URMIA Resource Update - ERM

Join host Julie Groves, URMIA’s current president and host of URMIA Matters, as she interviews guests Saumya Khanduja, Assistant Director of Institutional Risk Management at the Massachusetts Institute of Technology; Gary Langsdale, Retired Education Manager at URMIA; Sue Liden, URMIA’s Education Manager; and Tim Wiseman, Chief Risk Officer at the University of Wyoming, about the new ERM Resource created by expert members of the URMIA community. The newly released ERM Resource is an excellent guide for enterprise risk management (ERM) in higher education. It's a great tool for anyone interested in ERM, whether you're just starting out or already have some experience. The guide includes short essays on topics like using technology, standards, what to do if you are a team of one, and much more! You can even share it with your leadership to help them understand the value of ERM better. So, if you're interested in ERM, be sure to check it out!

Connect with URMIA & URMIA with your network
-Share /Tag in Social Media @urmianetwork
-Not a member? Join ->www.urmia.org/join
-Email | contactus@urmia.org

Give URMIA Matters a boost:
-Give the podcast a 5 star rating
-Share the podcast - click that button!
-Follow on your podcast platform - don't miss an episode!

Thanks for listening to URMIA Matters!

Transcript

Show Notes
Enterprise Risk Management Resource for Higher Education 2023 [member login required]

2007 ERM White Paper

ERM Library Topic Folder

Join the Higher Ed ERM Roundtable Community (next meeting Oct. 16, 2023)

Annual Conference

Guests
+Saumya Khanduja, Assistant Director- Institutional Risk Management–Massachusetts Institute of Technology
+Gary Langsdale, Retiree- URMIA and Penn State University
+Sue Liden, Education Manager- URMIA
+Tim Wiseman, Chief Risk Officer- University of Wyoming

Host
Julie Groves- Director, Risk Services, Wake Forest University & URMIA President 2022-23

Transcript
Julie Groves: Hi everyone. I'm Julie Groves, director of Risk Services at Wake Forest University and the current URMIA president. I'll be your host for this episode of URMIA Matters. Today we'll be discussing URMIA's new Enterprise Risk Management Resource for Higher Education. Joining me today are in no particular order, Sue Liden, who currently serves as URMIA's Education Manager, she's a recent retiree from Pacific Lutheran University where she was the Director of Risk Services; Tim Wiseman, the Chief Risk Officer at the University of Wyoming; Saumya Khanduja, the Assistant Director of Risk Management at the Massachusetts Institute of Technology; and last but not least, we have Gary Langdale, who's calling in from Retirement Land USA. He formally served as URMIA's Education Manager, and prior to that he was the VP and University Risk Officer at the Pennsylvania State University. So welcome to you all. Thank you for being on the podcast today. So, before we start, why don't you each tell us a little bit about yourself and give us a bit more info than what was in the intros I gave folks. So, Saumya, why don't we start with you.

Saumya Khanduja: Sounds good. Thanks, Julie for that introduction. And as Julie mentioned, I am at MIT, and I joined MIT a little over five years ago. I am one of three FTEs within the risk management and compliance services office. And so far, it's been a very interesting and enlightening journey for me in the higher ed space. I started my career with Ernst and Young, where my primary focus was on risk advisory and internal audit work. But I was also introduced to ERM at that time while we were working on an engagement to help a client establish their ERM program. After Ernst and Young, I spent a number of years with CHURIM, which is a Society for Human Resource Management, where I led their internal audit function and instituted their ERM program. And after that it's been MIT for the last five years or so.

Julie Groves: Great. Well, we're glad to have you on the podcast. Tim, why don't you tell us about yourself? We, you used to be in, in the Great State of North Carolina and now you're out in Wyoming.

