• Section 1 - Overview and Scope
• Section 2 - Policy
• Part A - Principles
• Framework of ethical conduct
• Part B - Planning and prevention of fraud and corruption
• Fraud control officer
• Prevention systems
• Fraud and corruption risk management
• Communication and awareness of fraud and corruption
• Employment screening and vetting processes
• Business associate (supplier) vetting
• Physical security and asset management
• Education agent, intermediary and partner vetting
• Student capability vetting
• Protection of academic and research integrity 
• Protection of intellectual property
• Protection of certification documentation
• Privacy management
• Internal audit
• Part C - Detecting fraud and corruption
• Post-transactional reviews
• Data analytics
• Analysis of accounting reports
• Student related fraud and corruption detection systems
• External audit
• Part D - Response to fraud and corruption
• Reporting fraud and corruption
• Complaint management
• Exit interviews
• Investigation of fraud and corruption
• Responses to privacy concerns
• Responsibilities
• Section 3 - Authority and Compliance
• Section 4 - Quality Assurance

Section 1 - Overview and Scope

(1) The purpose of this Policy is to protect the reputation and assets of the University of New England (UNE) from fraudulent and corrupt activities, and outline the processes and mechanisms for preventing, reporting and investigating incidents of fraudulent activity in and against the University.

(2) This Policy establishes a Fraud and Corruption Control System (FCCS) consistent with the Australian Standard on Fraud and Corruption Control (AS 8001:2021). The Policy provides guidance on how to prevent, detect and respond to incidents of fraud and corruption and:

1. reinforces management’s commitment to, and responsibility for, identifying risk exposures to fraudulent and corrupt activities, and ensuring all UNE Representatives and students are aware that UNE has zero tolerance for fraud or corrupt conduct; and
2. requires UNE Representatives to perform their duties with honesty and integrity in accordance with the framework of ethical conduct that underpins the expected standards of behaviour for all members of the University community. The Code of Conduct policy sets the standards of ethical behaviour expected of staff and students. Staff should abide by the principles set out in the Code of Conduct and students should abide by principles set out in the Student Behavioural Misconduct Rules.

(3) This Policy applies to all UNE Representatives, students, customers, contractors, business associates, partners, external service providers, volunteers and controlled entities of UNE. Fraud and corruption prevention, control and reporting is the responsibility of all UNE Representatives.

1. Staff and other individuals who enter into a range of relationships with the University (including contractors, visiting fellows and volunteers) have a responsibility to act honestly, responsibly and impartially in accordance with the Code of Conduct.

(4) This Policy should be read in conjunction with the UNE Risk Management Policy, Organisational Resilience Rule, Procurement Policy, and Codes of Conduct.

(5) Within this Policy:

1. Part A sets out the Principles that underpin this Policy;
2. Part B outlines UNE’s approach to planning and preventing fraud and corruption;
3. Part C outlines UNE’s systems for detecting fraud and corruption; and
4. Part D outlines UNE’s responses to fraud and corruption.

Section 2 - Policy

Part A - Principles

(6) UNE has zero tolerance for fraudulent or corrupt activity.

(7) UNE recognises that fraud and corruption create reputational and financial damage to the University.

(8) UNE recognises that the risk of fraud and corruption can arise in various contexts and has put in place measures proportionate to the risks in order that UNE Representatives, students and associates of the University and its controlled entities are aware and understand the relevant policies for the prevention, detection and response to fraud and corruption.

(9) To demonstrate this commitment the University, through the Vice-Chancellor and Chief Executive Officer (VC&CEO) and Senior Executive, will ensure:

