The Landscape, Framework, And Strategies For MANAGING & MITIGATING RISK

A P P AT H O U G H TL E A D E R Sand as it impacts the facilities organization in particular. APPA invited both senior facilities officersand representatives of multiple campus constituencies to the symposium, including presidents andchancellors, chief finance officers, leaders in bothacademic and student services, and senior risk managers. Together, the symposium participants learnedabout ERM, assessed the risks confronting theirindustry and institutions, and reviewed strategiesfor mitigating threats.Symposium participants identified six major riskareas that higher education institutions must consider for their campuses:TLS2nnnnnnRevenue and investmentsBrand and reputationHealth and safetyInnovationFacilitiesChanging political/cultural environment.They also considered the role of facilities in managing risk, concluding that the facilities departmenthas much to offer the institution. The facilitiesoperation has one of the largest workforces on campus, and facilities staff are out in the communityevery day. They often see what no other faculty orstaff would be in the position to notice, and theymitigate risks by alerting the appropriate officesto signs of depression or other mental illness instudents, to damage or vandalism to institutionproperty, and to potential facilities failures. Atthe same time, this workforce is uniquely positioned to help the campus in the case of a crisis oremergency. Facilities staff have a customer-serviceattitude combined with in-depth familiarity withevery corner of the campus.Symposium participants also looked at the risksand opportunities facing the campus built environment. They identified the following risks tofacilities and facilities operations:nnnnnnnFinancial shortfalls and facilities failuresNatural disastersLack of a qualified workforceTechnology failuresUtility infrastructure failuresCompliance issuesInstitutional curb appeal/first impression.S E R I E S2 0 1 8Then they evaluated the following opportunitiesfor improving the contribution of facilities to theinstitution:nnnnnEnergy conservationFuel and utility strategiesGreen technologyFacilities supporting student successResources to respond to emergencies.This report concludes with a list of questions developed by participants to encourage discussion anddebate on your campus. We encourage institutionsto evaluate their existing risk management strategyand consider where it succeeds and fails. No matterwhere your campus finds itself, improvements canbe made. If your institution has made little commitment to risk management, what concrete firststeps can you take to move the campus forward? Ifyour institution has embraced enterprise risk management, where are efforts still falling short?A hard look at risk on APPAmember campusesShortly before the Thought Leaders symposium,APPA decided to better understand the state ofrisk on its member campuses. APPA released asurvey asking members about risk preparedness, effectiveness, and roles and accountability. The resultsof this survey are found throughout this report.You’re encouraged to benchmark the results of ourmembership with data from your own institution.To gather even more data, symposium participantswere asked how they would rank their institution’srisk readiness on a scale of 1 to 10, with 10 themost prepared and 1 the least prepared. The average score from participants was 6.89. Some simplestatistical analysis finds that the median (the dividing point between the greater and lesser halves ofthe dataset) was 7 and the mode (the most frequentvalue in the dataset) was 8.It’s interesting to combine this number with theresults of the survey question, “How effective isyour institution at managing risk?” More than60 percent of respondents found their institutionwas doing either “very good” (21.47%) or “good”(41.72%).

2 0 1 8A P P AT H O U G H TThis suggests that overall, facilities leaders believetheir institutions are paying attention to risk andtaking steps to improve their readiness—they areconfident that a solid foundation of risk management has been laid.L E A D E R SS E R I E SBut like waves in the ocean, risks never stoppounding on colleges and universities. Inevitably,risks that you never anticipated will strike. Andyou never want to turn on the news one morningand find that your campus is the headline—for thewrong reason.Data Point:Risk communicationsRisk Hazard OutrageOne of the greatest challenges in managingrisk is that people tend to underestimate certain threats while overestimating others. Riskcommunication expert Peter Sandman hasspent most of his career helping his clients understand this challenge.“If you distinguish two characteristics of arisk—how dangerous is it versus how upsetting is it—let’s give ’em labels. Let’s call howdangerous it is ‘hazard.’ Let’s call how upsetting it is ‘outrage.’ The correlation betweenhazard and outrage is extremely low,” saidSandman in a 2013 interview on public radio’sOn the Media. “What this means is if you knowa risk is dangerous, that tells you almost nothing about whether it’s upsetting. If you know arisk is upsetting, that tells you almost nothingabout whether it’s dangerous.”In practical terms, that means people are morelikely to be afraid of terrorists hijacking theirairplane than having their car crash on theirway to the airport—or slipping in the showerbefore they leave the house.ignore. Sandman calls this “precaution advocacy.” “The paradigm in precaution advocacyis ‘watch out, this could kill you. Do something.Wear a seatbelt, wear a hard hat,’” he said.Other times, the job is to manage outrageabout unlikely threats. Sandman emphasizesthat outrage is mitigated by trust (“If I trustyou, I’m going to find the risk that you are exposing me to much more acceptable than if Idon’t trust you.”) and control (“If it’s under mycontrol, I’m going to be less upset than if it’sunder your control.”)Outrage has a tendency to shut down rationalthought, Sandman explained, and when someone is outraged they need to feel like they areheard and their fears acknowledged beforethey can calm down enough to start to thinklogically. “When people don’t understand thedata, it’s not because they can’t. It’s becausethey choose not to. And that’s a function ofoutrage. So if you can reduce the outrage, thenthey’re more interested in the data. Then youcan begin to educate them,” said Sandman.Sometimes the role of risk managers is to increase attention to hazards that people tend toSource: Excerpts from “Terrorists vs. Bathtubs,” On the Media, WNYC Studios, June 21, 2013.TLS3

