Higher Education Enterprise Risk Management: The Time Is Now

By Kenneth M. Krenicky, Principal, Core Risks Ltd.

Higher education is known for being ahead of trends, promoting best practices, seeking the "truth," and inspiring innovation that can be transferred successfully and practically to business and industry. Interestingly, in one important area of advanced management and "corporate governance"-that is, in developing, implementing, and embedding practical and sustainable enterprise risk management (ERM) programs-the bastions of higher education are falling behind business and industry. ERM has been a hot topic in higher education, but implementing it has proven difficult for many institutions. In fact, in the fall of 2007, three leading higher education associations published white papers promoting the need for ERM. The University Risk Management and Insurance Association (URMIA) published, "ERM in Higher Education," and the Association of Governing Boards of Universities and Colleges (AGB) and the National Association of College and University Business Officers (NACUBO) published, "Meeting the Challenges of ERM in Higher Education." Both papers strongly recommend that institutions of higher education go beyond the mere discussion of ERM and start implementing it on their campuses. A more recent development shows some of the leading university systems, such as the University of North Carolina, are going so far as to create in-house senior administrative positions to develop and oversee ERM programs.

The questions raised by the recommendations of these higher education associations and reinforced by the actions of colleges and universities in the forefront of implementing ERM are:

• When do we start ERM?
• How do we start ERM?
• Can we afford ERM?
• How do we implement ERM?
• What are the practical benefits of ERM?
• How do we embed and sustain ERM?

When Do We Start ERM?

The easiest question to answer is, "When?", since the answer is a simple, "NOW." During the current period of economic crisis and challenge, acting "now" becomes even more important because one of the most beneficial and practical outcomes from a well-designed ERM program is a disciplined, objective, and non-political process to better allocate resources and assets to address the material risks and identify potential lost opportunities which could impact the institution. In light of financial losses suffered by virtually all colleges and universities in the past year, now is the time to assure the most appropriate use of remaining resources. A well-run ERM process focuses not only on the allocation of financial resources, but also provides a valuable tool to aid in the allocation of the other two most important resources: the time and focus of its staff and faculty.

How Do We Start ERM?

As with all major institutional initiatives, whether they are for-profit, non-profit, business, or academia, none works unless there is commitment and support from "The Top." As evidence that a successful ERM program requires senior administration and board support, the vast majority of successful ERM programs are being initiated and driven by the Boards of Trustees or Regents and their Audit Committees so as to assure that the institution is complying with the ever increasing demands of good corporate governance.

It is recognized by most industry, academic, regulatory, and rating agency organizations that ERM is a critical component of the corporate governance of a well-run institution. For example, in the past year bond rating agencies have announced they will begin using ERM as one of their criteria to determine an organization's credit worthiness and rating. While not currently applicable to higher education, it is likely to be in the future.

Can We Afford ERM?

As to whether an institution can afford ERM, it has become evident in the corporate world that the more effective and focused allocation of resources attained via the ERM process offsets the cost of the implementation of an ERM program, usually many times over. This offsetting of costs and better focus on asset allocation should certainly hold true within academia. Implementing ERM requires not only "Top Down" support but also support, validation, and reinforcement from the "Bottom Up." Using the expertise of key functional personnel who are closest to the risks, the ERM process will start validating and implementing what the Top Down senior administration perceives is needed, as well as identifying risks of which the senior administration is not aware but that are the real concerns for the operational level. This Bottom Up team will work to develop a cross-functional process to promote open discussion of risk and identify, analyze, and mitigate all institutional risks. An important goal of the ERM process must always be that safeguards and procedures are installed to assure that "no messenger will be shot" for speaking the "truth."

How Do We Implement ERM?

It is only with a Top Down/Bottom Up approach that ERM will succeed. Top Down/Bottom Up assures that both strategic and operational/tactical goals are met. A result of this implementation approach is the embedding of a risk management based decision process into the institution's culture. This is further assured by establishing ERM process mission, goals, and objectives that are compatible with and incorporated into both the long-term strategic planning cycle and the annual budget cycle. As most will agree, if an initiative is not formally addressed in the budget, it doesn't really exist. Thus, the ERM process should ensure that the institution ends up with a "risk enhanced budget" wherein the cost of risk and its mitigation is understood and properly appreciated. However, one of the interesting characteristics of a well-functioning ERM program is that it more often than not reinforces that the cost to mitigate many risks is not financially significant. Rather, the "cost" is more often nothing more than assigning responsibility and accountability to the right risk owner to address. Once people know they clearly have the authority to fix something and will be held accountable to do so, things get done, and these risk owners will welcome the opportunity to be part of the solution.

What Are the Practical Benefits of ERM?

Why are higher education institutions so in need of ERM, and what is a practical example of a beneficial outcome of the process? Whenever one speaks of ERM in general, perhaps the most common challenge and beneficial outcome cited is that ERM helps to enhance the communication, interaction, and success of an entity to break down organizational and cultural silos. No institutions are considered more siloed than those of higher education. There is the academic silo, the business silo, the athletic silo, the research silo, the undergraduate silo, the graduate and professional school silos, the state funding silo, the private endowment silo, the alumni silo, the faculty silo, the community silo, the student body silo, the Board of

Trustees silo, and so on. We all know there is much unrealized potential and many great ideas and varied interests in the silos, but rarely is there a process or venue to understand how these silos can effectively interact, how they can help each other identify both risks and opportunities, and how they can work together through a non-political, objective process to get the best overall outcome for the institution. ERM provides just such a process. The greatest material and strategic benefits to the institution occur as

ERM becomes embedded in the institution's culture and operational mindset. These benefits become most clearly evident in the second and third years of the process and onward.

How Do We Embed and Sustain ERM?

One size or approach to ERM, however, does not fit all. ERM needs to be tailored to fit the unique culture, organizational structure, and risk profile of each institution. The ERM team or institution must develop a mission statement and definition of risk that can be understood by all the various silos and their constituents. These silos need to be able to communicate about risk in the same way, and to do so they need a common language of risk. This should be done early in the development of the ERM process by internally developing definitions and synonyms within the various silos for key risk terms. One of the first and perhaps most important definitions that must be determined is each specific institution's definition of "materiality." Unlike with a for-profit business, what is "material" to academic and research institutions is not as often defined in pure financial terms. Thus, when identifying material risks, other factors, such as academic integrity, reputation, branding, and alignment with the stated mission of the institution, need to be considered for materiality. Often the various silos do not realize the cross-functional aggregate effect, which then often becomes material, that one silo's actions can have on other silos or the institution enterprise-wide. ERM helps bring transparency and clarity to these challenges.

It should be noted that an institution need not be concerned or overwhelmed by what looks like too big a task when contemplating ERM. The ERM process lends itself well to being developed and implemented in a phased approach across multiple entities of larger institutions. There are many good "beta" sites within institutions of higher education. For example, for those schools that are part of a system, ERM can be developed first at one or two of the branch campuses and then gradually be rolled out system-wide. ERM can also be focused on a particular college or professional school within the institution or initially be targeted in particular departments, such as athletics.

The point is that the process works on any size or type of college or university, and the key opinion leaders in higher education know that their institutions should start ERM sooner rather than later. The walls of the silos will only grow taller and thicker the longer an institution waits. It is extremely important to get started because effective ERM programs cannot be bought off the shelf and implemented quickly.

To dig a little deeper...

Enterprise Risk Management Task Force. "URMIA White Paper: ERM in Higher Education." University Risk Management and Insurance Association (URMIA), September 2007 (accessed 5/11/09).