Please explain how ERM adoption and implementation in the higher education (HE) environment differs from the public company sector environment. Pick a specific company for comparison purposes and do a direct connection within your answer. Cite specific e
Michelle_Michy
20200114014627chapter_9_erm.pdf
CHAPTER 9
Lessons from the Academy ERM Implementation in the University Setting
ANNE E. LUNDQUIST Western Michigan University
T he tragedy at Virginia Tech, infrastructure devastation at colleges and uni- versities in the New Orleans area in the aftermath of Hurricane Katrina, the sexual abuse scandal at Penn State, the governance crisis at the Uni-
versity of Virginia, American University expense-account abuse, and other high- profile university situations have created heightened awareness of the potentially destructive influence of risk and crisis for higher education administrators.1 The recent Risk Analysis Standard for Natural and Man-Made Hazards to Higher Educa- tion Institutions (American Society of Mechanical Engineers–Innovative Technolo- gies Institute 2010) notes that “resilience of our country’s higher education insti- tutions has become a pressing national priority” (p. vi). Colleges and universities are facing increased scrutiny from stakeholders regarding issues such as invest- ments and spending, privacy, conflicts of interest, information technology (IT) availability and security, fraud, research compliance, and transparency (Willson, Negoi, and Bhatnagar 2010). A statement from the review committee assembled to examine athletics controversies at Rutgers University is not unique to that situa- tion; the committee found that “the University operated with inadequate internal controls, insufficient inter-departmental and hierarchical communications, an uninformed board on some specific important issues, and limited presidential leadership” (Grasgreen 2013).
The situation at Penn State may be one of the clearest signals that risk man- agement (or lack thereof) has entered the university environment and is here to stay. In a statement regarding the report, Louis Freeh, chair of the independent investigation by his law firm, Freeh Sporkin & Sullivan, LLP, into the facts and circumstances of the actions of Pennsylvania State University, said the following:
In our investigation, we sought to clarify what occurred . . . and to examine the Uni- versity’s policies, procedures, compliance and internal controls relating to identi- fying and reporting sexual abuse of children. Specifically, we worked to identify any failures or gaps in the University’s control environment, compliance programs and culture which may have enabled these crimes against children to occur on the Penn State campus, and go undetected and unreported for at least these past 14 years.
143
www.it-ebooks.info
144 Implementing Enterprise Risk Management
The chair of Penn State’s board of trustees summed it up succinctly after the release of the Freeh Report (Freeh and Sullivan 2012) regarding the university’s handling of the sexual abuse scandal: “We should have been risk managers in a more active way” (Stripling 2012).
The variety, type, and volume of risks affecting higher education are numer- ous, and the public is taking notice of how those risks are managed. Accreditation agencies are increasingly requiring that institutions of higher education (IHEs) demonstrate effective integrated planning and decision making, including using information gained from comprehensive risk management as a part of the gover- nance and management process.2 Credit rating agencies now demand evidence of comprehensive and integrated risk management plans to ensure a positive credit rating, including demonstration that the board of trustees is aware of, and involved in, risk management as a part of its decision making.3 Through its Colleges and Universities Compliance Project, the Internal Revenue Service (IRS) is considering how to hold IHEs responsible for board oversight of risk, investment decisions, and other risk management matters.4 The news media has a heightened focus on financial, governance, and ethical matters at IHEs, holding them accountable for poor decisions and thus negatively affecting IHE reputations. In response to this, many IHEs have implemented some form of enterprise risk management (ERM) program to help them identify and respond to risk.
THE HIGHER EDUCATION ENVIRONMENT Colleges and universities have often perceived themselves as substantially differ- ent and separate from other for-profit and not-for-profit entities, and the outside world has historically viewed and treated them as such. Colleges and universities have been viewed as ivory towers, secluded and separated from the corporate (and thus the federal regulatory and, often, legal) world. Higher education was largely a self-created, self-perpetuating, insular, isolated, and self-regulating environment. In this culture, higher education institutions were generally governed under the traditional, independent “silos of power and silence” management model, with the right hand in one administrative area or unit often unaware of the left hand’s mission, objectives, programs, practices, and contributions in another area.
John Nelson (2012), managing director for the Public Finance Group (Health- care, Higher Education, Not-for-Profits) for Moody’s Investors Service, observed that higher education culture is somewhat of a contradiction in that colleges and universities are often perceived as “liberal,” whereas organizationally they tend to be “conservative and inward-looking.”5 Citing recent examples at Penn State and Harvard, he noted that colleges and universities can be “victims of their own success”; a past positive reputation can prevent boards from asking critical ques- tions, and senior leadership from sharing troubling information with boards, and this can perpetuate a culture that isn’t self-reflective, thus increasing the likelihood for a systemic risk management or compliance failure. The Freeh Report (2012) is instructive regarding not only the Penn State situation, but the hands-off and rubber-stamp culture of university boards and senior leaders more broadly. The Freeh Report found that the Penn State board failed in its duty to make reason- able inquiry and to demand action from the president, and that the president, a senior vice president, and the general counsel did not perform their duties.
www.it-ebooks.info
LESSONS FROM THE ACADEMY 145
The report calls these inactions a “failure of governance,” noting that the “board did not have regular reporting procedures or committee structure to ensure dis- closure of major risks to the University” and that “Penn State’s ‘Tone at the Top’ for transparency, compliance, police reporting, and child protection was com- pletely wrong, as shown by the inaction and concealment on the part of its most senior leaders, and followed by those at the bottom of the University’s pyramid of power.”
In his text regarding organizational structures in higher education, How Col- leges Work, Birnbaum (1988) notes that, organizationally and culturally, colleges and universities differ in many ways from other organizations. He attributes this difference to several factors: the “dualistic” decision-making structure (comprised of faculty “shared governance” and administrative hierarchy); the lack of metrics to measure progress and assess accountability; and the lack of clarity and agree- ment within the academic organization on institutional goals (based, in part, on the often competing threefold mission of most academic organizations of teaching, research, and service). Because of these organizational differences, Birnbaum notes that the “processes, structures, and systems for accountability commonly used in business firms are not always sensible for [colleges and universities]” (p. 27).
While noting that colleges and universities are unique organizations, Birnbaum also observes that they have begun to adopt more general business prac- tices, concluding that “institutions have become more administratively centralized because of requirements to rationalize budget formats, implement procedures that will pass judicial tests of equitable treatment, and speak with a single voice to pow- erful external agencies” (p. 17).
This evolution to a more businesslike culture for IHEs has been evolving since the 1960s and has brought significant societal changes while seeing the federal gov- ernment, as well as state governments, begin to enact specific legislation affecting colleges and universities.6 The proliferation of various laws and regulations, cou- pled with the rise of aggressive consumerism toward the end of the 1990s, has led to an increased risk of private legal claims against institutions of higher education— and their administrators—as well as a proliferation of regulatory and compliance requirements. Higher education is now generally treated like other business enter- prises by judges, juries, and creative plaintiffs’ attorneys, as well as by administra- tive and law enforcement agencies, federal regulators—and the public.
Mitroff, Diamond, and Alpaslan (2006) point out that despite their core edu- cational mission, colleges and universities are really more like cities in terms of the number and variety of services they provide and the “businesses” they are in. They cite the University of Southern California (USC) as an example, noting that USC operates close to 20 different businesses, including food preparation, health care, and sporting events, and that each of these activities presents the university with different risks. Jean Chang (2012), former ERM director at Yale University, observed that IHEs are complicated businesses with millions of dollars at stake, but they don’t like to think of themselves as “enterprises.”
Organizational Type Impacts Institutional Culture
While Birnbaum (1988) notes that IHEs differ in important ways from other orga- nizational types, especially for-profit businesses, he also concludes that colleges
www.it-ebooks.info
146 Implementing Enterprise Risk Management
and universities differ from each other in important ways. Birnbaum outlines five models of organizational functioning in higher education: collegial, bureaucratic, political, anarchical, and cybernetic. In Bush’s (2011) text on educational leader- ship, he groups educational leadership theories into six categories: formal, colle- gial, political, subjective, ambiguity, and cultural. In their discussion of organiza- tional structure, Bolman and Deal (2008) provide yet another method for analysis of organizational culture, identifying four distinctive “frames” from which people view their world and that provide a lens for understanding organizational culture: structural, human resources, political, and symbolic.
Each of these models can provide a conceptual framework by which to under- stand and evaluate the culture of a college or university. Understanding the orga- nizational type of a particular institution is imperative when considering issues such as the process by which goals are determined, the nature of the decision- making process, and the appropriate style of leadership to accomplish goals and implement initiatives. What works in one university organizational type may not be effective in another. The leadership style of senior administration may be oper- ating from one frame or model while the culture of the faculty may be operating from another, thus affecting policy and practice in positive or negative ways.
While not true across the board, for-profit organizations tend to operate from what Bush as well as Bolman and Deal refer to as the formal or structural models and Birnbaum terms bureaucratic. The structural frame represents a belief in ratio- nality. Some assumptions of the structural frame are that “suitable forms of coordi- nation and control ensure that diverse efforts of individuals and units mesh” and that “organizations work best when rationality prevails over personal agendas” (Bolman and Deal 2008, p. 47). Understanding this cultural and framing difference is important when considering the adoption and implementation of ERM in the university environment, and can help to explain why many university administra- tors and faculty are skeptical of the more corporate approach often taken in ERM implementation outside of higher education.
