Determining your strategic focus for the year ahead could start with a survey of your own organization’s perceived Top Ten Risks. Join Guest Host Julie Groves and Guests Steven Dunham and Lou Drapeau as they discuss how you might go about that process and how a recent URMIA survey could support that process. Check out the results of the collective survey which was conducted in late 2021 [Member Log-in Required].
Show Notes [member login required for some content]
Connect with URMIA & URMIA with your network
-Share /Tag in Social Media @urmianetwork
-Not a member? Join ->www.urmia.org/join
-Email | contactus@urmia.org
Give URMIA Matters a boost:
-Give the podcast a 5 star rating
-Share the podcast - click that button!
-Follow on your podcast platform - don't miss an episode!
Thanks for listening to URMIA Matters!
Determining your strategic focus for the year ahead could start with a survey of your own organization’s perceived Top Ten Risks. Join Guest Host Julie Groves and Guests Steven Dunham and Lou Drapeau as they discuss how you might go about that process and how a recent URMIA survey could support that process. Check out the results of the collective survey which was conducted in late 2021 [Member Log-in Required].
Show Notes [member login required for some content]
Connect with URMIA & URMIA with your network
-Share /Tag in Social Media @urmianetwork
-Not a member? Join ->www.urmia.org/join
-Email | contactus@urmia.org
Give URMIA Matters a boost:
-Give the podcast a 5 star rating
-Share the podcast - click that button!
-Follow on your podcast platform - don't miss an episode!
Thanks for listening to URMIA Matters!
Show Notes
URMIA website
Top Ten Risks Survey (2021) [Member Log-in Required]
URMIA Risk Inventory [Member Log-in Required]
ERM Do you need training on ERM/ISO 31000? Check out this annual training opportunity You might consider joining the Higher Education ERM Roundtable community as well.
ERM Page in the URMIA Resource Guide
KPI Dashboards
Emerging Risks
Ask Lou is a red button on the right side of the URMIA website. A quick fill form expands on the screen and you can submit your question. [Member Log-in Required]
Join URMIA
Make Contact
Transcript
Julie: [00:00:00] Hi everyone. I'm Julie Groves, the director of risk services at Wake Forest University in Winston-Salem North Carolina. And I'll be your host for today's episode of URMIA Matters. With me today is Steven Dunham, who is the chief risk officer at the University of North Carolina at Charlotte right down the road from me.
And also with me is Lou Drapeau, who is URMIA’s fantastic resource manager. So welcome to the podcast today, gentlemen. We're gonna talk about, uh, URMIA’s recent survey of the Top Ten Risks, [00:00:30] unique to higher education, and what all went into that process. But before we get started on our discussion, Steven, why don't you tell the listeners a little bit about you.
Steven: Thank you, Julie. Uh, as you mentioned, I am the chief risk officer for Charlotte. Um, in that role, I have responsibility for enterprise risk management. I also have, uh, oversight responsibilities for operational risk management, including our property and casually lines of insurance, as well as workers' compensation [00:01:00] claims management. With that said, my primary personal responsibility is enterprise risk management. I was hired three years ago by Charlotte to design and implement from scratch a new enterprise risk management program. And I'm pleased to say we've matured that program quite a bit over time. Um, for those who don't know, Charlotte University, uh, is a, has 30,000, uh, students and, uh, you know, a growing athletic department.
Julie: go 49ers.
Steven: That's right.
Julie: um, and so Lou, [00:01:30] most people know you, but why don't you let folks know a little bit about your background and how you ended up on the URMIA staff.
Lou: Okay, happy to do that. Um, like Steven, I spent 22 years in the private sector before, uh, going to higher education at the University of Kentucky where I was director of risk management for 12 years there retiring in 2015 and, uh, I had been an URMIA member since [00:02:00] 2003 and, uh, a year or two later, um, there was a post for a job opening at URMIA for resource manager and I applied for it and, uh, URMIA hired me.
And so here I am, I've been here for about five years now.
