Universities 2021

Report highlights

What the report is about

Results of the financial statement audits of the public universities in NSW for the year ended 31 December 2021.

What we found

Financial reporting

Unmodified audit opinions were issued for all ten universities.

The University of Wollongong reported the retrospective correction of a prior period error relating to a $169 million contract termination liability.

All universities reported positive net results in 2021 (four in 2020) and each showed improvement from 2020. This was mainly due to expenditure decreasing by a combined $644 million (5.8%) from 2020. Universities implemented redundancy programs in response to the COVID-19 pandemic, which resulted in a decrease of nearly 2,300 full-time equivalent staff in 2021.

All universities held an investment in Education Australia Limited, which paid to its shareholders a fully franked dividend comprising cash and shares in IDP Education Limited. This increased the combined investment revenues of the universities by $515 million in 2021. However, it affected each university's net result differently depending on elections made in their historical accounting treatment.

Government grants increased by $442 million from 2020, of which $297 million related to the Commonwealth's 2021 additional Research Support Program funding to the NSW universities which was a COVID-19 support measure to the sector.

Over 43% of universities' course fees revenue comes from three countries (39% in 2020). Students from China now represent over half of all overseas student enrolments. A high level of reliance on student revenue from a single country poses a concentration risk for universities.

Internal controls

We reported 105 findings to universities on internal control deficiencies (110 in 2020).

Four high-risk findings were identified (three in 2020), relating to:

  • the status of one university's work in assessing its liability for underpayment of staff
  • IT control deficiencies over privileged user access
  • control deficiencies that resulted in non-recognition of a liability in one university's prior year's financial statements
  • a detailed review of payroll compliance for casual staff, which remains outstanding at one university.

There were 45 repeat findings of control deficiencies in 2021 (45 in 2020). 

All universities have drafted or implemented a cybersecurity policy and established a governance committee accountable for cybersecurity. However, improvements could be made in:

  • recording and monitoring of attempted cyber incidents
  • assessing cyber risks relating to IT vendors
  • implementation of cybersecurity control measures for key systems. 

Four out of 13 entities experienced a significant cyber incident during 2021. 

What we recommended

  • Universities should prioritise actions to address repeat findings on internal control deficiencies, particularly where the issue has been repeated for a number of years.
  • Universities and controlled entities should prioritise improvements to their cybersecurity and resilience.

Fast facts

There are ten public universities in NSW, with 52 controlled entities in Australia and 22 overseas controlled entities.

  • $12b total combined adjusted revenue in 2021, an increase of $1.1 billion (10.5%) from 2020
  • $10.4b total combined expenditure in 2021, a decrease of $644 million (5.8%) from 2020
  • 79,134 overseas student enrolments in 2021, a decrease of 3,138 students (3.8%) from 2020
  • 209,018 domestic student enrolments in 2021, an increase of 1,622 students (0.8%) from 2020
  • 4 high-risk management letter findings were identified (3 in 2020) 
  • 43% of reported issues were repeat issues. 

1. Introduction

This report provides Parliament with the results of our financial audits of universities in New South Wales and their controlled entities in 2021, including our analysis, observations and recommendations in the following areas:

  • financial reporting
  • internal controls and governance
  • teaching and research.

1.1 Snapshot of NSW universities

* Of the 23 entities not audited, 22 were relieved from reporting requirements and one entity did not comply with requirements to provide financial
statements to the Audit Office of NSW. Further details are in section 2.1 of this report.
** Equivalent Full-Time Student Load (EFTSL) represents the equivalent full-time study load for one year.
*** Full-Time Equivalent.
Source: Student and staff numbers are provided by universities (unaudited).

2. Financial reporting

Financial reporting is an important element of governance. Confidence and transparency in university sector decision-making are enhanced when financial reporting is accurate and timely.

This chapter outlines our audit observations on the financial reporting of universities in NSW for 2021.

Section highlights
  • The 2021 financial statements of all ten universities received unmodified audit opinions.
  • All universities reported positive net results in 2021 and all showed improvement from 2020 results.
  • The change in universities' investments in Education Australia Limited resulted in a combined increase of $515 million in investment revenue. However, it affected each university's net result differently depending on elections made in their historical accounting treatment.
  • Forty-three per cent of universities' course fees revenue comes from three countries (up from 39% in 2020). Students from China now represent over half of all overseas student enrolments.

2.1 Quality of financial reporting

Audit results

Unmodified audit opinions were issued for all universities

The 2021 financial statements of all ten universities received unmodified audit opinions for the purposes of satisfying the requirements of the Government Sector Finance Act 2018 (GSF Act).

The University of Wollongong reported retrospective correction of a prior period error

The University of Wollongong reported the retrospective correction of a prior period error relating to contract termination costs of $169 million. Although the costs were paid in 2021, the liability to pay the costs arose in the previous year when the University of Wollongong terminated the contract. The costs and the liability should have been recognised in the financial statements for the year ended 31 December 2020.

All completed audits of university controlled entities' financial statements resulted in unmodified audit opinions

Of the 74 university controlled entities:

  • 48 received unmodified audit opinions
  • 22 university controlled entities were relieved from GSF Act reporting requirements
  • 1 did not comply with the GSF Act as it did not submit financial statements to the Audit Office (Suzhou Xi Su Commercial Consulting Co. Ltd)
  • the audits of three entities are still in progress.

Suzhou Xi Su Commercial Consulting Co. Ltd, an overseas controlled entity of the University of Sydney, did not submit separate financial statements for audit as required by the GSF Act. The company only prepares financial statements for local jurisdictional purposes. The non-compliance was reported in the Statutory Audit Report for the University of Sydney.

Twenty-two university controlled entities were exempted from preparing financial statements in 2021

Division 2 of the Government Sector Finance Regulation 2018 excludes certain entities from having to prepare financial statements under the GSF Act if all of the following criteria are met:

  • the assets, liabilities, income, expenses, commitments and contingent liabilities of the entity are each less than $5 million
  • the total cash or cash equivalents held by the entity is less than $2.5 million
  • at least 95% of the entity’s income is derived from money paid out of the Consolidated Fund or from money provided by other relevant agencies
  • the entity does not administer legislation for a minister by or under which members of the public are regulated.

As a result of the provisions, 22 university controlled entities were exempted from GSF Act reporting requirements in 2021 (22 in 2020). Entities that are exempted from financial reporting obligations are not audited by the Auditor-General.

Quality and timeliness of financial reporting

Misstatements in financial statements increased in 2021

Across the sector, this year we identified more monetary misstatements in the financial statements submitted for audit than in the previous year. A monetary misstatement is an error in amount recognised in the financial statements initially submitted for audit.

Reported corrected misstatements increased to 20 in 2021 (17 in 2020). Reported uncorrected misstatements increased to 18 in 2021 (nine in 2020).

The table below shows the number and quantum of monetary misstatements identified in universities' financial statements for 2021 and 2020. 

Year ended 31 December 2021 2020
  Corrected
misstatements
Uncorrected
misstatements
Corrected
misstatements
Uncorrected
misstatements
Less than $1 million 4 10 -- 3
$1 million to $4,999,999 6 7 3 2
$5 million to $9,999,999 3 1 2 3
$10 million to $19,999,999 4 -- 8 1
Over $20 million 3 -- 4 --
Total number of
misstatements
↑ 20 18 17 9

Note: Corrected misstatements include retrospective correction of errors in the prior period.
Source: Statutory Audit Reports issued by the Audit Office.

One university did not meet the statutory timeframe for submitting draft financial statements for audit

The statutory deadline for submitting draft financial statements for audit within six weeks of the year end date was not met by one university (the University of New England), which submitted its financial statements six days late. The Treasurer's Direction TD 21-03 'Submission of Annual GSF Financial Statements to the Auditor-General' issued on 16 June 2021 requires GSF Agencies to provide their draft financial statements within six weeks following the end of the annual reporting period concerned.

