Over the summer, the Office for Students (OfS) announced a new risk assessment framework intended to guide the regulator’s assessments of providers’ financial viability and sustainability.
Setting out an approach in this way addresses an implied demand for consistency and transparency in exercising regulatory judgement – understandable when the stakes are so high for providers facing financial difficulty. What the framework does not do, is change OfS’ powers of intervention in cases of providers whose financial resilience and sustainability is judged to be at significant risk. Only a change in the law can change OfS’ enforcement powers.
The distinction is an important one because there is a risk that third party stakeholders start using OfS’ framework and, more specifically, OfS’s risk categories, as trigger events for their own enforcement powers.
OfS’ powers are relatively limited – although “pausing OfS funding in the interests of protecting public funding” is one of the interventions which providers might expect from the regulator if they are assessed as being in Category 4/“Acute financial concerns.” If, at the same time, a Category 4 assessment triggered a lender to demand early repayment, the result could feasibly be to tip providers into insolvency.
Risk based regulation
Under the new framework, OfS will place providers into one of five risk categories, ranging from Category 1/“No financial concerns” to Category 5/“Market exit.” This approach offers a marked contrast to the regulatory framework overall, which states in para 126 that OfS will not assign an overall summative risk rating or classification to an individual provider. While that statement is probably still true in a strict sense – the new risk categories are only looking at financial risk – the express acknowledgment that these categories exist and that they are assessing the topic which is on everyone’s lips at the moment is surely going to pique some interest.
OfS lists five different financial metrics that it will be looking at together with non-financial metrics – for example, capital expenditure requirements, headroom on lending covenants and refinancing risk. Banks and other lenders might typically focus on a slightly smaller number of metrics. Clearly (and understandably) OfS wants to give the impression that it is taking a broader view to account for institutional diversity and context.
Crucially, OfS is not publishing the thresholds for each metric. Whether that is the right approach is a question for chief financial officers and finance professionals to consider. The answer, I suspect, is likely to depend on how the metrics are used and the debates that are likely to ensue between the regulator and individual providers about what the “right” number might look like. At present, we have no visibility on how many providers might currently be in each category.
Categorical consequences
In addition to the financial indicators, the framework also sets out the “typical” financial characteristics in each category and a description of what providers can expect from their regulator in terms of monitoring, engagement, and intervention in each risk category.
Providers in Category 1/“No financial concerns”) or Category 2/“Possible financial concerns” can largely sleep soundly at night. OfS tells us:
“Providers in categories 1 and 2 should expect engagement…to be minimal and limited to routine regulatory interactions, with no enhanced monitoring or additional regulatory intervention unless new risks emerge.”
Providers in Categories 3 /“Actual financial concerns” and 4/“Acute financial concerns” won’t be so lucky. In those situations, OfS will communicate with the accountable officer and chair of the governing body to discuss OfS’ judgement and what that will mean in terms of further action.
Providers in Category 4 can typically expect a Student Protection Direction (SPD) to be in their immediate future. We have previously explained why SPDs aren’t necessarily fit for purpose in the real world. The concern, more generally, is that with a regulator who, as the framework is at pains to point out, “does not have a duty, or powers, to manage a provider’s financial risk, or prevent a provider from closing” any intervention and monitoring as a result of being placed in Categories 3 or 4 is essentially going to be a data gathering exercise. This will add to providers’ burdens at the very point where the attention of finance and senior leadership teams should be focused on turning around the institution.
Private matter and public interest
Beyond regulatory consequentials, it remains unknown how lenders and other stakeholders – such as pension funds – are going to react to this. In a sense, the framework is nothing new. Back in the day, HEFCE would carry out risk assessments based on a provider’s annual accountability returns. The risk assessment would be reported to the governing body and the accountable officer. There were two risk categories: “not at higher risk” (the vast majority of higher education institutions) and “at higher risk” (a small minority).
There was a support strategy for institutions at higher risk and, in exceptional circumstances, HEFCE could make an “at higher risk” assessment public where it considered it to be in the collective interest of students or the public to do so. In addition, HEFCE would consider withdrawing the grant in full or in part. Those risk assessments often found their way, contractually, into lender’s loan agreements, either as reporting obligations or, more seriously, as events of default. Risk assessments have also been a tool of OfS since its inception.
