Higher Education Strategic Risk Analysis Report 2025/26 22 2.8 Risk with the largest increases in inherent risk scores (partnerships, IT and digital estates, and UK government policy) Partnership risks: over the last four years partnership risks (which primarily cover domestic and transnational education partnerships) have been appearing on strategic risk registers with greater frequency, up from 41% in 2022/23 to 60% in 2025/26. The average inherent risk score has also increased substantially this year. Risks in this area predominantly relate to partnership management, the delivery of quality outcomes, and realisation of planned income. The elevation of partnership risks to strategic risk registers is likely, at least in part, to reflect growing government and regulatory scrutiny of the value for money to the taxpayer and anticipated strengthening of regulatory controls. Following several investigations, the OfS has consulted on a new regulatory condition requiring lead institutions to strengthen their oversight and transparency. OfS has also asked governing bodies to consider risks associated with third party and off-campus delivery to ensure that due diligence is effective and to minimise overreliance on individual sources of partnership income. Audit committees should satisfy themselves about the effective oversight and management of UK and international partnerships, including the quality of the student experience and student outcomes. IT and digital estate risks: in the last three years there has been a notable increase in institutions recognising IT and digital risks in their strategic risk register (from 47% in 2023/24 to 80% in 2025/26). 2025/26 also sees a substantial increase in average inherent risk score. Risks in this theme tend to fall into three broad areas: • risks caused by potential failure, fragmentation, and inadequate capability of the existing technology estate; • risks around failure to deliver planned improvements at pace to realise service improvements and efficiency benefits; and • risks of not capitalising on new technologies and especially AI. Increased risk is likely to reflect the ongoing challenges some institutions face in maintaining aging and unsupported systems, working with suboptimal digital and data architecture, and undertaking major process re-engineering and core systems replacement while maintaining operational effectiveness and needing to contain operating costs. As recent insight shows,17 use of AI in HE is expanding rapidly, with over 50% of institutions using AI for teaching preparation and delivery, and over 30% using AI for student assessment and corporate reporting. Rapid and effective utilisation of AI is likely to be a key differentiator of university success, and therefore poses a strategic risk for institutions who are underprepared or slow to take advantage. Audit committees should ensure that they understand the core IT systems employed at their institution, and how AI is governed and used in a responsible and ethical way. UK policy environment risks: our analysis shows that the third largest increase in average inherent risk scores in 2025/26 relates to the UK policy environment. While this features on just over half of institutional risk registers, specific concerns are institution dependent and relate to areas such as: • potential adverse impacts of policy changes on international student recruitment; • government policies favouring some subject areas over others; and • the ability to realise opportunities from regional devolution. This an area where we observe a particularly high degree of variability in normalised inherent risk scores between institutions, suggesting that the elevated average risk score is likely to be driven by concerns at a small number of institutions. Additionally, just over half of institutions in our sample also cite OfS compliance as a strategic risk. Institutions typically describe the risk in general compliance terms or highlight risks relating to individual conditions of registration such as harassment and sexual misconduct, student outcomes, or delivery of access and participation plan targets. 17 https://nationalcentreforai.jiscinvolve.org/wp/2025/05/01/ai-andjiscs-leadership-survey-2025/
RkJQdWJsaXNoZXIy NTI5NzM=