Medr/2024/10: Guidance for Internal Auditors to use in their Annual Internal Audit of HE Data Systems and Processes

Introduction

1. This publication provides guidance to the internal auditors of higher education institutions (HEIs) and further education institutions (FEIs) funded by Medr for higher education provision referred to throughout as higher education providers (HEPs) to use for their annual internal audit of the internal controls relating to the systems and processes in place to produce higher education (HE) data returns, and requests a copy of this internal audit report for each HEP.  Both HEFCW and Medr are referenced throughout this publication depending on historic or current data and processes.

2. Previously, external audits were commissioned by HEFCW so that HEPs were externally audited at least once every four years. 2021/22 was the last year of the contract HEFCW had with external auditors to do this and so in Medr we are continuing with the interim process used last year in place of external audits until the audit process is reviewed.

3. For 2025 the process will involve members of the Medr Statistics team meeting with data contacts at each HEP, to cover items such as previous audit findings, Data Futures implementation and review, and data quality. As part of this interim process, Medr will continue to rely on the annual assurance provided to HEPs and their Audit Committees by their internal auditors about the systems and processes used to produce data returns. Relying on the internal audits will maintain an adequate level of annual assurance in respect of HEPs’ data returns.

4. The internal audit will provide an opinion as to the adequacy and effectiveness of the controls in place to manage the risks relating to the accuracy of data submitted by the HEP to the Higher Education Statistics Agency (HESA), Medr and Welsh Government (WG), including data used in calculations for the following funding streams:

• Teaching funding (currently comprising per capita and premium funding and part-time (PT) undergraduate (UG) credit-based funding);
• Research funding comprising Quality research (QR) funding and Postgraduate research (PGR) training funding;
• Research Wales Innovation Funding (RWIF);
• Medr’s part-time undergraduate fee waiver scheme;
• Well-being and mental health funding;
• Race access and success funding;
• Targeted employability support funding;
• Wales Research Environment and Culture (WREC) funding;
• Capital funding.

and the data used to monitor the following funding streams:

• Medr’s part-time undergraduate fee waiver scheme;
• PGT Master’s bursaries allocations;
• Medr funded Degree Apprenticeship scheme allocations.

5. The internal audit should also provide assurance over the controls in place to ensure the accuracy of data used in the monitoring of performance, including key performance indicators such as the National Measures, and if applicable, data included by HEPs as part of the fee and access plan reporting requirements.

6. The Data Futures programme was implemented for the 2022/23 HESA student record. There were difficulties with the return caused by delays to the functionality of the HESA Data Platform, late software updates, late supply of data quality rules by Jisc and other issues in its implementation year.  In light of this, for the 2024 audit scope we didn’t recommend that auditors examine the implementation of the new record for 2022/23 in depth, or the systems and process relating to the 2022/23 return, but rather provide opinions on the controls in place to manage risks relating to the record going forward including plans to review and/or improve processes, documentation and data quality moving into the 2023/24 return. Difficulties were also experienced in returning the 2023/24 student record and this may mean that providers have not been able to fully implement new processes and procedures for their systems and auditors should take these difficulties into account when setting out their programmes of work for 2025. We would expect auditors to include in the scope any updates applied to systems and processes, and to risk registers, after review of both the 2022/23 and 2023/24 student data returns.

7. This document provides guidance to the internal auditors about the nature of the controls that their audit should address, to assess whether the systems and processes are adequate to provide accurate data returns and data to use in funding and monitoring and also to ensure that internal audits taking place across the sector are carried out on a consistent basis.

8. If the internal audit report’s overall conclusion, or the conclusions relating to the adequacy of the design of the methods of control and the application of those controls, provides a negative opinion (e.g. limited or no assurance, unsatisfactory or inadequate controls) and/or the report includes a significant number of recommendations, Medr should be notified as soon as the opinion has been agreed. Medr will then conduct their own assessment of the issue and/or commission their own external audit as appropriate. This external audit would consider the accuracy of data for the current period and also consider the findings of the internal auditor and aim to assess the extent of potential errors in the data returns and data used for funding and monitoring for prior periods up to the last external audit. The findings of this external audit may result in adjustments to funding and further action may be taken if HEPs are found to be not compliant with their fee and access plans, the supply-side code of practice for data collections or the financial management code.

Scope of the Audit

9. The way in which internal audit work and controls testing is carried out at each HEP will depend on the systems and controls in place and how information is shared within the HEP. However, it is expected that the internal audit work will cover the elements highlighted in this document. Where previous internal audit work has found that the systems and controls in place are satisfactory, it may be considered appropriate by the HEP’s Audit Committee for subsequent audits to only cover areas of risk. In particular, due to the increased risks associated with the implementation of the HESA Data Futures programme in 2022/23 and into 2023/24 collection, we would expect to see this area of work included in the scope, (See also paragraph 62).

