Media release
This report contains findings on the results of financial audits of NSW universities for the year ended 31 December 2019.
All ten NSW universities received unqualified audit opinions. The 2019 financial results for universities are reported as at 31 December and reflect results from operations before the impact of the COVID‑19 pandemic.
The combined revenues for all NSW universities increased by $381 million to $11.4 billion in 2019, driven by increases in student revenues. Revenue from overseas students continued to grow faster than that from domestic students and contributed $3.6 billion in course fees to NSW universities in 2019.
Overseas students from the top three countries of origin, being China, India and Nepal, represented 72.4 per cent of all enrolments of overseas students and 65.4 per cent of all overseas student revenues for 2019. Revenue from students from these three countries comprised 40.9 per cent of total student revenues for all NSW universities, creating a considerable concentration risk for NSW universities.
The COVID‑19 pandemic may significantly impact the financial results of NSW universities in 2020. NSW universities provided data on COVID‑19 impacted student enrolments for semester one 2020. Overall numbers of student enrolments in semester one 2020 were 5.8 per cent beneath projections. Overseas student enrolments were 13.8 per cent beneath expectations and domestic student enrolments were 2.4 per cent below expectations.
The report makes recommendations to the NSW universities, aimed at strengthening controls over information technology, cyber security, validating published performance information, procurement practices and the oversight of their overseas controlled entities' legal and policy compliance functions.
Executive summary
This report analyses the results of our audits of the financial statements of the ten NSW universities for the year ended 31 December 2019. The table below summarises our key observations.
1. Financial reporting
Financial reporting |
The 2019 financial statements of all ten NSW universities received unmodified audit opinions. One controlled entity of the Western Sydney University received a qualified audit opinion. Five NSW universities finalised their audited financial statements this year on or before the date they did last year. New accounting standards, which changed how universities report income and treat operating leases, became effective from 1 January 2019. |
Sources of revenue from operations |
Government grants as a proportion of the total income of NSW universities continued to decrease. Fee revenue from overseas students continued to grow faster than fees from domestic students. Forty-one per cent of NSW universities' total student revenue came from overseas students from three countries. Five NSW universities increased the proportion of revenue they receive from overseas students from a single country. Two universities sourced over 73 per cent of their total overseas student revenue from students from a single country of origin in 2019. |
Other revenues | Two universities attracted over 69.5 per cent of the total philanthropic revenue of $174 million received by all NSW universities in 2019. |
Operating expenditures | Combined total operating expenditure for NSW universities increased to $9.9 billion in 2019, a rise of 5.2 per cent from 2018. |
Current ratio | At 31 December 2019, five NSW universities had a current ratio of less than one, meaning those universities need to actively manage their cash to meet current obligations. |
Controlled entities |
All six NSW universities with overseas controlled entities have devolved responsibility for governance and legislative compliance to their overseas controlled entities. Recommendation (repeat issue): NSW universities should strengthen their governance arrangements to oversight their overseas controlled entities' legal and policy compliance functions. |
COVID-19 impacts and responses |
The 2019 financial results for universities are reported as at 31 December. Consequently, the results for the 2019 year were unaffected by the impact of the COVID-19 pandemic. NSW universities provided data on the COVID-19 impacted student enrolments for semester one 2020. Overall numbers of student enrolments were 5.8 per cent beneath projections. Overseas student enrolments were 13.8 per cent beneath expectations and domestic student enrolments were 2.4 per cent beneath expectations. NSW universities are responding to the challenges presented by COVID-19 by moving course delivery online, expanding student support and introducing cost saving measures. |
2. Internal controls and governance
Internal control findings |
Our audits identified 108 internal control deficiencies in 2019 (99 in 2018). Gaps in information technology (IT) controls comprised the majority of these deficiencies. Deficiencies included a lack of sufficient user access reviews, inadequate review and approval of change management processes, and issues with password settings. We identified one high risk financial control deficiency at the University of New South Wales, which resulted in the University providing for a potential underpayment of casual staff salaries. NSW universities continue to implement recommendations arising from 35 findings raised in previous years. |
Performance reporting |
Five NSW universities still do not have formal processes to internally review and validate performance information published in their annual reports. Recommendation (repeat issue): NSW universities should strengthen processes to review and validate published performance information. |
Cyber security |
Two universities have not yet implemented a cyber risk policy and three universities have not formally trained staff in cyber awareness. Recommendation (repeat issue): NSW universities should strengthen cyber security frameworks and controls to protect sensitive data and prevent financial and reputational losses. |
Management of IT service providers | NSW universities have contracts with vendors to support their computer systems. Five universities have not formally established frameworks to manage these contracts. Poor contract management can compound risks associated with IT control deficiencies. |
Data breach management | Universities are required to maintain the privacy of sensitive data which, if disclosed or used inappropriately, could result in harm to individuals, financial loss, or loss of intellectual property. Two NSW universities have not established formal policies to manage data breaches. |
Procurement |
All universities have a procurement policy. Most universities have a documented procurement manual and contact management policy. Recommendation: NSW universities should review their procurement and contract management policies and procedures to ensure that they are relevant and effective in reducing risk and improving purchasing outcomes. |
3. Teaching and research
Graduate employment outcomes | Eight out of ten NSW universities exceeded the national average for full-time employment rates of their undergraduates in 2019. Six universities performed better than the national average for full-time employment outcomes of their postgraduates in 2019. |
Student enrolments by field of education | Enrolments at NSW universities increased the most in Management and Commerce courses in 2019. |
Achieving diversity outcomes |
Five universities in 2018 (five in 2017) met the target enrolment rate for students from low socio-economic status (SES) backgrounds. Eight universities increased enrolments of students from Aboriginal and Torres Strait Islander backgrounds in 2018. |
1. Introduction
This report provides Parliament with the results of our financial audits of New South Wales universities and their controlled entities in 2019, including our analysis, observations and recommendations in the following areas:
- financial reporting
- internal controls and governance
- teaching and research.