Five universities finalised their 2021 audited financial statements later than they did last year

Unlike the former Public Finance and Audit Act 1983, the Government Sector Audit Act 1983 does not set a fixed statutory timeframe for completion of audits but defines the 'relevant auditing period' as the period specified by the GSF Act or the Treasurer's Directions. There are currently no Treasurer's Directions mandating a statutory deadline for the Auditor-General to issue audit reports.

Our audit opinions on universities' financial statements for 2021 were issued between 24 March 2022 and 28 April 2022. Audit completion dates are presented in the following diagram. 

comparison of the completion date for audits in 2021 and 2022 for NSW universities. For an accessible version, please email communications@audit.nsw.gov.au
Audit completion dates
Source: Independent Auditor's Reports issued by the Audit Office.

Common accounting issues

Universities reported different results when accounting for change in investment in Education Australia Limited

All Australian universities owned equal shares in Education Australia Limited (EAL). EAL was set up by the Australian universities in 1999 with each university contributing $10,000 in capital to the company. Trading in shares in EAL is restricted as EAL is not publicly listed entity. However, its primary asset was a 40% shareholding in IDP Education Limited (IDP), a company that provides education services, which is listed on the Australian Stock Exchange. Since EAL was established and acquired its interest in IDP, that investment has grown in value. In 2021, EAL:

  • sold a 15% shareholding in IDP and paid the sale proceeds to the universities as cash and franking credits receivable
  • transferred its remaining 25% shareholding in IDP to the universities as an in-specie distribution. Each university now directly owns its shares in IDP.

Following the in-specie distribution and the payment of dividends, the value of EAL fell and the universities impaired their investment in the company. However, at the conclusion of the transaction each university had made $33 million on their original investment, including franking credits of $25 million on the dividend payments.

The universities adopted different accounting treatments, depending on whether they had previously formally designated their investment in EAL as held for trading, or held as an investment. The designation, which is required under Australian Accounting Standards, determines whether fair value gains and losses are taken through profit or loss (FVTPL) or through other comprehensive income (FVOCI). Four NSW universities had designated their investment as held for trading (FVTPL) and six NSW universities treated their investment as FVOCI. Further, each university had to consider whether, in their view the dividend (including the in-specie distribution) was clearly a return of the cost, or a net gain on their original investment in EAL.

Accounting treatments varied as a result of each university’s position of how the investment had been designated, and judgements it made about whether it considered the dividend a return of the cost of their historical investment in EAL. However, each university’s total comprehensive income reflects the $33 million net impact of the transaction. 

The table below summarises how the EAL transactions have impacted the universities’ financial results for 2021.

  FVTPL* FVOCI position 1** FVOCI position 2***
No. of universities 3 5 2
How were the EAL
distributions recognised?
Dividend income through
profit or loss of
$83 million
Dividend income through
profit or loss of
$83 million
Increase in fair value of
EAL through other
comprehensive income
of $33 million
How was the fair value of
EAL after distributions
accounted for?
Reduction in fair value
through profit or loss of
$50 million
Reduction in fair value
through other
comprehensive income
of $50 million
Investment was
derecognised
Impact on net result Net gain of $33 million Gain of $83 million Nil
Impact on other
comprehensive income
Nil Loss of $50 million Gain of $33 million
Impact on total
comprehensive income
Increase of $33 million Increase of $33 million Increase of $33 million

* This position reflects the impact for universities which designated their investment in EAL as FVTPL.
** This position reflects the impact for universities which designated their investment in EAL as FVOCI, and considered the dividend a net gain on
their original investment in EAL.
*** This position reflects the impact for universities which designated their investment in EAL as FVOCI, and considered the dividend a return of the
cost of their original investment in EAL.

Because of the differences with how each university might have accounted for this transaction, it has been excluded from each university's net results for the purposes of the analysis presented in this report. The following table shows the position taken by each university and impact of the exclusion of the transaction on their net results for 2021. 

University Accounting
position

Reported net result
2021

$m

Adjusted net result 2021
without EAL transaction

$m

Charles Sturt University FVOCI 1 143.7 60.7
Macquarie University FVTPL 62.2 29.1
Southern Cross University FVOCI 2 10.6 10.6
University of New England FVOCI 1 102.6 19.3
University of New South Wales FVOCI 1 305.8 222.8
University of Newcastle FVOCI 1 185.3 102.3
University of Sydney FVTPL 1,049.7 1,016.4
University of Technology Sydney FVOCI 1 109.1 25.7
University of Wollongong FVTPL 8.3 (24.7)
Western Sydney University FVOCI 2 143.2 143.2

Source: Universities' consolidated financial statements (audited).

Change in accounting policy on cloud computing arrangements affected four universities

In April 2021, the International Financial Reporting Standards Interpretations Committee (IFRS IC) published an agenda decision relating to the accounting for configuration and customisation costs incurred relating to cloud computing/Software as a Service (SaaS) arrangements. The Committee concluded that a contract that conveys to the customer only the right to access the supplier’s application software in the future is neither a software lease nor an intangible software asset. The Committee found such agreements are services the customer receives over the contract term.

The decision meant that three universities (Macquarie University, Charles Sturt University and University of Newcastle) applied this change in accounting policy retrospectively, writing off previously capitalised costs and restating their previously reported results.

Wage remediation provisions decreased in 2021

Complexity in enterprise agreements and inconsistent interpretation of the terms within those agreements meant that for several years, universities both over and underpaid certain staff. NSW universities have recorded provisions of $50.8 million in aggregate at 31 December 2021 ($57.6 million in 2020) relating to historical underpayments of staff wages and entitlements.

Universities have now collectively remediated $21.8 million during the year to staff identified as having been underpaid. The balance at 31 December 2021 represents estimates of amounts still owing or likely to be owing to staff the universities have identified as being at risk of having been underpaid.

Nine universities have undertaken or commenced procedures to mitigate the risk of future staff underpayments, including:

  • assessing risks and controls in the payroll process
  • reviewing systems and employment awards/agreements
  • developing new or improved timesheet functions and training staff
  • engaging consultants to perform or assist with the above.

One university expects to commence these actions in the first half of 2022.

2.2 Impacts of COVID-19

The COVID-19 pandemic continued to affect the way the university sector operated in 2021.

The impact of COVID-19 is being felt differently at each university

Universities have continued to apply cost saving measures and all universities reduced their operating expenses in 2021 compared to 2020, with an aggregated reduction of $644 million (5.8%). Operating expenditure is covered in more detail in section 2.3 of this report.

Overseas student enrolments (EFTSL) have decreased overall by 3.8%. However, two universities increased their overseas student enrolments, which increased their student revenue.

In aggregate, domestic student enrolments (EFTSL) at NSW universities increased by 0.8%, although half of the universities experienced decreased enrolments of domestic students. These universities experienced decreased enrolments of both overseas and domestic students.

The graph below shows the movement in student enrolments between 2021 and 2020.

graph showing changes in student enrolments for each university from 2020 to 2021. For accessible version please email communications@audit.nsw.gov.au
Change in 2021 student enrolments compared to 2020 by university
Note: EFTSL is Equivalent Full-Time Student Load.
Source: Provided by universities (unaudited).

More courses are being delivered online in 2021, with 50% of universities increasing the percentage of courses they delivered through online or digital means in 2021 compared to 2020. The digital learning platforms used by universities are predominantly external software services.

One university adjusted its course offerings to remove those with low volumes of enrolments in 2021 in favour of short courses in 2022 that utilise the Australian Government's announcement of extra funding during the pandemic.

Fifty per cent of universities introduced more initiatives to seek philanthropic revenue from alumni and donors in 2021. Of those universities, 40% were successful in increasing their philanthropic revenue in 2021.

Universities identified $170 million in surplus land and building assets

With reduced usage of physical campus buildings and student accommodation as a result of border closures and COVID-19 stay-at-home orders, 60% of universities identified land and building assets that were surplus to requirements. These comprised of student accommodation, offices and teaching and research facilities.

