Define risk. TO AN INVESTOR WHO'S NOT SQUEAMISH, RISK MIGHT BE putting money into the commodities market, where prices go up and down on a daily basis. To a gambler at a blackjack table who's down to only a small pile of chips but has a big pot staring him in the face, risk could mean asking for another card when he's showing 17. Staying at 17 would be a very low-risk move on that particular hand, but it could mean losing more money overall.
To a college or university risk manager, identifying the major risks that might lurk around campus--such as a broken sprinkler system in a residence hall--and then fixing them protects the school from costly claims, thereby mitigating the risks.
This is the way a steering committee at Emory University in Atlanta defined risk in its planning stage at the launch of the university's enterprise risk management (ERM) development program in 2006: "Risk, in one form or another, is present in virtually all worthwhile endeavors. We recognize that not all risk is bad and our goal is not to eliminate all risk, for by doing so we would cease all productive activity. Rather, our goal is to assume risk judiciously, mitigate it when possible, and prepare ourselves to respond effectively and efficiently when necessary."
Shulamith Klein, senior director for the office of risk and insurance services of Emory University and Emory Healthcare, says that the underlying premise to the institution's ERM process was a heartening jumping-off point for the 10-member committee. "The composition of the steering committee was the key to our salvation. The individuals had a very good handle on their respective areas of risk responsibility." The group's camaraderie is strong, and their meetings have become a "safe zone," she adds. "There's nothing we can't discuss in a healthy, open, and meaningful way."
That's how Emory started its ERM program, which identified more than 550 risks during the first risk assessment go-round. As the steering committee refined that list, the number of risks dropped to 141. That was still too cumbersome, so they further shaved the list to the top 50 risks, based upon a frequency and severity analysis. That's a much more manageable number of risks to monitor.
Know Your ERMs
There are probably dozens of definitions of ERM, some much more jargon-filled than others, depending on whom you ask.
In a white paper on ERM published in 2003, a definition by former university risk manager Leta Finch contains the important concepts that still underlie the most successful higher education ERM programs. Finch, now executive director of the Higher Education Practice Group at A.J. Gallagher Risk Management Services, wrote that "ERM expands upon traditional risk management practices by taking a holistic, comprehensive, organization-wide approach towards managing risks." That reflects the paths higher ed institutions follow when implementing an ERM process.
But today, any U.S. college or university that hasn't already instituted some version of ERM is sure doing it now. The plunging economy has steamrolled through campuses, reducing already shaky budgets, decimating endowments, and making it difficult, at best, for schools m impose their usual annual tuition hikes. Recent reports have surfaced that question why the highly touted ERM programs haven't protected schools from having to lay off employees, scuttle programs, and raise tuitions. "I don't think it's possible to have a failsafe solid wall that protects us from every risk," says Klein.
While some institutional risk managers understand ERM'S strengths, others believe it's just too complicated, or they just don't want to be bothered. After all, isn't that what insurance is for?
About a year ago, during a break at the Risk and Insurance Management Society's annual conference, a group of university risk managers were discussing common problems. …