AUDIT AND RISK COMMITTEE

AUDIT AND RISK COMMITTEE
Thursday 11 November 2010
CONFIRMED MINUTES
Present:
David Thomas (Chairman) Kathryn Barrow Elizabeth Hall
Vernon McClure
In attendance:
Wendy Appleby Dean Curtis Adam Dawkins
Clive Everest Andrew Keeble Philip Lawson [Deloitte]
Simon Neale [for item 10] Professor Philip Ogden Richard Shaw [KPMG]
Apologies:
Richard Evans Simon Linnett Neil Thomas [KPMG]
Part 1: Preliminary Items
1. Welcome and Apologies (Oral Report)
2010.030 The Chairman welcomed Vernon McClure to his first meeting of the Committee.
2. Executive Summary and Minutes (ARC2010/13&14)
2010.031 The Committee confirmed the Executive Summary and minutes of the meeting
on 20 September 2010.
3. Matters Arising (ARC2010/15)
2010.032 [a] Minute 2010.006 [b]: Elizabeth Hall as Chair of Research Ethics
Committee no longer needed to pursue a meeting with the outgoing
internal auditors on the recommendations arising from the internal audit
on Research Awards.
[b] Minutes 2010.024-25: since the last meeting and prior to completion of
the external audit, Kath Barrow had met with the Director of Finance and
Planning and the Head of External Audit to review the Financial
Statements 2009-10.
4. Serious Incident Reporting (ACC2010/16)
2010.033 The Committee noted a paper summarising recent HEFCE guidance on serious
incident reporting and which proposed an approach for reporting on and
responding to serious incidents.
A&RC CONFIRMED MINUTES 101111 Page 1 of 13

2010.034 The Secretary reported that:
[a] the paper proposed a systematic, staged approach to the reporting of
known or alleged serious incidents. The Chairmen of both Audit and Risk
Committee and Council would need to be notified of serious incidents
and receive assurances that an investigation had been conducted and
concluded, to satisfy both internal and HEFCE requirements.
[b] the paper would form the basis of a policy which would indicate roles
and responsibilities of key individuals and bodies, including clarification
of the respective roles and responsibilities of the Chief Administrative
Officer, Secretary to Council and Chairs of Audit and Risk Committee
and Council in being notified of known or alleged incidents.
[c] the annual recommendation to Governance Committee to revise the
terms of reference of Audit and Risk Committee in June 2010, would
incorporate reference to serious incident reporting.
Action [b]-[c]: Adam Dawkins
2010.035 The Committee noted that:
Part 2: External Audit
[a] clarification of the roles of the individual role-holders to whom incidents
were notified, and indicative timelines, was key.
[b] this included, in particular, known or alleged links with proscribed
organisations which fell within the HEFCE definition of a serious incident.
5. Financial Statements 2009-10 (ARC2010/17)
2010.036 The Committee considered the Financial Statements 2009-10 which had been
audited by the external auditors and reviewed by Finance and Investment
Committee.
2010.037 The Committee’s co-opted accountancy specialist [Kath Barrow] reported that:
[a] she had met with the Director of Finance and Planning and the external
auditors to aid her scrutiny of the Statements.
[b] the key points she had raised with the Director of Finance and Planning
in reviewing the Statements were:
[i] to understand the basis and assumptions on which the internal
impairment valuation of Queen Mary Bioenterprises Innovation
Centre had been made.
[ii] to understand the cost basis and disclosures in the Statements
for demolition of the Old Chemistry Building.
A&RC CONFIRMED MINUTES 101111 Page 2 of 13