Bush observes that the collegial model has been adopted by most universities and is evidenced, in part, by the extensive committee system. Collegial institu- tions have an “emphasis on consensus, shared power, common commitments and aspirations, and leadership that emphasizes consultation and collective responsi- bilities” (Birnbaum, p. 86). Collegial models assume that professionals also have a right to share in the wider decision-making process (Bush 2011, p. 73). Bush points out that collegial models assume that members of an organization agree on orga- nizational goals, but that often various members within the institution have differ- ent ideas about the central purposes of the institution because most colleges and universities have vague, ambiguous goals. Birnbaum describes the collegium (or university environment) as having the following characteristics:
The right to participate in institutional affairs, membership in a congenial and sym- pathetic company of scholars in which friendships, good conversation, and mutual aid flourish, and the equal worth of knowledge in various fields that precludes preferential treatment of faculty in different disciplines. (p. 87)
ERM (or risk management and compliance initiatives in general) tend to be viewed as more corporate functions and to align with formal, structural, and bureaucratic aims, goal setting, planning, and decision making. The chart in Exhibit 9.1 outlines management practices and how they are viewed from the
www.it-ebooks.info
E xh
ib it
9. 1
D is
ti n
ct io
n s
b et
w ee
n St
ru ct
u ra
la n
d C
o ll
eg ia
lE le
m en
ts o
f M
an ag
em en
t∗
E le
m en
ts o
f M
an ag
em en
t F
o rm
al /S
tr u
ct u
ra l
C o
ll eg
ia l/
H u
m an
R es
o u
rc es
B o
lm an
an d
D ea
l B
u sh
In st
it u
ti o
n al
B ir
n b
au m
In st
it u
ti o
n al
B o
lm an
an d
D ea
l B
u sh
B ir
n b
au m
L ev
el at
w h
ic h
g o
al s
ar e
d et
er m
in ed
In st
it u
ti o
n al
In st
it u
ti o
n al
th ro
u g
h ag
re em
en t
an d
co n
se n
su s
P ro
ce ss
b y
w h
ic h
g o
al s
ar e
d et
er m
in ed
V er
ti ca
la n
d la
te ra
l p
ro ce
ss es
Se t
b y
le ad
er s
B as
ed o
n o
rg an
iz at
io n
al st
ru ct
u re
an d
ro le
s
A g
re em
en t
A g
re em
en t
C o
n se
n su
s
R el
at io
n sh
ip b
et w
ee n
g o
al s
an d
d ec
is io
n s
O rg
an iz
at io
n s
ex is
t to
ac h
ie v
e es
ta b
li sh
ed g
o al
s
D ec
is io
n s
b as
ed o
n g
o al
s
C o
n sc
io u
s at
te m
p t
to li
n k
m ea
n s
to en
d s
an d
re so
u rc
es to
o b
je ct
iv es
Sh ar
ed se
n se
o f
d ir
ec ti
o n
an d
co m
m it
m en
t
D ec
is io
n s
b as
ed o
n g
o al
s
St ro
n g
an d
co h
er en
t cu
lt u
re an
d v
al u
e co
n se
n su
s in
fo rm
s d
ec is
io n
s N
at u
re o
f th
e d
ec is
io n
p ro
ce ss
R at
io n
al ;r
u le
s, p
o li
ci es
,a n
d st
an d
ar d
o p
er at
in g
p ro
ce d
u re
s
R at
io n
al R
at io
n al
;c o
m p
li an
ce w
it h
ru le
s an
d re
g u
la ti
o n
s
E g
al it
ar ia
n is
m ;
te am
s C
o ll
eg ia
l D
el ib
er at
iv e
co n
se n
su s
N at
u re
o f
st ru
ct u
re O
rg an
iz at
io n
s in
cr ea
se ef
fi ci
en cy
an d
en h
an ce
p er
fo rm
an ce
th ro
u g
h sp
ec ia
li za
ti o
n an
d d
iv is
io n
o f
la b
o r
O b
je ct
iv e
re al
it y
; h
ie ra
rc h
ic al
D es
ig n
ed to
ac co
m p
li sh
la rg
e- sc
al e
ta sk
s b
y sy
st em
at ic
al ly
co o
rd in
at in
g th
e w
o rk
o f
m an
y in
d iv
id u
al s
O rg
an iz
at io
n s
ex is
t to
se rv
e h
u m
an n
ee d
s; m
u st
b e
a g
o o
d fi
t b
et w
ee n
o rg
an iz
at io
n an
d p
eo p
le
L at
er al
C o
ll eg
iu m
St y
le o
f le
ad er
sh ip
E st
ab li
sh ed
au th
o ri
ty L
ea d
er es
ta b
li sh
es g
o al
s an
d in
it ia
te s
p o
li cy
L ea
d er
is co
n ce
rn ed
w it
h p
la n
n in
g ,
d ir
ec ti
n g
, o
rg an
iz at
io n
, st
af fi
n g
,a n
d ev
al u
at in
g
D o
es n
’t co
n tr
o lo
r o
v er
ly st
ru ct
u re
; se
n si
ti v
e to
b o
th ta
sk an
d p
ro ce
ss ;
u se
o f
te am
s
L ea
d er
se ek
s to
p ro
m o
te co
n se
n su
s
L ea
d er
is “f
ir st
am o
n g
eq u
al s,
” co
n su
lt at
io n
an d
co ll
ec ti
v e
re sp
o n
si b
il it
ie s
∗ A
d ap
te d
fr o
m B
u sh
(2 01
1) ,1
99 (F
ig u
re 9.
1) .
147
www.it-ebooks.info
148 Implementing Enterprise Risk Management
formal/structural and collegial/human resources models. As will become clear in the University of Washington ERM implementation case described in this chap- ter, the culture of higher education in general, and the institution-specific culture of the particular organization, cannot be ignored when adopting or implementing an ERM program, and may be the most important element when making ERM program, framework, and philosophy decisions.
Risks Affecting Higher Education
One way in which colleges and universities are becoming more like other organi- zations is the type and variety of risks affecting them. Risk and crisis in higher edu- cation may arise from a variety of sources: a failure of governance or leadership; a business or consortium relationship; an act of nature; a crisis related to student safety or welfare or that of other members of the community; a violation of federal, state, or local law; or a myriad of other factors. The University Risk Management and Insurance Association (URMIA 2007) cites several drivers that put increased pressure and risk on colleges and universities, including competition for faculty, students, and staff; increased accountability; external scrutiny from the govern- ment, the public, and governing boards; IT changes; competition in the market- place; and increased levels of litigation. A comprehensive, yet not exhaustive, list of risks affecting higher education is outlined in Exhibit 9.2. Risks unmitigated at the unit, department, or college level can quickly lead to high-profile institutional risk when attorneys, the media, and the public get involved. Helsloot and Jong (2006) observe that higher education has a unique risk as it relates to the genera- tion and sharing of its core task: “to gather, develop, and disseminate knowledge” (p. 154), noting that the “balance between the unfettered transfer of knowledge, on the one hand, and security, on the other, is a precarious one” (p. 155).
EMERGENCE OF ERM IN HIGHER EDUCATION In the corporate sector, interest in the integrated and more strategic concept of enterprise risk management (ERM) has grown significantly in the past 15 years (Arena, Arnaboldi, and Azzone 2010). Certain external factors affected the adop- tion and implementation of ERM practices in corporations, including significant business failures in the late 1980s that occurred as a result of high-risk financing strategies (URMIA 2007). Governments in several European countries took actions and imposed regulatory requirements regarding risk management earlier than was done in the United States, issuing new codes of practice and regulations such as the Cadbury Code (1992), the Hampel Report (1998), and the Turnbull Report (1999). In 2002, the Public Company Accounting Reform and Investor Protection Act (other- wise known as Sarbanes-Oxley, or SOX) was enacted in the United States. In 2007, the Securities and Exchange Commission (SEC) issued guidance placing greater emphasis on risk assessment and began to develop requirements for enterprise- wide evaluation of risk. In February 2010, the SEC imposed regulations requiring for-profit corporations to report in depth on how their organizations identify risk, set risk tolerances, and manage risk/reward trade-offs throughout the enterprise.
While widespread in the corporate sector, in large part due to regulatory com- pliance, ERM is fairly new in higher education. Gurevitz (2009) observes that
www.it-ebooks.info
LESSONS FROM THE ACADEMY 149
Exhibit 9.2 Risks Affecting Higher Education
Institutional Area Types of Risk
Boards of Trustees and Regents, President, Senior Administrators
Accreditation Board performance assessment CEO assessment and compensation Conflict of interest Executive succession plan Fiduciary responsibilities IRS and state law requirements Risk management role and responsibility
Business and Financial Affairs
Articulation agreements Bonds Budgets Business ventures Cash management Capital campaign Contracting and purchasing Credit rating Debt load/ratio Endowment Federal financial aid Fraud Gift/naming policies Insurance Investments Loans Outsourcing Transportation and travel Recruitment and admissions model
Compliance with Federal, State, and Local Laws, Statutes, Regulations, and Ordinances
Americans with Disabilities Act (ADA)/Section 504 Copyright and fair use Drug-Free Schools and Communities Act Family Educational Rights and Privacy Act (FERPA) Health Insurance Portability and Accountability Act of
1996 (HIPAA) Higher Education Opportunity Act IRS regulations Integrated Postsecondary Education Data System (IPEDS) Jeanne Clery Disclosure of Campus Security Policy and
Campus Crime Statistics Act (Clery Act) National Collegiate Athletic Association
(NCAA)/National Association of Intercollegiate Athletics (NAIA) regulations
Record retention and disposal Tax codes Whistle-blower policies
Campus Safety and Security
Emergency alert systems for natural disaster or other threat
Emergency planning and procedures Incident response
(continued)
www.it-ebooks.info
150 Implementing Enterprise Risk Management
Exhibit 9.2 (Continued)
Institutional Area Types of Risk
Campus Safety and Security (continued)
Infectious diseases Interaction with local, state, and federal authorities Minors on campus Terrorism Theft Violence on campus Weapons on campus Weather
Information Technology Business continuity Cyber liability Electronic records Information security Network integrity New technologies Privacy System capacity Web page accuracy
Academic Affairs Academic freedom Competition for faculty Faculty governance issues Grade tampering Grants Human subject, animal, and clinical research Intellectual property Internship programs Joint programs/partnerships Laboratory safety Online learning Plagiarism Quality of academic programs Student records Study abroad Tenure
Student Affairs Admission/retention Alcohol and drug use Clubs and organizations Conduct and disciplinary system Dismissal procedures Diversity issues Fraternities and sororities Hate crimes Hazing International student issues Psychological disabilities issues Sexual assault Student death Student protest Suicide
www.it-ebooks.info
LESSONS FROM THE ACADEMY 151
Exhibit 9.2 (Continued)
Institutional Area Types of Risk
Employment/Human Resources
Affirmative action Background checks Discrimination lawsuits Employment contracts Grievances Labor laws Performance evaluation Personnel matters Sexual harassment Termination procedures Unions Workplace safety
Physical Plant Building and renovation Fire Infrastructure damage Off-site programs Public-private partnerships Residence hall and apartment safety Theft
Other Alumni Athletics External relations Increased competition for students, faculty, and staff Increased external scrutiny from the public, government,
and media Medical schools, law schools Vendors
educational institutions “have been slower to look at ERM as an integrated busi- ness tool, as a way to help all the stakeholders—trustees, presidents, provosts, CFOs, department heads, and frontline supervisors—identify early warning signs of something that could jeopardize a school’s operations or reputation.” In 2000, the Higher Education Funding Council of England enacted legislation requir- ing all universities in England to implement risk management as a governance tool (Huber 2009). In Australia, the Tertiary Education Quality Standards Agency (TEQSA 2013) evaluates the performance of higher education providers against a set of threshold standards and makes decisions in relation to their performance in line with three regulatory principles, including understanding an institution’s level of risk.
In the United States, engaging in risk management efforts and programs for IHEs is not specifically required by accrediting agencies or the federal govern- ment. Perhaps because it is not required, ERM has not been a top focus for boards and senior administrators at IHEs. Tufano (2011) points out that risk management in the nonprofit realm, including higher education, is significantly less developed than in much of the corporate world and often still has a focus on avoidance of loss rather than setting strategic direction. Mitroff, Diamond, and Alpaslan’s (2006)
www.it-ebooks.info
152 Implementing Enterprise Risk Management
survey assessing the state of crisis management in higher education revealed that colleges and universities were generally well prepared for certain crises, particu- larly fires, lawsuits, and crimes, in part because certain regulations impose require- ments. They were also well prepared for infrequently experienced but high-profile situations such as athletics scandals, perhaps based on their recent prominence in the media. However, they were least prepared for certain types of crises that were frequently experienced such as reputation and ethics issues, as well as other non- physical crises such as data loss and sabotage.7 A survey conducted by the Asso- ciation of Governing Boards of Universities and Colleges and United Educators (2009) found that, of 600 institutions completing the survey, less than half of the respondents “mostly agreed” that risk management was a priority at their insti- tution. Sixty percent stated that their institutions did not use a comprehensive, strategic risk assessment to identify major risks to mission success. Recent high- profile examples may be beginning to change that. The Freeh Report regarding Penn State determined that “the university’s lack of a robust risk-management sys- tem contributed to systemic failures in identifying threats to individuals and the university and created an environment where key administrators could ‘actively conceal’ troubling allegations from the board” (Stripling 2012).
