Report: Audit Committee - June 19, 2023

REPORT NUMBER 153 OF THE AUDIT COMMITTEE

JUNE 19, 2023

Present: Joanne McNamara (Chair), Teodora Dechev (Vice-Chair) *, David Bowden, Sue Graham-Nutter, Paul Huyer*, Rajiv Mathur, Lara Zink

Regrets: Rima Ramchandani

Non-Voting Assessors:
Alex Matos, Director of Internal Audit
Sheree Drummond, Secretary of the Governing Council
Scott Mabury, Vice President, Operations and Real Estate Partnerships
Trevor Rodgers, Chief Financial Officer

Secretariat:
Timothy Harlick, Secretary

In Attendance:
Isaac Straley, Chief Information Security Officer (for item 2)
Sanish Samuel, Controller and Director of Financial Services 
Daniel Ottini, Deputy Director, Internal Audit
Audelyn Budihardjo, Internal Audit Supervisor
Diana Brouwer, Ernst & Young 
Joyce Yu, Ernst & Young 
Helen Pham, Ernst & Young *

*Attended remotely

Audit Committee met in Closed Session

ITEM 7 WAS APPROVED. ITEMS 3 AND 4 ARE RECOMMENDED TO THE BUSINESS BOARD FOR APPROVAL.  ALL OTHER ITEMS ARE REPORTED TO THE BUSINESS BOARD FOR INFORMATION.

Pursuant to section 6.1 of the Audit Committee terms of reference, consideration of items 11 and 12 took place in camera.

1. Chair’s Remarks
   
   
   The Chair welcomed members and guests to the final meeting of the governance year. She reminded those in attendance that the Committee met in closed session and that the materials were confidential.
    
2. Annual Report: Information Security and the Protection of Digital Assets
   
   Members received the Annual Report on Information Security and the Protection of Digital Assets for information. The Report “Secure Together”, focused on the fundamental shift to a more shared approach to reduce risk. Mr. Straley discussed the concerted tri-campus effort to define UofT’s information security strategy that would provide a shared direction for information security over the next four years. Some key accomplishments included the adoption of next-generation anti-virus protection by UTM, data access modernization at KPE, and enhancements to incident response capabilities at UTSC.
   
   Mr. Straley reported that key focus areas for the coming year included security awareness, development of unit-level risk management programs, and continued participation in the Canadian Shared Security Operations Centre (CanSOC) and in the Broader Public Sector cyber security expert panel.
   
   Discussion
   
   Following the presentation, members discussed with Mr. Straley:

• the complexity of the cybersecurity protocols and information security plan required given the size and decentralized nature of the University.
• While information security continued to become more sophisticated at the University, the related risks had also been steadily increasing.
• Opportunities existed to consolidate areas of the University into the shared services model which would further reduce network security risks.
• Funding for shared services was adequate, and work continued to ensure appropriate resources were allocated in areas where shared services was not involved.
• The Office of the Chief Information Security Officer continued to actively engage with the University community on the need to adequately protect against the threat of ransomware and other cyber attacks.
• An Information Security Dashboard similar to the dashboard regularly provided to the Audit Committee was being developed with the divisions to provide consistent metrics for evaluation.
• Personnel attraction and onboarding had been a topic of discussion and remained an ongoing point of focus.
  
  The Chair thanked Mr. Straley for his presentation.
   

3. Audited Financial Statements for the Year Ended April 30, 2023
   1. Financial Report Presentation
      
      The Committee received a presentation of the Audited Financial Statements from Mr. Trevor Rodgers, Chief Financial Officer, and Mr. Sanish Samuel, Controller and Director of Financial Services. The efforts of the Financial Services team were recognized, as well as the contributions of the Internal Audit Department and the External Auditors in completing the audit successfully.
      
      The presentation of the Financial Report for the year ended April 30, 2023, highlighted the following:

• for the year ended April 30, 2023, the University recorded a positive net income of $551 million (12.9% of revenues);
• The positive net income also included funds that had been set aside for future capital projects and other priorities, resulting in an increase of $395 million in central and divisional reserves;
• The University received $308 million in fundraising pledges during the year, which included $256 million in pledges and gifts (donations) and $52 million in philanthropic research grants from non-government sources;
• The University continued to invest in vital capital infrastructure with $536 million in capital asset additions;
• Enrolment continued to be strong, increasing 7% over the last 5 years providing $2.2 billion in revenues from student fees. Government grants provided in support of student enrolments amounted to $719 million. Together these two sources accounted for 68.4% of revenues for the year;
• $2.2 billion was spent on salaries and employee benefits comprising 59.9% of the University’s $3.7 billion in expenses; and
• Net assets increased by $531 million to a total of $9.03 billion, This was net of the amount reported as a deficit ($483 million) largely due to the internal financing of capital construction in accordance with the University’s debt strategy.
  
  Discussion
  
  Mr. Rodgers and Mr. Samuel addressed the following in response to questions from members:
• The University included projected student fee revenues as part of its budgeting process. These projections included scenarios of increasing, decreasing and a leveling off in growth potential.
• The University remained on track with fundraising targets in the Defy Gravity campaign and was increasing staffing levels to meet its ambitious goals.
  
  A Supplementary Report was also received by the Committee for information.
  
