Higher Education Standards Committee, Australian Tertiary Education Commission
The Group of Eight (Go8) consents to the publication of this high-level submission and has no wish for any of it to be treated as confidential.
The Go8 strongly supports measures that protect Australia’s research, innovation and national interest.
Research security is not a peripheral issue for the Go8. Our universities undertake around 70 per cent of Australia’s university-based research, graduate more than half of Australia’s PhD candidates and manage many of the nation’s most significant international research partnerships and research infrastructure.
Research security is therefore a core responsibility and a longstanding priority for our institutions.
The Go8 has played a leading role in strengthening Australia’s research security arrangements, including through the establishment of the University Foreign Interference Taskforce (UFIT) and ongoing collaboration with government. We therefore strongly support the objective of strengthening Australia’s research security framework
The issue raised by this consultation is not whether research security matters. It does.
Nor is the issue whether universities should be accountable for managing research security risks. They should be.
The question is what role the Higher Education Standards Framework (Threshold Standards) should play within Australia’s broader research security architecture.
Research security is fundamentally a national security and risk management issue. It is not a higher education quality issue.
The Threshold Standards should therefore provide assurance that institutions have appropriate governance arrangements in place, but they should not create operational research security obligations or expand TEQSA’s role into that of a research security regulator. Responsibility for developing and overseeing operational research security requirements should remain with government agencies, funding bodies and security agencies with specialist expertise. Ignoring that reality is itself a risk.
Recommendations
Recommendation 1
The Go8 supports the inclusion of research security within the Threshold Standards only if it is through a principles-based, governance obligation.
The Standards should require institutions to demonstrate that appropriate governance, oversight and assurance arrangements are in place to identify, assess and manage research security risks, while preserving flexibility for institutions to implement measures that are proportionate to their size, mission, research profile and risk exposure.
Recommendation 2
The Threshold Standards should not impose operational research security requirements, prescribe specific controls or establish a parallel research security regulatory framework.
The role of TEQSA should be focussed on assuring that institutions have effective governance arrangements in place. Responsibility for operational oversight, regulatory intervention and specialist guidance should remain with the government agencies responsible for research funding and security and national security matters.
Recommendation 3
Any amendments should complement and align with existing frameworks, including the Australian Code for the Responsible Conduct of Research, the UFIT Guidelines to Counter Foreign Interference in the Australian University Sector, the ARC Research Security Framework, the Foreign Arrangements Scheme and other research security requirements attached to publicly funded research, while avoiding duplication, regulatory overlap and uncertainty regarding institutional and government responsibilities.
The Go8 does not suggest that the current research security architecture is complete or fully fit for purpose. Research security risks continue to evolve and existing arrangements, including the Australian Code for the Responsible Conduct of Research and the UFIT Guidelines, will require periodic strengthening, refinement and updating. The question for this consultation is not whether those frameworks should continue to develop, but whether the Higher Education Standards Framework is the appropriate vehicle for imposing new operational requirements. The Go8 considers that the Threshold Standards should support and complement existing frameworks through governance and accountability requirements, rather than duplicate or replace them.
Discussion
Research security requires continuous improvement
As Australia’s leading research universities, the Go8 recognises that research security is fundamental to maintaining national capability, protecting sensitive knowledge and preserving public trust in the research system.
The Go8 approaches this consultation from the perspective of universities that undertake the majority of Australia’s university-based research and having a substantial stake in the success of Australia’s research security framework.
Research security is already a core institutional responsibility for our members. Significant progress has been made across the sector in building systems, capability and governance arrangements to identify and manage research security risks.
However, research security is not a static challenge. The risk environment continues to evolve, requiring institutions to continuously assess, adapt and strengthen their approach.
The Go8 recognises that Australia’s broader research security architecture must also continue to evolve. Existing frameworks, guidance and regulatory settings have made an important contribution to strengthening research security across the sector, but they should not be regarded as complete or immutable. As technologies, international collaborations, geopolitical circumstances and national security risks evolve, so too will the need to strengthen and refine the frameworks that support research security. The objective should be continuous improvement across the entire system rather than the creation of overlapping regulatory obligations.