ADOPTING AND IMPLEMENTING ERM IN COLLEGES AND UNIVERSITIES In 2001, PricewaterhouseCoopers and the National Association of College and University Business Officers (NACUBO) sponsored a think tank of higher educa- tion leaders to discuss the topic of ERM in higher education, likely in response to widespread discussion in the for-profit sector and in anticipation of potential reg- ulatory implications for higher education. The group included Janice Abraham, then president and chief executive officer of United Educators Insurance, as well as senior administrators from seven universities.8 The focus of their discussion was on the definition of risk; the risk drivers in higher education; implementa- tion of risk management programs to effectively assess, manage, and monitor risk; and how to proactively engage the campus community in a more informed dia- logue regarding ERM. Their conversation produced a white paper, “Developing a Strategy to Manage Enterprisewide Risk in Higher Education” (Cassidy et al. 2001). In 2007, NACUBO and the Association of Governing Boards of Universities and Colleges (AGB) published additional guidance in their white paper, “Meeting the Challenges of Enterprise Risk Management in Higher Education.” The Uni- versity Risk Management and Insurance Association (URMIA) also weighed in with its white paper, “ERM in Higher Education” (2007). In 2013, Janice Abraham wrote a text published by AGB and United Educators, entitled Risk Management: An Accountability Guide for University and College Boards. These documents provide guidance and information to institutions considering the implementation of an ERM program and discuss the unique aspects of the higher education environment when considering ERM implementation.
Several authors have discussed the transferability of the ERM model to higher education, even with the cultural and organizational differences that abound between the for-profit environment and higher education. URMIA (2007) con- cluded that “the ERM process is directly applicable to institutions of higher
www.it-ebooks.info
LESSONS FROM THE ACADEMY 153
education, just as it is to any other ‘enterprise’; there is nothing so unique to the col- lege or university setting as to make ERM irrelevant or impossible to implement” (p. 17). Whitfield (2003) assessed the “feasibility and transferability of a general framework to guide the holistic consideration of risk as a critical component of college and university strategic planning initiatives” (p. 78) and concluded that “the for-profit corporate sector’s enterprise-wide risk management framework is transferable to higher education institutions” (p. 79).
National conferences for higher education associations such as NACUBO, AGB, URMIA, and others had presentations on ERM. Insurers of higher educa- tion, such as United Educators and Aon, as well as consultants such as Accenture and Deloitte, among others, provided workshops to institutions and published white papers of their own, such as the Gallagher Group’s “Road to Implemen- tation: Enterprise Risk Management for Colleges and Universities” (2009). In the early 2000s, many IHEs rushed to form committees to examine ERM and hired risk officers in senior-level positions, following the for-profit model.9 However, when specific regulations such as those imposed by the SEC for for-profit entities did not emerge in the higher education sector, interest in highly developed ERM models at colleges and universities began to wane. Gurevitz (2009) points out that the early ERM frameworks weren’t written with higher education in mind and were often presented “in such a complicated format that it made it difficult to translate the concepts for many universities.”
Institutions with ERM programs have taken various paths in their selection of models and methods and have been innovative and individualized in their approaches. There is no comprehensive list of higher education institutions with ERM programs, and not all IHEs with integrated models use the term ERM. Exhibit 9.3 shows a snapshot of IHEs that have adopted ERM; a review of their websites demonstrates the various risk management approaches adopted by IHEs and the wide variability in terminology, reporting lines, structure, and focus. In many instances, those IHEs with highly developed programs today had some form of “sentinel event” (regulatory, compliance, student safety, financial, or other) that triggered the need for widespread investigation and, therefore, the develop- ment of more coordinated methods for compliance, information sharing, and deci- sion making. In other situations, governing board members brought their business experience with ERM to higher education, recognizing the “applicability and rel- evance of using a holistic approach to risk management in academic institutions” (Abraham 2013, p. 6).
Regardless of the impetus, the current focus appears to be on effectively link- ing risk management to strategic planning. Abraham points out that many higher education institutions are recognizing that an effective ERM program, with the full support of the governing board, “will increase a college, university or system’s likelihood of achieving its plans, increase transparency, and allow better allocation of scarce resources. Good risk management is good governance” (p. 5). Ken Barnds (2011), vice president at Augustana College, points out that “many strategic plan- ning processes, particularly in higher education, spent an insufficient amount of time thinking about threats and weaknesses.” Barnds believes that “an honest and thoughtful assessment of the college’s risks . . . would lead [Augustana] in a pos- itive, engaged, and proactive direction.” A recent Grant Thornton (2011) thought paper urges university leaders to think about more strategic issues as part of their risk management, including board governance, IRS scrutiny of board oversight
www.it-ebooks.info
E xh
ib it
9. 3
Sa m
p le
o f
C o
ll eg
es an
d U
n iv
er si
ti es
w it
h E
R M
P ro
g ra
m s
In st
it u
ti o
n T
it le
o f
P er
so n
w it
h E
R M
R es
p o
n si
b il
it y
W eb
si te
D u
k e
U n
iv er
si ty
E xe
cu ti
v e
D ir
ec to
r o
f In
te rn
al A
u d
it h
tt p
:/ /
in te
rn al
au d
it s.
d u
k e.
ed u
/ ri
sk -a
ss es
sm en
t/ in
d ex
.p h
p E
m o
ry U
n iv
er si
ty C
h ie
f A
u d
it O
ff ic
er w
w w
.e m
o ry
.e d
u /
E M
O R
Y _R
E P
O R
T /
st o
ri es
/ 20
10 /
04 /
19 /
ri sk
_ m
an ag
em en
t. h
tm l
G eo
rg ia
St at
e U
n iv
er si
ty D
ir ec
to r,
E n
te rp
ri se
R is
k M
an ag
em en
t w
w w
.g su
.e d
u /
ac co
u n
ti n
g /
63 37
0. h
tm l
Io w
a St
at e
U n
iv er
si ty
A ss
o ci
at e
V ic
e P
re si
d en
t fo
r B
u d
g et
an d
P la
n n
in g
w w
w .p
ro v
o st
.ia st
at e.
ed u
/ w
h at
-w e-
d o
/ er
m
Jo h
n so
n &
W al
es D
ir ec
to r
o f
C o
m p
li an
ce ,I
n te
rn al
A u
d it
,a n
d R
is k
M an
ag em
en t
w w
w .jw
u .e
d u
/ co
n te
n t.
as p
x? id
= 57
82 5
M ar
ic o
p a
C o
u n
ty C
o m
m u
n it
y C
o ll
eg e
D is
tr ic
t (M
C C
C D
)
D ir
ec to
r o
f E
n te
rp ri
se R
is k
M an
ag em
en t
w w
w .m
ar ic
o p
a. ed
u /
p u
b li
cs te
w ar
d sh
ip /
g o
v er
n an
ce /
ad m
in re
g s/
au xi
li ar
y /
4_ 16
.p h
p
O h
io U
n iv
er si
ty A
ss o
ci at
e V
ic e
P re
si d
en t
fo r
R is
k M
an ag
em en
t an
d Sa
fe ty
w w
w .o
h io
.e d
u /
ri sk
an d
sa fe
ty /
u rm
i.h tm
T ex
as A
& M
U n
iv er
si ty
Sy st
em O
ff ic
e o
f R
is k
M an
ag em
en t
an d
B en
ef it
s A
d m
in is
tr at
io n
w w
w .t
am u
s. ed
u /
o ff
ic es
/ ri
sk /
ri sk
m an
ag e/
g u
id e/
en te
rp ri
se -r
is k
- m
an ag
em en
t/ U
n iv
er si
ty o
f A
la sk
a Sy
st em
C h
ie f
R is
k O
ff ic
er w
w w
.a la
sk a.
ed u
/ ri
sk sa
fe ty
/
U n
iv er
si ty
o f
C al
if o
rn ia
R is
k Se
rv ic
es ,O
ff ic
e o
f th
e P
re si
d en
t w
w w
.u co
p .e
d u
/ en
te rp
ri se
-r is
k -m
an ag
em en
t/ U
n iv
er si
ty o
f D
en v
er D
ir ec
to r
o f
E n
te rp
ri se
R is
k M
an ag
em en
t w
w w
.d u
.e d
u /
in te
rn al
-a u
d it
/ in
te rn
al _a
u d
it /
fa q
.h tm
l U
n iv
er si
ty o
f Io
w a
Se n
io r
V ic
e P
re si
d en
t o
f F
in an
ce an
d O
p er
at io
n s
an d
T re
as u
re r
w w
w .u
io w
a. ed
u / ∼ fu
sr m
/ E
n te
rp ri
se R
is k
M an
ag em
en t/
in d
ex .h
tm l
U n
iv er
si ty
o f
M ar
y la
n d
V ic
e P
re si
d en
t fo
r P
la n
n in
g an
d A
cc o
u n
ta b
il it
y w
w w
.u m
ar y
la n
d .e
d u
/ ac
co u
n ta
b il
it y
-o ld
/ ri
sk -m
an ag
em en
t/
U n
iv er
si ty
o f
N o
tr e
D am
e D
ir ec
to r
o f
R is
k M
an ag
em en
t an
d Sa
fe ty
h tt
p :/
/ ri
sk m
an ag
em en
t. n
d .e
d u
/ ab
o u
t/
U n
iv er
si ty
o f
V er
m o
n t
Se n
io r
St ra
te g
is t
fo r
E n
te rp
ri se
R is
k an
d P
la n
n in
g ,O
ff ic
e o
f th
e V
ic e
P re
si d
en t
fo r
F in
an ce
& A
d m
in is
tr at
io n
w w
w .u
v m
.e d
u / ∼ er
m /
U n
iv er
si ty
o f
M ar
y la
n d
V ic
e P
re si
d en
t fo
r P
la n
n in
g an
d A
cc o
u n
ta b
il it
y w
w w
.u m
ar y
la n
d .e
d u
/ ac
co u
n ta
b il
it y
-o ld
/ ri
sk -m
an ag
em en
t/
U n
iv er
si ty
o f
W as
h in
g to
n R
is k
A n
al y
st h
tt p
:/ /
f2 .w
as h
in g
to n
.e d
u /
fm /
er m
Y al
e U
n iv
er si
ty D
ir ec
to r
o f
E R
M h
tt p
:/ /
o g
c. y
al e.
ed u
/ ri
sk m
an ag
em en
t
154
www.it-ebooks.info
LESSONS FROM THE ACADEMY 155
practices, investment performance in university endowments, indirect cost rates in research, changes in employment practices, and outsourcing arrangements.