10. Auditors should ascertain the processes by which data returns and monitoring information are compiled and document them to the extent necessary to enable an evaluation to be made of the adequacy of the existing controls used by the HEP to ensure that they produce accurate data returns and appropriately compile monitoring data. Examples of the controls that the audit would normally be expected to assess are set out for all the current funding streams, data returns and other areas of audit in the sections below. Many of the controls are common to the data returns for all areas of audit. However, not all of the areas of audit apply to all HEPs, and auditors should refer to the relevant paragraphs.

11. Auditors should note that there are some areas where HEPs may have to return estimates, where information is not known at the time of return or information is not available in the required form. Estimates can be made using methods suggested by HEFCW/Medr in its guidance, or if appropriate, HEPs can use their own methods. Where estimates have been made, auditors should review the methods used to calculate them, confirm that they are properly documented, reasonable, consistently applied and tested for reliability.

12. If a HEP is in the process of merging or has recently merged with one or more other HEPs, the auditor should ascertain if procedures have been put in place to integrate their data systems or otherwise ensure that returns for the whole merged HEP can be made.

13. In planning the audit, the Auditor should consider the findings and conclusions of the latest external and/or internal audit reports relating to systems and data returns for the HEP and any follow up reports and correspondence with management to assess the extent of implementation of the reports’ recommendations. It is expected that the audit reports will make reference to and comment upon the extent that recommendations made by auditors in the previous internal or external audit reports have been effectively implemented.

14. Additionally any data issues or errors notified either directly to Medr by the provider, or identified and communicated by HEFCW/Medr, should be referenced in the report together with any action taken to ensure that data systems and processes have been amended where appropriate to mitigate against any such errors in future. As explained in paragraph 6, there were difficulties with the implementation of the Data Futures programme. This led to multiple errors being flagged and tolerated in the HESA student record issue management system (IMS) in both 2022/23 and 2023/24. We are not expecting auditors to review these errors, but would recommend any review for the HESA student record for the 2023/24 return focus instead on providers’ plans to review these errors and any action they might take to improve systems and processes moving into future HESA student record returns.

15. It is recommended that internal audit staff with some experience of the HE sector and associated data returns are involved in the visits to HEPs undertaken as part of the review and that auditors are sufficiently briefed on the guidance contained within this publication prior to carrying out the audit. In addition, auditors should make themselves aware of the UK-wide issues experienced with the implementation of Data Futures in 2022/23 and the issues experienced for the 2023/24 return. Advice and clarification relating to the guidance in this publication can be obtained from Medr via [email protected], and Medr staff are available to meet with internal audit staff if required.

16. All HEFCW/Medr publications described below are available via the relevant links in this publication or can be obtained from Medr directly via [email protected].

Funding Methodology and Data Requirements

17. HEFCW circular W24/13HE HEFCW’s Funding Allocations 2024/25 describes the overall funding distribution for academic year 2024/25 including:

• PGR and QR funding (pages 6&7)
• RWIF (page 7)
• Teaching funding (pages 8 to 11)

W24/13HE also includes funding which is further described in the following publications:

• Well-being and health strategy funding (Medr/2024/07)
• Part-time undergraduate fee waiver scheme (W24/15HE)
• Race equality in higher education allocations (Medr/2024/03)
• Targeted employability support for students (W23/15HE)

18. HEFCW circular W23/27HE Higher Education Data Requirements 2023/24 informs HE providers of the 2022/23 data used to calculate funding allocations and used for monitoring purposes, as well as student eligibility criteria for:

• Per capita funding (Annex A para 18)
• Access and retention premium (Annex A para 20)
• Disability premium (Annex A para 34)
• Welsh medium premium (Annex A para 36)
• Expensive subjects premium (Annex A para 41)
• Higher cost subjects premium (Annex A para 46)
• Part-time undergraduate fee waiver scheme (W24/15HE)
• Race equality in higher education allocations (Medr/2024/03)
• Targeted employability support for students (W23/15HE)

19. Medr publication Medr/2024/01 Higher Education Data Requirements 2024/25 informs HE providers of the data used to calculate funding allocations and used for monitoring purposes using 2023/24 HESA student record data.

20. Due to the implementation of HESA Data Futures, auditors should note the caveats included for 2022/23 and 2023/24 data, given the new nature of the data return, in paragraphs 3 and 4 of Medr/2024/01, and our expectations about audit of the systems and processes for the 2023/24 HESA student data return described in paragraphs 6 and 14 of this publication.

21. Annex A of this publication contains an outline of the methodology used to calculate the formula driven elements of credit based funding for teaching, RWIF, PGR training funding and QR funding.

22. Annex B contains the criteria for inclusion of data in the allocations of per capita, premium, PGR training funding, race equality funding, well-being and health funding and targeted employability support funding.

