(Paper 2)

Audit Committee Terms of Reference

Introduction

The Audit Committee is identified as a Committee of the Ayrshire College Board of Management. The approved Terms of Reference and information on the composition and frequency of the Committee will be considered as an integral part of the College Standing Orders.

The Committee will be known as the Audit Committee of the Board and will be a Standing Committee of the Board of Management. For the purposes of the Terms of Reference, unless otherwise indicated, ‘the Board’ means the Ayrshire College Board of Management.

Remit

The Committee will be responsible for overseeing all matters related to the external and internal audit of the College and provide assurance to the Board that the requirements of the Code of Audit Practice published by Audit Scotland are observed along with all other relevant regulations and legislation. The Committee will have a particular engagement with internal and external audit and financial reporting issues.

Committee Membership

The Committee membership shall consist of a minimum of four non-executive Board members who shall be independent and objective in terms of their Audit Committee function and, in line with good practice, will not include either the Principal or the Chair of the Board. At least one member of the Audit Committee must have recent relevant financial or audit experience.

The Committee Chair will be appointed by the Board.

Committee membership will be reviewed annually by the Board, taking account of the remaining terms of office of the Committee members.

Quorum

50% of the total membership of the Committee will constitute a quorum.

Attendance

The Committee may co-opt additional individuals as appropriate. Details of proposed co-opted individuals will be notified to the Chair of the Board in advance. The role, remit and term of membership of co-opted individuals will be determined by the Committee. AyrshireAyrshire CollegeCollege ## 193132484082 External and Internal Auditors shall normally attend meetings and 09/12/201810/31/2018will be invited 14:26:1914:56:15 to all meetings.

Audit Committee, 18 September 2018 1 The Vice Principal Finance and College Systems, the Director of Finance and Student Funding and, where appropriate, other staff should attend meetings of the Committee to provide information and reports as appropriate.

Meetings

The Committee shall normally meet on a quarterly basis, but shall meet on a minimum of three occasions per annum.

Any member of the Committee may convene additional meetings of the Committee as and when required by giving a minimum of ten working days’ notice to the Secretary to the Board of Management to call a meeting.

The Committee Chair will instruct the Secretary to the Board of Management to call meetings of the Committee. The agenda and supporting papers will be sent to members at least five working days before the day of the meeting.

The Committee may meet privately without any non-members (with the exception of the secretary) for all or part of a meeting if they so decide.

The Committee will normally meet with the External and Internal auditors annually without any members of the Executive Management Team being present.

Duties

 To agree Strategies within the Committee’s overall remit subject to Board of Management Approval.

 Reviewing and advising the Board of Management on the effectiveness of the College’s financial and other internal control Systems.

 Reviewing and advising the Board of Management on corporate governance requirements.

 Appointing the College’s Internal Auditors and agreeing on the terms of reference for an audit service.

 Reviewing the scope and effectiveness of the work of the internal and external auditor using appropriate performance indicators.

 Considering issues raised in audit reports, annual management letter and reporting to the Board of Management on action required.

 Considering the College’s annual financial statements and external auditor’s report prior to submission to the Board of Management by the Finance Committee. Recommending to the Board the adoption ofAyrshire the audited College Annual # 193132484082 Accounts. 09/12/201810/31/2018 14:26:1914:56:15

 Agreeing an internal and external audit plan.

Audit Committee, 18 September 2018 2  Advising the Board of Management on internal and external value for money reviews which secure the effective use of College resources.

 Preparing an Annual Report to the Board of Management on the work of the Audit Committee which will then be submitted to the Scottish Funding Council.

 Reviewing reported cases of impropriety to establish whether they have been appropriately handled.

 Agreeing the fees of Internal and External Auditors.

 Ensuring the system of risk management established by Ayrshire College remains fit for purpose and is being appropriately maintained.

 At each meeting receive and consider the rolling Ayrshire College Risk Register and comment accordingly to the Board of Management.

Authority

The Committee is authorised to investigate any matters which fall within its Terms of Reference.

The Committee is authorised to seek and obtain any information it requires from any Senior Manager or Employee of the College, its Advisors or Member of the Board of Management whilst taking account of policy and legal rights and responsibilities.

Reporting Arrangements

At the end of each meeting, the Committee will decide on the business of the meeting that may be fully published on the College website. Normally it would be expected that complete minutes and papers will be published: except where the exclusions listed in paragraph 2.8 of these Standing Orders apply.

Minutes will be kept of the proceedings of the Committee by the Board Secretary. These will be circulated, in draft form normally within ten working days to the Executive Management Team representative for checking and then to the Chair of the Committee for consideration. It is expected that minutes will be checked timeously and any amendments advised to the Secretary to the Board of Management.

The Chair of the Committee shall report on the work and recommendations of the Committee and submit Committee minutes to the Board meeting for information.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

Audit Committee, 18 September 2018 3 Audit Committee Work Plan 2018-19

September December March June Reports to this meeting Terms of Reference & 2018-19 2017-18 Financial Statements External Audit Strategy Review Work Plan to July 2018: and Plan for 12 Months Ending i. Board of Management July 2019 Report and Financial Statements ii. Annual Report to the Board of Management and Auditor General iii. Letter of Representation 2017-18 External Audit Internal Audit Annual Report Audit Needs Assessment - Progress Report Internal Audit Assignment Plan for 2019-20 Audit Committee Annual Report

2017-18 Audit Reports: i. SFC Credit Return ii. Student Support Funding and EMA Reports to each meeting 2018-19 Internal Audit 2018-19 Internal Audit 2018-19 Internal Audit 2018-19 Internal Audit Assignment Reports Assignment Reports Assignment Reports Assignment Reports Internal Audit Progress Report Internal Audit Progress Report Internal Audit Progress Report Internal Audit Progress Report

Internal Audit Rolling Action Internal Audit Rolling Action Internal Audit Rolling Action Internal Audit Rolling Action Plan Plan Plan Plan

Corporate Risk Register 2018- Corporate Risk Register 2018-AyrshireCorporate College Risk # 193132484082 Register 2018- Corporate Risk Register 2018- 19 (V1) 19 (V2) 09/12/201810/31/201819 (V3) 14:26:1914:56:15 19 (V4)

Audit Committee, 18 September 2018 4 Ayrshire College ANNUAL INTERNAL AUDIT PLAN 2018-19 AND INTERNAL AUDIT STRATEGY 2018-2021 September 2018 – DRAFT FOR DISCUSSION

AyrshireAyrshire CollegeCollege ## 193132484082 09/12/201810/31/2018 14:26:1914:56:15 CONTENTS

Internal Audit Approach 3 Audit Risk Assessment 4 Proposed resources and outputs 5

Appendices

I Internal Audit Plan 2018 – 2019 6

II Internal Audit Plan Overview 7

III Phasing of Plan 10

IV Internal Audit Strategy 2018 – 2021 11

V Internal Audit Charter 12

VI Internal audit protocols and performance 15

VII Ayrshire College Risk Register 19

AyrshireAyrshire CollegeCollege ## 484082193132 10/31/201809/12/2018 14:56:1514:26:19 Restrictions of use Restrictions on use: This document has been prepared solely for the management of Ayrshire College and should not be quoted in whole or in part without our prior written consent. BDO LLP neither owes nor accepts any duty to any third party whether in contract or in tort and shall not be liable, in respect of any loss, damage or expense which is caused by their reliance on this document.

2 1. INTERNAL AUDIT APPROACH

Introduction Internal Audit at Ayrshire College Our role as internal auditors is to provide an We have been appointed as internal auditors to Ayrshire College to provide the Board of independent, objective assurance and consulting Management, through the Audit Committee, with assurance on the adequacy of internal control activity designed to add value and improve an arrangements, including risk management and governance. organisation’s operations. Our approach, as set out in the Firm’s Internal Audit Manual, is to help the Responsibility for these arrangements remains fully with management, who should recognise organisation accomplish its objectives by bringing a that internal audit can only provide ‘reasonable assurance’ and cannot provide any guarantee systematic, disciplined approach to evaluate and against material errors, loss or fraud. Our role at Ayrshire College will also be aimed at helping improve the effectiveness of risk management, control management to improve risk management, governance and internal control, so reducing the and governance processes. effects of any significant risks facing the organisation. Our approach complies with best professional practice, In producing the draft internal audit plan for 2018-2021 we have sought to gain an understanding in particular the Public Sector Internal Audit Standards of the business of Ayrshire College together with its risk profile in the context of: (PSIAS). • The overall business strategy of Ayrshire College • The key areas where management wish to monitor performance and the manner in which performance is measured • The financial and non financial measurements and indicators of such performance • The information required to ‘run the business’ • The key challenges facing Ayrshire College

AyrshireAyrshire CollegeCollege ## 484082193132 10/31/201809/12/2018 14:56:1514:26:19

3 2. AUDIT RISK ASSESSMENT

Background Individual audits

Our risk based approach to internal audit uses Ayrshire College’s own risk When we scope each review, we will reconsider our estimate for the number management process and risk register as a starting point for audit planning as of days needed to achieve the objectives established for the work and to this represents the client’s own assessment of the risks to it achieving its complete it to a satisfactory standard in light of the control environment strategic objectives. identified within Ayrshire College. Where revisions are required we will obtain approval from the Vice Principal – Finance and Skills prior to commencing The extent to which we can rely on management’s own perception of risk fieldwork. largely depends on the maturity and effectiveness of Ayrshire College’s own risk management arrangements. In estimating the amount of audit resource In determining the timing of our individual audits we will seek to agree a date required to address the most significant risks, we have also sought to confirm which is convenient to Ayrshire College and which ensures availability of key that senior management’s own assessment of risk accurately reflects the officers. College’s current risk profile. We have included a summary of the current risk register at Appendix VII. A proposed phasing of our audit plan, based on our current understanding of Ayrshire College’s workloads is set out in Appendix III. Planned approach to internal audit 2018-19 Variations to the Plan The Internal Audit proposed audit programme for 2018-19 is shown at Appendix I. We will keep the programme under continuous review during the Significant variations to the plan arising from our reviews, changes to Ayrshire year and will introduce to the plan any significant areas of risk identified College’s risk profile or due to management requests will be discussed in the during that period. first instance with the Vice Principal – Finance and Skills and approved by the Audit Committee before any variation is confirmed. We have set out further in Appendix II the rationale for the inclusion of particular reviews in the audit plan, based on our initial review of the Internal Audit Charter College’s risk register, discussions with a number of key stakeholders and consideration of various documents, publications and information sources. We have set out in Appendix V our Internal Audit Charter which gives fuller details of the role and responsibilities of internal audit. We have set out in Appendix IV a high level view of our proposed internal AyrshireAyrshire CollegeCollege ## 484082193132 audit coverage over the period 2018-19 to 2020-21. 10/31/201809/12/2018 14:56:1514:26:19

4 3. PROPOSED RESOURCES AND OUTPUTS

Staffing

The core team that will be delivering this programme to you is shown below: Our indicative staff mix to deliver the programme is shown below: Name Grade Telephone Email Grade 2018-19 (days) Grade Mix (%)

Director 5 11 Claire Robertson Director 07583 237579 [email protected] Manager 16 33 Andrew Manager 07583 044332 [email protected] O’Donnell Auditors 27 56 Total 48 100

Following completion of the internal audit programme for 2018-19 we will The core team will be supported by specialists from our national Risk and produce an Internal Audit Annual Report summarising our key findings and Advisory Team and wider firm as and when required. evaluating our performance in accordance with agreed service requirements. We have set out at Appendix VI a summary of our proposed Reporting to the Audit Committee performance measures and intended working protocols.

We submit the Internal Audit Plan for discussion and approval by the Audit Committee at its next meeting. We will liaise with the Vice Principal – Finance and Skills and other senior officers as appropriate to ensure that internal auditAyrshireAyrshire CollegeCollege ## 484082193132 reports summarising the results of our visits are presented to the appropriate 10/31/201809/12/2018 14:56:1514:26:19 Audit Committee meeting.

5 APPENDIX I Internal Audit Plan 2018-19

Assurance / Assurance Theme Subject Days Advisory / Regulatory Assurance / Governance and Risk Risk management 5 Advisory Financial controls – financial planning and longer term Financial Control 5 Assurance forecasting Internal Control Systems Estates and infrastructure 5 Assurance SFC returns 5 Assurance Student experience / curriculum review 5 Assurance Commercial income generating programmes 6 Assurance IT security 7 Assurance Follow Up and Contract Management Follow up 3 Audit Committee 3 Client Liaison 3 Annual Reporting 1 TOTAL 48

AyrshireAyrshire CollegeCollege ## 484082193132 10/31/201809/12/2018 14:56:1514:26:19

6 APPENDIX II Internal Audit Plan Overview

Overview

The plan overview sets out the proposed audits in more detail and highlights further comment and rationale for inclusion in the Annual Internal Audit Plan 2018-19, together with the risk assessment source. We will scope individual audits in advance of commencing any reviews and agree terms of reference with key officers involved.

Audit Area Comment Source

Risk Management BDO’s risk based approach to internal audit will seek to place reliance on the a) BDO Assessment risk management arrangements in place at Ayrshire College to inform the annual planning process. In order for BDO to place assurance on the risk register, a review will be performed to assess the maturity and on going effectiveness of the risk management arrangements currently in place, including policy, role and responsibilities, methods for identifying, evaluating and measuring key risks and risk reporting arrangements.

Financial Controls – Financial planning and We have included coverage of key financial control areas in each year of the a) BDO Assessment longer term forecasting internal audit plan. In 2018-19, we will assess the design and effectiveness of b) Risk Register the controls in place surrounding financial planning. This will include an assessment of whether: the financial plans are based on reasonable assumptions and forecasts and accurate, reliable information; financial plans are developed in a timely manner with appropriate consultation, review and approval arrangements; scenario planning and sensitivity analysis has been carried out to ensure budgets are flexible and robust enough to meet organisational requirements and respond to funding changes; and budget reforecasts are carried out on a regular basis to reflect changes which may occur to plans, or to predict the outturn where expenditure in some areas differs from expectations. AyrshireAyrshire CollegeCollege ## 484082193132 10/31/201809/12/2018 14:56:1514:26:19 SFC returns We will review the return submitted to SFC at 31 March, to provide assurance a) BDO Assessment that the figures reported are in line with the College’s management accounts. b) Risk Register

7 APPENDIX II Internal Audit Plan Overview

Audit Area Comment Source

Estates and Infrastructure We will review the progress made on the implementation of the College’s a) BDO assessment Infrastructure Strategy and future plans. We will assess whether progress is in b) Risk Register line with the planned costs and timescales, and is delivering the benefits c) Strategic Plan expected. We will assess whether risks relating to the programme are being identified, managed and reported effectively.

Student Experience / Curriculum review We will review arrangements over an aspect of Student a) BDO Assessment Experience/Curriculum identified as higher risk by the Learning & Teaching b) Risk Register Committee.

Commercial income generating programmes We will review the effectiveness of the College’s commercial income a) BDO assessment generating programmes, e.g. trade body courses, Flexible Workforce Risk Register Development Fund and Business Solution activities. We will review the b) processes in place within the College to plan for and manage commercial c) Strategic Plan activity. This will include a review of whether the College is setting and achieving targets for commercial activity in areas which align to the College’s strategic objectives, and a review of whether an appropriate framework is in place to cost, risk assess, and approve commercial activities to ensure they offer value for money, and risks are effectively managed. We will also assess whether appropriate contractual arrangements are put in place for commercial activities, and review whether there is appropriate management reporting and oversight in place with regard to commercial activities.

AyrshireAyrshire CollegeCollege ## 484082193132 10/31/201809/12/2018 14:56:1514:26:19

8 APPENDIX II Internal Audit Plan Overview

Audit Area Comment Source

IT Security Protecting IT systems from unauthorised access and attack is important to a) BDO assessment preserve the integrity of systems and data. Effective network and systems b) Risk Register security controls help prevent and detect both external and internal security breaches. We will evaluate the design and operational effectiveness of certain key network and system security controls on the Ayrshire College network with reference to good practice, and recommend areas for improvement.

Follow Up The effectiveness of the internal control system may be compromised if a) BDO assessment management fails to implement agreed audit recommendations. Our follow up work will provide the Audit Committee with assurance that prior year, and in some cases in-year, recommendations are implemented within the expected timescales.

AyrshireAyrshire CollegeCollege ## 484082193132 10/31/201809/12/2018 14:56:1514:26:19

9 APPENDIX III Phasing of the Plan

Respecting existing work pressures, and subject to the availability of key officers, we would look to agree with Ayrshire College the phasing of our audit work as shown in the following tables. We would normally seek to phase our work around Audit Committee dates.

Block 1: August – October 2018 Block 2: November 2018 – January 2019

Review Proposed Audit Sponsor Review Proposed Audit Sponsor

Financial controls – financial planning Risk management Michael Breen / James Thomson Michael Breen / James Thomson and longer term forecasting

IT security Michael Breen / James Thomson

Commercial income generating Michael Breen / James Thomson programmes

Block 3: February – April 2019 Block 4: May – July 2019

Review Proposed Audit Sponsor Review Proposed Audit Sponsor Student Experience / Curriculum Estates and infrastructure Michael Breen / James Thomson Michael Breen / James Thomson Review SFC returns Michael Breen / James Thomson Follow up Michael Breen / James Thomson

AyrshireAyrshire CollegeCollege ## 484082193132 10/31/201809/12/2018 14:56:1514:26:19

10 APPENDIX IV Internal Audit Strategy 2018- 2021

Subject Risk Register 2018 – 2019 2019 – 2020 2020-2021

Risk Management 

Corporate Governance  

Financial Controls     Partnership Working  

Data Protection (GDPR)  

Staff Recruitment and Retention  

IT Security  

Commercial income generating programmes  

Student experience / curriculum review     SFC returns    IT Strategy  Estates and Infrastructure   Business Continuity Management  

Student Support (FE Bursary / Discretionary /    Childcare funds, HE Discretionary Fund & EMA)

Further Education Statistical (FES) return    Follow up    AyrshireAyrshire CollegeCollege ## 484082193132 10/31/201809/12/2018 14:56:1514:26:19

11 APPENDIX V Internal Audit Charter

Purpose of this Charter Internal Audit’s Authority

This Charter formally defines Internal Audit’s purpose, authority and The Head of Internal Audit and internal audit staff are authorised to : responsibility. It establishes Internal Audit’s position within Ayrshire College • Have unrestricted access to all the College’s records, property, and personnel (“the College”) and defines the scope of Internal Audit activities. relevant to the performance of engagements • Obtain the necessary assistance of the College’s personnel in relevant engagements, as well as other specialised services from within or outside the Internal Audit’s Purpose College.

Internal Audit provides an independent, objective assurance and consulting Internal Audit has no authority or management responsibility for any of its activity designed to add value and improve the College’s operations. It helps engagement subjects. the College accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, Internal Audit will not make any management decisions or engage in any control and governance processes. activity which could reasonably be construed to compromise its independence .

Internal Audit acts primarily to provide the Audit Committee with information Internal Audit’s Responsibility necessary for it to fulfil its own responsibilities and duties. Implicit in Internal Audit’s role is that it supports the College’s management to fulfil its own risk, The Head of Internal Audit is responsible for all aspects of Internal Audit control and compliance responsibilities. activity, including strategy, planning, performance, and reporting.

The Head of Internal Audit will:

Strategy • Develop and maintain an Internal Audit Strategy • Review the Internal Audit Strategy at least annually with management and Board of Management

AyrshireAyrshire CollegeCollege ## 484082193132 10/31/201809/12/2018 14:56:1514:26:19

12 APPENDIX V Internal Audit Charter

Planning Reporting • Develop and maintain an Internal Audit Plan to fulfil the requirements of • Issue a report to management at the conclusion of each engagement to this Charter and the Internal Audit Strategy confirm the results of the engagement and the timetable for the completion • Engage with Management and consider the College’s strategic and of management actions to be taken operational objectives and related risks in the development of the Internal • Provide periodic reports to management and the Audit Committee Audit Plan summarising Internal Audit activities and the results of Internal Audit • Review the Internal Audit Plan periodically with management Engagements • Present the Internal Audit Plan, including updates, to the Audit Committee • Provide periodic reports to management and the Audit Committee on the for periodic review and approval status of management actions taken in response to Internal Audit • Prepare an Internal Audit Budget sufficient to fulfil the requirements of this Engagements Charter, the Internal Audit Strategy, and the Internal Audit Plan • Report annually to the Audit Committee and management on Internal Audit • Submit the Internal Audit Budget to the Audit Committee for review and performance against goals and objectives approval annually • Report as needed to the Audit Committee on management, resource, or • Coordinate with and provide oversight of other control and monitoring budgetary impediments to the fulfilment of this Charter, the Internal Audit functions, including Risk Management, Compliance & Ethics, and external Strategy, or the Internal Audit Plan audit • Inform the Audit Committee of emerging trends and practices in internal • Consider the scope of work of the external auditors for the purpose of auditing. providing optimal audit coverage to the College.

Performance • Implement the Internal Audit Plan • Maintain professional resources with sufficient knowledge, skills and experience to meet the requirements of this Charter, the Internal Audit Strategy and the Internal Audit Plan • Allocate and manage resources to accomplish Internal Audit engagement objectives • Establish and maintain appropriate internal auditing procedures incorporating best practice approaches and techniques AyrshireAyrshire CollegeCollege ## 484082193132 • Monitor delivery of the Internal Audit Plan against the Internal Audit Budget 10/31/201809/12/2018 14:56:1514:26:19 • Ensure the ongoing effectiveness of Internal Audit activities.

13 APPENDIX V Internal Audit Charter

Independence and Internal Audit’s Position within the College Internal Audit’s Scope

To provide for Internal Audit’s independence, its personnel and external The scope of Internal Audit activities includes all activities conducted by the partners report to the Head of Internal Audit, who reports functionally to the College. The Internal Audit Plan identifies those activities that have been Board of Management. The Head of Internal Audit has free and full access to identified as the subject of specific Internal Audit engagements. the Chair of the Board of Management. Assurance engagements involve the objective assessment of evidence to The Head of Internal Audit reports administratively to the Head of Finance provide an independent opinion or conclusions regarding an entity, operation, who provides day-to-day oversight. function, process, system or other subject matter. The nature and scope of the assurance engagement are determined by Internal Audit. The appointment or removal of the Head of Internal Audit will be performed in accordance with established procedures and subject to the approval of the Consulting engagements are advisory in nature and are generally performed at Chair of the Board of Management. the specific request of management. The nature and scope of consulting engagement are subject to agreement with management. When performing The Internal Audit service will have an impartial, unbiased attitude and will consulting services, Internal Audit should maintain objectivity and not assume avoid conflicts of interest. management responsibility.

If the independence or objectivity of the Internal Audit Service is impaired, details of the impairment should be disclosed to either the Head of Finance, Standards of Internal Audit Practice or the Chair of the Board of Management, dependent upon the nature of the impairment. Internal Audit will perform its work in accordance with the International Professional Practices Framework of the Chartered Institute of Internal The Internal Audit Service is not authorised to perform any operational duties Auditors. This Charter is a fundamental requirement of the Framework. for the College; initiate or approve accounting transactions external to the Internal Audit Service; or direct the activities of any college employee not Approval and Validity of this Charter employed by the Internal Auditing Service, except to the extent such employees have been appropriately assigned to Service or to otherwise assist This charter shall be reviewed and approved annually by Management and by the Internal Auditor. AyrshireAyrshirethe AuditCollegeCollege Committee ## 484082193132 on behalf of the Board of the College. 10/31/201809/12/2018 14:56:1514:26:19

14 APPENDIX VI Internal Audit Working Protocols & Performance

Working Protocols

The table below illustrates the key communication and reporting points between the College and Internal Audit, which we will be subject to regular review. Any future changes to the communication and reporting points will be reported to the Audit & Risk Assurance Committee for approval.

Table One: Liaison Meetings between Internal Audit and the College

Meeting Frequency Audit Vice Director of Managers Relevant External Committee Principal – Finance and Staff Audit Finance and Student Skills Funding Internal Audit Update Meeting As required   

Quality Assurance Meeting Annually  

Internal Audit Liaison meeting with Chair of As required  Audit Committee Access to Audit Committee to discuss internal As necessary  audit progress Meetings to raise immediate concerns As necessary     

Meetings with External Audit As necessary AyrshireAyrshire CollegeCollege ## 484082193132  10/31/201809/12/2018 14:56:1514:26:19

15 APPENDIX VI Internal Audit Working Protocols & Performance

Table Two: Key reporting points between Internal Audit and the College

Meeting Board of Vice Principal Director of Managers Relevant Staff Management – Finance and Finance and Skills Student Funding Annual Internal Audit Plan     

Individual Internal Audit Planning Documents  

Draft Internal Audit Reports  

Final Internal Audit Reports     

Quality Progress Reports 

Annual Internal Audit Report    

AyrshireAyrshire CollegeCollege ## 484082193132 10/31/201809/12/2018 14:56:1514:26:19

16 APPENDIX VI Internal Audit Working Protocols & Performance

Performance Measurement Table Three: Performance Reporting to each Board of Management

Performance measurement is the use of measures and associated targets to assess objectively the performance of a body. It is now well established as an important means of improving performance and reinforcing accountability. Measure / Indicator BDO LLP has been appointed as internal auditors to Ayrshire College, subject to satisfactory performance. Consequently there is value in reviewing the Audit Coverage quality of our service on a regular basis. Audits completed against the Annual Audit Plan Internal Audit Performance measures and indicators Actual days input compared with Annual Audit Plan Internal audit performance can be assessed in two ways. Firstly, there is the ability for us to self assess our performance on a regular basis and report back Audit Planning and Reporting to the Board of Management on certain measures around inputs and satisfaction from those officers who have been subject to a review. Secondly, Days to issue draft report after end of fieldwork the view of the Board of Management as to the value being received from its internal audit provider has to be taken into account. For our part we will look to report to the Board of Management regularly on the internal audit inputs as detailed below.

The tables below contain performance measures and indicators that we consider to have the most value in assessing the efficiency and effectiveness of internal audit. We recommend that the Board of Management approves the following measures which we will report to each meeting and / or annually as appropriate.