Tim Wiseman: Hello everyone. Great to be a part of this podcast and a very interesting topic that I'm passionate about. I'm currently the Chief Risk Officer at the University of Wyoming. We have a small office and department here that I'm responsible for, but we handle all our self-insured layers and programs, a vehicle fleet, and the traditional lines of liability and specialty insurance policies and property all coordinated through our office, along with some student health insurance and other aspects at risk management that have been added to our to our plate. I, as Julie, as you mentioned, was previously at East Carolina University, so I've had 10 years there and a little over three years here at the University of Wyoming, for about 13 or 14 years combined in higher education risk management. Prior to that, I had a career in the US Army as an army officer and transitioned or retired from the Army back in 2009, and jumped into the risk management and higher education career field and really haven't, haven't looked back since then. Been involved with URMIA since day one of, or nearly day one of moving over into this sector, and really am excited about the resources and the things that provides its members. My particular interests outside of the bread and butter of risk management insurance lies in, in our topic today, enterprise risk management. And I've been pretty active in that arena along with my regular duties to my respective institutions.

Julie Groves: Great. Thanks, Tim. So, Sue, tell us a little bit about you.

Sue Liden: Thanks, Julie. Well, as you mentioned, I recently retired from Pacific Lutheran University, where I served 15 years as their Director of Risk Services. And I'm happy to continue working in higher education risk management as URMIA’s education manager now and excited to share with our membership all of the great resources and professional development opportunities URMIA has to offer.

Julie Groves: Great. And finally, Gary, you know, you're just like a bad penny. You just keep turning up. We can't get rid of you. So how are things going?

Gary Langsdale: Oh, things, things are great. Retirement is a wonderful thing. Now that I'm here my last official act for URMIA came almost exclusively after I turned over the reins of the education manager position to Sue, but I had agreed with Jenny and the URMIA staff that we would finish writing a new resource for URMIA members about ERM, and we can talk a little more about that. But before that, I spent three years as URMIA’s Education Manager. That was a fun engagement and before that, 16 years at, it's the Pennsylvania State University. It's the University that's to Pennsylvania's west.

Julie Groves: See, I just thought when you said ‘the’ that meant the article and just sounds like not as much of an article to me.

Gary Langsdale: You're the English major, not me.

Julie Groves: I know, but I was trying to, I guess I was trying to elevate your, you know-

Gary Langsdale: Well, thank you.

Julie Groves: Penn State, so sorry if I offended any other schools in Pennsylvania with that. So, you know, we call Wake Forest, the University of North Carolina. That's what we call it.

Gary Langsdale: Oh, oh, well good luck with that. Before I was at Penn State, I spent 25 years or more, actually 25 years in the manufacturing risk management profession. And before that I was an insurance claims adjuster, which is how I got my start and how I learned about insurance and about risk management, so that's where I've been. But now I'm busy babysitting grandchildren.

Julie Groves: That's great. Well, it's certainly, certainly well deserved. And so, we do appreciate all that you've done for our association. So, let's jump into our ERM discussion. So, before we talk about our resource, I just wanted to hear from Saumya or, and or Tim what stage is ERM in at your respective campuses. Saumya, you wanna start?

Saumya Khanduja: Sure, so the ERM program at MIT has been in place for about a decade now. Overall, I would say we have a program that works with the quirks of our institute, and within the needs of our reporting structure. We have a very engaged group of stakeholders, which I would say is a key component of a successful program. And we have an engaged risk and audit committee that supports and endorses risk management. We did complete an exercise to self-assess our ERM maturity a couple of years ago, and we would probably rate ourselves at a level right below a completely mature program. And that basically means that we've incorporated a number of maturity elements over the years, but we also have a few more that we have on our maturity roadmap and that we would like to implement over the next couple of years.

Julie Groves: Great. And what about you, Tim?

Tim Wiseman: In my situation, I've kind of got two experiences in my previous institution. We actually started from square one and took a program up to a fairly robust and mature level. Took about five years to get there but we were really hitting on all gears and had support in place at the multiple layers to include governance, but right here at the University of Wyoming, we had sort of a slow start, did some research about three years ago. Got a proposal out and then we had a leadership transition and went into the pandemic. So went on the shelf for a little bit. And as we've come out of the pandemic, we've restarted most of the fundamental aspects and we're in our second year of repeatable core activities, I would call them. And we're stopping and taking an evaluation right now, self-assessment, if you will, of our stakeholders and key leadership to see where we wanna go from here. As we enter into adolescence, I call it and move forward. Or do we wanna hold what we got or what was, what will the future path for years, three through N look like. So, the, that's, we're taking a strategic pause, doing the evaluation and it's a, it's a less developed program at this time here than my previous experience.

