What should universities prioritise in their 2026/27 internal audit plans?

In June 2026, an incident at one Russell Group university reportedly affected around 455,000 people, through a vulnerability in third-party software underlying its student records platform. Plus, the Canvas incident in May 2026 and the 2023 MOVEit attacks each reached thousands of institutions through a single supplier. A contract is not evidence of security, so ask what test results you actually hold for the platforms that hold your student, staff and research data.

In the British Library’s 2023 attack, the Information Commissioner’s Office noted that the incident escalated because one administrator account lacked multi-factor authentication. One account. Assurance should test how attackers really use identity, including helpdesk resets and privileged account coverage, rather than checking that a policy exists.

Multi-factor authentication, single sign-on and privileged access can each pass an audit and still fail when combined by an attacker. Adversary-style testing shows how quickly an attack would be detected and whether incident response holds up live. A clean penetration test and a serious breach can coexist.

State-linked actors have targeted university research for years, using quiet campaigns that ransomware-focused monitoring is unlikely to detect. Research data may need its own access governance and detection.

The LLE replaces higher education student finance in England for levels 4 to 6 and extends funding to modules, with applications opening from September 2026 for study from January 2027. HESA will flag modular provision from 2026/27, and from 2027/28 providers must identify funded modular students and track completion and credits. Income may look different too: Times Higher Education notes a full-time undergraduate brings in over £28,000 across three years, while shorter modular study may bring far less. Sensible audit candidates include programme governance, systems readiness and a data quality review before the first 2027/28 return.

The UK government has proposed a flat levy of £925 per international student per year on English providers, with the first 220 students exempt. Subject to Parliamentary approval, the levy will take effect from 1 August 2028, with the Office for Students undertaking trial calculations using 2026/27 and 2027/28 student data to help providers prepare. For English providers, the levy adds a further consideration, but across the UK the more fundamental question is how exposed your institution is to international income. Audit can help through recruitment forecasting, market concentration risk, oversight of agents and stress testing, while keeping sponsor licence compliance in scope.

The qualifying period for unfair dismissal is due to fall from two years to six months from 1 January 2027, with further changes planned for zero-hours and casual workers. Universities rely heavily on hourly-paid lecturers, invigilators and student employees, so the impact could be significant. The question for audit is less ‘have the policies been updated?’ and more ‘are we ready to operate these changes?’. It matters especially where restructuring depends on workforce savings: if voluntary severance falls short, compulsory redundancy becomes riskier and costlier.

The Bill is still moving through Parliament and is expected to bring tighter incident reporting and regulation of managed service providers. Universities may not be directly in scope, but will likely feel its effects through critical suppliers.

The Tertiary Education and Training (Funding and Governance) (Scotland) Act 2026 expands the Scottish Funding Council’s role to cover funding for apprenticeships, work-based learning and national training programmes alongside colleges, universities, research and innovation. The reforms also strengthen its oversight of funded institutions, including new duties to monitor financial sustainability and additional powers relating to information, guidance, funding conditions and independent examination of financial governance. Universities should assess their readiness for enhanced financial and governance scrutiny, including the quality of forecast information, delivery of transformation plans, whistleblowing and conflicts arrangements, and stakeholder engagement around significant decisions.