AyrshireAyrshire CollegeCollege ## 484082193132 10/31/201809/12/2018 14:56:1514:26:19

17 APPENDIX VI Internal Audit Working Protocols & Performance

Table Four: Annual performance reporting to Board of Management Management Performance Measures and Indicators

Management’s ability to respond efficiently to internal audit findings and recommendations helps the Board of Management to form its own view of the Measure / Indicator internal control framework. Importantly, Management’s consideration of internal audit findings plays a contributory factor in our ability to deliver Relationships and Customer Satisfaction timely reports to the Board of Management. We recommend, therefore, that the following measures are also reported to the Board of Management. Customer Satisfaction Reports

% recommendations agreed with management Measure / Indicator Timing

Staffing and Training Audit Reporting

Staff mix compared with budget Days for receipt of management responses As data becomes available

Percentage of Partner and Manager time Other Performance Measures Continuity of staffing In addition to the above mentioned measures we will also provide the Audit & Use of specialist staff (e.g. IT Risk and Advisory) Risk Assurance Committee with the results of other reviews of our internal audit service as and when they become available, including: Provision of appropriate training for staff • Independent quality assurance reviews as required by the Chartered Institute of Internal Auditors (IIA); and • BDO internal quality assurance reviews

AyrshireAyrshire CollegeCollege ## 484082193132 10/31/201809/12/2018 14:56:1514:26:19

18 APPENDIX VII Ayrshire College Risk Register Summary

AyrshireAyrshire CollegeCollege ## 484082193132 10/31/201809/12/2018 14:56:1514:26:19

19 APPENDIX VII Ayrshire College Risk Register Summary

AyrshireAyrshire CollegeCollege ## 484082193132 10/31/201809/12/2018 14:56:1514:26:19

20 BDO LLP, a UK limited liability partnership registered in England and Wales under number OC305127, is a member of BDO International Limited, a UK company limited by guarantee, and forms part of the international BDO network of independent member firms. A list of members' names is open to inspection at our registered office, 55 Baker Street, London W1U 7EU. BDO LLP is authorised and regulated by the Financial Conduct Authority to conduct investment business.

BDO is the brand name of the BDO network and for each of the BDO Member Firms.

BDO Northern Ireland, a partnership formed in and under the laws of Northern Ireland, is licensed to operate within the international BDO network of independent member firms.

Copyright ©2018 BDO LLP. All rights reserved. www.bdo.co.uk

AyrshireAyrshire CollegeCollege ## 484082193132 10/31/201809/12/2018 14:56:1514:26:19 Audit progress report Ayrshire College September 2018

AyrshireAyrshire CollegeCollege ## 193132484082 09/12/201810/31/2018 14:26:1914:56:15 CONTENTS

1. Summary 3

2. Auditprogress 4

3. National publications 5

4. Positionstatementon2017-18audit 7

5. Contact details 8

This document is to be regarded as confidential to Ayrshire College. It has been prepared for the sole useAyrshire of the Audit CommCollegeittee. No # 193132484082 responsibility is accepted to any other person in respect of the whole or part of its contents. Our written consent must09/12/201810/31/2018 first be obtained before 14:26:1914:56:15 this document, or any part of it, is disclosed to a third party.

2 1. SUMMARY

Purpose of this report

This report provides the Audit Committee with an update on progress in delivering our responsibilities as your external auditors.

Audit progress

Our key audit stages are summarised in the diagram shown below. Overall work is on track and there are no significant issues arising.

Details of work completed and on-going are shown overleaf.

National publications and other updates

This section of the report sets out summaries from national publications and other updates which may be of interest to Members.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 4. Position statement on 1. Summary 2. Audit progress 3. National publications 5. Contact details 2017-18 audit

3 2. AUDIT PROGRESS

Audit progress

Since the issue of our Audit Strategy Memorandum to this committee in May 2018 we have: ° documented key controls and processes on material transaction streams in the accounts and performed walkthrough testing in line with our audit strategy; ° attended an FE sector update meeting with Audit Scotland; ° developed and issued a draft Accounts final visit project plan setting out the key dates when we plan to undertake our work and the likely documents, working papers and information we will need to review. We will agree this with management in the coming weeks; and ° continued to update our risk assessment for our Wider Scope work conclusion, including review of agendas and minutes for relevant meetings and consideration of reports by external regulators.

Our audit work is on track, and we have no matters to raise with the Committee at this stage of our audit. There are no changes to the risks previously reported in our Audit Strategy Memorandum.

The final audit fieldwork is due to begin on 22 October 2018. We will report to the Audit Committee on 27 November 2018 with our annual audit report and draft opinion on the financial statements. The accounts are due to be approved by Ayrshire College Board on 6 December 2018.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 4. Position statement on 1. Summary 2. Audit progress 3. National publications 5. Contact details 2017-18 audit

4 3. NATIONAL PUBLICATIONS AND OTHER UPDATES

Publication

1. Scotland College’s Report 2018, Audit Scotland June 2018

2. College Estate Condition Survey, Gardiner & Theobald, December 2017

3. Accounts direction for Scotland’s colleges 2017-18, Scottish Funding Council, July 2018

4. 2018 (FE) Technical Guidance Note – Audit of annual report and accounts, Audit Scotland, TBC

1. Scotland’s Colleges Report, June 2018

Audit Scotland’s annual review of the college sector found an increase in student numbers and an overall improvement in the underlying financial position of the colleges, but highlighted that they face future financial challenges particularly in relation to staff costs and estate costs.

Reviewing college performance, Audit Scotland found that the sector had exceeded its targets for learning activity in the academic year 2016-17, which is the first year that activity has increased since 2013-14. In addition, student numbers also increased by around 4% compared to the prior year, which has resulted in the highest headcount since 2013-14. This increase is primarily in the under 16 age range. Part-time student numbers had increased overall, however it was noted that a decrease had occurred in Ayrshire College for part– time student numbers. Audit Scotland found that student attainment and retention levels were more or less in line with the previous year, with 82.7% of qualifiers going into positive destinations on leaving. They did highlight however, that the gap in attainment between students from the least and most deprived areas is growing.

The financial health of Scotland’s colleges has improved overall, with a financial surplus of £0.3 million reported for 2016-17 compared with a deficit of £8 million in 2015-16. Staff costs, which are the highest area of expenditure remain relatively unchanged in 2016-17 compared to the previous year, however it is expected that national bargaining will cost about £50 million each year from 2019-20. The Scottish Government has agreed to pay for these costs up to the end of 2018-19, and it is unclear how these costs will be funded beyond this date. Ayrshire College had forecast a net surplus in each year between 2013-14 and 2017-18, however, the increased staff costs incurred resulted in deficits being experienced. In addition, the Scottish Funding Council’s 2017 Estates Condition Survey (see point 2) highlighted that Scotland’s colleges require urgent and significant investment, with an estimated backlog over the next 5 years costing £360 million.

The report included details of financial challenges facing Ayrshire College arising from PFI costs at the Kilwinning Campus. The Scottish Government had agreed to the college could use money raised from selling land associated with the former Holehouse Rd Campus towards PFI costs in 2018-19, there is currently no further funding commitment from the Scottish Government or the SFC. http://audit-scotland.gov.uk/report/scotlands-colleges-2018

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 4. Position statement on 1. Summary 2. Audit progress 3. National publications 5. Contact details 2017-18 audit

5 3. NATIONAL PUBLICATIONS - CONTINUED

2. College Estate Condition Survey, December 2017

Gardiner & Theobald were appointed by the Scottish Funding Council in January 2017 to provide a summary of the conditions of the estates within the Scottish Further Education sector, being the first independent review of the college estate in Scotland for 10 years.

The estimated net total backlog of maintenance and renewals cost is £163 million excluding contingencies, any related operational and management costs of the colleges, professional fees, VAT, optimism bias and inflation allowance. When taking these items into account, the resulting total gross estimated backlog is £363 million. 10% of these costs were defined as urgent, requiring action within the next year, with the majority of the costs requiring action within 3-5 years.

The Scottish Funding Council is working with the Scottish Government and Scottish Futures Trust to produce a framework for college sector estate development to manage competing demands for estate development.

The Ayr Campus was surveyed for Ayrshire College. This showed an estimate of £4.7 million of costs over the 5 year period from 2017- 18 to 2022-23, with £1.8m being identified as urgent mainly in relation to Dam Park. The campuses at Kilmarnock and Kilwinning were not surveyed as part of this report as they are NPD / PFI sites where maintenance is built into contract costs. http://www.sfc.ac.uk/publications-statistics/corporate-publications/corporate-publications-2017/SFCCP052017.aspx

3. Accounts direction for Scotland’s colleges 2017-18, Scottish Funding Council, July 2018

On 13 July 2018, the Scottish Funding Council issued its accounts direction for Scotland’s colleges for the 2017-18 year, along with supporting guidance. There have been no significant changes in the accounting requirements for 2017-18, however there are a number of additional disclosure changes.

Changes include: • additional guidance for the disclosure of the adjusted operating position (taking the SORP position and removing non-cash adjustments) to ensure consistency across the sector; • inclusion of details of the adjusted operating position in the Performance Report, so as to provide a better indication of the college’s operational cash generative capacity; • inclusion of non-financial information including social matters, respect for human rights, anti-corruption and anti-bribery matters; • additional disclosures in the Remuneration and Staff Report, including diversity issues and equal opportunity in employment; • inclusion of time and cost information in respect of relevant Trade Union officials in accordance with the Trade Union (Facility Time Publication Requirements) Regulations 2017; • disclosure of the actual total remuneration of the head of the college, disclosing separately salary, bonus, employer pension contribution and benefits in kind (in addition to the banded remuneration shown in the Remuneration and Staff Report); and • the Governance Statement must now include a statement of compliance with the 2016 Code of Good Governance for Scottish Colleges, or provide an explanation for any non-compliance. The Governance Statement must also include details of any significant lapses of data security (or confirm that there were none). http://www.sfc.ac.uk/publications-statistics/guidance/guidance-2018/SFCGD132018.aspx

4. 2018 (FE) Technical Guidance Note – Audit of annual report and accounts, Audit Scotland, TBC

At the time of writing, the issue of the technical guidance was imminent. There have been no significant changes to the underlying reporting framework (HE/FE SORP 2015 and the Government Financial Reporting Manual) and therefore we expect no significant changes to the technical guidance other than for changes to the Accounts direction as noted above. Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 4. Position statement on 1. Summary 2. Audit progress 3. National publications 5. Contact details 2017-18 audit

6 4. POSITION STATEMENT ON 2017-18 AUDIT

Expected Final report issued Planned output Comments completion date to Audit Committee

2017-18 Audit Strategy Memorandum By 12 June 2018 12 June 2018 ~

Audit Committee Progress Report and Briefing 18 September2018 18September 2018 ~

2017-18 Audit Completion Report, incorporating: By 31 December • Opinion on the financial statements. TBC ~ 2018 • Conclusion on Wider Scope work

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 4. Position statement on 1. Summary 2. Audit progress 3. National publications 5. Contact details 2017-18 audit

7 5. CONTACT DETAILS

Please let us know if you would like further information on any items in this report. www.mazars.co.uk

Lucy Nutley Engagement Lead 07387 242 052 [email protected]

Joanne Buchanan Senior Manager 07794 031 384 [email protected]

Address: 100 Queen Street Glasgow G1 3DN 0141 227 2400

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 4. Position statement on 1. Summary 2. Audit progress 3. National publications 5. Contact details 2017-18 audit

8 Ayrshire College (Paper 5)

Audit Committee Meeting

18 September 2018

Subject: Business Continuity Plan (V3) at August 2018

Purpose: To present to the Audit Committee the updated Business Continuity Plan (V3) for review, discussion and approval

Recommendation: The Audit Committee is asked to approve the Business Continuity Plan (V3).

1. Background

Business Continuity is seen as the activities required to maintain and recover College operational effectiveness against threats or events which, if realised, may materialise as incidents and ultimately escalate into a full scale emergency or crisis.

A Business Continuity Plan (BCP) is required to guide actions and responses in a structured manner in the event of a sudden or unseen event that could seriously disrupt College operations and impair its ability to operate services efficiently and effectively.

The College developed its first BCP in November 2014. The most recent BCP was approved by the Audit Committee in June 2017.

2. Current Situation

In September 2017 the College established a Business Continuity Plan Steering Group with the Group’s first meeting taking place in November 2017. The purpose of the Group is to ensure the College’s BCP is continually monitored and up to date. The Group’s membership includes staff from curriculum and service areas. All attendees had been selected to give a cross-representation of the key areas of the College and were directly linked to the lead roles identified in the College’s BCP.

The Group meets on a quarterly basis to review and consider any BCP events that have taken place and to assess the College’s response to the event. The Group is responsible for updating the BCP, where relevant, after each meeting and conducts a full formal BCP review on an annual basis. The Group’s responsibilities include overseeing frequent testing of the College’s BCP arrangements and reviewing and updating the College’s BCP.

An Internal Audit of the College’s BCP arrangements was undertaken in October 2017. The audit identified that significant work had been undertakenAyrshireAyrshire CollegeCollegein developing ## 193132484082 the College’s BCP and that detailed disaster recovery procedures09/12/201810/31/2018 were in place.14:26:1914:56:15

Audit Committee, 18 September 2018 1 The audit identified opportunities for improvement that would strengthen the College’s control framework, such as testing of the College’s BCP arrangements and detailing required recovery times for critical college functions.

The College’s BCP arrangements were live tested through BCP events that took place during 2017-18. These included the bomb threat at Kilmarnock and multiple campus closures due to adverse weather conditions.

The internal audit, the BCP events that have taken place during 2017-18 and the work of the BCP Steering Group have been used to develop and enhance the Business Continuity Plan (V3).

Business Continuity Plan (V3) is now presented to members for their review and approval.

3. Proposals

No further proposals are contained in this report.

4. Consultation

No formal consultation is required given the subject of this paper.

5. Resource Implications

No specific resource implications require to be noted.

6. Risks

The BCP addresses a number of key risks which the College may face, including for example denial of access and loss of computer records and data.

7. Equality Impact Assessment

An impact assessment is not applicable to this paper given the subject matter.

8. Conclusion

The Audit Committee is asked to approve Business Continuity Plan (V3).

Michael Breen Vice Principal, Finance and Skills 20 August 2018

[James Thomson, Director of Finance and Student Funding] Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

Audit Committee, 18 September 2018 2 (Paper 5 – Appendix 1)

Business Continuity Plan Critical Functions & Procedures September 2018

Date of First Issue: November 2014 Date of Most Recent Review: August 2018 Revision Number: V3 Approving Body: Audit Committee Date of Approval/Issue: [September 2018]

Responsibility for Review: Director of Finance and Student Funding Date of Next Review: [September 2019]

AyrshireAyrshire CollegeCollege ## 193132484082 09/12/201810/31/2018 14:26:1914:56:15 Page

1. Introduction 3

2. Aim and Purpose 4

3. Objectives of the Plan 5

4. Business Continuity Plan ~Steering Group 6

5. Critical Functions 9

6. Procedures 55

7. Risk Methodology 71

8. Appendices 81-96 Appendix 1 – Key Contacts Ayrshire College Staff Appendix 2 – Key Contacts Emergency Services Appendix 3 – Key Contact Partners & Stakeholders Appendix 4 – Key Contacts Suppliers

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

2 1 Introduction

Business Continuity is seen as the activities required to maintain and recover College operational effectiveness against threats or events which, if realised, may materialise as incidents and ultimately escalate into a full scale emergency or crisis. Such events are by their nature unforeseen and it is not possible to predict with any degree of accuracy the details of the event or chain of events that causes the implementation of the plan. For this reason the plan gives broad guidelines and information to allow the Business Continuity Response Team (BCRT) to undertake the task of preparing a detailed response to any situation that arises.

The College will develop an interface protocol agreement with our PFI and NPD operators to ensure roles and responsibilities are clearly understood for our Kilwinning campus and Kilmarnock campus when required.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

3 2 Aim and Purpose

The purpose of the plan is to minimise the effect of any sudden or unforeseen event that could seriously disrupt College operations and impair its ability to operate effectively. The aim is to set down broad guidelines that provide a basis for a relatively quick and effective return to business as usual. These guidelines are set down in section 4 for each of the identified critical functions.

If an incident or event occurs which bears an immediate or imminent threat to the continuity of the business of Ayrshire College, the BCRT should be convened.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

4 3 Objectives of the Plan

 List the critical functions and activities of the organisation.

 Analyse and respond to potential risks to these critical functions.

 Provide a detailed prioritised and timetabled response to an emergency situation.

 Identify the key roles, responsibilities and contacts to respond to an emergency.

 Enable testing of the plan on a regular basis.

The Business Continuity Plan is split into 5 Sections.

Section 1 Introduction and explanation of the Business Continuity Plan.

Section 2 Information regarding who should take charge in any unforeseen event, issue or emergency.

Section 3 Suggested plan of action for the first 24 hours of any major event.

(This plan is generic and may need to be adapted depending on the exact nature of the Event or issue)

Section 4 Information regarding the College’s critical functions and suggestions of how they may be restored in event of the loss of that particular function.

Each critical function is assessed for its impact and likelihood. For each critical function information is given regarding what procedures/ methodologies are presently in place to prevent the loss of the critical function, together with suggestions, where appropriate, of further work which could be done to mitigate the risk of occurrence.

For each critical function, the BCP sets out the estimated time within which the function must be resumed / recovered, the point to which information should be restored to and the maximum tolerable period of disruption. Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 Suggestions are also made regarding staff or staff teams which will be useful or required to restore a normal Mode of operation (NMO). Lastly a list of ‘Triggers’ is given; these being events which may occur and the table provided suggests what 5 steps and procedures are available to mitigate the effect of the Trigger.

Section 5 Contains details of some of the procedures suggested in section 4

Please note, there is nothing in this plan or arrangements which negates or supersedes the College’s evacuation procedures or Health and Safety responsibilities.

Plan Owner

The owner of this plan will be the Director of Finance and Student Funding who will ensure that the plan is reviewed at least annually or more frequently if required.

Testing

This plan will be tested annually against blind scenarios.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

6 4 Business Continuity Plan Steering Group

The College has develop a Business Continuity Plan Steering Group. The purpose of the Group is to ensure the College’s Business Continuity Plan (BCP) is continually monitored and up to date. The Group’s membership includes staff from curriculum and service areas. All attendees had been selected to give a cross- representation of the key areas of the College and were directly linked to the lead roles identified in the College’s BCP.

The Group meets on a quarterly basis to review and consider any BCP events that have taken place and to assess the College’s response to the event. The Group is responsible for updating the BCP, where relevant, after each meeting and conducts a full formal BCP review on an annual basis.

The Group is also responsible for overseeing that there has been sufficient testing of the College’s BCP each year. The Group uses a risk based approach to BCP testing. In addition, the level of formal testing required is determined by the number of live BCP incidents during a given year and any weaknesses or concerns identified in the BCP.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

7 5 Critical Functions

Critical functions, critical services and critical resources (hereafter called “critical functions”) within the scope of the BCP include:

1. Accommodation

A. Denial of Workplace Access – short term (up to 1 day)

B. Denial of Workplace Access – long term (greater than 1 day)

2. Staff

A. HR and Payroll Systems

B. Loss of Key Personnel

C. Threat to Well Being of staff

D. Industrial Action – Work Stoppage

3. Finance

A. Student Funding

B. Payments to Suppliers

C. Payroll

4. Telecommunications (Internal Campus Level or WAN Level)

5. Computer Systems and Services

A. ICT Services

B. Student Records and Bursaries

6. Loss of Data (viruses, hacking, human error)

7. Utilities Loss (water, sewage, electricity, gas etc.)

8. Flu Pandemic/ Terrorist Attack (or equivalent in terms of large scale staff absences) Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

8 Critical Function 1: Accommodation Risk: 1A Denial of Workplace Access – short term (> the 8 hours less than 1 day)

This Action Plan defines the Procedures to be followed, or steps to be taken in the event of a Threat, or actual loss of Access to the Workplace for up to 1 day.

Risk assessment Very Low

Recovery Time Objective 1 day

Maximum Tolerable Period of Disruption 1 week

Recovery Point Objective

Critical Likelihood Impact Risk Score Action Further Action Function Controls which needs to be already in taken to mitigate place this risk Denial of Staff vigilance Ensure that the Workplace 2 2 4 against Fire, College has the Access – Vandalism or latest key contact Short term concerted details stored at (up to 1 day) attack. each of the College campuses per appendices attached

1A Further Information Denial of Workplace Access – Short Term Responsibility: (role responsible for leading on this activity, BCRT with Estates Team. plus deputies) 2 Likelihood of Event Very Low

2 Potential impact on organisation Minor Refer to college risk methodology

Recovery timeframe: Short Term defined as less than one (how quickly must this function be working day. recovered to avoid lasting damage) However maximum timescale to avoid lasting damage is one week.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

9 Resources required for recovery Staff VPs, Directors, Heads of Curriculum / Services, (staff and Teams the BCRT are likely Marketing and PR Manager to need to call on) Data / systems Potential recovery of data if required (backup and recovery processes, alternative manual work-round, staff and equipment required) Premises Expected at current levels of activity that short term denial of access may be best dealt with by either (potential relocation or work-from- Re-entering building as soon as it is cleared for home options) use or to close the facility for one day. Potential relocation for staff may include temporary relocation to another campus Communications Local Papers/Radio/Social Media Sites/E- (methods of contacting staff, suppliers, mail/Phone/ Text/Megaphone if Building has customers, etc) been evacuated and Staff/Students have gathered at Emergency Evacuation Assembly Equipment Equipment required pointsdependent upon extent of (key equipment recovery or damage but could include replacement processes; alternative PCs/Desks/Chairs/Specialist Health sources; mutual aid) Equipment/Teaching Resources Supplies Supplies available through regular ordering process (processes to replace stock and key supplies required; provision in emergency pack)

Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) Any / all Ayrshire campus 1. Ensure at least one 3.4 BCRT Communications BCRT member is aware 3.5 Damage Assessment & Premises Evacuated Salvage Implementation of 2. Establish reason for 3.3 Fire and Evacuation emergency evacuation. evacuation and confirm if estate is unaffected.

3. Establish when the facility will be returned to normal function

Student Internal BCRT instructs affected Discuss with Director of Quality Assessments taking place. Curriculum Group to Enhancement and relevant ascertain level of disruption Curriculum Director who will and any breach of exam agree what actions to be taken security and to report to the in conjunction with a delegated Director of Quality BCRT member Enhancement

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

10 Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) Student External BCRT instructs affected The Director of Quality Assessments taking place. Curriculum Group to Enhancement and relevant ascertain level of disruption curriculum directors will refer and any breach of exam to awarding bodies procedure security and to report to the for such incidents. Director of Quality Enhancement

Confirmed that Premises Establish expected duration 3.5 Damage Assessment & are Unaffected of denial of access Salvage

Expected Duration of Decide whether to 3.6 BCRT Meetings Denial of Access is implement Emergency Workplaces and Learning, Established as being in six Teaching and assessment hours or less spaces.

With a duration of one working day or less it is unlikely that the disruption this would cause would merit the provision of emergency workplaces or Learning and Teaching spaces

Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) Expected Duration of See Risk 1B 3.6 BCRT Meetings Denial of Access is Established as more than one working day – Denial of Workplace access – Long Term

Decision Not to Implement Instruct all Staff to go home / 3.1 Staff Communications Emergency Workplaces or relocate to an alternative and Learning and Teaching campus and return to the spaces Workplace next working day, or another specified date, or to await further instructions as appropriate

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

11 Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) Decision to Implement 1. Divert telephones and fax 3.8 Diversion of Telephone & Emergency Workplaces as appropriate Fax 1.5 Disable Key College 2. Disable key applications Application Servers servers as required 3.1 Staff Communications 2.2 Student Communications 3. Ensure all staff are advised of where to report and operate from

4. Ensure Students are advised of where to attend

Decision to Implement 1. Implement emergency 2.1 Interim Learning and Emergency Learning, teaching fulfilment Teaching Teaching and Assessment arrangements 2.2 Student Communications Arrangements 2. Notify students

All Reports received – 1. Advise all affected 3.1 Staff Communications Emergency Operations students of the Event 2.2 Student Communications Stable 2. Confirm expected date/time to return to Premises

Advised of Date of Return 1. Develop plan to return all 1.3 Physical Recovery to Premises Functional Areas affected 3.1 Staff Communications to Normal Operations 2.2 Student Communications

2. Inform all Staff of planned date to return to Premises

3. Inform all students of expected date of return to Normal Operations

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

12 Critical Function: Accommodation

Risk: 1B Denial of Workplace Access – long term (greater than 1 day or 1 week)

This Action Plan defines the Procedures to be followed, or steps to be taken in the event of a Threat, or actual loss of Access to the Workplace greater than 1 day.

Risk assessment Low

Recovery Time Objective 1 week

Maximum Tolerable Period of Disruption 6 months Current Recovery Point Objective standard of services

Critical Likelihood Impact Risk Score Action Further Action Function Controls which needs to be already in taken to mitigate place this risk Denial of Staff vigilance See also Short Workplace 2 4 8 against Fire, Term Risk at 1.1 Access – Vandalism or above. Long term concerted Long term denial of (greater than attack. access will require 1 day) use of alternative accommodation either within the existing estate or through reciprocal arrangements sought with other Colleges, Schools (Disclosure issues) and Local Authority. Also investigate the use of for example Church Halls and Local Hotels. 1B Further Information Denial of Workplace Access – Long Term

Responsibility: (role responsible for leading on this activity, BCRT with Estates Team plus deputies) Ayrshire2 College # 193132484082 Likelihood of Event Very09/12/201810/31/2018 Low 14:26:1914:56:15

13 1B Further Information Denial of Workplace Access – Long Term

4 Potential impact on organisation Major Refer to college risk methodology

Recovery timeframe: Long Term defined as greater than one (how quickly must this function be working Day. However, the BCRT may recovered to avoid lasting damage) take the view that Denial of Access lasting one to 5 days may be treated as short term depending on the circumstances. Maximum timescale to avoid lasting damage is assessed as being one week.

