Risk Governance in Higher Education

Good governance is a mechanism for leadership to achieve its objectives and make quality decisions. The time to revisit risk management practices and effective governance structures is more important than ever in higher education. In this episode of URMIA Matters, host Julie Groves, Director of Risk Services at Wake Forest University will sit down with Jake Braunsdorf and Cynthia Vitters from Deloitte to talk about how colleges and universities are structuring their risk governance, specifically ERM program constructs and how they are positioned within the institution to support the management of risks, and best practices to communicating risk information to university leadership and trustees, inclusive of reporting formats and how they lend themselves to communicating risk information that equips leadership to act.

URMIA is partnering with Deloitte on a four-part webinar series on risk governance in higher education starting on August 25. You can learn more and register online at urmia.org.

Resources Mentioned in This Episode
Risk Governance in Higher Education: What Boards of Trustees Need to Know - whitepaper from Deloitte

On the Board: The Role of Trustees in Higher Ed - podcast episode from Future U

Connect with URMIA & URMIA with your network
-Share /Tag in Social Media @urmianetwork
-Not a member? Join ->www.urmia.org/join
-Email | contactus@urmia.org

Give URMIA Matters a boost:
-Give the podcast a 5 star rating
-Share the podcast - click that button!
-Follow on your podcast platform - don't miss an episode!

Thanks for listening to URMIA Matters!

Transcript

Jenny Whittington: Hey there. Thanks for tuning into URMIA matters, a podcast about higher education, risk management, and insurance. Let's get to it. 

Julie Groves: Hi everyone. I'm Julie Groves, the Director of Risk Services at Wake Forest University and I'll be your host for this episode of URMIA Matters today. I'll be talking with Jake Braunsdorf, Senior Manager in the Higher Education Practice at Deloitte, and Cynthia Vitters, also at Deloitte and where she's a Managing Director. And we're going to chat about how colleges and universities are structuring their risk governance, more specifically with their ERM programs. We're going to talk about how these programs are positioned within the institution to support the management of risks. And we're going to cover some best practices in communicating risk information to university leadership and trustees, so this should be a really interesting conversation. So welcome to the podcast both of you. We're glad you're here. So, before we start our discussion, I'm going to ask each of you to introduce yourself to our listeners and just let us know a bit about your background. So, Cynthia, why don't we start with you? 

Cynthia Vitters: Great. Thanks, Julie. And again, my name is Cynthia Vitters, and I am currently the Leader of the Higher Ed Practice for Advisory Services at Deloitte. I’ve been at Deloitte for about 7 years focused on both higher education, and also risk and enterprise risk management. And before joining Deloitte, I actually spent my entire career, 22 years with the United States Department of Education, in a myriad of different roles. I was the Chief Risk Officer for the Office of Federal Student Aid, and then also held some various positions in compliance, internal audits, CFO services, and some government reengineering. So happy to be here. Thank you. 

Julie Groves: Great, great. Well, Jake, why don't you let us know a little bit about yourself? 

Jake Braunsdorf: Yeah. Thanks, Julie. Jake Braunsdorf, Senior Manager at Deloitte Higher Education practice. Work closely with Cynthia and lead a lot of our strategic risk work, which means enterprise risk management compliance. Have worked in the third party risk management space as well as internal audit. So, my background is risk and all things risk related. Been at the firm for just shy of 10 years now have done work in federal government, space, state and local government, and over the last five years or so, focusing exclusively on higher education, working with risk managers, risk officers, those who manage risk and institutions. Supporting them in the building and maturing of their risk programs and really excited to be here with everyone but. 

Julie Groves: Well, great again, we appreciate you being here because this is a very timely topic and a lot of risk managers are having to deal with this in their own, you know institution. So I think this is going to be really helpful to a lot of people. So there seem to be. A lot of things in the news now about boards and their role in risk, governance and higher. Today. So can you talk a little bit about why you specifically chose to explore this topic and why you're doing that now? 

Cynthia Vitters: Yes, Julie, so. Just a little background, our strategic risk practice at Deloitte works with colleges and universities all across the country to assess, build and mature their risk programs. So as you can imagine, this means engaging with those who are leading risk at the college or university that they are at and one trend that we've been seeing is. Increased interest and higher quality risk information from the board of trustees. We've learned through our conversations and support that we provide to various risk leaders. That they have really begun to think through what and how they communicate this risk information to their trustees. Similarly, through conversations with college university trustees, we've been having a lot of interest from them and what their responsibilities are as it relates to risk awareness.  