[iii] information on insurance in respect of the income currently
held in escrow following the sale of Apatech Ltd.
[iv] evidence sought to support the accounting treatment and
classification of the Herschel Smith endowment.
[c] the responses received were satisfactory and addressed the points
raised.
[d] it would be helpful if a summary of management responses to the
points raised by the external auditors was issued further in advance of the
meeting to provide the Committee with assurances that appropriate
responses had been issued.
2010.038 The Head of External Audit reported that a conservative stance had been
adopted in impairment of the value of the Innovation Centre. The level to which
rental streams would need to fall to further compromise the value of the asset
was not currently clear. It was noted, however, that an anchor tenant had been
secured. The College’s letter of support that the Centre was a going concern
provide assurance in this area. The criteria for valuation of the Centre and any
future impairment would be monitored.
2010.039 The Director of Finance and Planning reported that:
[a] a tendering exercise had taken place for the asbestos removal and
demolition of the Old Chemistry Building, and the value of the building
had therefore been written off and removed as a fixed asset disclosure in
the Statements. In light of HEFCE’s withdrawal of capital funding, plans
for the development of the site were on hold, so a very conservative view
had been taken.
[b] the College’s share of 8% in Apatech yielded £10.1m following its sale in
2009-10. The College had a share of £791k in escrow, release of which
was contingent on specified baseline sales targets being reached and the
warranty secured the income held in escrow. Most of the risks were
insured, and the uninsured risks were considered negligible. But, whilst
the amount was not deemed significant in terms of the College’s overall
income, it was significant for the subsidiary company.
[c] legal documentation supplied to the College confirming that the capital
from the Herschel Smith endowment was expendable had not been
located. The capital was used to refurbish the CCLS building, and
therefore now appears to conflict with classification as a restricted
permanent endowment. Senior members of staff in post at the time the
endowment was given, including the Senior Vice-Principal and Chief
Administrative Officer could attest to having seen the original document
confirming that the capital could be expended. The College would
consider reinstating the capital.
A&RC CONFIRMED MINUTES 101111 Page 3 of 13

2010.040 The Committee recommended to Council the adoption of the Financial
Statements 2009-10.
6. External Audit Report and Management Response (ARC2010/18)
2010.041
The Head of External Audit reported that:
[a] the introduction of the new Student Information System would require
close monitoring as its implementation would affect data quality and
accuracy. An audit of SIS implementation was recommended as priority
for internal audit.
[b] the follow-up recommendations in Appendix A from previous audit
reports where ‘significant advance’ had occurred but which remained
subject to resolution, were not a cause for concern and would be
reviewed in 2010-11.
[c] each of the specific recommendations relating to the previous IT audit
remained ‘open’, which was a concern. Management had indicated that
the Acting Director of IT had produced a robust action plan. It was
recommended that the Committee pay close attention to IT controls as
part of its work.
[d] the 2009-10 external audit had run effectively from the perspective of
his team.
2010.042
2010.043
The Director of Finance and Planning endorsed the view that the external audit
had run smoothly from the perspective of the Finance and Planning Team.
The Committee noted that:
[a] an internal audit of the SITS implementation project should be treated as
a priority and be undertaken before the end of the calendar year 2010, as
this was linked to the wider issue of data quality assurances, to be
audited subsequently.
[b] in light of the 11 open recommendations in relation to IT controls, an
action plan should be presented to the next meeting of the Committee.
Action [a]: Wendy Appleby/Richard Shaw/Neil Thomas
[b]: Chris Day/Dean Curtis
Part 3: Financial Control
7. Online Purchasing: Agresso Compliance Update (ARC2010/19)
2010.044
2010.045
The Committee considered a progress report on College-wide compliance
with the Agresso online purchasing system.
The Director of Finance and Planning reported that:
A&RC CONFIRMED MINUTES 101111 Page 4 of 13