Julie: That's great. Well, we are very fortunate to have you, so, uh, I'm glad you decided to come out of retirement and work with us. So, tell us, uh, Lou about how this idea for this survey came up.[00:02:30]
Lou: Well, I had been asked several times over a period of probably a couple of years. If we had ever done a survey of our membership to determine what their top 10 risks were. And, uh, fortunately, or unfortunately the answer to that was no, we had not done that. And so, um, Gary Lang stale and I were having a conversation one day about risks and about top 10, should [00:03:00] we, you know, do something… and I mentioned that, well, gee, we had a couple of people that had asked about that and that maybe we should go ahead and do such a survey and see what happens. So we basically developed a relatively simple survey. We asked people to -in free form - list the top 10 risks at their university in order of importance. In other words, the biggest risk was number one and the lowest risk of [00:03:30] the 10 was going to be number 10 and we just left it free form open so they could answer. And however they wanted to, if it was a large category risk, or just an individual risk, they could list it however they want it.
Julie: So I'm sure that doing that gave you a large amount of really interesting and yet, uh, disparate information. So, how are you going about the process of [00:04:00] looking at all of this information people sent you and trying to put it in categories? I mean, how are you tracking? How are you going about getting your arms around it?
Lou: Okay, well, that, that was obviously the first big problem. Um, we downloaded all the data and looked at it from the standpoint of the individual listing of risks, what a particular risk might be, and I started looking at those [00:04:30] vis-a-vis our, the URMIA risk inventory, which has all of the various risks that, uh, we've come across in higher education, but categorized into different areas.
Um, you know, like students or, you know, safety, uh, whatever the cases may be. And so the, the way that I was looking at the data, the only meaningful way that I could see that it would be helpful to anyone, anyone was [00:05:00] to categorize it similarly to how we did it in the risk inventory, to be able to come up with any reasonable numbers, to be able to tell which ones were the top risks. The other thing we had to deal with was if somebody listed a particular risk in the number one category and someone else listed the same risk in the number three category, how were we going to, uh, you know, mix that all up and, and [00:05:30] make it come out in a, in a meaningful manner.
And so what I finally did with it was to, reorganize them basically by, uh, the, you know, where they w what the positions were. So the number one risks, I added more weight and less weight to number two, and number three, and on down to number 10, getting the. Wait, the really interesting thing was in doing that.
It didn't [00:06:00] change because we had already categorized them. It really didn't change much of how it came out in the order of categories. I think there were only, uh, two changes that didn't really, you know, like number three went to number five or something like that. So, uh, but that was the best way that we could think of to be, was weighting them like that Uh, to be able to take into consideration that someone had listed a risk as number one, and somebody else [00:06:30] had risked their had listed it as number three or number five.
Julie: Just out of curiosity. Did anybody have pandemic in their top ten?
It's interesting because had you, had you done the same survey in 2019? I feel certain no one would have had pandemic on there, but it's interesting now that we've been through what we've been through, I just was curious if anybody even listed that at all. Or maybe people feel like, because we've been through it, we know what to do now.
Lou: I think, I think that was the big thing was [00:07:00] now. there are some of the risks that were listed in number one are the result of problems with the pandemic, like declining enrollment and student retention, some of those kinds of things, but there's, I don't think anybody listed as number one, just straight pandemic.
Julie: Hmm. Well, do you think there is any value in combining all these risks you've gathered from the various institutions? I mean, what do you think universities can do with this [00:07:30] information?
Lou: Well, I guess it's an interesting exercise to look at. If, if someone is thinking about, well, gee, how can I, you know, come up with my top ten risks. They could certainly look at this and see the categories that might give them, you know, some sort of an idea of where they're going and where their risks might, uh, fall.
Another thing that I think it would probably lead them to, is if you then went to the risk [00:08:00] inventory and now you're looking at all of those individual risks, and with the new features that we have in the risk inventory, you can actually select the individual risks that you want to make your own, uh, risk inventory out of and download that and you now have a list of your risks for your institution. Um, so I think as kind of a, a process that creates kind of a process, you look at [00:08:30] the, at the combined risks first, and then you look at your risks in the risk inventory and you might come up as a good starting point with how you're going to deal with the risks that you have at your institution say for instance, as part of an ERM program,
Julie: Well, and I do think one of the things about surveys or survey results. Is it helps you realize you're not alone, right? So you can, you can read what other people have responded as. [00:09:00] You know, top ten risks and, it helps you feel like you're, you're not fighting this fight by yourself, other institutions are dealing with very similar, situations and concerns, um, to what you're dealing with.
So, um, so Steven, talk a little bit about how you see from an institutional point of view, how you would suggest that institutions go about identifying their own top ten risks. If they haven't done that already.