Julie Groves: Saumya, did the pandemic affect your ERM program at all?

Saumya Khanduja: I would say our risk assessments that we do on specific top risks we kind of put a pause on that just because. Our stakeholders, our risk owners were, you know, engaged in other, you know, aspects of the pandemic and kind of responding to all of that. So, we did take a pause on the risk assessment side, but we did take that opportunity to do that self-assessment and come up with a maturity roadmap as to what, and we engaged a number of our stakeholders to see what we wanted to see as part of our ERM program going forward.

Julie Groves: Well, that's great. I knew that the pandemic probably did cause a lot of people to put their ERM programs sort of on the back burner. So hopefully if that's the case for our listeners and their institutions, hopefully they're pulling those out and brushing them off now. So, well so why don't we talk about this new resource, Gary, why don't you tell us a little bit about it and tell us why you all decided to do this resource now?

Gary Langsdale: Absolutely. Well, first of all, let's talk about what the resource is. It is designed to be a lot of things to a lot of people, so it has a lot of material in depth about different topics. It is what it is not is designed to be read front to back like a white paper. It is more a sampling of materials that someone can use, whether they are just interested in what is this ERM thing or whether they are at the beginning of an ERM process or if they are well on their way and are looking for a couple of pick me up topics to help them out. And most importantly, you can skip around in this thing, although the topics build in a logical sequence. This is not something you need to read A through Q to get something out of. There are parts that might be more important than others. For example, there is one that could be critical for those who are a team of one. There, there is a good section about what if your ERM team is you, and Saumya wrote that actually. And thank you for contributing that because it's very important. We have a lot of members who are under-resourced and need to know what they can accomplish with a small mighty army of one.

There are other parts that are equally important that talk about different aspects using technology, maturity models, the standards that are out there. Most of these, although they're a cohesive group, are almost standalone resources in their own right. They're very short essays 1, 2, 3 pages long, about these topics that you can consume in bite-sized chunks. And so, what it is, is something that was designed that our members can use, or they could share part or all with their leadership particularly if they're getting a new leader like Tim mentioned happened at Wyoming that wants to know what the heck is this? If it wasn't their idea or they weren't involved in the beginning of the development of the program at the institution you might wanna share, share some of this with them as appropriate.

The reason that we decided to do this now is frankly, during the pandemic, URMIA saw a tremendous uptick in demand for ERM programming materials. It became very obvious during the pandemic that more and more of our members were being asked to take on new roles, to take more responsibilities on, and ERM kind of fits the bill when you are being asked to take on new responsibilities and to move your program along from an elemental operational risk management program to something much more. And so, we decided that, that this would be a great time. This is something that took a while to develop, so. It was in the planning stages for at least a year. And in the development stage or the final, the writing and editing stage for what seemed like a year to get it all together, we were asking for different people's perspectives. There are 9 or 10 contributors who are all experts in their fields that we asked to write something and then we gave everybody the opportunity to edit. And that was, that was an adventure for me because we had nine or 10 different perspectives on how, how the paper should be put together. Everything-

Julie Groves: So, like, herding cats. Kinda like herding cats.

Gary Langsdale: I had a, I had a boss who used to say that. It's more like trying to carry squirrels in a wheelbarrow.

Julie Groves: Oh, that's a good analogy.

Gary Langsdale: And but, but it was all great work, and everyone contributed a lot, and the timing was good. Now that we're out of the pandemic this, more or less, this is available to people to take a good hard look at what they have been doing and what they would like to do with their program of managing risks.

Julie Groves: Great. So, for those of us who've been around URMIA for a minute, I'm sure a lot of us have referred to our 2007 ERM white paper. So why did we decide to do this as a resource guide instead of as a typical white paper like we would've done previously?