23. Annex C contains the eligibility criteria for data used in the calculation of the National Measures.

24. Annex D contains documentation supplied to HEPs to support Fee and Access Plan sign off.

25. Annex E contains a summary of recommendations from previous internal audits.

Teaching funding

26. 2024/25 teaching funding comprises:

• Funding allocated through the credit based teaching funding method for part-time undergraduate taught provision;
• Per capita funding for full-time and part-time taught provision;
• Expensive subjects premium funding for full-time undergraduate provision;
• Higher cost subjects premium for full-time undergraduate provision;
• Access and retention premium funding for part-time undergraduate provision;
• Disability premium for all modes and levels of study;
• Welsh medium premium for part-time undergraduate provision and full-time undergraduate provision that qualifies for expensive subjects premium or higher cost subjects premium funding.

27. Funding allocated for part-time undergraduate provision through the credit based teaching funding method for 2024/25 was based on 2022/23 End of Year Monitoring of Higher Education Enrolments (EYM) credit value data extracted through the HESA Information Reporting Interface Service (IRIS) process. HEFCW circular W23/26HE details the 2022/23 EYM extraction process and mappings.

28. Adjustments to credit based teaching funding are normally calculated using EYM data extracted during the HESA IRIS process. The 2022/23 adjustment process has taken place and the data extracted is described in the 2022/23 EYM circular W23/26HE. The latest data extraction is described in the 2023/24 EYM publication Medr/2024/00 though the adjustments for 2023/24 have not yet been calculated.

29. Testing of the systems and processes used to generate figures returned on the Higher Education Students Early Statistics (HESES) survey and EYM data returned on the HESA student record and extracted via HESA IRIS should aim to answer the following questions:

• Is the latest HEFCW/Medr guidance being utilised and adhered to, in particular, have changes from the previous HESES surveys been noted and appropriately implemented?
• Are data on the records system validated (e.g. a comparison of a sample of enrolment forms with data on the system)?
• Is the method of extraction of data used to make a return to the HESES survey documented?
• Is there an adequate audit trail to confirm that the method of data extraction for the surveys is being applied as documented?
• Are details of any manual amendments to data extracted from the system for the HESES survey, or to EYM data extracted via HESA IRIS, documented, with justification and/or appropriate authorisation of the changes?
• Is a copy kept of the data taken from the system to make the return to the HESES survey?
• Is the final return to the HESES survey checked against data on the system prior to submission and is there adequate evidence of this checking process?
• Is the EYM data extraction provided through the HESA IRIS system checked against data on the HEP’s internal system and is there evidence of this checking process prior to the data verifications being signed off?
• Is the verification approved and signed off by an appropriate person?
• Are the staff resources available, taking into consideration experience and expertise, adequate to ensure that the HESES survey returns are accurately prepared and the EYM extraction from the HESA IRIS system is thoroughly checked?
• Is the documentation of the system and staff resource sufficient to ensure that accurate data returns could be prepared even in the absence of some key staff?
• Is there a risk register in place and are the risks relating to the compilation of accurate data returns, and related controls to manage these risks, adequately assessed and documented together with details of planned action to be taken, where relevant, to strengthen the existing controls?
• Where errors were identified in HESES/EYM returns or sign-offs, by HEFCW/Medr or the HEP, have processes been implemented to address these data errors and to mitigate against errors in future returns and sign-offs?
• Are HESES survey returns scrutinised before submission by suitably experienced members of staff other than those compiling the return?
• Are EYM data extracted as part of the HESA IRIS system scrutinised before verification by suitably experienced members of staff other than those that compiled the HESA return?
• Is a summary report of the data returned presented to the HEP’s senior management team (e.g. the total numbers of credits and students by mode and level with comparisons to prior years and/or other returns)?
• Is there a suitable process in place to ensure that staff who provide information (e.g. in departments) and staff compiling the return liaise as necessary to ensure that the most up to date information available relating to the survey period is included in the return?
• Is there evidence that validation and credibility checks are completed before returning or signing off data (e.g. scrutinising the credibility checks provided by HEFCW/Medr on the Excel spreadsheets; comparing EYM/HESES data against HESES returns made earlier in the academic year or in the previous academic year; use of control totals)?
• Has the Explanations worksheet in the EYM workbook been completed where year on year differences require explanations?
• Are there procedures for determining the fundability status of students and are checks made on fundability status (e.g. for students located outside Wales); and have the fundability rules contained in HESES been accounted for in the determination?
• Is the method for assigning Higher Education Classification of Subjects (HECoS) codes to modules and hence categorising credits into Academic Subject Categories (ASCs) documented and reasonable (for any data relating to 2019/20 onwards)?
• Is there an adequate audit trail to confirm that the method for categorising credits into ASCs is being applied as documented?
• Are processes used by HEPs to calculate estimates (e.g. non-completion rates) reasonable and documented, and is their reliability tested?
• Do processes ensure that evidence of enrolment and attendance available is complete and retained as part of the audit trail (e.g. enrolment forms, online enrolment records, module choice forms)?
• Are franchised out students correctly identified as such on the system, and recorded as such on the returns, and not, for example, as distance learning students (where distance learning students are those that are students of the reporting HEP, where staff employed by the reporting HEP are responsible for providing all teaching or supervision, but who are located away from the reporting HEP and are not part of a franchising arrangement with another HEP or organisation)?
• Are arrangements with franchise partners documented and are there controls in place to ensure that only the franchisor returns the provision?
• From 2024/25 HESES onwards, are degree apprentices on the Medr funded degree apprenticeship scheme recorded correctly both for enrolments and associated assumed completed credit values.
• If the HEP has recently been formed from a merger are the data systems in place sufficiently integrated to enable the HEP to make returns for the whole HEP and manage the process of validating and verifying data?

