Statement of internal control

The University’s Council acknowledges its responsibility for ensuring that an effective system of internal financial control is maintained and operated by Buckinghamshire New University and the University’s Council confirms it has reviewed the effectiveness of these arrangements.

The system of internal financial control is based on a framework of regular management information, administrative procedures including the segregation of duties and a system of delegation and accountability. The following processes are established to review the adequacy and effectiveness of the University’s system of internal control:

• KCG provides internal audit services for the University. KCG provides an annual opinion on the adequacy and the effectiveness of internal controls and risk management across the University, in accordance with the CUC Higher Education Audit

Committees Code of Practice.

• The Audit Committee receives regular reports from the internal audit service, including its independent opinion on the adequacy and effectiveness of the University’s system of internal control, together with recommendations for improvement. • Council receives regular reports from the Audit Committee on internal control and the business of the Committee.

• There is a comprehensive budgeting system with an annual and fiveyear budget which is reviewed and agreed by Council. These arrangements also allow for the University to ensure propriety and regularity in the use of public funding. This is achieved through the operation of frameworks and policies, including Financial Regulations, which are underpinned by linked policies, such as the Expenses Policy, and procedures in relation to procurement.

The key elements of the University’s system of internal control, which is designed to support the Council in carrying out its responsibilities, include: • Clear definitions of the responsibilities of, and the authority delegated to, senior officers of the University • A comprehensive annual planning process, supplemented by detailed annual income, expenditure, capital and cash flow budgets. • A regular review of institutional performance and of financial results, involving variance reporting and updates of forecast out-turns. • Clearly defined and formalised requirements for approval and control of expenditure • Procedures for the management of investment and risk

• A professional internal audit service delivered under terms of reference which reflect guidance issued by

CUC, and whose annual programme is approved by the Audit Committee The University's Council has established the processes for the identification, evaluation and management of risks that the University faces.

The University’s Council has responsibility for maintaining a sound system of internal control that supports the achievement of policies, aims and objectives, while safeguarding the public and other funds and assets for which it is responsible.

This is in accordance with the responsibilities assigned to the governing body in the Instrument and Articles of Government and the Terms and Conditions of funding for higher education institutions with the OfS.

The system of internal control is designed to manage rather than eliminate the risk of failure to achieve policies, aims and objectives. It can therefore only provide reasonable and not absolute assurance of effectiveness. The system of internal control is based on an ongoing process designed to identify the principal risks to the achievement of policies, aims and objectives, to evaluate the nature and extent of those risks and to manage them efficiently, effectively and economically.

More specifically:

• The Audit Committee provides an oversight of risk management. • Regular meetings between senior managers and Service Leaders to review progress and issues arising from operational activities, and similar meetings with Heads of School in relation to academic developments. • Oversight by Resources Committee of matters relating to resource allocation, forward planning, effectiveness and value for money. • The University’s Council receives periodic reports from the Chair of the Audit Committee concerning internal control and requires regular reports from managers on the steps they are taking to manage risks in their areas of responsibility, including progress reports on key projects. • A robust risk prioritisation methodology based on risk ranking and cost-benefit analysis has been established and an organisation wide risk register is maintained. • Clear definitions of the responsibilities of, and the authority delegated to, senior officers of the University. • 8 internal audits, one of which, sustainability was unsatisfactory.

Significant progress in this area has already been made and will be reported on in January 23 • External Auditors, in their audit for the year ending 31 July 2022, included consideration of internal control relevant to the preparation of the

Financial Statements, the external audit finding no significant deficiencies.