This content was previously published by Campus Labs, now part of Anthology. Product and/or solution names may have changed.

Unfortunately, we are seeing first-hand how a single root cause event can trigger interrelated consequences for an enterprise. While strong risk management practices can’t stop the spread of the coronavirus or prevent other pandemic risk events, enterprise risk management processes can help organizations anticipate the impact of these kinds of unforeseen, extraordinary events.  - Mark Beasley, Ph.D.

Over the past several years, numerous institutions have dealt with high profile risks and the resulting disastrous after-effects: hurricanes, mass shootings, suicides, sexual abuse, hate crimes and more. In these cases, individual campuses were thrust into the spotlight. Institutions were often criticized, second-guessed and held accountable for their lack of foresight and preparation and the resulting adverse consequences, even when the crisis was arguably unforeseeable. Today, the spotlight is not on just one campus, but all of higher education, as institutions struggle to manage risks – and seize opportunities.

So how is it that storied, well-established institutions of higher education so often miss the mark when it comes to identifying, assessing and mitigating risks? Most campuses still utilize a traditional risk management approach that is reactive, responding to crises and incidents on an ad hoc basis, with departments operating in fragmented silos and no focus on risk interrelatedness.

These unprecedented times demand a reevaluation of how institutions assess and respond to uncertainty. Enterprise Risk Management (ERM) systematically identifies, assesses and mitigates risk across an institution. ERM is integrated (spanning all organizational units), comprehensive (including all types of risk) and strategic (aligned with an overall business strategy). ERM has proactive board and senior administrative leadership and links institutional governance to the identification, evaluation, mitigation and monitoring of risks. ERM also incorporates the upside of risk – the opportunities.

Required by the SEC in the corporate sector, ERM can be difficult to adopt in higher education due to the complex interwoven missions of teaching and learning, research and service, decentralized administrative and faculty governance structure, and the “collegial” culture shaped by the competing demands of a diverse set of internal and external stakeholders. College and university assets go far beyond the physical and financial to include the institution's reputation.

Many campuses have effectively translated the tenants of ERM to campus culture using the ISO 31000 risk management framework. The purpose of University of Vermont’s ERM program is to enhance the University’s ability to achieve its mission, vision, and strategic objectives and strengthen its competitive position by fostering an institution-wide culture of risk and opportunity awareness and providing a structured, consistent, and continuous process for the early and proactive identification and reporting of risks and opportunities to senior management and trustees. UVM’s risk form the basis for decision-making about which risks or opportunities are priorities, what the appropriate response should be, and how resources should be allocated to manage the risk or opportunity in a way that best support’s their mission and strategy. form the basis for decision-making about which risks or opportunities are priorities, what the appropriate response should be, and how resources should be allocated to manage the risk or opportunity in a way that best support’s their mission and strategy.

An ERM approach helps an institution see both the positive opportunities and negative consequences associated with risk, and allows for more informed, and thus more effective, decision making. What’s more, it can be an active component in improving an organization’s governance and, ultimately, its performance. Key aspects of ERM to consider as institutions navigate their current and future decisions related to the pandemic include:

• Continue to evaluate and update previously developed preparedness and crisis management plans
• Reassess goals, objectives and performance measures – and adjust as needed
• Determine tolerable risk levels based on internal and external environmental scans
• Don't forget the upside – identify emerging opportunities
• Leverage data analytics and metrics to support ongoing risk monitoring

To consider how ERM applies at your institution, use the worksheet to ponder how your institution currently views risk and determine how you can embed enterprise risk management as a part of your institution’s overall strategy to achieve its mission.

Download the Campus Labs ERM worksheet

Additional Resources

• The ISO 31000 risk management framework
• University of Vermont’s ERM program
• UVM’s risk assessment process and framework