University Business - May 2009 - (Page 41)

Because reputational risk is also a major concern for universities (think Virginia Tech), any disastrous event in any of the above categories could seriously affect a school’s reputation. The first official framework, and the first bona fide, broad-based introduction of ERM, arrived in 2004 when the Committee of Sponsoring Organizations of the Treadway Commission (COSO) expanded on an earlier report on internal controls. But the report, “Enterprise Risk Management—Integrated Framework” (with its 16-page executive summary), features a graphic of a threedimensional colored box that is overwhelming by itself and is ‘ERM is crucial to be able to nimbly operate in clearly designed for corporations, not higher education. COSO’s model contains eight components: internal en- times like this.’ vironment, objective setting, event identification, risk assess—Richard Denning, Shelter Island Risk Services ment, risk response, control activities, information and communication, and monitoring. The report concedes that the “components will not function identically in every entity.” That ably made other risk managers, who figured ERM would quietly go alone has scared off a lot of university risk managers, even though away, feel guilty). Other institutions, such as Cornell, have simply they might want to incorporate some components in their own pro- instituted the ERM philosophy, or expanded their current risk management programs. They may not call them ERM, though. grams, using different terminology. The traditional silo culture in higher ed nurtures innovation, creIt seems so complicated to so many, especially for comprehensive and liberal arts colleges, Abraham explains. “The large research uni- ativity, and academic freedom, making the culture change required versities are much further ahead. All are adapting ERM to their by ERM a slow, uphill battle—despite efforts in recent years to dispecific uses, and no one is following a cookie cutter approach, which minish silos. ERM essentially requires co-opting people from across is something we encourage. It needs to be a tool that can be integrat- campus. “You’re asking these same people to co-exist with the ERM ed into their regular planning, either annual planning or strategic,” philosophy,” says Allen Bova, director of risk at Cornell. Of course, universities could not exist without their committees. she says. “Otherwise, we believe that if ERM is simply a new process, one of the ‘idea du jour’ concepts, then it will be dropped when the Implementing a holistic risk management program is no different. internal champion moves on.” According to United Educators, 29 Once the VPs, deans, and department heads are schooled on ERM’s research institutions of all sizes have implemented ERM programs advantages, they pass along this message to their staff and faculty, who then discuss through committees what kinds of risks exist in (see the online version of this story for the list). Within the past few years, administrators and boards (frequently their individual departments and come up with ideas on how to mitmade up of businesspeople whose companies have adopted ERM igate those risks. In some cases, as the committee at Emory knows, principles) have begun to embrace some of the ERM ideologies. the initial list of risks can be overwhelmingly long. The Emory comEmory’s president, Jim Wagner, an engineer by trade, was attracted mittee pared it down to the top 50 based upon a frequency and severity analysis done with the input of executive leadership. by ERM’s systematic approach, for example. universitybusiness.com May 2009 | 41 And when Steve Golding arrived at Cornell University in 2005 as executive vice president for finance and administration, he found the same standard structure typical of large, research universities, which are highly decentralized. “There was no overarching philosophy, how to manage the institution holistically, without changing the decentralized nature of the institution,” he says. Although risk identification was an ongoing process, “it had holes in the institutional level,” and he wanted the university to look at its risk management process holistically. “We’re making progress, but we still have a long way to go,” he admits. Golding points to Duke University, the University of Pennsylvania, and the University of Rochester—all major research universities with medical schools. “The plan has to be tailored to the unique nature of the institution,” he says. The primary issue is how to pick and choose the risk management components of ERM that can be appropriately applied to your institution. Golding describes Cornell’s overarching philosophy on institutional risk management (as ERM is known there) in this way: determining how the institution thinks about risk; creating the processes that hold people accountable; developing strategies and processes that identify the higher levels of risk; making sure the institution is taking actions to control risk; and having someone who takes the lead. In other words, hundreds of people are responsible for thinking about risk, from vice presidents and deans down to the people with functional responsibilities, such as the university police. As with any structure, there are the purists who were early ERM adaptors (most from the corporate world) and have since become regular speakers for the cause at university conferences (they prob- http://www.universitybusiness.com

Table of Contents for the Digital Edition of University Business - May 2009

University Business - May 2009
Contents
Editor's Note
College Index
Company Index
Advisory Board
Behind the News
Sense of Place
Money Matters
Viewpoint
Human Resources
Setting the Standard
Manageable Risk
Five Steps to a Powerful Social Networking Strategy
Higher Ed in the Recession
Community Colleges
What's New
End Note

University Business - May 2009