A P P AT H O U G H TL E A D E R SS E R I E S2 0 1 8Section 2:Identifying Enterprise Risks and OpportunitiesTaking an enterprise-wideapproach to risk managementColleges and universities have always faced risks,but it wasn’t until the 1980s that institutions beganthinking systematically about managing threats totheir organization. Today, college and universityleaders can draw on several decades of research andbest practices that have clarified our understandingof risk.TLS4A widely used definition of risk is one proposed bythe National Association of College and UniversityBusiness Officers (NACUBO):Risk is any issue that impacts anorganization’s ability to meet its objectives.This is a necessarily broad definition. Institutionsface a bewildering variety of risks—competitive,financial, operational, environmental, technological, regulatory, reputational, political. Risk can beas small as a slippery tile floor and as large as thefunding process for the entire institution. The sizeand complexity of college and university campusesand the number of people who walk their groundsevery day are factors that combine to create countless risks.Attempting to identify all of these risks would bean exercise in exhaustion—but too often collegesand universities become bogged down with cataloging threats. It’s certainly important to classify risks,and this report will explore ways to do so. Institutions can spend enormous energy and capital tryingto enumerate every single risk they could possiblyface. Yet a lengthy and detailed list of threats doesnothing on its own to prepare an institution todeal with those threats.The first step of risk management should notbe creating lists but rather developing an institution-wide framework for addressing risk andchange. This is the message of risk experts such asJanice Abraham, President and CEO of UnitedEducators Insurance, who emphasizes the importance of enterprise risk management (ERM).ERM is defined as a business process that takes astrategic and campus-wide approach to risk.“When colleges and universities first started thinking about risk, the process was transactional andreactionary,” said Abraham, speaking at the APPAThought Leaders symposium. “It was focused ontransferring risk away from the college or university.” Over time, risk management became moreintegrated into college or university processes.“People began to think of risk as an expense thatshould be minimized. It was driven by issues ofcompliance.”Savvy institutions go beyond integrated risk andseek to transform risk management into a strategic, enterprise-wide business process. “ERMemphasizes optimizing risks to achieve enterprisegoals,” said Abraham. “And it includes the understanding that alongside risks come opportunities.Colleges and universities need to be open to newpossibilities at the same time they prepare to facethreats.”The primary goal of ERM, according to Abraham,is culture change. When an institution is practicingERM, it has incorporated a well-organized approach to risk management, one that addresses theentire organization. The college or university hasthe skills and capacity to be flexible and adapt to anever-changing environment. When an unexpectedcrisis hits, the institution takes it in stride; when an

