1. Report snapshot
Overview
This report presents key findings and recommendations from financial audits of NSW public universities for the year ended 31 December 2025.
Key findings
Clean audit opinions were issued for all 10 universities.
Control deficiencies were most common in IT/cyber security, governance and payroll
There were 94 reported audit findings and most related to poor monitoring of IT/cyber security risks, inadequate governance oversight and deficiencies in payroll management.
Nearly 24% of consultancy engagements reviewed were directly sourced
Direct procurement sourcing minimises the opportunity for competition and value for money. All engagements directly sourced were approved within the university’s procurement policy exemptions except in one instance. Universities spent $139 million on consultant expenses, including $46.2 million collectively on 2 firms.
Lack of oversight for contingent labour hire
Universities collectively spent more than $217 million on contingent labour. However, central oversight is limited. Only 3 universities had formal policies governing contingent workers and 4 maintained a register of all contingent workers.
Domestic student revenue does not cover operating costs
Operating costs per student of $37,868 exceeded the average revenue per domestic student of $25,213, representing a 33% deficit margin. In contrast, average overseas student revenue of $41,381 exceeded cost, representing a 9% surplus margin.
Processes to obtain conflict of interest declarations are inadequate
Four universities did not require annual conflict of interest declarations from all employees and did not update their central conflicts of interest registers annually. Three universities did not require nil returns from senior executives, elevating the risk of undeclared conflicts.
There were undeclared employee interests in companies that are university vendors
We identified over 790 instances of employees with directorships in companies that were university vendors, of which 30% of instances reviewed could not be found on the conflict of interest register.
Weaknesses in managing legacy system risks
One university has no processes to manage IT legacy systems, and 6 universities have not formally assessed legacy system risks.
Universities continue to grapple with the complexities of adopting artificial intelligence
Three universities still do not have a formalised AI policy. Only 2 universities had procurement guidance in place for AI-related procurement.
Recommendations
The report makes 6 recommendations to improve procurement processes, strengthen contingent labour hire management, enhance policies and procedures for managing conflicts of interest and progress AI governance maturity.
Fast facts
2. Executive summary
This report presents the results of our financial audits of public universities in NSW and their controlled entities for the year ended 31 December 2025. It includes analysis, observations and recommendations in the following areas:
- audit results – including use of consultants and contingent labour hire
- financial performance
- internal controls and governance – including conflicts of interest and procurement
- enrolment and teaching outcomes
- cyber security
- artificial intelligence.
Audit results
Unmodified audit opinions were issued for all 10 universities’ 2025 financial statements
All audits of universities and their controlled entities received unmodified opinions, except for one controlled entity. For the second year, a qualified opinion due to a limitation of scope was issued for Stornaway Pty Limited, a controlled entity of the University of Sydney. It related to a lack of supporting evidence for certain balances which predated the university’s control of the entity.
Provision for wage remediation decreased by 24% to $122 million
Seven universities provided for wage remediation liabilities (8 in 2024). In 2025, universities paid a total of $37.2 million to staff identified as being underpaid. Eight universities are in the process of implementing mitigating actions which include payroll system enhancements, compliance reviews and clearer terms in enterprise agreements.
Universities have gaps in their readiness to prepare climate-related financial disclosures
Under NSW Treasury’s reporting framework TPG24-33, most universities will be required to prepare climate-related financial disclosures by 31 December 2026. Two universities have not assigned governance responsibility for overseeing climate-related risks and opportunities, and 4 have not completed a climate risks and opportunities assessment or determined their financial impacts.
Use of consultants
Universities paid a total of $46.2 million to 2 consultancy firms, representing 33% of total consultant expenses
Universities spent $139 million on consultant expenses in 2025, down 2.5% from 2024. A third of this expenditure was paid to 2 firms.
Unlike NSW state agencies, universities are not required to disclose consultant spending under NSW Treasury’s annual reporting rules. However, a NSW Parliamentary inquiry has recommended removing this exemption so universities would have to report this information for added transparency.
Nearly 24% of consultancy engagements reviewed were directly sourced using procurement policy exemptions
Of the top 5 consultancy engagements at each university in 2025, 24% were entered into outside of standard procurement practices. All but one were through management-approved exemptions that supported the direct appointment of a supplier. The main reasons were time critical requirements, the need for specialist expertise and continuity with existing providers.
Contingent labour hire
Universities lack central oversight of contingent workers and contractors
In 2025, universities spent $217 million on contingent labour and contractors, up 6.9% from $203 million in 2024. Only 3 universities had formal policies in place governing the use of contingent labour. Six universities did not maintain a register of current contingent workers and 5 were unable to provide information on how long their contingent workers had been working at the university.
Financial performance
Five universities reported a net surplus in 2025, compared to 4 in 2024
The number of universities that reported net surpluses increased from 4 to 5 in 2025. Eight universities reported improved net results from last year, although the sector reported an overall 5.3% decrease in net surplus of $548.4 million in 2025.
The key movements in the 2025 results included an increase in overseas student fees and charges of $646 million, increase in government grants of $202 million, offset by a decrease in investment income of $268 million and an increase in employee-related expenses of $601 million.
Domestic student revenue does not cover operating costs
In 2025 the average operating cost per student was $37,868, compared to average revenue per domestic student (including fees and government grants) of $25,213. In contrast, average revenue per overseas student was $41,381, which was 1.6 times higher than that from domestic students.
Growth in universities’ expenses exceeded growth in revenue
In 2025, universities’ expenses increased by $941 million or 6.9% to $14.5 billion. Revenue increased by $912 million or 6.4% to $15.1 billion.
All revenue streams except investment income recorded a growth in 2025. Fees and charges of $8.3 billion continued to represent over half of universities’ total revenue.
Total fees and charges revenue from overseas students and domestic students increased by 14.6% and 7.8% respectively. This was mainly driven by a 10.1% increase in the number of overseas students. Domestic student enrolments increased by 5.3%.
Redundancy expenses increased over 4 times their previous amount
Most of the increase in expenditure was attributed to higher employee-related expenses, which grew by 7.8%. Redundancy expenses increased from $42.6 million in 2024 to $193 million in 2025, reflecting an increase in the number of positions made redundant or provided for redundancy, from 497 to 1,299.
Over 44% of fees and charges revenue came from overseas students from 3 countries
The proportion of fees and charges revenue from the top 3 countries increased from 43.4% in 2024 to 44.7%. There was no change in the top 3 countries of student origin from 2024 to 2025 – China, India and Vietnam. China was the leading source of overseas student revenue for 4 universities (6 in 2024). The highest proportion of overseas student revenue sourced from a single country for each university ranged from 20% to 78% (13% to 78% in 2024). China comprised 78% of overseas student revenue for the University of New South Wales and 77% of overseas student revenue for the University of Sydney.
NSW universities continue to face concentration risk in overseas student revenue due to the high level of reliance on overseas students from a few key countries of origin.
Internal controls and governance
The number of audit findings decreased from 98 to 94 in 2025
No high-risk findings were reported in 2025 (one in 2024). We identified 34 repeat findings (38 in 2024) and the need to improve user access management and manage privileged user accounts was repeated for 8 universities.
Most control deficiencies continue to relate to IT/cyber security, governance and payroll
Findings in these categories made up 70% of total findings. All 10 universities had deficiencies in their IT/cyber security controls. Common findings included:
- all 10 universities had deficiencies in managing and monitoring user access to key systems
- 2 universities had deficiencies in cyber security controls
- 8 universities had deficiencies in managing conflicts of interest
- 7 universities did not require employees to annually review and attest compliance with the code of conduct.
Conflicts of interest
Universities have weak controls regarding conflicts of interest – particularly management of employee interests in companies that are university vendors
In some universities, conflict of interest policies did not cover all employees or were not clear on the types of interests that should be disclosed. Four universities did not require annual conflict of interest declarations from all employees. The same 4 universities did not update their central register of declared interests annually. Declarations may be incomplete where senior executives are not required to confirm they have nil interests (3 universities) or update their declarations annually (one university).
We identified over 790 instances of employees with directorships in companies that are university vendors, of which 30% of instances reviewed could not be found as declared on the conflict of interest register. Ten of the undeclared interests related to senior executives.
Procurement
Most universities allow discretion in calling public tenders for major procurement
Not all universities have defined criteria based on dollar values for procurement that would mandate or default to a public or open tender. Most procurement policies allowed more judgement or discretion for holding public tenders. This reduces transparency in procurement decisions and may not demonstrate value for money.
Four universities did not have a formal procedure requiring review of the conflict of interest register before awarding procurement contracts. Declarations by senior executives of any potential conflicts or declared interests help avoid the perceived risk of conflict, even if they are not directly involved in the procurement process or outcome.
Controlled entities
University-controlled entities were sometimes excluded from key governance processes
We identified gaps in oversight for some controlled entities where three universities’ controlled entities did not maintain a legislative compliance register.
Enrolment and teaching outcomes
Student enrolments increased by 6.9%
Overall student enrolments grew from 310,070 to 331,480 equivalent full-time student load (EFTSL). Domestic student enrolments increased from 206,900 to 217,840 EFTSL. Overseas student enrolments increased from 103,170 to 113,640 EFTSL.
The largest increase in enrolments in 2025 was in IT, engineering and related technologies (9.6% increase).
Cyber security
Gaps in cyber security controls are exposing universities to supply chain vulnerabilities, legacy system risks and less effective investments
Universities have weaknesses in managing supply chain cyber security risks, including unclear cyber security roles and responsibilities in supplier contracts and limited inclusion of key third-party service providers in cyber incident response testing. Third-party cyber security responsibilities are not consistently enforced and arrangements to maintain cyber security and resilience after the termination of IT partnerships or service agreements are not well established. Four universities did not have formal strategies to maintain a complete IT asset register for externally hosted systems.
Controls over legacy systems are inconsistent, with one university having no processes to manage legacy systems, and 6 not having formally assessed legacy system risks. This reduces visibility and increases exposure to cyber security risks and system failures. Universities are not consistently setting and monitoring investment and benefits realisation, or aligning cyber security investments with key risks and threats. Only 2 universities identify and manage underutilised, redundant, or outdated cyber security tools and services.
Artificial intelligence
Universities have made some improvements in their governance and oversight of AI, but this does not appear to be keeping pace with the rate of adoption
Most universities have taken initial steps to support responsible AI use, with institution-wide AI policies being established. However, 3 universities still do not have an institution-wide AI policy. Many universities also continue to rely on existing risk, IT, data management, incident response and procurement frameworks that may not adequately address the distinct risks introduced by AI. This gap is significant given the widespread reliance on vendor-supplied AI tools. Only 2 universities have procurement guidance that explicitly addresses AI-related considerations, highlighting the need for stronger governance, risk and procurement controls to keep pace with adoption.
