| 20 June 2007 |  |
| To | Heads of HEFCE-funded higher education institutions Heads of higher education institutions in Northern Ireland |
| Direct Line | 0117 931 7300 |
| Direct Fax | 0117 931 7203 |
Circular letter number 18/2007
For further information contact Paul Greaves, 0117 931 7378, e-mail p.greaves@hefce.ac.uk
Dear Vice-Chancellor or Principal
Freedom of information and HEFCE's institutional risk assessments
1. This letter is to brief higher education institutions on the implications of the Freedom of Information Act for HEFCE's institutional risk assessments and Assurance Service reports.
2. The Council is responsible for the distribution of significant public funds to the higher education sector. It is also required to assess the risk associated with each higher education institution (HEI) and, where necessary, to take mitigating action to ensure that public funding and interests are not compromised. The Council assesses the relative risk posed by each institution using its institutional risk process. In brief, the Council assesses risk based on knowledge gained from data concerning an institution's operations, including its financial strength, and judgments of its audit and governance arrangements. Each institution is then assessed as 'at higher risk' or 'not at higher risk'. Risk assessments are used to determine the Council's level of engagement with the management of institutions, as set out in our support strategy (HEFCE 2005/31, Annex A). In recent years each institution has been notified formally of our risk assessment.
3. The English higher education sector is generally well-managed and low risk but there are usually a small number of institutions that are at higher risk. We work with these institutions to ensure that they develop a robust recovery plan and this normally results in their restoration to financial health. We have consistently maintained that our risk assessments should be confidential. We believe that placing them in the public domain before full recovery takes place could jeopardise HEIs as they address their risks. It could also impede the free and frank exchange of information between the sector and the Council.
Clarification of FOI requests
4. In 2005, following two Freedom of Information (FOI) requests from the media we released our institutional risk Board papers from 1998, usually editing out the names of HEIs and associated information which could disclose the identity of an institution. The requestors appealed to the Information Commissioner for the release of further information. Over the last two years, we have held discussions with the Information Commissioner's Office (ICO), the UK's independent authority set up to promote access to official information and to protect personal information, regarding the disclosure of these papers. Following these discussions we have agreed to publish Board papers concerning institutional risk three years after the date they are considered at a Board meeting, but subject to any redactions required to ensure the public interest is maintained.
5. The Commissioner's view is that a three-year period should be sufficient to dilute the commercial impact of the data being released and also enable the HEI to recover from the difficulties that created the 'at higher risk' status. This new arrangement will supersede paragraph 52 of the Accountability and Audit Code of Practice (HEFCE 2004/27) in which the Council undertook to keep risk assessments confidential, an undertaking that has been overtaken by the judgments of the Information Commissioner.
6. This means that we will shortly publish the names and details of some of the few HEIs that were reported to the HEFCE Board as being 'at higher risk' in the period between 1998 and December 2003. Redacted papers for September and December 2003 will be available on the HEFCE web-site from July 2007. However, we will not release the names of institutions, personal information or some commercial details where we have agreed with the ICO that an exemption applies. Details of the exemptions used may be obtained by e-mailing foi@hefce.ac.uk. Where an institution is named within the papers, we will provide heads of those institutions with a copy of the information so that they can prepare responses.
7. The Council has also received FOI requests for the release of Assurance Service cyclical audit reports. Our cyclical audit approach is changing from 2007-08 in line with the better regulation consultation of 2005 (HEFCE 2005/31). In our Circular Letter 25/2006 we explained that audit reports from future reviews, once agreed with the HEI, will be made available. This is consistent with the policies of other education regulators in respect of institutional reports.
8. HEFCE supports the principle of open government and believes that the reputation of the higher education sector can benefit from dissemination of information about its achievements. I trust therefore that we can work together to address these issues and to introduce the new procedures necessary to comply with legislative requirements.
Yours sincerely
Professor David Eastwood
Chief Executive