MANAGING RISK IN HIGHER EDUCATION HIGHER EDUCATION SECTOR RISK PROFILE 2018 - PWC
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Managing risk in
Higher Education
Higher Education
Sector risk profile
2018
Education Risk
Assurance Services
March 2018
Contents Introduction and scope 1 Risk trends 2018 2 The student perspective 5 2018 Risk profiles 6 Appendix – Risk themes and sub-categories 7
Introduction and scope Risk trends 2018
Introduction The sector is grappling with a cultural
change as students view themselves as
This paper aims to add to the discussion
on risk at institutions, by giving a view
consumers with the associated need to of what’s on others’ minds as expressed
Arguably the Higher continuously improve the student through their risk registers. We have
Education sector is going experience (only 32% of students from also added comment on the students’
England think they achieve good value perception based upon work we did with
through one of its most from their courses1) but without diluting our interns in the summer of 2017 by
turbulent periods for a academic quality. In addition, the sector asking them “what do you want from the
needs to ensure it is still managing the university of tomorrow?”
generation. This includes traditional but potentially high risk
increasing scrutiny on the compliance areas such as UK Visas and Our sample, scope
cost of a university degree; Immigration (UKVI), Competition and
Markets Authority requirements,
and methodology Year on Year trends
vice-chancellor pay and Prevent legislation, business continuity We have reviewed the risk registers from As we have undertaken this analysis for a number of
and health and safety. 37 Higher Education institutions. We
benefits; the new regulatory years now, we summarise the top five risk themes for the
With such an uncertain and risky reviewed all the risks in each risk
framework aimed at environment it is more important than register identifying those similar in last five years to provide a multi-year view on how they
‘championing the interests ever to have effective risk management nature and categorising the group of risk
embedded in to a university’s decision to a risk theme. The average likelihood have evolved. The risk of student under recruitment has
of students, promoting making processes. Effective risk and impact was calculated for each risk been a constant presence in the top five. Not surprisingly
choice and ensuring students management should ensure category to identify those themes
management and governing bodies are identified as being of higher risk. The financial sustainability and pensions have been
receive a good deal for their focused on the areas that matter, detailed findings of our analysis are set common themes, with pensions hitting top spot for
investment;’ financial understand the risks they face, how they out in the remainder of this paper; this
are being managed and whether the includes commentary on the top risk 2018, whilst the political uncertainty in recent years
uncertainty with the actions to mitigate risk are having an themes, a comparison with prior years, is also reflected.
upcoming review of funding impact. To some extent current risks are and the types of individual risks
driven by factors outside of a included within each theme.
and the ongoing Brexit university’s control and it is about how
negotiations. both individual institutions and the
sector as a whole have the ability to
Top 5 risks
respond to the challenges ahead. 2014 2015 2016 2017 2018
Arguably the Higher Education sector
is riskier now than it has ever been. 1 Student recruitment Student recruitment Student recruitment Government policy and Pensions
and financial political landscape
sustainability
2 Research funding and Research funding and Government policy, Brexit Government policy/
quality quality public funding and political landscape
sector reform
3 Pension deficits and Funding body grant Investment in IT, Financial sustainability Student recruitment
affordability reductions cyber security, data
and management
information
4 Tuition fee pricing Government policy Significant investment Student recruitment Reputation
and political landscape and transformational
change programmes
5 Information systems Pension deficits and Research funding and Organisational change Information security/
and technology affordability quality and transformation cyber
programmes
1 Student Academic Experience Survey, HEA/HEPI, June 2017
1 Managing risk in Higher Education Higher Education Sector risk profile – 2018 2
Key risks facing the sector 2018
As with previous years, cost inflation Whilst a number of institutions are
Our review has sought Government policy/political Student recruitment Information/cyber security
pressures and the need to achieve looking at developing business
landscape The lifeblood for many institutions, The onset of the need to be GDPR
to understand the most The current political instability and student recruitment remains a constant compliant and the ever increasing and efficiency savings are identified risks; intelligence strategies and how
however it is clear the biggest worry to management information therefore
significant risk areas as uncertainty around government policy on risk registers. Whilst in previous complex threat of cyber-attacks has
universities is the risk of reducing can be improved, the sector does, in our
is seen as a major risk. This uncertainty years there have been specific concerns meant Information Security has re-
assessed by institutions to some extent reflects how tuition fees around postgraduate or international entered the top five risks identified income. Specific examples include opinion, lag behind in this area. As the
potential cuts in government funding, operating environment becomes more
and sector trends. Here became one of the central themes of the recruitment, now the risk appears to be by institutions. In our experience,
the inability to grow income through volatile, having real time, accurate
2017 General Election and the perceived present across all areas of recruitment. institutions are making good strides
we provide a commentary influence of the student vote. A number This may be reflective of an increasingly towards GDPR compliance. Generally, commercial and non-academic income, information on which decisions can
missing student fees and research be based is becoming increasingly
on the key risk themes of factors are driving this risk including competitive market with changing management and governing bodies have
income targets. It appears institutions important.