An aggregate of 12 land and 51 building assets were identified as surplus, with a combined fair value of $170 million at 31 December 2021. Over 80% of these were sold during 2021 or held for sale at 31 December 2021, with the remainder planned to be leased or repurposed.

Universities that own student accommodation buildings have experienced a decline in the average occupancy rate over the last three years, from 74% in 2019, 47% in 2020 to 43% in 2021. Accordingly, revenue from student accommodation this year had fallen 55.6% from 2019 and 15.8% from 2020.

Universities received $304 million in government grant support relating to COVID-19 in 2021

Seventy per cent of universities, through their subsidiaries, received JobKeeper payments in 2021 totalling $6.9 million ($48.2 million in 2020). The JobKeeper scheme finished on 28 March 2021. The graph below shows the amount of JobKeeper payments received by universities’ related entities in 2021 and 2020, grouped by the parent or lead university.

A graph showing jobkeeper payments for each university in 2020 compared to 2021. For an accessible version email communications@audit.nsw.gov.au
JobKeeper payments received by university group in 2021 and 2020
Source: University related entities' financial statements (audited).

The Australian Department of Education, Skills and Employment allocated an additional $1 billion to the university sector under the Research Support Program (RSP) from January 2021. The universities in NSW received a total of $297 million in additional funding.

The RSP provides block grants, on a calendar year basis, to higher education providers to support the systemic costs of research not supported directly through competitive and other grants, such as libraries, laboratories, consumables, computing centres and the salaries of support and technical staff.

The graph below shows the amount of additional RSP funding received by each university in 2021.

Graph showing additional research program payments in 2021 by NSW university. For accessible version email communications@audit.nsw.gov.au
Additional RSP payments received by university in 2021
Source: University related entities' financial statements (audited).

One university (Charles Sturt University) increased its borrowings in 2021 by $75 million to boost cash flows for operational and capital expenditure.

2.3 Financial performance

Financial results

Universities’ net results have improved in 2021

All NSW universities reported positive net results in 2021 (four in 2020) and each showed improvement from 2020.

The graph below shows the net results of individual universities for 2020 and 2021, with the 2021 results adjusted as previously noted to exclude the impact of the Education Australia Limited (EAL) transaction. One university has a negative adjusted net result.

graph showing adjusted net results for NSW universities for 2020 and 2021. For accessible version, email communications@audit.nsw.gov.au
Adjusted net results by university for 2021 and 2020
Note: Adjusted 2021 net result excludes the impact of EAL transactions.
Source: Universities' consolidated financial statements (audited).

Key drivers behind the 2021 results are:

  • two universities recorded higher overseas student revenue than last year
  • decreases in expenditure on maintenance and student services at those universities most affected by COVID-19 lockdowns
  • savings in employee expenses as a result of ongoing redundancy programs.

The graph below presents the adjusted revenue and expenditure for each university in 2021.

graph showing the adjusted revenue and expenditure. For accessible version email communications@audit.nsw.gov.au
Adjusted revenue and expenditure by university in 2021
Note: Adjusted revenue excludes the impact of EAL transactions.
Source: Universities' consolidated financial statements (audited).

The movement in revenue and expenditure for each university and for the sector as a whole is analysed later in this report.

Revenue from operations

A snapshot of the universities' revenue for the year ended 31 December 2021 is shown below.

pie chart showing the total combined revenue was 12 billion dollars with fees and charges making up 5.8 billion, government grants 4.1 billion, other revenue 1.3 billion and investment income 0.7 billion.
Combined adjusted revenue of universities in NSW in 2021
Note: Government grants do not include Higher Education Loan Programs, such as the Higher Education Contribution Scheme (HECS), which are
included in fees and charges.
Investment income has been adjusted to exclude the impact of EAL transactions.
Source: Universities' consolidated financial statements (audited).
graph showing differences in combined revenue from 2017 to 2021. combined revenue includes investment income, government grants, fees and charges and other revenue. For accessible version, email communications@audit.nsw.gov.au
Combined revenue of universities in 2021 compared to recent years
Note: Government grants do not include Higher Education Loan Programs, such as HECS, which are included in fees and charges.
2021 revenue has been adjusted to exclude the impact of EAL transactions in investment income.
Source: Universities' consolidated financial statements (audited).

Combined adjusted revenue for universities totalled $12 billion in 2021, representing an increase of $1.1 billion (10.5%). The increase was mainly due to government grants.

Universities' combined revenue streams all improved from 2021

The graph below presents the aggregated revenue streams for all universities in NSW from 2017 to 2021. The COVID-19 pandemic impacted the financial results for 2020 and 2021. 

graph showing combined revenue streams of NSW universities from 2017 to 2021 including fees and charges, government grants, other revenue and investment income. For an accessible version email communications@audit.nsw.gov.au
Universities' combined revenue streams over time
Note: Government grants do not include Higher Education Loan Programs, such as HECS, which are included in fees and charges.
Investment income has been adjusted to exclude the impact of EAL transactions.
Source: Universities' consolidated financial statements (audited).

All revenue streams recorded a growth in 2021, ranging from 0.1% for fees and charges revenue ($3.2 million) to 67.7% for investment income ($492 million). Since 2020, government grants increased by $442 million (10.7%) and other revenue increased by $204 million (15.2%).

Over the past five years, the revenue stream recording the strongest growth for all universities was government grants, increasing by $668 million from 2017 or 19.2%. A portion of that increase relates to the 2021 additional Research Support Program funding of $297 million noted earlier in section 2.2 of this report. Fees and charges revenue increased by $554 million (10.5%) over the same period. However, at its peak in 2019 before the COVID-19 pandemic impacted results, the growth in revenues from sources other than government grants since 2017 was $1.2 billion (18.8%).

Government grants represented 34% of universities' combined revenue in 2021

In previous years, various higher education reforms have been proposed by the Australian Government to manage the cost of tertiary education and to reduce universities' reliance on government grants. Prior to the onset of the COVID-19 pandemic, combined government grants as a proportion of the total revenue of universities in NSW had been steadily reducing, from 37.1% in 2016 to 31.1% in 2019. This was despite an increase in the aggregated amounts contributed through government grants revenue by $61 million over the same period.

Aggregated government grants revenue to all universities increased from $3.7 billion in 2020 to $4.1 billion in 2021. As a proportion of the total revenues of all universities, government grants remained stable at 34.4% (34% in 2020).

The aggregated fees and charges revenue received by all universities increased slightly by $3.2 million in 2021 to $5.8 billion. As a proportion of combined revenue, fees and charges decreased in 2021 to 48.4% (53.4% in 2020).

The following graph shows major revenue streams by universities for 2021.

graph showing percentage of components of adjusted total revenue for each NSW university in 2021. Components include government grants, fees and charges, other revenue and investment income. For accessible version, email communications@audit.nsw.gov.au
Components of adjusted total revenue* by universities in 2021
* 'Adjusted total revenue’ refers to 2021 revenue adjusted to exclude the impact of EAL transactions.
Note: Government grants do not include Higher Education Loan Programs, such as HECS, which are included in fees and charges.
Source: Universities' consolidated financial statements (audited).

In 2021, five universities (three in 2020) received over 40% of their total revenue from government grants.

In the current year, the change in revenue from government grants at individual universities varied from a decrease of 3.6% to an increase of 21.9%. The graph below shows government grants received at individual universities in 2021 with the percentage change from 2020.

graph showing the change in government grants for each NSW university from 2020 to 2021. For accessible version email communications@audit.nsw.gov.au
Government grants by university in 2021 (change from 2020)
Note: Government grants do not include Higher Education Loan Programs, such as HECS, which are included in fees and charges.
Source: Universities' consolidated financial statements (audited).

