ERM 2014
The Implementation
of ERM at
The University of Kentucky
There are risks in everything we do.
We can take actions to manage the
amount of risk we need to take
compared to the reward that we hope
to achieve. The objective is to
optimize our risk taking in order to
optimize positive outcomes and
achieve institutional goals.
What is ERM?
The term Enterprise Risk
Management is intended to
cover risk management in the
broadest possible terms,
encompassing all forms of risk
management activity across the
entire organization.
There are many definitions but
the bottom line of all of them is
that they share the concept of
“managing risk to help an
organization meet its strategic
goals”
A definition that is easier to understand from a “to do” standpoint
is:
A structured, consistent, and continuous risk management process
applied across the entire organization that brings value by:
√
Proactively
identifying, assessing, and prioritizing material
risks
√
Developing
and deploying effective mitigation strategies
√
Aligning
with strategic objectives and administrative
processes
√
Embedding
key components into the organization’s culture
The history of ERM at UK
The Risk Focus Project was UK’s initial
experience with ERM in 2006, conducted by our
insurance broker, Marsh, Inc.
2 areas – Non-Clinical and Clinical
37 interviews with selected management
2 workshops to prioritize risk exposures
We decided to build UK’s ERM program from the
ground up.
Current Status
We developed a preliminary ERM training session which was
presented to several areas of campus
Athletics and Campus Recreation have done extensive
development of Risk Management practices.
4-H is developing a Risk Management Manual.
At a Treasurer’s Office Manager’s meeting and subsequently in
Treasury Services we identified risks and developed preliminary
“heat maps” using the UC Dashboard Program.
Broadening the representation on the RMAC to all areas of UK.
Risk Assessment & Management Process
2
1
Organizational
context
Risk
Identification
3
Communication
Risk Assessment &
Management
Process
7
Monitoring,
Review &
Corrective
Action
6
Risk
Assessment
4
Risk
Evaluation
Risk
Treatment
5
Goal
• Instill risk consciousness throughout the
institution
The ERM process identifies the risk owners and
as such, they are responsible for risk treatment.
Risk issues that cross several operations may
share a solution and/or rise to the attention of
upper management and consult with the Risk
Management Department/RMAC for a broad
based solution.
Not “One Size Fits All”
There are many risks that impact different
parts of the institution in different ways,
hence, there may be several mitigating
factors applicable in these areas. A high
priority risk in one area may be a low
priority or non existent in another area and
this requires a flexible program to deal
with them effectively.
How does this benefit UK?
Works to resolve “what keeps me awake at night?”
Awareness of risk issues throughout the organization
Reduce costs
Increase safety
Makes a better managed organization by helping to
achieve strategic goals
Protects reputational risk
Aids in legal and regulatory compliance
Risk Mapping
“Risk Maps” or “Heat Maps” come in
all shapes and sizes from simplistic to
complicated.
Our recommendation is to “Keep it
Simple”, at least in the beginning and
then grow into a more sophisticated
risk mapping strategy.
Risk Maps – Simplistic
100
90
80
70
60
Series1
50
Series2
40
30
20
10
0
Risk 1
Risk 2
Risk 3
risk 4
risk 5
Risk Maps - Moderate
Risk Map: Public University
Slips, Trips
and Falls
High
Sexual
Abuse &
Molestation
Study
Abroad
Programs
Medium
Transportati
on
Reputation
Educators
Legal
Liability
Assault,
Date Rape,
Student on
Student
Violence
Time
Element /
Business
Interruption
Third Party
Use of
Facility
Failed
Response
to Crisis
Employment
Practices
E-Risks
Work
Comp
Injury
Low
S
E
V
E
R
I
T
Y
Student
Organizations
Low
Medium
High
FREQUENCY
Implementation Process
Present concept and timeline to RMAC (March meeting)
We will distribute risks identified in “what keeps me awake at
night” to RMAC members to review and resubmit by May 1.
Marsh’s Higher Ed Practice Leader, Jean Demchak, will
moderate a risk prioritization session at our May 29th meeting and
demonstrate Marsh’s ERM Tool.
Jean will review results at our June 26th meeting.
Administrators will assume risk ownership and Risk Management
will provide guidance to the various areas of campus in risk
identification and prioritizing of risks on an enterprise wide basis.
Questions ?