30. For 2024/25 funding, per capita and premium funding is based on data taken from the 2022/23 HESA student record (coding manuals and guidance are available on the HESA website – www.hesa.ac.uk). In looking at the above questions, in any in analysis of student data, it is not expected that auditors will look in depth at systems and processes related to 2022/23 HESA student record data, as described in paragraphs 6 and 14, but that any in depth testing carried out would be on the systems and processes for 2022/23 data used for 2024/25 funding.

31. HESES data is not used in allocation of 2024/25 teaching funding, however it is required to monitor student recruitment and to provide to the Welsh Government for student and, up to 2023/24 HESES, Initial Teacher Education (ITE) planning. Additionally, from 2024/25 onwards, HESES data is used in allocation of in-year funding for degree apprentices on the Medr funded degree apprenticeship scheme. Testing will be similar to that of the systems and processes of the EYM extractions and as described in paragraph 29.

Data Requirements

32. The fields and criteria used to extract data from the records for 2024/25 funding and monitoring of funding are detailed in the HEFCW Higher Education Data Requirements circular W23/27HE The HESA student record data used in 2024/25 funding and monitoring of funding in the main is 2022/23 data which was the first record collected since the implementation of HESA Data Futures.

33. In looking at the scope of the audit, in any in analysis of student data and the associated systems and processes, including the suggested testing below, it is expected that auditors will look at 2023/24 HESA student record data submission, using guidance included in paragraphs 6 and 14.

34. Testing of the systems and processes used to make these returns should aim to answer the following questions:

HESA student record:

• Do the controls include quality checks on individualised data prior to submission to HESA, in particular for data fields used in funding (e.g. checks that home postcodes have been correctly transcribed; HECoS codes are correctly assigned; fundability status is correct; year of student is correct; those in receipt of disabled students’ allowance (DSA) are recorded as such)?
• Where errors were identified in prior returns, by HEFCW/Medr, HESA or the HEP, through audit, in Medr/HEFCW data quality meetings or otherwise, particularly those which led to reductions in funding, have processes been implemented to address these data errors and to mitigate against errors in future returns?
• Have any issues that have been raised via the HESA Issue Management System (IMS) and any associated targets applied been collated and considered to make improvements in future data submissions?
• Where errors have been identified in prior returns, are the relevant data checked prior to final submission of data to HESA to confirm that the error has not reoccurred?
• Is there evidence that the web reports and IRIS output, produced by the HESA data returns system after committing data, are scrutinised, and that any resulting issues are addressed?
• Has a review of the implementation of HESA Data Futures been carried out and any updates to systems or processes been actioned along with any associated changes to risk registers?
• Is a copy kept of the final data submitted to HESA?
• Is the method used to calculate the proportion of a module taught through the medium of Welsh documented, reasonable and consistently applied?
• Are any manual amendments made by HEFCW/Medr to exclude Welsh medium modules checked to confirm they have been correctly excluded?
• Are any changes made to include additional information requested, or manual amendments made to the Degree Apprenticeship monitoring extracts, checked to confirm they are accurate and adjusted totals are correct?
• Are any manual amendments made by the provider to the monitoring returns output from IRIS for the part-time fee waiver and PGT Master’s bursaries documented and scrutinised before sign-off?
• Are the staff resources available, taking into consideration experience and expertise, adequate to ensure that the data returns are accurately prepared?
• Is the documentation of the system and processes and the staff resource sufficient to ensure that accurate data returns could be prepared even in the absence of some key staff?
• Is there a risk register in place and are the risks relating to the compilation of accurate data returns, and related controls to manage these risks, adequately assessed and documented together with details of planned action to be taken, where relevant, to strengthen the existing controls?
• Are returns scrutinised before submission by suitably experienced members of staff other than those compiling the return?
• Is a summary report of the data submitted to HESA presented to the HEP’s senior management team (e.g. numbers of students by mode and level and/or course and subject with comparisons to prior years and/or other returns)?
• Are the HEFCW/Medr confirmation and verification reports checked against data submitted to HESA to ensure that the HEFCW/Medr reports are accurate according to HEFCW/Medr criteria?
• Where, in addition to their directly funded provision, the FEI franchises provision in, are there controls in place to ensure that only the franchisor returns the provision to HESA?
• If the HEP has recently been formed from a merger are the data systems in place sufficiently integrated to enable the HEP to make a HESA student record return for the whole HEP?