Gary Langsdale: Yeah. Well, like I did previously, I was one of the authors that 2007 works. So that tells you how long I've been around. Much to everyone’s chagrin. The 2007 project was more of a how-to, it was designed for the beginners from those who had already stuck their toes in the water, and in 2007, that's about all we had done. All of the people who were working on that, that white paper had just stuck their toes in the water. It has a couple of case studies from different perspectives of how you might start an ERM program based on the experience of four different institutions, but it was more of a beginner's how-to. It is still a valuable resource for those who want to go back and think about how to, it's not a, even though it was written 15 years ago, it is still pretty valuable in the techniques that it mentions, but this resource is designed to be so much more because everyone is, there are a lot of people, including those who, professionals who are on this call, who are much more advanced than anybody in higher ed ERM was in 2007. And there are those who need more information than were able to put as the, as the tool was developing with a unique higher ed kind of a look to it way back then. We are now at a point where we have a resource that should be of much broader interest to our members or to a broad swath of our members.

Julie Groves: Great. And you kind of touched on this a little bit and when you mentioned that there are sections of this that maybe leadership, you know, could find beneficial and there are sections for people who are just starting out. So, what are some other ways that members can use this resource?

Gary Langsdale: I think that members can use it to take a pulse to check their own thought process of where they've been and what they've been doing. Now, based on the experience of the nine professionals who contributed to this, as I mentioned during the editing process, everybody had a different perspective, which was good and valuable, but that should give the risk manager at one institution an idea of how nine others think about it, nine others who are very experienced in this field. I think that's the best part of this, is gathering that experience and giving people the ability to be able to check their own programs. Not as a checklist, but to think about, am I, am I doing all that I can? Are there things that I could be doing more?

Julie Groves: Okay. Well great. Well, I've had a chance to look at it just briefly and it does look like it's, it's just a fantastic resource. So, thank you for all your hard work on putting that together. I know that was not an easy feat, so, you know, we appreciate that. So, Sue, do you wanna talk a little bit about what other ERM resources URMIA has available?

Sue Liden: I'd love to. In addition to the new ERM resource and the 2007 white paper in our library, we have an ERM topic folder where members can find lots of other resources, past webinar presentations, and that. In addition, we have a higher ed ERM roundtable community that I invite members to join. Just email urmia@urmia.org or go onto the website and join that. We meet every other month. We’ve just had our most recent ERM meeting by the time this podcast comes out. But we will have our next one on October 16th. And you can also post questions to that community and get responses from individuals who have experience with ERM. And it's open for anybody who's aspirational about starting an ERM community or has a very mature ERM community. In addition, we have a lot of great ERM sessions scheduled for our annual conference. We have an ERM track. We're gonna have two ERM round table discussions, depending on the maturity level of your program. And last but not least, we're gonna have a post-conference ERM implement implementation workshop. So, I recommend that anybody who's interested sign up for our conference and come. We've got lots of stuff on ERM and other great risk management topics.

Julie Groves: Great. And you know, anytime anybody has a question for the larger URMIA community, they can always go into the institutional community and offer their question there, you know, that's a little broader than the ERM community and sometimes you may get some different answers there. So, we just, there are a number of resources for our members to use, so we just hope that you will all take advantage of those. I think finally, I, I wanna ask Tim and Saumya, what advice would you give to someone? Well, and obviously Gary, you can weigh in on this cuz you worked at an institution in Sue also, but our two resident institutional risk managers, what advice would you give to someone who's thinking about launching an ERM program on their campus? Tim, you wanna start with that?

Tim Wiseman: Well, sure, and I'm gonna cheat just a little bit cuz Gary gave a great answer on the. Previous question about how members can use this ERM resource. And a couple of things came to mind too, just from my experiences. Obviously, he outlined the differences in the approach. It's more like a mini library with a bunch of little volumes in there as opposed to a white paper to read straight through as a great way to think about it. But I think it's also when you're out there, whether you're just starting ERM or a more mature approach, and you're kind of reevaluating where you are on that. It's good to have kind of a one-stop shopping a couple of places where it hits all the main buttons, almost checklist fashion. Otherwise, you're scrambling to various organizations, associations, and trying to stream together. So, I really like the fact that for this one, it's not too long. It's pithy, but it's got some good content.