Universities report a range of persistent hurdles in adopting AI responsibly, spanning technology, governance and culture. Enhanced visibility of opportunities, challenges and risks will better position universities to leverage the benefits of AI, however, 4 do not yet have an AI strategy.
Recommendations
Universities should:
- establish systems and processes to report climate-related financial disclosures in line with NSW Treasury’s reporting framework TPG24-33
- ensure that engagement of consultants is supported by:
- adherence to the procurement policy
- robust assessment of whether an exemption to the procurement policy is required
- performing conflict of interest checks
- post-completion assessments to confirm services delivered met the university’s objectives
- strengthen management and oversight of the use of contingent labour by:
- updating policies to clearly state when contingent labour should be used, set maximum engagement periods and ensure value for money
- maintaining a central register to track all contingent workers
- introducing central oversight and reporting
- strengthen policies and procedures for managing conflicts of interest by:
- requiring all employees to make annual declarations of interests, potential conflicts and secondary employment, including nil returns
- providing clear guidance on the types of interests to be disclosed
- maintaining an up-to-date centralised register of interests covering all employees.
- strengthen the governance of controlled entities by clarifying roles and responsibilities over legislative compliance for each of the entities
- support the adoption of AI by:
- establishing and implementing an AI policy, and embedding the consideration of AI use into governance, risk and procurement frameworks
- considering the benefits of developing an AI strategy that can be integrated into a broader organisational plan to ensure that AI initiatives are coordinated and aligned with universities’ strategic objectives.
3. Introduction
3.1. Overview of NSW public universities
Ten public universities in NSW are established under state legislation. Their core functions are to provide higher education and research services. Other activities include commercial development and revenue generation in connection with promoting the university’s objectives. There were 38 public and 6 private universities operating across Australia in 2025. Universities receive funding from the Australian Government in accordance with the Higher Education Support Act 2003 (Cth) and are regulated by the Australian Department of Education through the Tertiary Education Quality and Standards Agency (TEQSA). TEQSA is the national independent regulator of higher education providers, including universities.
Following a recommendation from the Australian Universities Accord, the Australian Tertiary Education Commission (ATEC) started interim operations in July 2025 as an independent steward of the higher education system. ATEC advises government on tertiary education planning, funding and student place allocations, with a focus on increasing participation and improving equity. ATEC was formally established as a statutory body in April 2026 following passage of the Universities Accord (Australian Tertiary Education Commission) Act 2026.
In 2024 (the most recent available data), NSW public universities received $4.1 billion in Australian Government funding. This represents 28.5% of Australian Government funding to Australian universities totalling $14.4 billion.
At a state level, the NSW Department of Education administers the legislative responsibilities of the state’s public universities, develops policies related to higher education in NSW and manages stakeholder relations with universities. The Government Sector Finance Act 2018 (GSF Act) requires universities to prepare annual financial statements and provide these to the Auditor-General for audit.
NSW university sector
|
Consolidated financial results
|
Student enrolments
|
Employees
|
* Equivalent full-time student load (EFTSL) represents the equivalent full-time study load for one year. Numbers are rounded to the nearest 10.
** Full-time equivalent (FTE). These numbers include staff of universities’ controlled entities, which do not all provide academic services. Numbers are rounded to the nearest 10.
Source: Audit Office analysis, student enrolments and employee numbers are provided by universities (unaudited).
4. Audit results
Financial reporting is an important element of good governance. Confidence in and transparency of university sector decision-making is enhanced when financial reporting is accurate and timely.
This chapter outlines the results of our audits of 2025 financial statements of NSW universities.
Chapter highlights
|
4.1. Financial reporting
Audit results
Unmodified audit opinions were issued for all 10 NSW universities
Unmodified audit opinions were issued for all 10 universities’ 31 December 2025 financial statements. Issuing an unmodified opinion means sufficient audit evidence was obtained to conclude that the financial statements were free of material misstatement and were prepared in accordance with Australian Accounting Standards and Division 7.2 of the Government Sector Finance Act 2018 (GSF Act).
Unmodified audit opinions were issued for all but one relevant university-controlled entities
Of the 72 university-controlled entities in 2025:
- 34 received unmodified audit opinions
- 1 received a qualified audit opinion
- 37 were exempt from the GSF Act reporting requirements.
The University of Sydney’s controlled entity Stornaway Pty Limited, received a qualified opinion for the second consecutive year. This was due to scope limitation relating to a lack of supporting evidence for certain balances which predated the university’s control of the entity.
Division 2 of the Government Sector Finance Regulation 2024 (GSF Regulation), amended September 2025, exempts certain entities from preparing financial statements under the GSF Act if the following criteria is met:
- an agency is a controlled entity of a reporting GSF agency (parent agency)
- an agency’s financial position and financial performance are consolidated within the financial statements of the parent agency
- the assets, liabilities, income, expenses, commitments and contingent liabilities of an agency are each less than $20 million
- the total cash or cash equivalents held by an agency is less than $10 million
- an agency has less than $2 million of income from sources other than the Consolidated Fund, other GSF agencies or a statutory special deposits account.
In 2025, these provisions exempted 37 university-controlled entities from GSF Act reporting requirements. In 2024, 23 university-controlled entities were exempted under a superseded criteria which had a lower monetary threshold.
Entities that are exempt from financial reporting obligations are not audited by the Auditor-General.
Misstatements
A monetary misstatement is an error in an amount recognised in the financial statements initially submitted for audit.
In 2025, 15 monetary misstatements were identified during the audits of universities’ financial statements (16 in 2024). Eight of these, with a gross value of $66.8 million, were corrected in 2025 (12 in 2024 with a gross value of $289 million). The remaining 7, with a gross value of $22 million, were assessed as not material and remained uncorrected (4 in 2024 with a gross value of $14.2 million).
The nature of the corrected misstatements typically related to:
- errors in the fixed assets register, leading to incorrect depreciation expense and asset carrying values
- under-accrual of investment income
- incorrect recognition of gifted property assets
- overstatement of contract liabilities and receivables
- reclassification of financial assets to cash and cash equivalents.
Wage remediation provisions
Wage remediation provisions decreased by 24%
At 31 December 2025, 7 universities recorded provisions totalling $122 million ($160 million in 2024) relating to underpayments of staff wages and entitlements. These provisions represent estimates of amounts still owing, or are likely to be owing, to university staff at risk of being historically underpaid.
In 2025, universities collectively paid $37.2 million to staff they identified as being previously underpaid ($28.5 million in 2024). The impact of these payments in reducing provisions was partially offset by the identification of further instances and new categories of historical underpayments. In 2025, 2 universities identified new instances of staff underpayments with an estimated impact of $2.1 million.
The complexity in university enterprise agreements and inconsistent interpretation of the terms within those agreements have contributed to inaccuracies in some of the payments made to certain staff for several years.
Eight universities, including one that recorded no provision, are progressing their mitigation actions to address the risk of future staff underpayments. Generally, these actions include:
- payroll system enhancements and automation
- implementing diagnostic reviews, monitoring mechanisms and other assurance processes to validate compliance
- simplification of policies and new enterprise agreements with clearer clauses.
Climate reporting
Universities have gaps in their readiness to prepare climate-related financial disclosures
Climate-related financial disclosures (CRFDs) are required by NSW Treasury’s policy and guidelines TPG24-33 Reporting framework for first year climate-related financial disclosures (TPG24-33). The scope of TPG24-33 includes NSW universities. The reporting and assurance of climate disclosures aims to increase transparency of universities’ exposure to climate change impacts and enhance accountability over strategies to respond to climate risks and opportunities.
All universities have self-assessed that they:
- have systems or processes in place to collect and analyse emissions data, including external data sources
- have developed or are in the process of developing an emissions inventory covering all sources of scope 1 and 2 emissions within their operational boundary.
The University of Sydney and the University of New South Wales were the only 2 universities required to prepare their first CRFDs (unaudited) for the year ended 31 December 2025. These 2 universities will be required to have their climate disclosures audited for the financial year 2026 and onwards. Of the remaining NSW universities, 7 are expected to prepare CRFDs for the year ending 31 December 2026, and one is required to prepare CRFDs for the year ending 31 December 2027.
Our review of universities’ preparedness for CFRDs found several key areas for improvement in advance of the mandatory publication of CRFDs. Two universities have not included climate change as an area of focus in their strategic or corporate plan, nor assigned a governing body to manage and oversee climate-related risks and opportunities.
Other findings are listed below. The first section relates to requirements arising from the mandatory disclosures and the second section includes better practices supporting mandatory disclosures.
| Finding | Number of universities |
| Requirements arising from mandatory disclosures | |
| Has not assigned roles and responsibilities required for making climate-related decisions | 3 |
| Climate risks and opportunities assessment not completed | 4 |
| Financial effects of climate-related risks and opportunities not determined | 4 |
| Materiality for climate disclosure purposes was not considered | 6 |
| No documentation of methodologies for calculating and reporting emissions | 4 |
| Better practices | |
| No documented reporting boundary assessment to guide climate disclosure preparation | 3 |
| No gap analysis conducted against NSW Treasury’s reporting framework TPG24-33 requirements | 4 |
| No climate disclosure preparation plan | 4 |
| Climate risks not included in the risk register | 2 |
In addition to the NSW Treasury reporting framework, there are 2 controlled entities across 2 universities that are required to prepare sustainability reports under section 292A of the Corporations Act 2001, which is required for the year ending 31 December 2028. Two other universities have not yet considered whether their controlled entities have separate mandatory climate related disclosure requirements.
RecommendationUniversities should establish systems and processes to report climate-related financial disclosures in line with NSW Treasury’s reporting framework TPG24-33. |
4.2. Engaging consultants
In 2025, the NSW university sector spent $139 million on consultant expenses, a decrease of 2.5% from $142 million reported in 2024.
A consultant is defined as a person or organisation engaged under contract to provide recommendations or professional advice to assist decision-making by management. Generally, it is the advisory nature of the work that differentiates a consultant from other contractors. This definition was derived from the Procurement Board Direction PBD-2026-02 Engagement of professional services suppliers.
Universities paid over a third of total consultant expenses to 2 firms
In 2025, the sector spent $46.2 million on 2 consultancy firms, comprising over a third of total consultant expenses. The graph below shows the sector’s consultancy spend on the top 5 consultants in 2025.
Source: Universities’ consolidated financial statements and Audit Office analysis (audited).
Most of the major consultancy engagements across the sector were for strategic advice, IT services, operational advice (including change management) and legal/compliance matters.
Universities do not consistently report spending on consultants
Some universities list consultant expenses separately in their financial statements, while others include them in broader categories like ‘professional fees’ or ‘contract services’, which limits the ability to compare consultant spend across the university sector.