National Measures

35. The systems and processes used to return data used in the monitoring of National Measures for 2017/18 and onwards, for HEIs, are within the scope of the audit for the following set of measures:

• Widening access;
• Participation;
• Retention;
• Part-time;
• Welsh medium;
• Student mobility;
• Continuing Professional Development;
• Total HE-BCI income per full-time equivalent (FTE) of academic staff;
• Spin off activity;
• Start – up activity (graduate);
• Research Staff;
• PGR students;
• PhDs awarded;Research income;
• EU/Overseas students;
• EU/Overseas staff;
• Transnational Education.

36. A subset of the National Measures are included in the scope of the audit for FEIs:

• Widening Access;
• Participation;
• Retention;
• Part-time;
• Welsh medium.

37. HESA UK performance indicator (PI) data, which are derived from HESA student record data, were used in the calculation of the participation and retention National Measures. HESA previously produced PIs on behalf of all the HE funding and regulatory bodies of the UK and announced that 2022 would be the last year that PIs would be published and indicators will be reviewed for migration into Official statistics or Open data. However at the present time there are no updates to the UK PIs used to monitor participation and retention. This means that 2020/21 academic year data were the last used to produce PIs in their current form. More information about the UK performance indicators can be found on the HESA website. While we are unable to update the retention measure for 2021/22 and 2022/23, we have been able to update the participation measure for both 2021/22 and 2022/23. HESA kindly provided us with the 2021/22 data calculated using the UKPI methodology as a one-off, and we have calculated 2022/23 using a methodology which follows HESA’s participation methodology as closely as possible.

38. The fields and criteria used to extract the data used in monitoring these measures are detailed in the Higher Education Data Requirements circular (HEFCW circular W23/27HE). Testing of systems and processes used to return data that are used in funding will cover most of the testing appropriate for HESA data used in monitoring National Measures. In any testing of the HESA student record, auditors should take note of the guidance in previous paragraphs relating to the 2023/24 HESA student record, particularly in paragraphs 6 and 14. In addition to the points in paragraph 34, testing should aim to answer the following questions:

HESA student record:

• Do the controls include quality checks on individualised data prior to submission to HESA, in particular for data fields used in monitoring (e.g. checks that the student’s mobility experience data is correct)?
• Is there evidence that for National Measures data extracts contained in the IRIS output produced by the HESA data returns system after committing data, is scrutinised, and that any resulting issues are addressed?

HESA Higher Education Business and Community Interaction (HEBCI) survey:

• Are HEBCI survey definitions and guidelines utilised and adhered to?
• Are validation and credibility checks carried out before returning data (e.g. comparisons with previous year’s data)?
• Are the methods and processes used to collate and extract data documented?
• Is there an adequate audit trail to confirm that data extraction methods are being applied as documented?
• Are the staff resources available, taking into consideration experience and expertise, adequate to ensure that the data returns are accurately prepared?
• Is the documentation of the systems and processes and the staff resource sufficient to ensure that data returns could be prepared even in the absence of some key staff?
• Is there a risk register in place and are the risks relating to the compilation of data returns, and related controls to manage these risks, adequately assessed and documented together with details of planned action to be taken, where relevant, to strengthen the existing controls?
• Are returns scrutinised before submission by suitably experienced members of staff other than those compiling the return?
• Is a summary report of the data returned presented to the HEP’s senior management team (e.g. the items of data used in Corporate Strategy targets with comparisons to prior years and/or other returns)?
• Is there a suitable process in place to ensure that staff who provide information (e.g. in departments) and staff compiling the return liaise as necessary to ensure that the most up to date information available relating to the survey period is included in the return?
• Are processes used to calculate estimates reasonable and documented, and is their reliability tested?
• If the HEP has recently been formed from a merger are the systems in place sufficiently integrated to enable the HEP to make a HEBCI survey return for the whole HEP?
• Do the controls include a reconciliation of the total amount of income recorded on the HE-BCI survey from collaborative research, consultancy, contract research, continuing professional development, facilities and equipment related services, intellectual property and regeneration and development returned with the audited accounts to ensure consistency?

