Strategic and Governance Services

Terms of Reference

The purpose of the Quality, Audit and Risk Committee (‘QARC’ or ‘the Committee’) is to assist Council in fulfilling and discharging its responsibilities in relation to the University operations and strategic objectives, by providing independent and objective advice on the adequacy, integrity and/or effectiveness of the University’s systems of risk management, internal control and compliance; and such other matters as are referred to it by Council.

To this end, QARC has responsibility for:

1. Ensuring that collectively, quality improvement, risk management, compliance and control tools enhance the effectiveness, efficiency and economy of University activities.
2. Ensuring that the University has appropriate systems and processes in place to support the achievement of the University’s strategic plan as it relates to matters of risk management, internal control and compliance.
3. Assisting Council to meet its obligations under certain legislation, regulation and standards.
4. Reporting to Council as required on such other matters as may be referred to the Committee by the Council, Chancellor or Vice-Chancellor.
5. Making decisions on matters delegated to the Committee by Council.

The Committee has the authority to speak with any person, internal or external to the University, access any records, and act on behalf of Council in obtaining assurance on matters that fall within its terms of reference.

The Committee will:

Audit and Assurance

1. Review and recommend to Council the approval of the Internal Audit Charter to ensure appropriate protocols, access and reporting arrangements are in place.
2. Assess and approve progress against the internal audit work plan:
   • Assess the internal audit coverage and annual work plan and oversee progress of the work plan, including approving any significant changes to it.
   • Advise the Council on the adequacy of internal audit resources to carry out its responsibilities, including completion of the approved internal audit plan.
3. Oversee the coordination of audit programs conducted by internal audit and external audit respectively.
4. Consider the key findings of internal and external audit reports and assess management’s response in terms of content and timeliness.
5. Assess the adequacy of management’s implementation of internal audit and external audit recommendations.
6. Consider the scope, audit plan and key findings from external audit reports, including the audit of the University’s Annual Financial Statements and Key Performance Indicators, and other reviews that the WA Auditor General may conduct from time-to-time.
7. Periodically assess the performance of internal audit.

Risk Management

1. Review and recommend to Council the approval of the integrated risk management policy and framework, including the risk management function and its resourcing.
2. Review and recommend to Council the approval of University’s risk appetite; and assess the processes to ensure the University operates within the approved risk appetite.
3. Assess and provide advice on the adequacy, integrity and effectiveness of the risk management framework including the identification of key enterprise-wide risks, and in relation to strategic, operational and emerging risks (including corporate, academic governance, cybersecurity and values-based culture risks).
4. Assess management’s evaluation of the effectiveness of internal controls.
5. Assess the effectiveness of the University’s business continuity management practices and insurance and risk financing activities.
6. Receive advice from management on critical incidents and assess management’s treatment action plans.
7. Consider significant work health and safety risks, and assess compliance with key work health and safety legislation, to enable Council to meet its obligations under all relevant safety legislation.
8. Consider significant Environmental, Social and Governance (ESG) risks, to support the realisation of the University’s purpose and strategic priorities.
9. Review and recommend to Council the acceptance of the overall level of risk associated with partially controlled entities, as defined under Voluntary Code of Best Practice for the Governance of Australian Universities.