What keeps you up at night? While the immediate top-of-mind response to that question may vary widely among chief business officers, the answer centers on the ever-present risk management concerns, such as an international incident involving students, a cybersecurity threat, or a costly compliance breach.
The University Risk Management and Insurance Association (URMIA) risk inventory identifies 23 separate categories—from athletics to intellectual property to public safety—that may present a risk to an institution in a variety of ways, including strategic, operational, or reputational. While the list of highest-level concerns is largely similar across all institution types, the particular nuance of those concerns will vary from one college or university to another based on various factors, including institution mission.
No matter the threat, the job of an institution risk manager is to mitigate the potential adverse impacts of a program or activity, according to presenters of the session “Hot Topics in Risk Management That the CFO Needs to Know,” who spoke at the NACUBO 2018 Annual Meeting.
Identify risk. According to Luke Figora, Northwestern University’s associate vice president for risk management and environmental health and safety, topping the list of concerns for his senior vice president and CFO are HIPAA compliance and data security breaches, concussions and potential litigation and liability surrounding brain injuries, and student mental health.
To address these ongoing concerns, Northwestern has developed an extensive concussion management program that includes baseline testing for all athletes that is repeated in a student’s third and fifth years, a traumatic brain injury specialist athletic trainer on staff dedicated solely to this issue, a concussion care team, and concussion education requirements and protocols that extend to university club and intramural sports.
Communicate risk. Enrollment ranks as No. 4 on a list of top concerns at Nebraska Wesleyan University, according to Tish Gade-Jones, vice president for finance and administration. The institution’s proactive approach to maintaining healthy enrollment numbers includes developing a mission-driven admissions team with a focus on early recruitment, structuring meaningful first-year experiences for students, strengthening partnerships with community colleges, and developing themed campus visits for prospective students based on their curricular interests in art, nursing, and so forth.
That said, even when your institution is strategically focused on maintaining enrollment as a core priority, any possibility for lasting reputational risk that would counter those efforts rises to the top. Such a possibility for reputational risk was underscored in October 2017, when a gas leak that occurred off campus led to panic and misinformation across campus. This incident highlighted the risk of not having a focused communication response plan.
From a fire alarm going off in the library to helicopters flying over campus, ad hoc social media chatter exacerbated rather than calmed concerns. In the aftermath of that particular incident, the university instituted changes to (1) ensure that one point person was responsible for communicating with police and first responders, (2) designate an official text message system for university communications, and (3) better train students on social media use related to campus activity.
Prioritize risk. For Cheryl Lloyd, the University of California System’s associate vice president and chief risk officer, deferred maintenance and capital renewal are among her top concerns, based in part on polling CBOs from the 10 campuses and five medical centers that comprise the UC System. Left unaddressed, festering deferred maintenance issues spread across such a large portfolio can carry a huge risk related to workers’ compensation, not to mention reputational risk and risk to ratings from financial agencies that would only exacerbate the ability of the institution to secure ongoing funding.
To stay on top of these issues, UC created its Integrated Concept and Implementation Plan (ICAMP) to inventory and rank the system’s deferred maintenance priorities. The plan will help provide granular detail for each building on each campus to capture the backlog of architectural, electrical, and mechanical needs, while assessing the priority of projects based on a building’s use and importance to mission.
The software program UC is using to develop its plan will provide a fair, credible, and justifiable way to prioritize projects based on urgency on each campus and across all campuses. For instance, issues can be flagged for immediate replacement or replacement in one to three years, or three to five years. A mobile app synced with the system’s facility and space database allows for continual updating of information. While mapping the entire system will take some time, Lloyd says that, in the end, this building-by-building snapshot will greatly enhance the system’s ability to keep its deferred maintenance risk in check.
KARLA HIGNITE, Fort Walton Beach, Fla., is a contributing editor for Business Officer.