1.1 Snapshot of NSW universities
New South Wales has ten public universities established by legislation to provide tertiary education and research functions. The ten universities have established 76 controlled entities, of which 25 are based overseas.
A snapshot of the NSW universities' revenue sources, operating surplus and student numbers for the year ended 31 December 2019 is shown below.
Source: University financial statements (audited).
The total number of students attending NSW universities increased by 3.4 per cent in 2019 to 299,699. The impact of increased student numbers on the financial results and operating margins for the year is analysed later in this report. The graph below shows the movement in the numbers of equivalent full-time students at each NSW university in 2019.
2. Financial reporting
Financial reporting is an important element of governance. Confidence and transparency in university sector decision making are enhanced when financial reporting is accurate and timely.
This chapter outlines our audit observations on the financial reporting of NSW universities for 2019.
2.1 Quality of financial reporting
Audit results
The 2019 financial statements of all ten NSW universities received unmodified audit opinions for the purposes of satisfying the requirements of the Public Finance and Audit Act 1983 (PF&A Act).
Of the 76 controlled entities:
- 62 received unmodified audit opinions
- 1 received a qualified audit opinion
- 10 dormant university controlled entities were relieved from PF&A Act reporting requirements
- 1 did not comply with the PF&A Act and did not submit financial statements to the Audit Office
- 1 was granted an extension to its reporting period
- the audit of one was still in progress.
Western Sydney University Early Learning Limited, a controlled entity of the Western Sydney University, received a qualification for not recognising a liability and expense for payroll tax incurred in the period 1 July 2015 to 31 December 2018. Instead, it disclosed a contingent liability in the notes to the financial statements. The controlled entity is disputing the payroll tax liability with Revenue NSW.
Suzhou Xi Su Business Consulting Co, an overseas controlled entity of the University of Sydney, did not submit separate financial statements for audit as required by the PF&A Act.
Financial results
The 2019 financial results for universities are reported as at 31 December. Consequently, the results for the year were unaffected by the impact of the COVID-19 pandemic. The challenges presented by COVID-19 on the NSW universities' operations and financial outcomes in 2020 are discussed at the end of this chapter.
The graph below shows the net results of individual universities for 2019. This graph should be read in conjunction with the one on page 22 showing operating margin percentage for comparison.
Source: University financial statements (audited).
Timeliness of financial reporting
All NSW universities and 63 of their 76 controlled entities met the statutory timetable for submitting their financial statements for audit. As noted above, ten dormant university controlled entities were relieved from PF&A reporting requirements, one did not comply with the reporting requirements of the PF&A Act, one was granted an extension to its reporting period and the audit of one is still in progress.
Our audit opinions on NSW universities' financial statements for 2019 were issued between 25 March 2020 and 20 April 2020. Audit completion dates are presented in the following diagram.
NSW universities have adopted aspects of early close procedures to improve the timeliness of completing their financial reporting obligations. Six out of ten universities prepared proforma financial statements. Other early close procedures included completion of asset revaluations before year-end and identifying and seeking resolution of potential accounting issues.
Implementation of new accounting standards
AASB 15 and AASB 1058 became effective for all NSW universities from 1 January 2019. AASB 2019-6 'Amendments to Australian Accounting Standards - Research Grants and Not-for-Profit Entities' allowed universities to defer the application of these standards for research grant revenue until 1 January 2020. Three universities - Macquarie University, the University of New England and the University of New South Wales elected to defer the application of the new standards. As not all universities adopted AASB 15 in relation to research grant income, some 2019 financial data of the universities is not directly comparable.
The introduction of AASB 15 and AASB 1058 required universities to reassess the way they accounted for revenue, depending on whether it arises from contracts for sales of goods and services, grants and other contributions. Revenue from contracts for services is now recognised only when performance obligations have been satisfied. This has tended to delay the point at which universities and their subsidiaries recognise revenue in their financial statements, particularly in relation to research grant funding tied to specific deliverables.
NSW universities adopted the modified retrospective approach to transition to AASB 15 and AASB 1058. This method does not require the restatement of prior period financial statement figures. Instead, the cumulative effect of applying the standards on prior periods is presented as an adjustment to opening retained earnings at 1 January 2019.
On 1 January 2019, NSW universities reclassified $437.6 million from opening retained earnings to contract assets and contract financial liabilities (deferred revenue) on transition to AASB 15 and AASB 1058.
AASB 16 became effective for all NSW universities from 1 January 2019. AASB 16 changes how lessees treat operating leases for financial reporting. Previously leased assets and lease liabilities under operating leases were not recognised in the financial statements, even though the entity had control of the asset and was committed to making those future lease payments. Lease obligations were merely recorded as a commitment in the notes to the entity’s financial statements.
