The role of the Chief Risk Officer (CRO) has often been centered around audit, compliance, crisis response, and insurance. However, today’s complex, high-stakes, and rapidly changing higher education environment demands risk leaders who think beyond controls and instead shape strategy.
At Florida A&M University (FAMU), my career journey from Associate Vice President of Audit/ CRO to Deputy Chief Operating Officer and Associate Vice President for Enterprise Risk Management exemplifies this evolution.
The Case for a Strategic CRO in Higher Education
Risk today is interconnected. A single technology decision may have financial, operational, reputational, and compliance implications. Universities require risk leaders who can:
Anticipate emerging issues before they materialize
Integrate risk data into planning and budgeting
Communicate risk in ways that engage faculty, staff, leadership, and the board
Drive collaboration across siloed departments
Identify opportunities embedded in uncertainty
A strategic CRO goes beyond managing threats to unlocking value by informing better decisions.
Redefining the CRO Function at FAMU
When I was asked in August 2021 by the university president to create and lead FAMU’s Enterprise Risk Management (ERM) function, it operated as a component of the Division of Audit. This was valuable as it increased oversight, heightened responsiveness, and established relationships with management while gaining board buy-in. However, as the program matured, we recognized that true ERM required deeper integration into strategic planning, budgeting, and operations, resulting in an integration that would not compromise audit independence if maintained under the same umbrella.
This realization drove our structural evolution toward independent, strategically-focused risk management. In July 2024, we decided to reposition ERM directly under the Office of the Chief Operating Officer. This move:
Elevated ERM visibility across leadership
Facilitated integration into strategic planning and resource optimization
Allowed direct influence over operational transformation and innovation
Connected ERM insights to operational outcomes
This transition revealed five critical mindset shifts required to help establish risk management as a strategic partner in institutional decision-making. We also learned that investing in tools and building trust are also essential.
Five Strategic Shifts in the CRO Role
1. From Compliance-Driven to VALUE-DRIVEN
While compliance remains a core responsibility, strategic CROs focus on creating value. At FAMU, our ERM team supports decision-making by:
Developing risk action plans that align risk response with strategic goals
Identifying opportunity costs of inaction or misalignment
Providing scenario planning support around risks like name, image, and likeness (NIL) regulations and AI adoption
2. From Periodic Reporting to CONTINUOUS ENGAGEMENT
The old model of annual risk reports is no longer adequate. We shifted to:
Quarterly briefings with university leadership
Risk alerts that provide real-time insights on emerging and newly realized risks
Ongoing workshops and surveys to capture evolving perceptions of all university stakeholders, including our students
Officially making ERM a part of the board’s Audit, Risk, and Compliance Committee with report-outs from the CRO at every board meeting
Branding the month of February as ERM awareness month
This iterative model allows for greater agility and fosters a culture where risk is part of everyday conversations.
3. From Auditor to COLLABORATOR
CROs must build relationships beyond legal, audit, and compliance. I work alongside leaders in student affairs, academic affairs, IT, facilities, athletics, and research to co-create solutions, not just critique problems. Examples include:
Leading cross-functional digital transformation workshops focused on AI and process automation, risks, privacy, and responsible use
Serving as Lead Change Agent on the Workday implementation team to ensure risks and challenges are addressed proactively by our tech team and steering committee
4. From Risk Avoidance to RISK INTELLIGENCE
We help leaders distinguish between avoidable threats and strategic risks worth taking. For example, our campus police department was hesitant to pursue AI-powered analysis due to legal, privacy, and accountability concerns. Through working sessions centered around responsible use controls and prompt engineering, we created a pathway to innovate responsibly while reducing risk to the university.
5. From Governance Silo to STRATEGIC INTEGRATOR
We created an ERMAC (Enterprise Risk Management Advisory Council) subcommittee combining compliance, legal, audit, ERM, and policy functions to coordinate risk governance. This group discusses trending risks across the university, develops shared risk criteria, and ensures aligned messaging across governance channels.
“Today’s complex, high-stakes, and rapidly changing higher education environment demands risk leaders who think beyond controls and instead shape strategy.”
Tools for Strategic CROs
To execute this evolved role, we invested in key tools and approaches:
Risk Software for real-time monitoring and issue tracking
Risk Perception Surveys for faculty, staff, students, and board members
Risk Dashboards that map risks to performance metrics and strategic themes
ERM Communications Strategy, including LinkedIn campaigns and internal risk briefings
Capability Maturity Models to track progress in areas like AI adoption and student service optimization
These tools transform ERM from a static function into a dynamic asset.
Building Trust and Influence as a CRO
Influence is earned, not given. To be seen as a strategic partner, CROs must:
Build credibility through competence, consistency, and collaboration
Speak the language of leadership, connecting risk to goals and outcomes
Act as a translator, making complex risks accessible and actionable
Show up early, joining conversations when solutions are being developed, not after
Celebrate wins, using success stories to build buy-in and reduce resistance
At FAMU, we built this trust by showing how ERM helped improve decisions, save resources, and advance strategic priorities.
The Road Ahead
The role of the Chief Risk Officer in higher education is no longer confined to the back office. It belongs in the strategy room, the innovation lab, the boardroom, and the frontlines of change. We are no longer just risk stewards; we are innovators and integrators. At FAMU, we are proving that risk leadership is strategic leadership. By embracing this evolution, we can help our institutions navigate uncertainty with confidence and integrity. To my fellow CROs across higher education: the future needs your voice, your insight, and your bold leadership.
“The role of the Chief Risk Officer in higher education is no longer confined to the back office. It belongs in the strategy room, the innovation lab, the boardroom, and the frontlines of change.”