Audit and Risk Committee minutes 25 March 2026

Minutes of the Meeting of the Cardiff University Audit and Risk Committee held on Wednesday 25 March 2026 at 14:00 in room 0.62 Bute Building and by Microsoft Teams

Present: Dr Robert Weaver (Chair), Aneesa Ali, Pers Aswani, Suzanne Rankin, Craig Watkins.

In Attendance: Jonathan Brown (KPMG), Sally-ann Efstathiou [minute 1439], Carina Fraser [minute], Owen Hadall [minute 1436], Victoria Holbrook, Professor Wendy Larner, Sian Marshall, Catrin Morgan [minute 1425-1433], Sally Rutterford [minute 1436], Chris Shaw [minute 1438], Laura Sheridan, Natalie Stewart, Professor Roger Whitaker [minute 1438] and Darren Xiberras,.

1425 Welcome and preliminaries

All were welcomed to the meeting.

1426 Apologies for absence

No apologies were received. The meeting was confirmed as quorate.

1427 Declarations of Interest

The Chair reminded Committee members of their duty to disclose any potential conflicts of interest.

Noted

1427.1 that Suzanne Rankin declared an interest in relation to any discussion of the Dental Hospital as part of the Major and Serious Incidents Update item in the context of her role as Chief Executive of Cardiff and Vale University Health Board; that Suzanne Rankin would not be required to withdraw from the discussion of this item.

1428 Minutes of the Previous Meeting

The minutes of the meeting held on 12 November 2025 (25/336C) were confirmed as a true and accurate record.

1429 Matters Arising from the Minutes

Received and considered paper 25/340C ‘Matters Arising’. The Chair spoke to this item.

Noted

1429.1 Minute 1338.5: that an update was provided on this action as part of the Internal Audit Progress Report;

1429.2 Minute 1332.7: that the action in relation to the student health and wellbeing risk had been closed as the risk had been reviewed by the People, Cynefin and Governance Committee and Council and assurance had been provided that an implementation plan was in place to mitigate it;

1429.3 that it would be helpful to provide a more detailed summary or closure report when actions were closed owing to them being materially dealt with by another committee;

1429.4 that the actions relating to the internal control framework had been closed; that the Committee wished to receive regular updates on the roll out of the framework and the testing of key controls;

1429.5 Minute 1410.12: that progress had been made with this action; an update would be provided to the next meeting.

Resolved

1429.6 for a mapping exercise to be undertaken to clarify where some risks were within the remit of other committees and to consider the need for reporting between committees to ensure adequate visibility, e.g., for Health & Safety Risks;

1429.7 for the Committee to receive regular progress updates on the roll out of the internal controls framework and the testing of key controls.

1430 Items from the Chair

The Chair spoke to this item.

Noted

1430.1 that there were no chair’s actions to report;

1430.2  that Dr Robert Weaver would be stepping down as Chair when his current term of office ended in July 2026; that Stephen Mann had agreed to take over as Chair subject to approval by Council in May;

1430.3 that the Chair had observed a meeting of the Senate;

1430.4 that the Financial Reporting Council were reviewing the audit file for Cardiff University as part of KPMG’s annual Audit Quality Inspection; that the Chair had met with the inspection team;

1430.5 that the Chair had attended a Committee of University Chairs’ meeting on cyber security led by PWC and the Metropolitan Police, which had highlighted the increased threat to Universities of ransomware and cyber espionage attacks.

1431 Strategic Risk Register

Received and considered paper 25/341C ‘Strategic Risk Register’. The Chief Operating Officer and University Secretary spoke to this item.

Noted

1431.1 that work was being undertaken to review risk categorisation and scoring; that the considerable work undertaken by the team had resulted in a shift in accountability and culture; but that the risk profile for the University remained high;

1431.2 [Redacted];

1431.3 [Redacted]; that the Vice-Chancellor had attended a Universities UK meeting on efficiency and transformation in the sector where the need for a new operating model for UK higher education was acknowledged;

1431.4 that the Committee had held a useful discussion on risk appetite as part of a development session; that it had been acknowledged that good progress had been made, but further work was required to operationalise and embed risk appetite across the University;

1431.5 that the format of the report made it difficult for the Committee to take an overview of how the key strategic and supporting actions would effectively mitigate the risks; that this was a limitation of the 4Risk system, and a meeting was to be held with 4Risk to seek to enhance the reporting functionality;

1431.6  that the Dean for Sustainability was working to finalise a Net Zero Implementation Plan; that currently the capital requirement to achieve Net Zero was in excess of the University’s financial capacity; that work on the University’s capital plan was happening concurrently;

1431.7 that the Committee acknowledged there may be a need to deprioritise the mitigation of some risks given the importance of mitigating the financial sustainability risk.

