Exploring the oversight of risk management in UK higher education institutions: the case of audit committees

We explore how audit committees (ACs) oversee risk management in UK Higher Education Institutions (HEIs), using semi-structured interviews, attendance at AC meetings and documentary analysis. We find that the AC’s oversight seems constrained by a fixation on the process of risk management, an over-reliance on risk registers, and varying levels of emphasis on operational risks. Theoretically, the AC’s oversight reflects different shades of symbolic and substantive activities designed to maintain the HEI’s legitimacy and that of its governing board, hence providing a symbolic representation. We raise concerns as to the AC’s ability to monitor effectively the HEIs’ risk management practices.