1. the integration of fraud and corruption risk management into the University’s values, practices and business plans;
2. that the risk of fraud and corruption is assessed and that risk assessment will be conducted:
   1. following substantive changes to the regulatory or compliance environment;
   2. following substantive changes to the mechanisms in place at the University to manage fraud and corruption risk;
   3. following detection of substantive fraud or corruption; and/ or
   4. at least every two years.
3. the effectiveness of mechanisms to control fraud and corruption risk are evaluated;
4. the investigation of suspected fraud or corruption and take appropriate disciplinary action, which may include referral to the relevant police service, for any person found to have engaged in fraud or corruption;
5. the reporting of suspected corruption, whether it involves a UNE Representative or not, to the relevant anti-corruption agency where required by law;
6. in the absence of criminal prosecution, the application of appropriate civil, administrative or disciplinary penalties against individuals who have been party to fraud or corruption;
7. the taking of reasonable legal action to recover losses that result from fraudulent or corrupt conduct;
8. cooperation with the agencies including ICAC, the NSW Ombudsman, Audit Office of NSW and NSW Police Force (or the equivalent agency/ies in another state or territory as applicable) in relation to fraud and corruption and wherever practical, the alignment of University processes to better practice advice issues by those organisations;
9. the recording of all suspected incidents of fraud and corruption to identify trends and prevent recurrence;
10. the reporting of all actual and suspected fraud and corruption to the VC&CEO and the Audit and Risk Committee; and
11. the due consideration of a fidelity guarantee policy to protect the University against the financial consequences of fraud.

Framework of ethical conduct

(10) This Policy is one element of a suite of practices in place across the University that reinforce the University’s values. The University’s framework of ethical conduct includes, but is not limited to:

1. UNE Governance, Integrity and Standards Policy, Code of Conduct, Conflicts of Interest Policy and other University Policies specifically intended to guide positive behaviour;
2. the mandate and commitment to fraud and corruption control made in this Policy;
3. example setting by senior management;
4. roles and responsibilities as articulated in University Policies, including the position descriptions, and the UNE Delegations Framework Rule;
5. mechanisms for reporting and managing wrongdoing and misconduct;
6. complaints management processes; and
7. mechanisms to ensure ethical standards in research and academic integrity.

(11) Supporting the University’s commitment to an observable ethical culture, all staff are required to confirm in writing, annually that they have over the previous twelve months complied with the University’s Code of Conduct and this Fraud and Corruption Control Policy, and that they will continue to comply over the ensuing twelve months.

Part B - Planning and prevention of fraud and corruption

Fraud control officer

(12) The Director Governance and University Secretary (DGUS) is the primary Fraud and Corruption Control Officer (FCCO). In relation to fraud and corruption, the DGUS is responsible for:

1. developing, implementing and maintaining the University’s FCCS; and
2. coordinating periodic assessment of the University’s fraud and corruption risks.

(13) The Head, Internal Audit is responsible for:

1. recording fraud and corruption events;
2. escalating and monitoring fraud and corruption events including coordinating internal and external reporting; and
3. conducting, coordinating or monitoring investigations into allegations of fraud and corruption.

(14) While not limiting the capacity of any person to report matters of concern to any person or agency, the Head, Internal Audit is the nominated position to make official report to external agencies as a representative of the University with the exception of:

1. the VC&CEO, as the principal officer of the University, has a non-delegable duty to report to the ICAC as soon as they become aware of any matter that they suspect concerns and may concern corrupt conduct.

(15) The Senior Executive is responsible for ensuring that all of the University’s fraud and corruption control resources are coordinated and work together to fulfil the objectives of this Policy and the Fraud and Corruption Control System (FCCS).

(16) The Chief Information Security Officer (CISO) is responsible for:

1. establishing and monitoring systems-based controls and reporting on matters of concern to the Head, Internal Audit on the University’s fraud and corruption exposures;
2. attending continuing professional development in technology-enabled fraud and corruption in order to maintain a sound understanding of methods for managing the risk of fraud and corruption in accordance with relevant standards and contemporary and emerging practice in the field;
3. maintaining a sound understanding of how an information security management system can effectively mitigate the risks of fraud and corruption; and
4. maintaining a sound understanding of cybercrime and methods for managing the risk of cybercrime in accordance with relevant standards and contemporary and emerging practice in the field.

Prevention systems

(17) UNE is committed to preventing fraud and corruption within the University and its controlled entities. The enact this commitment, UNE will put in place appropriate mechanisms for fraud and corruption risk management, including policies and processes, risk assessment, internal controls, investigation, reporting, education and independent auditing to reduce the incidence of fraud and corruption and regularly evaluating these.