HESA finance record:

• Are definitions and guidelines utilised and adhered to?
• Are validation and credibility checks carried out before returning data (e.g. comparisons with previous year’s data)?
• Are the methods and processes used to collate and extract data documented?
• Is there an adequate audit trail to confirm that data extraction methods are being applied as documented?
• Is a copy kept of the final data submitted?
• Are the staff resources available, taking into consideration experience and expertise, adequate to ensure that the data returns are accurately prepared?
• Is the documentation of the systems and processes and the staff resource sufficient to ensure that data returns could be prepared even in the absence of some key staff?
• Is there a risk register in place and are the risks relating to the compilation of data returns, and related controls to manage these risks, adequately assessed and documented together with details of planned action to be taken, where relevant, to strengthen the existing controls?
• Are returns scrutinised before submission by suitably experienced members of staff other than those compiling the return?
• Is a summary report of the data returned presented to the HEP’s senior management team (e.g. the items of data used in Corporate Strategy targets with comparisons to prior years and/or other returns)?
• Is there a suitable process in place to ensure that staff who provide information (e.g. in departments) and staff compiling the return liaise as necessary to ensure that the most up to date information available relating to the survey period is included in the return?
• Do controls include a reconciliation of the returned Research income values with the audited accounts to ensure consistency?

HESA Staff record

• Are quality checks carried out on individualised data for data fields used in National Measures (e.g. nationality, academic employment function)?
• Where errors were identified in prior returns, by Medr/HEFCW, HESA or the HEP, through audit or otherwise, have processes been implemented to address these data errors?
• Where errors have previously been identified in data used in National Measures, are the data checked prior to final submission of data to HESA to confirm that the error has not reoccurred?

HESA Aggregate Offshore Record

• Are quality checks carried out on headcount data used in the Transnational Education National Measure?

PGR and QR Funding

39. More information about the funding methodology for both the PGR training funding allocation and the QR funding allocation, which were revised in 2022/23, can be found in circular W22/24HE.

40. PGR training funding for 2024/25 was allocated using data about eligible, fundable student FTEs in REF 2021 units of assessment (UoAs) which qualified for QR funding taken from the 2022/23 HESA student record. Students eligible to be included in the calculation of PGR funding are those in REF 2021 units of assessment (UoAs) that were included in the QR funding model for 2022/23.

41. The fields and criteria used to extract the data from the record for 2023/24 funding are detailed in the Higher Education Data Requirements circular Medr/2024/01. In any testing of the HESA student record, auditors should take note of the guidance in previous paragraphs relating to the 2023/24 HESA student record, particularly in paragraphs 6 and 14. In addition to the points in paragraph 29, testing should aim to answer the following questions:

HESA student record:

• Are quality checks carried out on individualised data for data fields used in calculating PGR funding (e.g. fundability status is correct; UoA is correct; student FTE is correct; postcode and domicile are correct)?
• Are the Medr confirmation reports checked against data submitted to HESA to ensure the Medr reports are accurate according to Medr criteria?
• Where errors were identified in prior returns, by Medr, HESA or the HEP, through audit or otherwise, particularly those which led to reductions in PGR funding, have processes been implemented to address these data errors and to mitigate against errors in future returns?
• Where errors have previously been identified in PGR data, are the PGR data checked prior to final submission of data to HESA to confirm that the error has not reoccurred?

42. Following the implementation of the new funding methodology for QR funding allocations for 2022/23, all input data were frozen. Therefore data used to calculate 2024/25 QR funding remain the same as those used to calculate 2022/23 QR funding. Data used to calculate 2022/23 QR funding were taken from REF 2021, and from the 2018/19, 2019/20 and 2020/21 HESA finance record . The REF 2021 is not included in the scope of the audit.

43. Checks on the systems and processes used to return data relating to the student finance data from the particular years used in the QR funding allocation are included in the scope, only where they have not been included in previous audits and this is considered to be an area of risk. The questions these checks should aim to answer are outlined in the section above.

Research Wales Innovation Fund (RWIF)

44. This funding stream is calculated using data from the HE providers HESA HEBCI survey and from their HESA staff, student and finance records.

45. The details of this process can be found in HEFCW circular W23/12HE and the allocations for 2024/25 are outlined in HEFCW circular W24/13HE. Testing should aim to answer the following questions (in addition to those listed for other funding streams above):

HESA student record (Open University in Wales only):

• Do the controls include quality checks on data prior to submission, in particular for the data fields used for RWIF (e.g. that student FTE is returned correctly)?

HESA Higher Education Business and Community Interaction (HEBCI) survey:

• See the HEBCI questions in paragraph 38.
• Do the HEBCI values signed off during the RWIF verification frequently differ from those values submitted to HESA?

HESA finance record:

• See the HESA finance record questions in paragraph 38.

HESA Staff record

• Are quality checks carried out on data for data fields used in this return (e.g. that academic Staff FTE is returned correctly)?

