Report: Audit Committee - November 29, 2023

Board Room, Simcoe Hall, 2nd floor



To the Business Board,
University of Toronto,

Your Audit Committee reports that it held a meeting in Chairs’ Board Room, 2nd floor Simcoe Hall, on November 29, 2023, at 4:00 p.m. with the following members present:

PRESENT: Joanne McNamara (Chair), Paul Huyer (Vice-Chair), Sandra Hanington (Vice-Chair of Governing Council), Sue Graham-Nutter, Scott MacKendrick, Brian Madden, Rajiv Mathur, Rima Ramchandani


Alex Matos, Director of Internal Audit
Sheree Drummond, Secretary of the Governing Council
Ron Saporta, Acting Vice President, Operations

Trevor Rodgers, Chief Financial Officer

SECRETARIAT:  Timothy Harlick, Secretary

Joe Wong (Vice-President, International), Sandy Welsh (Vice-Provost, Students), Gwen Burrows (Assistant Vice-President, International Engagement & Impact), Michelle Beaton (Director, International Relations), Sanish Samuel (Controller and Director of Financial Services), Bo Wandschneider (Chief Information Officer), Isaac Straley (Chief Information Security Officer), Diana Brouwer (Ernst & Young), Joyce Yu (Ernst & Young)

Audit Committee met in Closed Session.  

Pursuant to section 38 of By-Law Number 2,
consideration of items 14 to 15 will take place in camera.



  1. Chair’s Remarks

    The Chair welcomed members and guests to the meeting. Members were remined that the Risk Assessment Table for Reporting to the Audit Committee was available in the Committee’s resource folder in OnBoard and that feedback on the table had been requested.
  2. Reports of the Administrative Assessors

    Mr. Trevor Rodgers, Chief Financial Officer, provided an update on the data incident that had recently occurred at Ernst & Young (EY). He noted that the University community had been notified of the incident and that EY would be the primary contact regarding inquiries from the University community.
  3. Risk Presentations:

    The Chair welcomed Professor Joe Wong, Vice-President, International, and Professor Sandy Welsh, Vice-Provost, Students, to the meeting.

    1. International student care

      Professor Wong provided a presentation on the International Student Care risk. He introduced three key areas of this risk: housing, immigration, and health and wellbeing, and then discussed the mitigation strategies in place to reduce the level of risk in each area. Highlights included:

    • The University maintained a first-year residence guarantee for students, with capability to expand beyond university housing capacity should demand exceed availability.
    • The University offered a vetted landlord program to international students to help find accessible and safe housing.
    • The University continued to engage with government to ensure IRCC processing delays and undue refusals of Canadian student permit applications were addressed appropriately so that the University could meet its diversification goals and enrolment targets.
    • An overview of the many physical and mental health supports across the tri-campus, which included the Telus Health Student Support and same day mental health services.


      The Committee discussed the key risk areas and the strategies the University had in place to mitigate each area. Professor Wong and Professor Welsh informed the Committee of innovative discussions underway such as repurposing eligible office buildings for residential use. Mr. Saporta also highlighted that the University assessed and acquired equity interest in buildings to provide further residential housing as part of its four corners strategy.
    1. Geo-Political Instability

      Professor Wong provided a presentation on the Geo-Political Instability risk. He provided an overview of the dimensions of geo-political risk and how it was developed from consultations with academic leaders across the University. Professor Wong also highlighted the University’s international student exposure by country inventory which was updated regularly and used as an aid to diversify the University’s international enrolment.


      In response to a member’s question, Professor Wong discussed the reputational risks associated with ongoing media coverage of the number of international students entering Canada. He noted that the University continued to assess international student growth strategically with consideration to housing availability, academic programs, and immigration advising services.

      The Chair thanked Professor Wong and Professor Welsh for their presentations.
  4. External Auditors
    1. Audit Plan (including Engagement Letter for 2024 and Report on Non-Audit Services)

      The Committee received and reviewed the Audit Plan, including Engagement Letter for 2024 and Report on Non-Audit Services.

      Mr. Rodgers advised that the Engagement Letter set out the terms of the engagement with Ernst and Young, a summary of the audit approach for 2024, and areas of audit emphasis and risk. He noted that the fee increase, compared to the previous year, was mainly due to the inflationary environment.

      Ms Diana Brouwer and Ms Joyce Yu from Ernst & Young reported that the approach taken in respect of the 2024 audit plan had been consistent with the previous year and provided an overview of the audit plan which included its scope and magnitude. Ms Yu highlighted the estimated planning materiality at 2.5% of estimated total expenses and noted that they would report on any unadjusted differences more than $4.65 million. She then discussed the audit emphasis for the upcoming year which included: revenue recognition, risk of management override of controls, pension and other retirement post-employment benefits, investments, and legal matters.


      In response to a question, Ms Brouwer noted that US Generally Accepted Accounting Principles (GAAP) reporting was not included for the upcoming audit year as the University was only required to submit a US GAAP report every three years. The next US GAAP report would be completed in 2026.


THAT the Audit Committee accept the external auditors’ audit plan and engagement letter for the University for the year ended April 30, 2024, as outlined in the report from Ernst & Young dated November 22, 2023.

