Risk-based approaches to higher education are in a number of countries seen as a way to create more effective and efficient regulation. Australia was an early mover in this direction, initiating risk-based regulation in 2011 when the Tertiary Education Quality and Standards Agency (TEQSA) was established as Australia's new national higher education quality assurance agency. This paper analyzes the characteristics and changes in the evolution of risk-based regulation over the period 2011-2024. Drawing on extensive document analysis, independent third-party analysis, and a small number of Delphi-interviews, we identify three distinct phases in TEQSA's approach to risk-based regulation: (i) 'hyper-regulation', (ii) a more dynamic regulatory approach, and (iii) an approach balancing protection as well as regulation of providers. The paper contributes to the discussion on risk-based regulation by refining existing conceptual models, analyzing how risk-based regulatory approaches evolve over time, thus allowing for insights of value for risk-based regulators elsewhere.