Resources required for recovery Staff VPs, Directors, Heads of Curriculum/Services, (staff and teams the BCRT are likely Marketing and PR Manager to need to call on) Data/systems Potential Recovery of staff and student data from (backup and recovery processes, PC backup areas. alternative manual work-round, staff and equipment required) Premises Expected at current levels of activity that long term (potential relocation or work-from- denial of access will require use of alternative home options) accommodation either within the existing estate or through reciprocal arrangements with other Colleges, Schools (Disclosure issues) and Local Authority. Also investigate the use of Church Halls and Local Hotels. Communications Papers/Radio/Social Media Sites/Phone/E-mail/ (methods of contacting staff, suppliers, Text/Megaphone if Building has been evacuated customers, etc) and Staff/Students have gathered at Emergency Evacuation Assembly points Equipment Equipment required dependent upon extent of (key equipment recovery or damage but could include PCs/Desks/Chairs/ replacement processes; alternative Specialist Health Equipment/Teaching Resources sources; mutual aid) Supplies Supplies available through regular ordering process (processes to replace stock and key supplies required; provision in emergency pack) Contractors To be procured through estates. (to bring existing building back into See Emergency Contractors in Appendix 2 operation)

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

14 Trigger or Key Decision Action Procedure

1. Ensure at least one 3.4 BCRT Communications BCRT member is aware 3.5 Damage Assessment & Premises Evacuated Salvage Implementation of 2. Establish reason for 3.3 Fire and Evacuation emergency evacuation. evacuation and confirm if estate is unaffected.

3. Establish when the facility will be returned to normal function

Confirmed that Premises Establish expected duration 3.5 Damage Assessment & are affected of denial of access Salvage Expected Duration of Denial 1. See risk 1.i 3.6 BCRT Meetings of Access is Established as six hours or less – Denial of Workplace access – short term Expected Duration of Denial 1. Decide whether to 3.6 BCRT Meetings of Access is Established as implement Emergency more than one working day Workplaces – Denial of Workplace access – Long Term (5 days) Expected Duration of Denial 1. Decide whether to 3.6 BCRT Meetings of Access is Established implement Emergency Workplaces Student Internal 1. BCRT instructs affected Discuss with Director of Assessments taking place. Curriculum Group to Quality Enhancement and ascertain level of long relevant Curriculum Directors term disruption and any who will agree what actions to breach of exam security be taken in conjunction with a and to report to the delegated BCRT member Director of Quality Enhancement Student External 1. BCRT instructs affected The Director of Quality Assessments taking place. Curriculum Group to Enhancement and Curriculum ascertain level of Directors will refer to disruption and any awarding bodies procedure breach of exam security for such incidents. and to report to the Director of Quality Enhancement. Decision Not to Implement 1. Instruct all staff to go 3.1 Staff Communications Emergency Workplaces home and return to the workplace next working day, or another specified date, or to await further instructions as Ayrshire College # 193132484082 appropriate 09/12/201810/31/2018 14:26:1914:56:15

15 Trigger or Key Decision Action Procedure

Decision to Implement 1. Divert telephones and 3.8 Diversion of Telephone & Emergency Workplaces fax as appropriate Fax 1.5 Disable Key College 2. Disable key applications Application Servers servers as required 3.1 Staff Communications 2.2 Student Communications 3. Ensure all staff are advised of where to report and operate from

4. Ensure Students are advised of where to attend Decision to Implement 1. Implement emergency 2.1 Interim Learning and Emergency Learning, teaching fulfilment Teaching Arrangements Teaching and Assessment arrangements 2.2 Student Communications arrangements. 2. Notify students All Reports received – 1. Advise all affected 3.1 Staff Communications Stability of Emergency students of the Event 2.2 Student Communications Operations 2. Confirm expected date/time to return to Premises Advised of Date of Return to 1. Develop plan to return 1.3 Physical Recovery Premises all Functional Areas 3.1 Staff Communications affected to Normal 2.2 Student communications Operations

2. Inform all Staff of planned date to return to Premises

3. Inform all students of expected date of return to Normal Operations

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

16 Critical Function: Staff

Risk: 2A HR and Payroll Systems

This Action Plan defines the Procedures to be followed, or steps to be taken in the event of a threat, or actual loss of the Human Resource and Payroll Systems for a period of time deemed by the BCRT to be significant

Risk assessment Low

Recovery Time Objective 1 day 3 days Maximum Tolerable Period of Disruption (NB. Timeframe dependent on period in month, e.g. payroll dates) Recovery Point Objective Close of previous day’s backup

Critical Likelihood Impact Risk Score Action Further Action Function Controls which needs to be already in taken to mitigate place this risk Staff vigilance Hold all HR records Human 2 3 6 against Fire, electronically and Resource Vandalism or ensure that the and failure of College backs up Payroll computer HR and Payroll Systems systems system information off site. Use college Virtualisation solution to maintain connectivity Maintain an agreed offsite secure storage and archive solution

2A Further Information Human Resource Systems

Responsibility: BCRT with Vice Principal of HR/OW, (role responsible for leading on this Director of HR/OD, Vice Principal of Finance, activity, plus deputies) Vice Principal of Estates, Director of Finance & Student Funds/Payroll staff 2 Likelihood of Event Very Low

3 Potential impact on organisation SignificantAyrshire College # 193132484082 Refer to college risk09/12/201810/31/2018 methodology 14:26:1914:56:15

17 Recovery timeframe: Depending on where in pay (how quickly must this function be cycle refer to 3C recovered to avoid lasting damage)

Resources required for recovery

Staff HR staff/Payroll staff/ICT Staff/Finance (staff and Teams the BCRT are likely to need to call on) Data/systems (backup and recovery processes, HR and Payroll system backup alternative manual work-round, staff and equipment required) Premises Could work from any other campus and access (potential relocation or work-from- relevant systems via the College Virtualised home options) Server Solution and WAN network ICT to assist Communications Emails, phone calls, letters (methods of contacting staff, suppliers, customers, etc) Equipment HR & Payroll system backups, PCs and internet (key equipment recovery or access replacement processes; alternative sources; mutual aid) Supplies N/A (processes to replace stock and key supplies required; provision in emergency pack)

Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) HR and Payroll system 1. Contact IT staff 1.1 Faulty Workstation and data is not accessible Evaluation 2. Determine nature of the 1.11Data recover to server fault. (Hardware, software of Application) Contact HR and Payroll system provider 3. Recover system data and/or Application from backup as appropriate.

Hardware Problem 1. Determine whether the 1.1 Faulty Workstation Reported problem is local to a Evaluation particular workstation, or with the network

User Cannot Access Data 1. Determine whether the lack of access is due to password access failure Ayrshire College # 193132484082 2. Check if loss is due to 09/12/201810/31/2018 14:26:1914:56:15 corrupt data

18 Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) 3. Check if loss is due to 1.11Data recover to server system configuration change 1.1 Faulty Workstation 4. Determine whether the Evaluation lack of access is due to password access failure 1.8 Peripheral & Routing 5. Check if loss is due to Hardware Fault corrupt data Resolution 6. Check if loss is due to system configuration 1.2 Replace Hardware change Device 7. Check if loss is due to faulty workstation 1.8 Peripheral & Routing 8. Check if loss is due to Hardware Fault Key Systems Resolution Infrastructure Failure 9. Check if loss is due to 1.6 Communications network, or peripheral Service Fault Resolution routing hardware failure 10. Check if loss is due to telecommunications infrastructure failure Established that a Network 1. Determine whether the 1.2 Replace Hardware Computer has Failed and failed item can be Device cannot be Used replaced under Warranty Established that the Failed 1. Arrange for repair, or 1.2 Replace Hardware Computer is NOT included replacement of the failed Device in the Maintenance Service computer as appropriate Agreement 2. Assess the impact on the network and consider reviewing hardware covered on the maintenance service agreement Established that the Failed 1. Invoke replacement 1.2 Replace Hardware Computer is included in the computer service Device Maintenance Service Agreement Replacement Computer 1. Replace failed hardware 1.2 Replace Hardware Service Invoked Device Failed Hardware 1. Review age/condition/ 1.2 Replace Hardware Repaired/Replaced & suitability of all hardware Device functioning correctly Assets and the extent of the College’s critical dependence upon each item

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

19 Critical Function: Staff

Risk: 2B Loss of Key Personnel (see also Risk 8. Flu Pandemic or equivalent in terms of large scale staff absences)

This Action Plan defines the Procedures to be followed, or steps to be taken in the event of Key individuals, or a critical percentage (this percentage is assessed on individual team basis and location by HR/OW) of staff are absent long term or permanently. If loss is due to flu or some other form of mass illness please see Risk 8 Flu Pandemic.

Risk assessment Low

Recovery Time Objective 1 week

Maximum Tolerable Period of Disruption 3 months Temporary Recovery Point Objective arrangements to be in place for staff duties

Critical Likelihood Impact Risk Score Action Further Action Function Controls which needs to already in be taken to place mitigate this risk Loss of Key Contracts of Succession Personnel 2 4 8 Employment planning and the Resources and notice training of periods. appropriate staff to Absence be able to step up Management and undertake key Tool Kit. responsibilities as required. Access staff Procedure bank and manuals to be recruitment reviewed and agencies updated. Policies to be communicated widely and accessible via College intranet

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

20 2B Loss of Key Personnel Further Information Responsibility: BCRT with Vice Principal HR/OW, Director of HR/OD, relevant Directors Note, only the sudden loss of an SMT member is liable to necessitate the convening of the BCRT. Likelihood of Event 2 Very Low

Potential impact on organisation 4 Major Refer to college Risk methodology Recovery timeframe: Within contractual notice period (Within a week, temporary arrangements will be implemented)

Resources required for recovery

Staff Director of HR & O.D, HR Staff, relevant Director (staff and Teams the BCRT are likely and the employee’s line manager, Marketing & to need to call on) PR Manager Data/systems (backup and recovery processes, Contract of employment. Succession planning alternative manual work-round, staff and equipment required) Premises N/A (potential relocation or work-from- home options)

Communications Emails, phone calls, letters, Local (methods of contacting staff, suppliers, Papers/Radio/Social Media Sites. customers, etc)

Possible national media coverage Equipment N/A (key equipment recovery or replacement processes; alternative sources; mutual aid) Supplies N/A (processes to replace stock and key supplies required; provision in emergency pack)

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

21 Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) Manager: 1. Assess current/imminent 4.2 Assess & Prioritise Long Term activity and projects Current Workload 4.1 Identify Alternate for 2. Consider responsibilities Workload that can be delegated to 2.2 Student Communications other Managers and 3.1 Staff Communications reportees

3. Consider interim management resources

4. Advise students if appropriate

5. Advise Staff

Manager: 1. Consider if there is a 3.9 Recruitment Permanent continued need for the 4.2 Assess & Prioritise post. Current Workload 4.1 Identify Alternate for 2. Consider opportunity to Workload restructure/reorganise 2.2 Student Communications 3.1 Staff Communications 3. Recruit replacement as appropriate

4. Assess forward workload and responsibilities

5. Consider re-assignment of workload and/or responsibilities to other staff

6. Assess requirement for interim management, pending recruitment of replacement

7. Advise students as appropriate

8. Advise Staff

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

22 Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) Functional Area: 1. Assess & prioritise 4.2 Assess and Prioritise Critical Percentage current Workload Current Workload Reduction – Long Term 3.9 Recruitment 2. Keep in contact with member of staff and use absence management tool kit.

3. Review cause and recruit replacement staff as appropriate

4. Engage additional resources from agencies

Functional Area: 1. Assess & prioritise 4.2 Assess/Prioritise Current Critical Percentage current Workload. Workload Reduction – Permanent 3.9 Recruitment 2. Review case and recruit replacement staff as appropriate

3. Engage additional resources from agencies

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

23 Critical Function: Staff

Risk: 2C Threat to Wellbeing of Staff

This Action Plan defines the Procedures to be followed, or steps to be taken in the event of tangible threats to the wellbeing of staff, through events such as Fire, Flood, explosions and violence or lock down of campuses. Risk assessment Low

Recovery Time Objective 1 day

Maximum Tolerable Period of Disruption 1 week Temporary Recovery Point Objective arrangements to be in place for staff duties

Critical Likelihood Impact Risk Score Action Further Action Function Controls which needs to be already in taken to mitigate place this risk Threat to Vigilance of Staff training in wellbeing of 2 3 6 staff evacuation staff arrangements, Health and Safety and threat avoidance.

2C Threat to Wellbeing of Staff Further Information

Responsibility: BCRT with Vice Principal of HR/OW, Director of HR/OD, Health Safety and Wellbeing Manager.

2 Likelihood of Event Very Low

3 Potential impact on organisation Significant Refer to college risk methodology Recovery timeframe: Dependent on numbers of staff involved and timescales. If between 3 and 6 months temporary appointments would be required.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

24 Resources required for recovery

Staff Director of HR & O.D, HR Staff, relevant Director (staff and Teams the BCRT are likely and the employee’s line manager, to need to call on) Marketing Manager Data/systems (backup and recovery processes, Emergency services contacts, College evacuation alternative manual work-round, staff procedures and equipment required) Premises Affected staff could work from home to a certain (potential relocation or work-from- extent but any teaching staff affected would need home options) class cover. Emails, phone calls Papers/Radio/Social Media Communications Sites. (methods of contacting staff, suppliers, customers, etc) Equipment N/A (key equipment recovery or replacement processes; alternative sources; mutual aid) Supplies N/A (processes to replace stock and key supplies required; provision in emergency pack)

Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) Individual, or Group is 1. Take appropriate action 3.1 Staff Communications Identified as Under Threat to remove or avoid threat 3.11 Staff Protection Procedure 2. Alert at least one 3.4 BCRT Communications Member of the BCRT 3.1 Staff Communications 3. In a case of a threat of violence alert police

4. Inform Staff as appropriate

Individual, or Group is 1. Call appropriate 3.11 Staff Protection Identified as Suffering Actual emergency services Procedure Harm 3.4 BCRT Communications 2. Invoke Staff Protection/ 3.1 Staff Communications Safeguarding procedures

3. Alert at least one Member of the BCRT Ayrshire College # 193132484082 4. In a case of violence 09/12/201810/31/2018 14:26:1914:56:15 alert police. Inform Staff as appropriate

25 Critical Function: Staff

Risk: 2D Loss of Key Personnel through industrial action or work stoppage

This Action Plan defines the Procedures to be followed, or steps to be taken in the event of Key individuals, or a critical percentage (this percentage is assessed on individual team basis and location by HR/OW) of staff who are taking industrial action or are part of a work stoppage.

Risk assessment Moderate

Recovery Time Objective 1 day

Maximum Tolerable Period of Disruption 3 days Key College Recovery Point Objective functions delivered

Critical Likelihood Impact Risk Action Further Action Function Score Controls which needs to already in be taken to place mitigate this Loss of Key Communications Considerrisk Personnel 3 4 12 through closure of Resources employers College or association on Campuses negotiations

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

26 2B Loss of Key Personnel Further Information Responsibility: BCRT with Vice Principal HR/OW, SMT convening of the BCRT.

Likelihood of Event 3 Low

Potential impact on organisation 4 Major Refer to college Risk methodology Recovery timeframe: Within the negotiated agreement with relevant unions

Resources required for recovery

Staff SMT, Heads of Curriculum and Services (staff and Teams the BCRT are likely to need to call on) Data/systems (backup and recovery processes, N/A alternative manual work-round, staff and equipment required) Premises Consider closure of satellite campuses (potential relocation or work-from- home options)

Communications Emails, phone calls, letters, Papers/Radio/Social (methods of contacting staff, suppliers, Media Sites. customers, etc)

Possible national media coverage Equipment Consider avoiding high risk use of equipment (key equipment recovery or replacement processes; alternative sources; mutual aid) Supplies Consider the requirement to cancel stocks and (processes to replace stock and key supplies supplies required; provision in emergency pack)

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

27 Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) Manager/Staff: Short 1. Assess current/imminent 4.2 Assess & Prioritise Term activity and projects Current Workload

2. Consider and identify 4.1 Identify Alternate for responsibilities that can Workload be delegated to other Managers or staff 2.2 Student Communications 3. Consider interim management resources 3.1 Staff Communications 4. Advise students if appropriate

5. Advise Staff

Manager/Staff: Long Term 4.2 Assess & Prioritise 1. Assess forward Current Workload workload and 4.1 Identify Alternate for responsibilities Workload 2.2 Student 2. Consider re-assignment Communications of workload and/or 3.1 Staff Communications responsibilities to other staff

3. Assess requirement for interim management.

4. Advise students as appropriate

5. Advise Staff

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

28 Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) Functional Area: Short 1. Assess & prioritise 4.2 Assess and Prioritise Term current Workload Current Workload 4.1 Identify Alternate for 2. Consider re- Workload assignment of workload and/or 2.2 Student responsibilities to Communications other staff 3.1 Staff Communications 3. Assess requirement for interim management.

4. Advise students as appropriate

Functional Area: Long 1.5. AssessAdvise Staff& prioritise 4.2 Assess/Prioritise Current Term current Workload Workload 4.1 Identify Alternate for 2. Consider re- Workload assignment of 2.2 Student workload and/or Communications responsibilities to 3.1 Staff Communications other staff

3. Assess requirement for interim management.

4. Advise students as appropriate

5. Advise Staff

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

29 Critical Function: Finance

Risk: 3A Student Funding

This Action Plan defines the Procedures to be followed, or steps to be taken in the event of a disruption to the Student Funding service.

Risk assessment Moderate

Recovery Time Objective 1 day 2 days Maximum Tolerable Period of Disruption (NB. Dependent on when in week procedures are affected) Records returned to close of Recovery Point Objective previous day

Critical Likelihood Impact Assessment Action Further Action Function Controls which needs to be already in taken to mitigate place this risk Student Student Staff training Funding 2 5 10 Records and integration of Funding data student records and backup student funding systems Back up of Student Funding Payment files

3A Student Funding Further Information Responsibility: BCRT with Director of Finance, Director Quality (role responsible for leading on this Enhancement, Director of Finance, Student activity, plus deputies) Funding Manager, marketing staff Note: Disruption to student funding would have to be severe before the BCRT would be convened.

2 Likelihood of Event Very Low

5 Potential impact on organisation Extreme Refer to college risk methodology Recovery timeframe: (how quickly must this function be 2 working days Ayrshire College # 193132484082 recovered to avoid lasting damage) 09/12/201810/31/2018 14:26:1914:56:15

30 Resources required for recovery

Staff Student Funding staff, Finance staff for BACS (staff and teams the BCRT are likely to runs, ICT support. Marketing staff need to call on) Data/systems Backup files and server (backup and recovery processes, alternative manual work-round, staff and equipment required) Premises System accessible across campuses via (potential relocation or work-from- virtualised server solution links – the present home options) college network failover solutions will allow staff to relocate or receive connectivity through a Communications Possibleseparate need toconnection contact all to students the internet. affected if (methods of contacting staff, suppliers, payment will be delayed – would be done via customers, etc) notices, phone calls, emails, texts, college website as appropriate Equipment PCs, server, internet access, BACs access (key equipment recovery or replacement processes; alternative sources; mutual aid) Supplies n/a (processes to replace stock and key supplies required; provision in emergency pack)

Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) Reported difficulty in Ascertain the nature of the student funding problem and the length of time it is liable to take to get back to normal working. Short term problem which 1. Contact affected 2.2 Student Communications can be resolved in one or students via two days telephone, e-mail or text. Consider whether it will be more effective to illicit the help of the Curriculum Groups in this. 2. Fix problem and pay student funds as appropriate

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

31 Long Term Problem 1. Consider convening 3.4 BCRT Communications the BCRT. 2.2 Student Communications 2. Prepare media statement 3. Contact affected students via telephone, email. Consider whether it will be more effective to illicit the help of the Curriculum Groups in this. 4. Make arrangements for emergency manual payments

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

32 Critical Function: Finance

Risk: 3B Payments to Suppliers

This Action Plan defines the Procedures to be followed, or steps to be taken in the event of the college not being able to pay suppliers due to an event.

Risk assessment Moderate

Recovery Time Objective 2 days

Maximum Tolerable Period of Disruption 1 week Replicate BACS systems infrastructure Recovery Point Objective across main campuses

Critical Likelihood Impact Risk Score Action Further Action Function Controls which needs to be already in taken to mitigate place this risk Payment to Replicate BACS Suppliers 2 5 10 Finance systems Team infrastructure across main campuses – main system located in Kilmarnock campus

3B Payment to Suppliers Further Information Responsibility: BCRT, Vice Principal of Finance and Business (role responsible for leading on this Systems, Director of Finance activity, plus deputies) Note BCRT convened only if disruption was liable to be long term Likelihood of Event 2 Very Low

Potential impact on organisation 5 Refer to college risk methodology

Recovery timeframe: 5 working days (how quickly must this function be recovered to avoid lasting damage)

Resources required for recovery

Staff Finance staff, ICTAyrshire support. College # 193132484082 (staff and Teams the BCRT are likely 09/12/201810/31/2018 14:26:1914:56:15 to need to call on)

33 Data/systems Backup files and server (backup and recovery processes, alternative manual work-round, staff and equipment required) Premises System accessible across campuses via (potential relocation or work-from- virtualised server solution – the present college home options) network failover will allow staff to relocate or receive connectivity through a separate Communications Possible needconnection to contact to the suppliers internet. affected if (methods of contacting staff, suppliers, payment will be delayed – would be done via customers, etc) phone calls, emails as appropriate Equipment PCs, server, BACS (key equipment recovery or replacement processes; alternative sources; mutual aid) Supplies n/a (processes to replace stock and key supplies required; provision in emergency pack)

Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) Reported difficulty in 1. Ascertain the nature of making payments to the problem and the suppliers. length of time it is liable to take to get back to normal working. Short term problem which 1. Consider contacting See main suppliers list can be resolves in five days affected suppliers via (Appendix 4) telephone or email. 2. Fix problem and pay suppliers as appropriate Longer Term Problem 1. Consider convening 3.4 BCRT Communications the BCRT. 3.6 BCRT meetings 2. Prepare media statement See main suppliers list 3. Contact affected (Appendix 4) suppliers via telephone or email. 4. Consider whether it is necessary to inform the Funding Council, particularly if the problem is a financial one. 5. Make arrangements for emergency manual payments by cheque Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

34 Critical Function: Finance

Risk: 3C Payroll

This Action Plan defines the Procedures to be followed, or steps to be taken in the event of the college not being able to pay staff due to an event.

Risk assessment Moderate

Recovery Time Objective 1 day

Maximum Tolerable Period of Disruption 2 days Replicate BACS systems Recovery Point Objective infrastructure across main campuses

Critical Likelih Impact Risk Score Action Further Action Function ood Controls which needs to be already in taken to mitigate place this risk Payroll 2 5 10 Finance Replicate BACS Team systems infrastructure across main campuses – main system located in Kilmarnock campus

3C Payroll Further Information Responsibility: BCRT, Vice Principal of Finance and College (role responsible for leading on this Systems, Director of Finance activity, plus deputies) Note BCRT convened only if disruption was liable to be long term Likelihood of Event 2 Very Low Potential impact on organisation 5 Extreme Refer to college risk methodology Recovery timeframe: 2 working days (how quickly must this function be recovered to avoid lasting damage)

Resources required for recovery

Staff Finance staff, ICT support. HR information, (staff and Teams the BCRT are likely marketing staff to need to call on) Data/systems Payroll backup files – payAyrshire staff based College on last # 193132484082 (backup and recovery processes, month’s payroll if no other09/12/201810/31/2018 option available 14:26:1914:56:15 at alternative manual work-round, staff critical time. Maintain and back up master lists of and equipment required) staff and salaries which could be used to make emergency payments. 35 Premises System accessible across campuses via (potential relocation or work-from- virtualised server solution – the present college home options) network failover will allow staff to relocate or receive connectivity through a separate broadband connection Communications Email, phone calls to as required (methods of contacting staff, suppliers, All staff email if problem not rectified before pay customers, etc) run

Equipment Payroll P.C.s and server and internet access (key equipment recovery or replacement processes; alternative sources; mutual aid) Supplies n/a (processes to replace stock and key supplies required; provision in emergency pack)

Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) Reported difficulty in making 1. Ascertain the nature of payroll the problem and the length of time it is liable to take to get back to normal working. Short term problem which 1. Contact affected staff 3.1 Staff Communications can be resolves in five days via telephone or email. 3.2 Press communications 2. Prepare media statement 3. Pay staff based on last month’s payroll if no other option available at critical time Longer Term Problem 1. Consider convening 3.6 BCRT meeting the BCRT. 3.2 Press communications 2. Prepare media statement 3. Contact affected staff via telephone or email as appropriate. 4. Consider whether it is necessary to inform the Funding Council, particularly if the problem is a financial one. 5. Make arrangements for emergency manual payments Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

36 Critical Function: Telecommunications

Risk: 4 Telecommunications

This Action Plan defines the Procedures to be followed, or steps to be taken in the event of critical degradation, or outright loss of telecommunications services, affecting voice (telephone/fax), or data (email/web browsing/remote access), such that Normal Operations are threatened, or actually interrupted.

Risk assessment Moderate

Recovery Time Objective Less than 1 day

Maximum Tolerable Period of Disruption 1 day

Recovery Point Objective Fully operational telecommunications

Critical Likelihood Impact Risk Action Further Action Function Score Controls which needs to be already taken to mitigate in place this risk Telecommunications 2 4 8 ICT and Front of House Team

4 Telecommunications Further Information

Responsibility: BCRT, Vice Principal of Finance and (role responsible for leading on this College Systems, Vice Principal activity, plus deputies) Estates and Head of ICT 2 Likelihood of Event Very Low

4 Potential impact on organisation Major Refer to college risk methodology

Recovery timeframe: Same working day response from support (how quickly must this function be contracts. recovered to avoid lasting damage) Resources required for recovery

Staff Head of ICT, Front of House Team Leader (staff and Teams the BCRT are likely to need to call on) Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

37 Data/systems Redirection to other campus. (backup and recovery processes, Forward messages via Mobile Phone or Email alternative manual work-round, staff and equipment required)

Premises (potential relocation or work-from-home N/A options) Communications Contact Fault number as in ICT (methods of contacting staff, suppliers, Contacts list (attached) customers, etc) Quote post-code of site and fault details to raise helpdesk support call. A fault-reference number will then be provided. Equipment Networked telecommunications system (key equipment recovery or covered by Exchange Communications. Also replacement processes; alternative all Phone lines and kilo stream connections. sources; mutual aid) Vodafone manage the Ayrshire Wide Area Network (WAN) connectivity between the 3 main campuses

Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) Initial Report of Symptom(s) 1. Send network 1.6 Communications Service broadcast to identify Fault Resolution extent of fault

2. Investigate fault

Failure of External Link 1. Contact service 1.6 Communications Service Identified provider for fault Fault Resolution resolution

Failure of Telephone Switch 1. Establish interim 1.7 Internal Telephone System Identified function of answering Fault Resolution system/service

2. Implement system fault resolution

Failure of Routing, or own 1. Implement fault 1.7 Internal Telephone System Network Hardware resolution Fault Resolution Identified

Recovery Phase Achieved, 1. Decide on the extent 2.2 Students Communications or Full NMO Resumed of the need to inform students of the event 3.1 Staff Communications

2. Inform Staff of incident status

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

38 Critical Function: Computer Systems and Services

Risk: 5A ICT Services

This Action Plan defines the Procedures to be followed, or steps to be taken in the event of a Threat, or actual Incident that leads to the loss of key computer services and business systems.