  1. Report on Audit Fees

    Mr. Rodgers noted that the Report outlined the audit fees charged to Ontario universities from 2017-18 to 2021-22 and had been provided for background and context.
  1. Status Update on Information Security

    The Chair welcomed Mr. Bo Wandschneider, Chief Information Officer, and Mr. Isaac Straley, Chief Information Security Officer to the meeting.

    Mr. Ron Saporta, Acting Vice-President, Operations, informed Committee members that Mr. Straley had accepted a new position at the University of Washington. He noted that while Mr. Straley’s final regular day of work with the University was December 1, 2023, and he would remain with the University in a transition plan until January 19, 2024. He further noted that while recruitment was ongoing, an Acting CISO had been appointed to assist with the transition.

    Mr. Straley provided a presentation on the University’s recently released Information Security Strategy. The long-term strategy provided a shared direction for information security and privacy for the University, enabled more foundational institutional services and platforms, and empowered units to drive discipline-specific priorities.

    The presentation included major new initiatives targeted for 2023-24, such as a strategic partnership to deliver tri-campus network firewall services; new vulnerabilities scanners and local information security risk dashboards; risk assessment software; and direct support for research with cyber security compliance requirements. The presentation also included priorities for the following two years, which included tri-campus technology and expert response team for faster detection and response to security issues; share cloud security infrastructure for academic and shared services; and technical debt and disaster recovery.

    In response to a member’s question, Mr. Straley contemplated the challenges and opportunities for the University in the coming years and expressed the need for the University to review its data governance practices.

    The Committee thanked Mr. Straley for his dedication and transformative leadership at the University for information security.
  2. Annual Administrative Accountability Reports, 2022-2023

    The Committee received and reviewed the Annual Administrative Accountability Reports, 2022-2023.

    Mr. Samuel Sanish, Controller & Director of Financial explained that all faculty and staff with financial responsibilities, including the President, had been required to complete an Accountability Report for their supervisor. The President had submitted his report to the Chair of Governing Council.
  3. Enrolment Report to the Ministry of Colleges and Universities, 2022-2023

    The Committee received and reviewed the Enrolment Report to the Ministry of Colleges and Universities (“MCU”), 2022-2023.

    Mr. Rodgers reminded members that the report was used to confirm the accuracy of enrolment data on which grants to the University were based. In 2022-23, eligible for funding FTE enrolment decreased by 1.6% and Weighted Grant Units (WGUs) enrolment decreased by 1.3% over the previous year. The change was primarily due to anticipated decreases in summer enrolment relative to the exceptionally high enrolment in the previous two summers during the COVID-19 pandemic. Overall, enrolment remained within the University’s funded corridor and given the current freeze on funding for domestic general enrolment growth, the University planned for minimal annual changes in WGUs.
  4. MCU Financial Accountability Framework 2023

    Mr. Rodgers reported that the Ontario Government had been finalized its common financial health framework – a tool to help University’s administrators and governance assess institutional financial health, serve as an early warning system in cases of financial distress, and outline appropriate plans to address and mitigate financial risks. 

    The Committee received a presentation on the expected financial risk assessment of the University of Toronto as of April 30, 2023, based on the new MCU Financial Accountability Framework.


    In response to a member’s question, Mr. Rodgers indicated that as blue-ribbon panels had been undertaking similar reviews across many Canadian provinces, the sector appeared supportive of incorporating financial health indicators into its assessment and reporting requirements.
  5. Internal Audit: Semi-Annual Activity Report for the Six Months Ended October 31, 2023

    The Committee received and reviewed the Internal Audit: Semi-Annual Activity Report for the Six Months Ended October 31, 2023.

    Mr. Alex Matos, Director of Internal Audit, highlighted the following key points:
  • The Annual Audit Plan 2023-2024 had progressed as planned, with most projects completed, or in progress.
  • Key risks identified related for the most part to inconsistent processes across the community, information technology as a resource for efficiency and improvements in general oversight.
  • Internal Audit had experienced increased engagement with follow up action plans as a result of a focus on more significant items and the expanded dialogue with management.
  • The continuous audit function (including both operating and research funds) continued to evolve with adjustments made to enhance the focus of sampling, prioritize the gaps identified to ensure a focus on significant risks, and leverage the reporting to educate the community.
  • Assistance continued to be provided to E&Y in connection with the audit of the University’s 2023 financial statements, enrolment audit and program audits.
  1. Report of the Previous Meeting – Report Number 154 (September 20, 2023)

    The report of the previous meeting was approved.  
  2. Business Arising from the Report of the Previous Meeting

    There was no business arising from the report of the previous meeting. 
  3. Date of the Next Meeting: March 13, 2024, 4:00 p.m. – 6:00 p.m.

    The Chair confirmed that the next meeting of the Committee would be held on March 13, 2024. 
  4. Other Business

    There was no other business. 

The Committee moved In-Camera. 

  1. Internal Auditor: Private meeting

    Members of the administration absented themselves and the Committee met privately with Mr. Alex Matos, Director Internal Audit.
  2. Committee Members Alone

    Committee members discussed topics of interest.  

The meeting adjourned at 6:04 p.m.

December 4, 2023