   

2. External Auditors’ Report on Audit Results
   
   Ms Diana Brouwer, Ms Joyce Yu and Ms Helen Pham of Ernst & Young presented a high-level overview of the External Auditors’ Report of Audit Results which provided the Committee with a summary of the audit procedures and the discussion with management that supported their unqualified audit opinion. 
   
   The external auditors highlighted:

• the changes in the audit strategy were consistent with the audit plan;
• areas of audit emphasis included revenue recognition, investment, pension and other post-retirement employee benefit, legal matters and risk of management override of controls;
• there were no major deviations from the audit plan and scope during the execution of the audit, and no exceptions noted;
• the auditors performed additional procedures to satisfy themselves of the authenticity of the documentation provided given this year’s audit was performed remotely.
  
  The Committee agreed with the views expressed by the external auditors. Inquiries were also made with respect to the risk of material misstatements due to fraud and suspected fraud.  There were no significant matters that arose from the audit and no corrected or uncorrected errors noted. The Committee was also informed by the external auditors that they received excellent and on-going cooperation from management.  All required audit communications were provided to the Committee by the auditors. The Chair confirmed that the Committee was not aware of any concerns of fraud or non-compliance.
  
  The audited financial statements were examined in detail by the Committee, and the audit results indicated that there were no issues to bring to the Committee’s attention.
  
   

3. Legal Claims
   
   The Committee received the 2022-2023 summary of legal actions against the University exceeding $500,000 prepared by the administration. 
   
    
4. External Auditors: Private Meeting
   
   The Committee moved in camera.
   
   The Committee met privately with the external auditors with no University staff present.  No issues were identified for the Business Board’s attention.
   
   Ms. Brouwer was invited to advise of any problems encountered by the auditors, any restrictions on their work, the co-operation received in the performance of their duties by the administration and the Internal Audit Department, and any matters requiring discussion arising from the auditors’ findings.
   
   The Committee returned to closed session.
   
   The Chair reported that there had been no matters arising from the Committee’s in camera session with the external auditors that would require action.
   
    
5. Discussion and Recommendation
   
   The Chair thanked Mr. Rodgers and commended the Financial Services team for their work in preparing the financial statements.

On motion duly moved, seconded and carried

YOUR COMMITTEE RECOMMENDED

THAT the University of Toronto audited financial statements for the fiscal year ended April 30, 2023 be approved.
 

4. Appointment of the External Auditors for 2023-2024
   
   Mr. Samuel informed the Committee of the process followed in gathering and compiling feedback about the external auditors. The Auditor Assessment Template was reviewed which highlighted the following areas of the evaluation:

1. Professional Skepticism and Objectivity
2. Quality of Engagement Team
3. Quality of Communications
4. Quality of Service

Following these introductory remarks, Ernst & Young excused themselves and discussions of the appointment of the external auditor for the 2023-2024 year continued in their absence.

Mr. Rodgers reported that the administration was very pleased with the work of Ernst & Young. He commented on their excellent knowledge of the university sector, their responsiveness, proactive approach, and their high levels of technical abilities.  Mr. Rodgers also advised that Ernst & Young had been providing the University with auditing services since 2014 and his team would be undertaking a review of audit services in 2024. A review process would be discussed with the Committee in the upcoming year.

There were no questions from members.

On motion duly moved, seconded and carried

YOUR COMMITTEE RECOMMENDED

THAT Ernst & Young LLP be re-appointed as external auditors of the University ofToronto for the fiscal year ending April 30, 2024.
 

5. Internal Audit Annual Report (to April 30, 2023)
   
   Mr. Alex Matos, Director, Internal Audit, highlighted the following key points from the Internal Audit Annual Report Summary for the year ended April 30, 2023: 

• Internal Audit Services be area included Central Administration 51%, Academic Units 36%, and Student Services 13%.
• Internal Audit had provided Operational Audits, Compliance Auditing, Information System Audits, Advisory and other related services, and Follow-up Reviews with total budgeted hours of 12,500.
• risks assessed were categorized in three main areas: financial risks, operational risks and compliance risks.
• there had been unexpected turn over in the Audit Department which was being addressed through recruitment.
  
  The Committee discussed the ongoing assessment and approach to the number of outstanding management action items referenced in the Report. Mr. Matos noted that there had been as reassessment of older action plans and that some recommendations had been reassessed as low based on current risk criteria.
   

6. Reports of the Administrative Assessors
   
   There were no additional reports from the Committee’s Administrative Assessors.
    

7. Report of the Previous Meeting: Report 152, May 1, 2023
   
   The report of the previous meeting was approved.
    

8. Business Arising from the Report of the Previous Meeting
   
   There was no business arising from the report of the previous meeting.
    

9. Date of the Next Meeting: September 20, 2023, at 4:00 p.m.
   
   Returning members were reminded that the next meeting was scheduled September 20, 2023.
    

10. Other Business
    
    There was no other business.
    
    The Chair thanked, members, assessors, the internal auditors, and the Secretariat for their time and efforts devoted to the Committees throughout the year.
    
    The Committee moved In Camera.
     

11. Internal Auditor – Private Meeting
    
    Members of the administration absented themselves and the Committee met privately with the Director of Internal Audit.  There were no issues to be brought to the Business Board’s attention from this meeting.
     
12. Committee Members Alone
    
    Committee members discussed topics of interest and concern.
    
    The Committee returned to Closed Session.