Higher education sector risk profile: What are the key risks faced by HEIs?

Against a dynamic political and economic backdrop, higher education institutions are experiencing an increasing level of change, which only looks set to continue in the year ahead. Managing risk and building institutional resilience is key for institutions to thrive.

What are the key risks facing higher education institutions and what are they doing to respond?

Our annual benchmarking study analyses the risk registers of a sample of 36 higher education institutions, highlights the most significant risks facing the sector and outlines how institutions are responding.

Key risks in 2017


Navigating an uncertain policy landscape

Policies changes including the Higher Education and Research Bill, the overall design of the HE regulatory framework and funding decisions around health and teacher education all add up to uncertainty for universities.  The implications of the Teaching Excellence Framework (TEF) on the ability of institutions to raise tuition fees, and potential differences to league table positions, are also causing concern.  On top of all of this, the UK’s decision to leave the EU has caused uncertainty, largely in terms of student and staff recruitment, research funding and the broader economic impact.


Delivering organisational change and transformation

Many institutions have embarked upon ambitious organisational change and transformation programmes, including addressing organisational structure and reporting lines, curriculum development, IT and corporate systems, and broader estates programmes.  Given the scale of these programmes and their importance to delivering institutional strategy, getting assurance over change and transformation programmes is critical.


Ensuring cyber and information security

While IT security has long been an area of concern, the broader risks around information and cyber security have moved up the agenda, particularly in light of the cyber-attack on the Janet network. The new General Data Protection Regulation (‘GDPR’), which will apply from May 2018, has raised the bar in terms of requirements, and also a maximum fine of 4% of total revenue for non-compliance, and will need proper consideration. Over the last year we have seen institutions investing in IT resilience. However, the debate around broader business continuity and crisis management arrangements remains a key consideration for many.


Managing information and data

The extent of data returns and information available to HE institutions is well known and likely to increase in the next few years. Leading institutions have set up dedicated management information and business intelligence functions, have automated data processes where possible, and are looking in to predictive analytics. However there is still scope for significant improvement for many institutions in using this information for more informed decision making and competitive advantage.


Engaging staff and developing organisational culture

Over the last year, institutions’ scoring of this has reduced in terms of potential impact, but likelihood of issues has become more probable. The link between staff engagement and the satisfaction of students is increasingly recognised. Whilst many institutions are scrutinising the impact of academic staff research and teaching, there is an important balance with maintaining engagement and a positive organisational culture. The extent of change and transformation programmes at higher education institutions means, for many, organisational culture is being recognised as a key area for management focus.

Higher education sector risk profile

Building resilience

Effective risk management is more important than ever to provide assurance to the governing body over the changing risk profile. Given the complexity and uncertainty of the risks institutions are facing, developing a broader approach to enterprise-wide resilience will be key to sustainability.


Higher Education sector risk profile 2017

Our annual benchmarking study analyses the risk registers of a sample of 36 higher education institutions, highlights the most significant risks facing the sector and outlines how institutions are responding.