Consultant costs are also capitalised by universities when they directly relate to producing an asset that will derive future economic benefits. Examples include consultancy spend paid to help develop internal software or build university infrastructure. As these costs are included in the cost of assets, they are not separately identified in the universities’ financial statements. As a result, reported consultant expenses by universities are not comparable to total consultant payments made for the same period.
Unlike NSW state agencies, universities are not required to disclose consultant spending under NSW Treasury’s annual reporting rules (TPG25-10a). However, a NSW Parliamentary inquiry has recommended removing this exemption so universities would have to report this information for added transparency. More detail about the inquiry is provided in section 6.2.
One university’s policy on the use of consultants does not require consideration of internal capabilities
One university lacked a formal policy requiring consideration of whether in-house skills or capabilities are available prior to engaging a consultant. From our review of the top 5 consultancy engagements at the other 9 universities, all had documented justification for requiring external expertise. Some of these reasons included specialised or technical expertise in certain IT systems, legal or compliance matters and workforce strategy.
Nearly 24% of major consultancy engagements reviewed were directly sourced using procurement policy exemptions
Of the top 5 engagements at each university in 2025, one was non-compliant with the university’s procurement policy and there was no evidence of approved exemption supporting the direct appointment of a supplier (without obtaining quotes or going through a tender process). A further 22% of engagements were sourced outside normal procurement processes under approved exemptions. The main reasons universities sought exemptions from their normal procurement process were time critical requirements, the need for specialist expertise and continuity with existing providers that have an established relationship with stakeholders. Some regional universities have advised that the number of suppliers can be more limited in their area. Whilst these reasons are not unusual in nature in the procurement process, it does not follow that every circumstance should qualify for an exemption.
While approved exemptions are still compliant with procurement policies, overuse of exemptions may:
- reduce transparency in procurement decisions
- increase reliance on sole suppliers, weakening competitive pressure and value for money
- increase risk of perceived or actual conflicts of interest.
Conflict of interest declarations were not performed in 12% of the top 5 engagements reviewed. At one university, conflict declarations were not required for contracts under a certain monetary threshold.
Over 25% of the top 5 consultant engagements completed were not formally assessed on whether the services delivered on the objectives or whether the work met the university’s needs.
RecommendationFor greater transparency and accountability, universities should ensure that engagement of consultants is supported by:
|
4.3. Contingent labour and contractors
Contingent labour and contractors are engaged as part of universities’ workforce strategy and management. In 2025 the university sector spent $217 million on contingent labour and contractors, up 6.9% from $203 million in 2024.
Contingent labour and contractors may provide skills and capabilities that are otherwise unavailable at a university. However, engaging such personnel to perform core work that could reasonably be performed by existing employees of a university may not achieve effectiveness or value for money.
The use of contingent labour can be useful where:
- there is clear and current evidence of a low supply of such capabilities in the labour market
- there is a short-term or temporary need to engage external labour, and the need is so immediate that a short-term solution is needed, pending recruitment action where appropriate
- the need for additional resources or specialised skill is for a limited time or specific circumstance and will not be a core workforce requirement going forward.
While all universities engage contingent labour and contractors to varying extents, only 3 universities have formal policies in place governing their use. However, most of these policies were incomplete and missed critical elements, such as consideration of:
- internal capability - if required specialist skills are not within the university's core capability
- timing of work - if unpredictable or infrequent (such as short-notice, unplanned work that cannot be fulfilled by current staff levels)
- cost - if efficient and effective to engage contractors compared to using in-house capability, reasonableness of costs compared to market (quotes, tenders)
- timeframes for engagement - short-term (less than 6 months), long-term or recurring basis
- maximum term for engaging contractors, although some have described the engagements should be temporary.
Universities do not have central oversight of contingent workers and contractors
All universities operate a decentralised process for engaging and managing contingent workers and contractors, limiting a university’s ability to centrally review pay rates for consistency, fairness and competitiveness. Pay rates are usually set with reference to market rates and equivalent enterprise award rates.
While 4 universities maintained a register of current contingent workers or contractors, the registers vary in level of detail. Three universities were able to provide listings of contingent workers and their pay rates. The number of workers paid at a rate over $1,500 a day in 2025 ranged from 6 to 44 at each university. The number of workers who were paid over $350,000 in total in 2025 ranged from 4 to 14 at each university. The highest paid contingent worker was a digital transformation lead who earned over $515,000 in 2025. The majority of these higher paid roles were IT-related program or project managers.
Seven universities were able to provide the number of contingent workers they paid during the year, ranging from 24 to 505. One university had engaged the same contractor continuously for 8 years. At 4 other universities, the longest tenure held by a contractor ranged from 3 to 6 years. Five universities were unable to provide information on how long their contractors have been working at the university.
Three universities reported on contingent workers to the leadership team, regarding analysis of expenditure or the number of workers engaged. No universities reported on how long individual contingent workers have been engaged.
When supported by appropriate controls and informed by whole-of-organisation workforce planning, the use of contingent labour can be an effective and efficient use of resources to meet business objectives.
RecommendationUniversities should strengthen management and oversight of the use of contingent labour by:
|
The above recommendations when implemented would support better workforce planning, limit long-term reliance on contractors for key university functions and improve value for money.
5. Financial performance
Financial performance is a measure of an organisation’s ability to use its resources to generate revenue and manage expenses while maintaining appropriate levels of net assets and cash flows.
Financial performance also encompasses financial sustainability, which is the ability to meet current and future financial obligations without reducing core services or borrowing money to fund successive operational deficits. This is achieved by ensuring that over the medium and longer terms, revenue is sufficient to cover expenses, cash flow and risks are well managed, long-term financial planning is effective and sources of revenue are diverse.
This chapter presents our observations on the financial performance of universities in 2025.
Chapter highlights
|
5.1. Financial sustainability
Universities must be financially sustainable to adapt to economic changes, such as fluctuations in student enrolments, shifts in government funding and other movements in the geopolitical environment.
Net results
Eight universities reported higher net results in 2025
In 2025 the NSW university sector reported an overall net surplus of $548 million, a 5.3% decrease from the $579 million net surplus in 20241. The decrease was attributable to 2 universities that recorded increased expenditure while revenue remained consistent with 2024. Despite the reduction, the individual net results of 8 universities improved from 2024. Additionally, 5 universities reported net surpluses in 2025 (4 in 2024).
Key movements in the universities’ 2025 aggregated results included:
- an increase in overseas student fees and charges of $646 million, in line with increased overseas student enrolments of 10.1%
- an increase in government grants of $202 million
- a decrease in investment income of $268 million
- an increase in employee-related expenses of $601 million.
Earnings before interest, tax, depreciation and amortisation (EBITDA) is an alternative measure of financial performance that excludes factors like debt financing, non-cash expenses and taxes. This allows for a more useful comparison of financial performance for entities with different capital structures or tax situations. It can also be a useful indicator of operational cash flow.
The graph below shows the net results and EBITDA of individual universities for 2024 and 2025.
Note: 2024 net result and EBITDA are restated.
Source: Universities’ consolidated financial statements (audited).
All universities reported a positive EBITDA in 2025. The difference between individual net results and EBITDA is largely due to the impact of depreciation and amortisation, which varies across the universities based on the carrying values of their property, plant and equipment and intangible assets.
The University of New South Wales reported the largest increase in EBITDA of $246 million primarily due to a $319 million increase in revenue from overseas students and $44.8 million increase in Australian Government grants, offset by a $128 million increase in employee related expenses.
The University of Sydney reported a $301 million decrease in EBITDA primarily due to $235 million lower investment income from fair value market movements. While revenue from overseas students increased by $119 million, this was offset by a $148 million increase in employee related expenses and $75.1 million increase in repairs and maintenance expense.
The graph below presents the revenue and expenses for each university in 2025.
Source: Universities’ consolidated financial statements (audited).
Movements in revenue and expenses for the sector and by university are analysed later in this report.
Growth rate of revenue and expenses
A key indicator of financial sustainability is the relationship between revenue growth rates and expense growth rates. Sustained financial health is achieved when revenue growth rate consistently meets or exceeds the growth rate in expenses.
The graph below shows the cumulative growth rate movement in revenue and expenses of universities over the past 6 years. Growth rates in the graph reflect movement compared to 2019 revenue and expenses.
Source: Universities’ consolidated financial statements (audited).
The impact of COVID-19 saw universities experiencing a higher growth rate in expenses compared to revenue in 2020. Cost saving measures were implemented in response to the pandemic, resulting in cumulative revenue growth rate exceeding expenses in 2021. However, expense growth for universities was at a higher rate than revenue growth for the next 2 years. It was only in 2024 that the revenue growth rate slightly exceeded that of expenses and this trend continued in 2025, supported by growth in overseas student revenue.
Liquidity ratio
Two universities’ liquidity ratios declined from 2024
A liquidity ratio indicates the university’s capacity to meet financial obligations within its ordinary operating cycle. A benchmark ratio of one is generally used to indicate that there are sufficient liquid assets to meet short-term liabilities.
The unadjusted and adjusted liquidity ratios for NSW universities from 2023 to 2025 are shown in the graph below. The adjusted liquidity ratio excludes employee benefit provisions that are not expected to be settled in the following 12 months and accounts for financial assets classified as non-current but can be readily converted to cash at short notice.
Formula used to calculate the ratio (unadjusted): Current assets divided by current liabilities.
Source: Universities’ consolidated financial statements (audited).
At 31 December 2025, 6 universities reported an adjusted liquidity ratio greater than one. The University of Newcastle and the University of Wollongong showed a decrease in their adjusted liquidity ratio from the prior year.
When calculating an unadjusted liquidity ratio, only 5 universities reported a ratio of at least one. However, the adjusted liquidity ratio provides a more realistic assessment of universities’ liquidity requirements and the cash reserves available to meet financial obligations in the year ahead.
Cash expense cover
Five universities have less than 3 months of cash reserve to fund operating and financing activities
The cash expense cover shows the number of months a university can continue paying for its immediate expenses without additional cash inflow. A higher cash expense cover indicates a stronger buffer against financial volatility and a higher degree of short-term financial resilience.
The cash expense cover for NSW universities from 2023 to 2025 is shown in the graph below.
Source: Universities’ consolidated financial statements (audited).
At 31 December 2025, 3 universities had a lower cash expense cover from the previous year. Five universities (3 in 2024) recorded at least 3 months of cash reserve to fund their operating and financing activities.
Asset sustainability ratio
This ratio indicates whether the university is sufficiently reinvesting in its property, plant and equipment and intangible assets to sustain or grow operations. A ratio below one suggests the university is not fully replacing its assets at the rate they are being depreciated or amortised.
The asset sustainability ratio for NSW universities from 2023 to 2025 is shown in the graph below.
Note: Southern Cross University and the University of Wollongong measure their property, plant and equipment at cost, rather than fair value.
Source: Universities’ consolidated financial statements (audited).
