Internal Control Framework
The College’s Internal Control Framework supports the delivery of its strategy and compliance with its regulatory objectives. The objectives are to:
- manage risks which impact the achievement of the College’s objectives;
- safeguard the assets for which Council are responsible;
- ensure that liabilities are recorded and managed effectively;
- prevent and detect corruption, fraud, bribery and other irregularities.
It is designed to manage rather than eliminate the risk of failure to achieve the College’s objectives and can only provide reasonable, and not absolute, assurance against material misstatement or loss.
Council is responsible for determining and monitoring the adequacy of the system of internal control. It delegates authority to the Audit and Risk Committee and receives regular updates from them throughout the year. The Audit and Risk Committee meets four times a year to review ‘deep dives’ into different risks and controls conducted by the Internal Audit team and track progress on improvement actions. The role of the Committee is to assure Council that the systems in place are robust and the risk owners are capable.
KPMG, as the College’s internal auditors, judged that significant assurance could be taken on the overall adequacy and effectiveness of the College’s framework of governance, risk management and control for the period 1 August 2020 to 31 July 2021 with only minor improvements needed. The Council consider there were no significant internal control weaknesses requiring disclosure.
PwC, as the College’s external auditors, also consider internal controls relevant to the preparation of the financial statements. The audit is not designed to identify all internal control deficiencies but will report any significant deficiencies if required. There were no significant control weaknesses identified.
The College’s Risk Management Framework is designed to support the College strategy to deliver its academic mission and comply with all its regulatory obligations. It adopts the three lines of defence model as an integral part of its framework to manage risk.
The Audit and Risk Committee regularly reviews the College’s strategic risk dashboard which summarises the high-level risks the College faces and the likely impact with and without mitigation. The discussion on the key risks at Audit and Risk Committee and, more generally, at President’s Board and Provosts’ Board, are valuable and thought-provoking. In particular, around questions of what risks have we missed and what are the unintended consequences of the controls we have put in place especially with regard to other risks.
Our response to the COVID-19 pandemic is an excellent example of the value of these conversations. Like most institutions, this was not a risk that we had directly planned for. However, we had spent time reviewing our response to business continuity more generally, including designing a crisis response structure and testing this via several table-top exercises. This stood us in good stead when the crisis struck, and we needed to move rapidly online whilst continuing our essential COVID-related research.
Our actual response also taught us a great deal about the strengths and weaknesses of our crisis-response structure especially when asked to operate for long periods of time under conditions of great stress. There were lessons learned and change implemented about: frequency and clarity of communication; how to manage the trade-off between inclusive and rapid decision making; the need to rotate crisis leadership to avoid burn-out.
The issue of overlapping and conflicting controls tends to arise mainly when resources are limited. For instance, the need to improve regulatory compliance can lead to additional strain on staff heightening the risk around employee retention. Managing these trade-offs requires careful thought, for instance by designing reporting processes that are quick and easy to use.
Line of defence and responsibilities
First line of defence
The first line of defence lies with the faculties, schools, institutes, departments and process owners whose activities create and manage the risks that can facilitate or prevent the College’s objectives from being achieved. This includes taking the right risks. The first line owns the risk, and the design and execution of the College’s controls to respond to those risks.
Second line of defence
The second line of defence is responsible for the design and maintenance of frameworks, polices, procedures and instructions that support risk and compliance to be managed in the first line. It is also responsible for monitoring and judging how effectively the first line are doing it and is more commonly referred to as functional oversight. The second line is directed by management.
Third line of defence
Strategic Risk Dashboard
Our current risks in the Strategic Risk Dashboard and our approach to responding to them are described below. At the May 2021 Audit and Risk Committee meeting, the updated College principal risks were reviewed and approved and subsequently shared with Council.
It is worth noting the absence of two items from this latest version: Brexit and USS Pensions. The impact of the UK leaving the EU is clearly being felt in everything from reduced access to research funds to more complicated supply chains, but now that the risk has materialised the focus has shifted to mitigation and control by function.
The recent negotiations around reforms to the USS pension were an example of the difficulties and cost of trying to manage long-term risk. We are pleased that the agreed changes will put USS on a firmer footing for the future and recognise the importance of a reliable pension as part of the College’s total remuneration package.
Strategic Risk Dashboard
- Financial sustainability
- Income diversification
- Infrastructure
- Education and student experience
- Student recruitment and widening participation
- Managing our people
- Transition to a new normal
- Research
- Legal and regulatory compliance
- NHS partnerships
- Business disruption
- Digital infrastructure
- Staff and student safety