Audit and Risk Committee

1. Status

1.1 In accordance with the Scottish Code of Good HE Governance and the University’s core governance framework, Court has established the Audit and Risk Committee (the Committee). These Terms of Reference, approved by Court, define the Committee’s purpose, delegated authority, responsibilities and operating arrangements. They should be read in conjunction with other key governance documents available at Court's Key Documents.

1.2 The Committee shall only act within its approved remit, escalating matters that exceed its delegated authority as defined in the Scheme of Delegation and Decision-Making Powers or present material risk to Court in a timely and transparent manner, in accordance with the University Court Standing Orders and recognised good governance practice.

1.3 Delegation to the Committee does not transfer or diminish Court’s collective responsibility or accountability. Court retains the right to rescind or vary any decision of the Committee, without prejudice to actions already undertaken.

1.4 In the event of any question arising between different aspects of the University’s suite of governance documents, the Order prevails, followed by the University Court Statement of Primary Responsibilities, then the University Court Standing Orders and applicable Codes of Conduct, and thereafter the Scheme of Delegation and Decision‑Making Powers and other relevant policies and procedures including these Terms of Reference.

2. Purpose and Scope

2.1 The purpose of the Committee is to support Court in discharging its responsibilities for:

a) the oversight of risk management, internal control and governance arrangements;
b) the effectiveness, independence and resourcing of internal and external audit;
c) the stewardship of public funds, and the economy, efficiency and effectiveness of the University’s activities; and
d) the integrity of financial reporting and compliance with legal, regulatory and funding‑body requirements.

2.2 The Committee may review, enquire into, or seek assurance on any matter as necessary to support its assurance role, whether or not within its routine programme of work, so ensuring that significant risks, control weaknesses and governance concerns are identified, examined and, where necessary, escalated.

2.3 Operational delivery of risk management, internal control, governance, audit processes, financial management and regulatory compliance remains the responsibility of the Principal and Vice‑Chancellor and the Senior Leadership Team under delegated authority.

3. Responsibilities

3.1 Governance and Assurance

a) provide assurance to Court on the adequacy and effectiveness of risk management, internal control and governance arrangements, including compliance with corporate governance requirements and relevant sector good practice;
b) consider and evaluate assurances provided by management, internal audit, external audit and other relevant sources, including reviewing the effectiveness of audit processes and the adequacy of management responses to identified control deficiencies;
c) monitor the University’s compliance with the SFC Financial Memorandum and consider any significant relevant reports or findings from the Scottish Funding Council, Audit Scotland or other relevant bodies, advising Court as appropriate
d) ensure that material control failures or weaknesses identified through audit or other assurance processes are appropriately addressed by Management and, where necessary, escalated to Court; and
e) produce an annual assurance report for submission to Court (and onward submission where required), incorporating significant matters arising from audit activity and the Committee’s assessment of its own effectiveness.

3.2 Risk Management

a) review and advise Court on the effectiveness of the University’s arrangements for identifying, assessing and managing risk, including the adequacy of policies, procedures and early warning mechanisms for material changes in the risk profile;
b) monitor the implementation of the University’s Risk Management Policy and Framework and receive regular reports on risk management activities;
c) ensure significant risks or control failures particularly those outside the approved Risk Appetite, are appropriately escalated to Court; and
d) submit an annual report to Court on the effectiveness of the University’s overall approach to risk management.

3.3 Internal Audit

a) advise Court on the terms of reference, selection criteria, appointment and remuneration of internal auditors, and recommend their appointment following due consideration of suitable candidates;
b) review the scope, efficiency and effectiveness of internal audit work, including the adequacy of the resourcing made available;
c) oversee the effectiveness of internal audit, including reviewing the scope of work, the Internal Audit needs assessment and Strategic Internal Audit Plan;
d) agree with internal auditors the criteria for grading recommendations and review management responses to audit findings, monitoring the implementation of agreed actions; and
e) ensure that internal audit reports arising from the agreed plan are reported to the Committee and shared, as appropriate, with relevant Court committees.

