The University of Cambridge has been assigned a “limited assurance opinion” for seven out of eleven internal audits in the annual report of the audit committee for this financial year.

The “limited” rating means that there are “weaknesses in the system of internal controls” which could “put the University’s objectives at risk”.

An internal audit undertaken by Deloitte LLP stated that they can provide “reasonable assurance that the University has an efficient and effective system of risk management and governance”, but can only provide “limited assurance” on the University’s system of internal control.

This opinion was provided after the University was assigned a “limited assurance opinion” for seven out of eleven internal audits conducted this year, with the other four receiving a “substantial assurance opinion”. The “substantial” rating means that “while there is a basically sound system of internal control, there are weaknesses, which put some of the University’s objectives at risk”.

In the previous financial year (2022/23), out of eight internal audits, five were given the substantial assurance opinion and three were given a limited assurance assessment.

Limited assurance opinions were assigned to various areas of the University, including IT portfolio governance, departmental processes for managing conflicts of interests, key financial controls, as well as procurement dispensations and savings.

This comes after an internal report projected the University to face a £53m deficit for the academic year 2023/24, with “no fully worked-out proposal” to pull the University out of deficit within the next five years.

The University was also instructed to “focus on [the] timely implementation of agreed actions from this year’s limited assurance report” after 15 of the 123 open actions from the previous financial year’s report were overdue in October 2024 – an increase from the 18 out of 150 incomplete actions in September 2023.

However, the University’s audit committee noted that many of the limited assurance audits had been assigned towards the end of the financial year when actions had been agreed but not yet implemented. The committee also noted that the University’s implementation of audit actions was improving and should consequently improve its internal controls in the longer term.

Overall, the committee considered that the University’s internal control environment “was not getting worse”, but there is a need to “speed up the pace in implementing audit actions and driving change in response to audits”.

Alongside the internal audit, an external audit was conducted by PricewaterhouseCoopers LLP (PwC). The external auditor, when carrying out non-audit work, reported two instances of fraud in the 2023-24 academic year which have since been closed with plans to tighten controls in the future.

But, since June 2023, five new cases have been recorded under the University’s Whistleblowing Policy. Investigations into four are ongoing, with the fifth unlikely to warrant an investigation.

The University paid over £2.5million to PwC and Deloitte for the internal and external audits.

The University of Cambridge was contacted for comment.