Regardless of terminology, there is an increased priority on taking a more enterprise-wide approach to risk management and moving from a compliance- driven approach to a comprehensive, strategic approach across and throughout the organization that is used to positively affect decision making and impact mis- sion success and the achievement of strategic goals. Tufano (2011) points out that even in the corporate environment, top leaders are not inclined to work through a detailed step-by-step risk management process, but rather take a top- level approach. In the university environment, this means asking three fundamen- tal questions: What is our mission? What is our strategy to achieve it? What risks might derail us from achieving our mission? Richard F. Wilson, president of Illinois Wesleyan University, may best summarize the current perspective of senior-level higher education administrators:
When I first started seeing the phrase “enterprise risk management” pop up in higher education literature, my reaction was one of skepticism. It seemed to me yet another idea of limited value that someone had created a label for, to make it seem more important than it really was. Although some of that skepticism remains, I find myself increasingly in sympathy with some of its basic tenets . . . [especially] the analysis that goes into decisions about the future. Most institutions are currently engaged in some kind of strategic planning effort driven, in part, by the need to protect their financial viability and vitality for the foreseeable future. . . . Bad plans and bad execution of good ideas can put an institution at risk fairly quickly in the current environment. Besides examining what we hope will happen if a particular plan is adopted, we should also devote time to the consequences if the plan does not work. I still cannot quite get comfortable incorporating enterprise risk man- agement into my daily vocabulary, but I have embraced the underlying principles. (Wilson 2013)
THE UNIVERSITY OF WASHINGTON: A JOURNEY OF DISCOVERY The University of Washington (UW) has a robust enterprise risk management (ERM) program that is moving into its seventh year. The program began with what administrators10 at UW call a “sentinel event,” settling a Medicare and Medicaid overbilling investigation by paying the largest fine by a university for a compliance failure—$35 million. This led the new president, Mark Emmert, to for- mally charge senior administrators in 2005 with the task of identifying best prac- tices for “managing regulatory affairs at the institutional level by using efficient and effective management techniques” (UW ERM Annual Report 2008, p. 4). At the outset in 2006, the objective for UW was to “create an excellent compliance model built on best practices, while protecting its decentralized, collaborative, and entrepreneurial culture” (Collaborative ERM Report 2006, p. vi). The ERM pro- cess at UW has been what Ann Anderson, associate vice president and controller, terms “a journey of discovery.” ERM has developed and evolved at UW, mov- ing from what UW administrators describe as an early compliance phase, through
www.it-ebooks.info
156 Implementing Enterprise Risk Management
a governance phase to a mega-risk phase. Currently, the University of Washing- ton is focused on two objectives: (1) strengthening oversight of top risks, and (2) enhancing coordination and integration of ERM activities with decision-making processes at the university. This case study will describe the decision-making and implementation process at UW, as well as outline various tools and frameworks that UW adopted and adapted for use not only in the higher education setting in general, but to fit specifically within the university’s decentralized culture.
Institutional Profile
Founded in 1861, the University of Washington is a public university enrolling some 48,000 students and awarding approximately 10,000 degrees annually (see Exhibit 9.4). The institution also serves approximately 47,000 extension students. There are nearly 650 student athletes in UW’s 21 Division I men’s and women’s teams. There is a faculty/staff of over 40,000, making UW the third-largest employer in the state of Washington. The university is comprised of three cam- puses with 17 major schools and colleges and 13 registered operations abroad. It has a $5.3 billion annual budget, with $1.3 billion in externally funded research and $2.6 billion in clinical medical enterprise. UW has been the top public university in federal research funding every year since 1974 and has been among the top five universities, public and private, in federal funding since 1969. The university has an annual $9.0 billion economic impact on the state of Washington.
Culture at UW
When appointed to serve on the President’s Advisory Committee on ERM (PACERM) in 2007, Professor Daniel Luchtel commented, in the context of talking about risk assessments, that “the number of issues and their complexity is stun- ning. The analogy that comes to mind is trying to get a drink of water from a fire hose” (2007 ERM Annual Report, p. 4). As with most higher education institutions, especially research universities, along with the core business of the teaching and learning of undergraduate and graduate students, the faculty are focused on the creation of new knowledge. “The University of Washington is a decentralized yet collaborative entity with an energetic, entrepreneurial culture. The community members are committed to rigor, integrity, innovation, collegiality, inclusiveness, and connectedness” (Collaborative Enterprise Risk Management Final Report 2006, p. v).
Faculty innovation and the idea of compliance don’t always go hand in hand in higher education, and UW is no exception. Research associate professor David Lovell, vice-chair of the Faculty Senate in 2007–2008, expresses it well:
“Compliance” [is] not necessarily a good word for faculty members. . . . What lies behind [that] is the high value faculty accord to personal autonomy. . . . The notion of a culture of compliance sounds like yet another extension of impersonal, corpo- rate control, shrinking the arena of self-expression in favor of discipline and con- formity. . . . Over the last ten months, I’ve come to understand that you’re not here to get in our way, but to make it possible for us faculty legally to conduct the work we came here to do. . . . I hope that working together, we can try to spread such understanding further, so that we can make compliance—or whatever term you choose—less threatening to faculty and frustrating to staff. (Annual ERM Report 2008, pp. 6–7)
www.it-ebooks.info
LESSONS FROM THE ACADEMY 157
26.3% ASIAN AMERICANS
UNDERGRADUATE
32,291
48,022 students were enrolled at the UW in the fall of 2009 STUDENTS
GRADUATE
11,592
PROFESSIONAL
1,907
11% ASIAN AMERICANS
11.7% UNDERREPRESENTED MINORITIES
8.3% UNDERREPRESENTED MINORITIES
5.2% INTERNATIONAL STUDENTS
13.6% INTERNATIONAL STUDENTS
19.2% ASIAN AMERICANS
7.4% UNDERREPRESENTED MINORITIES WOMEN
55.8%
WOMEN
54%
WOMEN
52.4%
MEN
47.6%
MEN
46%
MEN
44.2% 1.6% INTERNATIONAL STUDENTS
GATES CAMBRIDGE
SCHOLARS 4MARSHALL
SCHOLARS 7RHODES
SCHOLARS
SCHOLARS
46
35
Exhibit 9.4 University of Washington Student Profile From University of Washington Fact Book: http://opb.washington.edu/content/factbook.
Organizationally, the institution is divided into silos, which has historically focused risk mitigation within those silos.
Implementation History at UW
On April 22, 2005, President Mark Emmert sent an e-mail to the deans and cabinet members in which he said: “With the most recent example of compliance issues, we have again been reminded that we have not yet created the culture of compliance that we have discussed on many occasions.” He went on to say that “the creation of a culture of compliance needs to be driven by our core values and commitment to doing things the right way, to being the best at all we do. . . . We need to know
www.it-ebooks.info
158 Implementing Enterprise Risk Management
that the manner in which we manage regulatory affairs is consistent with the best practices in existence.”
The Sentinel Event: Largest Fine at a Medical School The Collaborative Enterprise Risk Management Report for the University of Wash- ington (2006) began with the following: “Over the past few years, the UW has been confronted by a series of problems with institution-wide implications, includ- ing research compliance, financial stewardship, privacy matters, and protection of vulnerable populations” (p. v). The situation with the highest impact on the uni- versity began when Mark Erickson, a UW compliance officer, filed a complaint alleging fraud in the UW’s Medicare and Medicaid billing practices. The 1999 com- plaint prompted a criminal investigation, guilty pleas from two doctors, and a civil lawsuit resulting in the $35 million settlement, the largest settlement made by an academic medical center in the nation. The federal prosecutor claimed that “many people within the medical centers were aware of the billing problems” and that “despite this knowledge, the centers did not take adequate steps to cor- rect them” (Chan 2004). UW’s 2006 ERM Annual Report acknowledges that, in addition to the direct cost of the fines, there were also indirect costs in terms of additional resources for reviews of university procedures, increased rigor and fre- quency of audits, and an incalculable damage to the university’s reputation. The federal prosecutor acknowledged that UW’s efforts to reform its compliance pro- gram have been “outstanding” (Chan 2004). He further noted that since the law- suit was filed, the university “has radically restructured their compliance office. The government is very pleased with the efforts the UW is taking to take care of these errors.”
Leadership from the Top: President Outlines the Charge
At the time of the medical billing scandal, Lee L. Huntsman was president of UW. Huntsman had formerly been the acting provost, associate dean for scien- tific affairs at the school of medicine, and a professor of bioengineering. The UW Board of Regents had appointed Huntsman in a special session when Richard McCormick, the incumbent, accepted the presidency at Rutgers. Huntsman served for 18 months as president and continued as Special Assistant to the President and Provost for Administrative Transition until 2005 and as a senior adviser to the uni- versity for several more years. Mark A. Emmert, former chancellor of Louisiana State University and a UW alumnus, was appointed as the 30th president of UW and professor with tenure at the Evans School on June 14, 2004.
In April 2005, President Emmert charged V’Ella Warren, Vice President for Financial Management, and David Hodge, Dean of the College of Arts and Sciences, with conducting a preliminary review of best practices in compliance and enterprise risk management in corporate and higher education institutions. Warren engaged the Executive Director of Risk Management, Elizabeth Cherry, and the Executive Director of Internal Audit, Maureen Rhea, to conduct a literature search on enterprise risk management, particularly in higher education. Cherry and Rhea engaged Andrew Faris, risk management analyst, to assist, and the three spent nearly two years (from 2004 to 2006) conducting the literature search and finding out how risk management was functioning on other campuses. As they
www.it-ebooks.info
LESSONS FROM THE ACADEMY 159
conducted their research, they continued to report their findings to Vice President Warren. They also piloted the risk assessment process with various departments at UW.
Based on their findings and discussions with Vice President Warren, a draft report was compiled to provide initial guidance of the development of a UW- specific framework. The report provided an overview of various approaches to compliance, described best practices at four peer universities (University of Texas system, University of Minnesota, University of Pennsylvania, and Stanford Uni- versity), identified the common problems encountered in several recent compli- ance problems at UW, and offered suggestions for actions that UW might take in the effective management of compliance and risk. President Emmert then charged Warren and Hodge to cochair the recommended Strategic Risk Initiative Review Committee (SRIRC). The role of the SRIRC was to continue to investigate best prac- tices in university risk management and make recommendations about a structure and framework for compliance that would fit the UW culture. In a memo to the SRIRC regarding that review, Warren and Hodge noted that they had “developed a framework for university-wide risk and compliance management which builds on [UW]’s decentralized and collaborative character.” President Emmert also made it clear that the proposed model should be driven by UW’s core values as well as promote “effective use of people’s time and energy.” In a memo to the deans and cabinet members in 2005, President Emmert declared that UW did not “want or need another layer of bureaucracy.”
The SRIRC was comprised of broad university representation, including the Executive Vice President, the Associate Vice President for Medical Affairs, the Senior Assistant Attorney General, the Vice Provost-elect for Research, the Vice Provost for Planning and Budgeting, the Chancellor of the University of Washington–Tacoma, the Athletic Director, the Dean of the School of Public Health and Community Medicine, the Provost and Vice President for Academic Affairs, the Dean of the School of Nursing, the Special Assistant to the President for Exter- nal Affairs, the Vice President of Student Affairs, two faculty members, and two students. Meeting throughout the fall semester, the SRIRC reviewed the prelim- inary research material provided by Hodge and Warren and their team and dis- cussed a variety of issues, including the structure for risk management, how risk assessment has been and could be conducted, communication issues, methods for reporting risks, ways to report progress, and others. For each initiative, they asked the following three questions: Does this proposal add value? What obstacles are appar- ent and how can they be addressed? How could this proposal be improved?
