Introduction
This article focuses on the role that risks, together with their prediction, management and mitigation, play in the regulation of higher education. We consider some general concepts of risk and the particular issues relating to risks in the English system of higher education, as regulated by the Office for Students (OfS). The article is informed by our practical experience of senior leadership, governance and consultancy in higher education over many years and we aim to offer insights into how risk management can operate in practice. We also discuss these within the theoretical perspective of New Public Management (NPM).
We recognize the dual role of risk in organizational life in higher education, which generates dilemmas for regulators and governors. That is, risk may be viewed as a source of potential hazard and harm, on the one hand, requiring mitigation and transfer, while also being a source of innovation, enterprise and value enhancement on the other. In competitive market-based systems of higher education, as found in Australia, England and the USA, for example, the biggest risk for a university is the inability to pursue any innovation at all while competitors scoot ahead. Risk aversion and low risk tolerance may seem to be the safest strategy of all to Boards of Governors, exhibiting high levels of caution in order to avoid all potential harms. Yet, continuous developments in external environments require actions and engagement with the world, which become unavoidable without some level of risk-taking.
The Context of Higher Education
Higher-education (HE) systems are complex and multi-dimensional. During the last 20 years or so, systems have expanded for the following reasons:
-
• a student-led demand for access to higher education;
-
• government initiatives to promote increased access to, and widening participation in, HE;
-
• government perceptions of HE as an instrument for national economic growth and regional regeneration.
This has resulted in a move from elite to mass systems of higher education (according to the definitions of Trow Reference Trow2007).
These mass systems are now mixed economies of public/private institutions, comprising a range of diverse institutional types and corporate forms – both non-profit and for-profit. These institutions (or providers) do not necessarily conform to traditional notions of a ‘university’ with its associations of scholarship, research and a collegium of academics as central to its purpose and governance model.
This move to mass systems of HE has been accompanied by some key changes fundamental to the approaches to funding and regulation, namely:
-
• The shift in funding from the state to individuals (wholly or in part) creating a student debt burden through repayable loans (or a state debt burden if loans are not repaid);
-
• Students are recast as consumers;
-
• Consumer choice is promoted by the availability of accurate and transparent information regarding the learning experience and qualifications offered;
-
• Student protection is perceived (by the regulator) as a critical duty of the provider;
-
• Enrolment at an institution is regarded as a contract between the student and the provider, with the recourse to dispute resolution and damages if the terms of the contract are breached;
-
• In an attempt to move from an approach which treats all providers in the same way, diverse and mass systems of HE have tended to adopt proportionate and risk-based systems of regulation.
New Public Management
New Public Management (NPM) is a term associated with the marketization of public goods and services. Its development was led by the UK in the 1980s, attempting to make the public sector more efficient by adopting private-sector management models and tools. It was also widely adopted by Australia and the USA, so is now in evidence in the Anglophone systems of higher education in these three countries, which also have significant volumes of trans-national education.
NPM reforms demonstrate the following characteristics in operation:
-
• A greater emphasis on ‘performance’;
-
• The measurement of outputs;
-
• Preference for lean, flat, small, specialized (disaggregated) organizational forms;
-
• The substitution of contracts for hierarchical relations as the principal coordinating device;
-
• Market-type mechanisms, including competitive tendering and public-sector league tables;
-
• A repositioning of service users as ‘customers’ and on the application of generic quality improvement techniques such as Total Quality Management.
Better Regulation and Risk Management
Coinciding with the adoption of NPM and the expansion of HE in the UK, as described above, there has been a change in the regulatory approaches to various sectors of public services and businesses, reflecting the principles of NPM. These new approaches, categorized as ‘better regulation’ and ‘risk management’ have been strongly promoted by the OECD and rest upon a set of assumptions that:
-
• Most organizations want to behave appropriately and comply with requirements;
-
• They will benefit more from advice and guidance than from the imposition of sanctions;
-
• Consequently, a more selective approach to monitoring and enforcement (by regulators) concentrates upon organizations presenting the greatest risk to the system, or their user/client groups.
This risk-based and proportionate approach enables the concentration of resources to where they will have the most impact, and should, therefore, result in more efficient outcomes, whether public or private. Generally speaking, this change in approach is accompanied by regulatory scrutiny, supported by consumer choice and market forces. It also promotes a shift in the cost of regulation from the public to the private purse, with a view that a sector should pay for its own regulation. It can be argued that the convergence of NPM and ‘better regulation’ have promoted a system of scrutiny and control that relies heavily upon performance management and the measurement of outcomes in relation to established benchmarks, all dependent upon the availability of accurate and current data. This emphasis on data and management information systems within higher education has had an impact upon the allocation of resources and management styles within institutions. Within the UK, the establishment of the Office for Students (OfS) in 2018 (as the regulator for higher education in England) reflects the adoption of these approaches, which will be discussed in more detail later.
