Risk Management Policy

Risks that affect the ability to carry out goals and objectives.

Risks that affect compliance with laws and regulations and student, faculty, staff & visitor safety, such as environmental issues, litigation, conflicts of interest, and privacy.

Risks that affect the University’s reputation.

Risks that affect the loss of or ability to acquire assets or technology.

Risks that affect on-going management processes and procedures.

Risks that affect the ongoing operation of the University either by man-made, natural or other negative occurring events.

The Board of Trustees provides risk oversight and appetite. In order to support the board in this regard, its members are kept informed of IRM’s regular and repeatable processes designed to manage institutional risk within our risk criteria and to provide reasonable assurance regarding achievement of university objectives. The Board of Trustees should be certain that it is properly informed and that an appropriate culture of risk-awareness exists throughout the institution.

The IRM Steering Committee is comprised of the Provost, the Vice Chancellor for Finance and Administration, the Vice Chancellor for Information Technology Services, the Director of Internal Audit and advised by General Counsel. The IRM Officer and other staff will provide support to the committee as required. The IRM Steering Committee meets as needed and is charged with guiding the advancement of Institutional Risk Management, providing its programs and the IRM Committee with direction and assessing ongoing performance. Minutes of IRM Steering Committee meetings will be approved and archived. The IRM Steering Committee reviews and approves IRM presentations to the Compliance, Audit, Risk Management, and Legal Affairs (CARL) Committee of the Board of Trustees and assists in the evaluation of any comments or questions the Board may have. The IRM Steering Committee assesses progress toward optimal risk treatment of identified institutional risks and recommends changes in course as needed.

The IRM Committee meets at least quarterly, and members are the Vice Chancellor for Student Affairs designee, the Vice Chancellor for Information Technology Services designee, the University Controller, the Director of Environment, Health and Safety, the Chief of University Police, the Assistant Athletic Director of Operations, the Vice Chancellor for Research and Engagement designee, other members as needed, to be determined by the IRM Committee membership, and advised by the General Counsel designee. Through various work groups, committee members actively work on Tier I risks as well as associated risk treatments. The IRM Committee has the additional responsibility for providing a common-sense framework within which to scan the university’s environment to identify risk as an integral part of all organizational processes. Minutes of IRM Committee meetings will be approved and archived.

The IRM Officer provides university-wide leadership to identify and manage possible strategic, financial, operational, compliance, hazard or reputational risks. The IRM Officer develops the Institutional Risk Management Program for the university, applying best practices, the standards mentioned above and other industry guidance. In order to foster a risk management culture, the IRM Officer is available for consultation and discussion relative to issues of institutional risk as well as forwarding those issues to appropriate leadership.

The IRM Officer chairs the Institutional Risk Management Committee and works with committee members to identify items for meeting inclusion. The IRM Officer works with the IRM Committee and Executive sponsors to collaborate on a holistic approach to evaluate university risks and select optimal risk treatments.

The IRM Officer promotes risk awareness programs throughout all sectors of the university and provides support to university leadership in defining, maintaining, and educating university stakeholders through the development or procurement of best-practice-related or instructional literature.

Chancellor’s Council member or designee assigned to each Tier I risk are empowered to collaborate cross divisionally and guide the work involved in managing associated risks. Executive Sponsors have the authority to manage risks as well as the commitment to make the necessary resources available to assist those accountable and responsible for risk treatment. Executive Sponsors may find it advisable on occasion, due to the potential for (or the appearance of) a conflict of interest, to seek guidance from the IRM Steering Committee through the IRM Officer with regard to assessment and risk treatment.

Risk Identification is accomplished through committee discussion, unit risk assessment, periodic stakeholder interviews, education and outreach throughout the institution on a regular basis. Unit Risk Assessment is a process intended to identify individual risks based on likelihood of occurrence and potential institutional impact should they occur. Departments, programs or activities are chosen for assessment based on a number of factors including the number and complexity of risks involved, the interdependence of different risks and their sources, the degree to which the unit’s risks impact the institution as a whole. Strategically critical units should be assessed every three years at minimum.

Risk Analysis is performed on qualitative and quantitative data derived from risk assessments, stakeholder interviews, relevant external events and UNCG’s risk events and near-misses. Risk analysis should result in robust indicators that provide adequate data to recognize shifts in internal and industry risk patterns when they are most valuable, during the development phases of important strategic initiatives.

Risk Evaluation is intended to inform decision-making regarding risk treatment and employs the results of risk analysis. This is primarily accomplished through periodic comparison of current risk ratings with previous ones as well as looking at actual losses in context. Further analysis is often deemed necessary before risk treatment decisions can be made. The IRM office is charged with reviewing best practices and application of said practices in evaluation of Risk.

Risk Treatment emphasizes continual improvement through the use of appropriate measures to modify risk exposure and the review and subsequent modification of processes, systems and resources. It is a cyclical process involving the formulation of treatment measures, the evaluation of their efficacy, the generation of new measures as necessary and the subsequent assessment of the new measures. Risk Treatment Planning is undertaken at regular intervals for all Tier I Risk Areas. “Selecting the most appropriate risk treatment option involves balancing the costs and efforts of implementation against the benefits derived, with regard to legal, regulatory, and other requirements such as social responsibility and the protection of the environment. Decisions should also take into account risks which can warrant risk treatment that is not justifiable on economic grounds, e.g. severe consequence but extremely unlikely risks.” – ISO 31000