Two universities reported a ratio below one in 2025 (4 in 2024). Four universities had an increased asset sustainability ratio in 2025 compared to the prior year.
Operating cost and revenue per student
The average operating cost per student exceeds the average revenue from domestic students
In 2025 the average operating cost per EFTSL student across all universities was $37,868 ($37,919 in 2024). When compared to the average revenue per domestic student (including fees and Commonwealth Grant Scheme (CGS) grants) of $25,213, universities would operate at a net loss per student. Average CGS grant revenue per student of $10,550 has not kept pace with the increase in operating costs.
In contrast, the average revenue of $41,381 generated per overseas student provides a positive margin per student. This trend has been consistent over the past 5 years. The average revenue from overseas student was 1.6 times higher than that from domestic students in 2025.
Note: Operating cost is calculated as total expenditure less depreciation, amortisation, losses on disposal of assets, impairment and interest expenses.
Domestic student grant revenue comprises the Commonwealth Grant Scheme (CGS). Domestic student total revenue includes fees and charges revenue, other non-course fees and charges revenue, amounts from the Higher Education Loan Program (HELP), as well as the CGS grants.
Source: Universities’ parent financial statements (audited), student numbers provided by universities (unaudited).
5.2. Financial results
Revenue from operations
Universities’ total revenue increased by $912 million (6.4%)
Revenue for universities totalled $15.1 billion in 2025, an increase of $912 million (6.4%) from 2024. This was mainly driven by an increase of $646 million from overseas student fees and charges, an increase of $202 million in Australian government grants, offset by a $268 million decrease in investment income.
As seen in the graph below, fees and charges of $8.3 billion continued to represent over half of universities’ total revenue in 2025. The movement in fees and charges revenue is further explained on page 26 of this report.
Note: Government grants do not include the Higher Education Loan Program, which are included in fees and charges.
Source: Universities’ consolidated financial statements (audited).
Government grants represented 29.8% of universities’ total revenue
Commonwealth, state and local government grants revenue to NSW universities increased from $4.3 billion in 2024 to $4.5 billion in 2025.
Additional grant funding was provided between 2020 and 2022 to assist universities in responding to the COVID-19 pandemic - increasing the proportion of grant funding relative to total revenue for those years. This proportion peaked at 35.4% in 2022 and has decreased since. In 2024 the proportion of government grants relative to total revenue decreased from 30.3% to 29.8% in 2025.
Three universities (same in 2024) received over 40% of their total revenue from government grants. These were all regional universities.
All revenue streams except investment income recorded a growth
The graph below presents the aggregated revenue streams for all NSW universities from 2021 to 2025.
Note: Government grants do not include the Higher Education Loan Program, which are included in fees and charges.
Source: Universities’ consolidated financial statements (audited).
Revenue from fees and charges recorded the strongest growth in 2025, increasing by $880 million or 11.9% from 2024. This was mainly due to overseas student enrolments increasing in aggregate by 10.1%, with the largest growth at the University of New South Wales. Since 2021, fees and charges revenue increased by 42.6% across the sector and was largely in line with the growth in overseas student enrolments of 41.9%.
Trends in fees and charges revenue for NSW universities from 2021 to 2025 are presented in the following graph.
Source: Universities’ consolidated financial statements (audited).
In 2025 all universities reported increases in fees and charges revenue from the previous year, with increases ranging from $876,000 to $356 million. The University of New South Wales generated the highest fees and charges revenue, overtaking the University of Sydney which had consistently reported the highest balances in previous years. Two universities’ fees and charges revenue in 2025 have not yet returned to pre-pandemic levels (3 in 2024).
Total fees and charges revenue from overseas and domestic students increased by 14.6% and 7.8% respectively
Fees and charges generated from overseas students continue to exceed that of domestic students. In 2025 fees generated from overseas students was 57.1% higher than fees from domestic students. Nine universities reported increases in overseas student revenue, ranging from 4.7% to 38.5%. However, one university reported a 29.8% decrease.
At 31 December 2025, the NSW university sector reported $5.1 billion in revenue from overseas students, an increase of $646 million or 14.6% from the $4.4 billion reported in the previous year. The University of New South Wales accounted for almost half of the sector’s overall increase ($319 million).
Driving the sector’s result was the number of overseas equivalent full-time student load (EFTSL) students increasing by 10.1%, from 103,170 in 2024 to 113,640 in 2025. This increase was influenced by:
- ongoing post-pandemic recovery
- growing demand for quality education from key source countries such as India and Nepal
- policy changes related to visas and work regulations in other leading countries for overseas students
- improved world rankings for 3 universities in 2025
- student recruitment strategies.
At 31 December 2025, the NSW university sector reported $3.2 billion in revenue from domestic students, an increase of $234 million or 7.8% from the previous year. Higher reported domestic EFTSL students (217,840 in 2025 compared with 206,900 in 2024, a growth of 5.3%) was the key driver of the sector’s result. The University of Sydney reported the largest growth in domestic student revenue of $50.2 million driven by a 6.6% growth in domestic EFTSL.
All universities saw increased domestic student enrolments, while 2 universities had a decrease in overseas student enrolments
The graph below compares the number of reported EFTSL student enrolments between 2024 and 2025 by university (parent entity). All universities reported growth in domestic student enrolments in 2025, with 8 reporting growth in overseas student enrolments.
Source: Provided by universities (unaudited).
The University of New England reported a 32.5% decrease in overseas student enrolments in 2025. The university attributed this to the impact of Ministerial Direction 107 which was in effect from December 2023 to December 2024 (when it was replaced by Ministerial Direction 111). Ministerial Direction 107 prioritised processing of overseas student visa applications based on the assumed risk level of education providers and the student’s country of citizenship. This had a negative impact on overseas student enrolments particularly at regional universities. The university also experienced a drop in global rankings from 2024 to 2025.
The University of Wollongong reported a 11.2% decrease in overseas student enrolments in 2025, which is consistent with the 9.5% decrease in overseas student revenue at the parent entity. The university attributed this to higher visa rejection rates. However, this does not include overseas student enrolments at the university’s controlled entities.
The University of New South Wales had the highest growth in overseas student enrolments of 3,500 EFTSL (12.8%) due to continued strong demand from last year, partly driven by improved global rankings.
The graph below compares revenue reported in 2025 from overseas students by university with revenue generated from domestic students, inclusive of government grants. Income from overseas students exceeded that from domestic students at the University of Sydney and University of New South Wales. Overseas student revenue recorded by these 2 universities makes up over 68% of total overseas student revenue for all NSW universities.
Note: Revenue from domestic students includes amounts from the Higher Education Loan Program and other non-course fees and charges. Government grants for domestic students represents the CGS funding for Commonwealth Supported Places.
Source: Universities’ consolidated financial statements (audited).
The graph below shows the change in revenue generated from overseas students reported by university from the previous year.
Source: Universities’ consolidated financial statements (audited).
While 9 universities reported increases in overseas student revenue compared with the prior year, the magnitude of the increase varied. This is because different universities attract overseas students from different countries of origin in varying proportions. As noted earlier in the report, the decrease in overseas student revenue for the University of New England was in line with the 32.5% decrease in overseas student enrolments. For the University of Wollongong, enrolments increased at its overseas controlled entities which contributed to the overall increase in overseas student revenue at a consolidated level, despite the decrease in overseas student enrolments at the parent university. The highest increase in overseas student revenue was at the University of New South Wales, due to the 12.8% increase in overseas student enrolments.
Over 44% of parent universities’ total revenue from fees and charges came from overseas students from 3 countries
In 2025 overseas students paid $4.7 billion in course fees to NSW universities (parent entities only), an increase of $563 million or 13.6% from the previous year.
The graph below shows the parent universities’ proportion and equivalent revenue generated from student fees and charges in 2025 by student type.
Note: Revenue from domestic students includes amounts from the Higher Education Loan Program and other non-course fees and charges.
Source: Total revenue from domestic and overseas students was sourced from universities’ parent financial statements (audited). Revenue from students by country of origin was provided by universities (unaudited).
Fees generated by students in 2025 from the top 3 countries of origin totalled $3.5 billion ($3.1 billion in 2024), slightly exceeding the sector’s total revenue from domestic students. Students from China, India and Vietnam (same in 2024) comprised 44.7% (43.4% in 2024) of total student revenue for all universities and 75.1% of total overseas student revenue reported in 2025.
As reported in previous Auditor-General’s reports, a high level of reliance on student revenue from a limited number of key source countries of origin continues to pose a concentration risk for NSW universities. Unexpected shifts in demand arising from changes in the geopolitical or geo-economic landscape, or changes to visa approval rates or travel restrictions, can impact revenue, operating results and cash flow.
Student enrolments from China continue to represent the largest share of overseas enrolments
The number of overseas student enrolments at NSW public universities increased from 137,693 in 2024 to 148,030 in 2025.
All universities continue to market their educational products in international markets, focusing on countries in Asia.
The graph below shows the composition of overseas student enrolments by country of origin in NSW public universities over the past 5 years. It illustrates that in 2025 NSW public universities appear to have maintained similar sources of overseas student enrolments.
Note: Data for prior years have been restated within the source database.
Source: Australian Trade and Investment Commission, overseas student data (unaudited).
China was the leading source of overseas student revenue for 4 universities (6 in 2024). This creates a concentration risk for each university, although the extent of reliance for the broader NSW university sector appears to be reducing.
The graph below illustrates the relative reliance of each university on a single country for its overseas student revenue.
* In 2024, the leading country for Charles Sturt University, Southern Cross University and the University of Newcastle was China. For the University of Wollongong, it was India.
Note: The change in proportion since 2024 reflects the percentage point change from last year’s proportion.
Source: Universities’ parent financial statements (audited). Revenue from students by country of origin was provided by universities (unaudited).
Among the 6 universities for whom China was the leading source of overseas student revenue in 2024, 2 universities increased their proportion of revenue from China, one experienced a decrease, and 3 universities shifted their reliance to another leading country (India and Nepal). One university’s leading country for overseas student revenue changed from India to China in 2025. Six universities recorded Vietnam as one of the top 5 countries of origin in 2025 (6 in 2024).
Four universities rely on one country for over 40% of their overseas student revenue (3 in 2024). The highest proportion of overseas student revenue sourced from a single country of origin at individual universities ranged from 20% to 78% (same in 2024). China comprised 78% of overseas student revenue for the University of New South Wales and 77% of overseas student revenue for the University of Sydney.
Operating expenses
Universities’ total expenses increased by 6.9%
In 2025 the NSW university sector reported $14.5 billion in operating expenditure, an increase of $941 million or 6.9% from 2024. Employee-related expenditure accounted for $601 million of this increase, of which $193 million related to redundancy costs (mostly from Western Sydney University, University of Technology Sydney and University of Wollongong), which contributed to the increase.