Revenue from overseas students decreased by 0.9% in 2021

Universities' overseas and domestic student course fees and charges revenue for 2017 to 2021 is presented in the following graph.

graph comparing the revenue from course fees and charges for domestic and overseas students from 2017 to 2021. For an accessible version, email communications@audit.nsw.gov.au
Universities' overseas and domestic student course fees and charges revenue over time
Note: Revenue from domestic students includes amounts from Higher Education Loan Programs, such as HECS, but does not include government
grants for domestic students comprising the CGS funding for Commonwealth Supported Places.
Source: Universities' consolidated financial statements (audited).

Fees and charges revenue from overseas students increased by $794 million in the three years between 2017 and 2019, before the COVID-19 pandemic started to impact the universities' finances. Fees and charges revenue from domestic students only increased by $106 million over this same period.

In 2021, fees and charges revenue from overseas students declined by $29.1 million (0.9%) compared to 2020. As noted earlier in section 2.2 of this report, this decrease was driven by a fall in overseas students studying at universities in NSW, from 82,272 full-time equivalent students in 2020 to 79,134 students in 2021, a decrease of 3.8%.

Fees and charges revenue from domestic students increased by $27.2 million in 2021 to total $2.2 billion, consistent with an increase in the number of full-time equivalent domestic students by 0.8%. There were 209,018 domestic students enrolled at universities in NSW in 2021 compared to 207,396 in 2020, an increase of 1,622 students.

The graph below shows individual universities' revenue in 2021 from overseas and domestic students. Income from overseas students exceeds that from domestic students at two universities (two in 2020). These were the University of New South Wales and the University of Sydney. Overseas student revenue recorded by these two universities makes up over 64% of total overseas student revenue for universities in NSW. 

graph showing revenue for each university from overseas and domestic students including government grants in 2021. For accessible version email communications@audit.nsw.gov.au
Revenue from overseas and domestic students including government grants for each university in 2021
Note: Revenue from domestic students includes amounts from Higher Education Loan Programs, such as HECS. Government grants for domestic
students represents the CGS funding for Commonwealth Supported Places.
Source: Universities' consolidated financial statements (audited).

Eight universities recorded decreases in overseas student revenue compared to 2020. Only the University of Sydney and the University of NSW recorded increases in overseas student revenue in the current year. The movement in overseas student revenue in 2021 by university is shown in the graph below.

graph showing the movement of overseas student revenue in 2021 compared to 2020. For accessible version, email communications@audit.nsw.gov.au
Movement in overseas student revenue by university in 2021 (change from 2020)
Source: Universities' consolidated financial statements (audited).

The movement in overseas student revenue did not impact each university equally. Different universities attract overseas students from different countries of origin in varying proportions. Students from some countries were better able to return to Australia to continue their studies or were able to transition to on-line learning. The quality of the telecommunications infrastructure in students' home countries and time-zone differences contributed to the ease (or difficulty) of transition. The ability (or inability) of students from foreign countries to continue their studies impacted the revenues earned by universities where they are enrolled.

Over 43% of universities' total revenue from course fees in 2021 came from overseas students from three countries

In 2021, overseas students contributed $3.1 billion in course fees to universities in NSW ($3.1 billion in 2020). Students from the top three countries of origin contributed $2.4 billion in fees ($2.2 billion in 2020), which closely approximates the universities' total revenue from domestic students for 2021. These top three countries were China, India and Nepal (same in 2020). Revenue from students from these countries comprised 43.5% (38.9% in 2020) of total student revenues for all universities and 78.3% of total overseas student revenues in 2021.

As we have reported previously, a high level of reliance on student revenue from these three countries poses a concentration risk for NSW universities. Unexpected shifts in demand arising from changes in the geo-political or geo-economic landscape, or from restrictions over visas or travel can impact revenues, operating results and cash flows. The consequence of the reliance on students from particular countries was realised as travel restrictions were implemented following the outbreak of COVID-19 in early 2020. All universities' revenues from overseas students were negatively impacted in 2020. However, the current year is showing that student revenues from some countries of origin has proved less resilient than others.

The graph below shows universities' revenue in 2021 from overseas and domestic student fees.

pie chart showing that domestic students contributed 2.5 billion dollars or 44 per cent with overseas students from the top 3 countries contributing 2.4 billion or 43 per cent and overseas students from all other countries 0.7 billion or 12 per cent.
Universities' revenue from student course fees in 2021
Note 1: The figures used for revenue relate to students enrolled in bachelor or higher degrees at the parent university.
Note 2: Revenue from domestic students includes amounts from Higher Education Loan Programs, such as HECS.
Source: Total revenue from domestic and overseas students was sourced from university financial statements (audited). Revenue from students by country of origin was provided by universities (unaudited).

Student enrolments from China increased, while total overseas enrolments decreased in 2021

The number of overseas student enrolments (by headcount) at NSW universities continued to decline from 151,901 in 2020 to 138,907 in 2021. This represents a decrease of 8.6% from last year.

2019 was the last year of data not impacted by the pandemic and overall enrolments of overseas students have continued to decline throughout the pandemic. Enrolments of overseas students has fallen by 12.5% overall from pre-pandemic levels. A notable exception is the enrolment of students from China, which increased by 2,259 students in 2021, following an increase of 968 in 2020. Students from China now represent over half of all overseas student enrolments.

All universities continue to market their educational products in international markets, focusing on countries in Asia. Whilst the countries of origin of overseas students have diversified in the years leading up to 2019, the trend has reversed in 2020 and 2021. The graph below shows the composition of overseas student enrolments by country of origin over the past five years.

graph showing overseas student enrolments to NSW universities. This shows the top three countries were China, India and Nepal. For an accessible version please email communications@audit.nsw.gov.au
NSW universities' overseas student enrolments by country of origin
Source: Australian Trade and Investment Commission, international student data. China includes Hong Kong and Taiwan.

The highest proportion of overseas student revenue sourced from a single country at individual universities ranged from 19% to 86% (2020: 23% to 77%). It is important to note that not all universities are dependent on revenue from students from China. However, the pandemic has increased the number of universities where China is the leading source of overseas student revenue. While enrolments of students from India and Nepal had been increasing in the years up to 2019, they decreased in 2020 and 2021. For two universities, the University of Wollongong and Southern Cross University, the top country of origin changed from India to China in 2021. Seven out of the ten universities now record China as the leading source of overseas student revenues. This creates not only a concentration risk for each university, but for the NSW university sector as a whole.

The graph below illustrates the relative reliance of each university on a single country for their overseas student revenue.

Graph showing the top country for overseas student revenue and the difference between 2021 and 2020. For accessible version, email communications@audit.nsw.gov.au
Highest proportion of overseas student revenue from a single country of origin at each university in 2021 (with change since 2020)
Note: The figures used for revenue relate to students enrolled in bachelor or higher degrees at the parent university. The percentage has been
calculated based on the university parent total overseas student revenue.
Source: Provided by universities (unaudited).

Other revenues

Overall philanthropic contributions to universities decreased in 2021

Universities and many of their controlled entities are charities and are registered as deductible gift recipients for taxation purposes. They can attract significant donations and bequests from public, private and corporate philanthropists. Some bequests are tied to specific research activities. To comply with the terms of the bequest, universities may not use these funds for other purposes.

Philanthropic contributions to universities decreased by 19.5% from $222 million in 2020 to $179 million in 2021. However, philanthropic contributions increased at four universities in 2021.

The University of Sydney and the University of New South Wales attracted 69.6% of the total philanthropic contributions to the universities in 2020 (75.2% in 2020). The newer, smaller and non-metropolitan universities have been least able to attract donations.

The graph below presents the donations revenue received by each of the universities in 2021.

donations revenue received by each NSW university in 2021 and how much of a change it was from 2020. For accessible version, email communications@audit.nsw.gov.au
Philanthropic revenue for each university in 2021 (with change since 2020)
Source: Universities' consolidated financial statements (audited).