the government review of tuition fees demographics and an overall reduction a good overview of this risk area,
identified from our analysis. and future funding, the risk (and in applications for places, particularly including those that are transparent are acutely aware that a failure to
Business continuity
opportunity) higher apprenticeship for nursing places and mature students. they will not achieve compliance by the reduce costs and increase income
To some extent the fact this risk has
degrees bring; the new regulatory But it is not just about numbers, many 25 May 2018 deadline. The use of growth will seriously impinge on
increased is a symptom of institutions
framework as the Office for Students universities are concerned about phishing, ransomware and denial of institutions’ future investment in
becoming more aware of the need to
comes in to being and recent ministerial maintaining entry grades and quality service attacks on institutions are on infrastructure and facilities.
improve organisational resilience
changes. There is an acceptance at both undergraduate and postgraduate the increase, the motives being to obtain Teaching Excellence against a significant business
universities need to be agile to respond level, possibly an indication of taking sensitive student or staff personal data Framework (‘TEF’) disruption; but also reflecting the
quickly to an ever changing political a longer term view of ensuring higher or commercially sensitive research data. Reflecting the need for institutions to increasing national risks around terror
environment and a number have retention and progression rates. As the technology and methods used enhance and protect their reputation in related incidents. We are certainly
identified not being able to respond by hackers change, it is important for an increasingly competitive student noting a number of universities
quickly enough as a risk. The ability of Reputation institutions to ensure they have an market, the need to improve or simply becoming more aware of their
institutions and the sector to positively Given some of the bad publicity the effective information security maintain institutions’ TEF category vulnerabilities and becoming more
influence policy making is also seen as Higher Education sector has received framework. Information security is not remains high on risk registers. Whatever prepared for security incidents;
a risk. From a regional perspective how over the last twelve months it is, to some purely about technology; equally as institutions’ thoughts are on the merits although we still see varied practice
well universities are identifying and extent, no surprise that specific risks on important is the need to instil the right of the TEF process there does seem to when it comes to scenario planning and
exploiting the opportunities that come reputation have moved up risk registers. behaviours in staff through awareness be an acceptance that an institution’s incident testing.
with devolution is also a common Institutions have listed a number of and training, as well as having the TEF category can have both a positive
theme. factors impacting on this risk theme, necessary physical security in place. Other areas of note
and negative impact on their
and to some extent many are linked to But, in a sector which relies on Although not in the top 10 risks,
competitive position.
other risk themes in this document; openness, partnership and cooperation, organisational change and
although the overriding concern is about getting the right balance of academic Poor MI/data quality transformation programmes remain on
protecting stakeholder confidence and student freedom whilst ensuring As the move towards greater the agenda. So too are compliance
including students, the regulator, effective information security, is an transparency continues apace and more areas, which whilst are assessed to have
funders and partners. Our view is that issue institutions continue to grapple and more data is made available a low likelihood can have a significant
this may lead to institutions becoming with. publicly, the requirement to ensure impact, including UKVI, Health & Safety
more active in how they manage their the accuracy and quality of such data and Prevent. Staff related risks are also
reputation, not just in terms of Financial sustainability continues to be an issue. moving up risk registers, most notably
protecting against damage to it, but also (including pensions) industrial relations as well as risks
Throughout our work across the UK,
in more clearly showing the value they The perennial risk area of Financial around staff development and
we continue to identify issues related
create. Sustainability remains high on risk performance to facilitate a move
to the lack of effective data quality
registers, with Pensions being deemed towards a culture of high performance.
frameworks. We’ve noted issues around
as the highest individual risk facing the Finally, is the sector coming to terms
the need to ensure a culture of ensuring
sector at the moment. Whilst pension with the potential impact of Brexit?
data input at source is right first time,
risk is linked to current scheme deficits Brexit has significantly fallen down the
every time; a lack of clarity on who is
and potential upward pressure on costs, rankings this year.
responsible for the quality of data or the
there is also a clear link with another
process and controls around the data
increasing risk area: industrial relations.
submissions themselves.