Risk assessment Low

Recovery Time Objective Less than 1 day 2 days Maximum Tolerable Period of (Timeframe would be assessed & Disruption estimated as per exact disruption by Head of ICT) Restoration of full ICT capabilities for Recovery Point Objective cross-college functions

Critical Likelihood Impact Risk Action Further Action Function Score Controls which needs to be already in taken to mitigate place this risk ICT 2 4 8 ICT Team, Up to date Business maintenance contracts Intelligence and Consultancy support systems staff contracts

5A Further Information ICT Services Responsibility: BCRT, Vice Principal of Finance and College (role responsible for leading on Systems, Head of ICT, Business Systems this activity, plus deputies) Manager ICT Manager2 Likelihood of Event Very Low

4 Potential impact on Major organisation Refer to college risk methodology Recovery timeframe: Quick recovery required to facilitate restoration of full (how quickly must this function ICT capabilities for cross-college functions. be recovered to avoid lasting Timeframe would be assessed & estimated as per damage) exact disruption by Head of ICT

Resources required for recovery Ayrshire College # 193132484082 Staff ICT Services09/12/201810/31/2018 14:26:1914:56:15 (staff and Teams the BCRT are Maindec have maintenance contract likely to need to call on)

39 Data/systems Recovery process may involve closing external (backup and recovery network. processes, alternative manual work-round, staff and equipment Premisesrequired) Recovery options include backup Broadband (potential relocation or work-from- internet connections. home options) Communications 1. Estates staff for out-of-hours access if (methods of contacting staff, required. suppliers, customers, etc) 2. Emergency contact details for Electricians for power issues 3. ICT staff for restoration of ICT hardware. Equipment Source of network information through ICTCP. (key equipment recovery or (Held by all ICT staff) replacement processes; alternative sources; mutual aid) Supplies ICT Services will organise. 4.

Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) Problem Reported 1. Determine whether the 1.1 Faulty Workstation problem is local to a Evaluation particular workstation, or with the network

Established that a Network 1. Determine whether the 1.2 Replace Hardware Computer has Failed and failed item can be Device cannot be Used replaced under Warranty

Established that the Failed 1. Arrange for repair, or 1.2 Replace Hardware Computer is NOT included in replacement of the failed Device the Maintenance Service computer as appropriate Agreement 2. Assess the impact on the network and consider reviewing hardware covered on the maintenance service agreement

Established that the Failed 1. Invoke replacement 1.2 Replace Hardware Computer is included in the computer service Device Maintenance Service Agreement

Replacement Computer 1. Replace failed hardware 1.2 Replace Hardware Service Invoked Device

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

40 Failed Hardware 1. Review age/condition/ 1.2 Replace Hardware Repaired/Replaced & suitability of all hardware Device functioning correctly Assets and the extent of the College’s critical dependence upon each item

Failed Server or 1. Determine if the failed 1.11 Data recovery to server storage node server or storage node or storage node can be replaced under warranty

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

41 Critical Function: Computer Systems and Services

Risk: 5B Student Records & Bursary Services

This Action Plan defines the Procedures to be followed, or steps to be taken in the event of a Threat, or actual Incident that leads to the loss of MIS systems.

Risk assessment Moderate

Recovery Time Objective 1 day 2 days Maximum Tolerable Period of (NB. Time frames may be shorter d Disruption dependent on when procedures are affected) Relevant maintenance contracts actioned Recovery Point Objective immediately ICT to ensure that all backups are up to date and can be restored

Critical Likelihood Impact Risk Action Controls Further Action Function Score already in place which needs to be taken to mitigate this Student 2 5 10 Bursary, Business Capitarisk and Records & Systems & ICT Tequios Bursaries Team Maintenance contracts

5B Further Information MIS Services Responsibility: Head of ICT, Funding (role responsible for leading on Manager, Head of this activity, plus deputies) Business Systems 2 Likelihood of Event Very Low

Potential impact on 5 organisation Extreme

Recovery timeframe: The relevant maintenance contracts should be (how quickly must this function actioned immediately, ICT to ensure that all backups be recovered to avoid lasting are up to date and can be restored. damage)

Resources required for recovery Ayrshire College # 193132484082 Staff Bursary, Business Systems &09/12/201810/31/2018 ICT Staff required 14:26:1914:56:15 to (staff and Teams the BCRT are likely identify cause of problem. to need to call on)

42 Data/systems System accessible across campuses via (backup and recovery processes, virtualised server solution – the present college alternative manual work-round, staff network failover will allow staff to relocate or and equipment required) receive connectivity through a separate broadband connection Premises System accessible across campuses via (potential relocation or work-from- virtualised server solution – the present college home options) network failover will allow staff to relocate or receive connectivity through a separate broadband connection Communications Possible need to contact all students affected if payment will be delayed – would be done via notices, phone calls, emails, texts, college website as appropriate (methods of contacting staff, suppliers, external suppliers however, in the event that this customers, etc) method of communication is inoperable, mobile phones could be used as an effective means of communicating to both internal and external customers/suppliers/ staff. Equipment The backup tapes would also be required to (key equipment recovery or ensure the integrity of the database is maintained replacement processes; alternative until the recovery period is over. sources; mutual aid) Supplies Availability of laptops to enable offsite access and (processes to replace stock and key mobile phone. supplies required; provision in emergency pack)

Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) User Cannot Access Data 1. Determine whether the 1.11 Data recover to Server lack of access is due to or Storage node password access failure 1.12 Data Access Validation

2. Check if loss is due to 1.1 Faulty Workstation corrupt data Evaluation 3. Check if loss is due to 1.8 Peripheral & Routing system configuration change 1.2 Hardware Fault 4. Check if loss is due to Resolution faulty workstation

5. Check if loss is due to Key Systems Infrastructure Failure

6. Check if loss is due to telecommunications Ayrshire College # 193132484082 infrastructure failure 09/12/201810/31/2018 14:26:1914:56:15

43 7. Check if loss is due to network, or peripheral routing hardware failure

Short term problem which 1. Contact affected 2.2 Student can be resolved in one or students via telephone, Communications two days e-mail or text. Consider whether it will be more effective to illicit the help of the Curriculum Admin in this. 2. Fix problem and pay student funds as appropriate

Long Term Problem 1. Consider convening 3.4 BCRT Communications the BCRT. 2. Prepare media 2.2 Student statement Communications 3. Contact affected students via telephone, email. Consider whether it will be more effective to illicit the help of the Curriculum Admin in this. 4. Make arrangements for emergency manual payments

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

44 Critical Function: Loss of Data

Risk: 6 Viruses, hacking, human error

This Action Plan defines the Procedures to be followed, or steps to be taken in the event of a Threat, or actual Incident leading to the loss of Data.

Risk assessment Medium

Recovery Time Objective Less than 1 day

Maximum Tolerable Period of 1 day Disruption Records returned to back up from Recovery Point Objective previous evening

Critical Likelih Impact K Score Action Further Action Function ood Controls which needs to be already in taken to mitigate place this risk Loss of Data 3 5 15 ICT Team Ensure all records are saved in electronic format and ensure these are backed up each evening. Agree offsite secure storage and archive solution – see also RISK 2A

6 Further Information Loss of Data Responsibility: BCRT, Vice Principal of Finance and College (role responsible for leading on this Systems, Head of ICT, Vice Principal of HR/OW, activity, plus deputies) Director Quality Enhancement

Likelihood of Event 3 . Potential impact on 5 organisation

Recovery timeframe: Timeframe is dependent about severity of data (how quickly must this function be loss. Worst case scenario would require a recovered to avoid lasting damage) minimum of a full working day to restore a system and the Ayrshiredata. College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

45 Resources required for recovery Staff ICT Services/Business Information (staff and Teams the BCRT are likely Systems staff to need to call on) Data/systems Procedure 1.11 (backup and recovery processes, alternative manual work-round, staff and equipment required) Premises The System can be accessed from any other (potential relocation or work-from- College campus providing the network is fully home options) operational. Communications Given that the College network is functioning, an (methods of contacting staff, suppliers, email could be initiated to the relevant staff and customers, etc) external suppliers however, in the event that this method of communication is inoperable, mobile phones could be used as an effective means of communicating to both internal and external customers, suppliers and staff. Equipment Covered through (key equipment recovery or replacement processes; alternative sources; mutual aid) Supplies Covered through (processes to replace stock and key supplies required; provision in emergency pack)

Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) User Cannot Access Data 1. Determine whether the 1.11 Data recovery to Server lack of access is due to or Storage Node password access failure 1.12 Data Access Validation 2. Check if loss is due to corrupt data 1.1 Faulty Workstation Evaluation 3. Check if loss is due to system configuration change 1.9 Peripheral & Routing Hardware Fault 4. Check if loss is due to Resolution faulty workstation

5. Check if loss is due to 1.6 Communications Fault Key Systems Resolution Infrastructure Failure

6. Check if loss is due to network, or peripheral routing hardware failure Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

46 Critical Function: Utilities Loss

Risk: 7 Water, sewage, electricity, gas etc

This Action Plan defines the Procedures to be followed, or steps to be taken in the event of a Threat, or actual Incident leading to the loss of the following key utilities, Water Sewage, electricity and Gas.

Risk assessment Medium

Recovery Time Objective Less than 1 day

Maximum Tolerable Period of 1 day Disruption

Recovery Point Objective Utilities restored to acceptable standard

Critical Likelihood Impact Risk Action Further Action Function Score Controls which needs to be already in taken to mitigate place this risk Loss 4 4 16 Estates Team Work closing with Utilities, and the relevant Water, ICT Team to agencies involve in Sewage, back up any the maintenance of Electricity lost data the PFI and NPD and Gas Campuses.

7 Further Information Utilities Loss Responsibility: BCRT, Estates Team (role responsible for leading on this activity, plus deputies) Likelihood of Event 4 Very Low Likelihood of 4 interruption to Major organisation: Refer to college risk methodology Recovery timeframe: Timeframe is dependent about severity of key (how quickly must this function utilities. Worst case scenario would require a be recovered to avoid lasting minimum of a full working day to complete restoration damage) of the utility.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

47 Resources required for recovery Staff Estates staff working with the utilities companies and (staff and Teams the BCRT are the PFI and NPD support staff should be able to likely to need to call on) identify the problem. Data/systems System(See accessibleAppendix 1 across & 2 - Key campuses contact via numbers) virtualised (backup and recovery server solution – the present college network failover processes, alternative manual will allow staff to relocate or receive connectivity work-round, staff and through a separate broadband connection equipment required)

Premises Computer systems could be accessed from other (potential relocation or work- facilities should the main servers still be working. from- home options) Ayrshire College has a virtual server environment which has failover built in where if one or two campuses suffer a systems failure, the third campus will continue to provide server access across the region. Communications As email is hosted in the 365 cloud environment, (methods of contacting student, emails can be accessed via smart phones or by staff, suppliers, customers, etc) connecting from anywhere with internet access and the use of social media

Equipment May need replaced as necessary depending on (key equipment recovery or where fault lies replacement processes; alternative sources; mutual Suppliesaid) Availability of laptops to enable offsite access and (processes to replace stock and mobile phones. key supplies required; provision in emergency pack)

Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures) Estates is informed that 1. Inform Director of 3.4 BCRT Communications there will be, or is, a loss of Infrastructure and utilities HSW Manager or in their absence other BCRT member. 2. Ascertain the likely duration of the Utility loss 3. Assess any Health and Safety risks

Utilities loss likely to be 1. If no H&S risk short term 1 – 2 hours continue College Ayrshire College # 193132484082 operations as normally 09/12/201810/31/2018 14:26:1914:56:15 as possible

48 Utilities loss likely to be long 1. Consider if it is 2.2 Student term, but less than 48 hours necessary to close Communication College for the rest of 3.1 Staff Communication the day

Campus closes 1. Contact Evening Class 2.2 Student Students if possible Communication and inform them of College closure (Phones may be unaffected or use Phones in other campuses.

Power loss likely to be long 1. Treat as a long term See Critical Function 1.ii term and more than two denial of access working days Critical Function 1.ii

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

49 Critical Function: Staff

Risk: 8 Flu pandemic/ terrorist attack (or equivalent in terms of large scale staff absences)

This Action Plan defines the Procedures to be followed, or steps to be taken in the event of Key individuals, or a critical percentage of staff being absent due to flu or some other form of mass illness.

Risk assessment Very Low

Recovery Time Objective 1 week

Maximum Tolerable Period of 5 months Disruption Essential services Recovery Point Objective delivered to required standard

Critical Likelih Impact Risk Score Action Controls Further Function ood already in place Action which needs to be taken to mitigate this risk Flu Government Dissemination Pandemic 1 4 4 Health Advice. of Government Vice Principal of and Health HR/Organisational Service, Wellbeing leading Colleges College response Scotland guidance as it is received

8 Flu Pandemic Further Information (or equivalent in terms of large scale staff absences) Responsibility: BCRT, Vice Principal of Organisational Wellbeing (role responsible for leading on this and Director of HR/OD. activity, plus deputies)

Likelihood of Event 1

Very Low Potential impact on 4 organisation Major Refer to college riskAyrshire Methodology College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

50 8 Flu Pandemic Further Information (or equivalent in terms of large scale staff absences) Recovery timeframe: One week (how quickly must this function be recovered to avoid lasting damage) Disruption may last for 3 – 5 months, so actions to mitigate the threat should be implemented.

2 Likelihood of occurrence Remote, or unlikely but possible.

Resources required for recovery Staff Identify essential services and ensure that (staff and Teams the BCRT are likely additional staff are trained/ brought in to cover if to need to call on) required.

Teaching would be dependent on staff availability and is likely to be reduced as a result of illness. Data/systems Detailed log of those who are absent may be (backup and recovery processes, necessary. College might also consider a staff and alternative manual work-round, staff student dedicated phone line to report absence and equipment required) due to flu. Premises Work-from-home options should be considered and (potential relocation or work-from- planned for if the college is forced to close for a home options) period of time. It may be appropriate to consider asking some key staff to work from home to minimise risk of infection, before a decision is taken to close the college. Communications Communication systems for students and staff (Methods of contacting staff, suppliers, would ideally be established to allow least customers, etc.) disruption if closure/re-opening is to occur. Radio, newspapers and the College website, text messages and other social media may be more efficient and effective as opposed to email and letter.

An emergency advice line could be established and publicised to aid information dissemination about college closures/disruptions to eliminate the need for all students to travel to college and then be sent home.

Information on pandemics and reducing infection should be supplied to staff and students (information will be made available through key health websites). Equipment Infection is passed through droplets in the air and (key equipment recovery or so masks will be required for all students/staff. replacement processes; alternative Additional cleaning is recommended (door handles/ Ayrshire College # 193132484082 sources; mutual aid) public areas) and regular hand-washing09/12/201810/31/2018 is 14:26:1914:56:15 essential to reduce infection.

51 Supplies Planning to ensure that the maintenance, or even (processes to replace stock and key expansion, of key supplies and services would be supplies required; provision in essential to ensure continuity of services. emergency pack)

Trigger or Key Decision Action Procedure (numbers refer to Section 5, Procedures)

5% or more staff or 1. Decide whether or not to 3.4 BCRT students are convene BCRT. Communications absent because of 2. We immediately find out what illness. posters etc. is available 3.6 BCRT Meetings containing health information on how to limit the spread of infection. We may have to develop our own with information on College advice as to what to do if you feel ill. Staff or student 1. BCRT should be convened. 3.4 BCRT absences rise to 10% 2. Secure lines of communication Communications with all staff. All SMT, Heads and managers should ensure 3.6 BCRT Meetings that they have up-to-date contact details for all of their staff. 2.2 Student 3. Directors, Heads and Curriculum Communications Managers should ensure that they have up-to-date contact 2.1 Staff details for all students. Communications 4. The BCRT will ask all SMT, Heads and managers to report on all critical actions that need to 2.3 Student be accomplished even in the Communications face of major staff illness and the arrangements they have made to 3.1 Staff ensure that these actions can be Communications accomplished. 5. Team Leaders are especially asked to consider whether any critical actions are presently only being carried out by one member of staff and to make arrangement for the prompt training of others so they can take over critical functions as necessary.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

52 6. Communicate regularly with staff and students, informing them of the steps the college has/will take. 7. Depending on the time of year and the approaching exam period all Directors and Curriculum Managers should be advised that: 8. List of assessments, submission dates etc. should be obtained from each lecturer for each class. 9. Sufficient copies of assessment instruments should be prepared as soon as possible and stored centrally in their area.

10. Cease attending external Staff or student absences meetings. rise to 10% 11. Cease holding meetings in the college. 12. Limit travel by College staff.

The following two triggers are most likely to occur at the same time and therefore should not therefore be looked at in isolation.

The government has no plans at the moment to order a blanket ban on the operation of schools and colleges. We should however be aware that at some stage we may need to close the college, either on government advice or on our own initiative.

Teaching is disrupted BCRT should ask Curriculum Consider availability of due to staff absence Directors and Curriculum VLE and paper based and the unavailability of Managers what classes can still material. staff cover. be run

Learning is disrupted BCRT should consider whether to 2.2 Student because of a lack of cease teaching in some or all Communications teachers or because of areas. This is effectively closing 3.1 Staff student absence. the College to some or all Communications students and staff. (Although it is tempting to continue to offer classes to those students who are Staff and student well enough to attend, this may be communications by word counterproductive in that it could of mouth to all still in result in a large number of attendance and to all students falling behind in their others by the College units, which will have a large internet and local radio. knock on effect in assessment Ayrshire College # 193132484082 performance etc.) 09/12/201810/31/2018 14:26:1914:56:15

53 6 Procedures

1 Technical Operations 1.1 Faulty Workstation Evaluation 1.2 Replace Hardware Device 1.3 Physical Recovery 1.4 Invocation of Emergency Call Routing 1.5 Disable College Application Server 1.6 Communications Service Fault Resolution 1.7 Internal Telephone Fault Resolution 1.8 Peripheral & Routing Hardware Fault Resolution 1.9 Supplier Communications 1.10 Applications Recovery to Server 1.11 Data Recovery to Server 1.12 Data Access Validation 1.13 Delivery

2 Student Activity Operations 2.1 Interim Learning and Teaching 2.2 Student Communications

3 Infrastructure Operations 3.1 Staff Communications 3.2 Press Communications 3.3 Fire & Evacuation 3.4 Business Continuity Response Team Communications 3.5 Damage Assessment & Salvage 3.6 Business Continuity Response Team Meetings 3.7 Invocation of Event Management Centre 3.8 Diversion of Telephone & Fax 3.9 Recruitment 3.10 New Employee Induction Procedure 3.11 Staff Protection Procedure

4 General 4.1 Identify Alternate for Workload 4.2 Assess & Prioritise Current Workload Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

54 SECTION 1 - TECHNICAL OPERATIONS

1.1 Faulty Workstation Evaluation

Confirm whether issue is Loss of Access to Data and if so, follow the ICT Services – Operational Guidelines – Restoration Procedures to restore their data.

Confirm that the fault can be replicated by the User.

Carry out System Self-Test Diagnostics.

Identify if fault is a known software problem that can be remedied by applying patch, or upgrade. If so, apply the patch/upgrade.

Advise User to seek use of alternate Workstation for access to necessary services in the interim.

Check that replicated fault is isolated to one application for the User. If so, reinstall the application for the User.

If reinstallation attempts generate multiple error conditions, schedule the computer/laptop for software rebuild using Windows Deployment Services.

If the root cause is hardware, schedule the Workstation for repair, or replacement accordingly.

1.2 Replace Hardware Device Assess if faulty device can be fixed by replacing/repairing faulty component (e.g. screen, cartridge, etc.). If so, replace component as an expense item.

If not, confirm if replacement devices are available from a local supplier, with sufficient similarities in terms of features.

If not, assess cost/benefit of sourcing replacements from remote locations, versus local purchase from local sources, factoring in lead time considerations.

Reroute user Services to Secondary platforms, subject to cost/benefit assessment in terms of time estimated to recover hardware for User.

Purchase replacement device as necessary.

Purchase additional replacement devices as necessary, as contingency, if considered beneficial to shorten future recovery.

1.3 Physical Recovery

Physical Recovery is set out in the following sections: ReplacementAyrshire College of IT # 193132484082 equipment & Systems; Replacement of Fixtures & Fittings;09/12/201810/31/2018 Repairs & 14:26:1914:56:15 Refurbishment of Buildings, Including Offices & Interiors; and Repair, or Replacement of Manufacturing and Related Facilities.

55 IT Equipment & Systems: The IT & telecommunications systems are to be restored to their previous standard, specification & configuration. A schedule of necessary hardware & software purchases, plus services to achieve this, must be drawn up and submitted to the relevant budget holder for approval. Where relevant, a schedule of confirmed damage and losses from the salvage contractor, as agreed by the loss adjuster, the salvage contractor must then issue this schedule to Ayrshire College for action.

Fixtures & Fittings: Fixtures & fittings, including furniture, must be reinstated to their pre-incident standard. Approval for all such replacements must be obtained from the loss adjuster. A schedule of all original assets may be obtained from the Director of Finance or Head of Financial Services.

Buildings & Infrastructure: If physical damage occurs at any of the campuses, Ayrshire College is accountable for effecting such repairs and providing alternative temporary Premises in the local area in the interim.

1.4 Invocation of Emergency Call Routing Confirm main Workplace and its facilities will not be available for an extended period (over 4 hours).

Reroute Ayrshire College telephone lines to designated alternative numbers/ alternative campuses, as specified by any member of the BCPG. This is done by contacting Exchange Communications (08000277202)

Revert to original routing number when Normal Mode of Operation (NMO) conditions are resumed.

1.5 Disable College Application Servers Notify affected users informing them of relevant server shut down at specified time.

Check that all users are logged off at shut down time.

Contact any users still logged on after shut down time & instruct them to log off, or possibly lose work.

Issue server shut down command at operating system level.

If down time is known, include this in the messages to users.

Power system off, if required. Ayrshire College # 193132484082 Notify users, or key contacts, that Services have been recovered,09/12/201810/31/2018 with 14:26:1914:56:15 broadcast email, and/or other notification method.

56 1.6 Communications Service Fault Resolution Identify that there appears to be an external communications service fault into the building, such that the phone service is unusable and report this to Front of House Staff.

Contact on-site facilities at Exchange Communications or Vodafone and inform them of the fault, for escalation to their own service provider, during office hours.

Outside of office hours, notify the Head of ICT Services.

If necessary, contact Vodafone on 07001001441, VODAFONE Managed Services on 0141 776 8890 on a working line, or mobile advising them of the fault.

If the service provider can identify a fault on the line, request an estimated time to resolution.

Request the diverting of the line to an alternate number or other campus or an EMT/SMT- designated mobile phone.

Ask Exchange Communications to place a message on the relevant line advising callers of the fault, if necessary. ICT to work in conjunction with Front of House staff with regard to telephone messages.

Report expected duration of function loss to relevant staff, suppliers & students as necessary.

Switch to alternate communications methods as appropriate.

1.7 Internal Telephone System Fault Resolution

Assess possibility of using alternative handset hardware within the local office.

Offer Call Forwarding and program where requested.

Request replacement handset from Exchange Communications.

Check replacement handset works with the underlying phone number.

Recheck previous configurations on new handset, such as speed dial.

1.8 Peripheral & Routing Hardware Fault Resolution

Conduct diagnosis to locate the faulty component.

Does a unit of the replacement component exist locally Ayrshire on site? College If so, # 193132484082 replace and re-order to replenish under warranty, or as 09/12/201810/31/2018 a purchased 14:26:1914:56:15 consumable.

57 Contact Main Dec on 01628 810 400 to report/order parts (HP Servers) under warranty.

Contact HP on 0800-917-7241 using pin 80098 to report computers under warranty.

Contact SEC-1 on 01924 284 240 for replacement VPN or Firewall.

Contact Ping Networks on 0141 410 1222 for replacement Cisco Core Switches and Wireless Controllers

Contact HPE on 0845-161-0030 for HP network Support

If component cannot easily be replaced, consider rerouting workload, or traffic, or other similar technical workarounds.

Notify any staff, students, or suppliers likely to be materially affected.

Ensure replacement of item & restoration of NMO after installation.

Consider cost-benefit of buying spare units of the failing component, or implementing alternative, more resilient technical solution.

1.9 Supplier Communications

Identify list of suppliers materially affected.

Determine the nature, frequency & content of the communication, defaulting to email on an ‘as needs’ basis.

Specify clearly the way in which the supplier relationship is likely to be affected.

Specify any increased services required, or any changes needed in NMO procedures between organisations.

Keep suppliers informed regarding likely resumption of NMO and when it is actually achieved.

1.10 Applications Recovery to Server

Ensure servers have passed daily backup, if not follow ICT Services Backup Procedures to ensure you have a completed backup.

College email is hosted in the Microsoft 365 Cloud Environment where all servers are backed up and replicated between Dublin and Holland. Ayrshire College # 193132484082 De-install any previous versions of the application as required,09/12/201810/31/2018 to permit 14:26:1914:56:15 clean install.

Restart/Power server down if necessary. 58 Install fresh version of application, following installation instructions to achieve desired configuration.

Check access to the application across the network & locally.

Check relevant Users can access both the application & any associated data as appropriate.

1.11 Data Recovery to a Server – Storage Node

Request of data recovery made to ICT Manager/campus ICT Team Leader. Note: Microsoft will only hold two weeks’ worth of deleted e-mails which can be restored.

Using information from request locate the backed up data from Veeam.

Restore Data to central place on server or storage node.

Confirm the restored data is correct.

Move data to original location.

1.12 Data Access Validation

Confirm if same data can be accessed from another workstation.

Confirm if same data can be accessed using another valid password access code.

Check if there are error messages linked to the data source in the relevant system monitoring logs.

Check with ICT Support whether there have been any recent configuration changes, since the last time the User recalls having full access.