Steven: You know, I think a survey is absolutely very [00:09:30] common approach and a very value-added approach to go. You know, I think that the, all the challenges and the benefits of doing a survey like we just talked about are the first step, but I think we need to be clear that that really is just the first step in the process.
Because usually when you need to identify and prioritize your, your risks for your institutions, you know, you can find that a survey can be something nothing more than like watching an episode of family feud.[00:10:00] right? You get a hundred people to answer a random survey and you get 10 smart people trying to guess all the survey results and despite their best efforts, they still can't pick the last one or two because you're likely you're going to get some, some results, some outliers, some unexpected or maybe even just unrealistic responses. So I think the, the important way of making sure that when you're evaluating your top risks at your university is to take your survey results the next step, and [00:10:30] really engage - hopefully you have one, but if not, you can create one - a peer governance, risk and compliance people.
You know, if you don't have an ERM committee, feel free to pull together a, person from legal or audit and compliance and maybe operational risk management. and let's sit down and have a peer review discussion about the reality and the real residual risks for each risk you find in your survey so you don't end up with that kind of oddball results, still floating there in, [00:11:00] in your answers. I think that the, that is a good way to, to finalize your, your risk.
I think, another way, uh, to really enhance the output and the value of the, the, your top risk list is to, you know, take a step back and take a look at what fundamentally, uh, ISO 31000 says about risk, and that's a framework for enterprise risk management. It defines risk as uh, uncertainty's effect [00:11:30] on objectives.
And so I think another real helpful way to get objective rather than just subjective information and insight into whether your top risks are really, you know an optimized, is to compare the results of your peer reviewed survey results your your institution's strategic plan or the key strategic objectives that your organization has uh, some organizations even have, key performance indicators [KPI] identified in a dashboard [00:12:00] and making sure and to, to the degree using that objective data of your organization's objectives. And, and KPIs can be another way of validating top risks, because if a risk doesn't affect a top objective of your organization, I'm not certain it really could qualify as a top risk if it's not going to affect an objective based on the definition of risk.
Julie: Along those same lines, tell us how you suggest [00:12:30] people who are getting started maybe in this process - how do they go about identifying emerging risks? Because you know, those are the things that everybody's afraid of, but we don't know about them yet. And so, so talk a little bit about how people can go about using some of this, does either the survey or using, you know, their risk committee to, determine what some, maybe emerging risks for their universities are.
Steven: Sure. Absolutely. you know, and I think emerging risks has yet to be maybe [00:13:00] clearly defined or universally defined, but, you know, I think emerging risks can depend on when you're doing the analysis. I think that was a perfect example. Earlier, when you spoke about, um, pandemics and, and those being emerging.
Um, you know, I, the first place you can start, I think are surveys like this, right? I'll let's use the example of say demographics and the demographics shift. Um, you know, I'm here comfortably in Charlotte, in the Southeast. And, [00:13:30] you know, as I, as I personally understand the demographic risk, you know, we've got a kind of universal national exposure to lower birth rates, uh, you know, creating lower numbers of traditional high school graduates in the coming years and that's going to create a demographic shift. That's going to affect the enrollment of institutions across the nation.
That come, that risk is going to be, you know, [00:14:00] felt and experienced at different rates depending on where you are in the nation. Based on my understanding of the risks, Entities, universities, institutions in the rust belt, or in the Northeast that have higher experience, that experience higher migration out of their state among that age group will begin to experience those risks sooner than those in the Southeast or the South, where the risk is expected to kind of be prolonged a little bit.
So just by I in this, for that particular one, It will be emerging [00:14:30] to me now, but could very well right now be a real risk that, you know, and I see a real risk -they could be experiencing the actual negative outcomes of that uncertainty in real time at a certain part of the nation whereas for I it's more of a leading indicator.
So I think a risk like that versus something like inflation, where I think we're all kind of experiencing it at the same time. So when you look at emerging risk surveys, national surveys, global surveys, [00:15:00] I think can be places to provide insight on things that might be coming your way.
And I'll say this for, for looking at, uh, the results of surveys you should be as a ERM practitioner, at least you should be able to look at the URMIA survey or other surveys, whether, whether they may come from whether it's the, you know, the ERM Institute at North Carolina State or, um, under United Educators or any other place you see these top ten come from.[00:15:30] - you should be able to articulate why or why not your particular institution is exposed or not. Whether the residual risks that your institution is exposed to, as it relates to those risks is a top ten risk for you or not. Um, if you can't answer that question, then I think that's a right time to go out and find the risk owner or the subject matter expert your institution related to that risk and have a conversation about I'm seeing this in other areas. Not coming to tell you as a [00:16:00] risk owner that “I know better than you, that this is a bigger risk than you think it is” but rather you as a risk owner going humbling to say, “I'm learning about this. This is something that, that I'm being exposed to - Can you help me understand why or why not we have an acceptable level of residual issue related to that.”