The notion of proportional and risk-based regulation assumes that risks can be identified, managed and mitigated effectively by organizations. In higher-education institutions, this role is the responsibility of senior management and the Board of Governors, and the regulatory system of the OfS in England requires that specified conditions are met initially (controlling market entry) and on an ongoing basis (retaining registration). If these conditions are not met by institutions, market entry can be refused or granted with stipulations to be met, or sanctions can be imposed post registration, on transgressing HE providers, the ultimate sanction being de-registration.
The Nature of Risks in Higher Education: Prediction, Effective Management and Mitigation
Higher education operates within a volatile external environment, globally (especially for systems of trans-national education), nationally and at an institutional level. This volatility creates a range of different risks that will have different implications for systems of higher education and individual institutions.
In a risk-based system of regulation, regulatory bodies will need to ensure that risks are identified and managed appropriately at a system and individual level. This raises challenges and tensions regarding transparency and confidentiality, student/institutional protection, the safeguarding of public investment, and the profits of private businesses.
Risk prediction is not an exact science. It depends largely on individual and institutional behaviours, which are notoriously difficult to predict. However, many data sets are available to inform horizon scanning and the identification of potential risks, by regulators and institutions. It is expected that institutions will have risk registers in place, using a risk rating system, and subject to regular scrutiny and reporting. There is a tendency to regard risks as mainly financial issues, and risk management is often the responsibility of finance and audit committees within a governance structure. However, significant risks may arise in terms of academic and reputational issues, and consideration is needed as to where holistic risk management is best located within governance structures and processes. For a system of risk management to be effective, there are some essential pre-conditions:
-
• Data must be accurate, comprehensive, relevant and timely;
-
• Active consideration must be given to what might constitute potential risks and their likely impact;
-
• Appropriate mitigating action must be determined and implemented;
-
• A communication strategy regarding identified risks and actions should be devised and actioned (for all stakeholders);
-
• Reporting and follow-through should ensure that mitigating actions are monitored and evaluated (i.e., evaluation should be active and not just passively note problems!);
-
• Accountability – by whom, and for what, should be clearly established in the Terms of Reference for management and governance bodies.
The Regulation of English Higher Education and the OfS: Context of the Regulation Policy
During the past thirty plus years, since the Further and Higher Education Act (1992), there has been a considerable expansion of the higher-education sector in England, with a categorization of institutions as ‘recruiters’ and ‘selectors’ emerging. This expansion was a response by institutions to student demand, not always funded by increased teaching grants and with student number caps in place. The resultant pressures on funding were addressed to some extent by the introduction of tuition fees for undergraduate students in 1998, accompanied by a system of student loans, administered by the Student Loans Company (SLC).
Undergraduate tuition fees were subsequently increased substantially in 2006 and again in 2012, when the teaching grant was removed for all but strategically important subjects. The move to a marketization of the sector, with the ability to access student tuition fee payments from the SLC, encouraged a growth in the number of alternative providers (i.e., an alternative corporate form to universities, university colleges or further education colleges), and universities themselves can be chartered, statutory or corporate (i.e., designated in accordance with the Companies Act 2006). In 2015/16 the cap on the number of undergraduate students that could be recruited by institutions was removed.
The Higher Education and Research Act (HERA) 2017 was an attempt to encourage more diversity and innovation in the range of provision, by creating ‘a level playing field’ in terms of funding and regulation for higher-education providers, through a system of registration. It was intended to create a new regulatory framework for higher education, increase competition and student choice, ensure students receive value for money and strengthen the research sector. Part 1 established the OfS as the regulatory body for higher education, Part 2 amended prior legislation regarding student finance and the complaints procedure for students, and Part 3 established United Kingdom Research and Innovation (UKRI) with responsibilities for funding and regulating research.
In the publication Securing Student Success: Regulatory Framework for Higher Education in England (last updated 2022) the OfS sets out the following aspects of regulation:
-
• The OfS’s risk-based approach;
-
• Sector level regulation;
-
• Regulation of individual providers;
-
• Validation, degree awarding powers and university title;
-
• Guidance on general ongoing conditions of registration.