Total research income for universities was $1.5 billion in 2020

Universities' total research income increased by $122 million (8.9%) in 2020 compared to 2019. The increase over the past five years between 2016 and 2020 was $295 million (27.5%) from $1.1 billion to $1.5 billion, mostly attributed to increased Australian Competitive Grants and other public sector research funding of a combined $306 million.

Research income statistics for 2021 will be available from the Australian Department of Education, Skills and Employment after July 2022.

Two universities attracted 67% of the total research income of all universities (66.5% in 2019) as shown in the graph below.

graph showing the research income for each university in 2020 and how it differs from 2019. For accessible version, email communications@audit.nsw.gov.au
Research income for each university in 2020 (with change since 2019)
Source: Australian Department of Education, Skills and Employment statistics on Higher Education Research Income (audited).

Expenditure

A snapshot of combined expenditure at universities in NSW for the year ended 31 December 2021 is shown below.

pie chart showing total combined expenditure was 10.4 billion dollars with employee related expenses at 6 billion, depreciation and amortisation at 1 billion, scholarships and grants at 0.7 billion and other at 2.8 billion
Combined expenditure at universities in 2021
Source: Universities' consolidated financial statements (audited).
graph showing combined expenditure at universities in 2021 including employee related expenses, depreciation and amortisation, scholarships and grants and other expenses. For accessible version email communications@audit.nsw.gov.au
Combined expenditure at universities in 2021 compared to recent years
Note: 2020 expenditure has been restated from last year's report due to retrospective correction of prior period errors.
Source: Universities' consolidated financial statements (audited).

Combined expenditure for universities totalled $10.4 billion in 2021. This was a decrease of $644 million (5.8%) from 2020.

Universities have been managing expenditure and optimising cost efficiencies over recent years so that they could operate in a competitive environment with less direct government support in the form of grants. However, the outbreak of the COVID-19 pandemic put immediate financial pressure on the sector. Universities responded by implementing cost saving measures including reducing the casual and contractor workforce, delaying the hire of new staff, eliminating travel, and pausing other discretionary expenditure.

Employee related expenses decreased 7.9% in 2021

Combined employee related expenses for universities decreased to $6 billion in 2021. This was a fall of $514 million (7.9%) from 2020. The decrease was mainly due to a drop in full-time equivalent (FTE) staff numbers by 2,297 or 5.5%, and lower redundancy costs.

In 2020, universities recorded a total expense of $294 million relating to staff redundancy programs implemented in response to financial pressures resulting from the COVID-19 pandemic, making 2,162 positions redundant. In 2021, the redundancy expense was $111 million for 1,297 positions.

The decrease in other expenses in 2021 was in response to the COVID-19 pandemic

Combined other expenses for universities decreased in 2021 by $24 million to $2.8 billion. This reduction of 0.9% was largely driven by cost saving measures introduced to respond to the COVID-19 pandemic.

Notable decreases in combined other expenses at universities in 2021 were in:

  • consultant and contractor expenses, which were $143 million in 2021 compared to $166 million in 2020, a decrease of $23.4 million (14.1%)
  • travel, entertainment and staff development expenses, which were $47.6 million in 2021 compared to $59.6 million in 2020, a decrease of $12 million (20.2%).

The expenditure for each university in 2021 with the change since 2020 is shown below. 

graph showing the expenditure for each university in 2021 with the change since 2020. For accessible version email communications@audit.nsw.gov.au
Expenditure for each university in 2021 (with change since 2020)
Source: Universities' consolidated financial statements (audited).

All universities reduced expenses in 2021 compared to 2020 (five universities in 2020). The biggest reduction (excluding those due to prior period errors) was at the University of Technology Sydney where savings of $95.3 million were achieved, primarily in employee related expenses which reduced by $80.7 million. The employee related expenses in 2020 included costs of redundancy programs.

The graph below shows the key components of expenditure for each university in 2021.

graph showing the key components of expenditure for each university in 2021. This includes employee related expenses, depreciation and amortisation, scholarship and grants and other expenses. For accessible version email communications@audit.nsw.gov.au
Key components of expenditure for each university in 2021
Source: Universities' consolidated financial statements (audited).

Employee related expenses represent the major portion of expenses at each university and ranged from 54% to 60% of total expenditure.

Controlled entities

The overall number of universities' controlled entities remained unchanged

While some universities have started to streamline and reduce the number of their controlled entities to contain administrative and compliance costs, others have established new entities to expand their operations overseas or commence new business activities. Universities created three new controlled entities and deregistered three entities in 2021, resulting in the same number of controlled entities this year overall.

Out of 74 controlled entities, there were 14 dormant entities at 31 December 2021, including corporate trustees that do not trade and entities that have ceased to operate due to business rationalisation.

None of the universities closed any controlled entity as a result of the COVID-19 impact. All controlled entities were able to demonstrate they were going concerns (i.e. able to meet financial obligations as and when they fall due for the next 12 months). However, 18 controlled entities reported a loss in 2021.

Twenty-nine of the universities' controlled entities required letters of financial support from their parent in 2021 (22 in 2020).

Depending on the nature of their business, controlled entities based in Australia were impacted by COVID-19. For instance, there was:

  • reduced activity in student services such as food outlets, gymnasiums and sporting facilities due to less students on campus
  • reduced enrolments in academic pathway courses with general reduction in overseas students
  • reduced medical activity from government suspension of non-urgent elective surgery (for MQ Health and Westmead IVF).

Controlled entities overseas did not report significant disruption of their activities from COVID-19.

The table below details the number of universities' controlled entities.

University at 31 December 2021 Total number of
controlled entities
Number of dormant
entities
Number of overseas
controlled entities
Charles Sturt University 2 -- --
Macquarie University 14 9 1
Southern Cross University 1 -- --
University of New England 5 1 --
University of NSW 16 1 7
University of Newcastle 4 -- 1
University of Sydney 3 -- 1
University of Technology Sydney 11 1 5
University of Wollongong 12 1 7
Western Sydney University 6 1 --
Total 74 14 22

Source: University and controlled entities' financial statements (audited).

3. Internal controls

Appropriate and robust internal controls help produce reliable financial reports and reduce risks associated with managing finances, compliance and administration of universities.

This chapter outlines the internal controls related observations and insights across universities in NSW for 2021, including overall trends in findings, level of risk and implications.

Our audits do not review all aspects of internal controls and governance every year. The more significant issues and risks are included in this chapter. These along with the less significant matters are reported to universities for management to address.

Section highlights
  • The total number of internal control findings decreased from 110 in 2020 to 105 in 2021.
  • Four high-risk findings were identified in 2021 (three in 2020).
  • The number of repeat deficiencies remained the same with 45 reported in 2021 and 2020.
  • All entities have drafted or implemented a cybersecurity policy/framework and established a governance committee accountable for cybersecurity.
  • Four out of 13 entities experienced a significant cyber incident during 2021.

3.1 Internal controls trends

Internal control findings

The number of internal control findings decreased from the prior year

In 2021, our audits identified 105 findings (110 findings in 2020). Information technology (IT) deficiencies accounted for 25% of the findings. Universities increasingly rely on IT for efficient and effective delivery of services such as online/remote learning, as well as for their financial processes and internal and external financial reporting. While IT delivers considerable benefits, increasing reliance on IT systems with known vulnerabilities presents additional risks that universities need to address.

Findings are categorised as relating to information technology, financial controls, policies and procedures and financial reporting. The high-risk and common findings across these areas are explored further in this chapter. The graphs below describe the spread of management letter findings by risk rating.

Source: Management letters issued by the Audit Office for the parent universities.

The table below shows the levels of risk on the management letter findings by university for 2021, and how many of the findings were repeat issues.