The graph below shows the NSW university sector’s operating expenditure and composition across a 5-year period.
Note: Income tax has not been included in operating expenses. 2024 amounts have been restated.
Source: Universities’ consolidated financial statements (audited).
The movement in other expenses was relatively low in 2025, at 3.6% increase, but over a 5-year period has grown 45.6%. Other expenses include repairs and maintenance, consultants and other professional services, fees and charges (such as software, licensing, supplies) and travel expenses.
Since 2021, total expenditure has grown by $4 billion or 38.3%. The bulk of this movement came from employee related expenses increasing by $2.3 billion or 39.4%. Depreciation and amortisation increased by $174 million or 17.2%. Scholarships and grants increased by $203 million or 29.9%.
The net change in total expenditure from 2024 and 2025 by percentage for each university is shown below.
Source: Universities’ consolidated financial statements (audited).
All universities reported increases in operating expenditure from the previous year. Operating expenditure at the University of Sydney increased by 10.9% or $363 million, largely driven by higher employee-related expenses, repairs and maintenance, and grants and scholarships.
The University of Technology Sydney and Western Sydney University also incurred more than 7% increases in expenses compared to the prior year. This was mainly due to both universities conducting organisational restructure reviews, resulting in a collective $118 million in redundancy expenses for the year.
The University of New England had the lowest increase in expenses of $4.9 million or 1.1%, mainly due to a decrease in consulting and professional fees expenses which offset increases in employee-related expenses.
Employee-related expenses increased by 7.8%
Employee-related expenses for universities increased to $8.3 billion in 2025, up by $601 million (7.8%) from 2024. The movement was partially due to growth in full-time equivalent (FTE) staff of 275 (0.6%) and wage increases in line with enterprise agreements, averaging 3.4% across the universities for 2025.
Redundancy expenses increased over 4 times their previous amount
Redundancy expenses increased from $42.6 million in 2024 to $193 million in 2025, reflecting an increase in the number of positions either made redundant or provided for redundancy, from 497 to 1,299. Six universities started, and some completed, a formal review to reduce staff numbers or reconsider their workforce composition in 2025, with one additional university planning to start this in 2026. The planned reductions in workforce at those universities range from less than 10 to 400 FTE employees. In addition, 2 university-controlled entities have completed a formal program to reduce staff numbers.
The graph below shows the key components of expenses for each university in 2025.
Source: Universities’ consolidated financial statements (audited).
Employee-related expenses represent the major portion of expenses at each university and range between 54% to 61% of total expenses.
1 2024 net surplus of $583 million was restated in 2025.
6. Internal controls and governance
Governance is the framework of rules, processes and systems that enable organisations to achieve goals and comply with legal requirements. Good governance promotes public confidence in the integrity and effectiveness of university systems and operations. A strong system of internal controls enables universities to operate effectively and efficiently, produce reliable financial reports, comply with laws and regulations, and support ethical and transparent decision-making.
This chapter outlines our findings on internal controls and governance across the 10 NSW universities.
Financial audits focus on the key internal controls and governance that support the preparation of financial statements. Breakdowns and weaknesses in internal controls can increase the risk of fraud and error. Our management letters report deficiencies in internal controls, matters of governance interest and unresolved issues to those charged with governance. These letters also include risk ratings, implications, recommendations and management responses.
Chapter highlights
|
6.1. Audit findings
The number of findings reported to management decreased by 4%
In 2025 there were 94 audit findings (98 in 2024) reported across the universities. There were no high-risk findings this year (one in 2024).
The graph below shows the breakdown of the 2025 audit findings by key themes and risks.
Source: Audit Office analysis.
Thirty-four audit findings were repeat findings from previous audits
Repeat findings comprised 36% of all issues reported to those charged with governance (39% in 2024). Repeat findings arise when the university has not implemented recommendations from previous audits. The most common repeat issues related to IT/cyber security, governance and payroll. Eight universities received repeat findings relating to user access and privileged user account management.
Delays in implementing audit recommendations increases the risk of intentional and accidental errors in processing information, producing management reports and generating financial statements. This can impair decision-making, impact service delivery and expose universities to fraud, financial loss and reputational damage. Poor controls may also mean staff may be less likely to follow internal policies.
Common findings
IT/cyber security, governance and payroll control matters continue to dominate audit findings and make up 70% of total findings. Common findings reported in audit management letters include deficiencies in:
- user access management and review, including for privileged user accounts
- cyber security practices (refer to section 7)
- managing conflicts of interest (refer to section 6.2)
- outdated policies and procedures
- underpayment of employee entitlements
- delays in payroll processing of timesheets and contracts
- asset management and fair value assessments of property, plant and equipment.
There were 28 control deficiencies in IT/cyber security
All 10 universities had deficiencies in their IT/cyber security controls. However, the total number of findings in IT/cyber security has decreased from 35 in 2024 to 28 this year.
All 10 universities had deficiencies in managing and monitoring user access to key systems
Deficiencies in managing and monitoring user access to key information systems, including for privileged user accounts, comprised over half of the IT/cyber security findings. These user access deficiencies applied to all 10 universities.
Robust access management processes include:
- ensuring only approved new users can gain access to systems
- periodic review of functions granted to each user to ensure access levels reflect any changes to a user’s role requirements
- timely removal of user profiles that no longer require access
- setting up separate accounts for each user requiring privileged access that is:
- separate to their standard account
- not shared with other users
- maintaining audit logs of privileged user activities and implementing independent periodic reviews of audit logs.
Poor user access management and lack of review of privileged user activity increases the risk of inappropriate access to information systems. This increases the risk of unauthorised transactions or theft of sensitive information.
Two universities had deficiencies in cyber security controls
We identified 7 findings across 2 universities highlighting weaknesses in cyber security controls. These related to:
- lack of cyber risk identification
- limitations in the cyber incident register
- inadequate management of third-party cyber security risks
- gaps in data breach procedures
- use of unsupported software.
Eight universities had deficiencies in their management of conflicts of interest
Deficiencies identified in managing conflicts of interest included:
- undeclared or incomplete declarations of interests or secondary employment
- lack of a centralised conflict of interest register
- incomplete conflict declarations by panel members in the tender evaluation process.
These increase the risk of undisclosed actual or perceived conflicts which can undermine probity and transparency in decision-making. The lack of a centralised register reduces a university’s ability to fully identify and manage conflicts effectively.
Seven universities do not require employees to annually review and attest their compliance with the code of conduct
One university has not updated its code of conduct that was scheduled for review in June 2024.
All universities require their employees to acknowledge that they understand and will comply with the code of conduct when starting employment. However, only 3 universities require employees to annually review and attest their compliance. Eight universities have mandatory annual refresher training on the code of conduct.
Key governance, financial or IT policies and procedures were outdated or not in place at 5 universities
Five universities did not formalise and/or regularly review all key governance, financial or IT policies and procedures. Regular review ensures emerging risks are considered and policies are reflective of changes to the business environment. Lack of formal policies and procedures may result in inconsistent and inappropriate practices and an increased risk of:
- inefficient or ineffective governance practices
- errors in financial reporting
- inappropriate access to key systems.
There were deficiencies in asset management and fair value assessment processes for property, plant and equipment at 6 universities
Property, plant and equipment (PPE) comprises a significant proportion of universities’ assets. Most universities choose to present PPE at fair value in their financial statements. Assessing the fair value of PPE is complex as it involves applying judgements and assumptions. Small changes in these factors can have a significant impact on asset values. Therefore, robust controls and reviews are vital to ensure PPE are appropriately valued in the financial statements. Effective asset management practices are also critical to ensuring accuracy and completeness of property data.
Deficiencies in 6 universities’ procedures over asset management and fair value assessments of PPE included:
- delays in the capitalisation of completed assets, impacting depreciation
- increases in the extent of fully depreciated assets, indicating useful life estimates may be inaccurate
- insufficient review by management of their valuer’s work, including oversight of the valuation methodology, key judgements and assumptions
- inconsistent accounting treatment for recognition of certain property assets.
6.2. Governance
On 18 August 2025, the NSW Legislative Council Standing Committee on Social Issues (the NSW Committee) established a parliamentary inquiry into the NSW university sector. The terms of reference included a focus on the current legislative governance frameworks that regulate universities in NSW, the role of governance structures in safeguarding the public mission of universities and the accountability of university councils.
The NSW Committee published an interim report on 8 April 2026 which found that existing internal governance and reporting mechanisms at NSW universities are not sufficient to ensure transparency, accountability and alignment with universities’ public mission.
The Australian Government Senate Education and Employment Legislation Committee also had an inquiry into the quality of governance at Australian higher education providers, releasing a final report on 11 December 2025. A total of 20 recommendations were made (8 from the final report and 12 from the interim report), which included improving the transparency and accountability of universities’ governing bodies, and review of the composition of members on governing bodies to ensure the primacy of public research and education can be achieved.
Governance bodies
The composition, functions and requirements of university councils are set out in each university’s establishing legislation, with many common features across all 10. The council is the governing authority of the university.
A council consists of 11 to 22 members, comprising:
- official members - these are the Chancellor, Vice-Chancellor and presiding member of the Academic Senate (or deputy presiding member if the presiding member is the Vice-Chancellor)
- elected members - academic staff, non-academic staff or student representatives elected by peers
- council appointed members
- ministerially appointed members.
Council appointed members make up the largest group within university councils
Legislation dictates that no single category of council members can form a majority of the council’s members. No university breached this requirement during the year.
Council appointed members are the largest category of members for 9 universities, comprising 25% of the university council for the University of New England to 47% of the university council for Charles Sturt University and Western Sydney University. The graph below shows the composition of each university’s council by member category.
Source: Provided by universities (audited).
Nine universities appoint their members by invitation with regard to the university council’s specific skills matrix and other criteria. One university puts out a public notice.
While all universities provide elected members with governance training to support their role, only 3 provide annual refresher training.
Conflicts of interest
Conflict of interest policies are ambiguous or limited in scope
Managing conflicts of interest is important for universities to demonstrate transparent and ethical decision-making, particularly in spending public funds. A conflict of interest policy should be clear on scope and application as to which employees are required to comply with it and the types of interests or conflicts that should be disclosed.
All universities require senior executives or key management personnel to make written declarations about their private financial, business, personal or other interests or relationships that could result in conflicts of interest or perceived conflicts of interest. However, the same requirement does not apply to all employees. Even for those universities that require employees to disclose their interests, some policies may not cover all categories of staff, such as casual academics, or lack clarity on the types of interests to be disclosed, such as ownership or directorship of companies and secondary employment. Universities often have employees who hold director roles in related or affiliated entities by virtue of their position at the university (that is, not in a personal capacity) and these are not consistently declared.
One university’s conflicts of interest policy does not cover handling complaints about concealed or mismanaged conflicts of interest.
