Audit exposes reporting risks at unis, TAFEs

An audit of Western Australia’s public tertiary institutions has identified major risks, particularly in financial reporting and cyber security.

The Office of the Auditor General released its financial audit results – Universities and TAFEs 2022 report in late June.

The report, based on the 2022 tertiary reporting cycle, found expenditure, revenue and financial reporting to be the main areas where the universities and TAFEs had financial control weaknesses.

In her overview, state auditor general Caroline Spencer said her office issued clear, but unqualified, opinions for all the universities and TAFEs on their financial statements, controls and key performance indicators.

Ms Spencer said 69 per cent of her office’s findings were rated as moderate and of sufficient concern to warrant prompt action to prevent escalation to significant or high risk.

“Disappointingly, 20 [39 per cent] were unresolved prior year issues, significantly more than last year [at 22 per cent],” she said in the report.

“Universities had 11 [22 per cent] unresolved prior year issues and TAFEs had nine [17.6 per cent].”

The OAG reported 51 financial and management control weaknesses, with five of the issues rated as significant, 35 as moderate and 11 considered minor.

Ms Spencer found impacts from the pandemic were still lingering on university and TAFE staff, students, operations and finances in 2022.

However, she said the impacts were both positive and negative.

“Adaptations made by entities earlier in the pandemic became bedded down as both students and staff learned to work within new systems,” she said in her overview.

“The results summarised in this report indicate that entities have been largely successful in meeting the challenge.”

The audit found international student numbers began to recover but had yet to return to pre-pandemic levels.

In Edith Cowan University, the OAG found travel disruption and visa delays in the first half of 2022 continued to affect onshore student numbers. Online and flexible study plans were preferred by many international students.

The OAG also found Murdoch University’s student enrolments decreased further in 2022, with a $12.9 million decrease in Commonwealth funding that was generally tied to student enrolment numbers.

At Curtin University, the OAG reported the 2022 fee income from international students was largely unchanged from 2021.

Meanwhile, international and overall student enrolments increased at The University of Western Australia last year but Australian grant funding declined by $49.6 million compared with 2021.

Cyber security

Ms Spencer said recent leaks from Medibank and Optus highlighted the seriousness of cyber threats.

“Globally, cyber security is becoming a primary concern of all organisations that deal with sensitive information, and educational entities are not exempt,” she said.

“It is therefore disappointing that our information systems auditors identified 134 IT control weaknesses, an increase on the 124 reported last year.

“Even more concerning, 59 per cent were unresolved issues from the previous year, up from 49 per cent in 2021.

“While many of these were rated moderate or minor, I again recommend that executive management in each entity gives priority to monitoring the confidentiality, integrity and availability of information systems.”

From the 134 weaknesses identified, 87 were from the four WA universities.

According to the report, 23 per cent of the 134 IT weaknesses identified were related to protection, including malicious code and system ‘hardening’.

A further 22 per cent of the weaknesses related to access management, including poor management of privileged accounts, weak passwords and lack of multifactor authentication.

“Information systems control weaknesses have the potential to compromise the confidentiality, integrity and availability of key business systems and therefore need to be managed and actioned promptly,” the report said.

All four universities have been contacted for comment.

Recommendations

According to the audit report, university and TAFE managements were responsible for keeping proper accounts and records to enable the timely and accurate preparation of financial reports.

After identifying the risks, Ms Spencer recommended universities, TAFE and other entities should address the financial management, KPI (key performance indicators) and information systems control weaknesses in a timely manner to ensure the integrity of their financial controls and external reporting.

The OAG also recommended universities continue advising the office promptly of any proposed changes to approved strategic objectives, services or KPIs to ensure any OAG feedback could be considered.