So we attribute some of this new interest to the fact that. Many risk leaders had their role elevated as a result of the pandemic we saw on many occasions that the risk leaders were actually the ones in charge of poor nation and response to the pandemic. And in turn, they were, you know, given a. Seat at the table. That they may. Not have had before what this did was. Also pique the interest of trustees on risk information as a whole. So as we started to see this theme continue to emerge, we embarked on a paper to explore the relative lack of maturity, risk management and higher Ed compared to some. Commercial and government agencies, our practice and Deloitte spans across government, public service and. Fees, which means federal, state, local and also higher education. So this has given us a unique view into the maturity of risk programs. We also have a tie into our commercial counterparts, which afforded us a rather unique and Broadview to dive into this. 

Jake Braunsdorf: And Julie, just to jump in here and what I think is really interesting is when we started to think about the composition of higher education trustees and the fact that they all also serve as senior leaders within commercial and governmental organizations, they become accustomed to a certain level of risk management practices that are ingrained in their business rhythms. And what we've seen is that in their role of trustees. We observe the absence of this high. Quality, risk management and risk management practices, and the information is occasionally unclear and and they're unclear in their role. So we began to have conversations with trustees, both public and private. We engaged our Center for board excellence at Deloitte and other thought leaders within the firm to develop the paper. And in this paper. Covers the challenges of top risks facing higher education the importance of. Integrating risk awareness into into institutional culture and responsibilities of the trustee in terms of risk, governance and how ERM supports that risk management and some of those steps to get started. 

So the hope was that as we were generating this paper that the readers would become one more well versed in risk management as it relates. To higher education sector and feel empowered to to advocate more for mature risk practices of their specific. Institution what we we found out is that we really have some really positive feedback and on our thinking and actually some requests to to go further on this, which is something that we're looking to do. And when we were approached by Michelle Smith that earlier to explore this multi part webinar series that dives into various components of that paper and I think goes beyond as well. We really couldn't think of a better way to engage on this topic for those that live and breathe these challenges every day. 

Julie Groves: So that's really interesting. And so, you know, when you mentioned that you've done this paper that you've kind of catalogued what some of the themes are. So what do you see as some of the key themes? Within these modules that you intend to cover and why do you think they'll be helpful to today's risk leaders? 

Cynthia Vitters: Yes, well the. Webinar series. At its core is intended for the risk manager and to educate them on collecting and assessing the highest quality risk information. A primer on the board of trustees and their operation. Reasons and with the better understanding of the trustees, how to best communicate with them and then concluding with some new and innovative thinking on how to get better engaged with the board and really utilize them to collectively better manage risk at their university. Now we do realize this is not easy. It's very different than the normal activities of a risk. Manager. But for a college university to have a strong program, a risk aware culture of the risk information really does need to be elevated to the trustee. And our hope is that this series will really help with that. 

Jake Braunsdorf: Yeah. And the way we've designed this series is that each module builds off of each other. There should be and will be a natural flow from module to module. Each module will have what we consider an educational component where we will cover key concepts and layer in our perspectives. And that will be followed by an institutional example to provide a case study of sorts for that. Topic. So we're really fortunate to have several leaders join us in this series, Melanie Lott from Carnegie Mellon, Leanne Moffett from Southern Methodist and Alan Smith from Western Governors University, as well as several trustees to provide their experiences and thinking what they're going to bring is the real life application to the concepts and strategies that we'll discuss in the early part of each module.  

The series begins with a more basic ERM 101 to illustrate that high quality risk information is generated from the ERM program through the risk assessment process, specifically, as well as flowing through an established ERM program governance structure in discussions around how ERM and its integration with other management. Functions like internal audit compliance you know supports more informed risk discussion. And with that understanding in place of why and how risk information is collected, we pivot our focus more to the board of trustees in module 2, covering the fundamentals of the board. We felt that in order to better communicate with the board, you really needed to understand who they were, who is the board, what is its composition, what are its roles and responsibilities. When we have that baseline set up, we then dive into how to connect back into the university, risk government structures and the various committees that may touch.  

In module 3, everything really starts to come together. We cover on effective strategies and approaches to communicating risk information to the board. We begin with the premise that communicating risk information is challenging and particularly tough in front of a group like the board. We share perspectives on when and how risk information is discussed. And then dive into different types of information brought to the board. That baseline established there. We tie back into module 2 and then discuss communication with various board comma. Is who that institutional leader may be and and what they might discuss. And they closed with some specific techniques and approaches to communicating risk information like our inform and decide model that we discussed in our paper. That really helps organize and frame what decisions and how they're brought to trustees as well as some reporting. Considerations.  

