Who (or what) regulates the regulator? OfS and the regulator’s code

There’s quite a bit of grumbling out there about the Office for Students’ provider regulation function.

Complaints surround all sorts of aspects. Independent HE has raised the “quality of guidance and support” provided to those applying and a lack of “full eligibility criteria for registration” ahead of time. Guild HE has asked whether the regulation avoids “imposing unnecessary burdens”, and has questioned whether institutions “feel able to seek advice without fear of triggering enforcement action”. Everyone we meet seems to have a tale of woe about shifting goalposts, or poor comms, or the regulator’s “tone”.

It’s hard to discern whether they’re justified. OfS is a pretty new regulator trying to impose tough requirements on a diverse sector on a tight timescale – most of whose providers have been delivering excellent higher education for donkey’s years thank you very much, and some of which are new or small or both. The real question is perhaps whether some of the things that that OfS has been saying or doing that people disagree with aren’t teething problems, but facets of a permanent approach. Who would you complain to? Against what standard? Who, or what, policies the police?

Cracking the code

The good news is that OfS has to operate within a regulatory framework all of its own – or rather, something called the “Regulator’s Code”. Back in 2012 the Government announced that it would introduce a package of measures to improve the way regulation was delivered at the frontline, with an eye on reducing regulatory burdens and the development of an “open and constructive” relationship between regulators and those they regulate. Replacing something called the “Regulatory Compliance Code”, the idea was a flexible, principles based framework for regulatory delivery that supports and enables regulators to design their service and enforcement policies in a manner that “best suits the needs of their regulated entities”.

It was laid before Parliament in accordance with section 23 of the Legislative and Regulatory Reform Act 2006, and OfS must have regard to the Code when developing policies and operational procedures that guides its regulatory activities. That act was extended by the Enterprise Act 2016, requiring regulators other than local authorities to “formally report” on the effect that the Regulators’ Code has on the way they exercise their regulatory functions and the impacts of this on business.

Sadly, it’s not yet an additional obligation that is in force – BEIS will “engage with regulators” before it is introduced – but it’ll be very interesting to see OfS’ reflection on it when it does get enacted. In the meantime we thought we’d take a look at the code and triangulate it with stories from providers, comparisons with other regulators and our own thoughts.

Proportionate approaches

The first section talks about regulators enabling those being regulated to be compliant:

“1. Regulators should carry out their activities in a way that supports those they regulate to comply and grow

Regulators should “avoid imposing unnecessary regulatory burdens” through their regulatory activities and should assess whether similar social, environmental and economic outcomes could be achieved by less burdensome means. Regulators should choose “proportionate approaches” to those they regulate, based on factors including, for example, size and capacity.

When designing and reviewing policies, operational procedures and practices, regulators should consider how they might support or enable by considering how they can best “understand and minimise the costs of compliance”, and improve confidence in compliance by providing “greater certainty”. They should also ensure that their officers have the “necessary knowledge and skills” to support those they regulate.

There’s a fine balance between having a set of standards that ensure that all students are protected, and the image of “proportionate approaches” that section one conjures up, which rubs up against the experience of many a small, specialist or private provider trying to navigate registration. For us the “baseline” thing still isn’t really working anyway – because from an individual student’s point of view, the bigger the provider, the more statistically likely it is that your poor experience or outcomes will be ignored by the averages. And there’s certainly not much of a sense from providers that they trust that OfS “gets” them and is working to “understand and minimise the costs of compliance” – quite the opposite, in fact.

Engagement ring

The next principle is all about engagement.

“2. Regulators should provide simple and straightforward ways to engage with those they regulate and hear their views

Here regulators should have mechanisms in place to engage “those they regulate, citizens and others to offer views and contribute to the development of their policies and service standards”. Before changing policies, practices or service standards, regulators should “consider the impact” on providers and engage with “provider representatives”.

If they find non-compliance, regulators should “clearly explain” what the non-compliant item or activity is, the advice being given, actions required or decisions taken, and the reasons for these. Regulators should provide also an opportunity for dialogue in relation to the advice, requirements or decisions, with a view to ensuring that they are acting in a way that is “proportionate and consistent”. They should also provide an impartial and clearly explained route to appeal against a regulatory decision, make available clearly explained complaints procedure, and have a range of mechanisms to enable and regularly invite, receive and take on board feedback, including, for example, “through customer satisfaction surveys of those they regulate”.

We’re not aware of any provider satisfaction surveys (beyond some basic stakeholder work and something on website usability), and as far as we know the only appeals you can raise are on formal decisions like a refused registration, rather than an imposed condition or enhanced monitoring.

You’ve got to have quite the brass neck to be a regulator operating explicitly in the “student interest” and regularly pontificating on it, but have still not got around to publishing an engagement strategy with those students over two years into your operation. Is keeping enhanced monitoring confidential in “the student interest”? Is not getting around to publishing proper advice on student protection plans in “the student interest”? Is an approach based on outcomes rather than inputs and outputs in “the student interest”? Is the current balance between competition and collaboration (both are in the Higher Education and Research Act) in “the student interest”?

Any SU would tell you that the “student interest” is not at all straightforward to determine – but at least they tend to have explicitly democratic engagement structures to resolve competing and conflicting interests. OfS just defining it in opposition to “provider interest” and running a student panel isn’t going to cut it forever.

