Victorian Auditor-General’s report 
23 May 2012 
Tertiary Education and Other Entities: Results of the 2011 Audits
Audit summary
This report presents the results of the 2011 audits of 106 entities mainly with a 31 December financial year end. It focuses on universities, tertiary and further education (TAFE) institutes and alpine resort management boards (ARMBs), providing detailed analysis of their internal controls, financial results and sustainability. 
Clear audit opinions were issued on the financial reports of all but three entities, while all 20 performance reports received clear audit opinions. The three qualified opinions related to the financial reports of The University of Melbourne, Deakin University and the Anti-Cancer Council of Victoria. An ‘emphasis of matter’ comment was included in the opinion for a further seven entities, mainly relating to financial sustainability issues.
Conclusion
Notwithstanding some deficiencies, Parliament can have confidence in the adequacy of financial reporting and the internal controls of the entities audited.
Internal controls
We found that all universities and TAFEs operate adequate internal controls to maintain reliable financial reporting, assist with the efficiency and effectiveness of their operations and to comply with relevant laws and regulations. As part of our annual assessment of internal controls we focused on controls over information technology (IT) security and capital project management. Significant expenditure is incurred in relation to these core business activities, therefore robust systems and documented policies are required to maintain probity and maximise efficient use of public sector resources. 
The tertiary education sector spent approximately $415 million on software, hardware, IT contractors and IT staff in 2011. We found that IT systems’ security was strong, as universities and most TAFEs have documented policies and procedures. However, tertiary education sector entities need to improve their information security classification policies and oversight of IT systems security, including having a dedicated committee for the governance of their IT environments. Some TAFEs did not have documented IT security policies, which is concerning given that private student information is stored electronically. 
Capital project management frameworks were generally strong and all entities regularly reported to their governing bodies on capital project matters. However, our review indicated that a quarter of capital projects were either not completed within budget or on time. The opportunity to improve the management of capital projects is also being neglected, as post-project evaluations are not being performed in a third of tertiary education entities.
Financial results and sustainability
Our financial sustainability assessments of the tertiary education sector indicated that most entities are in the low risk category. However, the sector generally recorded poor self-financing indicators, with 90 per cent of entities recording a medium- or high-risk assessment. This suggests that these entities are not able to effectively fund capital programs with cash generated from their operations. This is problematic given that many of these entities have limited cash reserves to draw upon to fund future capital activities.
Universities continued to record strong financial results, with the sector generating a healthy $478.5 million surplus in 2011. Monash University and Victoria University’s financial sustainability was assessed as medium risk overall due to their poor self‑financing indicators. 
The TAFE sector recorded a surplus of $100.5 million, down 32.5 per cent on 2010, partially due to a decrease in international student fee revenue. We noted that three of the 11 TAFEs that currently provide educational services to international students could not provide infromation on these students’ countries of residence or social demographics. This deficiency impacts on their ability to effectively market and tailor educational programs. 
Our analysis of the TAFE funding model shows that capital grants are strategically allocated across the sector rather than progressively to each entity, with funds for asset replacement provided at government discretion. The governing body is accountable for an entity’s financial management and performance but has limited ability to make decisions around asset upgrades and replacement, with adverse implications for the adequacy of the sector’s facilities and impacting on their long-term operational performance.
Alpine resort management boards
Substantial support payments of $8.2 million contributed by the Department of Sustainability and the Environment and insurance recoveries of $1.9 million resulted in the sector achieving a $5.2 million surplus. Without these support payments there would have been an overall deficit of $4.9 million. At the smaller ARMBs, expenditure has grown faster than revenue over the past five years, with government grants representing an expanding component of total revenue.
We have concerns with the ongoing financial sustainability of the smaller boards, Lake Mountain and Mount Baw Baw. These entities recorded overall financial sustainability risk assessments of high and medium, respectively. These assessments highlight the ongoing challenge for smaller ARMBs to control their expenditure, particularly given their limited ability to increase revenue streams. The Minister for Environment and Climate Change has directed the ARMBs and the Alpine Resorts Co-ordinating Council to provide advice on an integrated financial sustainability solution for the sector.
Recommendations
Number	Recommendation	Page	
1.	That performance reporting for the TAFE sector be elevated to legislative status.	14	
			
2.	That universities and TAFEs continue to refine their financial reporting processes by preparing shell financial statements and adopting rigorous quality control and assurance procedures.	14	
			
	That tertiary education bodies:		
3.	assess their policies and practices against the identified general internal control weaknesses to determine the adequacy of their controls, and whether they are operating reliably, efficiently and effectively	33	
4.	develop comprehensive policies and procedures over information technology system security which are approved at board or council level and subject to regular review	33	
5.	develop an information security classification policy that outlines criteria for assigning security classifications to information and the required security controls for each classification	33	
6.	undertake periodic assessments of the adequacy of, and compliance with, information technology security requirements	33	
7.	develop capital project management policies and procedures which are approved by the governing body	34	
8.	undertake post-project evaluations to learn from recent projects and report findings to the governing body	34	
9.	engage internal audit to conduct periodic reviews of their information technology security policies and capital project management arrangements and outcomes	34	
10.	develop and maintain the capacity to monitor the country of residence and other socio-economic details of their international students to improve their marketing focus and provide appropriately structured courses. 	46	
			
11.	The Alpine Resorts Co-ordinating Council together with Lake Mountain and Mount Baw Baw alpine resort management boards should investigate the potential for implementing revised operating arrangements to improve their longer-term financial viability.	71	
			
12.	Alpine resort management boards should continue to address commonly identified internal control weaknesses to ensure they are operating in a reliable and sustainable manner.	71	
Submissions and comments received
In addition to progressive engagement during the course of the audit, in accordance with section 16(3) of the Audit Act 1994, relevant extracts from the report were provided to all universities, TAFEs, alpine resort management boards, the Department of Treasury and Finance, the Department of Education and Early Childhood Development and the Department of Sustainability and Environment with a request for submissions or comments.
Agency views have been considered in reaching our audit conclusions and are represented to the extent relevant and warranted in preparing this report. Their full section 16(3) submissions and comments, however, are included in Appendix E.