Preventing fraud on campus

In the last academic year, the Office for Students (OfS) distributed a total of £1.4 billion to higher education providers. The Student Loans Company (SLC) paid out nearly £20 billion in student support for 1.5 million students in England during the last academic year on which it reported (2020-21).  

Any sector that attracts such significant public investment is vulnerable to fraud, and we all need to continue to be vigilant on behalf of taxpayers.

At the OfS we’re extending our regulatory work in this area. We continue to work closely with colleagues at the SLC, exchanging intelligence about individual providers that may be drawing down public funding for students who are not genuinely committed to their course.

Courses delivered through partnership arrangements often feature in this intelligence and we have engaged with a number of providers because of our concerns. We expect to escalate our interventions where we are not satisfied that a provider has an effective grip on sources of potential fraud.

Universities and colleges must have adequate and effective internal control arrangements to reduce the likelihood of fraud taking hold – both in relation to the students they teach themselves and those taught through partnership arrangements. They must be confident that they will be able to identify any attempts at fraud. And they must ensure that fraud cannot flourish unchecked, for example through unnoticed gaps in control arrangements or with the support of ill-intentioned actors in a provider or its partners.

Every university and college – and their governing bodies, audit committees, and executive teams – should be able to answer the following questions. Can you?

Are you registering only genuine students who meet your academic and language requirements?

A provider’s registration process is the gateway for any fraudulent student to access student loan funding. When you tell the SLC that a student has successfully registered, you are confirming they are a genuine student who has demonstrated that they meet the academic and other requirements for admission onto your course. You will have seen evidence of their identity and verified their qualifications and any other documentation.

We know that the higher education sector in England is diverse – not all students enter through traditional routes with traditional academic qualifications. But any admissions decisions not based on qualifications must be rigorous and the basis for admission must be credible.

We also receive notifications from students who tell us that many students on their course do not have sufficient language skills to engage with their peers and teaching staff, or to complete assessments. In these circumstances, our concern is not simply that students may be registered without appropriate checks that their language qualifications and skills are genuine. Notifications of this kind may also raise concerns about the compliance of providers with our quality conditions.

Are your students attending and engaging effectively with their course?

Providers are required to report to the SLC each term to confirm the ongoing attendance and engagement of each student. If a student has suspended their studies or withdrawn from their course, the SLC needs to know that promptly.

We have seen cases where a provider’s approach to attendance monitoring is passive and reactive, with attendance confirmed unless a student has told the provider they are leaving their course. In the absence of a notification of withdrawal, students are deemed to be attending and engaging, whether or not this is the case.

This cannot be right, because it means the SLC continues to pay out public funding for students who are not appropriately engaging with their course. This could amount to fraudulent conduct in some cases, for example with students continuing to receive maintenance loans without any intention of meaningful study. In other cases, it raises concerns about whether a provider is effectively spotting students who disengage from their course and who require academic or welfare support.

Do your internal auditors test your approach regularly?

When we speak to providers about these issues, they are keen to demonstrate that they have comprehensive and robust policies to ensure that the information they submit to the SLC about individual students is accurate and reliable. We are frequently assured that the relationships between a provider and its delivery partners are well-established, operate with a high level of trust, and that there are strong protocols in place to spot issues of concern.

This might sound reassuring. But we are concerned when it then emerges that data about the registration and attendance of individual students flows without interrogation from a delivery partner, to the lead provider, to the SLC. When we look in more detail, it becomes clear that the lead provider has no idea, and isn’t testing, whether students’ identification and qualifications have been checked correctly, if English language proficiency is sufficient, or if students are attending their course.

The rigour of the lead provider’s internal control arrangements in a partnership is particularly important where delivery partners make decisions about which students to recruit and register, and whether students should progress academically through their course. The obligation to report information to the SLC remains with the provider that registers a student. So it must be confident that its reports are accurate and reliable.

Sometimes a provider’s internal auditors have tested these arrangements. Sometimes they have not, or have not done so with the rigour necessary to identify the issues that we can see.

Do you investigate allegations of potential fraud thoroughly?

The notifications we receive sometimes suggest that a student or staff member has already alerted their provider to concerns about potential fraud. They contact us because they don’t think appropriate action has been taken.

We don’t require all whistleblowing allegations to be reported to us, but we do expect any allegations of this nature to be robustly investigated. The potential impact on taxpayers’ money means that a provider should be alive to the need to investigate – even in response to more limited evidence of concern than might trigger investigation for other types of whistleblowing allegations.

Where an investigation identifies concerns about the data submitted to the SLC, or about the appropriateness of a provider’s internal control arrangements, we expect to be told about it. And, of course, the SLC needs to know so it can recover any funding paid inappropriately to a provider, its partners, or its students.

Time for a closer look?

We know that this time of the academic year tends to be busy with meetings of providers’ audit committees and governing bodies. This provides an opportunity to consider these issues and to think about whether your risk management and internal control arrangements in this area are sufficient to prevent fraud from flourishing. We encourage you to do so.