Report: Audit Committee - November 29, 2023

REPORT NUMBER 155 OF THE AUDIT COMMITTEE

WEDNESDAY, NOVEMBER 29, 2023

CLOSED SESSION 
 

1. Chair’s Remarks
   
   The Chair welcomed members and guests to the meeting. Members were remined that the Risk Assessment Table for Reporting to the Audit Committee was available in the Committee’s resource folder in OnBoard and that feedback on the table had been requested.
    
2. Reports of the Administrative Assessors
   
   Mr. Trevor Rodgers, Chief Financial Officer, provided an update on the data incident that had recently occurred at Ernst & Young (EY). He noted that the University community had been notified of the incident and that EY would be the primary contact regarding inquiries from the University community.
    

3. Risk Presentations:
   
   The Chair welcomed Professor Joe Wong, Vice-President, International, and Professor Sandy Welsh, Vice-Provost, Students, to the meeting.

   1. International student care
      
      Professor Wong provided a presentation on the International Student Care risk. He introduced three key areas of this risk: housing, immigration, and health and wellbeing, and then discussed the mitigation strategies in place to reduce the level of risk in each area. Highlights included:

   • The University maintained a first-year residence guarantee for students, with capability to expand beyond university housing capacity should demand exceed availability.
   • The University offered a vetted landlord program to international students to help find accessible and safe housing.
   • The University continued to engage with government to ensure IRCC processing delays and undue refusals of Canadian student permit applications were addressed appropriately so that the University could meet its diversification goals and enrolment targets.
   • An overview of the many physical and mental health supports across the tri-campus, which included the Telus Health Student Support and same day mental health services.
     
     Discussion
     
     The Committee discussed the key risk areas and the strategies the University had in place to mitigate each area. Professor Wong and Professor Welsh informed the Committee of innovative discussions underway such as repurposing eligible office buildings for residential use. Mr. Saporta also highlighted that the University assessed and acquired equity interest in buildings to provide further residential housing as part of its four corners strategy.
      
   2. Geo-Political Instability
      
      Professor Wong provided a presentation on the Geo-Political Instability risk. He provided an overview of the dimensions of geo-political risk and how it was developed from consultations with academic leaders across the University. Professor Wong also highlighted the University’s international student exposure by country inventory which was updated regularly and used as an aid to diversify the University’s international enrolment.
      
      Discussion
      
      In response to a member’s question, Professor Wong discussed the reputational risks associated with ongoing media coverage of the number of international students entering Canada. He noted that the University continued to assess international student growth strategically with consideration to housing availability, academic programs, and immigration advising services.
      
      The Chair thanked Professor Wong and Professor Welsh for their presentations.
       
4. External Auditors

   1. Audit Plan (including Engagement Letter for 2024 and Report on Non-Audit Services)
      
      The Committee received and reviewed the Audit Plan, including Engagement Letter for 2024 and Report on Non-Audit Services.
      
      Mr. Rodgers advised that the Engagement Letter set out the terms of the engagement with Ernst and Young, a summary of the audit approach for 2024, and areas of audit emphasis and risk. He noted that the fee increase, compared to the previous year, was mainly due to the inflationary environment.
      
      Ms Diana Brouwer and Ms Joyce Yu from Ernst & Young reported that the approach taken in respect of the 2024 audit plan had been consistent with the previous year and provided an overview of the audit plan which included its scope and magnitude. Ms Yu highlighted the estimated planning materiality at 2.5% of estimated total expenses and noted that they would report on any unadjusted differences more than $4.65 million. She then discussed the audit emphasis for the upcoming year which included: revenue recognition, risk of management override of controls, pension and other retirement post-employment benefits, investments, and legal matters.
      
      Discussion
      
      In response to a question, Ms Brouwer noted that US Generally Accepted Accounting Principles (GAAP) reporting was not included for the upcoming audit year as the University was only required to submit a US GAAP report every three years. The next US GAAP report would be completed in 2026.
       

IT WAS RESOLVED

THAT the Audit Committee accept the external auditors’ audit plan and engagement letter for the University for the year ended April 30, 2024, as outlined in the report from Ernst & Young dated November 22, 2023.

2. Report on Audit Fees
   
   Mr. Rodgers noted that the Report outlined the audit fees charged to Ontario universities from 2017-18 to 2021-22 and had been provided for background and context.
    

5. Status Update on Information Security
   
   The Chair welcomed Mr. Bo Wandschneider, Chief Information Officer, and Mr. Isaac Straley, Chief Information Security Officer to the meeting.
   