Resolved

1431.8 for the Dean for Environmental Sustainability to be invited to present on the University’s Net Zero plan and targets once the implementation plan and the capital expenditure plan have been approved.

1432 Risk Improvement Plan

Received and considered paper 25/343C ‘Risk Improvement Plan’.  The Chief Operating Officer and University Secretary spoke to this item.

Noted

1432.1 that the plan would if deployed effectively enable the University’s risk maturity to move from “defined” to a target level of “enabled”;

1432.2 the Committee’s view that a target for risk appetite tolerance to be embedded by 2027 was not sufficiently ambitious and should be reviewed.

Resolved

1432.3 to approve the Risk Improvement Plan 2026, subject to the timelines within the plan being reviewed to ensure they are stretching and realistic, particularly in relation to risk appetite.

1433 Due Diligence Framework

Received and considered paper 25/337C ‘Due Diligence Framework’. The Head of Compliance and Risk spoke to this item.

Noted

1433.1 that there had previously been a number of disparate processes in place for high risk areas such as procurement, donations and research; that the framework put in place a standard approach for all areas; this was particularly important in the context of increased third party engagement;

1433.2 that following approval of the Due Diligence Policy in November 2025, work was being carried out to finalise the procedure and guidance documents and to roll out implementation using a communication and training plan; that this work contributed to closing the outstanding Due Diligence internal audit recommendations;

1433.3 that a follow-up audit would be undertaken once the policy was embedded; this was likely to take place in the next one to two years; that no further oversight of the policy and framework was required.

Catrin Morgan and Cheng Long left the meeting at the conclusion of the item.

1434 External Auditor re-appointment

Jon Brown, KPMG, was asked to withdraw from the meeting for this item.

Received and considered paper 25/337C ‘External Auditor re-appointment’.  The Chief Financial Officer spoke to this item.

Noted

1434.1 [Redacted];

1434.2 that the previous procurement process had been challenging, with limited bidder interest, and had resulted in an increase in audit costs; that there were significant risks associated with retendering at this point in time;

1434.3 that independence would be safeguarded through rotation of the audit partner in 2027 with transition arrangements in place for the 2025-26 audit;

1434.4 that a retendering exercise would be undertaken prior to 2029; the Committee acknowledged the importance of commencing this at an early stage given the delays to contract signing following the previous tender exercise;

1434.5 [Redacted];

1434.6 [Redacted].

Resolved

1434.7 to recommend to Council approval of the exercise of the contractual extension option with KPMG LLP for the provision of External Audit Services for a further two-year period from 1 June 2027 to 31 May 2029;

1434.8 for the Chief Financial Officer to discuss contract pricing with the KPMG audit partner to consider whether any costs could be stripped out through the use of increased technology automation;

1434.9 for the KPMG Audit Partner to provide a note on how technology automation can be leveraged and embedded within the audit process going forwards.

Jon Brown, KPMG, re-joined the meeting at the conclusion of the item.

1435 Internal Audit Progress report

Received and considered paper 25/348HC ‘Internal Audit Progress report’.  The Head of Internal Audit spoke to this item.

Noted

1435.1 [Redacted];

UUK/Guild HE Accommodation Code of Practice

1435.2 [Redacted].

1435.3 [Redacted];

Transformation

1435.4 [Redacted];

1435.5 [Redacted].

Resolved

1435.6 to approve the following changes to the 2025/26 Internal Audit Plan:

i.   to defer the staff recruitment audit to 2026/27 and replace the audit with a review of accreditation processes within Optom;

ii.  to reduce the days allocated to Building Management Systems and allocate those days to an audit of Cyber Security.

Suzanne Rankin left the meeting at the conclusion of this item.

Received and considered paper 25/351 ‘UUK Code of Practice’.

1436 Internal Audit recommendations tracker

Received and considered paper 25/346HC ‘Internal Audit recommendations tracker’.  The Head of Internal Audit spoke to this item.