Existing controls around managing conflicts of interest leave gaps for incomplete declarations
For senior executives or key management personnel who are required to make written declarations of interests, we noted:
- 3 universities do not require senior executives to submit a nil return where they have no private interests to declare
- 1 university does not require senior executives to make updated declarations upon change in their assignment to a new role or responsibility
- 1 university does not require senior executives to make annual declarations.
These gaps may increase the risk of undeclared conflicts of interest by those involved in university decision-making.
Four universities do not require employees to annually update their conflicts of interest, declared interests or nil returns. Of these, 2 have no requirement for staff employed in roles that carry greater exposure to conflicts of interest, such as procurement or recruitment assessment panels.
All universities maintain a centralised register of conflicts of interest or disclosed interests. However:
- 4 universities do not update the register annually (same 4 which do not require employees to annually update their declared interests)
- 1 university’s register only includes staff in higher-risk roles and does not include senior executives.
Without an up-to-date register of disclosed interests, particularly covering senior executives, it is more difficult for the university to ensure that actual or perceived conflicts are appropriately managed when making decisions.
RecommendationUniversities should strengthen policies and procedures for managing conflicts of interest by:
|
Employees had undeclared interests in businesses that had transacted with the university
This year, we matched NSW universities’ employee and vendor data to the Australian Securities and Investments Commission (ASIC) database of registered organisations and their key officers to identify potential conflicts of interest, secondary employment arrangements and related party risks. Matched entities were refined to identify which entities had transacted with the university during the year.
Our aggregated testing results identified over 790 instances of employees with directorships in companies that are on the university’s vendor master file. From a sample review, 30% of instances could not be found as declared on the university’s conflict of interest register. However, as noted earlier in this report, some registers are incomplete and do not cover all employees. Furthermore, some of the instances could be affiliated or related entities of the university where the directorship is a result of an employee’s role or otherwise openly known within the university.
Over 450 matched entities (including those that were declared) transacted with universities in 2025, with total payments of $353 million.
The 4 largest payments identified to an individual vendor at each university are listed below.
| Amount | Type of entity | Interest declared? | Other information |
| $41.8 million | Affiliated health research entity | No | The employee’s directorship arose by virtue of their role at the university and may not have been declared due to a lack of clarity in the university’s conflicts of interest policy regarding the treatment of affiliated entities |
| $27.8 million | Affiliated health research entity | Yes | -- |
| $7.8 million | Company | Yes | -- |
| $1.8 million | Company | No | This was a casual employee who did not declare interests under the university’s policy. |
We identified 44 matches which related to senior executives, of which 10 instances were not declared. Two of these were due to senior executives having left the organisation without completing year-end key management personnel disclosures and 2 related to directorships on related entities.
The results of the data analytics procedure and list of matched employees and vendors were referred to the universities’ governance or internal audit units for further review.
Procurement
Effective internal controls and governance over procurement can help universities deliver services to the public efficiently and effectively. Procurement procedures should also uphold the principles of fairness, transparency and ethical conduct, which include managing conflicts of interest, both perceived or actual.
Most universities require procurement staff to undertake mandatory training
One university does not provide training to its procurement staff on performing procurement activities. Such training is intended to cover regulatory compliance matters, risks such as fraud or corruption prevention and modern slavery. Three universities do not make procurement training mandatory for staff engaged on procurement activities, which may lead to inconsistent knowledge levels in staff.
Six universities do not perform a periodic independent review of past procurement decisions
Independent reviews of past procurement decisions may help identify shortfalls in procurement practices and highlight potential financial wastage. Outcomes from these reviews can inform future procurement activities and is best performed by an independent party such as internal audit who may have recommendations or insights outside of the existing procurement experience. These reviews are also an opportunity to update policies and training content for improved practices.
Two universities do not have policies requiring approval of business cases for significant procurement
The preparation of business cases in support of major procurement is a key control for demonstrating that such procurement decisions are well-justified, aligned with organisational priorities and deliver value for money.
The procurement policies of 2 universities did not require business cases to be approved for significant procurement.
Without a policy requiring approval of business cases, universities risk making significant procurement decisions without adequate assessment of need, costs, benefits, risks or alternative options. This reduces transparency in decision-making and limits senior management’s ability to assess whether the procurement was conducted with value for money in mind.
Most universities allow discretion in calling public tenders for major procurement
Although all universities require a tender process for procuring goods and services over a specified dollar value, most universities’ procurement policies do not set mandatory requirements for holding public tenders. Current university policies allow more judgement or discretion for holding public tenders. While a select tender (inviting a select group of suppliers to apply for the contract) may be more efficient, limiting the number of prospective tenderers has the potential to lead to higher costs. It is also less transparent and may exclude new suppliers with innovative solutions.
Other findings on the procurement process are listed below.
| Observation | Number of universities |
| No formal procedure requiring review of the central conflict of interest/declared interests register before awarding procurement contracts | 4 |
| No guidance on performing supplier due diligence checks | 3 |
| No standard policy or process to ensure a best and final offer is obtained from the supplier | 4 |
Our review of the 2 largest tenders awarded in 2025 at each university found 2 instances whereby a university did not obtain conflict of interest declarations from all tender evaluation panel members, which was a requirement in its policy.
Reviewing the central conflict of interest/declared interests register with respect to the preferred supplier before awarding and finalising procurement contracts is important for managing potential perceived conflicts of interest. Declarations by senior executives of any potential conflicts or declared interests helps avoid the perceived risk of conflict, even if they are not directly involved in the procurement process and outcome. Perceived conflicts can arise from:
- a senior executive’s position to indirectly influence others in the procurement process or provide information to the prospective supplier that gives them an advantage
- management of the contract or supplier performance, for example, if a senior executive is involved in reviewing the supplier’s work and may not be completely objective.
Supplier due diligence checks are a risk management process used to verify a supplier’s legitimacy, financial stability, operational capability and ethical standards.
They include ensuring the supplier:
- is a genuine business
- is capable and reliable
- is financially viable
- has the required authorities, licences and status
- is of good repute and integrity.
The best and final offer (BAFO) process obtains a final, revised price proposal from shortlisted suppliers prior to finalising selection. This aims to encourage suppliers to sharpen pricing, often after project scopes are finalised or details clarified. For fairness, the BAFO process should be disclosed up front in the approach to market documents. From our review of the 2 largest tenders at each university, of the 7 universities that performed a BAFO, one university did not disclose this approach up front to suppliers.
A robust and transparent BAFO process upholds competitive integrity and maintains supplier trust while securing value for money outcomes.
6.3. Controlled entities
NSW universities collectively operate over 70 controlled entities serving different functions including, education pathway services, student and staff amenities, overseas campuses, research commercialisation, charitable foundations and various other businesses.
The number of university-controlled entities decreased
At 31 December 2025, the total number of controlled entities in the sector decreased from 74 to 72. During the year, 3 university-controlled entities were closed (2 with the University of New South Wales, one with the University of Technology Sydney) and one new controlled entity was established (University of Wollongong).
Twelve controlled entities were non-operating at 31 December 2025 (12 in 2024). These include corporate trustees that do not trade and entities that have ceased to operate due to business rationalisation. Twenty-four controlled entities reported losses in 2025 (24 in 2024).
A greater number of controlled entities is associated with a heightened risk of compliance issues. As previously recommended in the Auditor-General’s Universities 2018 audits report to Parliament, universities should continue to ensure they have appropriate governance arrangements to oversee the legal and policy compliance functions of their controlled entities, particularly those operating overseas.
Some university-controlled entities were omitted from governance processes, specifically in the area of legislative compliance
Responsibility for monitoring controlled entities’ risk management and compliance with laws and regulations can be devolved to the controlled entity itself or overseen by the parent university.
All university-controlled entities were covered in risk management processes, whether directly themselves or through the university parent. This included risk registers maintained for all controlled entities.
One university has designated the university council as the primary governing body for monitoring some controlled entities’ legislative compliance but does not maintain a legislative compliance register relating to the controlled entity’s operations. On the other hand, 3 universities (including the one university at the start of this paragraph) assigned oversight and legislative compliance responsibilities to their controlled entities despite these entities not maintaining their own legislative compliance register.
RecommendationUniversities should strengthen the governance of controlled entities by clarifying roles and responsibilities over legislative compliance for each of the entities. |
The table below details the number of controlled entities by university.
| University at 31 December 2025 | Total number of controlled entities | Number of non-operating entities | Number of overseas entities |
| Charles Sturt University | 2 | 0 | 0 |
| Macquarie University | 13 | 8 | 1 |
| Southern Cross University | 2 | 0 | 0 |
| University of New England | 5 | 1 | 0 |
| University of New South Wales | 13 | 1 | 5 |
| University of Newcastle | 4 | 0 | 1 |
| The University of Sydney | 5 | 0 | 2 |
| University of Technology Sydney | 8 | 1 | 4 |
| University of Wollongong | 13 | 1 | 8 |
| Western Sydney University | 7 | 0 | 1 |
| Total | 72 | 12 | 22 |
Source: University and controlled entities’ financial statements (audited).
7. Enrolment and teaching outcomes
Universities’ primary objectives are teaching and research. They invest most of their resources to achieve quality outcomes in academia and student experience. Universities have committed to achieving certain government targets and compete to advance their reputation and standing in international and Australian rankings.
This chapter outlines enrolments and teaching outcomes for NSW universities in 2025.
Chapter highlights
|
7.1. Student enrolments
Overall student enrolments increased by 6.9%
Overall enrolments increased by 21,410 equivalent full-time study load (EFTSL) students in 2025 from 310,070 EFTSL to 331,480 EFTSL (EFTSL are rounded to the nearest 10).
The graph below shows the movement and composition of student enrolments over time. Domestic student enrolments increased from 206,900 to 217,840 EFTSL. Overseas student enrolments increased from 103,170 to 113,640 EFTSL.
Source: Provided by universities (unaudited).
Enrolments in IT, engineering and related technologies increased the most
The largest increases in student enrolments at NSW universities in 2025 were in:
- IT, engineering and related technologies courses, with 5,383 more enrolments than in 2024 (9.6% increase)
- education courses, with 4,400 more enrolments compared to 2024 (20.5% increase)
- society and culture courses, with 3,737 more enrolments than in 2024 (5.6% increase).
The only field with decreased enrolments was hospitality and mixed field programs, which declined by 20.1%.
The graph below shows the movement in student enrolments by EFTSL by field of education between 2024 and 2025.
Source: Student numbers are provided by universities (unaudited).
Students from low socio-economic status backgrounds
The participation rate of students from low socio-economic status backgrounds decreased slightly in 2024
In 2023, the Australian Universities Accord recommended the Australian Government adopt participation targets to support under-represented groups. The recommended participation target for students from low socio-economic status backgrounds is 20.2% of domestic undergraduate enrolments by 2035.