Comprehensive guidance is provided on the conditions of registration, and the principles-based approach emphasizes that the way in which a provider meets the conditions should be in relation to its size, context and mission. It is interesting to note that registration applies to ‘higher-education providers’ with ‘higher education’ defined by the Education Reform Act 1988, and no distinction is made between the designation of provider types, although university title is a protected term. Registration with the OfS operates as a gateway to HE market entry and confers access to funding for tuition fees (from the SLC) and to licensed sponsor status (from UKVI) for the recruitment of international students.
Where are We Now? The Current Size of the Higher-education Sector in England
Although HERA was intended to increase the number and nature of providers offering higher education, significantly smaller numbers of providers are now registered than initially expected (currently 427, of which fewer than half are universities). It should also be noted that many unregistered providers are also in operation, something that is currently a cause for concern, with a proposal that all providers with more than 300 students should apply for registration.
When the OfS was established in 2018, all existing and new higher-education providers in England had to apply for registration. According to data from the Higher Education Statistics Agency (HESA) the total number of HE students enrolled in England in the academic year 2023/24 was 2.9 million (2.05 million undergraduate and 850,000 postgraduate). The home element of this student population is funded by loans subject to income-contingent repayments (based upon earnings after graduation) and there is government concern that insufficient numbers of graduates are likely to repay their loans in full. The recruitment of international students (at uncapped fee levels) is significant to the financial viability of the higher-education sector in the UK, and recent reductions in this recruitment stream have contributed to the current financial pressures facing some large universities, resulting in proposed cuts to academic and administrative staff numbers.
Current Risks to English Higher Education: The System and Institutions
There are several current risks facing higher education generally, at the system level and for individual institutions. They occur as a consequence of a volatile and rapidly changing external environment internationally, together with some internal challenges to institutions. In England, there is concern that a number of large, established universities are facing significant financial problems. In May 2025, the OfS published its annual report on the Financial Sustainability of Higher Education Providers in England, showing the third consecutive year of decline in the financial stability of the sector, with 43% of providers having a financial deficit. One of the conclusions of the report was that overly optimistic predictions of student recruitment of home and international students is a significant risk to the finances of institutions.
Individual financial details are not made public by the OfS, but the fact that in December 2024 it was announced that applications for registration, degree awarding powers and university title would not be accepted until August 2025, is an indication of a significant risk level and the potential consequences. Additionally, consideration of all existing applications would be paused, so that resources could be concentrated upon dealing with financial concerns at providers.
At the time of writing (November 2025) there is no public admission that the OfS has yet intervened with financial support for a provider, although Sections 39–41 of HERA enable it to provide loans and grants to registered providers. These may be used for various purposes, in line with DfE priorities, and were used to provide financial support during the COVID pandemic.
The current government has stated that it will not bail out a university facing financial pressures, but this has yet to be formally tested. However, there are rumours that financial support is being provided to some universities. A recent article by Philip Augar (Chair of the Independent Panel Report to the Review of Post-18 Education and Funding, May 2019) published in the Financial Times, 13 August 2024, stated that:
Three quarters [of English higher-education providers] are expected to be loss making by 2025–2026, a handful are getting secret bail outs, and 10,000 jobs are under threat.
The current lack of transparency regarding financial support for universities in crisis (and the form this takes) is not helpful for the institutions concerned and the sector in general, leading to rumours and mistaken perceptions. It is particularly unhelpful to the future recruitment of students. It is likely that there would be encouragement for mergers and co-operative ventures, prior to any bailout, closure of campuses or market exit. In such events, Student Protections Plans should be in place, but these are not likely to be adequate, to protect students’ interests fully. This is an area of significant potential risk to the HE system, which may possibly unfold in the coming months; however, there are also some other issues arising from data analysis which illustrate potential risks which merit discussion. These are the following.
The £2 Billion Student Debt at Unregistered Providers
In response to a question in the House of Lords in April 2025, SLC data revealed that almost £2.6 billion in tuition fee loans (over the last three years) had been paid to students at providers who are not registered with the OfS. These data need unpicking to reveal the full story, but clearly such a significant sum of ‘off radar’ funding could constitute a risk to the English HE sector. Perhaps prompted by this issue, there are two separate proposals to strengthen the oversight and governance of sub-contractual (franchised) provision. The proposals, from the OfS and the Department for Education (DfE), include a new condition of registration that would shift responsibility for sub-contractual arrangements to the lead provider, where the franchise (delivery) partner has more than 100 students. There is also a separate proposal from the DfE to require franchise partners with more than 300 students to register with the OfS.
