Risk Management – ‘A Do or Die’ for Higher Education Institutions

Recent shootings at Makerere University, Student strike at Baraton University causing enormous
damage, Lack of funds from local or foreign donors are just a few but to mention highlights of poor risk
management practices in the region. Just like for-profit organizations and businesses, education
institutions face many of the same risks encountered such as the availability of funding or reputational
risks. The stakeholders of an education institution include donors (local and foreign), government at all
levels, faculty, students, parents and future employers. The actions of key administrators, faculty or
students can impact the institution’s future enrolment, reputation and future contributions. While campus
administrators cannot eliminate all of the risks facing their institutions, they can mitigate the impact of
events more effectively with advance planning. Implementing an Enterprise Risk Management (ERM)
approach can help managers of Higher Education institutions identify risks to the organization, estimate
the impact of risk events and plan strategically to limit their effects.

With the International Organization for Standardization (ISO) having recently issued ISO 31000 a new
global standard for risk management and a consistent risk management framework that can be integrated
across various industries and regions and adopted by any organization – including public, private, not-for-
profit and government organizations, it is high time of Higher education institutions to benchmark their
practices with the rest of the world.

Why is Risk Management importance rising among Education Institutions?

The following drivers are increasing pressure to transform risk management for education institutions:

• Global standard on risk management for all kinds of organizations;

• fierce competition for faculty, students, staff, and financial resources;
• pressure for increased productivity, responsiveness, and accountability while reducing costs;
• increased external scrutiny from government, donors, the public, governing boards, journalists,
and taxpayers rights groups;
• introduction of powerful new technologies that require significant investment of both financial and
human capital resources;
• rapidly increasing entrepreneurial ventures beyond the traditional educational venues that create
stresses and strains on traditional administrative and financial infrastructures;
• increased competition in the marketplace; and
• increased levels of litigation in general and internally, with ever-increasing levels of financial
competition.

Strategies to address these drivers for change are introducing more complex risks for educational
institutions. Leaders are in need of techniques to manage the complex portfolios of risks they now face.
Many are turning to ERM to help them establish a more robust risk mindset because it helps link
institutional governance, risk management, and the strategic goals of the institution. Leaders are
beginning to find that ERM is an effective method to manage all the risks that exist on a college or
university campus.

www.abs-africa.net
Page 1
The benefits of ERM for a university or college can help in management’s efforts to:

• Sustain its competitive advantage

• Solidify its integrity and reputation
• Respond effectively when a significant event occurs
• Avoid financial surprises
• Effectively manage all of its resources

Finding an ERM Framework Relevant to Higher Education

The first step to implementing ERM is the selection of a conceptual framework to provide an overriding
structure to help develop a more robust view of risk oversight – one that extends far beyond the traditional
university risk management practices. The framework provides an overall structure, while at the same
time preserving the need for customizing ERM practices to take into account the institution’s goals,
objectives, management culture, and philosophy. Several alternative frameworks, eg ISO 31000, AU/NZS
4260:2008 or COSO ERM framework, that provide relevant guidance to those leading the launch of ERM.
While many may view these frameworks as applicable to the for-profit setting, these frameworks have
been developed for enterprises of all types. That is, they lay out fundamental concepts that are relevant to
all.

Some institutions appoint a Chief Risk Officer (CRO) to oversee the implementation of ERM. The person
in this position is able to encourage and facilitate the entire organization to integrate thinking about the
costs and benefits of taking risks, and how to manage them, through the entire strategic planning
process. The CRO is different from a more traditional risk manager. The CRO serves as the institution’s
risk champion, encouraging and facilitating an enterprise-wide view of risks and helps lead thinking about
the costs and benefits of taking risks, and how the institution manages risks through a strategic process.