[a] order backed payments had reached 72% by mid-October 2010,
which represented an incremental increase since the previous
report to the Committee. Engagement with the system in a number
of Schools needed to be increased - including the School of
Biological and Chemical Sciences, which had had a new stock
system introduced to enable system usage.
[b] it would not be sensible to require purchase orders for regular utility
bills or for regular stage payments to contractors in accordance
with overall contracts, and these could be treated on a exceptions
basis.
[c] the main reason for remaining non-compliance was primarily due to
‘off payroll’ invoicing for temporary teaching support staff and
laboratory demonstrators. Processes had been established to
strengthen controls in this area, as described in the paper.
[d] the increased use of the e-marketplace for online procurement
would assist in ensuring compliance with the system.
2010.046
The Committee noted that:
[a] compliance at 72% of order backed payments through the system was
not at a level with which the Executive or the Committee was content
with for control purposes.
[b] QMSE, rather than the Committee, was responsible for enforcing
usage where evidence of non-compliance existed – and Committee
looked to QMSE ro enforce usage.
[c] whilst measures for the improved management of off payroll invoices
had been introduced, the Committee would need to provide
assurances to Council that the College would not be liable for an
unexpected HM Revenue & Customs (HMRC) bill in respect of PAYE.
It was of the understanding that the internal auditors would be
conducting a review of College controls in this area, and that a report
on this should be provided to the next meeting.
[d] Agresso compliance should remain a routine agenda item, until further
notice and a report should be presented to the Committee’s next
meeting indicating: which payments (e.g. regular utility bills) should be
excluded from compliance with Agresso; the percentage compliance
level after those were excluded; the action that QMSE was taking to
enforce compliance; and the results of the internal audit of off payroll
invoices.
Action: [c]: Andrew Keeble/Richard Shaw/Neil Thomas
[d]: Andrew Keeble
A&RC CONFIRMED MINUTES 101111 Page 5 of 13

Part 4: Internal Audit
8. Internal Audit Annual Report 2009-10 (ARC2010/20)
2010.047
2010.048
2010.049
The Committee considered the Internal Audit Annual Report 2009-10.
The representative of internal audit [Deloitte] reported that the Committee had
received the draft version of the 2009-10 Report at its last meeting. Of the 15
systems audits four now remained at draft status, pending management
response: TRAC, Purchasing and Payments, Data Quality and Risk
Management Assessment. However, all reports had received draft verdicts of
‘substantial assurance’. Management responses for the Data Quality audit had
been returned, and the draft report – showing that all criteria had been met -
had been circulated to members as one source of assurance for its opinion on
data quality.
The Committee noted that:
[a] on a general point, levels of substantial assurance verdicts had
increased, but it would be useful to have a sense of College ambition
and performance benchmarks for internal audit, to help understand
how the judgments reached compared with other HEIs.
[b] receipt of management responses was a priority to enable the reports
to be finalised for inclusion in the Annual Report of Audit and Risk
Committee to Council and HEFCE.
[c] it would be useful to receive further information on the audit of Income
Collection (Tuition Fees) which had received substantial assurance,
but for which one priority 2 recommendation had been raised.
[d] the Committee had not received the full report that had been produced
by the internal auditors on alleged breaches of the Fire Regulations
which was raised under the College’s Public Interest Disclosure
(Whistleblowing) Policy. This should be circulated to members as a
priority.
[e] a report was required on the Students and Campus Services follow-up
visit for the next meeting of the Committee, particularly in relation to
action taken to address the two priority 1 recommendations.
[f] the Finance and Investment Committee was engaged with raising
awareness of carbon reduction targets.
[g] minor inconsistencies in the numbers of audits and percentages of
specific verdict levels required correction.
Action: [b] Andrew Keeble
[d] Adam Dawkins
[e] Brian China
[g] Philip Lawson
A&RC CONFIRMED MINUTES 101111 Page 6 of 13