The 2024 results showed 5 NSW universities achieved this recommended target. The total percentage of domestic undergraduate students being from low socio-economic status backgrounds decreased slightly from 15.8% in 2023 to 15.2% and remained below the recommended target of 20.2%.
Reported enrolments of domestic undergraduate students from low socio-economic status backgrounds in 2024 as a percentage of total domestic undergraduate students is shown in the graph below.
Source: Australian Department of Education, Student Data 2024, Section 11: Equity groups.
Enrolment statistics for 2025 are not expected to be available from the Australian Department of Education until late 2026.
Students from Aboriginal and Torres Strait Islander backgrounds
In this document, the term Aboriginal people is used to describe Aboriginal and Torres Strait Islander peoples. The Audit Office of NSW acknowledges the diversity of traditional Nations and Aboriginal language groups across the state of NSW.
The participation rate of Aboriginal students increased slightly in 2024
The Australian Universities Accord recommended the Australian Government adopt a participation target for Aboriginal students to represent 3.3% of domestic undergraduate enrolments by 2035.
The 2024 results showed 5 NSW universities achieved this recommended target. The total percentage of domestic undergraduate students being from Aboriginal backgrounds increased slightly from 2.5% in 2023 to 2.6% and remained below the recommended target of 3.3%.
Reported enrolments of Aboriginal students in 2024 as a percentage of total domestic undergraduate students is shown in the graph below.
Source: Australian Department of Education, Student Data 2024, Section 11: Equity groups.
Enrolment statistics for 2025 are not expected to be available from the Australian Department of Education until late 2026.
7.2. Teaching outcomes
Graduate employment rates
Six universities exceeded the national average for domestic undergraduate full-time employment rates in 2024
Universities assess the employment outcomes of their graduates by using published data from surveys conducted by the Australian Department of Education’s agents. The survey timeframe for employment outcomes is about 4 to 6 months after completion of studies.
Graduate employment outcomes vary across universities. According to the 2024 independent survey, 6 of 10 NSW universities exceeded the national average of 74% for full-time employment rates of their domestic undergraduates. Five universities performed better than the national average of 88.1% for full-time employment outcomes of their domestic postgraduates.
The national averages for both undergraduate and postgraduate full-time employment rates declined from 2023, which were 79% and 90.3% respectively.
The survey results indicate that, in the short-term, postgraduates are more likely to be employed full-time compared to those who completed an undergraduate qualification. These results reflect that postgraduates are more likely to be well established in the workforce prior to undertaking their postgraduate studies.
The graph below presents the results of the 2024 survey by university.
Source: Quality Indicators for Learning and Teaching ‘2024 Graduate Outcomes Survey National Report’, published September 2025, funded by the Australian Department of Education.
Overseas student graduates’ employment rates continued to be consistently lower than those for domestic graduates. In 2024, the undergraduate full-time employment rate for overseas graduates was 52.3%, down from 59.7% in 2023. For postgraduate coursework full-time employment, the rate for overseas graduates was 56.1% compared to 60.7% in 2023. The Quality Indicators for Learning and Teaching (QILT) report explains the lower rates for overseas undergraduates is because they are more likely to go straight into postgraduate studies following completion of their undergraduate qualification. This means they are less likely to have established themselves in the workforce compared to domestic graduates.
Ratio of students to academic teaching staff
The ratio of students to academic staff provides a broad indication of potential constraints on the level of support available to students, the quality of the learning experience for students and the average teaching workload. A lower ratio means that there are fewer EFTSL students per FTE academic staff.
The average ratio has increased to 18.2 students per academic staff, indicating larger class sizes
Overall, the ratio in the sector has increased from an average of 17.2 students per academic staff in 2024 to 18.2 in 2025.
The student to academic staff ratio for NSW universities for 2024 and 2025 is shown in the graph below.
Formula used to calculate the ratio: Total students (EFTSL) divided by total academic staff (FTE).
Note: The figures used in the calculation relate to EFTSL and FTE at the parent university. International offshore students were excluded if they were taught offshore by local agents (not university staff).
Source: Audit Office analysis based on data provided by universities (unaudited).
The ratio increased for all universities in 2025. This is consistent with the 6.9% increase in student enrolments, while academic staff FTE only increased by 0.3%.
Course offerings
Across the NSW university sector, the number of courses offered has been declining over the past 3 years, with a similar decrease in the number of subjects taught. Courses refer to a degree or qualification, such as a Bachelor of Commerce. Subjects refer to a unit of study, such as ACCT101 Accounting Foundations. Completion of a course is comprised of many subjects and some subjects may form part of multiple courses.
The graph below shows the movement in the number of courses and subjects in aggregate across the universities from 2024 to 2026.
Source: Provided by universities (unaudited).
In aggregate, there was a 9% decrease in the number of courses offered from 2024 to 2025 and 5% decrease from 2025 to 2026. The decrease in the number of subjects was 3% and 6% for the respective years.
The larger decreases at individual universities have been consistent with those that have implemented formal plans to reduce the size of their workforce. In 2025, the largest decrease in courses was 59% and the largest decrease in subjects was 11%. The 59% decrease in courses was due to reductions in double degree combinations offered at the university.
While streamlining of courses and subjects is a method of reducing costs, there may be broader implications such as:
- risks to teaching quality and student satisfaction if class sizes and workloads are increased
- impact on student access and equity with narrower academic pathways
- reduced student confidence and reputation of the university
- loss of institutional capability.
8. Cyber security
Cyber security is a key risk area for universities due to increasingly complex digital environments. Inadequate management of these risks can disrupt operations, compromise sensitive data and damage reputations. Reliance on third-party vendors and broader information and communication technology supply chains adds risk where external partners may not have cyber security controls equivalent to those of universities. Understanding and managing cyber risk, including risks from third parties, is essential for maintaining business continuity and protecting valuable data and systems.
This chapter analyses how universities:
- manage internal and supply chain cyber security risks
- manage legacy systems
- control and monitor their cyber security investments.
Chapter highlights
|
8.1. Background
Universities operate complex and decentralised technology environments and continue to face increasing cyber security risks. The Cyber Security Insights 2025 report indicates that while universities have strengthened their cyber security frameworks and governance, gaps remain in how cyber risks are identified, prioritised and managed. These gaps can undermine the protection of sensitive data and the reliability of systems supporting core university operations.
Cyber threats can disrupt university operations, compromise sensitive data and damage reputation. Reliance on third-party vendors and broader information and communication technology supply chains introduces additional risk where those parties lack robust cyber security controls. Effectively understanding and managing cyber security risks, including risks arising from third parties and the broader supply chain, is essential to maintaining business continuity and safeguarding critical data and assets.
The continued use of legacy systems further increases cyber security risk across the university sector. These systems can be difficult to patch, monitor and integrate with modern security controls which can reduce visibility and limit the effectiveness of detection and response activities. Managing legacy system risks requires clearly articulated strategies, including the use of compensating controls and plans to upgrade, or replace, or decommission systems where appropriate.
To respond to these risks, universities have implemented a range of controls and invested in cyber security tools and services to protect their information assets and technology environments. It is important that these investments are regularly assessed and monitored to ensure they remain effective, fit for purpose and responsive to evolving threats. Ongoing evaluation also supports value for money outcomes by helping universities identify whether expected benefits are being realised and whether cyber security resources are being used efficiently.
8.2. Managing supply chain cyber security risks
As universities increasingly rely on complex technologies and third-party services, the potential for cyber threats from these third parties grows significantly. Universities remain accountable for managing cyber risks across their supply chains, including those arising from third parties, to maintain business continuity and protect valuable data and assets.
Weaknesses in managing supply chain cyber security risks can limit universities visibility over critical systems, reduce the effectiveness of cyber controls, and hinder their ability to respond to and recover from cyber incidents.
We reviewed the process in place for managing cyber security risk, including those arising from supply chains. We focused on determining whether universities:
- effectively maintain, manage and monitor their cyber security risks, encompassing both internal threats and those associated with third parties and overall supply chains
- maintain an up-to-date inventory of all assets related to both external and internal systems, supported by robust procedures to ensure completeness and appropriate risk classification of each asset
- employ structured protocols for third-party management, including rigorous due diligence practices, clear definition and oversight of roles and responsibilities, as well as ongoing management of security risks throughout the lifecycle of IT partnerships.
Four universities do not have a formal strategy to ensure the IT asset register for externally hosted systems is complete
Eight universities have established IT asset registers covering their external vendors with 6 of these universities having a formal strategy in place to ensure its completeness. Without a documented strategy to include all externally hosted systems, universities may have an incomplete view of the systems that process or store sensitive information. This limits effective risk classification and control coverage.
There are weaknesses in managing third-party cyber security risks
Universities that do not effectively manage third-party cyber security risks may be exposed to significant vulnerabilities that can result in data breaches, operational disruptions, financial losses and reputational damage.
Formal due diligence processes are in place for 9 universities and are required to be completed before entering supplier relationships. The university without a due diligence process advised that they are working on including cyber security clauses in new contracts.
In addition, of the 10 universities:
- 4 universities have not specified cyber security roles and responsibilities for vendor or other third-party relationships within their contract
- 3 universities do not monitor and enforce third-party cyber security responsibilities throughout the technology product and service lifecycle
- 5 universities do not have a formal process or plan to ensure security risks and resilience are managed after termination of IT partnership or service agreements
- 9 universities test their cyber incident response plans. Five of these do not include relevant third‑party providers in testing, despite those providers being essential to the operation of key systems.
Case study - Cyber incident involving supply chain risks A cyber incident affected one university’s student management system, which was hosted by a third-party provider on a cloud-based platform. The university identified unusual activity on 6 August 2025 and 11 August 2025. An investigation started immediately and the university directed the third-party provider to shut down access to the platform. The investigation found the unauthorised access to the system was obtained through an earlier and longer breach (between 19 June and 3 September 2025) of another external system linked to the student management system. Unauthorised entry through third- and fourth-party systems enabled personal information to be accessed and taken from the student management system. The university’s investigation confirmed that the information impacted included personal, financial, health and legal information. The stolen data from the incident was subsequently used in fraudulent emails sent to some members of the university community on 6 October 2025. This incident illustrates how supply chain dependencies can expand an entity’s attack surface and reinforces the need for strong third-party cyber security risk management. Key lessons for the sector:
|
8.3. Managing legacy systems
Legacy systems can be difficult and costly to maintain and may not support modern security requirements. In a constantly evolving cyber threat environment, these systems can increase risk through security vulnerabilities, outdated controls, limited vendor support and may not be updated or monitored regularly.
Weak management of legacy systems can increase universities’ exposure to cyber incidents, reduce confidence in system reliability, and limit their ability to detect, respond to and recover from cyber security events.
We examined whether universities:
- maintain an inventory of legacy systems and assess the risk associated with each legacy system
- document a strategy or roadmap to upgrade, replace or decommission of legacy systems
- include legacy systems in vulnerability management and patching processes.