Under AASB 16, operating leases are now recorded, with a few exceptions, in an entity’s Statement of Financial Position through the recognition of a right of use (ROU) asset and a corresponding lease liability. Consequently, AASB 16 results in more assets and liabilities being recorded in the Statement of Financial Position. It also changes the timing and pattern of expenses recorded in the Statement of Comprehensive Income by recognising the depreciation on the asset and the financing cost of the lease.
AASB 16 requires different and more extensive disclosures about an entity’s leasing activities. The objective of the disclosures is to provide users of financial statements with a basis to assess the effect of leasing activities on an entity’s financial position, performance and cash flows.
On 1 January 2019, NSW universities recognised right of use assets of $801 million and lease liabilities of $741.1 million on adoption of AASB 16.
2.2 Financial performance
Results from operations
The graph below presents the income and expenditure for each university in 2019.
Source: University financial statements (audited).
Sources of revenue from operations
Over the past six years, various higher education reforms have been proposed by the Australian Government to manage the cost of tertiary education. As part of the Mid-Year Economic Fiscal Outlook 2017–18, the Australian Government announced it was capping Commonwealth Grant Scheme (CGS) funding for domestic bachelor level courses for 2018 and 2019 at the 2017 funding level.
The extent to which individual universities have been able to reduce their reliance on grant funding by reducing costs and maximising alternate revenue streams has varied. However, over the last five years, the income stream recording the overall strongest growth for all universities is fees and charges.
The graph below presents the aggregated income streams for all NSW universities from 2015 to 2019.
Source: University financial statements (audited).
In October 2019, the Australian Government announced that funding for bachelor level places from 2020 will grow in line with population growth in the 18 to 64 year-old age bracket, with universities able to access this funding if they meet specified performance requirements.
Performance will be assessed across four measures: graduate employment outcomes, student success, student experience, and participation of Indigenous, low socio-economic status, and regional and remote students. Graduate employment outcomes will account for 40.0 per cent of funding, with the other three measures weighted at 20.0 per cent each.
Performance-based funding is intended to ensure universities focus sufficient attention on the quality of their teaching, and student support to ultimately achieve the best possible graduate outcomes.
On 12 April 2020, as part of the Higher Education Relief Package announced by the Australian Government to help universities and other tertiary education providers respond to the challenges presented by COVID-19, the performance-based funding amounts were guaranteed for 2020.
Government grants for NSW universities have increased by $199 million over the past five years to total $3.6 billion in 2019. Despite this, total government grants as a proportion of the total income of NSW universities has steadily reduced.
The major components of NSW universities' total income over the past five years are detailed below.
The following graph shows major income streams by university for 2019.
Two regional universities, the University of New England and the University of Newcastle, received more than 40 per cent of their total income from government grants.
In response to the CGS funding cap, most universities increased student revenue through targeted student recruitment campaigns, broadening their geographic focus, and offering more courses overseas.
In the current year, the change in income from government grants at individual universities varied from a decrease of 4.0 per cent to an increase of 13.4 per cent. Between 2015 and 2019, income from government grants increased by 5.9 per cent.
Total revenue from fees and charges, including Higher Education Loan Programs, increased by 8.2 per cent in 2019 from last year. Four universities experienced a growth in revenue from fees and charges of more than ten per cent over that time. Over the past five years, revenue from fees and charges increased by 48.8 per cent.
The graph below shows the growth in fees and charges revenue by university over the past five years.
NSW universities' total course fee revenue from overseas students continued to grow and exceed the total course fee revenue from domestic students in 2019 by 66.7 per cent. The increase was due to growth in both the numbers of overseas students and the fees from courses in which they are enrolled.
Overseas student course fees increased for all but one NSW university in 2019, and represented 31.6 per cent of the combined total revenue (30.3 per cent in 2018). The dollar value increased by $381 million (11.8 per cent) from the previous year to $3.6 billion in 2019.
Total revenue from domestic students increased by $92.3 million (2.2 per cent) in 2019. The lower growth rate in fees from domestic student revenue is consistent with the Australian Department of Education and Training’s approved fee increases for Commonwealth Supported Places.
NSW universities' overseas and domestic student course fee revenue for 2015 to 2019 is presented in the following graph.
The graph below shows individual universities' revenue in 2019 from overseas and domestic students. Income from overseas students exceeds that from domestic students at three universities (two in 2018). These were the University of New South Wales, the University of Sydney and the University of Wollongong.
In 2019, overseas students contributed $3.7 billion in course fees to the NSW university sector. Students from the top three countries of origin contributed $2.4 billion in fees, which closely approximates the NSW universities' total revenue from domestic students for 2019. Revenue from students from these three countries comprised 40.9 per cent of total student revenues for all NSW universities and 65.4 per cent of total overseas student revenues in 2019.
As we have reported previously, the universities that are most dependent on revenue from students from these three countries are at risk from unexpected shifts in demand. Demand for education can change rapidly due to changes in the geo-political or geo-economic landscape, or restrictions over visas or travel.
The consequence of the reliance on students from particular countries emerged as travel restrictions were implemented following the outbreak of COVID-19 in early 2020. The challenges presented by COVID-19 to NSW universities in 2020 are discussed at the end of this chapter.
The graph below shows NSW universities' revenue in 2019 from overseas and domestic student fees.
The countries of origin of overseas students enrolled at NSW universities are set out below. All universities continue to market their educational products in international markets, focusing on countries in Asia. While the countries of origin of overseas students have diversified, a concentration risk remains. Over 42 per cent of all overseas students attending NSW universities come from China, but not all universities are dependent on students from China. Enrolments of students from India and Nepal have increased. Four universities receive the greatest proportion of fees from overseas students from these countries.
