The advent of a new national regulatory and quality assurance regime in Australia, through the Tertiary Education Quality and Standards Agency (TEQSA), presents additional requirements to university governing bodies, for compliance with standards and for risk management. This paper discusses TEQSA's approach and potential vulnerabilities for TEQSA as the regulator. It then analyses issues for the membership, role and conduct of university governing bodies arising from TEQSA's requirements. The challenges and potential hazards of TEQSA's model for university governing bodies are outlined, with particular reference to the differences between the risk management and strategic goals of institutions and of the regulator. While focusing on the situation in Australia, the analysis is relevant to university governance in other countries where risk-based regulatory approaches are under development.