Noted

1436.1 [Redacted];

1436.2 [Redacted];

1436.3 [Redacted];

1436.4 [Redacted];

[Redacted];

Conflict of Interest

1436.6 [Redacted];

Financial Controls

1436.7 [Redacted];

1436.8 [Redacted]

Counter Fraud and Anti Bribery

1436.9 [Redacted];

Fraud Controls in Admissions

Sally Rutterford, Head of Admissions joined the meeting to speak to this action

1436.10 [Redacted];

1436.11 [Redacted];

Sally Rutterford left the meeting

IT General Controls

Owen Hadall, Director of IT, joined the meeting to speak to this action

1436.12 [Redacted];

Identity and Access Management

1436.13 [Redacted];

1436.14 [Redacted].

Owen Hadall left the meeting

Resolved

1436.15 for the Director of Communications and Marketing to confirm the timeline for completion of the Fraud Controls in Admissions action;

1436.16 for action owners for overdue recommendations and issues to continue to be invited to report on progress;

1436.17 for the Head of Internal Audit to consider implementing a review of whether closed actions have been fully embedded as part of the annual plan.

1437  Major and Serious Incidents update

Received and considered paper 25/345HC ‘Major and Serious Incidents update’.  The Chief Operating Officer and University Secretary spoke to this item.

Noted

1437.1 [Redacted];

1437.2 [Redacted];

1437.3  [Redacted];

1437.4  [Redacted].

1438 Open Research Integrity and Ethics Committee Assurance summary

Received and considered paper 25/347C ‘Open Research Integrity and Ethics Committee Assurance summary’.  The Pro Vice-Chancellor Research Innovation and Enterprise, the Head of Research Integrity and the HTA Manager joined the meeting to speak to this item.

Noted

1438.1 [Redacted];

1438.2 [Redacted];

1438.3 that an inspection by the Human Tissue Authority had been undertaken of the research licence and positive feedback had been received on the procedures in place;

1438.4 that the first iteration of the report provided a reasonable level of assurance.

Resolved

1438.5 for the next iteration of the report to provide further detail on the longer term strategic risks, actions & timelines, and the financial implications of any mitigating actions.

Carina Fraser, Chris Shaw and Professor Roger Whitaker left the meeting at the conclusion of this item.

1439 Update on actions to improve mandatory training completion

Received and considered paper 25/339 ‘Update on actions to improve mandatory training completion’.  The Director of People and Culture joined the meeting to speak to this item.

Noted

1439.1 that mandatory training was kept under regular review by UEB to ensure it added value, achieved its intended aims, and the volume did not detract from completion; training was undertaken in addition to wider communications, engagement and capability building;

1439.2  that completion rates of in excessive of 80% had been achieved for some training programmes; that it was not uncommon for training rates to be low in the sector but Management was committed to achieving as close to 100% as possible; that targets for completion rates were not currently in place, but this would be kept under review;

1439.3  that a number of actions were in place to improve completion rates including performance management and development, improving system capabilities, and a pilot of consequences for non-compliance;

1439.4 that the work on values, behaviours and sanctions would provide an opportunity to set expectations for staff in relation to mandatory training completion.

Sally-ann Efstathiou left the meeting at the conclusion of this item.

1440 Any Other Business

No further business was discussed under this item.

1441 Review of risks identified in the risk register

The Chair spoke to this item.

Noted

1441.1  that the issue of artificial intelligence in relation to student assessments was highlighted at the recent meeting of the Senate; that an AI risk was included on the Strategic Risk Register; that it was planned for the Chief Digital and Information Officer to update Council on the work being undertaken on the impact of AI on learning, teaching and research; that members of the Committee would be invited to attend this session given the relevance to the Committee’s work.

Resolved

1441.2  that the information received during the meeting was accurately reflected by the risk register.

1442 Whistleblowing Reports

Received and noted paper 25/344HC ‘Whistleblowing reports’.

All Officers apart from the Head of Internal Audit and the Secretary left the meeting for the reserved item.

1443 In-Camera Meeting

Following the meeting of the Audit and Risk Committee, an in-camera meeting was held. The members of the Audit and Risk Committee, the external auditors, the Head of Internal Audit and the Secretary were present.  There were no points that the Committee wished to bring to the attention of the Council.

The minutes of the meeting held on 25 March 2026 were confirmed as a true and accurate record and were approved by the Committee on 18 June 2026.