   Mr. Ron Saporta, Acting Vice-President, Operations, informed Committee members that Mr. Straley had accepted a new position at the University of Washington. He noted that while Mr. Straley’s final regular day of work with the University was December 1, 2023, and he would remain with the University in a transition plan until January 19, 2024. He further noted that while recruitment was ongoing, an Acting CISO had been appointed to assist with the transition.
   
   Mr. Straley provided a presentation on the University’s recently released Information Security Strategy. The long-term strategy provided a shared direction for information security and privacy for the University, enabled more foundational institutional services and platforms, and empowered units to drive discipline-specific priorities.
   
   The presentation included major new initiatives targeted for 2023-24, such as a strategic partnership to deliver tri-campus network firewall services; new vulnerabilities scanners and local information security risk dashboards; risk assessment software; and direct support for research with cyber security compliance requirements. The presentation also included priorities for the following two years, which included tri-campus technology and expert response team for faster detection and response to security issues; share cloud security infrastructure for academic and shared services; and technical debt and disaster recovery.
   
   In response to a member’s question, Mr. Straley contemplated the challenges and opportunities for the University in the coming years and expressed the need for the University to review its data governance practices.
   
   The Committee thanked Mr. Straley for his dedication and transformative leadership at the University for information security.
    
6. Annual Administrative Accountability Reports, 2022-2023
   
   The Committee received and reviewed the Annual Administrative Accountability Reports, 2022-2023.
   
   Mr. Samuel Sanish, Controller & Director of Financial explained that all faculty and staff with financial responsibilities, including the President, had been required to complete an Accountability Report for their supervisor. The President had submitted his report to the Chair of Governing Council.
    
7. Enrolment Report to the Ministry of Colleges and Universities, 2022-2023
   
   The Committee received and reviewed the Enrolment Report to the Ministry of Colleges and Universities (“MCU”), 2022-2023.
   
   Mr. Rodgers reminded members that the report was used to confirm the accuracy of enrolment data on which grants to the University were based. In 2022-23, eligible for funding FTE enrolment decreased by 1.6% and Weighted Grant Units (WGUs) enrolment decreased by 1.3% over the previous year. The change was primarily due to anticipated decreases in summer enrolment relative to the exceptionally high enrolment in the previous two summers during the COVID-19 pandemic. Overall, enrolment remained within the University’s funded corridor and given the current freeze on funding for domestic general enrolment growth, the University planned for minimal annual changes in WGUs.
    
8. MCU Financial Accountability Framework 2023
   
   Mr. Rodgers reported that the Ontario Government had been finalized its common financial health framework – a tool to help University’s administrators and governance assess institutional financial health, serve as an early warning system in cases of financial distress, and outline appropriate plans to address and mitigate financial risks. 
   
   The Committee received a presentation on the expected financial risk assessment of the University of Toronto as of April 30, 2023, based on the new MCU Financial Accountability Framework.
   
   Discussion
   
   In response to a member’s question, Mr. Rodgers indicated that as blue-ribbon panels had been undertaking similar reviews across many Canadian provinces, the sector appeared supportive of incorporating financial health indicators into its assessment and reporting requirements.
    
9. Internal Audit: Semi-Annual Activity Report for the Six Months Ended October 31, 2023
   
   The Committee received and reviewed the Internal Audit: Semi-Annual Activity Report for the Six Months Ended October 31, 2023.
   
   Mr. Alex Matos, Director of Internal Audit, highlighted the following key points:

• The Annual Audit Plan 2023-2024 had progressed as planned, with most projects completed, or in progress.
• Key risks identified related for the most part to inconsistent processes across the community, information technology as a resource for efficiency and improvements in general oversight.
• Internal Audit had experienced increased engagement with follow up action plans as a result of a focus on more significant items and the expanded dialogue with management.
• The continuous audit function (including both operating and research funds) continued to evolve with adjustments made to enhance the focus of sampling, prioritize the gaps identified to ensure a focus on significant risks, and leverage the reporting to educate the community.
• Assistance continued to be provided to E&Y in connection with the audit of the University’s 2023 financial statements, enrolment audit and program audits.
   

10. Report of the Previous Meeting – Report Number 154 (September 20, 2023)
    
    The report of the previous meeting was approved.  
     
11. Business Arising from the Report of the Previous Meeting
    
    There was no business arising from the report of the previous meeting. 
     
12. Date of the Next Meeting: March 13, 2024, 4:00 p.m. – 6:00 p.m.
    
    The Chair confirmed that the next meeting of the Committee would be held on March 13, 2024. 
     
13. Other Business
    
    There was no other business. 
     

The Committee moved In-Camera. 
 

14. Internal Auditor: Private meeting
    
    Members of the administration absented themselves and the Committee met privately with Mr. Alex Matos, Director Internal Audit.
     

15. Committee Members Alone
    
    Committee members discussed topics of interest.