The highest proportion of overseas student revenue sourced from a single country at individual NSW universities ranged from 24 to 75 per cent (2018: 24 per cent to 74 per cent). The graph below illustrates the relative reliance of each NSW university on a single country for their overseas student revenue.
NSW universities' total research income increased by $195 million (19.1 per cent) in the five years between 2014 and 2018 from $1.0 billion to $1.2 billion. Research income statistics for 2019 will be available from the Australian Department of Education and Training after July 2020.
Two universities attracted 65.2 per cent of the total research income of all NSW universities as shown in the graph below.
The Australian Research Council announced the introduction of the 'national interest test' in November 2018. This requires researchers to outline how their research project will advance the interests of Australia. NSW universities have built on existing strategies and processes to address the new 'national interest test' when applying for Australian Research Council grants from 2019.
Other revenues
NSW universities and many of their controlled entities are charities and are registered deductible gift recipients for taxation purposes. They can attract significant donations and bequests from public, private and corporate philanthropists. Some bequests received are tied to specific research activities and cannot be used for other purposes.
The University of Sydney and the University of New South Wales attracted 69.5 per cent of the total philanthropic contributions to the NSW universities in 2019. The newer, smaller universities and non-metropolitan universities have been least able to attract donations.
The graph below presents the donations revenue received by each of the NSW universities in 2019.
Operating expenditure
Managing expenditure and optimising cost efficiencies are important for NSW universities so they can operate in a competitive environment with less direct government support in the form of grants.
We have defined operating expenditure in this report as total expenses excluding interest, tax, depreciation, amortisation, impairment of assets and loss on disposal of assets. Operating revenue is defined as total revenue excluding investment income, donations and gains on disposal of assets.
The graph below shows key components of operating expenditure over the past five years for NSW universities.
Combined total operating expenditure for NSW universities increased to $9.9 billion in 2019 ($9.4 billion in 2018), a rise of 5.2 per cent. Across the board, employee-related expenses at universities are a significant contributor to total operating expenditure and has grown by 6.9 per cent in 2019 from the previous year.
Over the last year, the average increase in scholarships and grant expenses grew by 7.5 per cent. Other operating expenses grew by 1.4 per cent.
The graph below shows the key components of operating expenditure for each university in 2019.
Employee related expenses represent the major portion of expenses at each university and ranged from 55.9 per cent to 66.5 per cent of the total operating expenditure.
Operating margin percentage
A university's operating margin percentage is its operating result divided by operating revenue. Operating result is operating revenue minus operating expenditure. We have defined the components of operating revenue and operating expenditure earlier in this report.
For five NSW universities, the operating margin percentage change was negative in 2019. For most of these universities, the decrease was due to the higher employee-related expenses. The risk associated with narrowing operating margins is compounded where universities have a high reliance on student revenues from a single source. Sudden changes in demand can challenge the ability of those universities to adjust their cost structures.
The operating margin for each university in 2019 is shown below. This graph should be read in conjunction with the one on page 7 showing net results for comparison.
Current ratio
The current ratio is a liquidity measure that indicates an entity's ability to meet short-term obligations as and when they fall due. A ratio of less than one indicates that current liabilities exceed current assets.
High current ratios mean individual universities may have opportunities to utilise surplus cash to optimise their income from investments. Low current ratios mean those universities need to actively manage their cash to meet current obligations.
Universities may have investments and term deposits which, because of maturity dates are disclosed as non-current assets. While less liquid, these funds can, if required, be drawn upon to meet obligations.
At 31 December 2019, five NSW universities (one university in 2018) had a current ratio of less than one.
The current ratio for each university for 2019 is shown below.
Controlled entities
While some universities have started to streamline and reduce the number of their controlled entities to contain administrative and compliance costs, others have established new entities to expand their operations overseas or commence new business activities. NSW universities created ten new controlled entities and deregistered eight entities in 2019, resulting in two new controlled entities this year overall.
Out of 76 controlled entities, 26 entities reported losses in 2019 (33 in 2018). There were 11 dormant entities in 2019, including corporate trustees that do not trade and entities that have ceased to operate due to business rationalisation.
Twenty-three of the NSW universities' controlled entities required letters of financial support from their parent in 2018 (18 in 2017).
The table below details the number of NSW universities' controlled entities.
University at 31 December 2019 | Total number of controlled entities | Number of dormant entities | Number of overseas controlled entities |
Charles Sturt University | 2 | -- | -- |
Macquarie University | 13 | 8 | 1 |
Southern Cross University | 1 | -- | -- |
University of New England | 5 | -- | -- |
University of NSW | 19 | 1 | 9 |
University of Newcastle | 2 | -- | 1 |
University of Sydney | 4 | -- | 1 |
University of Technology Sydney | 10 | -- | 5 |
University of Wollongong | 13 | 1 | 8 |
Western Sydney University | 7 | 1 | -- |
Total | 76 | 11 | 25 |
Recommendation (repeat issue)
NSW universities should strengthen their governance arrangements to oversight their overseas controlled entities' legal and policy compliance functions.
Five of the six NSW universities with overseas controlled entities reported that they are responding to this recommendation, which we included in last year's Report to Parliament.