Data returned on fee and access plans and fee and access plan monitoring returns

46. Fee and Access Plans covering two years were submitted in 2024. The approved plans covered the 2025/26 and 2026/27 academic years.

47. Fee and Access Plans were returned in line with guidance included in HEFCW circular W24/07HE Fee and Access Plan guidance. Data required for HEI submissions were limited to total numbers of students forecasted for study at each of the institutions’ location of study. Detailed guidance for this can be found in paragraphs 157 to 165 in HEFCW circular W22/19HE. In addition to this, FEIs were required to submit information on total fee income to be received and financial information. Guidance for this can be found in W22/19HE in paragraphs 155-156 and 166-173 respectively.

48. Institutions were invited to provide applications for Fee and Access Plan variations in March 2024 further to an increase in tuition fee limits made by Welsh Government in February. As part of that process, institutions were required to submit a tracked change version of their original Plan, alongside a variation request form. In submitting the variation, governing bodies of those institutions were confirming that they:
i) were compliant with CMA requirements and have taken appropriate legal advice;
ii) had consulted students on the variation;
iii) involved student representatives in the approval process;
iv) would continue to invest their agreed proportion of tuition fee income with no reduction to the proportion of investment to promote equality of opportunity; and
v) had involved partner providers where fee levels are being varied at courses delivered under franchise arrangements.

49. Fee and Access Plan monitoring is incorporated into the annual assurance return process. Institutions’ governing bodies are required to sign off the following statements in relation to Fee and Access Plans:

• No regulated course fees have exceeded the applicable fee limits, as set out in the 2023/24 Fee and Access Plans.
• The institution has assurances in relation to the management of the provision of fee information across all recognised sources of the institution’s marketing.
• The institution has taken all reasonable steps to comply with the general requirements of the 2023/24 Fee and Access Plans.
• The institution to provide documentation to support Fee and Access Plan sign off.
• The institution has taken all reasonable steps to maintain previous levels of investment, including maintaining:
  • the splits between investment to support equality of opportunity and promoting higher education,
  • investment to support the Reaching Wider partnership and student support investment.

50. The documentation produced internally that enables the governing body to sign off its annual assurance statement must be submitted alongside the annual assurance return. These documents enable us to understand the basis on which the governing body was able to sign off the Fee and Access Plan related statements of the annual assurance return. In addition to this, we also require documentation to be submitted to evidence how institutions evaluate the effectiveness of investment to deliver on Fee and Access Plan objectives. Auditors should familiarise themselves with the data required to enable the governing body to sign off this part of the statement and to inform the evaluation of the effectiveness of the Fee and Access Plan. Guidance to inform institutions is provided at Annex D.

Other HESA data

51. Other HESA data not covered in the previous paragraphs that are also under the scope of the audit include data returned on the HESA finance record, aggregate offshore record, Estates Management record, HEBCI survey and data returned on the HESA Unistats record.

52. Testing of systems and processes used to return data that are used in National Measures and RWIF funding (see relevant sections above) will cover most of the testing appropriate for HESA HEBCI survey data and HESA finance record data.

53. The Unistats dataset contains information about courses. Included in the scope of an audit of Unistats data are course related data and accommodation cost data. Testing should aim to answer the following questions:

• Have eligible courses been returned on the Unistats dataset and are the data for those courses accurate?
• Where data have been estimated, have estimates been made on a reasonable basis and documented?

54. The following funding streams were also allocated:

• Higher Education Research Capital (HERC) Funding 2024/25 (W24/14HE)
• Capital Funding 2024-25 (W24/12HE)

The audit of systems and processes used in other funding streams is sufficient to also provide assurance for the funding streams listed in this paragraph.

HESA Data Futures Programme

55. Data Futures is Jisc’s transformation programme for collecting student data, and was implemented for the 2022/23 HESA student record collection.

56. The 2022/23 and 2023/24 collections were an annual collection using the Data Futures data model. The 2024/25 collection will continue to be an annual collection.

57. Auditors should familiarise themselves with the programme and the requirements for the new record from 2022/23 and into 2023/24. We recommend that any review of the 2023/24 HESA student record should follow the guidance as described in paragraph 6, given the continuing difficulties that providers encountered in returning the record. We would expect auditors to provide opinions on the controls in place to manage risks relating to the record going forward including plans to review and/or improve processes, documentation and data quality using lessons learnt from the return of both 2022/23 and 2023/24 data, moving into the 2024/25 return, even if those processes or plans are not yet in place.

58. Testing should aim to answer the following questions:

• Did the HEP have sufficient resource, in terms of both finance and suitably skilled staff in making the 2023/24 return?
• Were senior management aware of any issues that their provider encountered for the 2023/24 return?
• Is there a plan in place to review any data quality issues, targets set resulting from IMS queries, or to put in place any lessons learnt from the 2022/23 and 2023/24 returns, to improve future returns?