In addition to formal meetings, Cherry, Rhea, and Faris conducted one-on-one meetings with the SRIRC members to gather more information about how they viewed implementation at the university. Because one of the recommenda- tions was the creation of a Compliance Council, meetings were also conducted throughout the campus with director-level personnel to survey their interests and suggestions regarding that aspect of the proposed model. Prior to the formal implementation of the ERM program, resources were also dedicated to create an infrastructure to sustain the recommended model. Faris’s role as risk manager was formally revised to create a full-time ERM analyst position within the Office of Financial Management in the Finance and Facilities division and a half-time ERM project manager position was created, filled by Kerry Kahl.
www.it-ebooks.info
160 Implementing Enterprise Risk Management
Advisory Committee Recommendations: Create a Culture-Specific ERM Program
In February 2006, Hodge and Warren put forth to President Emmert a Collabora- tive Enterprise Risk Management Proposal developed by the SRIRC. The proposal recommended that “the UW adopt an integrated approach to managing risk and compliance, commonly called enterprise risk management (ERM).” They acknowl- edged that the proposed changes were not intended to “replace what already works across the university,” but rather to “augment the existing organization with thoughtful direction, collaboration, and communication on strategic risks” (Collab- orative ERM Final Report, February 13, 2006). At the outset, the SRIRC acknowl- edged that the structure and priorities of the ERM program would likely evolve and develop over time, but the members of the committee were confident that they had created a “strong, yet flexible framework within which to balance risk and opportunity” (February 14, 2006, memo to President Emmert).
While the report acknowledged the impetus for the creation of the ERM pro- gram (the $35 million compliance failure fine), it focused on the positive impact an ERM program could have for UW, beyond addressing compliance concerns. The report defined key terms and made recommendations based on three basic parameters: scope of the framework, organizational structure for the framework, and philosophy of the program. Each aspect was framed in the context of the liter- ature review and campus comparisons; UW-specific recommendations were put forth based on SRIRC discussion and analysis.
Scope of the Risk Framework
The report reviewed and discussed the various approaches taken by organizations in practicing risk management, from a basic practice of risk transfer through insur- ance to a more integrated institution-wide approach. It acknowledged that, prior to implementation, some key decisions would need to be made: Would the scope of the program be institution-wide or targeted at the school, college, or unit level? Would it include all risks (compliance, finances, operations, and strategy) or be focused on certain categories of risk? ERM was cited as “the most advanced point on the continuum,” a model that integrates risk into the organization’s strategic discussions. The report also summarized a Centralized Compliance Management approach. This model, rather than encompassing all risks, would focus primarily on legal and regulatory compliance. It was noted that “while both are university- wide approaches, they vary in a number of important aspects, including scope, objective, and benefits” (p. 6).
The report also summarized the ERM models at four IHEs, based on interviews with compliance and audit managers at those institutions. Noting that all four were institution-wide approaches, Pennsylvania and Texas were identified as having adopted a more corporate philosophy; Minnesota, a compliance approach with a centralized style; and Stanford, a collaborative ERM approach (see Exhibit 9.5). The report recommended developing a “collaborative, institution-wide risk manage- ment model” for UW, one that “ensures that UW creates an excellent compliance model based on best practices, while protecting its decentralized, collaborative, and entrepreneurial culture” (p. 28).
www.it-ebooks.info
LESSONS FROM THE ACADEMY 161
Minnesota
Stanford
Pennsylvania
Texas•
•
•
•
Washington
Enterprise
Risk
Management
Centralized
Compliance
Management
Control
Collaboration
Exhibit 9.5 UW’s Approach to Risk Management Compared to Other Institutions From University of Washington Collaborative Enterprise Risk Management Final Report, February 13, 2006.
Organizational Structure
Based on a review of the literature and discussions with risk and audit managers at other universities, the report also summarized various models and structures for organizing the risk management activities. One method was to appoint a cen- tral risk officer with institution-wide oversight and responsibility. With this model, key decisions would need to be made regarding reporting lines and the placement of that position within the organization. The report also outlined UW’s current approach to risk management, noting that it had moved beyond the insurance approach, “which is usually reactive and ad hoc,” but also observing that respon- sibility for specific risks was currently distributed among the institution’s orga- nizational silos (p. 15). It further noted that “the UW does not formally integrate risk and compliance into its strategic conversations at the university-wide level” (p. 15). While acknowledging the good progress being made in several areas (including UW Medicine, the newly restructured Department of Audits, and the Office of Risk Management), the report highlighted the weaknesses of the current approach, including the fact that “due to the size, decentralization, and complexity of the institution, a proliferation of compliance, audit, and risk management activ- ities has grown up around separate and distinct risk areas, each largely operating in a self-defined stovepipe” (p. 18).
Philosophy of the Program
The report also discussed the philosophy of a proposed risk management pro- gram, asking whether the preferred approach should focus on enforcing law and regulation—a compliance or control approach—or be one that “encouraged coop- eration between faculty and staff to develop flexible compliance approaches—a collaborative approach” (p. 2). After sharing the findings from the literature review
www.it-ebooks.info
162 Implementing Enterprise Risk Management
and the institutional profiles of the peer institutions, the report outlined three guid- ing principles to shape the evolution of compliance and risk management at UW: (1) foster an institution-wide perspective, (2) ensure that regulatory management is consistent with best practices, and (3) protect UW’s decentralized, collaborative, entrepreneurial culture. In light of these principles, the report made the following eight recommendations, detailing the key elements and implementation sugges- tions for each:
1. Integrate key risks into the decision-making deliberations of senior leaders and Regents.
2. Create an integrated, institution-wide approach to compliance. 3. Ensure that good information is available for the campus community. 4. Create a safe way for interested parties to report problems. 5. Minimize surprises by identifying emerging compliance and risk issues. 6. Recommend solutions to appropriate decision makers. 7. Check progress on compliance and risk initiatives. 8. Maintain a strong audit team.
EVOLUTION OF ERM AT UW The SRIRC report acknowledged that the ERM concept was not new, but that it has not been fully implemented at many organizations, especially in higher education. The development of risk management within an organization was discussed, not- ing that the management of risk develops along a continuum, with early mod- els focused on hazard risks only and mitigation being accomplished primarily through the purchase of insurance. As risk models evolve at an organization, other risk types are added to the model and more cross-functional participation by other units begins to occur. Ultimately, strategic risks are added to the conversation and there is an integration of information from all units across the university. It is at this point that risk can be viewed as both an opportunity and a threat and where mitigation priorities can be more clearly linked to the strategic objectives of the organization.
In 2006, when the ERM program and model were proposed, UW viewed itself as being in the middle of the continuum (see Exhibit 9.6). The report noted:
Although many operational units, committees, and administrative bodies handled the risks faced in their own environments well, there is little cross-functional shar- ing of information. The opportunity aspect of risk is therefore not fully utilized by the University and risk mitigation priorities are not consistently driven by the institution’s strategic objectives. (p. 4)
The 2012 ERM Annual Report observes that “the ERM program has continued to evolve, developing structural mechanisms to support the 8 initial recommenda- tions” (p. 2).
Faris and Kahl commented that the first few years of implementation of ERM at UW were focused on risk assessments. They spent most of their time (both work- ing with the ERM committees and in their roles as ERM staff) performing risk
www.it-ebooks.info
LESSONS FROM THE ACADEMY 163
UW Evolution of ERM
Risk Categories
Strategic – Mega
Financial
Operational
Compliance
Separate Partial Full Functions - - - - - Integration - - - - -
Degree of Cross - Functional Integration
What we have accomplished
Where UW’s program is headed
Exhibit 9.6 Evolution of ERM at the University of Washington From University of Washington 2009 ERM Annual Report, p. 4.
assessments using the risk mapping process (e.g., writing a risk statement, ranking the risks for likelihood and impact, plotting the risks on a 5 × 5 map). In the first four or five years, they conducted nearly 35 risk assessments across the univer- sity. Based on broad cross-functional topics identified by the President’s Advisory Committee on ERM (PACERM), the risk assessments were facilitated by Faris and Kahl with temporary teams put together to meet three to five times over the course of the year to write risk statements, rank them, and put together suggestions for mitigation.
The first five years of ERM at UW were “formative” and focused on the fol- lowing key activities:
� Developing a common language around risk � Conducting individual risk assessments � Focusing discussion and mitigation on financial and enrollment challenges � Comparing financial strength (as gauged by Moody’s Investors Service)
against peers � Drafting an initial compendium of enterprise-wide success metrics
Well-written, clear annual reports to the president, the Board of Regents, and the UW community helped to connect the dots and keep the strategic overar- ching goals front and center, even as employees at the unit level were continu- ously engaged in the more operational aspects of ERM. Exhibit 9.7 summarizes the implementation time line from the formalized inception of ERM at UW to the present. A review of the chart shows how the UW has continued to focus on mov- ing from an initial focus on hazard risk to a more integrated, strategic approach to enterprise risk management.
www.it-ebooks.info
164 Implementing Enterprise Risk Management
Exhibit 9.7 University of Washington ERM Implementation Time Line
Academic Year Initiatives∗
2005–2006 President Emmert charged administrators with review of best practices and development of broad institutional compliance/risk framework for UW.
Warren and Hodge drafted report with overview of institution-wide approaches, best practices at four peer universities, common compliance problems faced by UW, and suggestions for next steps.
2006–2007 Developed a central focus and common language for evaluating risk across the university.
ERM structure formed (including PACERM, Compliance Council). First UW-wide risk map was compiled. Office of Risk Management dedicated one FTE to ERM initiative. Dedicated $4.8 million in funds for integrity/compliance/stewardship
initiatives, including animal care, student life counseling, human subjects, global activities, and IT security.
Information about ERM program included in reinsurance renewal discussions with international underwriters.
First Annual Report to the Board of Regents. 2007–2008 Identified key strategic and mega risks for the institution.
Expanded Compliance Council to form COFi. Rolled out Enterprise Risk Management Toolkit for units to do
self-assessments. UW Medicine and Department of Athletics presented annual reports on their
compliance programs and ongoing efforts to minimize risks and address current issues.
Continued development of the Institutional Risk Register. Internal Audit department expanded from nine to 15 staff.
2008–2009 Focused on financial crisis and demographics. PACERM formed two mega-risk subgroups to apply ERM processes at a
strategic level: extended financial crisis and faculty recruitment and retention.
HR advance planning for economic downturn and major reduction in state funding.
Office of Risk Management conducted first Employment Practices Liability Seminar.
ERM web pages were enhanced. Hired a new Executive Director for Audits. Second ERM Report to the Board of Regents.
2009–2010 Development of the UW Integrated Framework based on COSO model. PACERM focused discussion on how to remain competitive. Initial exploration of enterprise-wide dashboard of success metrics. Use of risk assessments in business case alternatives and research proposals.
2010–2011 PACERM evaluated the university’s academic personnel profile and oversaw major information technology projects.
Assessed institutional financial strength in comparison to peers (Moody’s). More than 200 ERM Toolkits provided to universities and companies.