(18) UNE will minimise the incidence of fraud and corruption by:

1. applying the Risk Management Policy and Risk Management Policy - Annexure 1 - Risk Approach and Terminology;
2. making all UNE employees, and employees of controlled entities, aware of UNE’s Code of Conduct, Conflicts of Interest Policy and other elements of the UNE ethical conduct framework at induction and throughout employment;
3. the establishment and implementation of processes for all students to be made aware of the University’s Code of Conduct, Student Behavioural Misconduct Rules, and other relevant Codes and Policies;
4.  the establishment and implementation of management accountabilities, including:
   1. the incorporation of fraud and corruption control into the performance management system; and
   2. allocating, as far as practicable any losses, either known or estimated, due to fraud and corruption to the cost centre in which the loss occurred;
5. the establishment and implementation of first line assurance business practices for preventing fraud and corruption that are:
   1. developed in all relevant areas of the University where there is a risk of fraudulent or corrupt activities;
   2. identified as required by assessment of the risk of fraud or corruption;
   3. documented and include requirements to create records of performance of the process;
   4. approved by a manager with sufficient skill, competence and accountability to validate the business process will be effective in the prevention of fraud and corruption; and
   5. periodically subject to informal and formal audit.
6. the inclusion of fraud and corruption control responsibilities for manager and all members of staff in the Delegations Register;
7. the establishment and implementation of a program for the communication of awareness in relation to the risk of fraud and corruption; and
8. the establishment and implementation of processes for:
   1. employment screening and relevant employee declarations;
   2. the vetting of business associates (suppliers);
   3. the vetting of education agents, intermediaries and partners;
   4. vetting of student academic capability;
   5. the protection of academic and research integrity;
   6. the protection of intellectual property;
   7. the protection of the integrity of certification documentation; and
   8. the protection of any personal information collected by the University.

Fraud and corruption risk management

(19) The DGUS will coordinate an annual program of fraud and risk assessment management activities across the University. The program:

1. will be submitted to the Audit and Risk Committee for endorsement;
2. will be developed using a risk-based approach to address the areas of greatest risk exposure first as determined through application of risk assessment methodologies identified in the Risk Management Policy and Risk Management Policy - Annexure 1 - Risk Approach and Terminology;
3. will be continuously improved having regards to:
   1. risk reviews undertaken;
   2. the records of risk exposure in the Enterprise Risk Management Register;
   3. the historical incidence of fraudulent or corrupt incidents;
   4. the guidance material incorporated in AS80001:2021; and
   5. external environment scanning including global, national and higher education sectors.

(20) The Head, Internal Audit will use the findings of the fraud and corruption risk assessments to develop a fraud and corruption control assurance management plan to be reported annually to the Audit and Risk Committee and monitored for effectiveness over time.

Communication and awareness of fraud and corruption

(21) The DGUS will coordinate a regular program of communication and awareness to inform all stakeholders impacted by this Policy of: 

1. UNE’s definition of behaviours that constitute fraud or corruption;
2. UNE’s zero tolerance position for fraud and corruption;
3. the general incidence of fraud and corruption;
4. fraud and corruption exposures in the higher education sector;
5. the assessed fraud and corruption exposures within UNE;
6. the types of fraud and corruption that have been identified at UNE in the past five years and how these were dealt with in terms of disciplinary action and internal control enhancements;
7. the expectations of management and staff if fraud or corruption is detected or suspected;
8. fraud and corruption processes for management and staff including the Reporting Wrongdoing at UNE Policy and overview of the University’s FCCS;
9. an overview of fraud and corruption red flag behaviours.

Employment screening and vetting processes

(22) The Director People and Culture, will develop, implement and coordinate an employment screening program consistent with contemporary human resource practice, relevant legislation, codes and standards. The employment screening program will apply to appointments of:

1. senior executives and senior management; and
2. positions where the University faces an exposure to fraud and corruption above that of the level from professional and academic staff.

(23) The program will provide for effective employment screening of relevant persons:

1. before appointment;
2. on promotion or change of employment circumstances;
3. on temporary transfer/ secondment to an acting role of more than six months duration; and
4. at recurring intervals of not more than three years.

(24) The Director People and Culture will develop, implement and coordinate business processes for the declaration of:

1. outside professional activities; and
2. declarations of conflicts of interest.

