REPORT NUMBER 138 OF THE AUDIT COMMITTEE
June 17, 2020
To the Business Board,
University of Toronto
Your Committee reports that it held a virtual meeting on Wednesday, June 17, 2020, at 4:00 p.m. with the following members present:
PRESENT:
Christopher Thatcher (Chair); Robert Boeckner; Janet Ecker (Vice-Chair); Sue Graham-Nutter; Kathryn Jenkins; Andrew Szende
NON-VOTING ASSESSORS:
Mark L. Britt, Director, Internal Audit; Sheila Brown, Chief Financial Officer; Sheree Drummond, Secretary, Governing Council; Scott Mabury, Vice President, Operations and Real Estate Partnerships
SECRETARIAT:
Anwar Kazimi, Deputy Secretary of the Office of the Governing Council; Tracey Gameiro, Secretary, Audit Committee; Patrick McNeil, Assistant Secretary, Office of the Governing Council
IN ATTENDANCE:
Diana Brouwer, Ernst & Young; Brian Lawson, Chair of Business Board; Daniel Ottini, Deputy Director, Internal Audit; Pierre Piché, Controller and Director of Financial Services; Isaac Straley, Chief Information Security Officer; Bo Wandschneider, Chief Information Officer; Joyce Wu, Ernst & Young
Audit Committee met in Closed Session.
ITEM 2 WAS APPROVED. ITEMS 4 AND 5 ARE RECOMMENDED
TO THE BUSINESS BOARD FOR APPROVAL. ALL OTHER ITEMS
ARE REPORTED TO THE BUSINESS BOARD FOR INFORMATION.
Pursuant to section 6.1 of the audit committee terms of reference,
consideration of items 11 and 12 took place in camera.
- Chair’s Remarks
The Chair welcomed members and guests to the final meeting of the governance year and reminded them that the Committee met in closed session and that the materials were confidential.
- Report of the Previous Meeting
Report Number 137, from the meeting of April 27, 2020, was approved.
- Business Arising from the Report of the Previous Meeting
There was no business arising from the report of the previous meeting.
- Audited Financial Statements for the Year Ended April 30, 2020
- Financial Report Presentation
Ms. Sheila Brown, Chief Financial Officer, provided an introduction to the Financial Report. She recognized the tireless efforts of Dr. Pierre Piché, Controller and Director of Financial Services and the work of his team, as well as the contributions of the Internal Audit Department, UTAM, and the External Auditors in completing the audit successfully despite the challenges presented by COVID-19. Ms. Brown also highlighted the changes made to simplify the financial statements to make them easier to read and more explanatory. She noted that the two key themes of the statements were a focus on capital infrastructure and the impacts of COVID-19.
Dr. Piché’s presentation of the Financial Report for the year ended April 30, 2020, highlighted the following:
- Revenues for the year ended April 30, 2020 were $3.6 billion and expenses were $3.2 billion for a net income of $441 million. These figures were largely the result of growth in student revenue and research activity. There was also as well a positive net income over the past 5 years.
- The number of students at the University had grown by 6.7%, over the past 5 years.
- Net assets decreased by $19 million to $6.4 billion, mainly as the result of $441 million in net income, a decrease of $374 million due to lower-than-expected investment returns on pension plan assets, $120 million decrease in endowment investment income, offset by endowed donations of $34 million.
- The deficit of $124 million was largely due to internal financing of capital construction in accordance with the University’s debt strategy.
- The cumulative operating surplus for the year ended April 30, 2020 decreased by $5 million to $29 million as compared to $34 million last year. The long-range operating budget called for a break even position. .
Financial Impact of COVID-19
- Endowments decreased by $135 million as investment returns did not meet targets given the adverse impact of the pandemic on global commercial activity.
- Pension plan assets decreased by $376 million primarily due to lower-than-expected investment returns given the adverse impact of the pandemic on global commercial activity.
- Revenues from residence, parking, and good and service operations decreased by a combined $12 million due to reduced activities on campus.