One university reported that it did not action the recommendation because it believes that current governance arrangements are adequate.
Five of the six universities reported that they have devolved responsibility for governance and legislative compliance to their overseas controlled entities. Only three of the six universities are reporting compliance risks at the overseas controlled entities to the university's audit and risk committee. There are some overseas controlled entities that do not have, as yet, their own compliance framework and registers.
Without adequate monitoring of compliance risks, the universities may be exposed to regulatory breaches that may impact their reputation or ability to operate overseas. Although risks may change between jurisdictions, the parent university is best placed to ensure their overseas controlled entities consider and mitigate risks on a consistent basis.
COVID-19 impacts and responses
The COVID-19 pandemic is presenting, and will continue to present unprecedented challenges for the university sector. Travel restrictions have reduced enrolments. Social distancing and other infection control measures have disrupted the traditional means of teaching students and impacted other aspects of service delivery such as student accommodation. These disruptions may significantly impact the financial results of NSW universities in 2020.
As reported above, government grants have decreased as a proportion of total income of NSW universities over the past five years. Revenue from fees and charges increased by 49.1 per cent over the same period, with course fee revenue from overseas students growing much faster than that from domestic students. Overseas students contributed $3.7 billion in course fees alone to the NSW university sector in 2019.
Revenue from overseas students from the top three countries of origin comprised 38.2 per cent of total student revenues for all NSW universities and 65.4 per cent of total revenues from students from all overseas countries in 2019. As we have reported previously, the universities that are most dependent on revenue from overseas students from single countries of origin are most at risk from demand shifts. The consequence of the reliance emerged as travel restrictions were implemented in early 2020 following the outbreak of COVID-19. International students due to arrive and study in Australia in semester one of 2020 were increasingly unable to do so as international lockdowns were put in place.
The graph below shows total student enrolments at NSW universities for semester one 2020 versus budgeted student enrolments for both graduate and post graduate courses.
Total student enrolments at NSW universities for semester one 2020 were 129,265 against an expectation of 137,274, a shortfall of 8,009 or 5.8 per cent overall. Shortfalls in the Equivalent Full-Time Student Load (EFTSL) means revenue from fees and services will fall. EFTSL represents the equivalent full-time study load for one year.
Enrolments of domestic fee paying and Commonwealth supported students totalled 93,747 against an expectation of 96,070, a shortfall of 2,323 or 2.4 per cent. Data from NSW universities shows that the average annual fee revenue received per EFTSL domestic student enrolled in 2019 was $10,038.
Actual overseas student enrolments at NSW universities for semester one 2020 were 35,518 against an expectation of 41,204, a shortfall of 5,686 or 13.8 per cent. Data from NSW universities shows that the average annual fee revenue received per EFTSL overseas student enrolled in 2019 was $31,444.
The graph below shows actual overseas student enrolments at NSW universities for semester one 2020 versus budgeted student enrolments.
The projected financial impact of changes in future overseas and domestic student demand is being modelled by universities. Scenarios for the current and future years are being developed based on when travel restrictions and other containment measures might be lifted and the potential for both domestic student enrolments to be impacted.
All NSW universities have established committees or taskforces of senior executives to oversee and address all aspects of the impact of COVID-19. These committees are tasked with assessing the evolving situation and determining their university’s response to it.
Key actions taken by NSW Universities in response to the outbreak of COVID-19 include:
- establishing dedicated phone and email channels for staff and student enquiries
- developing alternative course delivery options including on-line delivery of teaching
- updating cleaning protocols with increased frequency and providing information on hygiene measures
- moving some administration activities to remote delivery and closing some buildings and facilities
- reconfiguring student accommodation to enable students to quarantine or socially distance, where necessary
- implementing programs and financial support for support students who are adversely impacted
- cancelling large non-essential gatherings including graduation ceremonies.
Universities are also closely monitoring the financial impact of COVID-19 and the pressure put on liquidity. NSW universities have implemented cost saving measures including reducing the casual and contractor workforce, delaying the hire of new staff, eliminating travel, and pausing other discretionary expenditure. They are also closely monitoring liquidity requirements and have deferred planned capital expenditures and renegotiated lines of credit.
On 12 April 2020, the Australian Government announced a Higher Education Relief Package intended to help universities and other tertiary education providers respond to the challenges presented by COVID-19.
Under the package, the Australian Government guaranteed CGS and the Higher Education Loan Program (HELP) funding streams for higher education providers at their current levels for the rest of 2020, even if domestic student numbers fall. Ordinarily, the amount of funding provided would be revised throughout the year based on variations to enrolments. Also, the performance-based funding amounts introduced in 2020 would be guaranteed for the current year.
The package also aimed to provide a revenue stream for universities by discounting the cost of short on-line courses to help Australians retrain. The courses, targeted at priority areas including nursing, teaching, health, IT and science, will start at the beginning of May 2020 and will run for an initial period of six months.
For domestic students, it was announced that there would be a six-month exemption from the loan fees associated with FEE-HELP and Vocational Fee and Training (VET) student loans in the sector to encourage full-fee paying students to continue their studies.
3. Internal controls
Appropriate and robust internal controls help reduce risks associated with managing finances, compliance and administration of NSW universities.
This chapter outlines the internal controls related observations and insights across NSW universities for 2019, including overall trends in findings, level of risk and implications.
Our audits do not review all aspects of internal controls and governance every year. The more significant issues and risks are included in this chapter. These along with the less significant ones are reported to universities for them to address.