Check what the User recalls doing immediately prior to the loss of access to the data.

1.13 Citrix Delivery

Confirm if issue relates to Servers, Storage, Networking, Thin Client or Software.

Replace Thin Client and if issue still exists contact iGel on 01183403400.

Contact HP on 0845 161 0030 to report Storage under warranty.

Contact HP on 0845 161 0030 to report Servers under warranty. Ayrshire College # 193132484082 Contact DTP on to report configuration problems with Servers,09/12/201810/31/2018 Storage and 14:26:1914:56:15 Networking.

Contact iKonic on 0141 810 5849 to report Citrix issues 59 Contact iKonic on 0141 810 5849 to report NetScalers under warranty.

If component cannot easily be replaced, consider rerouting workload, or traffic, or other similar technical workarounds.

Notify any staff, students, or suppliers likely to be materially affected.

Ensure replacement of item & restoration of NMO after installation.

Consider cost-benefit of buying spare units of the failing component, or implementing alternative, more resilient technical solution.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

60 SECTION 2 - STUDENT ACTIVITY OPERATIONS

2.1 Interim Learning and Teaching

Identify all outstanding teaching issues for students and timescales expected.

Identify College reasons for timescales and what impact any delays will have.

Negotiate revised deadlines and any associated commercial implications, including SLAs, credit penalties, cash payments, order cancellations, etc.

Qualify all student responses and assess likely overall College impact of delays indicated by the revised teaching deadlines.

Make recommendations to the BCRT as to which students teaching needs to prioritise.

Communicate decision to students affected, offering student feedback route to management if needed.

2.2 Student Communications

The Student Contact List is held in the Unit-e database and all student email accounts in the cloud.

Unless instructed otherwise by a member of the BCRT, Director of Quality Planning and Performance, and the Director of Student Services will determine with the Curriculum Directors who should contact which student and in what way.

Unless instructed otherwise by a member of the BCRT the Curriculum Directors will determine the content of the message to be communicated. By way of illustration, the following template should be adapted as required:

“Our premises have been affected by a fire/explosion/flood/other type of incident and we cannot use the premises for the time being. Fortunately, the relevant section of our Business Continuity Plan has been invoked and we are in the process of returning to normal operational capacity. As a College, we are built to operate effectively as a virtual team and the BCRT is handling matters. We are implementing the necessary arrangements with our Service & Curriculum staff to meet our teaching obligations to you. As we have been able to switch our service over to our Secondary Site, where we will endeavour to have all your relevant teaching materials present. If there will be any foreseeable impact upon our commitment to deliver teaching and learning, we will be in touch within X hours/days to confirm.”

Text message can also be sent to students, however this isAyrshire restricted College to 164 # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 characters.

61 SECTION 3 – INFRASTRUCTURE OPERATIONS

3.1 Staff Communications

In each communication, ensure inclusion of relevant elements of whether there is denial of access, duration of any interruption to Normal Mode of Operation, IT/telephony/other service issues, and wider considerations of feedback/welfare/staff morale. During office hours: 1. Ensure any staff known to be present, or associated with the affected Premises, are advised regarding what action they should take. 2. Initiate emergency call-out/broadcast to notify staff according to a message agreed by the BCRT. 3. If the incident occurs before [4pm] contact all absent staff members to advise them of action to take. 4. Record whether contact was reached, or whether just a message was left. (Confirm mechanism to record and where accessible) 5. After [6pm], consider contacting remaining staff on their home phone numbers if available. 6. If any affected staff are on holiday or away from their home, contact them by phone if possible, otherwise by email and post as a last resort. Outside office hours: 1. If the incident occurs before [5am], consider waiting until after [5am] to notify them at home. Otherwise, always default to primary contact on their mobile phone.

2. Give guidance on how long incident is likely to continue.

3. Record whether person has been contacted, or just a message was left.

4. Advise staff on how they will be kept updated on latest developments regarding the incident.

5. Confirm when Normal Mode of Operation has been resumed.

3.2 Press Communications A member of the BCRT, Vice Principal of Strategy, Planning and Performance and Marketing and PR Manager will set up a media control centre. Only the Members of the BCRT will comment on any issue to the Media and they should do so using a prepared text as agreed by the Ayrshire College # 193132484082 BCRT and the College’s media representatives. 09/12/201810/31/2018 14:26:1914:56:15

Unless specifically authorised by the BCRT, no comment should be made to the Press. If approached, staff response should be that a press 62 statement is being prepared and will be issued through official channels; all enquiries should be referred to the BCRT or the College’s media representatives.

The default spokesperson in Events will be the Principal. When the Principal is unavailable, the BCRT shall nominate the Marketing and PR Manager or an appropriate alternative, which in normal circumstances will be the Vice Principal of Strategy, Planning and Performance. The BCRT shall decide on any communication, the channels to be used, with whom to communicate and in what order. Prior to briefing the press, a decision should be made as to whether to provide an interview, conference, or merely issue a press statement. The latter is the preferred method for most foreseeable circumstances. Wherever possible, staff should be notified first, students second, suppliers third and Press last of all. Ayrshire College has no specific obligations with respect to notifying the Public concerning incidents at any of the College campuses. Third parties are responsible for their respective premises. It is usually best to communicate facts and expressing sorrow at any personal loss, or injury suffered as a consequence of the Event. 3.3 Fire & Evacuation This procedure is to be used in the event of a fire at all college locations

If you discover a fire: Operate the Fire Alarm immediately by breaking the seal on the nearest relevant unit.

Attack the fire if possible with the equipment provided, but do not take any personal risks. Leave immediately if the fire cannot be brought quickly under control.

On Hearing the Alarm The ALERT signal is a continuous ring on a bell alarm. Unless having received prior warning that the Alarm is a planned exercise, staff and visiting personnel should proceed immediately to the nearest muster point, the defaults being in the Car Park at the rear of the building, and the pavement outside the front of the building if nearest the front stairs. DO NOT USE LIFTS (EXCEPT WHERE SPECIAL ARRANGEMENTS EXIST FOR THE DISABLED). Ayrshire College # 193132484082 DO NOT STOP TO COLLECT BELONGINGS. 09/12/201810/31/2018 14:26:1914:56:15 DO NOT RE-ENTER THE BUILDING UNTIL INSTRUCTED TO DO SO 63 BY THE AUTHORISED FACILITIES MANAGEMENT REPRESENTATIVE Upon receiving notification of when staff will be able to return to their workspace, the most senior member of staff present, if they are not a member of the BCRT, should notify a member of the BCRT as soon as possible. Upon returning to the workspace, the most senior member of staff present should assess the workspace for damage and inform the BCRT of the need to invoke Damage Assessment & Salvage Procedures, if necessary 3.4 Business Continuity Response Team Communications

The following should be used for contact between members of the BCRT in connection with Business Continuity Incidents & Events.

Regardless of time, contact BCRT members by the following means, in order, until successful (see Appendix 2):

a. Mobile telephone (voice and text) b. Home telephone c. Work email, instant-mail, home e-mail d. Travel to home address (unless it is known that the contact is away from home)

Members of the BCRT and SMT and their contact details appear in the Key Contacts section of this Plan. Appendix 1.

The primary purpose of initially contacting all members of the BCRT is to arrange the first BCMG meeting. (See procedure: Business Continuity Response Team Meetings)

3.5 Damage Assessment & Salvage In the event of a physical incident where losses and/or damage are likely, the Director of Finance and Student Funding and the Head of Estates will contact the Insurance Company/Loss adjuster who have been pre- appointed as salvage contractor to provide a 24 hour response service.

3.6 Business Continuity Response Team Meetings

The first BCRT meeting will be held at the nominated location (the Business Continuity Management Centre [BCMC]) agreed by the BCRT, depending on the scale of the emergency. Choices shall include, but not be limited to:

a. Ayr Campus, Dam Park, Ayr Ayrshire College # 193132484082 b. Kilmarnock Campus, Hill Street, Kilmarnock 09/12/201810/31/2018 14:26:1914:56:15 c. Kilwinning Campus, Lauchlan Way, Kilwinning

If for some reason (although highly unlikely) none of these venues is available 64 contact local Hotels, schools or Church Halls for accommodation. (See P3.7)

The objectives for Day 1 of this type of incident would be to follow the 24 hour Activity Plan on page 5 of this document.

3.7 Invocation of Event Management Centre

BCRT to discuss options from list of BCMC Centre locations (section 3.6).

BCRT to select one location and notify staff from contact list.

BCRT to arrange transfer or purchase of emergency equipment and facilities at the BCPC.

Quantify impact of Event and likely duration of need for the Business Continuity Management Centre.

Notify staff, suppliers and students affected and procedure for obtaining latest information.

Advise all of likely resumption of Normal Mode of Operation.

3.8 Diversion of Telephone & Fax

Ayrshire College has the facility to divert to any telephone number Ayrshire College deem appropriate. Telephone supplier, Exchange Communications 08700 855 000.

The main Ayrshire College phone number for enquiries from the public is 0300 303 0303 – this number can be used to divert calls to designated mobiles.

The main campus numbers for use by Staff are: a. Ayr campus 01292 265184 b. Kilmarnock campus 01563 523501 c. Kilwinning campus 01292 559000

The main Ayrshire College fax numbers are d. Ayr campus 01292 293529 e. Kilmarnock campus 01563 538182 f. Kilwinning campus 01563 538182 – for redirection

Once Normal Mode of Operation is restored, the telephone supplier will revert the diverted telephone numbers back to the College telephone numbers.

3.9 Recruitment Ayrshire College # 193132484082 For recruiting of senior or key managers, submit a formal request09/12/201810/31/2018 to the 14:26:1914:56:15 relevant Vice Principal who will then seek approval from the Principal for new position or interim position and determine length of contract.

65 Work in collaboration with the HR Manager and relevant director to discuss job description and person specification. Obtain approval for and agree contract with the VP of HR and Skills. Interview candidates.

Make job offer to selected candidate in accordance with standard terms & conditions of employment. Take new employee through induction.

3.10 New Employee Induction Procedure

Ensure employee's details are registered in Ayrshire College HR files, including signed contract of employment. Inform Curriculum or Service area of official start date and ensure they have an area induction planned. Notify Payroll of employee's details, having obtained employee's last P45 if relevant. Set up person with own e-mail account, user name and password.

Obtain access to necessary systems to enable the employee to perform their tasks. Allocate mentoring responsible for guiding them through the early weeks, (this would normally be a colleague, a senior lecturer or supervisor or line manager. Set review date manager as a mentor, to ensure any issues are raised with a mentor. Cover the relevant items on the Technical, Learning and Teaching, or Infrastructure Induction Syllabus. 3.11 Staff Protection Procedure

Confirm details of Threat of, or actual harm, to which individual member, or Group of Staff or Students.

Consider if emergency services should be called immediately (for example if it was a terrorist threat, see also 9 and 10 below). Identify if the individual/group is aware of the potential harm.

Seek to communicate with the individual/group to direct them away from the Threat, and towards safety, with respect to their location.

Seek to educate the individual/group concerning the natureAyrshire of the Threat, College # 193132484082 to where relevant, notify the authorities: police, fire, ambulance,09/12/201810/31/2018 coast 14:26:1914:56:15 guard.

Direct Staff and Students towards counselling services relevant to the 66 nature of harm they may have suffered.

Notify wider staff and Student community regarding the nature of action taken and any changes to procedure required within NMO, where appropriate.

If the nature of the threat is one of physical violence and if this threat is deemed to be imminent and serious, the police should be called.

If the nature of the threat is one of physical or verbal violence and the threat is not felt to be imminent then if the perpetrator is;

• A College student - the Student Disciplinary procedure (Positive Behaviour Framework) should be invoked.

• A member of College staff - the Staff Disciplinary procedure should be invoked.

• A member of the public - the police should be informed.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

67 SECTION 4 – GENERAL

4.1 Identify Alternate for Workload

Assess the nature, quantity and expected timescales of the workload and the skills necessary to perform it, by referring to available paperwork, electronic files and co-workers of the person(s) not available. Represent the workload as a set of deliverables with target dates and associated status summaries, or starting positions. Prioritise the workload in terms of the value of the deliverables to the college department concerned. Evaluate the relative cost/benefits of achieving the deliverables with existing in-house staff, versus subcontracted resources. Formulate a plan identifying all deliverables identified, new deliverable owners, timescales agreed and method of updating progress against the plan. Circulate the plan to all staff affected.

Consider if Stakeholders and business partners should be informed. Staff involved are responsible for notifying their own management and colleagues, and managing their workload to incorporate the newly allocated deliverables, as required. 4.2 Assess and Prioritise Current Workload Procedure for reviewing the activities of owners of the Functional Areas: Technical Operations, Student Activity Operations & Infrastructure Operations, including BCRT.

BCRT initiate contact with all relevant representatives of the affected work areas and collate prioritised, bullet-point list of all activities of relevant staff and key third parties.

Invite contributions and discuss key perceived issues or activities by project, with all relevant contributors meeting together, or through conference call if necessary.

BCRT to consolidated view of contributors and assess collective impact of various courses of action and resource prioritisation on business as a whole.

Agree consolidated course of action, with action owners identified and completion timescales agreed.

Agree time/manner of review progress against agreed actionAyrshire plan. College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 Document & distribute agreed action plan, by e-mail, or other agreed mechanism, if e-mail cannot be relied upon.

68

Issue a time for action owners to report back to the BCRT.

Review progress at the set time/manner, unless rescheduled in the intervening time.

Repeat processes until issues are resolved, and Normal Mode of Operations is resumed.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

69 7 Risk Methodology

The detailed risk register has been formatted to show the allocation of risks to each risk category.

The rankings shown on the risk register range from one (1) to five (5) against each of the two criteria of likelihood and impact. The likelihood and impact scoring is multiplied together to provide the risk score.

Low High Likelihood 1 5 Impact 1 5 Risk Score = Likelihood x Impact

The risk scores are then classified as High, Medium, Moderate, Low and Very Low

Classification Risk Score Colour ID Very Low 1-4 Low 5-8 Moderate 9-14 Medium 15-19 High 20-25

Risk Assessment Grid

Almost certain 5 10 15 20 25

Likely 4 8 12 16 20 Likelihood

Possible 3 6 9 12 15

Unlikely 2 4 6 8 10

Rare 1 2 3 4 5

Insignificant Minor Significant Major Extreme Ayrshire College # 193132484082 Impact 09/12/201810/31/2018 14:26:1914:56:15

70 Risk Scoring

The overall risk score is the product of the likelihood of the risk occurring and the impact of the risk. These two factors have to be assessed separately and the detailed approach to this is set out below: a) Likelihood (Vertical)

Likelihood Risk Assessment Score 1 Rare (<5%) This will probably never happen/recur

2 Unlikely (5% to 20%) Do not expect it to happen/recur but it is possible

3 Possible (21% to Might happen or recur occasionally 50%) 4 Likely (51% to 80%) Will probably happen/recur but is not a persistent issue 5 Almost Certain Will undoubtedly happen/recur, possibly (>80%) frequently b) Impact Assessment (Horizontal)

Impact Score Example Definition

Insignificant 1 A. Unable to deliver 0 to 5% of the College’s agreed strategic targets. EMT & SMT intervention

B. Inconvenience to an individual or small group

C. Financial implications <£10k. Little damage to assets

D. Litigation, claim or fine <£2k

E. Rumours / potential for public concern / local media unsubstantiated article

F. Short-term low staffing level that temporarily reduces service quality (<1 day)

G. Loss/interruption of < 1hour. MinimalAyrshire or no College impact on # the193132484082 environment critical systems subject09/12/201810/31/2018 to minor incidents 14:26:1914:56:15

71 H. Health and safety impact could result in minor personal injury

Minor 2 A. Unable to deliver 5 to 25% of the College’s agreed strategic targets. Principal / Board intervention

B. Disruption to an individual or small group

C. Financial implications £10k to £100k. Minor loss or damage to assets

D. Litigation, claim or fine £2k to £50k

E. Local media coverage / short term reduction in public confidence. Elements of public expectations not being met

F. Low staffing level that reduces service quality

G. Loss/interruption of >8 Hours. Minor impact on environment critical systems subject to a series of incidents

H. Health and safety impact could result in minor injuries or short term illness

Significant 3 A. Unable to deliver 25% to 50 % of the College’s agreed strategic targets / SFC and other Agency Interventions

B. Disruption to a single curriculum area

C. Financial implications £100k to £500k. Significant loss of assets

D. Litigation, claim or fine £50k to £250k

E. Local media coverage / long-term reduction in public confidence Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

72 F. Late delivery of key objective/service due to lack of staff. Unsafe staffing level or competence (>1day). Low staff morale. Poor staff attendance for mandatory/key training

G. Loss / interruption of >1 day. Moderate impact on environment. Critical systems subject to a prolonged series of incidents or unavailable for <1 day

H. Health and safety impact could result in minor injuries or long term illness

Major 4 A. Unable to deliver over 50 % of the College’s agreed strategic targets / SFC and other agency investigation(s)

B. Significant disruption to multiple curriculum areas

C. Financial Implications £500k to £1m. Major loss of assets

D. Litigation, claim or fine £250k to £1m or custodial sentence imposed

E. National media coverage with <3 days service by the College well below reasonable public expectation

F. Uncertain delivery of key objective/service due to lack of staff. Unsafe staffing level or competence (>5 days). Loss of key staff. Very low staff morale. No staff attendance for mandatory/key training

G. Loss/interruption of >1 week. Major impact on environment. Critical systems subject to a prolonged series of incidents or unavailable for > 3 days

H. Health and safety impact could result in extensive injuries or long term illness Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

73 Extreme 5 A. Unable to deliver over 50 % of the college’s agreed strategic targets / SFC and other agency investigation(s). Potential legal action

B. Significant disruption to the whole student body

C. Financial Implications >£1m. Complete loss of assets

D. Multiple civil or criminal actions. Litigation, claim or fine above £1m

E. National media coverage with >3 days service well below reasonable public expectation. Political concerns MSPs / MPs. Total loss of public confidence. Non-delivery of key objective/service due to lack of staff.

F. Ongoing unsafe staffing levels or competence. Loss of several key staff. No staff attending mandatory training/key training on an ongoing basis

G. Permanent loss of service or facility. Catastrophic impact on environment. Critical systems subject to a prolonged series of incidents or unavailable for > 7 days

H. Health and Safety impact could result in multiple loss of life or severe permanent disabilities

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

74 Risk Appetite Methodology

Risk appetite for individual risks requires to be initially assessed by each of the Board of Management’s sub-committees. The Audit Committee provides scrutiny, with the Board of Management ultimately approving the risk appetite within the overall risk register at each of its meetings.

The risk appetite can be classified as Hungry, Open, Cautious, Minimal or Averse.

High level statements for each classification are noted below.

Averse:

Avoidance of risk and uncertainty is a key organisational objective. Willing to accept no risk, or at most, very low risk.

Minimal:

Preference for ultra-safe business delivery options. Willing to accept low risk but recognise that this limits the potential for reward.

Cautious:

Preference for safe delivery options. Willing to accept medium risk but recognise this may limit the potential for reward.

Open:

Willing to consider all options and choose the one that is most likely to result in success. The organisation is willing to accept high risk, as long as this will give an acceptable level of reward.

Hungry:

Eager to be innovative and to choose options that offer potentially higher rewards, despite greater inherent risk. Willing to accept very high risk.

Classification Appetite Score Colour ID Range Averse 1-4 Minimal 5-8 Cautious 9-14 Open 15-19 Hungry 20-25 Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

75 Risk Appetite Grid

5 10 15 20 25

4 8 12 16 20

3 6 9 12 15

2 4 6 8 10

1 2 3 4 5

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

76 Category of Risk Averse Minimalist Cautious Open Hungry

Examples of behaviours demonstrated by risk classification

Reputational Minimal tolerance for Only tolerant of risk taken where Only tolerant of risk taken Appetite to take decisions Appetite to take any decisions that there is no chance of significant where there is limited which may expose the College decisions which are could lead to repercussions for the College. chance of significant to additional scrutiny, but only likely to expose the increased scrutiny or repercussions for the where appropriate steps have College to additional criticism of the College. been taken to minimise scrutiny, if the College. exposure. potential benefits outweigh the risks. Political Minimal tolerance for Only tolerant of making decisions Only tolerant of making Appetite to take decisions Appetite to take taking any decisions that contradict or challenge statements or taking which may expose the College decisions which are or actions that could national or local governments decisions that impact on to additional parliamentary or likely to expose the result in increased where there is no chance of the political arena where political scrutiny, but only College to additional parliamentary scrutiny significant repercussions for the the College has the where appropriate steps have political, media and or criticism of the College. support of key political been taken to minimise any parliamentary scrutiny College. stakeholders. exposure. where the potential benefits outweigh the risks. Financial The key objective is to Only prepared to accept the Prepared to accept the Prepared to take some Prepared to take some operate in line with potential for very limited variance potential for some variance financial risk by investing in financial risk by the agreed budget in budget lines. in budget lines and the new projects or activities investing for the best profile. Minimising cost is the primary potential for some minor (recognising that this could possible reward, Only willing to accept concern. underspend / overspend. result in underspend / accepting that this the low cost option. Value for money is the overspend) as long as brings the possibility of primary concern, with appropriate controls are in underspend / emphasis on quality as well place. overspend. as price. In assessing value for money, quality considerations are weighted more than price Compliance/ Avoid anything which Want to be very sure the College Limited tolerance for Challenge will be problematic Chances of losing are Regulatory could be challenged, would win any challenge. sticking our neck out. but the College is likely to win high and even unsuccessfully. Want to be reasonably it. The gain will outweigh the consequences sure the College would win adverse consequences. serious. But a win Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

77 any challenge. would be seen as a great coup. Learning and Teaching Defensive approach - Innovations are always avoided Tendency to stick to the Innovation supported, as long Innovation pursued - service delivery, standards aim to maintain or unless essential. status quo. Innovations as there is a commensurate desire to ‘break to and protect existing ways Decision making authority held by generally avoided unless improvement in management mould’ and challenge outcomes of working, rather than Board/ EMT. necessary. control. current working to create or innovate. practices. Resources allocated to core Decision making authority Responsibility for non-critical Priority for tight business. generally held by decisions may be devolved. High levels of management controls EMT/SMT. devolved authority – Only essential systems / Resources are allocated to and oversight with management by trust technology developments. Resources are generally capitalise on potential limited devolved allocated to core business. opportunities, not just to rather than tight decision making control. Systems / technology deliver our current practices. authority. developments limited to Systems / technology Resources are Resources withdrawn those which are essential, developments considered allocated to areas of from all non-essential unless low risk. where these will enable work where there are activities. delivery. no firm guarantees of General avoidance of success – ‘investment systems / technology capital’ type approach. developments. New technologies viewed as key enabler of operational delivery. Other College Service Defensive approach - Innovations are always avoided Tendency to stick to the Innovation supported, as long Innovation pursued - delivery, aim to maintain or unless essential. status quo. Innovations as there is a commensurate desire to ‘break to standards and outcomes protect existing ways Decision making authority held by generally avoided unless improvement in management mould’ and challenge of working, rather than Board/ EMT. necessary. control. current working to create or innovate. practices. Resources allocated to core Decision making authority Responsibility for non-critical Priority for tight business. generally held by decisions may be devolved. High levels of management controls EMT/SMT. devolved authority – Only essential systems / Resources are allocated to and oversight with management by trust technology developments. Resources are generally capitalise on potential limited devolved allocated to core business. opportunities, not just to rather than tight decision making control. Systems / technology deliver our current practices. authority. developments limited to Systems / technology Resources are Resources withdrawn those which are essential, developments considered allocated to areas of from all non-essential Ayrshireunless lowCollege risk. # 193132484082where these will enable work where there are activities. 09/12/201810/31/2018 14:26:1914:56:15 delivery. no firm guarantees of General avoidance of success – ‘investment

78 systems / technology capital’ type approach. developments. New technologies viewed as key enabler of operational delivery.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

79 Appendix 1: Key Contacts

Executive Management Team

Name Designation Work Phone Mobile Email (Work)

Heather Dunk Principal and Chief 01563 495023 07595 522750 [email protected] Executive

Michael Breen Vice Principal 01563 495024 07702 955422 [email protected] Finance and Skills

Jane McKie Vice Principal 01563 495040 07900 658637 [email protected] People and Skills

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

80 Senior Management Team – Curriculum and Services

Name Designation Work Phone Mobile Email (Work)

Moira Birtwistle Director - Business, IT, 01292 265184 0785 0313706 [email protected] Sport, Fitness and Social Ext 7647 Science Helen Canning Director - Student 01294 559000 07876 885191 [email protected] Services Ext 2304

David Davidson Director - HR and 01563 495040 07881 510340 [email protected] Organisational Ext 2309 Development Elaine Hutton Director - Creative 01563 523501 07715 209389 [email protected] Ext 7425

Julie Maxwell Director - Care and Early 01292 265184 07715 209392 [email protected] Years Ext 3236

Michael McHugh Director - Quality 01294 559000 07932 723240 [email protected] Enhancement & Ext 2107 Business Improvement Stuart Millar Director - Industry 01292 293454 07909 518692 [email protected] Programmes Ext 7454

Gavin Murray Director - Aerospace, 01292 265184 07715 209390 [email protected] Construction, Ext 4141 Engineering and Science Carol Nisbet Director - Schools, 01294 559000 W: 07850 313713 [email protected] Essential Skills and Ext 2306 P: 07874 280033 Widening Access James Thomson Director - Finance & 01563 495024 07730 761653 [email protected] Student Funding Ext 5371

TBC Director - Infrastructure TBC AyrshireTBC College # 193132484082TBC 09/12/201810/31/2018 14:26:1914:56:15

81 Heads – Curriculum and Services

Name Designation Work Phone Mobile Email (Work)

James Adams Head of Sport and Social 01563 523501 07710 306970 [email protected] Science Ext 8600

Cameron Bell Head of Construction, 01292 293551 07710 306969 [email protected] Technology and Trades Ext 7430

Dorothy Bell Head of Early Years 01563 523501 07710 306961 [email protected] Ext 8603

Greg Cassidy Head of Essential Skills 01292 293577 07928 638799 [email protected] Ext 7442

Ged Freel Head of Business and 01563 523501 07787 481164 [email protected] Computing Ext 8411

John Govan Head of Hospitality & 01292 293433 07710 306975 [email protected] Tourism Ext 7433