2011–2012 Development of enterprise-wide dashboard of success metrics. UW’s work recognized as a “Best Practice” by the Association of Governing
Boards for Universities and Colleges (AGB).
∗All initiatives, including others not detailed in this chart, are outlined in more detail in the UW ERM Annual Reports, available at the website: http://f2.washington.edu/fm/erm.
www.it-ebooks.info
LESSONS FROM THE ACADEMY 165
ERM STRUCTURE AT UW The organizational structure for ERM at UW arose out of the initial recommen- dations of the SRIRC. In its aggregate, the UW ERM program is comprised of the following areas, working together to create an effective structure: UW units; ERM staff; Compliance, Operations, and Finance Council (COFi Council); President’s Advisory Committee on ERM (PACERM); Internal Audit; and the UW President and Provost (see Exhibit 9.8).
UW Units
At the unit level, staff and faculty take ownership of the activities that give rise to risk. They conduct risk and opportunities identification and self-assessments. They develop strategies and take action to mitigate and monitor risk. They are encouraged to share a summary of their risk assessments with the Office of Risk Management.
ERM Program Staff
There are 1.5 full-time equivalent (FTE) ERM program staff located in the office of the associate vice president/controller for UW. This staff supports the work of the various committees and units, in part by establishing the ERM framework, stan- dards, and templates. They monitor and participate in risk assessments for the pur- pose of providing the enterprise view. They provide administrative support and
University President and Provost UW Environment (e.g., right side of cube)
President’s Advisory Committee on Enterprise Risk Management (PACERM)
Entity Level (e.g., top-down view of strategic risks,
mega risks, and opportunities)
Compliance, Operations, Finance Council (COFi)
Division or Function Level (e.g., middle up, cross-functional view of
compliance, operations, and financial risks)
Research Academic
Affairs Athletics
Health
Care
Risk and
Safety Finance
Information
Technology
Human
Resources
Eight functional areas of risk
Core Functions Support Services
Attorney General
Risk Management
Environmental Health & Safety
Unit Level (e.g., bottom-up view of risks and opportunities)
Examples of UW Units
Exhibit 9.8 University of Washington ERM Structure From University of Washington 2010 ERM Annual Report, p. 10.
www.it-ebooks.info
166 Implementing Enterprise Risk Management
summary information and analyses to the ERM committees. They also provide professional development in a train-the-trainer format.
Compliance, Operations, and Finance Council (COFi)
The COFi Council, led by the Executive Director of Audits, takes a middle-up, cross-functional view of risks and opportunities, particularly items that have university-wide potential impact or where supervisory authority for various aspects of the risk reside in different departments or divisions across the univer- sity. The COFi Council has oversight of risk assessments at the division or func- tional level. It provides approval of methods to monitor risks and identifies topics for outreach, particularly items that have university-wide potential impact or that involve cross-departmental or divisional silos. The six primary goals of the COFi Council are to:
1. Engage in a continual, cross-functional process that results in effective prior- itization of institutional responses to compliance, financial, and operational risks, and consider the impact to strategic and reputational risks.
2. Ensure that the institutional perspective is always present in risk and com- pliance management discussions.
3. Identify strategies to address emerging risks and compliance management issues.
4. Support risk and compliance management training and outreach efforts throughout the university.
5. Provide external auditors and regulators with information about the uni- versity’s risk and compliance programs.
6. Avoid the creation of additional bureaucracy by minimizing redundancy and maximizing resources.
President’s Advisory Committee on ERM (PACERM)
PACERM, cochaired by the Provost and the Senior Vice President for Finance and Facilities, has oversight of risk assessments at the entity level. Taking a top-down view of risks and opportunities, PACERM advises the university president and other senior leaders on the management of risks and opportunities that may signif- icantly impact strategic goals and/or priorities. They review the ERM dashboard (e.g., key risk indicators and key performance indicators). According to V’Ella Warren and Ana Mari Cauce, cochairs of PACERM in 2008–2009, PACERM “is the one place where participants set aside their individual organizational perspectives, and really think about the major risks and opportunities from an institution-wide view” (2009 ERM Annual Report, p. 6).
Internal Audit
Internal Audit provides independent verification and testing of internal controls. The department also provides administrative support and summary information to the COFi Council.
www.it-ebooks.info
LESSONS FROM THE ACADEMY 167
UW President and Provost
The President and Provost play a key role in acknowledging, validating, and sup- porting the ERM program. They verbally refer to key documents such as the ERM framework, PACERM and COFi Council charters and assessments, and the ERM dashboard. They provide entity-level reporting to the Regents.
UW’S ERM MODEL After a careful review of models in the corporate sector and within higher educa- tion, UW settled on the following regarding its ERM model:
� Assess risks in the context of strategic objectives, and identify interrelation of risk factors across the institution, not only by function.
� Cover all types of risk: compliance, financial, operational, and strategic. � Foster a common awareness that allows individuals to focus attention on
risks with strategic impacts. � Enhance and strengthen UW’s culture of compliance while protecting the
decentralized, collaborative, entrepreneurial nature of the institution.
Adopting and Adapting the COSO Model
UW has defined ERM according to its interpretation of the Committee of Spon- soring Organizations (COSO) model, adapting the framework to fit the university environment and the UW in particular (see Exhibit 9.9). COSO describes ERM
University of Washington
Enterprise Risk Management – Integrated Framework
O pe
ra tio
ns
ERM
Process
Risk
Categories
Leadership, Culture, Values
Strategic Goals
Risk / Opportunity Identification
Risk / Opportunity Assessment
A lte
rn a tiv
e s
U n it L
e v e l
D iv
is io
n o
r F u n c tio
n L
e v e l
E n tity
L e v e lResponse
Control Activities
Information & Communication
Monitoring & Measuring
UW E
nv iro
nm en
t
Co m
pl ia
nc e
Fi na
nc ia
l
St ra
te gi
c
M eg
a
Exhibit 9.9 University of Washington’s ERM Integrated Framework From University of Washington Enterprise Risk Management Toolkit, p. 7. Copyright 2007, University of Washington.
www.it-ebooks.info
168 Implementing Enterprise Risk Management
as “a process, effected by an entity’s board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives” (COSO 2004). Adopted in 2009–2010, the 2010 ERM Annual Report notes:
The UW ERM Integrated Framework offers a schema to integrate the views of risk that have historically been addressed in silos or through a fragmented approach. The ERM framework bridges the gap between lower-level issues and upper-level issues, and it allows us to be explicit about the multiple levels on which the ERM process is deployed as a risk and/or opportunity management mechanism. (p. 4)
Risk Categories The top of the cube identifies risk types, including compliance, operations, and financial risks. Strategic risks can impact the mission. Mega risks are major external events over which the institution has no control, but for which the institution can prepare.
UW Environment The right side of the cube views the organizational structure at three levels: entity, which entails all operations and programs; division or function, looking at a major risk in depth; and unit, where individual departments can use the tools to assess their risks. A fourth level of ERM used in the UW environment is to evaluate alternatives.
ERM Process The front of the cube outlines the traditional eight steps from the COSO model, including setting the tone and context for ERM at the top, identifying risks in con- junction with strategic goals, and through the complete cycle with implementation and follow-up.
The report notes:
UW’s “cube” integrates the several ERM facets into a whole, and enables ERM to be applied in a very intentional manner: Starting any new risk assessment requires identifying the appropriate level of the organization or environment at which the assessment will be made; focusing on which set of risks (compliance—strategic— mega risks) to cover; and applying all the steps in the ERM cycle to ensure a com- plete assessment and follow through.
The UW views ERM as integrating risk discussions into strategic deliberations and identifying the interrelation of risk factors across activities. Using the COSO model, its eight-step process involves the following (see Exhibit 9.10):
1. Leadership, culture, and values. Setting the tone at the top. 2. Strategic goals. At the entity or institutional level (top down), the division
or function level (risk topic across shared goals of VPs and deans—”middle up”), the unit level (such as a department, school, or college—bottom up), or the alternatives level (investment alternatives or business options).
www.it-ebooks.info
LESSONS FROM THE ACADEMY 169
ERM PROCESS
Leadership, Culture
and Values Strategic
Goals
Risk
Identification
Risk
Assessment
Controls
Response
Monitoring and
Measuring
Information and
Communication
Exhibit 9.10 University of Washington ERM Process From University of Washington Enterprise Risk Management Toolkit, p. 8. Copyright 2007, the University of Washington.
3. Risk identification. In the appropriate context, name the harm, loss, or com- pliance violation to avoid, as well as the opportunities to be identified. This typically begins with listing broad risk activities or subject areas. Risks can be identified at the entity, division, functional, unit, or alternatives level. This process includes the use of risk statements and opportunity identification.
4. Risk assessment. In the appropriate context, analyze the risk or opportunity in terms of likelihood and impact (see Exhibit 9.11). Create a risk map, rank- ing or prioritizing risks to inform decisions regarding response. For oppor- tunities, rate the likelihood of occurrence on a scale of 1 to 5 (1 = rare, not expected to occur in the next five years; 5 = almost certain, expected to occur more than once per year). Also rank the positive impact, considering what impact the opportunity would have on the institution’s ability to achieve goals or objectives (1 = insignificant, with little or no impact on objectives and no impact to reputation and image; 5 = outstanding, could significantly enhance the capability to meet objectives and could significantly enhance reputation and image).
5. Response. Selecting the appropriate response involves comparing the cost of implementing the option against benefits derived from it. Responses include avoid, mitigate, transfer, or accept the risk. For opportunities, the response can be exploit, enhance, share, or ignore.
6. Controls. Document internal controls for top risks, and rank for effective- ness. For UW, internal controls are narrowly defined to describe the meth- ods used by staff or faculty that help ensure the achievement of goals and objectives, such as policies, procedures, training, and operational and phys- ical barriers.
www.it-ebooks.info
170 Implementing Enterprise Risk Management
IM P
A C
T
Catastrophic - 5 -
Disastrous - 4 -
Serious - 3 -
Minor - 2 -
Insignificant - 1 -
5
4
3
2
1
Rare - 1 -
10
8
6
4
2
Unlikely - 2 -
15
12
9
6
3
Possible - 3 -
20
16
12
8
4
Likely - 4 -
25
20
15
10
5
Almost Certain - 5 -
LIKELIHOOD
Risk Level
Extreme
High
Substantial
Medium
Low
Score Range
19.5 – 25
12.5 – 19.4
9.5 – 12.4
4.5 – 9.4
1 – 4.4
Exhibit 9.11 University of Washington Risk Assessment: Likelihood and Impact From University of Washington Enterprise Risk Management Toolkit, p. 17. Copyright 2007, the University of Washington.
7. Information and communication. Communicate with stakeholders and take action (the transition from analysis to action). Designate a risk owner for each of the top risks.
8. Monitoring and measuring. Monitor performance to confirm achievement of goals and objectives, and monitor risk to track activities that prevent achievement of goals and objectives.