And in module 4 the final module, our hope is that we've provided a solid baseline in understanding. How risk is? Collected through the Aaron Program and university governance structures, you'll then provided a primer on the board, its composition, goals, responsibilities, how it interacts with the university, and then some tactical techniques. For communication that will help you know, share that risk information upward. And we thought elevating the conversation and sharing some of our thinking around new and innovative approaches to engaging the board and leveraging their unique skill set and experiences to support better risk management would be interesting for this audience. We'll cover our evolving thinking around how to engage boards in a way that is really not currently done and dive into why you might consider this through a specific or set of use cases or examples for consideration. 

Julie Groves: Well, so following up a little bit on that, what are you hoping that risk leaders who tune into this webinar? Will walk away with. 

Cynthia Vitters: Yeah. Well, we certainly. Hope that when those tuning into the series Finish Module 4 that they will thoroughly understand the importance of trustees role in managing risk at colleges and universities. Roles are very simple. Trustees are to provide oversight of risk management and its risks, and the university staff are to provide the day-to-day Management of those risks, however, how to collect that risk information and how you message that up to trustees with the broader governance? Structure and how trustees engage and utilize that information can be some somewhat of an art. So we hope. That the content covered in this webinar series is both informative and hopes in becoming strong risk managers. 

Jake Braunsdorf: And going back to something we discussed earlier with everything that you read and see in the news regarding the risks facing higher education, the role of trustees is going to be increasingly more important and how you engage those trustees and university leaders will be paramount in how to respond. To these issues. Fortunately, and maybe unfortunately, depending on how you look at it, risk managers are going to play a large role in this and their ability to engage and communicate with the board will dictate in many cases how a college or university is really able to navigate those issues. I was recently listening to a Future View Podcast that Jeff Selingo and Michael Horne put on and. And recently did an episode on the role of board of Trustees and one of their guests spoke about how boards typically fly at that 40,000 foot level. But on occasion have to drop. Down to that 5000 foot level and then and then raise back up risk managers are really going to be critical in determining when they should drop down and and what do they do when they do drop to that level. What information are they getting and our hope is this series helps in their in education provide some tools. To better engage to help with this. 

Julie Groves: Well, I mean, it sounds like it's going to be very, very interesting. We'll have a lot of you know, takeaways for folks to to try to use. In their daily. Lives. So I want to let everybody know that this podcast today is a kickoff to A4 webinar series and we've kind of talked about that as we've been chatting today, our friends at Deloitte are doing this for us and it's going to be obviously, as we've been talking about. Governance and ERM and how to deal with trustees and everything that Jake and Cynthia have just covered. And so I'll let you know. The first one is going to be on July 20. There is a lot of information on this webinar series. It'll be LinkedIn, the show notes from this podcast, so be sure to check that out if this is at all interesting to you, because I think it sounds like it's a. Very timely topic. And then maybe we can have another webinar after and we can say here's some questions that people have so. But anyway, if not, you can certainly get in touch with these folks in the URMIA Office to answer those questions. So. Before we wrap up, either of you have any. Final thoughts today. 

Cynthia Vitters: Yeah. I think one final thought, I just wanted to mention is that you know, we do acknowledge that this discussion is evolving and the thinking in this space is newer than in other industries, but it is going to be increasingly important for colleges and universities to get this right and to ensure that risk governance is in place and done the right way. So you know we do. Look forward to continuing to refine our thinking and the hope is that this forum and this series will provide risk leaders with the form to communicate so we can collectively better support more mature risk practices in higher education. 

Julie Groves: Well, and those of us who have been risk management for any length of time know that ERM is always evolving. I mean, I remember when URMIA put out their ERM white paper way back in 2009 and it was sort of new and people didn't quite know what to do with it. And I think it's evolved a lot since then. But to your point, Cynthia, it's still evolving. All the time. And so, you know, we just look forward to this webinar series because it sounds like it's going to really help us to, to dig deeper into some some real issues about governance and trustees, which is always everyone's favorite topic. So. We look forward to it, so be sure to check out the information LinkedIn, the show notes. So thank you again both so much for being here. We look forward to this webinar and this wraps another episode of URMIA Matters. 

Narrator: You've been listening to URMIA matters. You can find more information about URMIA at www.urmia.org.  For more information about this episode, check out the show notes available for URMIA members in the URMIA Network library.