Interpretation and Guidance

59. Auditors should familiarise themselves with the latest, at the time of audit, HESES, EYM, HESA guidance (including for the HEBCI survey and finance record), data requirements circular and where available, the fee and access plan process and guidance. Some of the publications may be updated after publication of this publication and auditors should pay particular attention to any changes made to the data collected that imply changes to the way in which systems and processes work and assess whether HEPs have made or intend to make appropriate adjustments.

60. Any further clarification relating to the guidance for making HESES, EYM, HESA returns or extracting EYM data from the HESA student record via the IRIS system or relating to fee and access plan guidance can be obtained from Medr via [email protected].

Open University in Wales

61. Medr has responsibility for some funding relating to teaching and RWIF at the Open University (OU) in Wales. Teaching and RWIF funding allocated to the OU in Wales is calculated using the same funding methodology as other HEIs. As in previous years the systems and processes used to compile data returns to HESA and Medr that are used in the calculation of teaching and RWIF funding are included in the scope of the internal audit. In addition, the OU in Wales is included in the National Measures and so the systems and processes used for monitoring these are included in the scope of the audit. The OU in Wales does not currently receive PGR or QR funding from Medr and as the OU are not a Medr regulated institution, do not submit a fee and access plan.

Reporting

62. The annual internal audit plan should include a review of the controls in place to manage the risks relating to the submission of accurate data returns and where appropriate, data returned in and used to monitor the FAPs.

63. This review should include an assessment of the adequacy of the controls documented in paragraphs 29 to 58 above as relevant. However, the precise scope of the internal audit work completed will be determined by each HEP’s assessment of the risks relating to their HEP’s data return and it is expected that the internal audit work will focus on the higher risk aspects of the systems and processes, for example, issues identified in previous audits, or aspects not covered in previous audits. It is expected that the scope would address any data issues or errors found by the HEP or HEFCW/Medr in terms of processes in place to correct the errors and to mitigate against any future errors. In assessing the risks, we would expect the HESA student record return for 2023/24 to be an area of risk, however, providers should take account of the guidance provided in paragraphs 6 and 14 in relation to the 2023/24 record when determining the scope of the audit work.

64. The timing of the internal audit work should be arranged so that the internal audit report can be completed and presented to the HEP’s Audit Committee before a copy of the report is sent by the HEP to Medr by 27 June 2025.

65. Where the Audit Committee’s internal audit plan includes only very limited work in relation to data systems and processes, because there is perceived to be low risk in this area, an institutional representative should contact Medr to inform us why this area is considered low risk and how annual assurance can be obtained in these circumstances. The representative should contact Medr at the point that their Audit Committee finalises their audit plan if this is the case. Similarly, if there are any changes to the cyclical nature of the plan or timing of committees that mean that an audit report will not be available by the deadline of 27 June 2025, a representative should contact Medr to discuss.

66. The internal audit report should include:

• A description of the objectives of the audit and the risks and controls included within the scope of the audit;
• Details of the audit work completed;
• Details of issues identified during the audit and the recommendations made to address these;
• Details of processes put in place to correct the errors and to mitigate against any future errors of any data issues or errors found by the HEP or HEFCW/Medr;
• A consideration of the recommendations made in previous audit reports and the extent to which these have been effectively implemented;
• Management’s responses to the report’s recommendations and the agreed timescales for their implementation;
• Details of any disagreements or recommendations which were not accepted by management;
• A clear conclusion and overall opinion as to the adequacy and effectiveness of the controls in place to manage the risks relating to the accuracy of the data returns included within the scope of the audit.

67. If the internal audit report’s overall conclusion, or the conclusions relating to the adequacy of the design of the system of control and the application of those controls, provides a negative opinion (e.g. limited or no assurance, unsatisfactory or inadequate controls) details of the significant exceptions giving rise to this opinion should be provided in the report. In these circumstances the HEP’s Audit Committee and Medr should be informed of the relevant issues as soon as possible.

68. The HEP’s Audit Committee should include reference in its annual report to the reports and assurances that it has received during the year in respect of the controls in place to manage the quality of data returns made by the HEP for funding or monitoring purposes and the controls relating to data returned in and used to monitor the fee and access plans.

69. An electronic copy of the audit report and any associated correspondence should be sent by the HEP to [email protected] no later than 27 June 2025. Note that we do not require a paper copy to be sent to us.

70. Details of the internal audit work and reports completed since the last external audit of higher education data should be retained and if required be made available to any external auditors as advised by Medr. The Medr Audit Service may also wish to review these reports and related papers during their periodic visits to the HEP.

Further information

71. Further guidance and information is available from Rachael Clifford or Hannah Falvey ([email protected]).