3.1 Internal controls
Internal control findings
Our audits identified 108 internal control deficiencies (99 in 2018) at NSW universities of which 35 were repeated from the previous year. Information technology (IT) deficiencies accounted for 48 of the findings. Universities increasingly rely on IT for efficient and effective delivery of services, as well as for their financial processes and internal and external financial reporting. While IT delivers considerable benefits, increasing reliance on IT systems with known vulnerabilities presents additional risks that NSW universities need to address.
The graphs below describe the spread of management letter findings by risk rating across four key areas.
The table below shows the level of risks on the management letter findings by university for 2019.
Management letter findings 2019 | ||||
University | High | Moderate | Low | Repeat |
Charles Sturt University | -- | 4 | 2 | 4 |
Macquarie University | -- | 6 | 4 | -- |
Southern Cross University | -- | 4 | 2 | 4 |
University of New England | -- | 8 | 5 | 9 |
University of New South Wales | 1 | 5 | 5 | 4 |
University of Newcastle | -- | 3 | 7 | 3 |
University of Sydney | -- | 11 | 9 | 5 |
University of Technology Sydney | -- | 3 | 3 | 3 |
University of Wollongong | -- | 12 | 12 | 3 |
Western Sydney University | -- | -- | 2 | -- |
The high risk finding related to the University of New South Wales. The University identified that correct payment rates had not been consistently applied to casual academic staff in some cases. The absence of effective financial controls, which may have prevented the need to provide for a potential underpayment of casual staff salaries, related to:
- processes to sufficiently capture the actual time and services performed by casual academic staff, including ensuring changes to hours or services were reflected in the payroll system
- a lack of formal subsequent review to identify if casual academic staff payments aligned with teaching loads assigned.
Extended audit procedures were performed to conclude that the control deficiencies did not present a risk of material misstatement to the university's financial statements at 31 December 2019.
A summary of moderate risk control deficiencies identified in 2019 is set out below.
Areas | No. of moderate risk control deficiencies | Summary of the control deficiencies |
Information technology | 31 |
IT control deficiencies included:
Poor IT controls increase the risk of inappropriate access, cyber security attacks, data manipulation and misuse of information and assets. |
Financial controls | 12 |
Financial control deficiencies included:
Financial control weaknesses increase the risk of error or fraud in transactions that may result in financial loss to the university or misstatement in financial statements. |
Policies and procedures | 2 |
Deficiencies around policies and procedures included:
|
Financial reporting | 11 |
Financial reporting deficiencies included:
These increase the risk that the financial statements will be materially misstated or require correction in subsequent years. |
Total | 56 |
There were 35 repeat findings (38 in 2018) identified in 2019. Repeat findings arise when the university has not implemented recommendations from previous audits. Eighteen repeat findings related to IT control deficiencies. Universities have agreed to prepare implementation plans to address these repeat issues.
IT issues can take some time to rectify because specialist skill and/or partnering with software suppliers is required to implement appropriate controls. Changes to complex systems or IT architecture may involve extensive testing and assessment before they are put into production. However, until rectified, the vulnerabilities those control deficiencies present can be significant.
The graph below shows the spread of repeat findings by area of focus and risk rating.
Performance reporting
Annual reporting by the universities is one of the key elements of a good governance framework. Making timely and accurate disclosures is an integral part of the universities' corporate responsibility.
Recommendation (repeat)
NSW universities should strengthen processes to review and validate published performance information.
Whilst the NSW universities internally validate the performance information in their annual reports, there is generally no independent assurance on the validity and accuracy of the reported performance metrics.
Three universities either engaged their internal auditors or external experts to provide assurance on the validity and accuracy of their reported performance metrics.
Seven universities have documented policies and procedures to support consistent and reliable collection of performance information for the annual report. However, these did not all include a methodology for review and validation of the information.
3.2 Information technology
Cyber security
Cyber threats are becoming increasingly common and sophisticated as the global interconnectivity between computer networks has increased.
Cyber security comprises technologies, processes and controls that are designed to protect IT systems and sensitive data from cyber attacks. The cyber security framework consists of threat identification, protection, detection, response and recovery of IT systems.
Cyber incidents can harm universities' service delivery and may involve:
- theft of information such as intellectual property or sensitive personal data
- denial of access to critical technology
- hijacking of systems for profit or malicious intent
- financial losses.
Recommendation (repeat)
NSW universities should strengthen cyber security frameworks and controls to protect sensitive data and prevent financial and reputational losses.
The trend in adoption of common cyber security controls at NSW universities is detailed below.
Cyber security control | Number of universities in 2019 | Number of universities in 2018 | Trend |
Implemented a cyber risk policy | 8 | 8 | |
Maintained a cyber incidents register | 9 | 7 | |
Assessed the potential financial and/or operational impact of cyber attacks | 8 | 7 | |
Established a recovery plan following a cyber attack | 10 | 8 | |
Staff are formally trained in cyber awareness | 7 | 6 | |
Tested cyber resilience during the past year | 6 | 5 |
The number of cyber incidents recorded in 2019 by the seven universities ranged from two to 982.
The disparity in the number of recorded incidents is because:
- there are different definitions of what a 'cyber incident' is
- some registers include intercepted or blocked attempts, while others do not.
On average, universities incurred $4.6 million in costs in managing cyber security in 2019 ($4.0 million in 2018).