Qualifications Awarded
HESA (2025) data for Higher Education Student Statistics: UK 2023/24 identified a change in the balance of postgraduate taught qualifications awarded, compared with the total number of first degrees awarded. The total number of qualifications achieved in 2023/24 was 1,053,060 of these, 497,220 were PG and 465,240 were first degrees. The number of postgraduate taught qualifications obtained has increased markedly since 2019/20, rising by 15% between 2022/23 and 2023/24. Postgraduate taught qualifications became the most awarded qualification in 2023/24, surpassing first degrees for the first time since HESA records began. Again, the data need unpicking – UG student numbers are still significantly higher than PG (2056,520 compared with 847,905), but a shift to a greater proportion of PG students within an institution could represent a more volatile recruitment market, with one-year PG students replacing three-year UG students.
In addition to these risks regarding sector and institutional finances, demographics and reputation, there are also significant risks with regard to pedagogy, assessment and academic standards, which we discuss in the following.
Risk-based Regulation and the New Technology of Generative Artificial Intelligence (GAI)
In the current digital age, both the role of regulation and the governance of risk have increased in importance. Universities face rapid developments in technology, a growing reliance on digital services and the increased interconnectedness of global markets (Maggett Reference Maggett2025). Governors and regulators must be aware of risks (and opportunities) in issues such as data privacy, cybersecurity, machine learning, predictive analytics and the role of algorithms in decision making. Regulatory frameworks such as the European Union’s (EU’s) 2018 General Data Protection Regulation (GDPR) establish strong, even onerous, standards for data handling and privacy protection for individuals by organizations. In the wake of the EU’s recent Artificial Intelligence (AI) Act, which rests heavily on the precautionary principle, strict requirements are placed on high-risk applications (Moosa Reference Moosa2025). Regulators and governors must be vigilant and up-to-date with evolving technological and regulatory developments to stay compliant, whilst also seeking new possibilities for efficiency and effectiveness (Carden and Freeman Reference Carden and Freeman2025).
The US approach is more fragmented and sector-specific, with different agencies overseeing AI use, while also seeking an environment that facilitates and encourages innovation and technological advancement. The UK meanwhile seeks to establish a pro-innovation regulatory framework whose goal is to position the country as a global AI leader by relying on adaptive and principles-based regulation (Maggett Reference Maggett2025). Enterprise (or integrated) Risk Management (ERM), in which organizations benefit from the management of all risks together, potentially benefits from AI empowerment. Risk managers can access vast amounts of data holistically to make informed decisions and predict future risks accurately. Moreover, AI-enabled decision-making tools can enhance resource allocation, risk management and regulatory compliance.
Similarly, AI algorithms can perform tasks such as data entry, document processing and customer service more quickly and accurately than human labour (Hall and Carden Reference Hall, Carden, Carden and Freeman2025).
Universities, however, face a constant threat from cyberwarfare and the heightened need to protect the security of digital systems. Recent advances in generative artificial intelligence models raise new concerns around ethics, inequality, monopoly and social and other biases, as well as critical matters of increased unemployment and redundancy. Public authorities, including higher education, increasingly rely on AI models to improve productivity and raise service levels as well as calls to regulate their use.
Learning and Teaching in the GAI Age
GAI, not least Large Language Models (LLMs), possesses the ability to generate language content in a credible and coherent manner. In universities there has been a recent emergence of generative artificial intelligence models with an ability to undertake and deliver learning functions that traditionally have been the preserve of the teacher. Based on the convergence of powerful computer systems, the availability of massive amounts of data on the internet, together with machine learning capabilities and predictive analytics that can discern patterns and generate text-based responses, students are now able to use models such as ChatGPT to generate highly informed essays, solve complex problems and create other forms of output. These models have become increasingly expert at undertaking the tasks that students conventionally are asked to do as indications of their learning. As a result, academics and invigilators find it difficult to distinguish the output of machines from that of humans (Borthwick Reference Borthwick, Carden and Freeman2025).
This facility raises key issues for academic integrity and methods of assessment. Posing the question – how can we be sure that work submitted is generated by the student? Perhaps disclosure statements about the extent to which generative models have been used could accompany the submission of work, but it could be argued that such uncertainty requires forms of assessment relying more upon on-campus synchronous examinations such as presentations and vivas. Moreover, institutionally, there is increased conflict between the push for major technologically driven change and the conventional deliberateness and caution found in higher-education institutions, not least the enduring commitment to academic integrity and equitable access.
The risk of simply banning the use of GAI models is both unproductive and unlikely to be effective. The genie is now out of the bottle, and the task for academic leaders, teachers and regulators is to find ways of enabling students to use the new technology productively while at the same time mitigating the risks to academic integrity and equitable assessment. Carden and Freeman (Reference Carden and Freeman2025) also asserts that GAI can augment and automate strategy processes in universities. It provides rapid and extensive analyses of the external environment offering real-time insights into market conditions, competitive positioning and global trends that previously were more difficult to obtain.