So that's I just wanted to kind of circle back on that. Very good summary and overview, is sort of speed dial. I like metaphors of ERM stuff to just visit and take a deep dive, and then you can always take a deeper dive on each of the topics. But it's a great presentation as far as advice. I think the thing is very, if you're stuck with, or saddled with the opportunity to excel as an ERM champion, depending on how you look at it, and you can feel kinda lonely. So, I think having the networks through URMIA's platforms for the community of ERM, but also this reference work helps to boost your confidence a little bit. And the main thing I would say is realize that as with any project, but with ERM in particular, there are a lot of personalities that come into and out of various levels of passion about it. And you can hit a lull where some of your champions and key people might not appear cuz they're preoccupied with other priorities. Don't get discouraged. I would just say it's always one step forward, sometimes two steps back. And then till sometimes two steps forward, one step back.

But there's always some amount of back. And I think the recommendation is there is take a long-term, short and a long-term approach, short term, to score victories and show accomplishments and progress, realizing there will be moments and times of setback or a pause take, call it strategic pause, but never lose fact of sustainability and the longer-term goal over time, which may and, and set things in motion like a cog train so that you, you don't retreat far and you regain some momentum when the factors come together and make, make progress for your longer term goal.

Julie Groves: Great. That's helpful. Saumya, would you add anything to that?

Saumya Khanduja: Yeah, I would say you know, to me the first thing to do if you haven't had a program before and anyone launch something, is to get that buy-in from a senior level team, you know, senior team level sponsor who can not just sponsor, but also sell it to other members of the senior team. So, I think that's really important. It's important to have a good group of stakeholders on the ground that you probably have built relationships already and you can leverage you know, to have an initial risk identification exercise may be, or maybe run a mini ERM pilot within their departments and to kind of understand what they need out of the program as well.

And then last but not the least is peer benchmarking. I mean, URMIA provides such a great forum to be able to go out and find out what peers are doing, and I think we are at a stage where, you know, most of our peers do have an ERM program, and I think that's probably the most effective strategy that you can use to convince your senior team to you know, help launch an ERM program. Just learning from these experiences and reaching out to peers. I think what I've seen as part of the higher ed community is that everybody's so willing to share and they're so generous with their time. And I think it's, it's important to take you know, make the most of that and use URMIA as a forum to get in touch with those peers.

Julie Groves: Great. Great advice. Sue or Gary, you have any extra thoughts you'd like to add since you, hindsight is always 2020 and you're looking back now?

Gary Langsdale: I would say, the new resource says it a number of times in enough number of ways. Don't try to boil the ocean when you're starting out, start small and you will build on your success. That's, that is a lesson that I learned in trying to implement an ERM program. And it is also one that that number of the other contributors have mentioned in the resource to and don't let, and don't let perfect be the enemy of good as you're trying to build a program.

Julie Groves: Great, anything else you all want to leave our listeners with before we head out for the afternoon? Any final thoughts?

Saumya Khanduja: I would just like to thank Gary for bringing this wonderful group of people together to put this resource together and taking the time to edit it and compile it and bringing it to such a great spot. So, thank you, Gary. And again, it's been such a great opportunity collaborating with peers across different institutions, so I'm really grateful for that.

Julie Groves: Well, and I second that. Thank you all. Thank you all.

Gary Langsdale: Yes, it was, it was a tremendous collaboration of tremendous professionals, and I was honored to be part of that, put it all together. So, thank you to everybody, and thank you to URMIA for everything that you do for your profession.

Julie Groves: Well, and of course Gary, we are so delighted for you that you are going to be off and finally enjoying your retirement and your grandchildren, but we certainly will miss you. So, we hope you don't stray too far because we may have other things, we need you to help us with.

Gary Langsdale: I'll still be around.

Julie Groves: So, thank you all so much for being here today. We will put a link. To the new resource guide and also the 2007 ERM White paper in the show notes. But they're also available on the URMIA website, so please be sure to check those out. And this wraps another edition of URMIA Matters.