Alastair Heron Head of Engineering & 01563 523501 07710 306968 [email protected] Science Ext 7530

Ann Heron Head of Quality 01563 523501 07825 601855 [email protected] Enhancement Ext 3120

Chris Hutchison Head of Care 01294 559000 07929 235756 [email protected] Ext 2066

Brad Johnstone Head of ICT 01563 523501 07889 803823 [email protected] Ext 3171 Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

82 Name Designation Work Phone Mobile Email (Work)

Angela Sheridan Head of Hair, Beauty & 01563 523501 07710 306963 [email protected] Comp Therapies Ext 8660

Richard Simson Head of Business 01292 265184 07876 885192 [email protected] Intelligence & Information Ext 7652 Systems Julie Thorne Head of Arts & Fashion 01292 265184 07837 047698 [email protected] Ext 7538

Doreen Wales Head of Inclusion 01563 523501 07710 306964 [email protected] Ext 5356

Liz Walker Head of Financial 01563 495044 07889 361608 [email protected] Services Ext 8044

Ray Walkinshaw Head of Estates & 01563 523501 07889 537204 [email protected] Sustainability Ext 8592

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

83 Key Staff Contacts – Curriculum Managers

Name Designation Work Phone Mobile Email (Work)

Alistair Aird Engineering & Science 01292 265184 [email protected] Ext 7661 Paul Brodie Sport and Fitness 01294 555304 07867 784539 [email protected] Ext 2409 Allan Carpenter Engineering & Science 01563 523501 [email protected] Ext 8410 Lorna Connelly Comp Therapies, Makeup 01563 523501 [email protected] Artistry Ext 8675 Patrick Devlin Music, Sound & Drama 01292 265184 [email protected] Ext 7491

Graeme Donaldson Construction, 01292 293500 [email protected] Technology & Trades Ext 7500

Tes Eshetu Business & Computing 01292 265184 07931 532919 [email protected] Ext 7568 Lisa Flint Hair & Beauty 01292 293583 [email protected]

Maggie Gerrard Hospitality & Tourism 01563 523501 07825 216166 [email protected] Ext 4119/4120 Graham Gilbert Construction 01292 265184 [email protected] Ext 7485 Angela Gilzean Early Years 01563 523501 [email protected] Ext 8914

Ewan Granger Science & Engineering 01292 265184 [email protected] Ext 7475 Darlene Hogg Health & Social Care 01292 265184 Ayrshire College # [email protected] Ext 7729 09/12/201810/31/2018 14:26:1914:56:15

84 Name Designation Work Phone Mobile Email (Work)

Shona Howat Essential Skills 01563 523501 [email protected] Ext 5364

Loraine Johnstone Business & Computing 01294 559000 [email protected] Ext 3212 Sally Kennedy Hospitality & Tourism 01292 265184 07867 802655 [email protected] Ext 7613 David Lancaster Construction 01563 523501 [email protected] Ext 8412 Margaret MacDonald Care 01292 265184 07817 992192 [email protected] Ext 7630

Julia Mathieson Care 01563 523501 [email protected] Ext 8604

John McTaggart Sport and Fitness 01563 523501 07988 031372 [email protected] Ext 8602 Peggy Morgan Comp Therapies, Makeup 01294 559000 07876 885155 [email protected] Artistry Ext 5175

Kirsten Moore Early Years 01294 559000 [email protected] Ext 3245 Douglas Newell Essential Skills 01294 55900 [email protected] Ext 5175 Johnnie O’Byrne Arts and Fashion 01292 265184 [email protected] Ext 7440 Colin Ross Education 01563 523501 07830 616176 [email protected] Ext. 4039 Morag Soutter Care 01292 559000 [email protected] Ext 5354 Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

85 Name Designation Work Phone Mobile Email (Work)

Arlene Trapp Essential Skills 01292 265184 [email protected] Ext 7704 Elaine Zenati Education 01292 265184 07736 296530 [email protected] Ext 7466

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

86 Key Staff Contacts – Other Key Staff

Name Designation Work Phone Mobile Email (Work)

Peter Bacchetti Catering Services 01563 523501 07710 306984 [email protected] Manager Ext 8400

Mhairi Boyd Organisational 01292 265184 07714 436209 [email protected] Development Ext. 7582

Kimberley Bradford Police Liaison Officer 07551 170055 [email protected]

Gillian Brown Estates 01563 523501 07808 792712 [email protected] Ext 7427

Gillian Brown HR 01292 293523 07710 306986 [email protected] Ext 7523

Charlie Coyle Student Services 01563 523501 07710 306985 [email protected] Ext 7302

Martin Hammond Health, Safety and 01292 265184 07710 306982 [email protected] Wellbeing Ext 7557

Bill Lennox LRC & Technology 01292 265814 [email protected] Ext 7660

Shelagh McLachlan Marketing 01563 523501 07841 868129 [email protected] Ext 8565

Louise Park Student Funding 01563 523501 07513516995 [email protected] Ext 5363

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

87 ICT and FOH Staff

Name Designation Work Phone Mobile Email (Work)

James Barnes ICT Team Leader – Ayr 01292 265184 07710306971 [email protected] Campus Ext 3177

David Keenan ICT Team Leader – 01563 523501 07710306981 [email protected] Kilmarnock Campus Ext 3175

Mark McGregor ICT Officer 01563 523501 07720087368 [email protected] Ext 3178 Jacqui Steele FOH Team Leader 01292 265184 07715 955496 [email protected] Ext 7705

Estates, Cleaning and Catering Staff

Name Designation Work Phone Mobile Email (Work)

Gordon McLaren Estates Team 01563 523501 07956895531 [email protected] Leader, Kilmarnock Ext 8594

Michael Sykes Estates Team 01292 265184 07780386546 [email protected] Leader, Ayr Ext 7571 Linda Graham Catering Team Leader, 01292 265184 [email protected] Ayr Ext 7453 Jane Speirs Catering Team Leader, 01563 523501 07772445609 [email protected] Kilmarnock Ext 4093 Morag Morris Catering Team Leader, 01294 559000 [email protected] Kilwinning Ext 5355

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

88 KE Projects (SPV Company)

Name Designation Work Phone Mobile Email (Work)

Loraine Asquith KE Project Manager 0131 240 5060 07725 102771 [email protected]

Bellrock (PFI Operators)

Name Designation Work Phone Mobile Email (Work)

SPIE (NPD Operators)

Name Designation Work Phone Mobile Email (Work)

Steven McVey Facilities Manager 07734784894 [email protected]

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

89 Appendix 2: Key Contacts – Emergency Services / Emergency Contractors

Name Contact Work Phone

FIRE SERVICE

Fire Station – Ayr 01292 286888 Fire Station – Kilmarnock 01563 522144 Fire Station – Kilwinning 01294 461581 Fire Station - Irvine 01294 211488 Fire Station - Cumnock 01290 427610 POLICE

Police – Ayr 01292 664000 Police – Kilmarnock 01563 505000 Police – Kilwinning 01294 557770 Police - Irvine 01294 404400 Police - Cumnock 01290 306600 HOSPITALS

Crosshouse Hospital (Ayrshire) 01563 521133 Ayr Hospital (Ayr) 01292 610555 EMERGENCY CONTRACTORS

Plumbing & Heating Gibson Wight 01563 523633 Flooding Billy Bowie 01563 549049 Security Fortress 01563 533222 Roofing Andrew Park 01357 521290 Ayrshire College # 193132484082 Pest Control Ecolab 09/12/201810/31/2018 14:26:1914:56:15 01292 852000 Gas and Electricity Total Gas and Power 0800 300 999

90 Name Contact Work Phone

Water Scottish Water 0345 601 8855 Glazing Repairs A1 Glass 01563 531650 Fire & Security ADT 0344 8001999 Drains AJS 0800 6118011 Security Chubb 01413 323230 Security Connelly Security 01413 363336 Fire system Fire Protection Alliance 01224 626232 Passenger Lifts Otis 0141 8146530 External/Internal Doors Record 247 01698 376411 Electrician RSM Electrical 07770 491400

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

91 Appendix 3: Key Contacts - Partners and Stakeholders

Name Stakeholder Role Work Phone E-mail (Work)

Personal Pension Trust 0141 550 5835

Alex Brewster & Sons Townholm Landlord 0131 333 4759

Saltire Property Management Nethermains Landlord 0141 564 1292

KE Projects Kilwinning PFI 0131 240 5050

Zurich Insurance Insurance 0845 600 4231

Anderson Strathern Solicitors Legal Advice 0141 242 6066 [email protected]

Scottish Funding Council Edinburgh 0131 313 6500

Student Awards Agency for Scotland (SAAS) 0845 111 0241 www.saas.gov.uk/contact.htm

Colleges Scotland 01786 892000

West College Scotland (Greenock) 01475 724433

University of the West of Scotland (UWS) Ayr 01292 886000 [email protected]

University of the West of Scotland (UWS) Paisley 0141 848 3000 [email protected]

East Ayrshire Council 01563 576000

North Ayrshire Council 0845 603 0590 Ayrshire College # 193132484082 South Ayrshire Council 09/12/201810/31/20180300 123 0900 14:26:1914:56:15

92 Name Stakeholder Role Work Phone E-mail (Work)

West Sound/West fm 01292 284111

Clyde 1 0141 565 2200

BBC Glasgow 0141 422 6000

STV Glasgow 0141 300 3000

Ayrshire Standard 01563 525115

APUC Edinburgh 0131 442 8968

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

93 Appendix 4 Key Contacts – Key Suppliers

Service Company Contact Name Contact Number Email Address Account Number Telecommunications Exchange 08000277202 [email protected] KILMARNO Communications Firewall / VPN SEC-1 0113 2578955 [email protected]

Backup Software Veeam 08455087005 9748307

Internet Connectivity Janet 0300 300 2212 [email protected]

MFD’s Ricoh Chris McDaid 08457445565 [email protected]

Spares / Components PrimoIT Mick Sloan 01509500553 [email protected] N/A

Spares / Components Misco Sharon Devlin 08081814030 [email protected] N/A

Ayrshire core Maintenance Ping Networks 01414101222 [email protected] PMCN0035

Wan Vodafone 08000270000

HP Computer Warranty HP 08009177241 Pin 80098

IGEL Support IGEL Stefan Lourens 01183403400 [email protected]

Name Provision Contact Contact Number E-mail (Work) Name Capita Business Services Student Records 01285 647500 System Ayrshire College # 193132484082 Business Stream - Anglian 09/12/201810/31/20180131 228 14:26:1914:56:15 3153 [email protected] water 01312251919)

94 Name Provision Contact Contact Number E-mail (Work) Name Frontier Software Emma Feather 01276 451551 [email protected]

Cards Online Screen Check +31 (0) 79 3601160

BT Global Service Solutions 0800 677 983

Citrix/Moon-shot Support Ikonic 0141 810 5849

Finance Support system ABS 08451609999

BACS System Support Mosaic 01355272641

Server/HP Network support DTP Group 01133852696

Security Plus Limited Security 01889568268 [email protected]

WA&E Grant Fruiterers Refectory 10292476117 [email protected]

WW Wales Refectory 10563 535689 [email protected]

Reids Dairy Produce Refectory 01294833001 [email protected]

3663 BFS Group Refectory [email protected]

G Broadfoot and Son Refectory 01294215934 [email protected]

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

95 Ayrshire College (Paper 6)

Audit Committee

18 September 2018

Subject: 2017-18 Internal Audit Rolling Internal Audit Action Plan at 17 August 2018

Purpose: To provide Members with an update on the Rolling Internal Audit Action Plan as at 17 August 2018

Recommendation: The Audit Committee notes the content of this paper.

1. Background

The rolling Internal Audit Action Plan was last presented to the Audit Committee at its meeting on 18 June 2018. The plan has now been updated on an exceptions basis for actions which are now beyond their agreed completion dates.

2. Current Situation

2013-14 to 2017-18

Table 1 below lists all remaining points from the internal audits from 2013-14 to 2017- 18.

Table 1

Ref Audit Audit Area Points Actioned Remaining Year Raised in Period Points 1 2015-16 Key Financial Systems 1 1 0 2 2017-18 Business Continuity Planning 4 4 0 3 2017-18 Student Services 3 2 1 Key Financial Systems 4 2017-18 3 2 1 (Payroll) Total 11 9 2

We have set out below a summary of the two remaining internal audit action points.

1. Student Services (Learning Resource)

The remaining audit recommendation is the formal recording and approval of the eLearning Strategy. The eLearning Strategy is still in draft and therefore cannot yet be signed off at this time. This action will be completed by the end of September 2018.

2. Key Financial Systems (Payroll) The three audit recommendations relate to controls to monitor changes to core HR and payroll data and to introduce exception reporting on changes made by staff using AyrshireAyrshire CollegeCollege ## 193132484082 system administrator access. The College has completed09/12/201810/31/2018 the two 14:26:1914:56:15 audit recommendations relating to monitoring change in core data. The College is reviewing available system generated reports to confirm that these effectively capture all

Audit Committee, 18 September 2018 1 changes made by staff using system administrator access. Therefore this recommendation is only partially complete at this time.

3. Proposals

No further proposals are contained in this report.

4. Consultation

No formal consultation is required to be completed given the subject matter of this report.

5. Resource Implications

There are no resource implications to be noted in this paper.

6. Risks

An effective and challenging Internal Audit service is a key element in the management of risk within the College.

7. Equality Impact Assessment

An impact assessment is not applicable to this paper given the subject matter.

8. Conclusion

The Audit Committee notes the content of this paper.

Michael Breen Vice Principal, Finance and Skills 21 August 2018

(James Thomson, Director of Finance and Student Funding)

Publication

This paper will be published on the College website.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

Audit Committee, 18 September 2018 2 (Paper 8) Scotland’s colleges 2018

Prepared by Audit Scotland June 2018

AyrshireAyrshire CollegeCollege ## 193132484082 09/12/201810/31/2018 14:26:1914:56:15 Auditor General for Scotland The Auditor General’s role is to: • appoint auditors to Scotland’s central government and NHS bodies • examine how public bodies spend public money • help them to manage their finances to the highest standards • check whether they achieve value for money.

The Auditor General is independent and reports to the Scottish Parliament on the performance of: • directorates of the Scottish Government • government agencies, eg the Scottish Prison Service, Historic Environment Scotland • NHS bodies • further education colleges • Scottish Water • NDPBs and others, eg Scottish Police Authority, Scottish Fire and Rescue Service.

You can find out more about the work of the Auditor General on our website: www.audit-scotland.gov.uk/about-us/auditor-general

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

Audit Scotland is a statutory body set up in April 2000 under the Public Finance and Accountability (Scotland) Act 2000. We help the Auditor General for Scotland and the Accounts Commission check that organisations spending public money use it properly, efficiently and effectively. Scotland's colleges 2018  | 3

Contents

Key facts 4

Summary 5

Part 1. How Scotland's colleges are managing their finances 9

Part 2. How Scotland's colleges are performing 20

Part 3. Progress in the multi-college regions 30

Endnotes 36

Appendix 1. Audit methodology 37

Appendix 2. Scotland's college landscape 2018 38

Audit team The core audit team consisted of: Mark MacPherson, Mark McCabe, Ayrshire CollegeLinks # 193132484082 Fiona Diggle, Angus Brown, 09/12/201810/31/2018PDF 14:26:1914:56:15download Gemma McNally and Sanya Ahmed, with support from other colleagues and Web link under the direction of Angela Canning. 4 |

Key facts

Colleges in Scotland

26

Estimated total Students cost of backlog studying at of repairs and £360 235,737 college in maintenance in the million 2016-17 college sector

Estimated additional Overall annual cost £50 90.2 student of national million per cent satisfaction bargaining in 2016-17 from 2019-20

Real-terms increase in Amount spent by the Scottish Government 10.4 £728 20 incorporated colleges funding between per cent million in 2016-17 2016/17 and 2018/19

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 Summary | 5

Summary

Key messages 1 The college sector’s underlying financial position improved in 2016-17, but several colleges face significant financial challenges. Scotland’s 20 incorporated colleges reported an overall underlying financial surplus for 2016-17 of £0.3 million. This compares to an underlying deficit of £8 million in 2015-16. Across the sector, the cash held by colleges increased by 13 per cent in 2016-17 and the net value of their assets – such as land and property, compared against financial liabilities such as pension costs – grew by ten per cent. However, these sector-wide increases mask significant variations between colleges. 2 Staff costs remain the highest area of spending and are forecast to increase, mainly as a result of the costs associated with harmonising staff pay and other conditions. Colleges’ representative body, Colleges Scotland, has estimated the total cost of harmonisation as the sector's £50 million a year from 2019-20. This would absorb all of the Scottish Government’s projected savings from college reform. The Scottish underlying Government is providing funding to cover the additional costs up to the financial end of academic year 2018-19. But it has not yet specified funding for academic year 2019-20, when the costs will increase most significantly. position improved 3 The Scottish Funding Council’s (SFC’s) 2017 estates condition survey indicates that college buildings require urgent and significant and learning investment. The survey estimates a backlog of repairs and targets were maintenance over the next five years of up to £360 million. The SFC is providing £27 million of capital funding to colleges in 2018-19 to cover exceeded the very high priority needs identified in the condition survey. 4 Several factors pose a risk to colleges’ financial sustainability, including: the future impact of national bargaining for support staff; uncertainties around long-term funding of improved employment terms; the cost of maintaining buildings and land; and the potential impact of leaving the European Union. Differences in the assumptions colleges use for their forecasts mean they do not provide a reliable picture of future financial sustainability for the sector. The SFC and colleges are working to address this from 2018. Ayrshire College # 193132484082 5 The college sector exceeded its targets for learning activity and full- 09/12/201810/31/2018 14:26:1914:56:15 time equivalent student places in 2016-17. Student numbers increased by around four per cent, with most of the increase being students in part-time learning, particularly those under 16 years of age. At least 82.7 p er cent of all successful full-time college leavers entered positive 6 |

destinations, such as training, employment and higher education. This is largely unchanged from last year. Student satisfaction remains high at over 90 per cent and improved slightly compared to last year. 6 The proportion of credits (units of learning) delivered to students from deprived areas, from ethnic minorities, with care backgrounds or with disabilities all continue to increase. Despite this, the gap in attainment between students from the least and most deprived areas is growing. 7 Colleges have made notable progress in addressing the large gender imbalance on engineering courses but have had less success in other courses. The SFC shares good practice as part of its gender action plan and expects to see more progress from 2017-18 onwards. Some college boards also continue to have significant gender imbalances in their membership that would fall short of the new statutory gender representation objective. 8 The regional strategic bodies (RSBs) in the three multi-college regions are fulfilling their core statutory duties, but their progress in meeting the wider aims of regionalisation varies. The University of Highland and Islands (UHI) Court has made good progress and is now working with four of its incorporated colleges to explore opportunities for greater integration. The Glasgow Colleges' Regional Board (GCRB) is making progress in coordinating collaborative regional activity, but needs to do more work with its assigned colleges, to deliver all of the intended benefits of regionalisation. The current regional arrangements in Lanarkshire add little to the aims of regionalisation.

Key recommendations

The Scottish Government and the SFC should:

• publish the criteria within the Infrastructure Strategy for prioritising capital investment in the college sector (paragraph 27)

• work with colleges to examine why the attainment gap between students from deprived areas and the wider student population is growing and identify actions to reduce the gap (paragraph 53)

• assess and report publicly on the extent to which the regional strategic bodies are meeting the aims of regionalisation in multi- college regions (paragraphs 69–83).

The SFC should:

• revise its accounts direction to ensure colleges calculate their underlying financial position consistently (paragraph 9) Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 • progress its work with colleges to improve common assumptions for future financial forecasting returns, including clarifying when departing from the assumptions would be justified (paragraph 31) Summary | 7

• determine what other actions are required to tackle the greatest gender imbalances in subjects to deliver its gender action plan (paragraph 60)

• agree with regional strategic bodies in multi-college regions the most appropriate way of collecting information on college activities and clarify both why and when it needs to engage with, or collect information from, assigned colleges (paragraph 84).

Colleges should:

• work with the SFC to further develop their approach to long-term financial forecasting (paragraph 31)

• focus on reducing the attainment gap and improving student performance (paragraph 53)

• where appropriate, examine opportunities for getting a better gender balance on their boards to meet new statutory targets (paragraph 61).

GCRB and its assigned colleges should:

• address concerns among senior staff and college board members about its role to further improve collaborative working across the region (paragraph 78).

The Lanarkshire Board should:

• develop a clear plan for improving collaborative working across the region (paragraph 83).

Background

1. This report provides an overview of the college sector in Scotland. It gives an update on college finances and analyses learning activity. We have set out our methodology in Appendix 1. Our previous reports have commented on:1

• the sector's ability to meet the national target for learning

• the changes that have taken place in the sector in recent years including regionalisation, college mergers and reclassifying colleges as public bodies.

2. Scotland’s colleges play an important role in helping to achieve sustainable economic growth by developing a highly educated and skilled workforce. In 2016-17, there were 235,737 students. Colleges are the main providers of further education (FE) in Scotland. They also provide a significant amount of higher education (HE), with around 47,937 students (around 20 per cent) studying atAyrshire HE College # 193132484082 level at college in 2016-17. 09/12/201810/31/2018 14:26:1914:56:15

3. The college sector in Scotland comprises 20 incorporated colleges and six non-incorporated colleges, organised into 13 college regions (Appendix 2).2 Ten of these regions consist of one college. The three remaining regions (Glasgow, 8 |

Highlands and Islands, and Lanarkshire) have more than one college. The individual colleges in Glasgow and in Highlands and Islands are assigned to the relevant regional strategic body, ie Glasgow Colleges' Regional Board (GCRB) or University of Highlands and Islands (UHI). In Lanarkshire, New College Lanarkshire is the regional body and South Lanarkshire College is assigned to the Lanarkshire Board.

4. In this report we look at all colleges in the sector and Scotland's Rural College (SRUC), to present a comprehensive picture of the sector and its performance. In Part 1 of this report, How Scotland's colleges are managing their finances, we focus on incorporated colleges, as non-incorporated colleges are not subject to the same requirements as incorporated colleges (as public bodies). In Part 2, How Scotland's colleges are performing, the participation data used excludes information about students studying higher education through UHI or SRUC.

5. Colleges prepare their accounts based on the academic year (1 August to 31 July).3 This differs from the Scottish Government’s financial year, which runs from 1 April to 31 March. We use the following conventions in this report:

• 2016-17 when referring to figures from colleges’ accounts, or figures relating to the academic year

• 2016/17 when referring to funding allocations made in the Scottish Government’s financial year.

6. Financial figures in real terms are adjusted for inflation. The base year for this report is 2016-17. The GDP deflator provides a measure of general inflation in the domestic economy. We have used the GDP deflator from December 2017 to calculate the real-terms figures for other years.4

7. Where appropriate, our report draws on separate reports by the Auditor General for Scotland (section 22 reports) on Edinburgh College and New College Lanarkshire that were published in April 2018.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 Part 1. How Scotland's colleges are managing their finances | 9

Part 1 How Scotland's colleges are managing their finances

Key messages 1 The overall financial position of the college sector has improved since last year. The 20 incorporated colleges reported an overall underlying financial surplus of £0.3 million for 2016-17. This compares to an underlying deficit of £8 million in 2015-16. Individual college financial positions varied. Five incorporated colleges had an underlying deficit in 2016-17, compared with 11 in 2015-16. Scotland's six non-incorporated colleges reported an overall underlying surplus of £249,000 in 2016-17, with no college having an underlying deficit. 2 The Scottish Funding Council (SFC) first required colleges to include the estimated their underlying financial position in their accounts in 2016-17. Individual colleges have interpreted the SFC’s accounts direction additional differently, making it difficult to compare the financial positions of annual cost of different colleges. harmonising 3 Net assets increased by ten per cent (to £230 million). The level of cash pay and other held across the sector increased by 13 per cent (to £49 million). Despite the overall increase in cash held, nine colleges held less cash than conditions last year. This means they have less flexibility to meet unanticipated would absorb changes in income or expenditure. Some colleges face particular financial challenges. the projected savings from 4 The Scottish Government has provided revenue funding to the college sector of £570.7 million in 2018/19, a real-terms increase of five per cent college on 2016/17. Most of this is to meet increased costs associated with reform national bargaining. Colleges Scotland has estimated the total cost of harmonisation as £50 million a year from 2019/20. This would absorb all the Scottish Government's projected savings from college reform. 5 Colleges now prepare six-year financial forecasts. Differences in the assumptions colleges use for their forecasts mean they do not provide a reliable picture of future financial sustainability for the sector. The SFC and colleges are working to address this from 2018. 6 The SFC's 2017 estates condition survey indicates that college buildings require urgent and significant investment. The survey estimates a Ayrshire College # 193132484082 backlog of repairs and maintenance over the next five years of up to 09/12/201810/31/2018 14:26:1914:56:15 £360 million. The SFC is providing £27 million of capital funding in 2018-19 to address very high priority repairs and maintenance. 10 |

Colleges' underlying financial position improved in 2016-17

8. Incorporated colleges had income of £711 million, and expenditure of £728 million, in 2016-17. The main areas of income and expenditure (and changes from 2015-16) are presented in Exhibit 1.

Exhibit 1 Income and expenditure for incorporated colleges 2016-17 Colleges had income of £711 million and expenditure of £728 million.

£75m £84m £3m

£116m

£178m Income £520m Expenditure £463m £711m £728m

SFC income (up 6% from 2015-16) Staff costs including exceptional staff costs1 Tuition fees/contracts (down 3% from 2015-16) (up 1% from 2015-16) Other income, including research grants and Other operating expenses including investment income (up 10% from 2015-16) and exceptional costs (down 3% from 2015-16) donations and endowments, inc funding from Depreciation/interest/other finance arm's length foundations (ALFs) (up 26% from 2015-16, mainly due to (down 71% from 2015-16, due to large changes depreciation on new assets) at individual colleges) Donations to ALFs (no donations made to ALFs in 2015-16)

Note: 1. Exceptional staff costs include severance payments. Source: College accounts

9. For 2016-17, the SFC required incorporated colleges to include a calculation of their underlying financial position in their accounts. Colleges did not all interpret the SFC's guidance consistently. This required further work by the SFC to calculate an underlying financial position. The SFC is working to improve the direction for 2017-18.

10. Incorporated colleges had an underlying surplus of £0.3 million in 2016-17. This is an improvement on the £8 million underlying deficit we reported for 2015-16 (Exhibit 2, page 11).