The Australian Cyber Security Centre (ACSC) has published mitigation strategies and recommended controls for protecting against cyber threats. This set of controls is referred to as the 'Essential Eight'. Some of these controls are not expensive to implement, yet provide important protections. Whilst universities are not required to adopt these controls, some aspects of the Essential Eight have been implemented at some NSW universities.
ACSC Essential Eight mitigation strategies | Number of universities that apply |
1. Application whitelisting All non-approved applications (including malicious code) are prevented from executing. |
5 |
2. Check and apply security patches Security vulnerabilities in applications can be used to execute malicious code on systems. |
8 |
3. Configure Microsoft Office macro settings Microsoft Office macros can be used to deliver and execute malicious code on systems. |
5 |
4. User application hardening Flash, ads and Java are popular ways to deliver and execute malicious code on systems. |
3 |
5. Restrict / review administrative privileges Administrative user accounts have extensive access to systems and may be compromised. |
9 |
6. Patch operating systems Security vulnerabilities in operating systems can be used to further the compromise of systems. |
10 |
7. Multifactor authentication Stronger user authentication makes it harder for external parties to access sensitive information and systems. |
9 |
8. Daily backups and test for restoration Ensure information can be accessed again following a cyber security incident. |
10 |
Our 2018 performance audit report on Detecting and Responding to Cyber Security Incidents includes several findings that may be useful for universities to enhance their controls around cyber security risks.
Management of IT service providers
All NSW universities have IT vendor contracts for major systems and business applications such as finance, student management, payroll and procurement.
Some universities contracted the deliver and maintenance of certain IT services to external providers. These services include:
- hosting business applications such as finance, student management, payroll and procurement
- communications software
- network infrastructure
- data warehouse facilities
- website hosting and support.
Universities manage their IT service providers through a general contract management framework or an IT vendor framework or specific IT vendor contract management plans.
Significant gaps in the NSW universities' contract management were identified as noted below.
Significant gaps | Number of universities in 2019 | Number of universities in 2018 | Trend |
Contract management plan in place | 7 | 6 | |
Risk assessment performed | 4 | 3 | |
Service level agreement specifies key performance indicators | 9 | 8 | |
Vendor contract includes provision for review by independent auditors | 7 | 6 | |
Vendor phase out plan in place | 5 | 4 | |
Vendor contract contains clauses to deal with transition of services back in-house or to a new provider | 5 | 6 | |
Contract includes performance - based payments or penalties for under performance | 6 | 7 |
Data breach management
Universities maintain various types of sensitive data that are covered by privacy legislation or confidentiality agreements, such as personal information, academic records, and intellectual property.
The Privacy and Personal Information Protection Act 1998 (NSW) requires universities to abide by principles that cover the security of personal information and restrictions on use and disclosure of that information.
In addition, NSW universities teaching students from European Union countries may be required to comply with the European Union's General Data Protection Regulation (GDPR) which commenced on 25 May 2018.
NSW universities may be exposed to risks from data breaches resulting in:
- risk to students and or employees' safety or identity theft
- financial loss to an individual or the university
- loss of intellectual property or commercially sensitive data
- reputational damage and loss of public trust for the university.
Six NSW universities have implemented staff training on data protection and breach management.
Two NSW universities have not analysed the risks of data breach management and have not developed a formal policy on data breach management.
The Office of the Australian Information Commissioner (OAIC) and the NSW Information and Privacy Commission (IPC) have published guidance and resources for developing plans and policies to comply with privacy laws and voluntary data breach reporting requirements.
The OAIC recommends a data breach response plan should include:
- clear definition of what constitutes a breach
- a strategy for containing, assessing and managing data breaches
- roles and responsibilities of staff
- notification and reporting procedures to internal and external bodies.
Eight NSW universities recorded and reported the number of data breach incidents in 2019 that ranged from nil to 12. The cause of data breaches was generally from human error, system fault, or malicious attack.
Five NSW universities maintain a full or partial register of data that is managed by third party service providers, an improvement on two reported in 2018. Universities that have not assessed the data held by their service providers may be at greater risk of data breaches.
3.3 Procurement
Universities spend substantial funds each year to procure goods and services. It is important there is appropriate probity, accountability and transparency in procurement to reduce the risk of unauthorised purchases, corrupt and fraudulent behaviour and sub-optimal value for money outcomes.
Our audits identified:
- all NSW universities maintained a procurement policy, however five have not revised their policy since 2017 and in one case since 2014
- 8 universities have a documented procurement manual
- 8 universities provide training to staff with procurement responsibilities.
We selected a contract over $150,000 for each university to assess procurement practices. We observed the following encouraging better practice outcomes:
Procurement practices | Number of universities |
Tender evaluation panel members with complete conflict of interest declarations | 9 |
Tenderers disclosed conflicts of interest as part of the tender process | 10 |
Evidence recorded on file to support the tender process | 10 |
Universities enter into numerous contracts which vary in nature, size and complexity.
Our audits identified:
- 7 universities have a contract management policy
- 6 universities maintain a centralised contract register.
The table below summarises our findings for university contract management practices based on the same selection of contracts over $150,000 for each university.
