Meeting the Challenges of Enterprise Risk Management in Higher Education

enterprise risk management (ERM) in Washington DC with senior officers and trustees from several leading colleges and universities. Approximately 40 leaders—representing large and small as well as public and private institutions—attended the event. (For a list of attendees, see page xx). The summit opened with a presentation on implementing ERM in the for-profit financial services industry. The next morning the group heard four perspectives on risk management from a trustee, a chief risk officer (CRO), a president (CEO), and a chief business officer (CFO). After that, the group worked as a whole to develop a higher-education-specific model. The objectives of the summit were to begin to develop a robust, sustainable ERM model for colleges and universities, and to identify the appropriate ERM roles for presidents, CFOs and other senior managers, and trustees from large and small, public and private institutions. generously supported the summit. NACUBO and AGB are grateful for this support, which allowed the associations to make progress in development of an ERM model for higher education. Risk can be defined as any issue that impacts an institution's ability to meet its objectives. The Committee of Sponsoring Organizations, known as COSO, 1 defines enterprise risk management (ERM) as: " …a process, effected by an entity's board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives. " 2 Several words in COSO's definition are highlighted for emphasis: process, strategy, risk appetite, and objectives. ERM is a continuing process that aligns with strategy and changes as the institution's activities and objectives evolve. Risk appetite is defined as management's view of how much risk an institution is prepared to accept in order to achieve its objectives. Like investors, some institutions are more comfortable with risk than others. ERM focuses on an institution's achievement of its objectives or mission in the following four areas: 1. Strategic – high-level goals that are aligned with and support the institution's mission 2. Operational – ongoing management process 3. Financial – protection of institution's assets 4. Compliance – the institution's adherence to applicable laws and regulations Reputational risk is often included as a critical higher education risk. Summit participants agreed that a serious event in the above listed categories can cause reputational risks. …