3 Managing risk in Higher Education Higher Education Sector risk profile – 2018 4
The student perspective
In the summer of 2017, we
took the opportunity to ask
1 Technology
For our student interns the use of
2 Transparency
There has certainly been a shift in their
3 The importance
of place
Many of the interns recognised the
4 Collaboration
The students had viewed working
5 Wellbeing
An area is that starting to appear on risk
our student interns what technology has become second nature to perception of themselves as customers importance of making a positive impact together across multiple disciplines as registers there was a desire to support
them whether this be for studying, into stakeholders that are looking to in their local communities, using their another way to enhance their degree fellow students on issues such as mental
they would want from the socialising or even banking. They realise influence the strategic direction of their local area as a source of inspiration for courses and broaden their horizons. health and housing. Indeed the view
‘university of tomorrow’ and the importance of technology and universities as well as obtain value for their ideas and another way to add value They saw the development of projects was student welfare should be at the
understand its potential impact within money. An overriding view was students to their degrees and employability after across disciplines as a way of developing heart of university life.
challenged them to work the coming years. They identified are kept in the dark over how and where graduation. their employability skills.
together to bring their ideas artificial intelligence as something the university spends their money and Many want universities to have a,
universities should be embracing to give therefore struggle to see the value of “comprehensive sustainability strategy
to life. Whilst not necessarily students a better learning experience. their investment. that acknowledges the institution’s
expressed in the language responsibility to wider society and
increases its resilience in the current
of risk, the insight they uncertain economic and political
provided does signpost a climate.”
number of areas that
arguably should be
appearing on risk registers
over the coming months.
Five specific themes were
identified:
The full report can
be found here:
www.pwc.co.uk/
studentsvoice
5 Managing risk in Higher Education Higher Education Sector risk profile – 2018 62018 Risk profiles
2018 Higher Education sector risk profile
0.90
UKVI Compliance
0.85
Teaching Excellence Framework
0.80
Health and Safety
Poor MI / Data Quality
Business Continuity (excl Cyber)
Student Recruitment
Average Impact
0.75
Compliance with legislative Financial sustainability
requiremets Culture and staff performance Pensions
and development Information Security Reputation
/ Cyber
Estate Investment / Delivery Prevent Strategy
of Capital Programmes Change Programmes/Projects
0.70
Employability Student
experience Research and Enterprise Government policy/political
landscape
IT Infrastructure
International
0.65 Academic Quality
Brexit
Partnerships International strategy
Governance and
leadership
0.60 Staff Recruitment and Retention Industrial Relations
Strategic Decision Making Course Portfolio Management
and Implementation
0.55
0.45 0.50 0.55 0.60 0.65 0.70 0.75
Average Likelihood
7 Managing risk in Higher Education Higher Education Sector risk profile – 2018 8Appendix – Risk themes and sub-
categories
Below we summarise some of the anonymised risks included on institutional risk registers to give some context for the
individual risks within risk themes. This is not an exhaustive list, and is included for illustrative purposes.
Risk theme Sub-categories of risk Risk theme Sub-categories of risk
Government policy/ • If the political environment does not result in a coherent and supportive policy framework for HE. Pensions • Meeting increased costs in payroll cost inflation and pension provision becomes financially
political landscape • Developments in government policy/legislation developments impact on the university resulting in a unsustainable.
loss of competitive position relative to international/UK peer institutions. • Continued USS funding pressures despite changes already made to the scheme.
• The results of future government spending reviews and/or government policy changes are uncertain • Staff pension scheme deficit increases.
and may result in further changes to the HE sector funding system. • Changes to USS pension resulting in potential for liabilities to the university.
• That changes in government policy impacts the funding model for research and teaching and results • If the pension scheme deficit has a continuing adverse impact on the balance sheet.
in a reduction in university income.
• That the pension scheme leads to significant and potentially unstable costs now and in perpetuity,
Student recruitment • Growth in on-campus and distance learning student recruitment fails to achieve targets, leading to and may have an impact on borrowing.
loss of competitive position in the UK and internationally. • The cost of providing the current defined benefit pension schemes may escalate to such an extent
• Failure to achieve our Home/EU undergraduate recruitment targets which encompass number and that it significantly impacts on the university’s ability to invest in critical aspects of teaching quality,
quality. student experience and estate.
• Ability to recruit students to meet agreed growth targets. Financial • The threat to sources of public funding.
• Ability to meet the required improvements in application rates to support improved numbers and sustainability • The inability to win profitable contracts across the range of the university’s areas of focus.
selectivity.
