Enterprise Risk Management

The immediate impacts of COVID-19 have surfaced enterprise risk management needs across colleges and universities. To date, university leaders and boards have largely been focused on decisions that help to ensure the safety of their campus populations and the continuity of their missions during social distancing requirements for the pandemic.

Rather than creating crisis-specific capabilities with limited shelf lives, leading institutions are now leveraging this experience to implement, refine and expand models that support improved risk assessment, aligning with risk mitigation and decision making.

Huron has outlined a framework for higher education’s evolution through this pandemic and economic uncertainty. At this point, colleges and universities are mostly implementing measures to ensure stabilization while beginning to explore opportunities for fundamental transformation.

Effective enterprise risk management involves the comprehensive evaluation of interconnected risks across an institution. As universities have worked to stabilize their operations, one major decision has underscored the complexity of these intertwined strategic, reputational and financial risks — whether and when to reopen on-campus operations. Reopening campuses has required careful evaluation of the risks and execution of mitigation activities — particularly how to determine who can safely return to campus and whether to limit the capacity or operations of residence halls, classrooms and other high-capacity facilities. Leaders have shown this process weighing how and when to hold in-person educational experiences is difficult and not necessarily a decision that can be final, largely due to contagion counts and governmental announcements. With vaccinations still on the horizon and case counts surprising some regions, this evaluation will likely continue for the foreseeable future.

A critical question has been which campus constituents can return. At many universities, high numbers of faculty and staff fall into the high-risk age group of those 60 and older, while others, including students, are immunosuppressed or otherwise more susceptible to the virus. Resistance from these groups concerned with protecting their own health has understandably emerged as a strong response countering the desire of many to return to on-campus work and study. Some leaders have attempted a phased approach by first allowing lower-risk groups to return to campus. But with this hybrid approach comes expensive logistical challenges for many campus operations, including the delivery of curriculum to students in person and virtually.

Due to the risk associated with high-density occupancy, a specific area of focus will continue to be on-campus housing. As residence halls reopen, some institutions have implemented reduced occupancy rates in some buildings, despite the associated operating and debt service expenses. At such campuses that have determined opening is their best option for delivery on their value proposition, residence life leaders have undergone training to identify students with potential COVID-19 symptoms and respond quickly to limit rapid transmission. Contact tracing and strict attention to maintaining social distancing and hygiene practices are part of the elaborate plans being implemented and evaluated real-time. Beyond residential environments, other high-occupancy facilities (e.g., classrooms, student unions and recreational centers) have presented schools with similar challenges. Evaluating potential legal liability and modeling the financial impact of various scenarios that may continue to be required as experience dictates will need to inform all of the reopening/remote critical decisions.

While many institutions have established university-wide programs to assess, manage and mitigate risks over the last 15 years, and some leading institutions have even established chief risk officers, others have siloed approaches that are not linked to the broader enterprise strategy, mission and risk mitigation. To ensure the viability of their institutions, a fully integrated and resilient risk management program should become a priority.

The pandemic response has shed light on the financial, strategic, operational, reputational and compliance threats that interact in ways that increase organizational risk beyond the boundaries defined by traditional (and sometimes siloed) units. As institutions begin to move beyond mere stabilization, high-priority activities will likely include the expansion of emergency management and incident response, development of more mature risk assessment, monitoring and mitigation plans, and increased attention to internal control activities across all risk areas.

A critical outcome for institutions in the transformation phase will be to use momentum from their crisis responses to strengthen the foundation, framework and strategy for enterprise risk management, including formal resilience principles. Successful implementation will require sustained mobilization and leadership alignment, continued engagement and communication with key operational owners, and assessment of organizational processes to ensure risk becomes an integral part of operations. As institutions consider proactively enhancing their risk frameworks to prepare for the next unknown emergency or known vulnerability, the transformation of the program should remain aligned with the institutional mission, vision and values.

Access other educational resources on our COVID-19 resource page. For more information, contact us.