11. The six non-incorporated colleges recorded an underlying surplus of £249,000Ayrshire College # 193132484082 in 2016-17, compared to £69,000 in 2015-16. Information for incorporated and 09/12/201810/31/2018 14:26:1914:56:15 non-incorporated colleges is not directly comparable. Part 1. How Scotland's colleges are managing their finances | 11

Exhibit 2 College sector financial performance 2014-15 to 2016-17 Incorporated colleges reported an underlying financial surplus in 2016-17.

2014-15 2015-16 2016-17 (£m) (£m) (£m)

Sector underlying surplus 1 (8) 0.3 or (deficit) Number of colleges with an 7 11 5 underlying deficit

Note: Analysis does not include Scotland's six non-incorporated colleges. Source: College accounts

12. Five incorporated colleges had an underlying deficit in 2016-17, compared with 11 in 2015-16. Financial positions varied from a surplus of £0.9 million at North East Scotland College to a deficit of £2.5 million at Edinburgh College. Exhibit 3 shows individual college underlying deficits and surpluses as a percentage of their annual expenditure.

Exhibit 3 Underlying deficits and surpluses as a percentage of expenditure, 2016-17 The underlying financial position of incorporated colleges varies.

2

1

0

-1

Percentage -2

-3

-4

Fife College Perth College Moray College Ayrshire College Borders College Inverness College Edinburgh College Lews Castle College Forth Valley College West Lothian College West College Scotland Glasgow Clyde College North Highland College City of Glasgow College Glasgow Kelvin College New College Lanarkshire South Lanarkshire College Dundee and Angus College Ayrshire College # 193132484082 North East Scotland09/12/201810/31/2018 College 14:26:1914:56:15 Dumfries and Galloway College

Source: College accounts and SFC 12 |

Total cash held in the sector increased in 2016-17 but almost half of all colleges held less cash

13. Incorporated colleges held £49.2 million in cash in 2016-17, an increase of £5.5 million (13 per cent) from 2015-16 (Exhibit 4). While the overall cash held by the sector increased, the amounts each college held vary significantly:

• Eleven colleges increased their cash balances by a total of £11.2 million in 2016- 17. Four colleges accounted for £8.5 million (76 per cent) of this increase: City of Glasgow, Edinburgh, Forth Valley and North East Scotland colleges. The SFC has indicated that some colleges are holding cash to repay loans in future.

• Cash balances decreased in nine colleges, by a total of £5.7 million. This means these colleges have less flexibility to meet unanticipated future expenditure or reductions in income.

Exhibit 4 College sector financial performance 2014-15 to 2016-17 Cash balances and net assets across the sector both increased in 2016-17.

2014-15 2015-16 2016-17 (£m) (£m) (£m)

Cash balances 55 43.7 49.2 Net assets 255 209 230 Number of colleges in a net 3 5 5 liabilities position

Source: College accounts

Net assets increased by around ten per cent in 2016-17

14. Comparing the value of the assets an organisation holds against its financial liabilities – its net asset or liabilities position – provides an indicator of financial health. The sector’s net asset position has improved by around ten per cent compared to 2015-16 (Exhibit 4). However, this does not reflect the significant variation across colleges:

• Glasgow Clyde College accounts for the vast majority of the sector-wide increase in the net value of assets. Its net asset position increased by around £20 million to £58 million. This was the result of the value of its land and buildings significantly increasing.

• Five colleges reported a net liability position in 2016-17: Borders, ForthAyrshire College # 193132484082 Valley, Inverness, North Highland and West Lothian. These colleges also 09/12/201810/31/2018 14:26:1914:56:15 reported a net liability position in 2015-16. In 2016-17, the level of liability remained relatively unchanged in three of these colleges. North Highland College's liability more than halved, from £5.5 million to £2.4 million as a result of asset revaluations. Forth Valley College's liability increased Part 1. How Scotland's colleges are managing their finances | 13

significantly to £17 million due to significant devaluations of its existing assets. This will change as the college builds its new Falkirk campus.

The funds held by arm's-length foundations (ALFs) fell again in 2016-17

15. Colleges can apply for funds from arm’s-length foundations (ALFs). These are independent, charitable bodies that were set up when colleges were reclassified as public bodies and could no longer retain significant cash reserves. Colleges donate money into ALFs and can also apply to ALFs for funding. Other organisations can also donate to, and apply for funding from, ALFs. ALFs held £57 million in 2016 and £50 million in 2017.

16. Two colleges transferred a total of £3.4 million into ALFs in 2016-17. Eight colleges received grants totalling £15.1 million from ALFs in 2016-17, mainly to improve their buildings and other parts of their estate. Nine colleges propose to apply for around £8 million of ALF funding in 2017-18. The biggest planned use of ALF funding is at Glasgow Clyde College. The college plans to use over £10 million over the next five years, mainly for estate improvements. The other two Glasgow colleges plan to use ALF funding for estates projects in 2017-18. Glasgow Kelvin College plans to spend £2 million and City of Glasgow College £1.1 million. Some ALFs have very little funds left and others have never had significant funds donated to them.

17. The Scottish Government is considering how the sector might best continue to use ALFs to help with long-term financial planning and future investment decisions.

There was little change in staff costs and numbers in 2016-17

18. Colleges continue to spend most of their money on staff. Staff costs and numbers remained relatively unchanged in 2016-17. Staff costs rose by £14 million to £457 million (Exhibit 5, page 14).5 Total full-time equivalent (FTE) staff numbers decreased by 75 (0.7 per cent) to 10,850:

• Teaching staff decreased by 56 (0.8 per cent)

• Non-teaching staff decreased by 19 (0.5 per cent).

19. In 2016-17, 162 staff left incorporated colleges through voluntary severance at a total cost of £3.6 million. Of these, 81 were from Edinburgh College. Auditors reported that severances were subject to appropriate approval and in line with the existing severance schemes approved by the SFC.

The Scottish Government has announced further real-terms increases in revenue funding in 2018/19

20. The Scottish Government’s revenue funding for the college sector for 2018/19 is £570.7 million. This represents a real-terms increase of £28 million (five per cent) in the revenue budget from 2016/17 (Exhibit 6, page 14). This is the Ayrshire College # 193132484082 highest real-terms settlement in the last five years. 09/12/201810/31/2018 14:26:1914:56:15 14 |

Exhibit 5 Staff costs and numbers 2015-16 to 2016-17 Staff numbers fell slightly and staff costs increased slightly in 2016-17.

2015-16 2016-17

Staff numbers (FTE) 10,925 10,850 Staff costs (£m) 442 457 Total expenditure (£m) 692 728 Staff costs as percentage of total spend 64 63 Exceptional staff costs (£m)1 7 6 Exceptional staff costs as percentage of 2 1 staff costs

Note: 1. Exceptional staff costs include severance costs. Source: College accounts

Exhibit 6 Scottish Government revenue funding to the college sector 2014/15 to 2018/19 The Scottish Government has increased funding for colleges in real terms each year. 700

600

500

400

300 (£ millions) 200 Funding settlement

100

0 2014/15 2015/16 2016/17 2017/18 2018/19 Draft Scottish Government financial years

Cash figures Real terms trend

Notes: 1. The above allocations do not include additional amounts provided to the college sector to support NPD unitary charges (£6 million in 2015/16; £24 million in 2016/17; £29 million in 2017/18; and £28 million in 2018/19, all in real terms). 2. Between 2014/15 and 2016/17, the Scottish Government has made in-year adjustments to transfer an element of the capital allocation to revenue (£12 million in 2014/15; £10 million in 2015/16; £17 million in 2016/17, all in real terms). We have not incorporated these changes in the exhibit. Source: Scottish Government

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 Part 1. How Scotland's colleges are managing their finances | 15

21. The Scottish Government has agreed to pay for the additional costs of the national bargaining agreement up to the end of 2018-19. This excludes cost-of- living increases. This accounts for most of the increased funding for 2018-19. The Scottish Government has yet to indicate how costs associated with national bargaining will be funded beyond 2018-19. Colleges Scotland estimates that changes to pay and terms and conditions from national bargaining will cost about £50 million each year from 2019-20. This would absorb all the £50 million of annual financial savings that the Scottish Government and SFC expected the reform programme to deliver from 2015-16.

22. The SFC allocated £409 million to colleges for teaching in 2017-18. It is also allocating £455 million in 2018-19, an increase of £46 million (ten per cent). This increase reflects additional teaching costs and associated funding as a result of national bargaining.

Despite the improved financial position in 2016-17, colleges continue to face significant financial challenges

23. Several colleges currently face significant financial challenges:

New College Lanarkshire • Last year, we reported that New College Lanarkshire (NCL) had experienced cash flow difficulties during 2015-16. Those difficulties continued into 2016-17 and the Auditor General published a separate report, under section 22 of the Public Finance and Accountability (Scotland) Act 2000, in April 2018. The report noted that the college received an advance of £1.9 million from the SFC in July 2017 (subsequently deducted from its 2017-18 funding allocation), as well as specific, one-off funding of £1.1 million between November 2017 and February 2018 to run a voluntary severance scheme (not repayable). The college made savings of £2 million during 2016-17 and reported an underlying deficit of £560,000 (equivalent to one per cent of income). It is working with the SFC to deliver a plan intended to return it to financial sustainability. The latest draft of the plan indicates the college will report an underlying operating surplus in 2019-20.

Edinburgh College • Edinburgh College received £2.9 million of financial support from the SFC in 2016-17 that it will have to repay. It had an underlying deficit of £2.5 million in 2016-17 (equivalent to around four per cent of income). While the college still needs to deliver some aspects of its plan to return to financial stability, it has made good progress and its deficit for 2016-17 was below its original estimate of £3.8 million. The Auditor General published a separate statutory report on progress at Edinburgh College in April 2018.

Ayrshire College • The college had forecast a net surplus each year between 2013-14 and 2017- 18. However, increased staff costs have resulted in the college experiencing financial deficits, which it has covered to date by using cash reserves. Ayrshire College # 193132484082 • The college has indicated that ongoing PFI costs are contributing to its 09/12/201810/31/2018 14:26:1914:56:15 financial challenges. As part of the merger that created Ayrshire College, the college inherited a Private Finance Initiative (PFI) scheme from the former James Watt College for its Kilwinning campus. The 25-year PFI scheme started in 1999-2000, with annual payments of £2.1 million until 2024-25. The PFI costs equate to around four per cent of the college's annual expenditure. 16 |

• Ayrshire College identified that making the annual payments was a financial risk at the point of merger. The college has indicated that it will find it difficult to meet the ongoing PFI costs. While the Scottish Government agreed that the college could use money raised from selling land towards the PFI costs in 2018-19, there is currently no further funding commitment from the Scottish Government or the SFC.

• The college is considering other options for meeting the PFI costs as part of its overall expenditure.

UHI incorporated colleges • Last year, we reported that Lews Castle College had not met its learning activity targets over an extended period. This could have resulted in both a reduced level of funding and the SFC recovering funding for activity the college did not deliver. UHI, as the regional strategic body, has since agreed a reduced target and funding with the college. Despite this change, at June 2017, the college was still forecasting deficits for the next five years. As explained in paragraph 30, colleges' most recent forecasts in July 2017 do not reliably reflect current financial positions or the challenges now facing the sector.

• Last year, Moray College had to urgently draw down an advance on its funding allocation from UHI as it did not have enough money to meet its operational costs in 2015-16. The auditor concluded that the current financial position was not sustainable and that the college needed to take action to achieve financial balance. The college implemented an improvement plan and reported an improving financial position in 2016-17 with:

–– a lower operating deficit –– an underlying surplus –– increased cash –– lower net current liabilities. • The appointed auditor concluded that achieving financial sustainability represents a significant challenge for North Highland College. It reported a £523,000 deficit in 2016-17 and is forecasting a deficit of £857,000 for 2017-18. College management is of the view that the current arrangements will become unsustainable without significant changes, and has recommended that the college board considers steps to ensure it remains financially sustainable. The college will continue to require financial support from UHI to manage its ongoing financial pressures.

• UHI has started to look at the potential for greater integration between four of its five incorporated colleges during 2018 (not currently including Perth College). The aim is to improve joint working, education and the sustainability of their financial positions in the medium to longer term.

College estates require urgent and significant investment Ayrshire College # 193132484082 24. In 2018/19, the Scottish Government has allocated colleges £74.4 million of 09/12/201810/31/2018 14:26:1914:56:15 capital funding to spend on things such as improving buildings and buying new equipment (Exhibit 7, page 17). This represents a real-terms increase of £32 million (77 per cent) on 2016/17. Of the 2018/19 capital allocation, almost £42 million is funding for Forth Valley College's new campus at Falkirk. The remainder has been allocated to meet lifecycle maintenance costs and high-priority backlog repairs. Part 1. How Scotland's colleges are managing their finances | 17

Exhibit 7 Scottish Government capital funding to the college sector 2014/15 to 2018/19 The Scottish Government has increased capital funding for colleges in real terms.

100 90 80 70 60 50

(£ million) 40 30 20 Capital funding settlement 10 0 2014/15 2015/16 2016/17 2017/18 2018/19 Draft

Scottish Government financial years

Cash figures Real terms trend

Source: Scottish Government

25. In December 2017, the SFC published its college sector estates condition survey. This identified a backlog of repairs and maintenance of £163 million over the next five years across the sector. Once fees, inflation and other costs associated with these works are included, the repairs and maintenance could cost up to £360 million. These figures exclude the six campuses that have been financed in recent years through public-private partnerships: Ayrshire College's Kilmarnock and Kilwinning campuses; City of Glasgow College's Riverside and Cathedral Street campuses; and Inverness College's main campus and the School of Forestry. West College Scotland has the biggest repairs and maintenance backlog of £49 million over the next five years. This is equivalent to almost a fifth of the value of all its assets in 2016-17. A further five colleges have backlogs of over £20 million: North East Scotland, Dundee and Angus, Edinburgh, Fife and Scotland's Rural College (SRUC).

26. Of the £360 million total backlog, £31 million was identified as very high priority work needing to be addressed within one year, and a further £77 million as high priority within two years. The SFC identified two colleges where the very high backlog had been overstated, which reduced the ‘very high’ need to £27 million. The SFC is allocating £27 million to the sector in 2018-19 to allow it to address those very high needs.

27. In our report Scotland's colleges 2017 , we recommended that the Scottish Government and the SFC complete the national estate condition survey and use the results to prioritise future capital investment. Based on the estate condition survey, the SFC produced criteria for managing the competing demandsAyrshire College # 193132484082 for major capital investment as part of its Infrastructure Strategy in December 09/12/201810/31/2018 14:26:1914:56:15 2017. It has yet to publish these criteria. 18 |

The SFC is working with colleges to improve financial forecasting across the sector

28. Having longer-term financial plans in place will allow colleges to better prepare for future challenges. In response to recommendations we made in our report Scotland's colleges 2016 , the SFC now requires colleges to prepare six-year financial forecasts. The current forecasts run from 2016-17 to 2021-22. Colleges are forecasting that their annual expenditure will increase faster than their annual income and that the financial deficit across the sector will grow to £21 million by 2021-22. Only South Lanarkshire College is not forecasting to be in deficit at any point over this six-year period.

29. In line with our recommendations last year, the SFC worked with sector representatives to develop a set of common assumptions that colleges should use for longer-term financial forecasting. For example:

• Colleges should plan that their teaching grant will stay the same in 2018-19 and 2019-20, then increase by two per cent for 2020-21 and 2021-22.

• Colleges should assume that capital maintenance funding will be held at 2017-18 levels over the forecast period.

• Colleges should assume the costs of national bargaining will be supported by specific grants in 2018-19 and 2019-20 that will reflect the costs in particular colleges. They should also assume that the 2019-20 specific grant reduces to 67 per cent in 2020-21, 33 per cent in 2021-22 and then to nil in 2022-23.

• Colleges should factor in a one per cent increase for pay awards for support staff for all years and for lecturing staff from 2020-21 onwards, based on public sector pay policy. In September 2017, the Scottish Government announced its intention to remove the public sector pay cap from 2018, so this assumption is no longer realistic.

30. Despite the SFC providing these assumptions, some colleges used different assumptions, for example, for funding levels and pay awards, believing them to be more realistic. The differences in the assumptions used by colleges mean that their financial forecasts, submitted to the SFC in June 2017, are not fully comparable and do not provide a reliable picture of the sector's future financial sustainability.

31. It is important that colleges are basing their financial forecasts on realistic and consistent assumptions to help them make informed decisions about their operations. Reliable forecasts will also support effective SFC funding decisions. At the time of this audit, the SFC was working with colleges to significantly strengthen financial forecasts from 2018 onwards.

Withdrawing from the European Union will have implications for colleges Ayrshire College # 193132484082 32. The SFC administers and part funds the Developing Scotland's Workforce 09/12/201810/31/2018 14:26:1914:56:15 (DSW) Programme funded by the European Social Fund. Funding for this totalled £4.8 million in both 2016-17 and in 2017-18. This programme is scheduled to run until 2022-23. The decision to leave the EU should not affect this programme, and colleges should work with the SFC to plan for when it comes to an end. Part 1. How Scotland's colleges are managing their finances | 19

33. The sector has also been able to draw on money from the European Regional Development Fund (ERDF) to support capital programmes. The European Investment Bank (EIB) has also been a major funder of the Scottish Government’s Non-Profit Distributing (NPD) programme, including college campuses in Glasgow, Ayrshire and Inverness. It is not clear to what extent EIB funds will be available post Brexit.

34. Colleges Scotland research suggests around three per cent of teaching staff are from the EU, and it expects that figure to be higher for support staff.6 Colleges Scotland and the SFC are working to analyse and model the impact of Brexit on the college sector.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 20 |

Part 2 How Scotland's colleges are performing

Key messages 1 Student numbers increased by around four per cent in 2016-17. This is mainly due to an increase in part-time learners, particularly those under 16 years of age. Colleges exceeded the Scottish Government's learning target in 2016-17. They delivered 117,502 full-time equivalent (FTE) places against the Scottish Government’s target of 116,269. Colleges overall also exceeded the SFC's activity target and delivered more credits than in 2015-16. in October 2017, the 2 In 2016-17, attainment rates dipped slightly for higher education courses and full-time further education (FE) courses but increased for minister part-time FE courses. The percentage of students who complete their confirmed course was broadly static across all categories. Latest data covering 2015-16 shows that at least 82.7 per cent of successful full-time leavers that colleges entered a positive destination such as training or employment. Student no longer satisfaction across the sector remains high and increased slightly in 2016-17. Attainment, retention, positive destinations and student need to satisfaction all vary widely by college. prioritise 3 There is evidence that colleges are widening access to learning. Across full-time the sector, the proportion of credits delivered to students from deprived education areas, from ethnic minorities, who have been in care or who have disabilities all continue to increase. Despite this, the gap in attainment for 16-24 between students from the least and most deprived areas is growing. year olds 4 The gender balance across students in the sector has remained broadly even. However, more work is required to tackle the most significant gender imbalances on some courses and on some college boards.

Colleges exceeded the Scottish Government's learning target in 2016-17

35. The volume of learning that colleges deliver is measured in full-time equivalent (FTE) student places, or in units of learning known as credits. Each credit broadly equates to 40 hours of learning. Since 2012-13, the Scottish Government has set a national target for the college sector to deliver 116,269 FTE student places. Ayrshire College # 193132484082 Colleges delivered 117,502 FTE places against this target in 2016-17. The SFC set09/12/201810/31/2018 14:26:1914:56:15 colleges a core activity target of 1,690,618 credits in 2016-17. Colleges delivered 1,699,760 credits against this target. They also delivered additional European Structural Fund (ESF) credits, giving a total of 1,762,032. This represents an increase in credits delivered of 0.5 per cent compared to 2015-16. This means that 2016-17 was the first year that activity has increased since 2013-14. Part 2. How Scotland's colleges are performing | 21

36. To meet the national target, the SFC agrees targets with the college regions, Newbattle Abbey College, Sabhal Mòr Ostaig and SRUC.7 In 2016-17, all the colleges met their credit target except Newbattle Abbey College, which delivered 833 credits compared with its target of 926 credits. Newbattle Abbey College accounts for 0.05 per cent of Scotland's college activity.

Student numbers increased by around four per cent in 2016-17

37. The number of college students increased by four per cent (8,483) in 2016- 17, to 235,737 (by headcount). This is the largest number of students to attend Scotland's colleges since 2013-14 (Exhibit 8). For more information on how we present student numbers in this report, please see Appendix 1.

Exhibit 8 Student population analysed by headcount 2011-12 to 2016-17 The college student population in 2016-17 was the highest since 2013-14.

300,000 257,920 238,830 238,398 226,910 227,254 235,737 250,000

200,000

150,000

100,000 Number of students 50,000

0 2011-12 2012-13 2013-14 2014-15 2015-16 2016-17

Academic year

Source: SFC's Infact database

The largest increases in student numbers were in those taking part-time courses, particularly those aged under 16

38. In our report Scotland's colleges 2017 , we reported that decreasing numbers of young people and more school leavers going on to work and university would make it harder for colleges to continue to achieve the national target. At that time, the Scottish Government's focus was on full-time courses and students aged 16-24. This had led to significant decreases in part-time and older students.

39. It is clear that colleges have now changed their focus and in October 2017, the Minister for Further Education, High Education and Science confirmed thatAyrshire College # 193132484082 colleges no longer need to prioritise full-time education for 16-24 year olds. 09/12/201810/31/2018 14:26:1914:56:15 Full-time student numbers remained almost unchanged in 2016-17 at 78,311. Enrolments to part-time courses increased for the first-time since 2013-14:

• Part-time student numbers increased in 13 colleges, by a total of 13,464 students. Fife College accounts for more than half of this increase (7,066). 22 |

• Part-time student numbers decreased in 12 colleges, by a total of 5,536. The most significant decreases were in Ayrshire College (part-time students fell by 1,390) and North East Scotland College (part-time students fell by 1,433).

• Overall the number of part-time students increased by 7,452 (five per cent) to 166,520.

40. More school-age students are attending college (Exhibit 9). The Developing the Young Workforce (DYW) programme means colleges are now offering more vocational courses to school pupils from S4-S6. The number of students aged under 16 attending college increased by 6,495, making up over 70 per cent of the total increase. Over two-thirds of students aged under 16 were taking courses not leading to a recognised qualification. This was the second year that the number of students under 16 increased, following a trend of decreases since 2011-12. Of students aged under 16:

• more now study at college than in 2011-12 (28,334 in 2016-17 compared to 24,976 in 2011-12)

• most attend college part time, with only 391 under-16 students studying full time in 2016-17.

Exhibit 9 Change in number of students from the previous year, by age The number of students aged under 16 has increased for the second year in a row.

12,000 8,000 4,000 0 -4,000 -8,000

from previous year -12,000 -16,000

Change in number of students -20,000 2012-13 2013-14 2014-15 2015-16 2016-17

Academic year

Under 16 16-24 25 and over

Source: SFC Infact database

Attainment and retention, positive destinations, and student satisfaction rates were similar to the previous year

41. Attainment rates measure how many students successfully completed theirAyrshire College # 193132484082 course and gained the appropriate qualification. In 2016-17, attainment rates 09/12/201810/31/2018 14:26:1914:56:15 dipped slightly, that is, by less than one per cent, for HE courses and full-time FE courses. But they increased for part-time FE courses, from 74 per cent in 2015-16 to 77 per cent in 2016-17.8 Part 2. How Scotland's colleges are performing | 23

42. Retention measures the percentage of students who complete their course. In 2016-17, retention remained relatively static, changing by less than one per cent across all courses.

43. The SFC tracks successful full-time college leavers after they qualify, and publishes this information in its College Leaver Destination report. The most recent data shows the following:9

• For those qualifiers whose destinations could be confirmed, 94.9 per cent went into positive destinations (for example, work or further learning). Of all qualifiers, 82.7 per cent went into positive destinations compared to 82.6 per cent in 2014-15.

• Of all qualifiers, 66 per cent stayed in education or training. This is down from 69 per cent in 2014-15. For those remaining in education, 85 per cent progressed to a higher level of study, 11 per cent stayed at the same level, and four per cent dropped a level.10

• At least 17 per cent of all qualifiers went into employment. This is up from 14 per cent in 2014-15. Over two-thirds were in a job related to their course.

• Of all qualifiers, 4.4 per cent were unemployed or unable to work. This was a slight increase from 3.8 per cent in 2014-15.

44. Over the past two years, the SFC has coordinated a Student Satisfaction and Engagement Survey. This asks college students about their experience. Overall, satisfaction remains high:

• 90.2 per cent for full-time students (90.1 per cent in 2015-16).

• 94.6 per cent for part-time students (93.1 per cent in 2015-16).

• 92.7 per cent for distance learners (88.1 per cent in 2015-16).

45. The SFC is aiming for a 50 per cent response rate for the survey. While it did not achieve this in 2016-17, the response rate improved on the previous year. The response rate for full-time students was 41 per cent, compared to 16 per cent for part-time students and nine per cent for distance learning.

Outcomes for students vary significantly by college

46. Changes in attainment, retention, satisfaction and destinations have been relatively small for the sector as a whole, but the variation across colleges is significant. For full-time students in further education:11

• Attainment rates in 2016-17 ranged from 78.7 per cent (Orkney College) to 57.4 per cent (Fife College).

• Retention rates ranged from 86 per cent (Orkney College) to 65.6 per centAyrshire College # 193132484082 (New College Lanarkshire). 09/12/201810/31/2018 14:26:1914:56:15

• Overall satisfaction ranged from nearly 100 per cent to 81 per cent at Fife College.12 Response rates to the satisfaction survey varied widely, from 80 per cent at Lews Castle College to eight per cent at North Highland. 24 |

• Positive destinations for all full-time leavers ranged from 95 per cent at Orkney College, to 71.2 per cent at Fife College. The proportion of leavers whose destination could not be confirmed also varies. The unconfirmed rate ranges from 1.3 per cent (North Highland College) to 21 per cent (Fife College).

47. Most colleges seem to be stronger on some performance indicators for full- time FE courses than on others (Exhibit 10). The reasons for the variation in performance outcomes are complex and will be influenced by factors such as local deprivation levels in the communities served, ever more flexible learner pathways – influencing increasing numbers of early withdrawals – and improved employment opportunities, particularly for young learners.