Business associate (supplier) vetting

(25) The Chief Financial Officer (CFO) will develop, implement and coordinate a process for the vetting of business associates (suppliers). The vetting process:

1. must be applied to all business associates with whom the University has an annual spend threshold of $150,000 or more;
2. may be applied to other business associates, subject to resource availability to undertake the vetting;
3. is to be repeated every two years for all business associates.

(26) The vetting process is to include but is not limited to the following:

1. search of company register;
2. ABN and bank account confirmation;
3. verification of the personal details of directors;
4. director bankruptcy search;
5. disqualified director search;
6. educational qualifications claimed;
7. assessment of credit rating;
8. search of legal proceeding pending and judgements entered;
9. telephone listing and trading address;
10. media search;
11. search of available debarment, sanction and watch-lists; and
12. Search for politically exposed persons.

(27) Vetting is to be undertaken prior to the award of contracts exceeding the threshold value and at such time that the University becomes aware that expenditure with a specific supplier has exceeded the annual threshold value.

(28) Adverse outcomes in relation to vetting are to be report to the Chief Operating Officer (COO) for consideration of the University’s ongoing commercial relationship with the business associate.

Physical security and asset management

(29) The COO will maintain oversight of the University’s practices for the physical security and asset management. The security of the physical environment will be assessed to ensure appropriate measures are implemented for the prevention of theft of valuable tangible assets. Details of measures in place are outlined in the Key and Lock Policy, Password Policy, IT Server Room Access Procedures, and Information and Communications Infrastructure Rule.

Education agent, intermediary and partner vetting

(30) For Education agent, intermediary and partner vetting process refer to the Academic Quality Assurance Policy and Third Party Provider Arrangements Policy.

Student capability vetting

(31) For student capability vetting see the Admission, Credit and Enrolment Policy.

1. Where UNE accepts student admitted through other providers and third parties, the Executive Principal Brand Partnerships and Business Development will ensure vetting of students is at least equivalent to the standards undertaken by UNE.

(32) Verification of student identity occurs at the point of issuing a student identification card.

Protection of academic and research integrity 

(33) The Student Coursework Academic Misconduct Rule and Student Academic Integrity Policy, HDR - Higher Degree Research Student Responsible Research Conduct Policy and the Code of Conduct for Research Rule set out the requirements for the protection of academic and research integrity.

Protection of intellectual property

(34) The Knowledge Assets and Intellectual Property Policy sets out the requirements for the protection of intellectual property.

Protection of certification documentation

(35) The University Seal and Signing Documents Rule, Academic Qualifications Issuance Policy, Rescission of an Award/Correction of an Award Procedure and Digital Signatures Policy outline business practices protecting the integrity of the certification of documents.

(36) Business practices must ensure all certification documentation issued by the University is:    

1. unambiguously issued by UNE;
2. readily distinguishable from other certification documents issued by UNE;
3. protected against fraudulent use, including implementing practices to:
   1. secure and account for paper stocks used in the production of certification documentation, and
   2. ensure the storage of electronic records of certification documentation in accordance with the Records Management Rule and Records Management Procedures.
4. traceable and authenticable;
5. designed to prevent unauthorised reproduction; and
6. replaceable only through an authorised and verifiable process.

Privacy management

(37) The DGUS will promote the development, implementation and coordination of business practices to protect the integrity of personal information.

(38) These practices must ensure all personal information is compliant with relevant statutory and regulatory requirements and the information protection principles applying the NSW public sector agencies. The UNE Privacy Management Rule outlines the business practices to protect the personal information UNE collects.

Internal audit

(39) Internal Audit support the prevention of fraud and corruption by:

1. evaluating the effectiveness of internal controls in mitigating the risk of fraud and corruption;
2. developing a risk-based internal audit program that considers the risk of fraud and corruption in line with the UNE Internal Audit Charter; and
3. periodically reviewing the effectiveness of the University’s fraud and corruption prevention framework including this Policy and the FCCS.

Part C - Detecting fraud and corruption

(40) UNE is committed to the development and implementation of dynamic detection processes. The DGUS, CISO, Head of Finance and Head, Internal Audit have responsibility to validate the development of systems to detect and investigate fraud and corruption, including post transactional review, data mining and analysis of management accounting reports.

