Annual TEQSA Compliance Health Check Procedure

Every registered higher education provider faces periodic regulatory scrutiny, and the providers that handle it with the least stress are invariably those that never wait for the regulator to test them. They test themselves, on a schedule, through a disciplined annual compliance health check. This article focuses on the methodology of that health check: how to design it, who should run it, when to run it, and how to make it a permanent feature of the governance calendar rather than a one-off scramble. A checklist alone does not make a good health check; the process around the checklist does.

Want expert help putting this into practice? Higher Education Governance can guide you through it.

Designing the Health Check as a Repeatable Process

The first principle is that a health check must be a defined, repeatable process rather than an improvised exercise that looks different each year. A process can be improved over time, delegated confidently, and defended to a reviewer. An improvisation cannot. Designing the process means specifying its scope, its method, its outputs, its owners, and its place in the annual cycle, and then documenting all of that so the next iteration builds on the last rather than reinventing it.

The scope should map to the standards the provider is held against, covering student outcomes, learning environment, teaching, quality assurance, governance, and information integrity, adjusted for the provider's category and activities. The method should be evidence-based, requiring proof rather than assertion for every judgement. The outputs should include a rated assessment, a findings report, and a remediation plan. Defining these once, and refining them annually, converts the health check from an anxious event into a mature, self-improving discipline.

Who Should Run It and Why Independence Matters

Related: Higher Education Governance - Expert Advice.

A recurring question is who should conduct the health check, and the answer turns on independence. If the people who run the institution's compliance day to day also assess whether it is compliant, they face an inherent conflict: they are marking their own work. Some degree of independence in the assessment is therefore valuable, whether through an internal audit function, a designated reviewer outside the assessed area, or periodic external facilitation.

This does not mean front-line staff have no role. They provide the evidence and context that make the assessment meaningful. But the judgement of whether a standard is genuinely met benefits from a degree of separation from the people responsible for meeting it. A practical model rotates the reviewing responsibility, so that a colleague from a different function assesses each area, bringing fresh eyes and reducing the risk of comfortable self-approval. The governing body should also see the results directly, unfiltered by the executive whose performance the check partly assesses, so that its assurance rests on the real picture.

Timing the Check Within the Governance Year

When the health check happens matters as much as how. A check run too close to a registration renewal leaves no time to remediate what it finds, turning discovery into panic. A well-timed check runs far enough ahead of any regulatory deadline that findings can be acted upon calmly. Embedding it at a consistent point in the annual cycle also lets it feed into other governance processes, such as risk review, strategic planning, and board reporting.

Consider sequencing the check so its outputs inform the board's annual consideration of institutional risk and the executive's planning for the year ahead. A worked sequence might place the health check early in the second half of the governance year: findings are compiled, a remediation plan is agreed with owners and deadlines, and progress is tracked at subsequent board meetings, so that by the time any external scrutiny arrives, the institution has already found and fixed its own gaps. Timing turns the health check from an isolated inspection into an integrated part of how the institution manages itself.

The Assessment Method in Practice

See also: Higher Education Governance (Scotland) Act 2016 Requirements: Best Practices for Success.

The heart of the process is the method by which each standard is assessed, and rigour here separates a real health check from a reassuring ritual. A robust method rates each standard on more than a binary compliant or non-compliant. Consider assessing three dimensions:

• Design: is there a documented control, policy, or process addressing the standard?
• Operation: is there evidence the control actually operated during the period under review?
• Effectiveness: does the evidence show the control achieved its intended outcome?

A standard can score well on design and poorly on operation, or well on both and poorly on effectiveness, and each pattern calls for a different response. A worked example: a provider's academic-integrity process may be well documented and consistently followed, yet a rising trend of undetected breaches would suggest it is operating but not fully effective, pointing to a need for better detection rather than better documentation. Rating across all three dimensions produces findings precise enough to remediate intelligently, rather than a vague sense that something is amiss.

Turning the Check Into Action and Assurance

A health check delivers value only when its findings drive action, and the process must build that link explicitly. Every finding that is not fully satisfactory should convert into a remediation item with a named owner, a due date, and a defined completed state. Someone must track these items to closure and report progress to the governing body, because a finding that is identified and then forgotten is worse than useless; it creates a record showing the institution knew of a weakness and failed to address it.

Prioritisation is essential, because not every finding carries equal weight. A gap affecting student safety or the integrity of a qualification demands immediate attention, while a documentation inconsistency can wait. Ranking findings by risk ensures scarce remediation capacity goes where it protects the most. Over successive cycles, the trend in findings, whether they are diminishing and whether they recur, becomes a powerful indicator of the institution's compliance maturity, and a compelling piece of assurance to present to a regulator or board.

Building Compliance Maturity Over Time

The ultimate purpose of an annual health check is not to pass a single test but to build lasting compliance maturity. In the first cycle, the check often surfaces many findings, some of them uncomfortable. In subsequent cycles, if the institution acts on what it learns and embeds controls into ordinary operation, the findings should diminish and the check should become faster and less disruptive. The institution moves from rediscovering its obligations each year to genuinely living them, with the health check simply confirming what is already true.

At Higher Education Governance, we regard a well-designed annual compliance health check as one of the surest routes to that maturity, because it institutionalises honest self-scrutiny and turns regulatory readiness into a steady state rather than a periodic emergency. A provider that designs the check as a repeatable process, runs it with appropriate independence, times it wisely, assesses rigorously, and acts on its findings will face external scrutiny with confidence rather than dread. This article offers general governance guidance and is not legal advice; providers should always interpret their specific obligations in light of current regulatory requirements and their own circumstances.