SUMMARY
DEPARTMENT
There are no new recommendations to the Department of Enterprise and Advanced Education in this report.
POST-SECONDARY INSTITUTIONS
We recommended that, similar to a recommendation made to certain post-secondary institutions in our February 2013 report, Athabasca University, University of Alberta, University of Calgary and University of Lethbridge improve systems to ensure compliance with legislation —see page 94.
ATHABASCA UNIVERSITY
We recommended that the university improve procedures to monitor access and security of information systems—see page 95.
We repeat our recommendation that the university develop a disaster recovery plan and capabilities—see page 96.
THE UNIVERSITY OF ALBERTA
The university implemented the prior year’s recommendation related to information technology controls—see page 97.
THE UNIVERSITY OF CALGARY
The university implemented the following prior years’ recommendations:
information technology change management controls—see page 99
secure access to PeopleSoft—see page 100
THE UNIVERSITY OF LETHBRIDGE
The university implemented our prior year’s recommendation related to clear and complete research policies—see page 100.
INTERNAL CONTROLS—A REPORT CARD
This report includes an update on the report card on four universities’ internal controls over financial reporting, together with comparative assessments from our 2012 and 2011 audits. Our next report will include the results of our audits at the colleges, technical institutions, MacEwan University and Mount Royal University.
We evaluated the following key indicators of effective financial processes and internal controls:
- the time it took institutions to prepare complete and accurate year-end financial statements
- the quality of draft financial statements we received, including the number of errors our audit found
- the number and type of current and outstanding recommendations
To govern effectively, boards need accurate and timely financial information throughout the year, not just at year-end. To manage effectively, management needs the same information. We see a direct correlation between a strong year-end process to prepare financial statements and the ability to prepare quality financial information throughout the year.
A university could have a yellow or red ranking, yet still receive an unqualified opinion, as management can correct errors and disclosure deficiencies during the audit process. The number of errors and disclosure deficiencies we find in the draft financial statements indicates how effective financial controls are for preparing accurate financial statements.
Effective control environments include clear policies, well designed processes and controls to implement and monitor compliance with policies and secure information systems to provide timely and accurate financial and non-financial information to manage and govern the institutions.
Recommendations that are not implemented on a timely basis erode the effectiveness of the institution’s control environment. Weak control environments impact the quality of decisions made by management and the board of governors. This can result in an institution not achieving its goals by operating in a cost effective manner and managing operating risks.
It is critical that the board of governors of post-secondary institutions hold management accountable for improving identified control weaknesses in a reasonable period of time. As the Minister of Enterprise and Advanced Education and the Lieutenant Governor in Council appoint the boards, the minister through the department, must also hold the boards accountable for their effective oversight of the institutions.