2010.050 The Committee approved the Internal Audit Annual Report 2009-10, subject
to resolution of the points raised.
9. Internal Audit Plan 2010-11 (ARC2010/21)
2010.051 The representative of internal audit [KPMG] reported that:
[a] following on from the first meeting since being appointed as the
College’s internal auditors work had been undertaken to understand
the structure and control environment of the College, to help inform the
Internal Audit Plan 2010-11. A meeting was due to be held in the near
future to discuss the College’s emerging risk strategy, which was
deemed key to the final development of the full Plan. The Plan and full
audit programme would be devised as soon as possible after this.
[b] an audit of the College’s QUEDOS programme had commenced and
the SITS audit and payroll audit would be concluded by the end of the
calendar year. A data quality audit would be undertaken once the
findings of the SITS audit were released and responded to.
Action: [a]-[b]: Richard Shaw/Neil Thomas
2010.052 The Committee noted the update on progress in development of the Internal
Audit Plan 2009-10.
10. Estates Lessons Learned Audit Follow-Up (ARC2010/22)
2010.053
2010.054
The Committee considered a report on the Estates Lessons Learned internal
audit.
The Director of Estates reported that:
[a] an update report was provided on the ‘lessons learned’ internal audit of
Estates. The major recommendation which had not been implemented
related to an internal lessons learned review on construction of the
Health and Fitness Centre and Library Phase I.
[b] significant progress had been made in the area of project management
protocols and oversight. The new Assistant Director (Projects) was due
to be appointed and establishment of the Project Board had improved
governance of this area.
[c] completion of Declaration of Interests for Estates staff working on
capital projects would be strictly enforced in response to another audit
recommendation.
A&RC CONFIRMED MINUTES 101111 Page 7 of 13

Part 5: Risk Management
11. Revised Strategic Risk Register (ARC2010/23)
2010.055
2010.056
The Committee considered an update on the development of the Strategic
Risk Register.
The Senior Vice-Principal reported that:
[a] the ongoing work of the Strategic Risk Register Working Group,
reporting to QMSE, had identified the full range of strategic risks and
risk-based opportunities that the process and format for ensuring risks
are mapped to the strategic and operational risk registers.
[b] the next stage was to distil from this list the core strategic risk
areas and to embed the risk management culture in the institution,
particularly through the PAR process to present risks as opportunities
as well as potential threats. This was pivotal to the two-way reporting
and recognition of risks at local and strategic levels.
[c] there was a need to ensure that the governance around a number of
key strategic risk areas was appropriate to avoid exposures, particularly
in light of the outcomes of the governance review.
[d] a meeting was planned with KPMG and Elizabeth Hall to ensure the
internal audit plan was informed by the College’s approach to risk, and
that this approach was appropriate.
2010.057 The Committee noted that:
[a] consideration should be given to the introduction of indicators showing
risk appetite (the level of risk the College was prepared to tolerate) in
order to ensure that an over-cautious approach did not shut out
opportunities or incur unnecessary costs.
[b] so far as the residual risk (after current controls) was materially above
the risk appetite, it would be helpful to have an indication of the
process and timescale for bringing the residual risk within the risk
appetite.
[c] the internal and external auditors (drawing on their knowledge of other
higher education institutions) should be consulted on whether there
were risks that might have been missed or understated.
[d] the Executive should consider what the early warning signs would be of
key risks being realised, so they could be monitored, and how far highimpact
but low-probability risks were covered by business continuity
arrangements.
A&RC CONFIRMED MINUTES 101111 Page 8 of 13