Indeed, under section 7(1) of the 2017 Higher Education and Research Act OfS is under a statutory duty to “ensure that the initial registration conditions applicable to an institution and its ongoing registration conditions are proportionate to the OfS’s assessment of the regulatory risk posed by the institution.” So, it has always been OfS’ job to assess a provider’s regulatory risk. “Regulatory risk” is defined in section 7(2) as “the risk of the institution, when it is registered, failing to comply with regulation by the OfS.”
However, risk assessments were a private matter. The continuation of this convention, and its rationale, was set out explicitly in OfS’ regulatory framework:
The OfS does not intend to publish its risk assessments or the risk profiles for individual providers. Such information could be erroneously treated as equivalent to judgements on a provider’s quality and have an unnecessary reputational impact. Publication could in fact be harmful to the OfS’s ability to carry out its regulatory functions, for example, by creating confusion, giving providers insights that allow them a commercial advantage, or affecting the OfS’s ongoing relationships with providers.
OfS was also fairly sketchy about what metrics it was looking at, at least from the point of view of financial risk. There are specific conditions of registration around being financially viable and financially sustainable – with specific meanings attributed to those phrases – but the detail of the indicators that OfS was using to assess those things was not widely publicised.
In 2020, the height of the pandemic, OfS introduced a new reportable event where it was “reasonably likely that liquidity will drop below 30 days at any point during a rolling three-month period.” During the Covid era providers started to need financial covenant amendments and waivers from their lenders so in 2022, Regulatory Advice 16 includes within its list of events that is always reportable “a likely breach of any financial covenant attached to a loan, where that breach has not been waived by the lender.”
The regulator’s language is slightly wobbly here – what does “likely” mean in this context and does “waived” mean that you have to have breached it first ie before the waiver is issued?
Nevertheless, there was a sense in which – apart from the liquidity test – OfS was content to piggyback off the covenants imposed contractually by lenders. Conceptually, that’s not necessarily a bad idea. If OfS was applying financial metrics to individual providers, then it was doing so privately as part of its own internal risk assessments. Bringing those internal risk assessments out into the open (or at least telling the world that it will be entering into a dialogue with individual providers about their individual risk assessments) does feel like a move back to a more HEFCE-style of approach.
Given the financial headwinds facing the sector, it is not surprising that OfS is trying to demonstrate that its financial oversight is operating at an individual provider level, not just at the level of assessing the financial sustainability of the sector as a whole. However, the new issue which the framework creates is that lenders are going to be extremely interested in hearing whether their borrowers have been placed in Category 3 or Category 4.
OfS acknowledges this in paragraph 42 of the framework:
We are aware that affected providers will have obligations to third parties, such as lenders and others with a financial interest, about the disclosure of regulatory actions. The OfS has no expectation that institutions provide stakeholders with copies of our regulatory decisions. However, we understand that lenders and others with a financial interest may expect providers in category 4 that are in receipt of a material risk of market exit assessment and/or a Student Protection Direction to share relevant information with them. Conversely, we do not believe third parties should need providers to supply them with a copy of any F3 Notices the OfS has issued. In all cases, it remains the provider’s responsibility to determine the extent of any disclosure, considering their specific circumstances and contractual obligations.
However, in my view, the regulator is perhaps being slightly naive here. If OfS has made an evidence-based assessment that a provider has actual or acute financial concerns, then it is surely not unreasonable of a major creditor (such as a bank or pension fund) to want to know about that assessment and what the regulator is doing about it.
Whatever contractual rights lenders have at the moment in terms of disclosure of regulatory action, lenders may well feel compelled to write a disclosure obligation – whereby, for example, the university must tell the lender if it is moved into Category 3 or Category 4 – into future facility agreements.
Existing arrangements are also not necessarily immune given the number of amendments and waivers that are currently being sought by the sector (“we’ll give you that extra covenant headroom, but we want to know if you are in Category 3”). It can only be hoped that lenders (and their lawyers) are measured about this.
While OfS has no remit or powers to prevent a provider from closing, the regulator is (one would hope) itself unlikely to tip a provider into insolvency: its powers are essentially that of a monitor and overseer, not a rival creditor. Ultimately, its risk assessments should not be revealing anything that an engaged lender doesn’t know about already.
Nevertheless, including a contractual event of default in a loan agreement around a provider being placed in Category 4 runs the risk of accelerating the problem that a prudent financial monitoring regime was presumably intended to avoid.
This article is published as part of a partnership with Mills & Reeve.
