Risk Ratings: Examples of Relevant Context and Provider Controls that TEQSA Considers

Purpose and Background

TEQSA’s Risk Assessment Framework (RAF) outlines TEQSA’s approach for undertaking risk assessments of higher education providers, including the set of risk indicators used. Risk ratings for indicators are derived by TEQSA giving consideration to risk thresholds and the specific circumstances of providers. This includes contextual information about the provider and information on the provider’s own risk controls, where known to TEQSA. If TEQSA identifies potential risks, the provider is invited to discuss the risks and offer any further evidence that may impact the risk assessment.

This document provides examples of context and provider controls that may be taken into account by TEQSA in rating a risk indicator, to assist providers in participating in TEQSA’s risk assessment process.

Examples of Relevant Evidence and Context

In considering the examples below, please note the following:

• These examples are not exhaustive, restrictive or directive.
• Evidence that demonstrates the effectiveness of strategies/risk controls (e.g. a report from the provider’s own systematic and timely review process with data showing positive results), carries more weight than a general, narrative description.
• Different levels of evidence may be required to change a risk rating, depending on the significance of the issue and context of the provider (i.e. in some cases a combination of factors may support an adjustment to a risk rating).
• These examples focus on information that may lead to a positive change in rating. There may be times when TEQSA upgrades a risk flag (i.e. higher risk rating) based on broader information.
• TEQSA takes into account a provider’s regulatory history as part of the risk assessment process. This would include any findings from recent regulatory processes about the provider’s own risk management capability.