The revised CUC Code goes considerably further than the 2020 Code across strategy, sustainability, risk and assurance, and collectively represents the most significant intensification of board-level financial and risk oversight in the Code's history. 

New mandatory requirements include stress testing and scenario analysis, a comprehensive risk management and internal control framework, and detailed financial resilience scrutiny covering estate liabilities, pension exposure and capital programme viability. Boards with limited current engagement in these areas will need to take immediate steps to build capacity.

How the 2020 Code addressed strategy, risk and financial oversight

The 2020 Code required boards to approve strategy, manage risk and maintain appropriate oversight of finances, but the provisions are broadly framed and do not specify particular methodologies such as stress testing, nor do they require boards to scrutinise specific components of financial risk as discrete matters of board-level concern.

Strategy development and board collaboration

Strategy development must be underpinned by robust identification and assessment of risk and opportunity, including horizon scanning and scenario testing, consideration of opportunities for collaboration within and beyond the sector, meaningful engagement with key stakeholders, and clear articulation of mitigating actions and contingency plans where material risks are identified.

The Board should collaborate with the executive in setting strategy from an early stage, testing key assumptions, ensuring alternative options have been considered with major trade-offs made explicit, and agreeing the timeframe for strategy review.

The Board should satisfy itself that the institution has the capability, capacity and culture required to deliver the agreed strategy within its defined risk appetite. It should hold the executive to account for strategy implementation, receiving regular reporting against agreed priorities and success measures, monitoring leading as well as lagging indicators, and ensuring timely action where performance diverges from plan.

Risk appetite and risk management

The Board must determine and regularly review the institution's risk appetite, ensuring it is clearly articulated, understood and applied consistently across the organisation. The Board must approve and oversee a comprehensive risk management and internal control framework aligned to the institution's strategy, operating model and regulatory environment.

The Board should ensure that consideration of historical, current and emerging risk and opportunity is embedded within strategy development, financial planning and major decision-making, with proposals for significant decisions clearly articulating alignment with risk appetite, key assumptions and sensitivities, principal risks and mitigations, and alternative options including severe but plausible downside scenarios.

The Board should set the tone for a healthy institutional risk culture which promotes openness, transparency and informed risk-taking, and should seek assurance that risk information is escalated straightforwardly and that significant concerns, control weaknesses or compliance breaches are escalated promptly.

The Board must devote sufficient time and attention to the oversight of risks to the institution's short-, medium- and long-term sustainability, with intensity and frequency of scrutiny proportionate to the institution's risk profile and operating context.

The new assurance framework requirements: What must boards define?

Boards must define how they obtain assurance over risk management, internal controls, financial stewardship, regulatory compliance and academic governance. They should define the sources of assurance upon which they rely, understand the limitations of those sources, and satisfy themselves that assurance is sufficiently independent, objective and proportionate to the level of risk. The Board must review the adequacy and coherence of its assurance framework when there have been material changes in the institution's risk environment.

Mandatory stress testing and scenario analysis: The new financial resilience requirements

Boards must scrutinise institutional financial performance, including income statement and cash flow through forecasts, scenario modelling and stress testing, covering a range of scenarios and with plans in place to address them. The Board must also scrutinise the institutional financial position, including the balance sheet and long-term financial risks such as estate liabilities, pension exposure and the viability of the capital programme. The Board must require stress testing and scenario analysis to assess the institution's resilience under a range of plausible adverse conditions, and ensure that contingency plans are credible, actionable and implemented where necessary.

The Board must be provided with comprehensive, timely and accurate information over financial performance and position, which includes leading indicators and prudent forecasts. The Board must also scrutinise the potential financial impact on the institution of significant change in operations, investments or change programmes.

The Finance Committee and full-cost recovery

The Board should constitute a Finance Committee (or equivalent) to delegate detailed scrutiny of financial matters. It should understand and test the material assumptions underpinning financial projections, strategic plans and material investment decisions, including student recruitment, research funding, cost base, borrowing and capital investment. The Board should also be provided with sufficient information to understand the full costs of the institution's material activities, and where the institution does not recover full costs of material activities, it should be clear how the activity aligns with the institutional purpose and financial strategy.

How should boards respond to the intensified financial and risk oversight expectations?

The revised Code's strategy, risk, assurance and financial resilience provisions collectively represent the most significant intensification of board-level financial and risk oversight in the Code's history. The explicit reference to estate liabilities, pension exposure and capital programme viability reflects the specific nature of recent sector financial difficulties. 

The OfS Chair's letter of 24 June 2026 reinforces this directly, warning governing bodies of the danger of signing off over-optimistic student number forecasts and emphasising that boards are responsible for ensuring that forecasts are realistic, that assumptions are appropriately challenged, and that structural changes are implemented if anticipated growth does not materialise.

This is a direct signal from the regulator that financial challenge at board level will be scrutinised. Audit and finance committees will face materially increased demands for rigour, and boards with limited current engagement in scenario analysis and stress testing will need to take immediate steps to build this capacity.

Strategy setting, risk culture and leading indicators: What needs to change?

The requirement for early-stage Board collaboration on strategy, the expectation that boards will monitor leading as well as lagging indicators, and the detailed expectations around risk culture and escalation processes represent additional areas that will require boards to review their existing strategy-setting and risk oversight processes. 

The recommendation to establish a Finance Committee, and the detailed expectations around understanding full-cost recovery, will also be relevant for higher education institutions that do not currently have these structures in place.