• The university fails to achieve sustainability by maintaining, growing and diversifying income
• Attractiveness to potential students affected by ongoing pressures on student life [costs and career streams.
outcomes] resulting in failure to meet recruitment targets.
• Lack of long term financial sustainability.
• Home and EU Undergraduate student recruitment – The university fails to recruit the target number
• The university has insufficient finance to achieve strategy and cover new development objectives.
of Home and EU students.
• If university Sponsored Schools underperform, then all parties concerned may experience major
• Decline in home applicant pool and reduction in domestic demand for Arts Design subjects.
incidences and financial complications.
Reputation • The reputation of the university is not at a level to align with the aspirations of the strategic plan. • If loss of NHS funding for courses in Health and Well Being is not addressed.
• Through student recruitment, staff recruitment, collaboration or a business relationship, the • Inability to develop commercial income or contribution as per plan.
university establishes links with a country, person, organisation etc. that may damage its reputation. • Failure to address rising costs has an adverse impact on the university’s academic excellence,
• The perception of the university by external bodies, informed by league table positions and other reputation and financial sustainability.
metrics within an increasingly competitive environment, may impede our ability to attract, retain
and develop research-active staff of sufficient calibre to maintain and grow our research reputation Teaching Excellence • Continuing low Teaching Excellence Framework (‘TEF’) categorisation at institution/subject levels.
and income. Framework • Failure to achieve high standing in the TEF.
Information • Failure to implement effective controls to avoid breaches of General Data Protection Regulation • The university fails to maintain a significant profile for Teaching Excellence.
Security/Cyber (‘GDPR’). • Initial and sustained low TEF rating relative to comparators.
• If the university does not comply with the General Data Protection Regulations by May 2018. • Correlation between low rating and lower fee rate.
• If cyber security measures do not provide adequate protection. • The university has not achieved ‘Gold’ in the TEF by the time tuition fees are linked to the TEF.
• Information security – systems are compromised or fail to deliver services. • Poor TEF rating impacts on reputation, finances and market position.
• That the Institution is subject to a cyber-attack or other event that compromises its systems and data • Academic and financial difficulties and tensions created by poor placement of the university in the
to a catastrophic extent. TEF.
• Deterioration/loss of information assets and data. Poor quality • Failure of quality recording, collection and utilisation of our data or accuracy of our operating
• As a result of a failure in IT security and/or governance, the university suffers a major data loss, management information.
breach of security or loss of systems availability. Specific attention is drawn to consequences of information/data • Management Information is not meaningful, reliable, or does not triangulate for internal decision or
breach of the General Data Protection Regulation. external reporting.
• Failure to maintain sufficient cyber and information security impacts negatively on institutional • Data management. university is ineffective with regard to data management leading to audit issues.
reputation has adverse financial implications and a detrimental impact on learning, teaching and
• Failure to provide accurate and complete operational/student management information leading to
research.
disruption to support services.
• Corporate and personal data not accessed or stored securely, or processed appropriately.
• That data is not sufficiently integrated to support strategic planning and decision making.
• Inadequate and ineffective data management and quality assurance.
9 Managing risk in Higher Education Higher Education Sector risk profile – 2018 10Risk theme Sub-categories of risk Risk theme Sub-categories of risk
Business continuity • External incident compromises campus operations or access. Health and safety • The university does not provide a safe working/studying environment.
(excluding Cyber) • Failure to operate due to severe business disruption or sudden environmental change. • The university fails to comply with legislation, regulations and duty of care obligations.
• Loss of moveable assets resulting in inability of the University to function properly and to provide • That the institution fails to comply with the Health and Safety at Work Act.
satisfactory services to students. • Failure to effectively manage health and safety with consequent risk or damage to staff and
• Poor resilience/protection of key University assets that might be affected by power failures; harmful students.
effect on productivity, research, health and safety, IT and reputation. • If the university does not comply with National and International Health and Safety Laws and
• If the University does not respond effectively to Major Disruptions, Damage to its Operations, Regulations then legal action could be pursued by third parties.
Damage to its Infrastructure and/or Staff or Student related Critical Incidents, then there may be • That failure to comply with The Regulatory Reform (Fire Safety) Order (RRO) 2005 leads to closure
detrimental consequences to the Institution. of buildings, enforcement and prosecution.
• If emergency management and business continuity planning fail to respond effectively to an
unexpected event. Prevent There is a perceived loss of human rights/freedom of speech due to Prevent activity in the university.
Indication of this might include:
Brexit • If the UK Government fulfils the commitment to withdraw from the EU. • Breakdown in relationship with trades unions and/or students’ union.