[e] it was also important that the document was not over-engineered. It
would be helpful if a cover sheet could show key risks (before and after
controls) and risk appetite, in a graphical way. This would be
particularly helpful in communicating with Council.
[f] in setting a threshold above which risks would be reported, it was
important to consider not only the higher residual risks but also lower
residual risks where that relied on a high level of control and high
impact risks with low probability as if they crystallised they could be
catastrophic.
[g] the Committee would need to determine a process by which it could
receive general and specific assurances on risk areas and need to
ensure that the Register was reviewed on a periodic basis, through
testing the Executive, drawing on internal audit. The Committee would
need to provide assurance to the Council through regular reporting on
strategic risk.
[h] the Committee would encourage Council not to leave the Risk Register
entirely to the Committee, because assessment of risk was a key
element in the strategic planning with which Council was concerned.
Other committees might also have a role in relation to risks within their
areas of competence, as might Council itself.
[i] it was possible that a special meeting of the Committee would be
required to focus on the Risk Register and approaches to risk. It would
be appropriate to convene this following the conclusion of the PAR
process, and that the most appropriate timing would be following the
February 2010 meeting, to ensure all the appropriate amendments to
the Register were factored in. A report could then be given to Council.
[j] the Council/Executive Annual Residential Planning Conference in June
2010 would provide a suitable for joint discussion and review of the
Strategic Risk Register.
Action [a]: Professor P Ogden/P Rosenberg
[b]: Professor P Ogden/P Rosenberg
[c]: Professor P Ogden/E Hall
[d]: Professor P Ogden
[e]: Professor P Ogden/P Rosenberg
[f]: Professor P Ogden/P Rosenberg
[g]: Audit and Risk Committee members
[h] Audit and Risk Committee members
[i]: Adam Dawkins/David Thomas
[j]: Adam Dawkins
A&RC CONFIRMED MINUTES 101111 Page 9 of 13

Part 6: Public Interest Disclosure (Whistleblowing)
12. Public Interest Disclosure (Whistleblowing Incident) Confidential
(ARC2010/24)
2010.058 The Committee noted the confidential findings and actions taking in light of a
whistleblowing Investigation.
Part 7: Committee Management and Reporting
13. Audit and Risk Committee Annual Report to Council 2009-10 (ARC2010/25)
2010.059 The Committee considered the final draft of its Annual Report for 2009-10. A
number of minor amendments were recommended in relation to external audit
findings; risk management and Value for Money. The Secretary had
formulated a draft opinion for the Committee which would be considered along
with the amendments by circulation following the meeting. Council would
receive the final Report at its meeting on 23 November 2010 for onward
submission to HEFCE by 01 December 2010.
14. Committee Business Plan (ARC2010/26)
2010.060 The Committee noted its annual business plan and items for inclusion on the
agenda for the next meeting, which had arisen as actions from the meeting.
15. Date of next meeting
2010.061 The next meeting of the Committee would be held at 1500 hours on
Thursday 24 February 2011, Robert Tong Room.
Adam Dawkins
Assistant Registrar (Council and Governance)
Secretary, Audit and Compliance Committee
November 2010
A&RC CONFIRMED MINUTES 101111 Page 10 of 13

2010.034 [b]
[c]
2010.043 [a]
[b]
2010.046 [c]
[d]
AUDIT AND RISK COMMITTEE
ACTION SHEET
Serious Incident Reporting
a policy to be produced from the proposals, indicating
roles and responsibilities of key individuals and bodies,
including clarification of the respective roles and
responsibilities of the Chief Administrative Officer,
Secretary to Council and Chairs of Audit and Risk
Committee and Council in being notified of known or
alleged incidents.
reference to serious incident reporting to be incorporated
in the terms of reference of Audit and Risk Committee.
External Audit Report and Management Response
recommendation that an internal audit of the SITS
implementation project should be treated as a priority and
be undertaken before the end of the calendar year 2010,
as this was linked to the wider issue of data quality
assurances, to be audited subsequently.
an action plan on the 11 open recommendations in relation
to IT controls, should be presented to the next meeting of
the Committee.
Online purchasing: Agresso Compliance Update
the Committee would need to provide assurances to
Council that the College would not be liable for an
unexpected HM Revenue & Customs (HMRC) bill in
respect of PAYE. It was of the understanding that the
internal auditors would be conducting a review of College
controls in this area, and that a report on this should be
provided to the next meeting.
Agresso compliance to remain a routine agenda item, until
further notice and a report should be presented to the
Committee’s next meeting indicating: which payments
(e.g. regular utility bills) should be excluded from
compliance with Agresso; the percentage compliance level
after those were excluded; the action that QMSE was
taking to enforce compliance; and the results of the
internal audit of off payroll invoices.
Adam Dawkins
Wendy
Appleby/Richard
Shaw/Neil
Thomas
Chris Day/Dean
Curtis
Andrew Keeble/
Richard Shaw/
Neil Thomas
Andrew Keeble
A&RC CONFIRMED MINUTES 101111 Page 11 of 13