2 0 1 8A P P AT H O U G H TL E A D E R SS E R I E SData Point:Enterprise risk managementHow effective is your institution at mitigating risk?Most SeniorFacilities Officersresponding to theAPPA ThoughtLeaders RiskSurvey believedtheir institutionswere doing aneffective jobmanaging risk. Only3 percent—fiverespondents—believed theydidn’t do well atmitigating risk.Very good a top priorityGoodCould be betterWe don't0%10%20%30%40%50%60%70%80%90%100%Source: APPA Thought Leaders Risk Survey, January 2018.unexpected opportunity arises, the institution takesadvantage of the situation. The goals and missionof the college or university are unshaken by whatever the world throws its way, and the institutioncan do what it wants to do, not what it has to do.1. Ensure support of senior management. Riskmust be championed from the highest levels ofthe institution. If the board and senior leadershiparen’t invested in ERM, efforts will eventuallystumble.“This is the goal,” said Abraham. “Maybe you’llnever quite get there, but it’s what you can aim for.”2. Develop and communicate a risk managementpolicy. For example, the University of Regina’spolicy on ERM, according to URMIA’s report,ERM in Higher Education, states that its objective is to “incorporate a consistent approach torisk management into the culture and strategicplanning processes of the University, supportingthe setting of priorities and making of decisionsat the institutional level.”Creating the ERM frameworkEffective enterprise-wide risk management requiresinstitutions to create a framework—a structure thatsupports the basic components of ERM. This is acentral step in ensuring that risk management isadopted across the entire college or university, andit is the only real way to achieve culture change.Many models of ERM frameworks have beenemployed, and each institution will need to shapea framework that works for its campus. Some keyelements of effective frameworks include:3. Establish accountability and authority. Riskis ultimately everyone’s responsibility, but thatcreates a situation where it can be no one’s responsibility. Clear authority needs to rest in keyfigures who will be accountable for their actions.TLS5

A P P AT H O U G H TL E A D E R SS E R I E S2 0 1 8Data Point:Enterprise risk managementKeeping risk assessments up to dateTLS6Risk assessmentsat most campusesare fairly up to date,Neveraccording to the APPAThought LeadersBetweenRisk Survey. About1-4 years58 percent of SeniorFacilities OfficersBetweenreported that their5-9 yearsmost recent riskassessment wasOver abetween one anddecade agofour years old. Somewere older, and threerespondents (1.84%)Don't knowsaid their assessmentswere more than a0%10% 20% 30% 40% 50% 60% 70% 80% 90% 100%decade old. More thana quarter didn’t knowhow old their assessments were, but most alarmingly, 14 respondents (8.59%) said their institutionhad never conducted a formal risk assessment.Source: APPA Thought Leaders Risk Survey, January 2018.Implementing an ERM processOne of the most important words in the definitionof ERM is “process.” ERM isn’t something thatan institution does once. It is an ongoing effort inwhich the college or university is always engaged.Abraham presented ERM as a cycle. Different institutions have developed their own process, but allshare, at their core, the following steps:1. Identifying threats and opportunities across theenterprise.2. Categorizing and ranking risks and opportunitiesrelated to the institution’s plans and mission.3. Mitigating risks and responding to emergencies.4. Monitoring risks and opportunities and responding to changing circumstances.Step 4 leads right back to step 1. Emerging risksand opportunities must be assessed, and mitigation plans must be developed and tested. Overtime, as situations change, some risks will fade insignificance and new threats will take their place.College and university leaders must constantlycycle through the process, keeping up with changeas it happens.We’ll look at each step in this process, focusing firston risks and then on opportunities.

2 0 1 8A P P AT H O U G H TL E A D E R SS E R I E SData Point:Enterprise risk managementInstitutions with a formal strategic plan to mitigate riskThe APPA Thought LeadersRisk Survey found thatabout half (50.62%) of 162respondents had a formal riskmanagement strategy, leavingabout half (49.38%) withoutsuch a rce: APPA Thought Leaders Risk Survey, January 2018.Managing risk in higher educationStep 1: Identifying threats. Understanding thethreats facing the campus requires both an eagle’s-eye view of the big picture and attention to themost mundane—but possibly explosive—details.Participants at the 2018 Thought Leaderssymposium were asked what mechanisms their institutions rely on to define and identify risk. Theirresponses fell into several categories:n Individuals or teams within the college oruniversity responsible for some facet of riskmanagement. The campus leaders tasked withrisk management play a major role in bringingthreats to the attention of the campus. Abouthalf of the colleges and universities representedat the Thought Leaders symposium have a chiefrisk officer or someone with a similar title intheir organization. But many others within theinstitution also play a role, including the executive leadership team and emergency managementcommittees. Experts in specific fields contributeassessments of specialized risks, such as economic forecasting or political affairs.n The campus community. Many institutionsseek input from faculty, staff, students, and parents to better understand threats and how theyare perceived. Information can flow throughsocial media or via formal processes such as townhall meetings. Hotlines and fraud lines give indi-viduals direct and sometimes anonymous ways ofreporting problems or concerns.n Outside experts and resources. Emergingthreats are often best understood by tapping thewisdom of experts outside of the institution.Insurance companies can be helpful, as well asoutside firms or consultants. Campuses maintainrelationships with local law enforcement, andsome reach out to the Federal Bureau of Investigation. Institutions can also draw on publishedresources such as risk registers that list commoncampus threats.n News and trends. Smart campuses work to stayon top of local, national, and international newsand apply that news to their institution whilepaying attention to social, demographic, andeconomic trends.n Real-life incidents. While you might hope toanticipate all possible threats, inevitably situations will arise that you never expected. Anytime a scandal or crisis hits another campus, thesmart strategy is to think through how your owncampus would be exposed in a similar circumstance.Risk management experts warn against spending too much time listing risks. In the report APractical Approach to Institutional Risk Management: Getting Risk Right in an Era of ConstrainedTLS7