So I think all of that kind of creates a, an appropriate emerging risk understanding. I think it's really helpful to know. To have active relationships with your ERM committee again, if you don't have one, I really think it's important to have a [00:16:30] cross-functional committee.
Uh, I, I think it's important to keep it cabinet level minus one, because what you get is the people who are exposed to both the most strategic thinking in the organization while at the same time, trying to balance the, the daily pragmatic efforts of the organization and really kind of know what's going on at the tactical level.
And, and, and having regular dialogues in a committee that, that can bring to light, not just to [00:17:00] use the risk manager, but to, uh, to peers and various parts of the institution that they can be exposed to more emerging risks is another way to, to make sure that, uh, you're aware of what's.
Lou: And Interesting side note to what Steven just said, um, enrollment was the number three risk in the survey that we just did.
Julie: So Lou, if people are interested in this survey, I mean, I know you're still trying to get your arms around it, but if people are interested in the survey [00:17:30] or have questions about it, how can they get information about it?
Lou: Well, number one, it is posted in the, uh, URMIA library under URMIA Surveys. Um, but if somebody had particular questions or whatever, I'd be happy to have them click the Ask Lou button and, uh, I'd be happy to help them in any way that I can.
Julie: Great. Everybody take advantage of the Ask Lou button because it's a great feature of, of URMIA and our, our website and Lou is a great resource. So, [00:18:00] which is, I guess, uh, how we got to this conversation today because somebody asked if we'd ever done this. So is there anything else you all want to add before we close out our discussion?
Lou: Well, I think at this point we've pretty much covered where we are like we said, we haven't really solved anything necessarily, but I think we've had a pretty interesting discussion and gotten some interesting results from this survey And, uh, see where we go. As we go forward we will be reinstituting the [00:18:30] surveys. that Glen used to do on risks and emerging risks and so we'll be getting a new one out here, uh, in the next month or so. So, uh, that may also provide some interesting results.
Steven: Yeah. I might add that. You know, when, when I look around, you know, having practiced ERM, You know, for at least a decade as just pure enterprise risk management. I think we're living in experiencing a more dynamic and, uh, changing, [00:19:00] unpredictable environment than we ever have in the past. I remember years of creating, you know, my top ten risks and really, even as I changed industry from retail to manufacturing, there was subtle, they would be very subtle changes in what you would perceive as your top ten risks over time. I mean, you'd really have to do something like, I'll try, I'll try to use examples from higher ed, like, unless you added a medical school, right? Or unless you really did something bold international, [00:19:30] like trying to create an international, extension of your university or some type of M and A activity, you really. Yeah, a major change in a regulation like Title IX or something like that. Occasionally you would see like something interject itself like into this new top ten risk.
But for the most part, it seemed by industry those top ten risks pretty much were static, stable kind of understood risks. And I think just the pandemics really changed everything. You know, it's brought a lot [00:20:00] of significant new public health and safety issues to bare. You know, the lockdowns brought significant and brand new operational and financial challenges to manage, it stressed our emergency management and business continuity plans and resources to the limit, and I, I'm just, I'll be honest I'm not even sure that we've ultimately understood the, the long-term impacts on employee and student retention and satisfaction. To me, our person and Charlotte, [00:20:30] our top ten risks. Have have had new entrance and have had, you know, some shakeup, unlike we've seen in the past years because of the dynamic nature that this pandemic wasn't just a peak of health and safety challenges it's, it's really resulted in some, some long-term shifts of, you know, employment and, uh, safety and security and, and, the ways people want to learn and the operational, uh, dynamic. That, that I [00:21:00] think surveys like this, really can go a way to, again, helping you to identify emerging risks or risks that you know, are kind of unique or niche for particular, uh, you know, scenarios.
Julie: Great. Well, that's, that's very helpful. I just, I want to thank you both for being here today. Thanks for your work on this survey, Lou and you, and, um, Gary and, uh, if you're interested again, go on the website and check it out.
I will just close by saying that wraps another episode of URMIA Matters.