A robust ERM program creates a living document that helps decision makers identify risks and strategically allocate resources across the entire organization — on a daily basis.
Higher education administrators face institutional crises on a fairly regular basis. We often think of a crisis as something rare and devastating, but there’s an everyday, run-of-the-mill variety, too, and it calls for constant budgetary management and reprioritization. Business officers at colleges, universities, and other higher education schools know this far too well.
Consider this hypothetical yet all-too-familiar scenario: Some of your school’s administrators are pushing for essential new software; you know it’s necessary, but it wasn’t budgeted. There’s an email in your inbox outlining recently issued federal regulations that are sure to strain your fiscal processes. A storm raged through campus last night and blew part of the roof off an old building you’ve needed to raze but don’t yet have the funds to destroy. And on top of all this, you just got a notice that the local Office for Civil Rights has scheduled an ADA compliance site visit, which will very likely result in unplanned (and costly) facilities modifications.
That’s just a day in the life of a business officer, and if it hits a little too close to home, you may be encouraged and relieved to know that there is a way to help your president and board manage the barrage of challenges and adequately address each one: enterprise risk management (ERM).
If you have a robust ERM program in place, you can feel more confident about the process you will use to prioritize and respond to these crises — and better yet, prevent them from even becoming crises in the first place.
ERM is a timely process that informs important decisions
An effective ERM process should be tailored to your organization and designed to capture information for institutional leaders to evaluate in a methodical, consistent manner — but it must be timely. ERM is an overarching framework that helps your board members and administrative team identify, evaluate, and prioritize risks to the institution in its entirety. The process should be customized for your specific institution and incorporated into strategic and other executive-level planning activities. The end result is a living document that provides decision makers a basis for allocating resources in a strategic manner.
ERM helps you consider and manage risks holistically
All too often, risk identification and management occur in functional silos; technology, instruction, student services, legal, compliance, finance, and human resources. Yet all have a fiscal impact, and an incident in any of these areas can damage your public reputation or internal morale. A good ERM plan helps you stretch that thinking beyond the silo to the entirety of your institution so you can plan, prevent, and react more effectively.
ERM is a proactive process
A mature ERM process should be futuristic and forward-thinking, though your school might have to start by considering present risks and then address future risks as you go. To identify the most complete list of risks, ask yourself these four questions and take a hard look at your honest answers.
1. Are all the risks being identified?
A thorough process includes a methodical approach and engages the right stakeholders. One of the most overlooked sources for identifying risks and solutions are those who manage frontline personnel. Your frontline employees are in the best position to identify risks because they are in possession of details your leaders may never even consider, working through all of the exceptions and errors they encounter every day. They may not see the exceptions or errors as risks but rather mere daily problems they need to solve. They may not realize those errors could prevent the accomplishment of strategic goals. Training those who manage the front line activities to evaluate daily crises and to communicate those to higher level management provides executive leadership with critical information in identifying risks.
2. Are risks being identified before they become a crisis?
One of the most destructive patterns an organization can fall into is allowing threats to go unmitigated and to create crises. The continual derailment of personnel and fiscal resources to address emergencies threatens the achievement of strategic goals. It also impacts morale. Your best staff members will recognize the pattern and will become frustrated by management’s inability to address preventable crises and may eventually disengage or leave.
3. Are all the risks being communicated to the appropriate level of management?
When working through an issue that became a crisis, it’s not uncommon to learn that one or more staff members realized there was a problem but never communicated it to the appropriate level of management. This is why it is so important for an organization to have a process for capturing this information that is available to staff and simple to utilize. All levels within your organization must have the ability to articulate concerns and communicate them to managers with the knowledge to accurately assess the situation and prioritize it at the organizational level.
4. Are risks being prioritized in a consistent manner across the organization?
If your current process allows the most persuasive speaker to obtain approval (and resources) for their projects instead of allocating funds based on a methodical process, the achievement of strategic goals is at risk. Whether addressing an identified risk or not, projects should be evaluated according to your institution’s strategic goals and values, and then prioritized against the other risks that have been identified.
How we can help
A well-implemented process for identifying, assessing, and prioritizing risks will help put your institution in the best position possible when the next crisis occurs. It’s also likely you’ll sleep a lot better at night. CLA’s higher education professionals can help you design and implement a customized ERM program that precisely fits the scope and complexity of your organization. We’ll work closely with you to build a specific risk profile, assess your current risk management processes against best practices, and strategically craft an ERM program from the ground up, tailored to your institutional needs.