Changes to Notes in the Financial Statements
- Note 3: Investments – information on interest rate SWAPS was removed as it was no longer relevant.
- Note 15: Donations – clarified that there were pledges that were not recorded in the financial statements.
- Note 22: COVID-19 – increased focus on risk and what was done to mitigate it.
Discussion
Dr. Piché and Ms. Brown addressed the following in response to questions from members:
- With assistance from UTAM, investment valuations were examined to determine if there were any impairment in the value of private investments;
- Industry analysis was undertaken to gain assurance in areas that could be problematic post-December 2019;
- Collection activities and service charges were suspended on outstanding student accounts;
- Students with outstanding accounts had been allowed to register given the exceptional circumstances created by COVID;
Members thanked Dr. Piché and Ms. Brown and commended the Financial Services team for their work in preparing the Financial Statements.
b. External Auditor’s Report on Audit Results
Ms. Diana Brouwer and Ms. Joyce Yu of Ernst & Young presented a high-level overview of the External Auditors’ Report of Audit Results which provided the Committee with a summary of the audit procedures and the discussion with management that supported their unqualified audit opinion. In the course of the presentation, the following was highlighted:
- the changes in the audit strategy were consistent with the audit plan;
- areas of audit emphasis included how the University recorded its revenues and accounts for its investments, employee future benefits and capital projects;
- there were no major deviations from the audit plan and scope during the execution of the audit, and no exceptions noted;
- the auditors performed additional procedures to satisfy themselves of the authenticity of the documentation provided given this year’s audit was performed remotely;
- procedures were conducted to ensure that the disclosure impact of COVID-19 was appropriate.
- there were no uncorrected or corrected misstatements as a result of the audit.
In response to members’ questions, Ms. Brouwer and Ms. Yu noted that work on data analytics continued to evolve, with the level of sophistication increasing commensurate with the extent of data gathered. With regard to the extent of involvement from specialists given the circumstances presented by the pandemic, the auditors stated that while there was more involvement from their Financial Services Organization than in other years, there was no more involvement from other specialists than would normally have been the case.
The Committee agreed with the views expressed by the auditors. Inquiries were also made with respect to the risk of material misstatements due to fraud and suspected fraud. There were no significant matters that arose from the audit and no corrected or uncorrected errors noted. The Committee was also informed by the auditors that they received excellent and on-going cooperation from management. All required audit communications were provided to the Committee by the auditors. The Chair confirmed that the Committee was not aware of any concerns of fraud or non-compliance.
The audited financial statements were examined in detail by the Committee, and the audit results indicated that there were no issues to bring to the Committee’s attention.
c. Legal Claims
The Committee received the 2019-2020 summary of legal actions against the University exceeding $500,000 prepared by the administration. Dr. Piché reported there had been an overall decrease in long-term disability (LTD) cases as compared to prior years.
d. External Auditors: Private Meeting
The Committee met privately with the external with no University staff present. No issues were identified for the Business Board’s attention.
THE COMMITTEE MOVED IN CAMERA
Members of the administration, the Secretariat, and the Internal Audit team absented themselves. Ms. Brouwer was invited to advise of “any problems encountered by the auditors, any restrictions on their work, the co-operation received in the performance of their duties by the administration and the Internal Audit Department, and any matters requiring discussion arising from the auditors’ findings.” (Audit Committee Terms of Reference, Section 5.1.2)
The Committee returned to closed session.
The Chair reported that there had been no matters arising from the Committee’s in camera meeting with the external auditors that would require action.
e. Discussion and Recommendation
The Chair thanked Ms. Brown and Dr. Piché and commended the Financial Services team for their work in preparing the financial statements.
On a motion duly moved, seconded and carried
YOUR COMMITTEE RECOMMENDS
THAT the University of Toronto audited financial statements for the fiscal year
ended April 30, 2020 be approved.
