December 2003/60
Core funding/operations
Consultation

Responses should be sent by e-mail by Friday 27 February 2004

Institutional audit and accountability: HEFCE Code of Practice

Draft for consultation

This draft document contains HEFCE's proposed requirements for audit and accountability arrangements in higher education institutions. It updates the 'HEFCE Audit Code of Practice' issued in May 2002 (HEFCE 2002/26). We seek the sector's views on the proposed changes.

Final version of Code (June 2004)

Table of contents, consultation process and executive summary (read on-line)

Download

Report plus Annexes A and B
[ MS Word 348K | Zipped Word 86K | Adobe PDF 160K | Zipped PDF 139K ]

Annexes C-J (web only)
[ MS Word 180K | Zipped Word 35K | Adobe PDF 82K | Zipped PDF 68K ]

Contents

Consultation process

Institutional audit and accountability: HEFCE Code of Practice - draft for consultation

Executive summary
Introduction
Corporate governance
Higher education audit framework
General principles for internal and external auditors
Audit of HEIs by the HEFCE Assurance Service
Audit committees in HEIs
Internal audit arrangements in HEIs
External audit arrangements in HEIs

Annex A    Mandatory requirements
Annex B    Consultation response form
List of abbreviations

Web-site

Annex C    Audit committee: model terms of reference
Annex D    Smith Report recommendations
Annex E    Audit committee annual report: model format
Annex F    Procedures for external testing of external and internal audit
Annex G    Internal audit: model terms of reference
Annex H    External audit: model terms of reference
Annex I    External audit report: suggested wording
Annex J    Annual audit return from institutions

Consultation process

1.    This draft document contains HEFCE's proposed requirements for audit and accountability arrangements in higher education institutions (HEIs). It updates the 'HEFCE Audit Code of Practice' issued in May 2002 (HEFCE 2002/26). We seek the sector's views on the proposed changes.

2.    The document is in two parts: the main text accompanied by Annexes A and B, which is available in hard copy and on the web; and the remaining annexes which are on the web only. There has been extensive re-writing and re-ordering of the document, and some deletion. Changed items, except where trivial, are italicised in this consultation draft to assist the reader.

3.    This draft incorporates changes made following consultation to date with: a sector focus group which met in August and September 2003; the Better Regulation Review Group; HEFCE staff; HEFCE Audit Committee members; and the Higher Education Audit Liaison group (providers of internal and external audit to the HE sector).

4.    Responses should be made by e-mail, using the form at Annex B. Please e-mail the completed form as an attachment to acopconsultation@hefce.ac.uk, by Friday 27 February 2004. All responses received by the deadline will be taken into account but it will not be possible to discuss individual responses.

5.    Following sector consultation, we will issue the final version of the Code, to be effective from 1 August 2004.

Executive summary

Purpose

1.    This document sets out our requirements for HEIs' accountability and audit arrangements and the broad framework in which they should operate.

Key points

2.    This Code replaces the 2002 version of the Audit Code of Practice (HEFCE 2002/26) with effect from 1 August 2004. Its contents reflect:

• a clearer recognition of the importance of corporate governance in institutional accountability and audit

• the reduction in audit burden following changes to the operation of the HEFCE audit team (the auditors are now integrated with HEFCE finance and estates advisers in the HEFCE Assurance Service)

• the requirement for a statement of internal control to be included with published financial statements, as recommended by the Combined Code on corporate governance best practice and reporting following the Turnbull Report, and as reflected in HEFCE's Accounts Directions to the sector

• further reference to risk management arrangements

• revised professional standards for internal auditors, for example from the Treasury

• developments intended to increase the overall degree of self-regulation in the sector, to enable further lightening of touch by the HEFCE Assurance Service, relying where possible on existing information and arrangements.

3.    Regard has also been paid to the recently published Smith and Higgs reports where they are relevant to the HE sector. Sir Robert Smith chaired a working group of the Financial Reporting Council to advise on updating Combined Code guidance about audit committees in UK listed companies. Although the sector backgrounds are different, the way audit committees are expected to operate is very similar. Derek Higgs reported in the Higgs report on the role and effectiveness of non-executive directors.

4.    The Code describes our minimum audit and reporting requirements and those that we consider to be good practice or worthy of consideration. It is now a mandatory requirement for institutions to submit their internal audit annual reports. Previously this was optional, although the majority of institutions have submitted the reports. We have also strengthened our guidance on dual appointments to require separate audit providers for internal and external services.

5.    Model versions of key documents are provided for HEIs to use at their own discretion.