Everyone gets that question: So, what do you do for a living? I always find it interesting when I tell people that I work in risk management, and they would ask, What does that mean? This leads to the questions: What is risk management, and what do risk managers wish leaders knew about their role?
The Evolution of Risk Management
Risk management as a field has evolved tremendously over the years. Traditional risk management was primarily focused on insurance and hazard risks. After multiple industry disruptions, enterprise risk management (ERM) transformed the practice from operational to a more strategic level. The complex regulatory environment continued to propel risk management to the boardroom, but higher education appeared to be somewhat immune or resistant to these changes.
ERM at the Forefront
Things changed drastically in 2020. The COVID-19 pandemic was a significant milestone for higher education risk management. The effects of the pandemic caused leadership to view enterprise risks with a new lens. Due to the urgency and interdependency of risks, risk management discussions reached the executive and board levels. Further, the U.S. and state governments enacted more regulations that impacted universities similar to the financial industry, and reputational risk was at an all-time high.
The Voice of the Higher Education Risk Manager
Higher education risks have only become more complex and intertwined. Campus protests, free speech, cyber breaches, and AI make headlines similar to adverse events in the private sector. Value and trust in higher education are being questioned at the societal level. Risk management is more important than ever, but it is still misunderstood especially in higher education.
I reached out to the University Risk Management and Insurance Association (URMIA), an association dedicated to promoting the advancement of higher education risk management principles and best practices, to gain insight into the minds of current risk managers and chief risk officers. URMIA surveyed their membership to answer this question:
"The Risk Management Department is not the "No" department, and risks are not all negative."
What do you wish your institutional leadership understood about risk management in higher education?
While the respondents may have used different words, there were several common themes. Many centered on misconceptions.
"Risk management as a field has evolved tremendously over the years. Traditional risk management was primarily focused on insurance and hazard risks." -Tracey Swift
Misconceptions and Needs
Risk management is “more than insurance.” While many risk managers have deep knowledge in this space, it is not their only skill. Risk management is about making an active choice to accept, avoid, mitigate, or transfer risks before they occur. It is only in the transfer stage where insurance fits in.
Leadership must be made aware of the complex interdependencies among the various risks and their downstream effects on the organization's missions and goals. I love this quote: “Risk management is more complex than they know. It's like the iceberg effect: the little they think they know at the surface level is much bigger and has a domino impact into other areas under the surface.”
The risk manager needs more funding and resources. Top-down support, or the "tone from the top," is essential in providing risk managers with the power to influence the campus community. Many risk managers also expressed that they are a department of only one or maybe two.
Risk management is strategic, not just operational. We "are a resource, not solely a process." Another respondent echoed a similar sentiment: "We are a key partner to address and collaborate with our campus stakeholders on their challenges and how best to work together to solve campus issues."
Risk managers need a voice at the executive table, because they are more effective when they can help formulate a proactive rather than reactive response.
Institutional units must be transparent about new ventures. By being included upfront in strategic decision-making, the risk manager can provide better insights and guidance, thus reducing risk exposure and long-term costs.
The Risk Management Department is not the "No" department, and risks are not all negative.
Risk managers enable vs. restrict activities by providing risk mitigation resources.
Leadership should not view "risk as inherently negative”; risks can be both positive and negative depending on risk appetite.
Leaders need to support collaboration that transcends departmental boundaries.
Risk management does not own the risk of the entire university.
Risk management "is a shared responsibility.” The tone from the top needs to be that "everyone is a risk manager.”
Rethinking Risk Management
Risk management is a broader discipline that includes a deliberative and thoughtful process that enhances better decision-making.
It considers all risks, not just insurable ones.
It anticipates challenges and is a framework for identifying, assessing, and mitigating potential risks before they occur.
It concentrates on protecting the organization and supports a risk management culture where employees have accountability.
It is proactive vs. reactive. Training and preparedness are essential to reduce the likelihood and impact of risks.
It's not a check box. Risk management requires ongoing monitoring to measure effectiveness and is adaptable to change.
WHAT CAN BOARDS DO?
Governing boards are integral to overseeing and reforming universities as part of their fiduciary duties. Risk management is one of those critical duties, requiring the board to examine risk through a more strategic lens.
This can be achieved by:
Understanding the role of the risk manager as a strategic resource
Supporting the Risk Management Department with funding and staff
Elevating the position of the risk manager with a voice at the leadership level
Providing top leadership support for risk management as a value-added partner to achieve strategic goals vs. an obstacle to success.
Bottom Line
Risk managers are the "eyes and ears" for detecting emerging risks and trends. Boards can leverage this risk intelligence to find innovative ways to control costs, navigate uncertainty, mitigate reputation risk, and optimize resources to achieve their organizations' missions and goals.