Tools and Techniques
As its ERM program has developed and evolved, UW has learned from its expe- rience and is positioned to share information not only internally, but with oth- ers in higher education as well. The university has developed a comprehensive Enterprise Risk Management Toolkit, copyrighted in 2007, with the second edition released in 2010. The second edition includes an expanded section on the ERM pro- cess and has new material on evaluating opportunities. It is comprised of a manual and a set of spreadsheets that provides a framework for assessing and understand- ing institutional risks. The UW allows access to the Toolkit for UW staff, faculty, and students, federal agencies, Washington State agencies, and other institutions of higher education at no charge through the UW Center for Commercialization Express Licensing Program.
As is typical with most universities, the tools utilized by UW for conducting the risk assessment process are Microsoft Office products. Excel is used to catalog
www.it-ebooks.info
LESSONS FROM THE ACADEMY 171
risk assessment inventories and Word for report writing. While the administrators have explored many options for software to aid in the process (and to potentially provide outcomes such as dashboards), they find that, having been developed in the corporate for-profit environment, none of those options are particularly suited to capturing the needs of the higher education environment. They note, however, that at the unit level, many departments are investing in unit-specific software to aid in their data management. For example, the Finance and Budgeting Office is investigating software to run stress tests and financial simulations, and the Human Resources Office is examining payroll software. This allows the units to be able to more quickly evaluate risk specific to their areas, but UW finds that its ability to aggregate risks for examination at the entity level can be accomplished effectively with its low-tech process.
OUTCOMES AND LESSONS LEARNED UW administrators can chart the evolution of their ERM program and the effec- tiveness it has on the university. They note that the early wins were at the unit level, when specific departments, such as Information Security and Environmental Health and Safety, integrated the ERM process with their well-established strategic planning processes. Those units used the risk assessment tools to identify and rank risks that could hinder or prevent the achievement of their strategic goals. Integra- tion of ERM at the entity level is happening more slowly, but issues that impact everyone at the UW, such as faculty recruitment and retention or responding to the external financial crisis, now can happen in a more integrated fashion as the understanding of ERM evolves. For several years, due to severe budget reductions, the Office of Planning and Budgeting consciously added some questions about risk assessment into the budget request process. Vice presidents and deans were asked to address the impact of budget reductions in terms of risk. This happened, in part, because two key members of the Budget and Planning Office, as well as the Provost, have been involved with the PACERM.
UW administrators have a few other observations about their process and how and why it has worked. First, they note that they were aware from the outset that the environment at UW is highly decentralized and that appointing an “ERM czar” or chief risk officer (CRO) wouldn’t fit with the culture. They made a deliberate choice not to formalize ERM through a senior-level position, but rather to engage in implementation through a committee structure. Second, they involved faculty members from the beginning. This helped with a sense of shared purpose. Faculty members came to see the business side of academia, and staff and administrators better understood the point of view of scholars engaged in teaching and learning. Third, the senior leadership has stayed dedicated to the ERM process, even with transitions in the president and other senior administrators. The 2011 ERM Annual Report points out the benefits to the UW of the ERM approach:
The value of ERM is both qualitative (e.g., risk and opportunity maps) and quanti- tative (e.g., dashboards to contextualize and display metrics). Qualitative benefits accumulate because the risk mapping process allows groups throughout the Uni- versity to collectively prioritize issues, and ensure that the effort and resources involved in root cause analysis, measurement, and monitoring are applied only
www.it-ebooks.info
172 Implementing Enterprise Risk Management
to the most significant concerns. Each iteration of the ERM process results in new capabilities, and insight gained into maintaining the University’s competitive advantage—particularly from managing our financial risks and strategic opportu- nities better than our peers. (p. 5)
UW has been strategic, deliberate, and inclusive as it continues on its journey to develop and enhance its ERM program, learning lessons from what works and adapting new strategies in order to improve or modify its program. ERM began at UW in 2006 “by establishing a collaborative approach and structure to consider broad perspectives in identifying and assessing risk” (2012 Annual Report, p. 3). This strategy has helped UW overcome some of the traditional challenges fac- ing universities when implementing ERM, including addressing concerns about the real effectiveness of risk assessment, getting agreement on definitions of risk assessment impact, identifying risk owners, and moving beyond the “risk discus- sion” to focus on mitigation (2012 Annual Report, p. 3). In her November 2012 pre- sentation on UW’s ERM program to the Pacific Northwest Enterprise Risk Forum, Ann Anderson, Associate VP and Controller, outlined the following seven key lessons that UW has learned by engaging in ERM for almost eight years:
1. Clarify the roles of the various risk committees. 2. Develop a “work plan” for the committees. 3. Develop engaging agendas, focused at the appropriate level. 4. Don’t overemphasize “lowest common denominator” risks. 5. Gather data/information to develop expertise on specific risks. 6. Avoid discussing low-level, narrow risks—too time-consuming! 7. Don’t get into the weeds with implementation and process. Delegate actions
to responsible parties.
WHAT NEXT?: CURRENT PRIORITIES AND FUTURE DIRECTION As the 2010 ERM Annual Report points out, the process of involving people in risk assessments, even with the most well-developed risk assessment tools, is only part of the process. “Successfully maintaining a large-scale organizational initia- tive such as ERM requires a comprehensive, broad based approach that is widely understood and used regularly to clearly articulate where risks and opportunities exist throughout the University” (p. 4). As ERM moves forward at UW, the focus is on a “greater refinement of institutional success metrics, increased assessments of risks identified, and continued expansion across the university to incorporate risk assessment into decision-making and strategic planning” (2012 Annual Report, p. 2). The objectives for 2013–2014 are: (1) strengthen oversight of the top risks and (2) enhance coordination and integration of ERM activities with decision-making processes. Several initiatives will help UW achieve these objectives, including seek- ing input and approval from the PACERM in order to elevate the monitoring of the top risks; a comparison of the institutional-level risks with unit-level risks; the development of quantitative visual representations of the risks, metrics, and tar- gets; engaging the community more broadly in risk management; integrating risk
www.it-ebooks.info
LESSONS FROM THE ACADEMY 173
management with the budget and planning cycle for the university; a retrospec- tive analysis of risks and mitigation investments; and a forward-looking analysis to highlight gaps and areas of concern. They are also in the process of developing specific deliverables and measures as indicators of success, such as executive-level risk registers, dashboards of key risks, and a foundation and structure to integrate risk maps and dashboards with the planning and budgeting cycle.
CONCLUSION UW’s ERM implementation process and lessons learned are consistent with the guidance offered by the National Association of College and University Attorneys (NACUA). In a 2010 conference presentation, NACUA identified the following eight critical success factors:
1. Establish the right vision and realistic plan. 2. Obtain senior leadership buy-in and direction. 3. Align with mission and strategic objectives. 4. Attack silos at the outset. 5. Set objectives and performance indicators. 6. Stay focused on results. 7. Communicate vision and key outcomes. 8. Develop a sustainable process versus a one-time project.
While complex and time-consuming, effective development of a culture- specific ERM program can have positive outcomes for colleges and universities. Institutions such as UW that view ERM as a long-term investment in institutional health, rather than a fad or simply a set of tools (such as spreadsheets and heat maps), position themselves well not only to respond to the external demands from credit ratings agencies, accreditors, and federal regulators, but to situate them- selves to make key strategic decisions, informed by both quantitative and qual- itative data, to enhance their organization, leading to increased enrollment and graduation and strategic disbursement of resources for teaching and research, as well as increasing the likelihood that, due to their integrated, proactive approach, they will avoid future compliance scandals. Perhaps the two most important deliv- erables on UW’s 2013–2014 agenda are those that demonstrate its awareness of the importance of the human resources component in its collegial environment: outreach to faculty and other administrators to obtain broader validation of risks and to identify additional mitigation activities, and an iterative process to involve senior leaders, the Provost, the President, and the Regents in monitoring the top risks. Through this process, UW is building a culture not only of compliance, but of shared responsibility for the future health of the university.
QUESTIONS 1. How does ERM adoption and implementation in the higher education environment
differ from the for-profit environment? 2. What type of culture is at the University of Washington? Why is culture important to
consider when implementing ERM?
www.it-ebooks.info
174 Implementing Enterprise Risk Management
3. What were some of the key factors in the early stages of UW’s ERM adoption and imple- mentation that led to its current success within the organization?
4. Why did UW decide to adopt a committee structure to administer its ERM program rather than designate a senior level Chief Risk Officer?
5. Who are some of the key players involved in the decision-making about the ERM model and its current administration?
NOTES 1. Many colleges and universities were affected by Hurricane Katrina in the New Orleans
area (see the American Association of University Professors [AAUP] Special Commit- tee Report on Hurricane Katrina and New Orleans Universities at https://portfolio .du.edu/downloadItem/92556). The independent report by Louis Freeh and his law firm, Freeh Sporkin & Sullivan, LLP, documents the facts and circumstances of the actions of Pennsylvania State University surrounding the child abuse committed by a former employee, Gerald A. Sandusky (available at http://progress.psu.edu/the- freeh-report). The AAUP’s Committee on College and University Governance reported on breakdowns in governance at the University of Virginia as the board attempted to remove president Sullivan (www.aaup.org/report/college- and-university-governance-university-virginia-governing-board). American Univer- sity trustees removed then president Ladner in 2005 after investigation of expense abuses of university funds (http://usatoday30.usatoday.com/news/education/2005- 10-11-au-president_x.htm). The most tragic of these situations was, of course, the shoot- ings at Virginia Tech on April 16, 2007. On December 9, 2010, the U.S. Department of Education issued a final ruling that Virginia Tech had violated the Clery Act by fail- ing to issue a “timely warning” to students and other members of the campus commu- nity following the initial shootings early on the morning of April 16, 2007. In comment- ing on the verdict, Stetson Professor of Law Peter Lake stated, “Higher education is under the microscope now. The accountability level has definitely changed” (S. Lipka, “Jury Holds Virginia Tech Accountable for Students’ Deaths, Raising Expectations at Colleges,” Chronicle of Higher Education, March 14, 2010).
2. In order to disperse federal financial aid and grant degrees, institutions in the United States are accredited by one of several accrediting bodies. One example of the way in which accreditors are emphasizing risk management in their review is the Southern Association of Colleges and Schools Commission on Colleges (SACS COC) (www.sacscoc.org/) Standard 3.10.4: The institution demonstrates control over all of its physical and financial resources. The University of Virginia demonstrates evidence of this standard on its website by articulating the organizational structure and inte- grated policies and procedures related to internal and external audit, internal controls, fixed assets, procurement, facilities management, and risk management, among others (www.virginia.edu/sacs/standards/3-10-4.html).
3. The recent Special Comment by Moody’s, “Governance and Management: The Under- pinnings of University Credit Ratings,” declares that “governance and management assessments often account for a notch or more in the final rating outcome compared with the rating that would be indicated by purely quantitative ratio analysis” (Kedem 2010, p. 1). In Moody’s consideration of five broad factors that contribute to its eval- uation of governance and management, the report cites “oversight and disclosure processes that reduce risk and enhance operational effectiveness” (p. 2). The report further notes: “Effective internal controls and timely external disclosure about stu- dent outcomes, research productivity, financial performance, and organizational effi- ciency will become the hallmark of effective university leadership and will become
www.it-ebooks.info
LESSONS FROM THE ACADEMY 175
increasingly critical in mitigating new risks to individual universities and the sector overall” (p. 3).