Post-transactional reviews

(41) A random selection of transaction will be reviewed after processing, by staff unconnected with the business unit making the transaction. Transaction to be reviewed include any action where fraudulent or corrupt gain or loss is possible and includes:

1. financial transactions;
2. student admission transaction;
3. transactions related to the production of certification documentation;
4. staff administration transactions;
5. recruitment and selection transactions;
6. tender selection and procurement transactions; and/ or
7. any other are of transaction that the Head, Internal Audit deems reasonable or necessary.

(42) The transaction reviews will look to ensure:

1. relevant documentation relating to the transaction is available and complete; and
2. transaction authorisations are properly made and recorded.

Data analytics

(43) Data analytics will be developed to consider relevant indicators of the University’s fraud and corruption risk exposure. Data analysis will be used to identify suspect transitions.

Analysis of accounting reports

(44) Analysis of accounting reports will be conducted to identify trends that may be indicative of fraud or corrupt conduct, including:

1. monthly actual/ budget comparison reports at account code level;
2. reporting comparing expenditure against industry benchmarks;
3. reports highlighting unusual trends on bad or doubtful debts.

Student related fraud and corruption detection systems

(45) Refer to relevant policies including Admission, Credit and Enrolment Policy, Student Behavioural Misconduct Rules, Student Coursework Academic Misconduct Rule and Student Academic Integrity Policy, HDR - Higher Degree Research Student Responsible Research Conduct Policy, Assessment Policy, and HDR - Encumbrances Procedure.

External audit

(46) UNE will present the annual financial statements to the NSW Audit Office for validation, and will participate in audits by the NSW Audit Office, and any other statutory agency as required.

Part D - Response to fraud and corruption

Reporting fraud and corruption

(47) UNE Representatives have a duty to report fraud and corruption, and the University encourages reporting of reasonable suspicions in relation to the University.

(48) UNE may have a statutory, regulatory or contractual obligation to report suspected fraud and/ or corruption to an external body or agency.

(49) UNE does not tolerate vexatious and/ or frivolous reports in relation to fraud or corruption, and may initiate disciplinary proceedings where reports of this nature are made.

(50) Reporting may be done by following the process outlined in the Reporting Wrongdoing at UNE Policy.

Complaint management

(51) UNE’s complaint management processes are designed to ensure that staff receiving complaints are trained to recognise complaints about fraud and corruption and the internal and external reporting processes that are available.

Exit interviews

(52) UNE’s exit interviews seeks to identify knowledge or reasonable suspicion the exiting employee has of potential fraudulent or corrupt conduct, including the conduct of the exiting employee, other internal UNE persons, and business associates of internal UNE persons.

Investigation of fraud and corruption

(53) The investigation of a report of possible wrongdoing to an authorised disclosure officer will be managed as outlined in the Reporting Wrongdoing at UNE Policy.

Responses to privacy concerns

(54) Concerns related to personal information held by the University will be address in accordance with the Privacy Management Rule.

Responsibilities

(55) The following table outlines responsibilities associated with this procedure:

(56) The following Table provides examples of functions and activities that are at risk of fraud and corruption, noting these are not exhaustive.

Section 3 - Authority and Compliance

(57) The Council, pursuant to Section 29 of the University of New England Act 1993 (NSW) makes this University Policy.

(58) The Policy Steward, Director Governance and University Secretary (DGUS), is authorised the develop supporting documents to support this Policy.

(59) This Policy operates as and from the Effective Date.

(60) Previous policy and plans on fraud and corruption controls are replaced and have no further operation from the Effective Date of this Policy.

(61) Notwithstanding the other provisions of this Policy, the Vice-Chancellor and Chief Executive Officer may approve an exception to this Policy where the Vice-Chancellor and Chief Executive Officer determines the application of this Policy would otherwise lead to an unfair, unreasonable or absurd outcome.  Approvals by the Vice-Chancellor and Chief Executive Officer under this clause must:

1. be documented in writing;
2. state the reason for the exception; and
3. be registered in the approved UNE electronic Records Management System (RMS) in accordance with the Records Management Rule.

Section 4 - Quality Assurance

(62) The implementation of this Policy will be supported and measured by UNE annually to ensure the level of understanding, engagement and application of this Policy meets expectations.