One of the primary responsibilities of a board member or leader at an institution of higher education is effectively overseeing institutional risk. With the new administration in 2025 and its potential to create new risks and amplify existing risks, it is important now more than ever to be proactive and look at risk management holistically. But how?
Why Boards and Executives Should Support ERM
Enterprise Risk Management (ERM) allows an institution to proactively identify, assess, monitor, and prioritize risks that can affect the institution’s objectives. ERM allows for risk-informed decision-making, increased transparency, and greater governance that supports an institution's goals and objectives. Engaging the board with mission-critical risks through an ERM program should be at the top of every institution’s agenda this year. According to the RIMS State of ERM Report, “Organizations with formalized ERM programs perform better than organizations without formalized ERM programs.” As the world begins to move ahead, facing major political, geopolitical, and social challenges, traditional risk management (or “siloed risk management”) will no longer be enough.
Emerging Risks in 2025
The following risks require a proactive and enterprise approach; and by relying on traditional siloed risk management, there may be blind spots.
Diversity, Equity, and Inclusion (DEI) programming investigations and crackdowns
Sex and gender identity, especially in athletics
Federal funding freeze concerns on grants, loans, and research
Targeted investigations under the False Claims Act
Immigration and international travel changes
Free Speech and the First Amendment
Pivot away from sustainability initiatives
A Roadmap to ERM
In 2024, the American Institute of Certified Public Accountants-Chartered Institute of Management Accountants (AICPA-CIMA) 2024 State of Risk Oversight Report surveyed a range of organizations in which 37% reported having a formal ERM process in place, and 34% did not have an enterprise-wide view of risk17. This is an improvement in the engagement levels of companies adopting formal ERM programs since AICPA’s 2015 State of Risk Oversight Report, where only 25% of organizations reported having a formal ERM process in place18.
Many institutions do not know where to start an ERM program, and even experienced risk professionals struggle to find where to begin. The following insights can help institutions build a successful ERM program:
Leadership & board buy-in and support: Build the case for ERM to the board of directors and senior administration. As higher education leaders, you set the tone for the organization’s risk culture and, ultimately, the ERM program. Board involvement, leadership, and oversight are essential for the success of ERM. This responsibility may fall within the Audit Committee.
Alignment with strategic plan and objectives: Create an ERM mission/ vision statement that aligns with the strategic plan, environment, and culture. Reflect on the institution’s short-, mid-, and long-term objectives. A helpful resource is the International Organization for Standardization (ISO) 31000 framework19, which defines risk as, “the effect of uncertainty on objectives.” Depending on which ERM framework your institution utilizes to leverage your program, such as ISO 31000 or the Committee of Sponsoring Organizations of the Treadway Commission (COSO), they share common themes. An ERM framework provides structure and methodology to approach risk consistently, strategically, and with accountability.
Build the foundation: Who will be the ERM leader championing a risk-aware culture at your institution? Select that leader, create a plan, and define a timeline. Make sure that risk, compliance, and internal audit functions are aligned with the plan. According to the Institute of Internal Auditors’ publication Internal Audit’s Role in Enterprise Risk Management, two of the most important ways an audit can add the most value are by 1) providing objective assurance that the major business risks are being managed appropriately and 2) providing assurance that risk management and the internal control framework is operating effectively20.
Governance: At every institution, the ERM governance structure and information flow will be varied. The governance structure provides guidance on the management and roles and responsibilities of the ERM program. It is important to occasionally review the risk governance structure because the risk landscape is constantly changing.
Hire a consultant: The decentralized nature of higher education can make it challenging to coordinate risk management across an institution. Consultants can help with ERM implementation from either a ground-up strategy or at tactical points in the process.
Demonstrate a small victory: Your institution does not need to start with a campus-wide ERM implementation. Undergo ERM with one department, provide results to leadership, and then champion to expand the efforts campus-wide.
Remember, slow progress is still progress! This is likely the case at many institutions. Timing can be everything, as noted by the impact of the pandemic on USF’s ERM program.
The time has come for institutions to move beyond traditional risk management programs and embrace ERM as a strategic institutional initiative. Forward-thinking leaders who prioritize risk at the board level will better position their institutions for greater resilience and success in this era of unprecedented change.