• Impact of EU Referendum result on operating conditions and market trends. • Campus events no longer organised on campus.
• Impact of Brexit on staff retention and recruitment, student recruitment and research income. • Complaints from academic colleagues.
• If the University does not manage the impact of the exit from the European Union effectively, then • Unauthorised event takes places under university auspices.
we may encounter a series of adverse repercussions.
• Delivery of the Prevent duty dilutes academic freedom and/or freedom of speech.
• Reduction in demand from EU students post Brexit.
• Delays in producing and delivering training materials.
• Brexit – loss of EU students and staff and research funding, collapse of negotiations.
• Failure to prevent radicalisation of students and promotion of extremism (Prevent).
• The UK’s decision to leave the EU may adversely impact upon EU staff/student recruitment, research
income and collaborative activities. Industrial relations • Employee relations deteriorate to a level which leads to disruption or inability to deliver either
• Impact of Brexit: economic uncertainty, in particular market impact on pensions and investments. critical activity or ‘core businesses’.
• Poor employee experience leading to industrial action.
Organisational • Failure to deliver major strategically high profile development projects on time and to budget.
• Interruption to research and education activity due to industrial action.
change and • Inadequate implementation of major projects both individually and as a combined programme of
transformation • If academic staff participate in Industrial Action then it may cause disruption to the university’s
activity leads to a failure to implement change effectively.
services and provisions.
• Failure to deliver returns on strategic capital and academic investments.
• Staff or Union industrial action disrupts business continuity and damages staff/union relationships.
• Failure to effectively manage transformational change, results in disengaged staff, which adversely
• Failure to manage the negative consequences of a failure in good campus relations, e.g. industrial
impacts on the reputation of the University as an employer of choice.
action, student protests or extremism.
• Failure to identify suitable software and suppliers.
• Failure to prepare for and respond to national or local level industrial action impacts on the
• Procurement and/or implementation of new systems does not proceed to intended timescales or university’s ability to operate and has a negative impact on our reputation.
costings.
• Failure to implement as intended due to pressures of ‘business as usual’ activities. Culture, staff • Lack of engagement with continuing professional development to support high quality teaching and
performance and research.
• Failure to deliver intended efficiencies in administration. development • If performance in areas of weakness identified in the staff survey does not improve.
• New systems fail to secure buy-in and support from staff.
• Poor productivity and/or insufficient capacity for teaching and research and student contact.
UKVI compliance • If compliance with UKVI requirements is not maintained, then we may not be able to Recruit • Failure to develop leadership capability in academic and professional service staff.
International Students as a consequence of a downgrade in our Sponsors Licence.
• Low staff engagement impacts performance negatively.
• The university must ensure that visa refusals, completions and registrations comply with UKVI
• Failure to appropriately develop staff in line with strategic plan.
requirements.
• We fail to achieve a high-performance culture, and ensure our workforce, management and
• Further changes to visa regulations may impinge on ability to recruit international students.
governance are effective for delivery of the strategy.
• Failure to remain below the Home Office’s defined levels of acceptable non-enrolment, visa refusal,
• That we fail to promote staff development and to tackle poor performance, leading to
and course completion rates per annum, or failure to satisfy UKVI auditors that the university meets
disenchantment of high performing staff and a staffing model that does not deliver effectively
all its responsibilities as a Tier 4 sponsor.
against the university’s requirements.
• The university community includes students and/or employs staff that do not comply with
requirements of UK Visa and Immigration, resulting in reputational damage and loss of overseas
students.
11 Managing risk in Higher Education Higher Education Sector risk profile – 2018 12Contacts Ian Looker Ian Roberts Chris Monk National Education Lead Partner Senior Manager Senior Manager T: +44 (0)1132 882 019 T: +44(0)7738 310 054 T: +44(0)7710 396 621 E: ian.looker@pwc.com E: ian.d.roberts@pwc.com E: chris.g.monk@pwc.com www.pwc.co.uk/education This publication has been prepared for general guidance on matters of interest only, and does not constitute professional advice. You should not act upon the information contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is given as to the accuracy or completeness of the information contained in this publication, and, to the extent permitted by law, PricewaterhouseCoopers LLP, its members, employees and agents do not accept or assume any liability, responsibility or duty of care for any consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it. © 2018 PricewaterhouseCoopers LLP. All rights reserved. In this document, “PwC” refers to the UK member firm, and may sometimes refer to the PwC network. Each member firm is a separate legal entity. Please see www.pwc.com/structure for further details. 180228-170004-ON-UK
You can also read