In risk-based regulatory conditions, this allows actors to engage in more powerful, dynamic and informed scenario planning and predictive modelling than previously. In the area of professional services, AI has the ability to perform repetitive, rules-based and high-volume tasks with greater efficiency and effectiveness than humans. Risks arise, however, from the need to provide ethical guardrails, ensuring compliance with data regulations and mitigating forms of bias and hazard. Additionally, universities may lack the quality and depth of available data to train AI models effectively. Integrated data architectures are also required to use AI effectively – such as automating document processing and data transfers across systems – with sufficient risk mitigation.
Regulating this new technology varies from institution to institution, but codes and examples of good practice are emerging from representative groups (the Committee of University Chairs, Universities UK, the Russell Group) as well as specialist bodies such as JISC and regulators such as the OfS. This should support forms of risk-based governance of the new technology to proceed in institutions without potential reputational hazard or loss of market competitiveness (Lapworth Reference Lapworth2025).
Counter to posing risks, GAI has the ability to improve organizational effectiveness and eliminate some of the routine support relating to issues of first-level responses to student and other customer enquiries. It could also support the governance task of predictive risk management by conducting regular scanning and reporting on competitor positioning and changing regulatory requirements. The types of risk discussed in this article are symptomatic of the volatility and unpredictable behaviours of which institutions need to be aware and include in their strategic planning and risk assessment.
Conclusion: A New Terminology for Risks and Education
In conclusion, it is apparent that universities face many different risks in a volatile environment, which need a creative and proactive approach to their prediction, management and mitigation. Undoubtedly, risk-based regulation and governance for universities in the world of new GAI technology remains both a source of innovation and enterprise as well as a source of enhanced hazard.
The current climate of higher education begs the question – is it time for a new dialogue regarding risks? As stated initially, risk assessment is not an exact science, and a more subtle and nuanced terminology may be appropriate to articulate the consideration of risks and mitigations.
In a recent paper on Regulatory Reform for University Success by Hamish Coates (Reference Coates2025) for the Higher Education Futures Lab, a different terminology for constructive dialogues is suggested. Coates argues that as higher-education systems have developed into quasi-markets, a regulatory approach based on standards and risk assessment has favoured a discourse style favouring lawyers and consultants. Although writing about the Australian system, this description is also applicable to the English system of regulating higher education. There is a danger that compliance with regulatory standards can narrow the strategic gaze of institutions and foster risk aversion in relation to intellectual experimentation and external challenges. It is suggested that ‘freshening the dialogue’ amongst all stakeholders (including teachers and students), as indicated in Figure 1, would promote change to enable universities to better meet the needs of students, communities and national systems of higher education.
Fresh dialogues among stakeholders to promote change.

These fresh dialogues are more in keeping with the terminology associated with research evaluation, especially in the UK Research Excellence Framework (REF), which considers qualitative evidence of impact narratives and direction of travel. If adopted, a more coherent, integrated and complimentary approach to teaching, research and overall performance in higher education could possibly result.
Elizabeth Halford is currently an independent consultant in higher education, working with institutions and government agencies in the UK, Canada, USA and Australia on issues of regulation and quality assurance. She was previously Head of Research and Intelligence for the UK Quality Assurance Agency for Higher Education (2012–2016) and has many years of experience in senior leadership and governance roles in public and private higher-education institutions. She is the author of several published conference papers and books on the political economy of higher education, including as a contributor to the Research Handbook on the Politics of Higher Education, published by Edward Elgar, July 2018, and online articles for the Higher Education Policy Institute (HEPI) and Wonkhe.
Roger King is currently a Visiting Professor at the University of Bath (since 2009) and a Research Associate at the London School of Economics and Political Science (Centre for the Analysis of Risk and Regulation) since 2004. He was previously the Vice Chancellor at the University of Humberside (UK) 1989–1996, then the founding Vice Chancellor of the University of Lincoln (1996–2001). He was also the founding Chair of the Institute for Learning and Teaching in Higher Education and a member of the independent, cross-political party Higher Education Commission, co-authoring its report, Regulating Higher Education (2013). He has considerable experience in university governance and consultancy in the UK and internationally and is the author of various books and articles on higher-education policy, governance and regulation, the most recent as an editor of Research Handbook on the Politics of Higher Education, published by Edward Elgar, July 2018.