;

1361.2 that TNE was not a new activity but the model of TNE was diversifying; that Cardiff University was primarily focused on overseas campuses and distance, flexible or distributed learning;

1361.3 that Kazakhstan was aiming to become the next big TNE hub; that this recognised the market trend for students to choose study locations closer to home;

1361.4 that TNE was a significant market financially for the UK with c.£28bn revenue from education related exports and TNE in 2021 according to Home Office tax return data; that the UK Government had appointed an International Education Champion in recognition of the importance of TNE;

1361.5 [Redacted]

1361.6 that the University made use of the British Council guidance on managing TNE risk, which included a risk maturity framework and checklist; that the key TNE risk areas were:

• reputation:
• quality
• financial
• legal
• internal resources/time – requires considerable resource
• risk of doing nothing is high

1361.7 [Redacted]

1361.8 that the risks around different systems for data protection, cultural differences, and managed growth were being monitored and addressed;

1361.9 that fraud and corruption risks had been carefully considered using the risk maturity framework; that a partnership model had been selected that placed greater control on the University in order to mitigate this; that PWC had been engaged to provide support, including setting up financial systems and bank accounts;

1361.10 that there was scope to learn from other universities in navigating the fragile geopolitical landscape, such as Minerva University; that the University benefitted from wide-ranging experience and examples of best practice provided by UUK International, the British Council and other networks;

1361.11 that no red flags had been identified thus far; that the main challenges related to gaps in knowledge or experience that were being addressed; that processes had been more complex and time consuming that expected, but there was confidence that they were robust; that QS had been engaged as a consultant to document the governance process and to provide an audit trail and framework for further TNE initiatives;

1361.12 [Redacted]

Anne Morgan left the meeting at the conclusion of this item.

1362 Update on Academic Futures next steps

The Vice Chancellor spoke to this item.

Noted

1362.1 that the Vice-Chancellor summarised the processes undertaken for consultation and develop of the Academic Futures business case, including the work of the Academic Futures Task Group; that a number of changes were made to the original proposals following the consultation process; that the business case was approved by Council on 17 June 2025 with a number of assurances provided to Council in relation to staff student ratios, and other matters;

1362.2 [Redacted]

1362.3 that a number of Schools remained in scope for redundancy; that the voluntary redundancy scheme would reopen for those Schools in scope now, with only small numbers needed to achieve the agreed student: staff ratios;

1362.4 that the next phase would be implementation; that it was acknowledged that staff were exhausted by the process and would necessarily need a break during the summer before progressing implementation at pace;

1362.5 that there would also be an important focus on other areas of activity during the autumn term; this included the curriculum refresh, global civic activity, and a new research commercialisation vehicle;

1362.6 that the Committee welcomed the actions taken by the Executive to address the financial sustainability risks.

1363 External Audit Progress Report

The External Audit Partner spoke to this item.

Noted

1363.1 that work was on track with the risk assessment and planning process.

1364 External Audit Plan

Received and considered paper 24/609C ‘External Audit Plan’. KPMG spoke to this item.

Noted

1364.1 that materiality had been set at the same level as the previous year; that the key audit risks were identified as:

• pensions
• research income revenue recognition
• management override of controls
• going concern

1364.2 that revenue recognition risks had been rebutted relating to funding body grants, tuition fee income, other income, investment income and donations and investments;

1364.3 that the use of funds audit work would review the use of grant and employee funding; that this approach was in line with Medr requirements, but was lighter-touch than a public sector regularity audit; that Medr was reviewing the approach as the legislation that this related to was in the process of being amended;

1364.4 that short-term investment valuations were sought from investment fund managers and confirmed by KPMG;

1364.5 that there was limited completeness risk in relation to international student fee income given that recognition was in line with the financial year and therefore presented limited opportunity to manipulate fee recognition;

1364.6  that the work around internal controls provided an opportunity to provide assurance against the risk of fraud arising from management override risks;

1364.7 that the use of cash reserves by the University was helping mitigate financial sustainability risks and therefore was preventing the going concern risk from materialising;

1364.8 that the contract with KPMG was for a five-year period; that audit partner rotation would be required following the 2026 external audit; that continuity of the remaining team would be maintained where possible.

Resolved

1364.9 to approve the External Audit Plan for 2024-25;

1364.10 for the internal control framework to include the identification of key fraud control risks in order to provide assurance against management override risks.

1365 Strategic Risk Register

Received and considered paper 24/610hC ‘Strategic Risk Register’. The Chief Operating Officer and University Secretary spoke to this item.

Noted

1365.1 [Redacted]

1365.2  [Redacted]

1365.3  [Redacted]

Resolved

1365.4 to recommend to Council for approval that the report provides adequate assurance;

1365.5 for sufficient time to be set aside at the next meeting for the Committee to review the report on the refreshed Strategic Risk Register.

1366 Major and Serious Incidents Update

Received and considered paper 24/611HC ‘Major and Serious Incident Update’.  The Chief Operating Officer and University Secretary spoke to this item.

Noted

1366.1 [Redacted]

1366.2  [Redacted]

1366.3  [Redacted]

Resolved

1366.4  to approve that the report provides adequate assurance for the risks in this area.

1367 Public Interest Disclosure Assurance Report

Received and considered paper 24/612C ‘Public Interest Disclosure Assurance Report’.  The Head of Compliance and Risk joined the meeting for this item.

Noted

1367.1 that the number of complaints received were relatively low and could often be referred for action under other University policies; that one case during 2024-25 had a public interest element and having an effective policy and clear process in place meant this could be appropriately managed;

1367.2 that a full review of the policy would be undertaken during 2025-26 in line with the three year review period for policies and procedures;

1367.3  that the small number of complaints received could lead to concerns that staff were not aware of the policy; that the policy was made available to staff on the University website and intranet, was referred to in other policies and was communicated to staff via induction; that further staff communications would be undertaken following the full policy review; that the range of mechanisms in place for staff to raise concerns meant that the Executive were not concerned about the low number of complaints.

Resolved

1367.4 to approve that the content of the Public Interest Disclosure (Whistleblowing) Assurance Report 2024 report provides adequate assurance in this area of risk.

Catrin Morgan left the meeting at the conclusion of this item.

1368 Any Other Business

Noted

1368.1 the Committee’s sincerest and heartfelt thanks to Agnes Xavier-Phillips’ who was to step down as a member of Council at the end of July.

1369 Review of risks identified in the risk register

Noted

1369.1 that no changes were required to the risk register based on the information received in the meeting.

1370 Internal Audit Charter

Received and considered paper 24/613HC ‘Internal Audit Charter’.

Resolved

1370.1 to approve the Internal Audit Charter.

1371 Financial Compliance Report (exceptions only)

Noted

1371.1 that there were no matters to report.

1372 Items Received for Information

• 24/614 Value For Money Policy
• 24/615HC Litigation Report
• 24/616C Annual Review of the External Audit Service

All Officers apart from the Head of Internal Audit and theSecretary left the meeting for the reserved item.

1373 In-Camera Meeting

Following the meeting of the Audit and Risk Committee, an in-camerameetingwas held. The members of the Audit and Risk Committee, the external auditors, the Head of Internal Audit and the Secretary were present.  There were no points that the Committee wished to bring to the attention of the Council.

The minutes of the meeting held on 19 June 2025 were confirmed as a true and accurate record and were approved by the Committee on 24 September 2025.