    Management letter findings 2021
University High Moderate Low Repeat
Charles Sturt University -- 8 8 7
Macquarie University -- 3 5 4
Southern Cross University 1 2 2 1
University of New England 1 13 11 6
University of New South Wales 1 4 5 4
University of Newcastle -- 2 5 7
University of Sydney -- 4 6 7
University of Technology Sydney -- 1 3 2
University of Wollongong 1 6 7 5
Western Sydney University -- 1 5 2

Note: The number of repeat findings is included within the other columns.
Source: Management letters issued by the Audit Office for the parent universities.

We reported four high-risk findings in 2021 compared to three in 2020

In 2021 we reported four high-risk findings, two relating to financial controls with one carried forward since 2019, one relating to deficiencies in privileged user access and one relating to a previously unreported liability for contract termination costs.

The University of New South Wales had one repeat high-risk finding

In 2019 the University of New South Wales identified that correct payment rates had not been consistently applied to casual academic staff in some cases. The absence of effective financial controls, which may have prevented the need to provide for a potential underpayment of casual staff salaries, resulted in extended audit procedures being performed to conclude that the control deficiencies did not present a risk of material misstatements.

In response, the University in 2020 and 2021 continued work to assess its liability for underpayment of casual staff entitlements. The University continues to implement processes to address identified deficiencies.

At 31 December 2021, the University continued to recognise a provision to reflect the extent of underpayments across all faculties and all associated remediation costs.

The University of New England had one high-risk finding

The audit of the University of New England identified continued deficiencies in privileged user restriction and activity monitoring processes. Observations were first raised with management in 2018 and whilst inappropriate privileged accounts highlighted in the prior year were removed, new issues were identified during 2021.

The University of Wollongong had one high-risk finding

The audit identified a prior period error in the University of Wollongong's 31 December 2020 financial statements for not recording a liability of $169 million for the early termination of student accommodation services provided by a third party vendor.

Southern Cross University had one high-risk finding

The University has self-assessed its casual payment practices and potential exposure to wage compliance issues. However, our audit noted Southern Cross University had not yet progressed the review of its payroll function beyond the initial scoping stage. The University is yet to perform a detailed payroll compliance review to assess the impacts from potential wage non-compliance.

We identified 44 moderate-risk findings, of which 14 related to IT

A summary of moderate-risk control deficiencies identified in 2021 is set out below.

Areas No. of moderate-risk
control deficiencies
Summary of the control deficiencies
Information
technology
14

IT control deficiencies included:

  • disaster recovery plan testing of key finance systems were not performed in recent years
  • no formal patch management policy and procedure and lack of involvement of the Information Security team in the cybersecurity incident management process
  • reviews of third party assurance reports on IT systems were not always performed and contained deficiencies.
Poor IT controls increase the risk of inappropriate access, cybersecurity attacks, data manipulation and misuse of information and assets.
Financial controls 9

Financial control deficiencies included:

  • systemic issues in the application of employee entitlements in payroll, resulting in underpayments
  • lack of independent reviews for changes to payroll master file data and employee details
  • inconsistencies between financial and system delegation limits.
Financial control weaknesses increase the risk of error or fraud in transactions that may result in financial loss to the university or misstatement in financial statements.
Policies and
procedures
10

Deficiencies around policies and procedures included:

  • absence of a centralised legislative compliance register or centralised breach register
  • lack of a complete and up to date register of contracts.
Policies and procedures that are visible and current are critical to supporting staff to meet their obligations and ensuring consistency and reliable decision making across the university.
Financial reporting 11

Financial reporting deficiencies included:

  • lack of system enforced segregation of duties for the processing of manual journals
  • lack of documented accounting assessment on key matters impacting the financial statements.
Financial reporting weaknesses increase the risk that the financial statements will be materially misstated or require correction in subsequent years.
Total 44  

Source: Management letters issued by the Audit Office for the parent universities.

Forty-five findings were raised in previous years

Recommendation

Universities should prioritise actions to address repeat findings on internal control deficiencies in a timely manner, particularly those that have been repeat findings for a number of years. 

There were 45 repeat findings (45 in 2020) identified in 2021. Repeat findings arise when the university has not implemented recommendations from previous audits. Fifteen repeat findings related to IT control deficiencies. Universities have agreed to prepare implementation plans to address these repeat issues.

IT issues can take some time to rectify because specialist skill and/or partnering with software suppliers is required to implement appropriate controls. Changes to complex systems or IT architecture may involve extensive testing and assessment before they are put into production. However, until rectified, the vulnerabilities those control deficiencies present can be significant.

The graph below shows the spread of repeat findings by area of focus and risk rating.

A coloured wheel showing the different areas and giving them a ranking around risk deficiencies on a scale of low, moderate or high. For an accessible version email communications@audit.nsw.gov.au
Repeat internal control deficiencies by area and risk
Source: Management letters issued by the Audit Office for the parent universities.

3.2 Managing cyber risks

This section outlines observations from our review of the cybersecurity planning and governance arrangements at all NSW universities. We also reviewed the controlled entities of universities if they were large, maintained IT control environments and systems that are separate from the parent, and had their own governance committees. These entities were:

  • UNSW Global Pty Limited (controlled by the University of New South Wales)
  • MQ Health Pty Limited (controlled by Macquarie University)
  • Insearch Limited (controlled by the University of Technology Sydney).

Cyber threats are increasingly common and sophisticated as the global interconnectivity between computer networks increases. High profile attacks on universities in Australia have included the targeting of  university staff through phishing to open avenues for the introduction of malicious software (malware) into key systems. Universities have also been subject to data breaches, with personal information on staff, students and external parties being obtained by unauthorised users. The continuing trend towards digital delivery of services has increased the vulnerability of organisations to cyber threats.

The COVID-19 pandemic has exacerbated these risks. It has increased universities' reliance on the internet – to work and deliver classes remotely, to provide access to services and information, and to communicate across Australia and in many instances globally. Traditional security policies within an organisation’s perimeter are harder to enforce in networks made up of home and other private networks, and assets the organisation does not manage. This has increased the cyber risks for universities and their subsidiaries.

Cybersecurity comprises technologies, processes and controls that are designed to protect IT systems and sensitive data from cyber attacks. Cyber incidents can harm universities' service delivery and may involve:

  • theft of information such as intellectual property or sensitive personal data
  • denial of access to critical technology
  • hijacking of systems for profit or malicious intent
  • financial losses.

In this section, we have considered how best to balance the need to support public accountability and transparency with the need to avoid revealing information that could pose additional risk to an entity's systems. This has involved an assessment of the appropriate level of detail to include in the report about the cybersecurity vulnerabilities identified in our audits. Deficiencies are not attributed to individual entities in this report. However, each entity has been informed of observations specific to them.

Cybersecurity planning and governance

All entities have drafted or implemented a cybersecurity policy/framework

As at 31 December 2021, we observed all entities had established readily accessible, current cybersecurity policies with defined roles and responsibilities, and detailed reporting requirements. However, some can be further improved by ensuring cyber incidents or attacks are clearly defined, timeframes for reporting are noted, and there are points of escalation. The table below details the percentage of entities' policies that do not incorporate these key elements. 

Policy maturity Percentage of entities
The entity's policy did not contain:  
  • a definition of cyber incidents or attacks
8
  • defined roles and responsibilities
Nil
  • detailed reporting requirements
Nil
  • timeframes for reporting
15
  • points of escalation
15

Source: Audit Office analysis.

Cybersecurity frameworks used by university entities vary as they are not required to adopt a specific model

NSW universities and their controlled entities are not obliged to use a specific framework/model for managing cybersecurity. Half of the entities have adopted one of the two major external framework models being:

  • Australian Cyber Security Centre (ACSC) Essential 8 mitigation strategies
  • National Institute of Standards and Technology (NIST) cybersecurity framework.

The chart below shows how university entities have designed their cybersecurity frameworks. 

pie chart showing 31 per cent of cyber security frameworks in use are ACSC Essential 8 mitigation strategies, 31 per cent NIST cybersecurity framework, 23 per cent other external framework and 15 per cent no external framework
Cybersecurity frameworks in use
Source: Audit Office analysis.