- Appointment of the External Auditors for 2020-2021
Dr. Piché informed the Committee of the process followed in gathering and compiling feedback about the external auditors. He indicated that those surveyed included members of the Financial Services Team, senior management at U of T Press, and members of the Internal Audit team. Dr. Piché reviewed the Auditor Assessment Template and highlighted the following areas of the evaluation:
- Professional Skepticism and Objectivity
- Quality of Engagement Team
- Quality of Communications
- Quality of Service
Following these introductory remarks regarding the review process, Ernst & Young excused themselves and discussions of the appointment of the external auditor for the 2020-2021 year continued in their absence.
Dr. Piché reported that the administration was very pleased with the work of Ernst & Young. He commented on their excellent knowledge of the university sector, their responsiveness, proactive approach, and their high levels of technical abilities. Dr. Piché stated that the level of skepticism exhibited by the external auditors was especially noteworthy this year given the audit was performed remotely. He reported that the external auditors questioned the impact of the pandemic and economic slowdown on the current years’ results, as well as its impact on the institution’s future sustainability.
Ms. Brown added her support for the re-appointment of Ernst & Young describing them as knowledgeable, engaged external auditors who delivered a lot of value and worked collaboratively with the University to ensure that issues and changes were dealt with as they arose which increased the quality of communications.
On motion duly moved, seconded and carried
YOUR COMMITTEE RECOMMENDS
THAT Ernst & Young LLP be re-appointed as external auditors of the University of
Toronto for the fiscal year ending April 30, 2021; and
THAT Ernst & Young LLP be re-appointed as external auditors of the University of
Toronto pension plan for the fiscal year ending June 30, 2021.
- Internal Audit Annual Report (to April 30, 2020)
- Annual Report, 2019-2020
Mr. Mark Britt, Director, Internal Audit, highlighted the following key points from the Internal Audit Annual Report Summary for the year ended April 30, 2020:
- completion of the audit plan and results yielded were positively impacted by the continued investment in automation;
- recommendations included in the audit reports emphasized the need to improve the consistency with which internal control processes and risk management activities were performed;
- results from follow-up reviews indicated that management had implemented appropriate actions for the risks noted in the audit reports;
In closing, Mr. Britt reported that the newly upgraded web-based audit management system Teammate+ would deliver increased visibility, consistency and efficiency both at the departmental and organizational level and offered powerful project control and reporting capabilities.
In response to a members’ question Mr. Britt indicated that IT risk continued to be an area of increased monitoring, especially in light of increased online activity as more business was conducted remotely. He assured members that identified areas of risk were discussed with the Chief Information Officer (“CIO”) and Chief Information Security Officer (“CISO”), who acknowledged similar concerns. Both the CIO and CISO expressed the desire for greater co-ordination and information sharing with the Internal Audit group moving forward.
b. Audit Plan, 2020-2021
Mr. Britt reviewed the Audit Plan for 2020-2021 with the Committee, highlighting the following:
- There would be 11,500 direct audit hours from a staff complement of 10.0 FTE.
- The focus would be on enterprise, divisional and departmental risks, and would include academic, administrative and student services functions on the three campuses; Department audits, Continuous Audit, Restricted Funds Compliance Audit, Information Systems reviews, Follow-up reviews, and Investigations and Advisory Services.
- Assistance would also be provided to Ernst & Young as they conducted their external audit.
- Audits would be selected with reference to the 2020 Risk Report, consultations, senior and operational management requests and internal audit risk assessments.
In reply to a member’s questions regarding the changing work environment with more transactional work being conducted remotely, Mr. Britt indicated that the plan had been developed with those considerations in mind. Mr. Britt also provided information on the follow-up process, explaining that the process was to return to the unit 9-12 months post audit, to review the action plans the department had committed to in respect of the top 5 risks identified in the audit report. Where recommendations have been implemented or were in progress, the follow-up review was concluded. The exception being with respect to high level risks, in which case a second follow up was done. Should a department not take action towards addressing the risks identified, Mr. Britt stated that the recourse was to advise the area’s one level up report. Should there be unmitigated risks that the auditor views as considerable, but the unit was willing to accept, the auditor would engage in further discussion with and seek direction from departmental superiors and senior administrators. He indicated that in the few cases where this had happened, it had resulted in action being taken.