2010.049 [b]
[c]
[e]
[g]
2010.051 [a]
[b]
2010.057 [a]
[b]
[c]
[d]
[e]
Internal Audit Annual Report 2009-10
receipt of management responses was a priority to enable
the reports to be finalised for inclusion in the Annual
Report of Audit and Risk Committee to Council and
HEFCE.
the full report that had been produced by the internal
auditors on alleged breaches of the Fire Regulations which
was raised under the College’s Public Interest Disclosure
(Whistleblowing) Policy should be circulated to members
as a priority.
a report was required on the Students and Campus
Services follow-up visit for the next meeting of the
Committee, particularly in relation to action taken to
address the two priority 1 recommendations.
minor inconsistencies in the numbers of audits and
percentages of specific verdict levels required correction.
Internal Audit Plan 2010-11
to devise the full Internal Audit Plan and audit programme
would be devised as soon as possible after the meeting to
discuss risk with Elizabeth Hall and Professor Ogden
the SITS audit and HMRC audit to be concluded by the
end of the calendar year. A data quality audit to be
undertaken once the findings of the SITS audit were
released and responded to.
Revised Strategic Risk Register
consideration to be given to the introduction of indicators
showing risk appetite.
to indicate the process and timescale for bringing the
residual risk within the risk appetite.
the internal and external auditors to be consulted on
whether there are risks that might have been missed or
understated.
the Executive to consider what the early warning signs
would be of key risks being realised, so they could be
monitored, and how far high-impact but low-probability
risks were covered by business continuity arrangements.
it was important that the document was not overengineered.
A cover sheet should be produced to show
key risks (before and after controls) and risk appetite, in a
graphical way. This would be particularly helpful in
Andrew Keeble
Prof P Ogden
Brian China
Philip Lawson
Richard Shaw/
Neil Thomas
Prof P Ogden/P
Rosenberg
Prof P Ogden/P
Rosenberg
Prof P Ogden/
E Hall
Prof P Ogden
Prof P Ogden/P
Rosenberg
A&RC CONFIRMED MINUTES 101111 Page 12 of 13

[f]
[g]
[h]
[i]
[j]
communicating with Council.
to consider not only the higher residual risks but also lower
residual risks where that relied on a high level of control,
and high impact risks with low probability, as if they
crystallised they could be catastrophic.
to determine a process by which the Committee could
receive general and specific assurances on risk areas and
need to ensure that the Register was reviewed on a
periodic basis, through testing the Executive, drawing on
internal audit. The Committee would need to provide
assurance to the Council through regular reporting on
strategic risk.
the Committee to encourage Council not to leave the Risk
Register entirely to the Committee, because assessment
of risk was a key element in the strategic planning with
which Council was concerned. Other committees might
also have a role in relation to risks within their areas of
competence.
to convene a special meeting of the Committee, if
required, to focus on the Risk Register and approaches to
risk following the conclusion of the PAR process after the
February 2010 meeting.
the Council/Executive Annual Residential Planning
Conference in June 2010 would provide a suitable for joint
discussion and review of the Strategic Risk Register.
Prof P Ogden/P
Rosenberg
Audit and Risk
Committee
Members
Audit and Risk
Committee
Members
A Dawkins
A Dawkins
Adam Dawkins
Assistant Registrar (Council and Governance)
Secretary, Audit and Risk Committee
24 November 2010
A&RC CONFIRMED MINUTES 101111 Page 13 of 13