All entities had a governance committee accountable for cybersecurity

All entities have established governance committees that are responsible for overseeing the response to cybersecurity risks, including oversight of cyber risks associated with third party IT providers. In 54% of cases this was the responsibility of the audit and risk committee with the remainder being under the responsibility of the board (23%) or a separate cybersecurity committee (23%).

Governance committees periodically met at various frequency levels with 69% meeting quarterly, and the remainder meeting monthly or bi-monthly. Of the entities whose cybersecurity risks are overseen by audit and risk committees, 14% did not have cybersecurity as a standing agenda item.

Cyber incidents management

The number of cyber incidents recorded in entities' registers in 2021 ranged from nil to 4,391.

The disparity in the number of recorded incidents is largely due to gaps in capturing defined events. Fifty-four per cent of registers did not include intercepted or blocked attempts as cyber incidents. This is despite all entities having defined a cyber incident to include attempted or unsuccessful attacks.

Monitoring of attempted attacks enables universities to locate weaknesses in their processes and identify areas subject to regular or increased attack.

The table below provides a list of common cyber incidents that are defined by entities.

Entity's definition of cyber incidents did not include the following items: Percentage of entities
Percentage of entities Nil
Phishing, vishing, smishing incidents Nil
Malware (malicious software) including ransomware, spy ware, viruses Nil
Denial of service attack 23
Man-in-the-middle attacks (e.g. intercepting data or unsecured wifi) 54
SQL injection 69
Email or user account compromise 15

Source: Audit Office analysis.

The cyber response plans may not adequately address the risks of some of these incidents if they are not defined and captured as cyber incidents for the purposes of risk identification and mitigation.

A third of entities’ incident registers do not include a risk rating. Risk ratings help entities assess and prioritise their response to incidents and to deploy resources efficiently and effectively to mitigate the risks that those incidents present.

The entities assessed that none of the incidents resulted in financial loss. However, in cases where accounts were breached or there was unauthorised access to data, the full impact of the incident may not be completely known as it is dependent on how and when the data is used by the perpetrator.

Four out of 13 entities experienced a significant cyber incident during 2021

Entities experienced a range of attacks during 2021, some of which were successful. The most commonly reported attacks were phishing attacks. Entities were in some cases subject to ongoing targeting by sophisticated threat actors seeking to breach the entity's systems and access passwords and logins.

Following these incidents all entities undertook procedures to contain, evaluate and respond to the incident and applied preventative controls against future incidents. However, one entity subject to suspicious activity did not report the incident to their governance committee as they deemed the event low risk on the basis that the threat actor did not ultimately gain access to sensitive or financial data.

Cyber threats are recognised in all entities' enterprise or IT risks registers. Entities have estimated the monetary impact from cyber risk ranging from $5 million to $239 million. Entities have identified a range of material digital or electronic assets subject to cybersecurity risk:

  • confidential research (62%)
  • intellectual property (54%)
  • copyrighted material (46%).

Cybersecurity of vendor systems

Entities regularly use IT systems provided by third party vendors to support their business operations as those vendors deliver specialised services and may offer cost savings or efficiencies. Consequently, third party IT providers are part of the general IT ecosystem and embody certain risks that need to be managed. Being unaware of weaknesses in an IT service provider's cybersecurity controls means entities may respond slowly, or not at all to close vulnerabilities that can be exploited by threat actors to gain access to the entity's systems, data and assets.

A third of entities' cybersecurity policies do not specify how it applies to third party IT vendors.

In 25% of entities, IT vendors are not required to notify the entity of cyber incidents, regardless of whether there was a financial loss or breach of information security.

Half of the entities required IT vendors to confirm compliance with their cybersecurity policy via attestations or certifications. Attestations reinforce the responsibilities of vendors in ensuring adequate cybersecurity controls are implemented when managing the entities information systems and data.

Half of the entities require IT vendors to provide control assurance reports over their controls around cybersecurity. Controls assurance reports are critical, in particular where entities do not have sufficient visibility over the control process operated by its vendor.

Cybersecurity control measures

The Australian Cyber Security Centre (ACSC) has published mitigation strategies and recommended controls for protecting against cyber threats. This set of controls is referred to as the 'Essential Eight'. Some of these controls are not expensive to implement yet provide important protections.

The table below provides the number of entities that have not incorporated these mitigation strategies to their systems, including 'crown jewels' or financial management information systems. Crown jewels are defined as the most critical assets for entities that must be protected if the entity is to remain operational. All entities have identified their crown jewels.

Cyber mitigation strategies Number of entities
(out of 13) that have
not implemented for
all systems
1. Application whitelisting  
  • has a list of authorised applications
7
  • ensure users are restricted to only these authorised applications
9
  • a formal process is followed when updating the authorised application list
7
All non-approved applications (including malicious code) are prevented from executing.  
2. Patch applications  
  • a formal periodic process to check and install security patches for applications such as Flash, web browsers, Microsoft Office, Java and PDF viewers
4
  • for applications noted above on 'high risk' computers implements patches within 48 hours
10
  • only runs applications that are supported by IT vendor and are patched
9
Security vulnerabilities in applications can be used to execute malicious code on systems.  
3. Configure Microsoft Office macro settings  
  • restricts or blocks untrusted or unverified Microsoft Office macros
5
Microsoft Office macros can be used to deliver and execute malicious code on systems.  
4. User application hardening  
  • has application hardening for web browsers and Microsoft Office
6
Flash, ads and Java are popular ways to deliver and execute malicious code on systems.  
5. Restrict/review administrative privileges  
  • has highly privileged access rights to operating systems and applications restricted and based on user duties
5
  • has a policy that restricts administrators from using privileged accounts for every day non-admin activities
7
Administrative user accounts have extensive access to systems and may be compromised.  
6. Patch operating systems  
  • operating systems are regularly updated with the latest patches
2
  • operating systems of high risk computers are patched/mitigated within 48 hours
5
  • only runs operating systems or versions that are supported by the IT vendor and are patched
9
Security vulnerabilities in operating systems can be used to further the compromise of systems.  
7. Multifactor authentication  
  • requires multifactor authentication when sensitive information is accessed
8
  • requires multifactor authentication when activities occur using remote access
5
Stronger user authentication makes it harder for external parties to access sensitive information and systems.  
8. Daily backups and test for restoration  
  • performs daily backups
4
  • stores backups offline (disconnected from the network and computer devices)
6
  • retains backups for at least 3 months
2
  • tests backups for restoration initially, annually and when IT systems change
6
Ensure information can be accessed again following a cybersecurity incident.  

Source: Audit Office analysis.
 
Recommendation

Universities and controlled entities should prioritise improvements to their
cybersecurity and resilience. Specific actions include:

  • implementing appropriate cyber mitigation strategies to key systems (crown jewels)
  • have processes whereby the head of the entity and those charged with governance formally accept the residual risks where current cyber control measures have not addressed all identified risks.  

Cybersecurity awareness training

All entities conducted cybersecurity awareness training during 2021

All entities provided training and awareness programs on cybersecurity during 2021, however 17% of entities did not require employees to undertake mandatory E-learning modules with the remainder offering the training as optional. With the ongoing and increasing risk of cyber-attacks, the risk of exposure is increased where staff are not mandated to undertake cyber awareness training.

Of the training conducted, 58% of entities did not tailor the training for employees in higher risk positions, e.g. (accounts payable, payroll, system administrators etc). Only half of the entities tested staff knowledge through awareness exercises (e.g. sending a fake phishing email).

The effectiveness of cybersecurity training can be improved through tailoring training and awareness activities to the risks specific staff face and for positions that are more likely to be attacked such as, senior management and financial staff. 

4. Teaching and research

Universities' primary objectives are teaching and research. They invest most of their resources aiming to achieve quality outcomes in academia and student experience. Universities have committed to achieving certain government targets and compete to advance their reputation and their standing in international and Australian rankings.