Three universities do not maintain an inventory of legacy systems
Three universities do not maintain an inventory of legacy systems used in the organisation and 6 have not formally assessed the risks associated with each legacy system.
One university has not implemented any processes to manage legacy systems, maintain an inventory of these systems or assess the risks. Moreover, the university does not have a plan in place to replace or decommission legacy systems and does not apply patches or design compensating controls when patching is not possible.
Four universities do not have a strategy or roadmap for upgrading, replacing or decommissioning legacy systems
Without a defined strategy or roadmap, universities may continue relying on ageing technology, increasing exposure to security weaknesses or unexpected system failures.
Four universities do not include legacy systems in patching or vulnerability management processes
Among the 6 universities that include legacy systems in patching or vulnerability management processes:
- one university does not have compensating controls for systems that cannot be updated or patched due to technical limitations
- one university does not have enhanced monitoring or logging in place to detect potential security risks affecting legacy systems.
Case study - Cyber incident involving historical data One university experienced a cyber incident involving unauthorised access to an online IT code library used for software storage and development. The university’s investigation found that the accessed data, used for developing and testing code for university systems, included personal information for over 20,000 current and former staff, affiliates, students, alumni and supporters, including historical data from 2010. The university responded by blocking the unauthorised access, starting an investigation, implementing cyber security procedures to strengthen the security of other university systems, purging the identified datasets from the code library and notifying relevant authorities. The unauthorised access was limited to a single system and did not affect other university systems. This incident highlights that risks associated with legacy environments can extend beyond the systems themselves, as legacy systems often generate large volumes of historical data that may continue to be retained after the systems are no longer in use. Key lessons for the sector:
|
Case study - Example of a more mature legacy systems risk management One university has established processes to mitigate risks associated with legacy systems that remain in use. Management has formally assessed the risks associated with each legacy system. Security monitoring and vulnerability scanning tools are used to support the ongoing identification of security vulnerabilities and other risks affecting legacy environments. The university has a formal approach to upgrade or replace end-of-life systems through its mandatory upgrades and enhancements roadmap in 2025. This roadmap prioritises mandatory upgrades to maintain regulatory or legal compliance, information security or contractual obligations. It also identifies planned upgrade and replacement activity for systems affected by end-of-life status, vendor support limitations or security risks. Legacy systems are included within the university’s vulnerability management and patching processes. Ongoing security scanning has identified unsupported software and recommended upgrades, patching, isolation of legacy applications where needed and application allowlisting. Where technical limitations prevent systems from being updated or patched, the university has implemented enhanced monitoring as a compensating control. Key lessons for the sector:
|
8.4. Managing cyber security spending
Universities are investing more in cyber security to protect their data and systems. As threats and technologies evolve, universities need to monitor whether these investments remain effective and aligned with identified risks.
Inconsistent processes for managing cyber security spending can lead to duplicated controls, misalignment with priority risks and challenges in demonstrating value for money.
We analysed the processes in place for managing cyber security procurement and subsequent benefits realisation, including identifying and managing duplicate/redundant cyber security tools and services.
We focused on whether universities:
- perform and document a cost-benefit analysis during the procurement process for cyber security tools and services and if they compare outsourcing versus in-house options
- have an established process for setting and monitoring return on benefit realisation related to cyber security spending
- have a formal strategy to prevent resource wastage or duplication of efforts in cyber security initiatives.
There is a lack of established processes to set and monitor benefit realisation from cyber security spending
Seven universities do not have a process to set and monitor return on benefit realisation for cyber security spending.
Seven universities also do not have a formalised procedure for taking action when cyber security investments fail to achieve expected benefits or outcomes.
Three universities do not have a strategy in place to prevent resource wastage or duplication of efforts in cyber security initiatives (including but not limited to procurement of services/tools, training, etc).
Eight universities have not identified underutilised, redundant or outdated cyber security tools and services
Most universities maintain a register or inventory of their cyber security tools and services. However, only 2 identify and manage underutilised, redundant or outdated tools and services.
Managing underutilised, redundant or outdated cyber security tools and services helps universities:
- strengthen the overall security posture by ensuring that all cyber security tools and services remain effective and up-to-date, thereby reducing vulnerabilities and exposure to cyber threats
- optimise resource allocation, allowing universities to reallocate funds from ineffective tools to more impactful security measures, which not only enhances overall security but also ensures that the cyber security budget is used efficiently
- reduce complexity in the technology environment, making it easier to monitor and maintain protection for systems and data.
9. Artificial intelligence
NSW universities are actively exploring AI-driven solutions for teaching, research and administration.
We have evaluated the maturity of AI adoption and governance across NSW universities, focussing on progress made by universities since the previous year. This chapter examines:
- the use of AI across universities
- whether appropriate governance, risk and assurance mechanisms are in place to support the ethical adoption of AI
- future plans and strategies for AI use.
Chapter highlights
|
9.1. Background
To safeguard ethical standards and uphold the integrity of public institutions, it is essential that universities establish robust governance frameworks to guide the development, deployment and oversight of AI technologies. Such frameworks not only support responsible innovation but also ensure that AI is used in a way that aligns with public expectations.
Our Universities 2024 report commented on the use and governance of AI by universities for the first time. We found that AI use and its governance varied widely among universities and highlighted the need for universities to strengthen transparency, oversight and strategic coordination in their use. The report recommended universities should:
- create a central AI inventory to document its purpose, uses and limitations for transparency, oversight and accountability
- establish and implement an AI policy and embed the consideration of AI use into governance and risk management frameworks
- consider the benefits of developing an AI strategy to support the co-ordination of AI initiatives with strategic objectives.
The Australian and NSW governments have established policies and principles for responsible and ethical use of AI, which offer a valuable reference point for the university sector. While NSW universities are not bound by these frameworks, they are considered best practice.
The frameworks issued by both the Australian and NSW governments establish:
- AI ethics principles
- AI assurance assessment requirements
- various other guidance and supporting material, including specific guidance on facets like generative and agentic AI and procurement essentials.
9.2. Artificial intelligence adoption
Universities continue to adopt a diverse array of AI tools. According to the latest data, the most common approach to sourcing AI is through features embedded within existing software suites and AI systems sourced from third-party providers. Enterprise-wide, approved AI platforms and standalone AI tools are also commonly implemented. In addition, 7 universities have developed their own in-house AI solutions, highlighting a mix of external adoption and internal innovation across the sector.
Source: Provided by universities (unaudited).
Some universities lack oversight of the AI systems they have implemented
Maintaining an inventory of AI systems supports transparency, oversight and accountability. Eight universities now have or are in the process of developing an AI register (6 in 2024).
Not maintaining an AI register inhibits the effectiveness of a university’s oversight or ability to fully account for the AI tools implemented across its institution. Coverage of AI systems used by contractors and supply chain partners remains limited and is not captured in AI registers.
Improved oversight would support more mature governance, risk management and organisational planning.
9.3. Policies for responsible use of artificial intelligence
Good governance and assurance arrangements support the effective delivery of ethical and lawful AI. A university should ensure arrangements are proportionate, adaptable and fit for the risks posed by AI to the institution.
Most universities have policies for responsible use of AI
Consistent with our previous findings, 3 universities have yet to establish an institution-wide AI policy or embed AI into existing policies. Policies and statements adopted by universities commonly addressed fairness, transparency, accountability, privacy, security and intellectual property considerations.
Universities are generally relying on existing risk, IT and data management frameworks, without considering the unique risks posed by AI
AI-specific risk management across the AI lifecycle remains uneven. Five universities have an AI governance and risk framework that addresses AI-specific risks across the lifecycle. Two universities have leveraged their existing enterprise risk frameworks to address AI risks whereas 3 have not contemplated the risk of AI at all.
Additionally, universities are relying on existing frameworks for areas such as data breach management and incident detection, monitoring and response without having assessed these for specific gaps that may exist because of the increased use of AI.
Traditional frameworks may not adequately cater or address new vulnerabilities or threats introduced by AI, potentially leaving institutions exposed to incidents that existing controls do not mitigate.
Procurement policies are not keeping pace with AI adoption
Despite the rapid uptake of AI in its various forms, procurement guidance remains inconsistently tailored to capture the specific and unique risks posed by AI. Only 2 universities have procurement guidance in place that explicitly captures AI-related procurement considerations. A further 3 rely on other existing procurement practices to manage risks associated with AI in the procurement process.
Given the prevalence of vendor-supplied AI, procurement documentation and contractual arrangements are a critical control point for managing AI risks.
RecommendationUniversities should support the adoption of AI by establishing and implementing an AI policy, and embedding the consideration of AI use into governance, risk and procurement frameworks. |
There are mixed approaches to managing student use of AI
As public education providers, universities face unique challenges from generative AI, including risks to degree integrity. All universities reported adjusting assessment design or monitoring practices to uphold academic integrity, supported by training and guidance.
Detection approaches vary. Five universities reported using AI-detection software, 2 reported using non-AI detection tools and others described mixed approaches or limited access. Several universities emphasised safeguards, such as human review, corroborating evidence beyond automated detection outputs, and established misconduct processes to avoid false accusations or bias.
All universities reported delivering training or awareness programs for both students and staff in the last 12 months. Student training was reported as mandatory at 4 universities and optional at 4, with the remainder describing mixed arrangements.
9.4. Strategic use of artificial intelligence
Enhanced visibility of opportunities, challenges and risks will better position universities to leverage the benefits of AI, however, 4 do not yet have an AI strategy
Universities report a range of persistent hurdles in adopting AI responsibly, spanning technology, governance and culture. Common issues include:
- outdated systems and data governance gaps that hinder safe AI integration
- concerns about privacy, security, and algorithmic bias in AI systems
- challenges in maintaining academic integrity as generative AI tools disrupt traditional assessments
- the need to uplift staff and student AI literacy through training and change management.
As the creation of purpose-tailored AI agents becomes more common across universities, agent management and governance is emerging as an additional challenge. Many institutions also struggle to balance rapid innovation with robust oversight, noting difficulties in establishing consistent AI governance across diverse operations. These sector-wide challenges underscore the importance of a comprehensive, risk-managed approach to AI adoption.
Six universities recognise AI as strategically material by capturing AI risks in their strategic risk register. Similarly, 6 universities have an AI strategy or have embedded this into an existing strategy (4 in 2024). The challenges noted above reinforce the importance of comprehensive strategies, robust governance and reporting frameworks, and clear roadmaps to ensure universities can fully leverage the benefits of AI while safeguarding against associated risks.
Source: Provided by universities (unaudited).
RecommendationUniversities should consider the benefits of developing an AI strategy that can be integrated into a broader organisational plan to ensure that AI initiatives are coordinated and aligned with universities’ strategic objectives. |