No institution will get every decision right every time. The objective should be continuous improvement in the identification and management of risk rather than compliance with increasingly prescriptive rules and processes.
For that reason, the Go8 supports the principles-based and outcomes-focused approach reflected in Part A of the existing Threshold Standards. This recognises that institutions differ significantly in size, mission, research intensity, international engagement and risk profiles.
Research security risks also vary significantly across disciplines, technologies, partnerships and jurisdictions.
Effective risk management therefore depends on institutions being able to exercise judgement and implement measures proportionate to their circumstances.
A heavily prescriptive regulatory or compliance-based approach is unlikely to improve research security outcomes and risks diverting effort away from the identification and management of genuine risks.
TEQSA should assure governance, not regulate research security
The Go8 supports a role for TEQSA in assuring that governing bodies maintain appropriate oversight of research security risks.
However, TEQSA is a higher education quality and standards regulator. It is not a national security agency, an intelligence agency or a research security regulator.
Research security increasingly involves matters relating to foreign interference, critical and emerging technologies, strategic capability, defence interests, intelligence assessments and international risk. These issues rely on specialist expertise and information held by government agencies rather than higher education regulators.
The Threshold Standards appropriately require governing bodies to satisfy themselves that effective risk management arrangements exist – including for research security risks.
The Threshold Standards should not require TEQSA to assess the adequacy of individual research security controls, research collaborations or operational decisions.
To do so would risk creating a de facto research security regulator without specialist expertise, intelligence capabilities or statutory role necessary to perform that function.
Nor should the inclusion of a reference to research security within the Threshold Standards be interpreted as transferring responsibility for research security regulation to TEQSA. Research security requires specialist expertise and government capability. The role of the Threshold Standards is to assure governance, not regulate the operational management of research security risks.
Avoid duplication and regulatory overlap
Australia’s research security framework continues to evolve, including through recent changes to the Foreign Arrangements Scheme and broader work across government to strengthen research security arrangements.
In this environment, clarity of roles and responsibilities is essential.
The Go8 recognises that some existing research security frameworks and guidance will require continued development to respond to emerging risks, technologies and geopolitical challenges. Strengthening Australia’s research security architecture should remain an ongoing priority for government and the sector alike.
However, the Threshold Standards should not create overlapping responsibilities or duplicate obligations that already exist within specialist regulatory and policy frameworks. Rather, they should operate as an overarching governance and assurance mechanism that recognises and supports those frameworks.
The most effective approach is one that refers to existing arrangements, supports continuous improvement and maintains clear accountability across Australia’s broader research security system.
Conclusion
The Go8 supports strong and effective measures to safeguard Australia’s research and innovation system.
As the universities undertaking approximately 70 per cent of Australia’s university research, we recognise both the importance of research security and the responsibility that comes with it. Research security is already a major institutional priority for our members and one that requires ongoing vigilance, adaptation and continuous improvement.
The Go8 supports the inclusion of research security within the Threshold Standards only if it is through a principles-based governance framework.
Research security is a national security issue, not a higher education quality issue.
The role of the Threshold Standards should be to assure effective institutional governance, accountability and oversight. They should not create operational research security obligations, duplicate existing frameworks or expand TEQSA’s role into that of a research security regulator.
Existing research security frameworks will continue to evolve and should be strengthened where necessary to address emerging risks and challenges. The role of the Threshold Standards should be to complement those developments, reinforce institutional accountability and provide assurance that governing bodies are effectively overseeing research security risks.
Universities should manage research security risks. Government should provide the specialist expertise, intelligence, regulatory frameworks and guidance necessary to support that work. TEQSA should assure governance.
Maintaining those distinct roles will strengthen Australia’s research security framework while preserving clarity, accountability and regulatory effectiveness.