Exhibit 10 Performance measure for full-time FE courses, by college Outcomes for students vary significantly by college.

All colleges sorted by alphabetical order

Attainment

Retention

Satisfaction

Positive destination

Fife Argyll Moray Perth SRUC AyrshireBorders Orkney Inverness Shetland Edinburgh Forth Valley North East Lews Castle West collegeWest Lothian City of Glasgow GlasgowGlasgow Clyde Kelvin North Highland West Highland Newbattle Abbey Dundee and Angus South Lanarkshire Dumfries and Galloway New College Lanarkshire

Highest percentage of all the colleges Lowest percentage of all the colleges

Note: Sabhal Mòr Ostaig does not have FE full-time students. Source: SFC data

48. The SFC does not currently identify the factors that contribute to the trends identified or whether there are any significant relationships between the published measures. The Scottish Government is working on a project to improve attainment and retention at colleges. This may provide an opportunity to further investigate relationships within the data. Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 49. Another potential performance measure would be articulation rates, that is, the number of students who progress from college to university. Up-to-date information is not currently available on this, though the SFC is developing a national articulation database. Part 2. How Scotland's colleges are performing | 25

Students from a wider range of backgrounds are going to college

50. Working in partnership with schools, universities and employers, colleges offer an important route to gaining skills, improving employability or going into higher education. Colleges play an important role in widening access to education for those in deprived communities or with additional needs by increasing their career prospects and helping them to achieve their individual potential.

51. The SFC has national priorities to increase the proportion of credits delivered to students from deprived areas or who have been in care. They also track progress on the proportion of credits delivered to students from ethnic minorities or who have a disability. Exhibit 11 shows progress by the sector. The number of students from these groups has increased since 2011-12, despite large drops in overall student numbers.

Exhibit 11 Proportions of credits delivered to students from selected groups The proportions of credits to students from these groups have been increasing.

20

16

12

8

4 Proportion of credits (per cent) 0 Students from the 10 per cent Ethnic minority students Students with a disability Students who have most deprived postcodes been in care Groups tracked by the SFC

2014-15 2015-16 2016-17

Source: SFC

52. Colleges play a key part in encouraging students from a wider range of backgrounds to stay on in education, particularly in providing HE courses. Higher education courses taught in Scotland range from HNC and HND courses to post- graduate qualifications: 68 per cent of college HE entrants were on HNC or HND programmes. In 2016-17, around 1,000 students at Scottish colleges (excluding UHI) were studying at degree level. Students entering HE courses at college are more likely to be from deprived areas than those entering courses at HE institutions such as universities. Students from the 20 per cent most deprived areas account for 23 per cent (over 8,000 students) of HE entrants to Scotland's colleges. ThisAyrshire College # 193132484082 compares to 12 per cent at HE institutions. In 2016-17, HE entrants at colleges 09/12/201810/31/2018 14:26:1914:56:15 accounted for 28 per cent (38,495 students) of all HE entrants in Scotland. 26 |

Students from the most deprived areas tend to have lower levels of attainment

53. In general, students from the least deprived areas do better than those from the most deprived areas. This gap has increased since 2011-12:

• For FE students, the gap in attainment between the ten per cent least deprived and ten per cent most deprived areas has increased from five percentage points in 2011-12 to seven percentage points in 2016-1 7. In 2016-17, attainment for students from the ten per cent most deprived areas was 62 per cent, compared to 70 per cent for students from the ten per cent least deprived.

• For HE students, the gap in attainment between these groups increased from 7.5 percentage points in 2011-12 to 7.7 percentage points in 2016-17. The attainment gap narrowed between 2015-16 and 2016-17. In 2016-17, attainment for students from the ten per cent most deprived areas was 68.5 percent, compared to 76.2 per cent for students from the ten per cent least deprived.

54. The SFC reports that, for all courses over 160 hours, 69 per cent of students achieved their qualification in 2016-17. Attainment was higher for ethnic minority students, but lower for students with a disability or who have been in care. Students from all of the groups identified in Exhibit 12 are also less likely to move into work once they leave college.

Exhibit 12 Attainment on courses over 160 hours for students from selected groups 2016-17 There is an attainment gap for students from deprived areas, with a disability or who have been in care.

80 All enrolments over 160 hours 70 60 50 40 30 20 Attainment (percentage) 10 0 Ethnic minority Students with Students from Students from Students students a disability 10 per cent 20 per cent who have been most deprived most deprived in care postcodes postcodes

Groups tracked by SFC

Source: SFC Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 Part 2. How Scotland's colleges are performing | 27

55. Students from deprived areas are more likely to face barriers to attending college; for example, they might struggle to cover the transport costs, or struggle to afford food. Colleges have developed new approaches to tackle these problems. For example: Glasgow Kelvin College has dedicated staff to provide support for disadvantaged students; Dumfries and Galloway College provides transport to students from remote areas; and South Lanarkshire College has been providing free counselling for students and free sanitary products to all female students.

56. An independent review of the student support system in Scotland published its findings in November 2017.13 This review proposed:

• changing the structure of student support funding for college students

• moving to one common funding system across both further and higher education with local face-to-face support.

57. The Scottish Government, SFC and Student Awards Agency for Scotland (SAAS) are currently considering the review's recommendations.

Colleges have made limited progress in reducing gender imbalance in certain courses

58. The gender balance across students in the sector has remained broadly even, as was the case last year. Female students represent 51 per cent of the student population (120,187), and males 49 per cent (115,320).14

59. Both male and female part-time students increased in 2016-17. The number of male students increased by eight per cent to 83,817 and the number of female students by two per cent to 82,529. Since 2011-12, female part-time student numbers have dropped by 35 per cent (45,074 students), compared to 24 per cent for males (26,405 students). Part-time students are now split almost evenly between male and female for the first time.

60. There continue to be large gender imbalances across subject groups (Exhibit 13, page 28). The SFC is committed to increasing the minority gender share in the most imbalanced subjects through sharing identified good practice and its gender action plan. It has made good progress in attracting female students to engineering, and some progress attracting male students into social work. But it needs to do more to improve gender imbalance in other subjects. Childcare courses are particularly imbalanced. The SFC expects to see more progress from 2017-18 onwards.

Colleges are trying to improve gender balance on college boards

61. In January 2018, the Scottish Parliament passed the Gender Representation on Public Boards (Scotland) Act 2018 to improve the gender representation on boards of Scottish public authorities. At February 2018, 16 colleges had more men on their boards than women. Six college boards had twice as many men as women, with the greatest gender imbalance at Orkney College (16 men to three 15, 16 Ayrshire College # 193132484082 women). Seven colleges had more women than men on their boards, with 09/12/201810/31/2018 14:26:1914:56:15 the largest gender imbalance being Borders College, with ten women and six men. Three colleges had an equal balance: New College Lanarkshire, Edinburgh College and Moray College. 28 |

Exhibit 13 Subjects with greatest gender imbalances Changes in the gender balance of some courses is relatively small.

Subject Male Female Percentage students in students in point change 2016-17 2016-17 in minority % % gender from 2015-16

Engineering 78 22 7

Transport 93 7 -4

Construction 89 11 — 0

Health 24 76 -1

Social Work 14 87 1

Source: SFC

62. We recognise that the gender balance of members of college boards is not entirely under the control of colleges as some members are elected to their position.

63. UHI has taken steps to improve the gender balance in the members of its governing body (Case study 1, page 29).

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 Part 2. How Scotland's colleges are performing | 29

Case study 1 UHI is addressing its gender balance

UHI had difficulty attracting female candidates to its governing body. Its recruitment process in late 2017 saw 70 per cent of applicants being men. One female governor was recruited through this process, but to supplement this UHI ran another recruitment process using a different approach. This included:

• changing the role description and person specification significantly to make it accessible to a much wider audience, for example removing the requirement that applicants must have served on boards before, and focusing on the skills needed for the role

• specifying that candidates should be able to demonstrate a commitment to equality and diversity

• encouraging appropriate candidates by sharing the vacancy with local women's groups, for example the Highland Business Women's Club.

This resulted in better quality applicants, a greater number of female applicants and, ultimately, to three further female appointments to the UHI Court. When all three new governors have joined, the Court membership will be 11 men and eight women.

Source: Audit Scotland

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 30 |

Part 3 Progress in the multi-college regions

Key messages 1 The three multi-college regional strategic bodies (RSBs) are fulfilling their statutory duties by setting targets for individual colleges and distributing funding. But the extent to which they are delivering the anticipated benefits of regionalisation varies. 2 The University of Highland and Islands (UHI) Court has made good progress in delivering the anticipated benefits of regionalisation. Since it became the RSB in 2014, it has focused on changing cultures and developing effective relationships among its assigned colleges. The RSB is helping colleges to balance income and expenditure over regional the medium-to-long term in a more sustainable way by re-allocating strategic learning activity and funding in the region. It is now planning more effective shared working and is working with four of its incorporated bodies are colleges to explore opportunities for greater integration. fulfilling statutory 3 After a difficult start, the Glasgow Colleges' Regional Board (GCRB) is making progress on coordinating collaborative regional activity. Both duties but GCRB and its assigned colleges recognise that they need to do more work to deliver a fully effective regional partnership. It will benefit from regional longer-term leadership stability to be more effective, particularly with the benefits vary regional arrangements following significant merger activity in Glasgow. 4 The benefits of regionalisation in Lanarkshire have come about mainly through the merger of colleges to create New College Lanarkshire. Under the regional structure, New College Lanarkshire and South Lanarkshire College are working together to meet core statutory requirements, but the regional arrangements are not delivering any significant regional benefits.

The regional strategic bodies (RSBs) in the three multi-college regions are fulfilling their statutory duties

64. As part of its reform of post-16 education, the Scottish Government established a regional approach to further education. The aim was to make Ayrshire College # 193132484082 the sector more efficient and responsive to the needs of students and local 09/12/201810/31/2018 14:26:1914:56:15 economies. Across Scotland, 13 regions were created. Three of these contain more than one college: Glasgow, Highlands and Islands, and Lanarkshire. In these three multi-college regions, RSBs oversee the assigned colleges.17 They are responsible for: Part 3. Progress in the multi-college regions | 31

• strategically planning college education across the region

• allocating funding to assigned colleges

• monitoring how their assigned colleges perform

• overseeing the delivery of the regional outcome agreement, which sets out what colleges in a region will deliver in exchange for funding.

65. All three RSBs in the three multi-college regions are structured and operate differently:

• The Court of the University of Highlands and Islands (UHI) existed before regionalisation, but was established as the RSB in August 2014. It secured operational fundable body status in April 2015. To carry out its regional body role, UHI established a committee of its Court, called the Further Education Regional Board (FERB). The RSB function within the university requires a small number of dedicated staff and its operating budget in 2017- 18 is around £325,000. Nine colleges are assigned colleges of UHI:

–– five incorporated colleges: Inverness, Lews Castle, Moray, North Highland and Perth. –– four non-incorporated colleges: Argyll, Orkney, Shetland and West Highland. Uniquely to UHI, assigned colleges are also academic partners of UHI for delivering higher education.

• Glasgow Colleges’ Regional Board (GCRB) was established in May 2014. GCRB has three assigned colleges: City of Glasgow, Glasgow Kelvin and Glasgow Clyde Colleges. It employs three staff and its operating budget for RSB activities in 2017-18 is around £430,000. After some problems which were highlighted in a statutory report by the Auditor General, it achieved operational fundable body status in April 2017.18

• The Lanarkshire Board is the board of the New College Lanarkshire (NCL) as well as the RSB. It secured operational fundable body status in August 2016. With no separate regional governance arrangements or additional staff, the RSB incurs relatively little additional cost. This is estimated to be in the region of £50,000 a year and is shared between the two colleges, with NCL funding 60 per cent and South Lanarkshire College 40 per cent.

66. To operate fully, RSBs in multi-college regions had to meet the SFC's requirements to be 'fundable bodies'. The creation of multi-college RSBs has led to a change in the financial and accountability relationships between the SFC and the assigned colleges in these regions.

67. In Scotland's Colleges 2016 , we reported that none of the three multi- college RSBs was operating as intended. The regional arrangements are still relatively new. As they have been established alongside significant reform in collegeAyrshire College # 193132484082 mergers, we expect that it will take some time for RSBs to be operating fully 09/12/201810/31/2018 14:26:1914:56:15 effectively. We are seeing the culture in assigned colleges is beginning to change. 32 |

Progress in meeting the aims of regionalisation varies

68. All three multi-college RSBs now fulfil their core statutory duties. But the extent of their progress in meeting the wider aims of regionalisation varies. The remainder of this section considers what each RSB has done since it was created.

UHI 69. UHI has made good progress in meeting the wider aims of regionalisation. It has invested a lot of time and effort in building relationships between the assigned colleges, and establishing a more collaborative culture. Colleges are now more willing to share best practice and services to generate greater efficiency. For example, Inverness College recently appointed a Director of Finance on the basis of her becoming the joint Director of Finance at both Inverness and Moray colleges.

70. UHI has been developing a clear sense of purpose, with a regional strategy for further education. It has invested in staff and revised structures to reflect its wider responsibilities and deliver its aims. This has included appointing a Vice-Principal of further education and other dedicated staff. It has also been developing regional policies and management information systems. For example, it is:

• making progress in developing a single set of policies for further education, covering admissions, the content of courses and student procedures

• delivering significant increases in foundation apprenticeships and pilot graduate apprenticeships by planning and delivering apprenticeships on a regional basis through its work-based learning hub

• using data better to help it report more effectively against its plans.

71. UHI has been strengthening the accountability of its assigned colleges by developing more effective performance monitoring arrangements. This has been prompted by the lessons learned from previous financial difficulties in Moray College. Its audit committee and financial and general purposes committee now both look in detail at the performance of all individual colleges across a range of measures. As a result, committee members are better informed about long-and short-term performance issues and about the colleges' financial sustainability. UHI recognises though that there is scope for further improvement, particularly in securing timely information from assigned colleges to form a more joined-up approach to risk and performance management.

72. Over the past two years, some of UHI's colleges have found it difficult to meet their activity targets. This has presented a risk to their ability to continue to balance their income and expenditure in the medium to long term. In November 2017, UHI agreed a funding model for allocating further education credits between colleges in a way that maintains financial stability at individual colleges and meets the regional targets agreed with the SFC.

73. UHI is working with four of its five colleges to explore options for greater integration. Its aims are to simplify UHI's structure and governance arrangements,Ayrshire College # 193132484082 deal more effectively with future financial pressures, and deliver benefits for staff09/12/201810/31/2018 14:26:1914:56:15 and students. The agenda is at an early stage, with UHI yet to consult colleges on specific proposals or the potential benefits from greater integration. Part 3. Progress in the multi-college regions | 33

GCRB 74. Following its creation, GCRB had weaknesses in governance arrangements, highlighted in a statutory report in 2014/15. This contributed to it taking three years to achieve fundable body status. GCRB has also experienced instability in its leadership, with three permanent and two interim chairs in four years, with its current chair being appointed in January 2018. GCRB is now benefiting from greater collaboration and integration in the areas outlined below. However, the current chair acknowledges that greater stability is needed to make GCRB more effective than it has been, and she is working with the three assigned colleges and their boards to agree a joint vision.

75. GCRB reviewed the region's curriculum in 2014 prior to publication of the Glasgow College Region Curriculum and Estates Plan 2015-2020. This led to changes in the number and content of courses, the closure of a campus that was no longer fit for purpose and a transfer of credits between colleges.

76. GCRB launched Glasgow's Regional Strategy for College Education in October 2017, which sets out the regional priorities for 2017-22. This strategy sets an overarching ambition of building an inclusive, responsive and effective regional college system. To deliver this, GCRB and its assigned colleges are taking forward a number of regional initiatives:

• Coordinating the way school students move into further education across the Glasgow region and developing ways for students to move easily from the three colleges to Glasgow University.

• Coordinating curriculum hubs that jointly plan the courses colleges provide, to match economic and employer needs. This approach gives learners a better chance of getting a job when they leave college. The hospitality hub, for example, is run by operational managers across the colleges and shares teaching materials, assessments and students.

• Supporting Glasgow’s colleges to develop individual college and regional science, technology, engineering and mathematics (STEM) strategies. The colleges now work together with employers and higher education partners to develop effective ways for school pupils to go to college and university and into jobs.

• Establishing regional leads, in the form of senior college staff, for curriculum planning, organisational development, student experience, developing the young workforce (DYW) and student data systems. Individual colleges fund this work, with senior staff concentrating on regional work, on average, for one day a week.

• Distributing capital funding to colleges against an agreed set of criteria, linked to regional priorities.

• Monitoring and scrutinising colleges’ finances and performance on an ongoing basis. Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 77. Prior to the creation of GCRB, the colleges in Glasgow established the Glasgow Colleges Group in response to the regionalisation agenda. This group still exists for the three colleges to take forward operational issues on a city-wide basis. GCRB staff are members of this group and contribute to the work of the group. GCRB staff membership also provides a link back to the regional board. 34 |

78. Senior staff and board members we spoke to from GCRB's assigned colleges expressed mixed views about the additional benefits the regional body brings. The majority acknowledge the benefits of having a regional body to support collaborative working, but some see it as an unnecessary additional cost and layer of bureaucracy. If GCRB is going to become more stable and add more value, it needs to address these concerns.

Lanarkshire 79. The benefits of regionalisation in Lanarkshire have come about mainly through the merger of three of the four Lanarkshire colleges (Coatbridge, Cumbernauld and Motherwell colleges) to create New College Lanarkshire. For example, it has been able to review and rationalise the courses provided by its predecessor colleges and harmonise policies and ways of working. New College Lanarkshire provides courses across the Lanarkshire region, including in South Lanarkshire.

80. The current regional structure, with South Lanarkshire College being assigned to New College Lanarkshire, adds very little value to regional college provision. Both colleges are working together to meet core statutory requirements, such as having a Regional Outcome Agreement (ROA), but, beyond this, significant cooperation or integration between the colleges has been limited.

81. Most members of the RSB that we spoke to recognise that the current arrangement is not ideal, creating duplication without delivering any benefits. They also share concerns about making further efforts to create a regional approach to learning. South Lanarkshire College performs well, has a relatively healthy financial position and its board members see no additional benefit to be gained from any changes across the region. New College Lanarkshire has been through a difficult period in merging its three predecessor colleges and is focusing on addressing its current financial difficulties page 15.

82. The colleges have indicated that demographics and infrastructure are also a barrier to greater cross-Lanarkshire course rationalisation. Distances between New College Lanarkshire's campuses and South Lanarkshire College are greater than the distance to colleges in Glasgow. There are also relatively poor transport links across Lanarkshire compared with good transport links to Glasgow. Both colleges share concerns that shifting courses between the colleges could potentially encourage more local students to look at courses in Glasgow than within the region.

83. There is limited evidence that the Lanarkshire Board has sought to address the issues described above or that its colleges have explored opportunities for more effective regional working. Since 2015-16, the board and its finance committee have been committed to developing a five-year plan for the region to 'form strategies to minimise negative impact and maximise opportunities which arise'. The board has yet to confirm when this will be developed and approved. There is some evidence that the colleges are beginning to look at other ways of working together more efficiently. For example, the remit for a review of regional finance structures will be taken to the regional finance committee in June 2018. However, these developments are still at an early stage. Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 Part 3. Progress in the multi-college regions | 35

Despite the regional arrangements, assigned colleges must also report to the SFC

84. Assigned colleges are accountable to their RSB for the local delivery of further education and meeting locally agreed targets. Each RSB is accountable to the SFC for delivering further education across the region. Despite the introduction of RSBs, the SFC still requires assigned colleges in multi-college regions to submit a number of specific data requests directly to them. It has required college-level responses to new initiatives, such as gender action plans and to its condition survey, rather than asking for regional responses. Assigned colleges tell us that this not only creates confusion around accountability, but that the requirement to provide data to both their RSB and the SFC can place an additional burden on them.

Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 36 |

Endnotes

1 Scotland’s colleges 2017 , Audit Scotland, June 2017; Scotland’s colleges 2016 , Audit Scotland, August 2016; Scotland’s colleges 2015 , Audit Scotland, April 2015.

2 Until 1992, all publicly funded colleges were run by local authorities. Under the Further and Higher Education (Scotland) Act 1992, most of these colleges established their own corporate body and boards of management. The boards of management took over responsibility for the financial and strategic management of the colleges. These colleges are referred to as incorporated colleges and produce accounts subject to audit by the Auditor General for Scotland. The remaining six colleges are generally referred to as non-incorporated colleges. Scotland’s Rural College (SRUC) is classed as a higher education institution but counts towards the achievement of the national target for colleges.

3 Orkney College and Shetland College are controlled by the respective local authority, and prepare their accounts for the same financial year end as the local authority.

4 These are produced by HM Treasury and published on the www.gov.uk website.

5 Incorporated colleges only. 6 Written evidence submitted by Colleges Scotland to the Scottish Affairs Committee, March 2018.

7 The other non-incorporated colleges (Orkney, Shetland, West Highland and Argyll) are part of the Highlands and Islands region.

8 Attainment and retention figures are derived from the SFC's Performance Indicators for 2016-17.

9 Positive destinations are from the most recent data available (2015-16), and represent only known destinations. The destination data is for all full-time students (including both HE and FE), except for UHI and SRUC where the HE data is not available. 87 p er cent of leavers' destinations could be confirmed (86 per cent in 2014-15). 10 Based on SCQF level. SCQF level progression information was available for 87 per cent of college leavers.

11 HE figures have been excluded here as HE data for UHI colleges and SRUC is reported differently.

12 2016-17 was only the second year that the SFC has collected satisfaction data across all colleges and modes of study. The SFC publishes student satisfaction results on a sector-wide basis but not currently for individual colleges due to the variation in response rates to college surveys. It is working with colleges to improve their survey response rates.

13 A New Social Contract for Students: Fairness, Parity and Clarity, Student Support Review in Scotland, Autumn 2017.

14 230 students did not give their gender or described it as 'other'.

15 North East College Scotland, City of Glasgow College, Glasgow Kelvin College, North Highland College, Orkney College and Shetland College.

16 Orkney College is one of two colleges run by the local council (the other being Shetland). The college board members are determined by the council. The Accounts Commission’s recent Best Value report identified a gender imbalance across councillors for Orkney Islands Council. (Best Value Assurance Report: Orkney Islands Council , Accounts Commission, December 2017).

17 Under the Further and Higher Education (Scotland) Act 2005 every incorporated college is eitherAyrshire designated College as a regional # 193132484082 college or assigned to a regional strategic body. 09/12/201810/31/2018 14:26:1914:56:15

18 The 2014/15 audit of Glasgow Colleges' Regional Board , Auditor General, March 2016. Appendix 1. Audit methodology | 37

Appendix 1 Audit methodology

Our audit involved the following:

• Analysing relevant Scottish Government budget documentation, colleges' audited accounts and auditors' reports covering the financial periods ending July 2017.

• Analysing information held by the SFC, including performance and activity data.

• Interviewing a wide range of stakeholders. These included college principals, senior college staff, regional chairs, Colleges Scotland, staff and student unions, trade unions, the SFC and the Scottish Government.

• Data we requested from colleges' local external auditors.

This report focuses on incorporated colleges. We state clearly where we include data relating to non-incorporated colleges.

Detailed methodology for specific sections in the report: Underlying financial position (paragraph 10) Incorporated colleges reported an overall deficit of £20.5 million in their 2016-17 audited accounts. This compares with an overall deficit of £19.4 million in 2015-16 audited accounts. In reporting the underlying financial position we have used the SFC's data for each college based on the accounts direction it issued in 2017.

Calculating student numbers (paragraph 37) In this report we present student numbers by headcount, drawn from the SFC's Infact database. Where possible, this headcount excludes any multiple enrolments, meaning if a student had been enrolled at two colleges in 2016- 17 they would only be counted once. Where we show full-time and part-time student numbers this will include multiple enrolments.

In previous college overview reports, we have presented student numbers for incorporated colleges only. For Scotland's colleges 2018, we have expanded our analysis to include non-incorporated colleges and SRUC to give a comprehensive picture of performance against the Scottish Government's national target for learning activity. If we analyse only the incorporated colleges in line with our approach last year, we see that headcount has increased by four per cent, and the trend is the same as for the whole sector. Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15 The student population data from the SFC's Infact database includes the data for Argyll and West Highland Colleges within the figures for North Highland College, so we are unable to identify trends in the student numbers data for these colleges separately. 38 |

Appendix 2 Scotland's college landscape 2018

Region College

Aberdeen and 1 North East Scotland College Aberdeenshire 19 Ayrshire 2 Ayrshire College Borders 3 Borders College Dumfries and 4 Dumfries & Galloway College Galloway Edinburgh and 5 Edinburgh College 16 Lothians Fife 6 Fife College 15 Central 7 Forth Valley College 13 8 City of Glasgow College Glasgow 9 Glasgow Clyde College 10 Glasgow Kelvin College 14 11 Argyll College 12 12 Inverness College 18 1 13 Lews Castle College 14 Moray College 20 Highlands and 15 North Highland College 23 Islands 16 Orkney College 17 17 Perth College 6 18 Sabhal Mòr Ostaig 7 11 9 8 27 26 25 19 Shetland College 24 10 21 5 20 West Highland College 22 3 21 New College Lanarkshire Lanarkshire 2 22 South Lanarkshire College 4 Tayside 23 Dundee and Angus College West 24 West College Scotland West Lothian 25 West Lothian College n/a 26AyrshireNewbattle College Abbey College# 193132484082 n/a 27 SRUC09/12/201810/31/2018 14:26:1914:56:15

Note: The map shows the 20 incorporated colleges, the six non-incorporated colleges in Scotland (in bold) and Scotland’s Rural College (SRUC) which is classed as a higher education institution but counts towards the achievement of the national target for colleges. Source: Audit Scotland Scotland’s colleges 2018

This report is available in PDF and RTF formats, along with a podcast summary at: www.audit-scotland.gov.uk

If you require this publication in an alternative format and/or language, please contact us to discuss your needs: 0131 625 1500 or [email protected]

For the latest news, reports and updates, follow us on:

Audit Scotland, 4th Floor, 102 West Port, Edinburgh EH3 9DN T: 0131 625 1500 E: [email protected] www.audit-scotland.gov.uk

ISBN 978 1 911494 66 9 AGS/2018/4 Ayrshire College # 193132484082 09/12/201810/31/2018 14:26:1914:56:15

This publication is printed on 100% recycled, uncoated paper