Risky business

OfS talks a lot about being a “risk based” regulator, which is just as well:

“3. Regulators should base their regulatory activities on risk

“4. Regulators should share information about compliance and risk

Here regulators have to take an “evidence based approach” to determining the priority risks in their area of responsibility, and allocate resources where they would be “most effective in addressing those priority risks”. Risk has to be considered at every stage of their decision-making processes, including choosing the most appropriate type of intervention or way of working with those regulated; targeting checks on compliance; and when taking enforcement action.

Regulators designing a risk assessment framework should have mechanisms in place to consult on the design with those affected, recognise the compliance record of those they regulate, and review the effectiveness of their chosen regulatory activities in delivering the desired outcomes and make any necessary adjustments accordingly.

And they should follow the principle of “collect once, use many times” when requesting information from those they regulate, and agree “secure mechanisms” to share information between partner regulators to help target resources and activities, and minimise duplication.

We’d argue there’s a mixed bag here. OfS never stops talking about risk and being “risk-based” (there’s 553 hits on “risk” on the OfS website), and the HESA Data Futures project was designed to address some of the data collection burden issues, even though it’s hit some problems. Some of the problem with the OfS approach to risk is that it’s all about the “risk” that someone will breach a registration condition – and when the conditions are unfamiliar or unclear, it’s pretty hard to judge a risk of breaching them.

Oh, and that stuff about resource allocation we think is supposed to be covered off by this “prioritisation framework”, but we’re willing to bet that decision makers in Nicholson House don’t have this egregious example of boilerplate corporate nonsense-speak pinned up on their hot desks when deciding whether to go hard on grade inflation because the minister says so.

We’re here to help

If you’re not sure whether you’re doing the right thing, the code suggests that OfS should be there to help:

“5. Regulators should ensure clear information, guidance and advice is available to help those they regulate meet their responsibilities to comply

Regulators should publish guidance, and information in a clear, accessible, concise format, using media appropriate to the target audience and written in plain language for the audience, and should provide advice and guidance that is “focused on assisting” those they regulate to understand and meet their responsibilities. The impact of the advice or guidance should be considered so that it does not impose unnecessary burdens in itself, and OfS should consult those they regulate in relation to the guidance they produce to ensure that it meets their needs.

Regulators should also seek to create an environment in which those they regulate have “confidence in the advice they receive” and feel able to “seek advice without fear of triggering enforcement action”. Plenty of providers would argue that beyond the regulatory framework itself, there’s precious little advice and guidance about – and given “where a provider seeks to abdicate responsibility for decision making, and seeks steers from the OfS, this behaviour may indicate non-compliance with condition E2” we’re not sure that the “seek advice without fear” thing is really cutting through.

Even sector *umbrella” bodies seem to be having trouble getting steers on advice they might put out – and the sector seems pretty united in describing the approach to advice as Kafka-esque. For our work with SUs we dop plenty of monitoring of Charity Commission stuff given the’re regulated directly by it – and whilst the voluntary sector moans all the time, its approach to advice on regulation and enabling compliance is much more helpful, in a much bigger and more diverse sector.

I see you

Finally, OfS has to ensure that we can see what it’s up to:

“6. Regulators should ensure that their approach to their regulatory activities is transparent

Regulators are required to publish a set of clear service standards, setting out what those they regulate should expect from them – making clear how they communicate with those they regulate and how they can be contacted, their approach to providing information, guidance and advice; their approach to checks on compliance, including details of the risk assessment framework used to target those checks as well as protocols for their conduct; their enforcement policy, explaining how they respond to non-compliance; and their fees and charges.

Information has to be published on how it meets the provisions of the Code that is easily accessible, including being available at a “single point” on the regulator’s website, and should publish on a regular basis “details of their performance against their service standards”, including feedback received such as customer satisfaction surveys, data relating to complaints about them and appeals against their decisions.

We’d mark this one up as a hard fail. The closest it appears to get on service standards are its “Efficiency and effectiveness performance measures”, which don’t really look explicitly at the things in section six, and anyway contains a series of measures that OfS expects to specify “during Spring 2019”. There’s just one mention of the code on the OfS website (buried in this Framework Document from October), and whilst some of the technical stuff is arguably in on its regulation webpages, there’s nothing we can find on feedback, complaints or appeals other than in relation to refused registration decisions.

And when it comes to information, there’s a habit of putting publications onto webpages without telling anyone. Board papers are now consistently late and heavily redacted. And some information is fiendishly difficult to track down – the idea that the register is still being hosted on an excel spreadsheet is really quite remarkable when you think about it – and the complete opposite of original pronouncements that it would be a source of public information for students.

This isn’t a theoretical problem, by the way. West London College is the proud holder of a TEF Silver – the panel “recognised many aspects of our excellent teaching and learning provision … including the excellent outcomes achieved by our students and the exceptional employability of our alumni”. Simultaneously it has appeared on the register spreadsheet with a B3 condition (outcomes) and has a student number control slapped on it as a result. Even if students could find that information, what on earth would they make of it?

Furrowed brow

A system that tears up a tradition of cosy co-regulation operating explicitly in the student interest was always going to take a while to get used to (both for the regulator and those regulated), so there were bound to be some initial wrinkles. But we’re not really sure that this canter through compliance with the regulator’s code is really about teething troubles.

What’s actually starting to become clear is that the core design of the regulatory system – based on a now fairly defunct approach to supporting public services in the No.10 Delivery Unit a few decades ago – is costly, confusing, deeply contested and often illogical. Formal regulation won’t and shouldn’t go away – but our guess is that beyond some issues of “tone”, that underpinning Barber model will have to change before things really get better.