4. One significant area of change has been the Internal Revenue Service’s increased over- sight of compliance issues affecting tax-exempt entities, including colleges and univer- sities. In 2008, under prompting by members of the U.S. Senate Finance Committee, the IRS developed a 33-page compliance questionnaire (IRS Form 14018) and sent it to a cross section of 400 institutions of higher education. The form focused on a number of potentially sensitive subjects, including the types and amounts of executive compen- sation, the investment and use of endowment funds, and the relationship between an institution’s exempt activities and other taxable business activities. The IRS also revised its Form 990, “Return of Organization Exempt from Income Tax,” beginning with the 2008 tax year. The purpose of the changes is to increase the transparency and account- ability of tax-exempt organizations and to ensure compliance with the Internal Revenue Code by requiring more detailed information in several categories. The changes focus not only on revenue, investment, and spending issues, but also on governance, conflicts of interest, and whistle-blower policies and procedures.
5. Based on a March 13, 2012, phone interview. 6. The Higher Education Act, up for renewal again in 2014, is a law almost 50 years old
that governs the nation’s student-aid programs and federal aid to colleges. It was signed into law in 1965 as part of President Johnson’s Great Society agenda of domestic pro- grams, and it has been reauthorized nine times since then, most recently in 2008. Addi- tional examples at the federal level include Section 504 of the Rehabilitation Act of 1973, the Americans with Disabilities Act (ADA) (1990), Family Educational Rights and Pri- vacy Act (FERPA) (1974, 1998, 2009), Health Insurance Portability and Accountability Act (HIPAA) (1996), Clery Act (1990), and Campus Sex Crimes Prevention Act (2000), among others. Lawsuits brought against institutions of higher education in which they and/or certain administrators at those institutions are accused of violating a particular federal law or a related legal right can lead to case decisions that impact that institution and perhaps others. Lawsuits can also have a significant impact even if they result in a settlement rather than a court decision. In May 2006, a group of 12 current and former deaf students at Utah State University sued the institution in U.S. District Court alleg- ing that it had violated the Rehabilitation Act and the ADA by failing to provide enough fully qualified interpreters. The lawsuit also named the Utah State Board of Regents as defendants. After negotiations, the lawsuit was settled in April 2007 with the univer- sity agreeing to hire qualified, full-time interpreters at a ratio of one translator for every two deaf students. The lawsuit, the issues it raised, and its ultimate resolution received significant media attention, as well as attention from various organizations around the country promoting the interests of students who are deaf or have hearing deficiencies.
7. Mitroff, Diamond, and Alpaslan (2006) note that “colleges and universities are in the very early stages of establishing their crisis management programs, and much remains to be done. The recent experience in New Orleans and elsewhere suggests that develop- ing and maintaining a well-functioning crisis management program is an operational imperative for college and university leaders” (p. 67).
8. One of those administrators was Elizabeth Cherry, Director of Risk Management, from the University of Washington (UW). As will be discussed in the case study, the UW was embroiled in several high-profile risk situations at the time and was undergoing the first of several presidential transitions.
9. See A. P. Liebenberg and R. E. Hoyt, “The Determinants of Enterprise Risk Management: Evidence from the Appointment of Chief Risk Officers,” Risk Management and Insurance Review 6:1 (2003): 37–52. Their study uses a logistic model to examine the characteristics of firms that adopt ERM programs, most of which signal the fact that they have an ERM program through the hiring of a CRO.
www.it-ebooks.info
176 Implementing Enterprise Risk Management
10. Many thanks to Andrew Faris, Enterprise Risk Management Analyst at the Uni- versity of Washington, and Kerry Kahl, ERM Project Manager at UW. They pro- vided information via an interview in April 2012 that is incorporated throughout this case study. Additional information for the case study comes from Annual Reports, memos, and other documents found on the University of Washington ERM website: http://f2.washington.edu/fm/erm.
REFERENCES Abraham, Janice. 2013. Risk Management: An Accountability Guide for University and College
Boards. Washington, DC: Association of Governing Boards of Universities and Colleges and United Educators.
American Society of Mechanical Engineers–Innovative Technologies Institute, LLC. 2010. A Risk Analysis Standard for Natural and Man-Made Hazards to Higher Education Institutions. Washington, DC: American National Standards Institute.
Arena, M., M. Arnaboldi, and G. Azzone. 2010. “The Organizational Dynamics of Enterprise Risk Management.” Accounting, Organizations and Society 35:7, 659–675.
Association of Governing Boards of Universities and Colleges and United Educators. 2009. The State of Enterprise Risk Management at Colleges and Universities Today. Available at www.agb.org.
Barnds, W. Kent. 2011. “The Risky Business of the Strategic Planning Process.” University Business. Available at www.universitybusiness.com/article/risky-business-strategic- planning-process.
Birnbaum, Robert. 1988. How Colleges Work: The Cybernetics of Academic Organization and Lead- ership. San Francisco: Jossey-Bass.
Bolman, Lee G., and Terrence E. Deal. 2008. Reframing Organizations: Artistry, Choice and Leadership. San Francisco: Jossey-Bass.
Bush, Tony. 2011. Theories of Educational Leadership and Management (4th ed.). London: Sage Publications.
Cassidy, D. L., L. L. Goldstein, S. L. Johnson, J. A. Mattie, and J. E. Morley Jr. 2001. “Devel- oping a Strategy to Manage Enterprisewide Risk in Higher Education.” National Asso- ciation of College and University Business Officers and PricewaterhouseCoopers. Avail- able at www.nacubo.org/documents/business_topics/PWC_Enterprisewide_Risk_in_ Higher_Educ_2003.pdf.
Chan, Sharon Pian. 2004. “UW Failed to Address Overbilling, Probe Finds.” Seattle Times, May 1, 2004. Available at http://seattletimes.com/html/localnews/2001917467_ uwmed01m.html.
Chang, Jean. 2012. Skype interview, March 2. Committee of Sponsoring Organizations of the Treadway Commission. 2004. Enterprise
Risk Management—Integrated Framework. Available at www.idkk.gov.tr/html/themes/ bumko/dosyalar/yayin-dokuman/COSOERM.pdf.
Committee of Sponsoring Organizations of the Treadway Commission. 2011. Internal Control—Integrated Framework. Available at www.coso.org/documents/coso_framework _body_v6.pdf.
Freeh, Sporkin & Sullivan, LLP. 2012. “Report of the Special Investigative Counsel Regard- ing the Actions of the Pennsylvania State University to Related the Child Sexual Abuse Committed by Gerald A. Sandusky,” July 12. Available at http://progress.psu.edu/the- freeh-report.
Gallagher Higher Education Practice. 2009. “Road to Implementation: Enterprise Risk Management for Colleges and Universities.” Arthur Gallagher & Co. Available at www.nacua.org/documents/ERM_Report_GallagherSep09.pdf.
www.it-ebooks.info
LESSONS FROM THE ACADEMY 177
Grant Thornton LLP. 2011. “Best-Practice Tips for Boards, Presidents and Chancel- lors Regarding Enterprise Risk Management.” OnCourse, January. Retrieved from www.grantthornton.com/staticfiles/GTCom/Not-for-profit%20organizations/ On%20Course/On%20Course%20-%20Jan%2011%20-%20FINAL.pdf.
Grasgreen, Allie. 2013. “Report Shows How Rutgers Botched Handling of Former Coach, Reiterates 5-year-old Recommendations to Improve Athletics.” Inside Higher Education. Available at www.insidehighered.com/news/2013/07/23/report-shows-how-rutgers- botched-handling-former-coach-reiterates-5-year-old.
Gurevitz, Susan. 2009. “Manageable Risk.” University Business. Available at www.university business.com/article/manageable-risk.
Helsloot, I., and W. Jong. 2006. “Risk Management in Higher Education and Research in the Netherlands.” Journal of Contingencies and Crisis Management 14:3.
Huber, C. 2009. “Risks and Risk-Based Regulation in Higher Education Institutions.” Ter- tiary Education and Management 15:2.
Kedem, K. 2010. “Special Comment: Governance and Management: The Underpinnings of University Credit Ratings.” Moody’s Investors Service, Report 128850.
Mitroff, I. I., M. A. Diamond, and M. C. Alpaslan. 2006. “How Prepared Are America’s Colleges and Universities for Major Crises?: Assessing the State of Crisis Management.” Change 38:1, 61–67.
National Association of College and University Business Officers and the Association of Governing Boards of Universities and Colleges. 2007. “Meeting the Challenges of Enter- prise Risk Management in Higher Education.” Available at www.ucop.edu/riskmgt/ erm/documents/agb_nacubo_hied.pdf.
Nelson, John. 2012. Phone interview, March 13. Stripling, Jack. 2012. “Penn State Trustees Were Blind to Risk, Just Like Many Boards.”
Chronicle of Higher Education, July 12. Available at http://chronicle.com/article/Penn- State-Trustees-Were-Blind/132943/.
Tertiary Education Quality Standards Agency. 2013. Available at www.teqsa.gov.au/ Tufano, Peter. 2011. “Managing Risk in Higher Education.” Forum Futures. Available at
http://net.educause.edu/ir/library/pdf/ff1109s.pdf. University Risk Management and Insurance Association. 2007. “ERM in Higher Education.”
Available at www.urmia.org/library/docs/reports/URMIA_ERM_White_Paper.pdf. Whitfield, R. N. 2003. “Managing Institutional Risks: A Framework.” Doctoral dissertation.
Retrieved from ProQuest Dissertation and Theses database, AAT 3089860. Willson, C., R. Negoi, and A. Bhatnagar. 2010. “University Risk Management.” Internal Audi-
tor 67:4, 65–68. Wilson, Richard. 2013. “Managing Risk.” Inside Higher Education, May 20. Available at
www.insidehighered.com/blogs/alma-mater/managing-risk.
ABOUT THE CONTRIBUTOR Anne E. Lundquist has had 20 years of increasing administrative responsibilities in higher education, having served as the dean of students at four liberal arts colleges. She received a BA in religious studies from Albion College and an MFA in creative writing from Western Michigan University. Currently, she is a PhD candidate in the Educational Leadership program at Western Michigan University with a con- centration in higher education administration, where she works with the vice pres- ident of student affairs on student affairs assessment and strategic planning and with the internal auditor and University Strategic Planning Committee on ERM implementation. Her dissertation research study is titled “Enterprise Risk Man- agement (ERM) in Colleges and Universities: Administration Processes Regarding
www.it-ebooks.info
178 Implementing Enterprise Risk Management
the Adoption, Implementation and Integration of ERM.” Using her expertise in several areas, she has presented and been the author of articles on risk manage- ment, institutional liability, students with psychiatric disabilities, assessment and strategic planning, intercultural competence, and the development and implemen- tation of integrated community standards/restorative justice judicial models. She is the coauthor of The Student Affairs Handbook: Translating Legal Principles into Effec- tive Policies (LRP Publications, 2007). She has had three recent risk management publications in peer-reviewed journals: URMIA Journal (2011, 2012) and New Direc- tions for Higher Education, Special Issue, Disability and Higher Education (with Allan Shackelford, July 2011).
Special thanks to Andrew Faris, Enterprise Risk Management Analyst at the University of Washington, for sharing information about the university’s ERM pro- cess, answering questions, and providing material for the case study.
www.it-ebooks.info