3.4 External Audit

a) advise Court on the selection, appointment, remuneration and effectiveness of external auditors;
b) review the University’s annual financial statements and external auditors’ report and recommend them to Court for approval;
c) review external audit management letters and monitor implementation of agreed recommendations;
d) maintain direct access to the external auditors; and
e) review and monitor on an appropriate basis the effectiveness of the external audit service.

3.5 Value for Money and Economy, Efficiency and Effectiveness

a) evaluate the University’s arrangements for securing economy, efficiency and effectiveness in the use of its resources;
b) consider relevant national studies and reports from Audit Scotland and other relevant bodies; and
c) advise Court on potential topics for value‑for‑money reviews and appropriate delivery arrangements.

3.6 Fraud, Irregularity and Whistleblowing

a) review reported cases of impropriety, fraud, cyber-incidents or irregularity and ensure they have been appropriately addressed; and
b) oversee the effectiveness of arrangements for whistleblowing and investigation of concerns.

3.7 Equality, Diversity and Inclusion

a) have due regard to equality, diversity and inclusion in carrying out its responsibilities including considering the implications for people with protected characteristics and other underrepresented or vulnerable groups when considering risks, control failures or audit findings; and
b) seek assurance that equality impact assessments, or equivalent consideration of equality implications, are undertaken where required for audit and risk related policies, practices and significant changes;

3.8 Review of Effectiveness

a) undertake an annual review of the Committee’s effectiveness, remit and sufficiency of delegated authority, including these Terms of Reference, and consider whether any amendments are required in light of legislative changes, governance frameworks or recognised good governance practice, with any proposed updates recommended to the Governance and Nominations Committee for onward approval by Court.

3.9 Other Responsibilities

a) take such other actions as are required or directed by Court in relation to audit, risk management, internal control and the provision of independent assurance on governance arrangements.

4. Composition

4.1 The Committee shall be constituted to provide an appropriate level of expertise in financial management, audit and risk.

4.2 All members of the Committee shall comply with the Code of Conduct for Members of the University Court and shall declare and manage conflicts of interest in accordance with the University Court Standing Orders.

4.3 Membership:

Appointed:
a) No fewer than four lay members of Court (one to act as Chair and one as Vice‑Chair).
External Members:
a) Court may appoint additional external lay members, who are not members of Court, with appropriate experience or expertise, provided there is always a majority of members are lay members of Court on the Committee.

4.4 In Attendance:

a) Principal and Vice‑Chancellor (when invited to attend by the Committee)
b) Deputy Principal and University Secretary
c) Director of Finance, Infrastructure and Corporate Services
d) Representatives of the internal and external auditors will be invited to attend all meetings where relevant matters are under consideration.

4.5 Non-members may be invited to attend meetings at the discretion of the Chair to contribute expertise to specific agenda items.

4.6 The Secretary to the Audit and Risk Committee shall be the Head of Governance and Deputy Secretary or their nominee.

4.7 The Governance and Policy Officer shall act as Clerk to the Audit and Risk Committee and shall be responsible for minute‑taking.

5. Meetings and Proceedings

5.1 The Committee shall conduct its business in accordance with the Standing Orders which apply to Committees with any necessary modifications and subject to any Committee‑specific provisions approved by Court.

5.2 Meetings shall be held at least three times per academic year or more frequently as required.

5.3 One meeting each year will be preceded by a private meeting of the Committee with the internal and external auditors without officers present.

6. Quorum

6.1 Three members, including the Chair or Vice‑Chair.

7. Reporting

7.1 The Committee reports directly to Court through the submission of its minutes (these can include unapproved minutes agreed with the Committee Chair) to the next available meeting of Court.

7.2 The Committee will also report to Court through a paper relating to any substantive matters for consideration.

Approved by Court, 17 June 2026