Members praised Mr. Britt and his team for the Annual Report and the development of the 2020-2021 Audit Plan.
- Annual Report: Information Security and the Protection of Digital Assets
Members received the first Annual Report on Information Security and the Protection of Digital Assets for information. Mr. Straley provided an overview of the following:
- the framework established to address the complexities of assessing information security risk across the diverse and distributed UT and data management processes of the tri-campus;
- the external assessment of the overall information security program conducted over the Fall 2019 and Winter 2020;
- the Information Risk Self Assessment (IRSA) program developed to complete the second part of the assessment and also used to fulfill the policy requirement that units create an information risk management plan;
- “move the needle” projects initiated to address tri-campus security needs and shared risk areas;
- outreach initiatives to build relationships of trust across tri-campus divisions and faculty;
- efforts undertaken or planned to establish a national presence for the University’s security program, specifically focusing on Canadian Shared Security Operations Centre (CanSSOC)
In conclusion, Mr. Straley outlined the following priorities for 2020-2021:
- wide adoption of Multi-factor Authentication;
- creating multi-year strategic roadmap and resources strategies;
- strengthening incident response by enhancing local resources and continuing CanSSOC integration efforts;
- focused attention on developing divisional security programs, including annual risk reports, data inventories, and deployment of local security resources;
There were no questions from members.
- Reports of the Administrative Assessors
Professor Scott Mabury, Vice-President Operations & Real Estate Partnerships provided an update as of June 17, 2020 on the pinging implications and impacts of COVID-19 on University operations. Highlights of his report included:
- plans for re-entry to campus which continued to be developed in line with public health advisory guidelines and included increased sanitizing of shared surfaces, assessment of ventilation systems, provision of facemasks, and installation of physical barriers to facilitate social distancing;
- initiatives to support faculty and staff working from home, notably those with child care responsibilities;
- an increased focus on capital projects to get as construction work done while campus remained relatively vacant;
- supports for faculty for online delivery of course content, with continued efforts towards increasing in person learning on campus to the extent possible;
- occupancy planning for classrooms, work space, and residences;
- financial impacts should international students be restricted from travelling abroad;
- continued discussions with government to communicate financial needs, and instill confidence in the University’s ability to manage resumption of campus activities safely and responsibly;
There were no additional reports from the Committee’s Administrative Assessors.
At 6:23 p.m., the Chair advised that a motion to extend the meeting would be needed.
Extension of Time
On motion duly moved, seconded and carried
YOUR COMMITTEE RESOLVED THAT
The time of adjournment be extended by thirty minutes.
- Date of the Next Meeting
Members were reminded that the next meeting was scheduled for Wednesday, September 16, 2020, 4:00 – 6:00 p.m.
- Other Business
There was no other business.
Recognition of the Audit Committee Chair
Mr. Brian Lawson, Chair of the Business Board, recognized the outgoing Chair, Chris Thatcher, and formally thanked him for his contributions to governance as a member of the Business Board since 2011, member of the Audit Committee since 2015, and, in particular, as Chair of the Committee from 2018-2020. He stated that Mr. Thatcher had been an excellent Chair, managing meetings in an efficient and respectful manner, and encouraging members to ask questions and share their views at meetings.
As a token of appreciation and consistent with tradition, Mr. Lawson presented a chair to Mr. Thatcher in recognition of exemplary service and leadership. Members of the Committee applauded Mr. Thatcher’s recognition.
The Chair thanked, members, assessors, the internal auditors, and the Secretariat for their time and efforts devoted to the Committees throughout the year.
THE COMMITTEE MOVED IN CAMERA.
- Internal Auditor – Private Meeting
Members of the administration as well as the Committee Secretary absented themselves and the Committee met privately with the Director of Internal Audit. There were no issues to be brought to the Business Board’s attention from this meeting.
- Committee Members Alone
Committee members discussed topics of interest and concern.
The Committee returned to Closed Session.
The meeting adjourned at 6:48 p.m.
June 19, 2020