This chapter outlines teaching and research outcomes for universities in NSW for 2021.

Section highlights
  • Seven universities were reported as having full-time employment rates of their undergraduates in 2021 that were greater than the national average.
  • Enrolments at universities in NSW decreased the most in Management and Commerce courses. The largest increase in enrolments was in Science courses.
  • On average, universities delivered 59% of their courses primarily through online means in 2021.
  • Five universities in 2020 were reported as meeting the target enrolment rate for students from low socio-economic status (SES) backgrounds.

4.1 Teaching outcomes

Graduate employment rates

Graduate employment outcomes vary across universities

Universities assess the employment outcomes of their graduates by using published data from surveys conducted by the Australian Department of Education, Skills and Employment's agents. The survey timeframe for employment outcomes is four to six months after course completion.

According to the 2021 survey, seven out of ten NSW universities (seven in 2020) exceeded the national average of 69.2% for full-time employment rates of their domestic undergraduates. This index increased slightly from 69.1% in 2020.

Six universities (six in 2020) performed better than the national average of 84.7% for full-time employment outcomes of their domestic postgraduates. The postgraduate national average decreased from 85.4% in 2020.

The graph below presents the results of the 2021 survey by university.

graph showing the undergraduates and graduates in full-time employment for each of the NSW universities as well as comparison with the national average for both. For an accessible version please email communications@audit.nsw.gov.au
Graduates in full-time employment by university 2021
Source: Quality Indicators for Learning and Teaching 'Graduate Outcomes Survey' 2021, funded by the Australian Department of Education, Skills and
Employment.

In 2021, employment rates for overseas student graduates were also published together with outcomes from 2020 and 2019. These are consistently lower than those for domestic graduates – full-time employment rate was reported at 43.0% for international undergraduates and 43.9% for international postgraduate coursework.

The report noted there was a broad decline in graduate employment rates between 2019 and 2020 for both domestic and international graduates associated with general weakness in the Australian labour market, which was worsened in 2020 from the impact of the COVID-19 pandemic. 2021 results showed a slight improvement from 2020.

The graph below presents the 2019–21 results from the survey by university.

graph showing overseas undergraduates and postgraduates in full-time work for each NSW university as well as comparison with national averages. For accessible version email communications@audit.nsw.gov.au
Overseas graduates in full-time employment by university 2019–21
Source: Quality Indicators for Learning and Teaching 'International Graduate Outcomes Survey' 2021, funded by the Australian Department of
Education, Skills and Employment.

Student enrolments by field of education

Enrolments at universities decreased the most in Management and Commerce courses in 2021

The largest decreases in student enrolments at universities in NSW in 2021 were in:

  • Management and Commerce courses, with 5,550 fewer enrolments compared to 2020 (10.3%)
  • IT, Engineering and Related Technologies courses, with 1,880 fewer enrolments compared to 2020 (four per cent)
  • Architecture and Building courses, with 1,774 fewer enrolments compared to 2020 (19.4%).

The largest increase in student enrolments at universities in 2021 was in Science courses. An additional 5,214 students were enrolled compared to 2020 (14.2%).

The graph below shows the movement in student enrolments by field of education between 2020 and 2021.

bar graph showing the movement in student enrolments by field of education between 2020 and 2021. For accessible version email communications@audit.nsw.gov.au
Movement in universities' student enrolments by field of education
Source: Student numbers are provided by universities (unaudited).

Modes of learning

Half of the universities increased their delivery of courses via online methods in 2021

Fifty per cent of universities increased the percentage of courses they delivered through online or digital means during 2021 compared to 2020.

Of those that did not report an increase, we noted that three universities had already moved to online delivery of courses in 2020 with the onset of the COVID-19 pandemic, and therefore had delivered almost all courses online in both years.

On average, universities delivered:

  • 59% of their courses primarily online in 2021 (58% in 2020)
  • 25% of their courses primarily face-to-face in 2021 (25% in 2020)
  • 33% of their courses both online and face-to-face in 2021 (34% in 2020).

The average percentage of domestic students who received their education primarily via digital learning means in 2021 was 68%. For overseas students, it was 53%.

Universities utilise a combination of both internally and externally managed learning platforms, with internally managed platforms supported by third party software. Two universities have capitalised costs associated with developing their own online platforms.

All universities have performed evaluations on the quality and effectiveness of their online service delivery over the last 12 months, some of which include student experience surveys and reviews of online content against externally published quality standards. Much of this is done as part of general course evaluation procedures.

One university has not evaluated its digital learning platforms as part of its cybersecurity assessments.

Students from low SES backgrounds

In 2009, the Australian Government set a target for 20% of university undergraduate enrolments to be students from low socio-economic status (SES) backgrounds by 2020.

The 2020 results for universities in NSW showed five universities (five in 2019) achieved enrolments of more than 20% of domestic undergraduate students from low SES backgrounds. The five universities which did not meet the target were the same as in the previous year.

Enrolment statistics for 2021 are not expected to be available from the Australian Department of Education, Skills and Employment until July 2022.

Universities can continue to improve outcomes for these students by consistently setting targets, tracking achievement against those targets, implementing policies to increase enrolments and supporting students to graduation.

Five universities reported that they enrolled more students from low SES backgrounds than the target

Universities in NSW reported an increase of 1.1% in the total number of low SES domestic undergraduate student enrolments, from 40,066 in 2019 to 40,517 in 2020. Overall, domestic undergraduate student enrolments (headcount) in NSW increased by 1.5% in the same period from 222,587 in 2019 to 225,918 in 2020.

Reported enrolments of domestic undergraduate students from low SES backgrounds in 2020 for universities as a percentage of total domestic undergraduate students are shown in the table below.

graph showing enrolments of domestic undergraduate students from low SES backgrounds in 2020 for universities as a percentage of total domestic undergraduate students. For accessible version email communications@audit.nsw.gov.au
Low SES domestic undergraduate student enrolments (headcount percentage) for each university in 2020
Source: Australian Department of Education, Skills and Employment, Student Data 2020, Section 11: Equity groups.

Enrolment of Aboriginal and Torres Strait Islander students

In March 2017, all Australian universities committed to achieving growth rates for enrolments of Aboriginal or Torres Strait Islander students to exceed the growth rate of enrolments of non-Indigenous students by at least 50%. 

The 2020 results for universities in NSW showed eight universities achieved increased enrolments of students from Aboriginal and Torres Strait Islander backgrounds (seven in 2019).

Eight universities reported increased enrolments of students from Aboriginal and Torres Strait Islander backgrounds in 2020

Universities in NSW reported an increase in the overall number of Indigenous student enrolments in 2020 by 556, taking the total number of Indigenous student enrolments in 2020 to 7,374. This represents a growth of 8.2% since 2019. Overall, non-Indigenous student enrolments in NSW increased by only 3.4% in the same period, from 293,913 in 2019 to 303,951 in 2020. Consequently, the target growth rate for enrolments of Aboriginal or Torres Strait Islander students to exceed the growth rate of enrolments of non-Indigenous students by at least 50% was achieved in 2020.

The Indigenous student enrolments for 2020 by university is shown below, together with the change in Indigenous student enrolments since 2019.

graph showing the number of students who enrolled in 2020 to each NSW university from an Indigenous background. Also compared with 2019. For an accessible version email communications@audit.nsw.gov.au
Indigenous student enrolments for each university in 2020 (with change since 2019)
Source: Australian Department of Education, Skills and Employment, Student Data 2020, Section 11: Equity groups.

Appendices

Appendix one – List of 2021 recommendations

Appendix two – Status of 2020 recommendations

Appendix three – Universities' controlled entities

 

Copyright notice

© Copyright reserved by the Audit Office of New South Wales. All rights reserved. No part of this publication may be reproduced without prior consent of the Audit Office of New South Wales. The Audit Office does not accept responsibility for loss or damage suffered by any person acting on or refraining from action as a result of any of this material.