A P P AT H O U G H TL E A D E R SAdministrative Resources, the University BusinessExecutive Roundtable states,Many universities are reluctant to undertake enterprise risk management (ERM) because of itsadministrative intensity, which has only becomemore pronounced after the Great Recession.When looking at their peers, many universityadministrators are confronted with a wastelandof horror stories of universities spending 18 to24 months on risk identification and assessment,only to come up with a risk register of 200 to500 risks. Of course, this concerns the averagesenior administrator who wonders, “Can ouruniversity actually begin tackling that manyrisks?”TLS8A register with 200-plus risks is so vast that it isuseless to the institution—and the time devotedto generating such a list could have been betterspent. Risk experts suggest jump-starting the riskidentification process by relying on published riskregisters from higher education organizations andpeer institutions. For example, the University RiskManagement and Insurance Association (URMIA)offers a risk inventory that its members can use inidentifying and ranking threats.Data Point:Risk identificationInverting the 80/20 rule“Institutions tend to spend 80 percent of theirrisk management time identifying risks and 20percent doing something about those risks,such as assessing the impact of risks, assigning owners to the risks, developing plans toreduce risk, and tracking risk. But best practicecalls for reversing the 80-20 allocation of effort. . . . Using [resources] gleaned from otherinstitutions, institutions can jump-start the riskidentification effort and limit it to 20 percent ofthe effort. Spending the remaining 80 percenton assessing the likelihood, impact, and riskmitigation strategies (rather than reinventingthe work done by others) is a far more efficient use of everyone’s time.”Source: Janice M. Abraham, Risk Management:An Accountability Guide for University andCollege Boards, Association of Governing Boardsof Universities and Colleges, 2013.S E R I E S2 0 1 8Step 2: Categorizing and ranking risks. The othermistake institutions make with their 200-plus listof risks is to treat them all equally. Failing to makeannual copyright infringement disclosure in atimely way is a compliance violation and, therefore,a risk—but it ranks nowhere near a bomb threat atthe biggest football game of the year.Risks should be grouped into categories that makeclear both who should be accountable for a particular risk and its potential impact to the institution.NACUBO proposes five broad categories of risks:1. Strategic risks. These risks affect an organization’s ability to achieve its goals. They willdepend on the institution’s mission and goalsand should include any threat to achieving thosegoals.2. Financial risks. These risks are those that couldresult in loss of assets. They will be heavily dependent on the institution’s funding strategy.Pushback against high tuition will dramaticallyimpact some institutions, while others will beput at greater risk by declining international enrollment.3. Operational risks. These risks affect ongoingmanagement processes and can include the failedrollout of a new payroll system or a major utilitybreak that cuts water to half of the campus.4. Compliance risks. These risks involve compliance with externally imposed laws andregulations as well as internal policies and procedures concerning safety, conflict of interest, etc.Compliance risks fall on many different divisionsin the institution—from accounting to facilitiesto research.5. Reputational risks. These risks affect an organization’s brand or reputation. They canencompass any of the above risks—mismanagement of a natural disaster such as a hurricanecan be as devastating to a college or universityas a scandal over failure to comply with Title IXrequirements. Reputational risks are the hardestto quantify—how do you place a value on an institution’s good name?

2 0 1 8A P P AT H O U G H TRisks should also be assessed so that the institution can focus its attention on the most seriousthreats—those with the greatest potential impactand the greatest likelihood of happening soon.If a whiteout blizzard hits your campus in SouthFlorida, it w

The Landscape, Framework, and Strategies for Managing & Mitigating Risk 2018 APPA THOUGHT LEADERS SERIES. TLS 1 n Compliance risks: Risks that involve externally imposed laws and regulations as well as internal policies and procedures. n Reputational risks: Risks to the organization's