Applicability of ERM in Institutions of Higher Education

Critics may challenge the applicability of ERM for institutions of higher education, based on the view that
ERM is only relevant for the for-profit world. Most argue that such a view is denying reality. Enterprises of
all types, including those in higher education, operate in a fiercely competitive landscape whereby they
deploy various strategies to meet their objectives. In doing so, they, like any other enterprise, face
tremendous amounts of risk and uncertainty. ERM helps provide them greater risk intelligence to more
effectively navigate those risks in order to increase the odds that they meet and exceed their objectives.

Establishing an ERM Framework

For an ERM implementation to be successful, the institution must have clearly defined its strategies and
objectives so that potential risks to achieving those objectives can be identified. Risks may be identified
using techniques like brainstorming, interviews, self-assessments, risk questionnaires or facilitated
workshops. Studying the loss-event data of other Higher Education institutions or firms in the private
sector may identify risks that were overlooked using other techniques.

www.abs-africa.net
Page 2
Risk assessment is a process of estimating the financial impact and likelihood of an identified risk to the
organization’s objectives. Risks with a high impact and likelihood require management attention and a
mitigation plan, while those risks with a low impact and likelihood may require no further action. Managers
may find that they are incurring excessive expenses to control risks with a low likelihood and financial
impact, which could lead to cost savings by streamlining risk mitigation efforts. Risks with a moderate
probability and impact, or a low probability and high impact, should be monitored by the institution.

For ERM to be effective, administrators cannot allow individual units to expose the institution to excessive
risks or overly manage smaller risks. The board and executive management must make decisions about
the institution’s risk appetite and communicate risks tolerances to leadership within the institution. Risk
information should be communicated upstream to senior management by risk owners so that appropriate
monitoring and mitigation strategies can be established.

ERM Challenges for Higher Education Institutions

Higher Education institutions face financial risks related to government funding, enrollment, contributions
and the financial performance of endowment funds. Reputation risk is a major risk for Higher Education
institutions that can impact enrollment and funding. Violence on campus is an example of a low
probability, high impact risk event that can significantly impact an institution’s reputation. Higher
Education institutions also face challenges recruiting and retaining quality administrators and faculty. The
risks associated with turnover can be mitigated by recruitment efforts and succession planning.

Higher Education institutions may be governed by board members who are not appointed based on their
ability to monitor risk and provide governance. Many board appointees are selected because of their
political connections or capacity as donors. Under the best conditions, boards cannot effectively monitor
and govern the institution’s risks if they are not identified and assessed. Higher Education institutions will
benefit from an ERM approach to risk assessment and monitoring that compiles information about the
organization’s biggest risks and facilitates strategic planning and risk mitigation.

Best Practices and Action Steps

There are several best practices and action steps presidents and boards can take to improve their
strategic risk assessments such as:

• Ascertain your risk appetite;

• Define risk broadly incorporating many types of risk;
• Recognize the downsides as well as the opportunities of risk;
• Develop a culture of evaluating and identifying risks at multiple levels so critical risks filter up to
top decision-makers;
• Examine the total cost of risk, including financial and non-financial costs;
• Boards and presidents should collaborate and work together;
• Develop a disciplined process to consider risk in strategic discussions;
• Designate an owner of the risk identification process;
• Require top administrators to prioritize risks based on likelihood and impact;
• Identify and monitor risks that could interfere with strategic goals;
• Require annual written reports on each high-priority risk being monitored;
• Reassess priority risks at the board level at least once a year as circumstances change;
• Look for risks that are being omitted;

www.abs-africa.net
Page 3
 • Move risk identification deeper into the institution to employees most likely to first see risks;
• Benchmark your risk practices with other institutions; and
• Repeat the process as risk management is a continuous process, not a one-time endeavor.

If you would like to know more on how you can improve or implement ERM in your organization,
Gilbert Mwalili is a specialist in ERM with experience with large and well known higher education
institutions internationally. Send us email to gmwalili@abs-africa.net for a one-on-one discussion.

NOTE: This article is strictly prepared by the author, replicating this article or publishing it without prior
approval of the author is not permitted.

www.abs-africa.net
Page 4