Contract management | Number of universities |
No contract management plan | 3 |
No risk assessment performed before entering into significant contracts | 2 |
No key performance indicators to measure the contract performance | 1 |
Contract payments are not linked to satisfactory contract performance | 2 |
Contract not entered into the contract register in a timely manner |
1 |
Recommendation
NSW universities should review their procurement and contract management policies and procedures to ensure that they are relevant and effective in reducing risk and improving purchasing outcomes
3.4 COVID-19 impacts and responses
The COVID-19 pandemic is significantly impacting the operations of NSW universities in 2020. As well as the immediate impacts to the welfare of students and staff and the financial implications, universities will also need to consider the impact of the pandemic on their governance arrangements, internal controls, risks and regulatory requirements.
Where there have been changes to operating models, such as a move to remote working environments and service delivery, universities will need to adapt systems, policies and procedures to the new arrangements. Existing controls may no longer be effective and new, alternative controls may need to be designed and implemented to enable routine checks and balances.
A significant number of remotely connected employees for an extended period increases digital traffic and this may strain a university’s IT infrastructure. It is also important to ensure network connections are secure to minimise the data protection risk associated with communicating through mobile applications.
Universities should be alert to the increased risks of fraud and corruption arising from the COVID-19 situation, in relation to the following:
- remote working environments – where there is less manager-employee and peer-to-peer interaction that normally takes place in an office environment
- procurement and purchasing – there may be increased pressure to:
- engage in emergency procurement
- agree to contract variations
- use direct negotiations and other exemptions to competitive procurement processes
- pay suppliers quickly, especially if they are small businesses
- accept on-line requests for changes to masterfile data
- rely on staff to purchase items using agency-issued purchasing cards
- cyber fraud – in an environment where many staff are working remotely and normal face-to-face interactions are limited, socially engineered cyber frauds are more likely to succeed and less likely to be detected quickly. In addition, the COVID-19 pandemic has prompted a number of criminals to impersonate government agencies as part of an attempt to defraud citizens.
4. Teaching and research
Universities' primary objectives are teaching and research. They invest most of their resources to achieve quality outcomes in academia and student experience. Universities have committed to achieving certain government targets and compete to advance their reputation and international and Australian rankings.
This chapter outlines teaching and research outcomes for NSW universities for 2019.
4.1 Teaching outcomes
Graduate employment rates
Universities assess the employment outcomes of their graduates by using data published by surveys conducted by the Australian Department of Education and Training's providers.
According to the 2019 survey, eight out of ten NSW universities (eight in 2018) exceeded the national average of 72.5 per cent for full-time employment rates of their undergraduates. This index decreased from 72.9 per cent in 2018 and includes employment outcomes from other tertiary education institutions such as TAFE and colleges that provide other vocational education and training qualifications.
Six universities (seven in 2018) performed better than the national average of 86.2 per cent for full-time employment outcomes of their postgraduates. The postgraduate national average decreased from 86.9 per cent from 2018.
The graph below presents the results of the 2019 survey.
Student enrolments by field of education
The highest increases in student enrolments at NSW universities were in:
- Management and Commerce courses, with an additional 4,924 equivalent full-time students from 2018 (8.3 per cent)
- IT, Engineering and Related Technologies courses, with an additional 3,525 equivalent full-time students from 2018 (7.7 per cent)
- Health courses, with an additional 3,024 equivalent full-time students from 2018 (7.8 per cent).
The graph below shows the movement in student enrolments by field of education.
The increase in Management and Commerce, IT, Engineering and Related Technologies and Health enrolments was due to growing demand particularly from overseas students.
Achieving diversity outcomes
In 2009, the Australian Government set a target for 20 per cent of university undergraduate enrolments to be students from low socio-economic status (SES) backgrounds by 2020.
In March 2017, all Australian universities committed to achieving growth rates for enrolments of Aboriginal or Torres Strait Islander students to exceed the growth rate of enrolments of non-indigenous students by at least 50 per cent.
The 2018 results for NSW universities showed:
- 5 universities (five in 2017) achieved enrolments of more than 20 per cent of domestic undergraduate students from low SES backgrounds
- 8 universities achieved increased enrolments of students from Aboriginal and Torres Strait Islander backgrounds (nine in 2017).
Enrolment statistics for 2019 are not expected to be available from the Australian Department of Education and Training until July 2020.
NSW universities can continue to improve outcomes for these students by consistently setting targets, tracking achievement against those targets, implementing policies to increase enrolments and supporting students to graduation.
NSW universities reported increases in the number of low SES domestic undergraduate student enrolments from 39,923 in 2017 to 40,082 in 2018. Overall university student enrolments in NSW marginally decreased in the same period from 299,117 in 2017 to 298,978 in 2018.
Actual enrolments of domestic undergraduate students from low SES backgrounds in 2018 for NSW universities as a percentage of total domestic undergraduate students are shown in the table below.
NSW universities increased the overall number of indigenous student enrolments in 2018 by 159, taking the total number to number of indigenous student enrolments in 2018 to 6,415. This represents a growth of 2.5 per cent since 2017. Overall non-indigenous student enrolments in NSW marginally decreased in the same period from 292,861 in 2017 to 292,563 in 2018. Consequently, the target growth rates for enrolments of Aboriginal or Torres Strait Islander students to exceed the growth rate of enrolments of non-indigenous students by at least 50 per cent was achieved in 2018.
The indigenous student enrolments for 2018 by university is shown below, together with the change in indigenous student enrolments since 2017.
Appendices
Appendix one – List of 2019 recommendations
Appendix two – Status of 2018 recommendations
Appendix three – NSW universities’ controlled entities and associated entities
Copyright notice
© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.