ERM 2014 The Implementation of ERM at The University of Kentucky

There are risks in everything we do. We can take actions to manage the amount of risk we need to take compared to the reward that we hope to achieve. The objective is to optimize our risk taking in order to optimize positive outcomes and achieve institutional goals.

What is ERM? The term Enterprise Risk Management is intended to cover risk management in the broadest possible terms, encompassing all forms of risk management activity across the entire organization.

There are many definitions but the bottom line of all of them is that they share the concept of “managing risk to help an organization meet its strategic goals”

A definition that is easier to understand from a “to do” standpoint is: A structured, consistent, and continuous risk management process applied across the entire organization that brings value by:  Proactively identifying, assessing, and prioritizing material risks  Developing and deploying effective mitigation strategies  Aligning with strategic objectives and administrative processes  Embedding key components into the organization’s culture

The history of ERM at UK The Risk Focus Project was UK’s initial experience with ERM in 2006, conducted by our insurance broker, Marsh, Inc. 2 areas – Non-Clinical and Clinical 37 interviews with selected management 2 workshops to prioritize risk exposures We decided to build UK’s ERM program from the ground up.

Current Status We developed a preliminary ERM training session which was presented to several areas of campus Athletics and Campus Recreation have done extensive development of Risk Management practices. 4-H is developing a Risk Management Manual. At a Treasurer’s Office Manager’s meeting and subsequently in Treasury Services we identified risks and developed preliminary “heat maps” using the UC Dashboard Program. Broadening the representation on the RMAC to all areas of UK.

Risk Assessment & Management Process Organizational context Risk Identification Risk Assessment Risk Evaluation Risk Treatment Monitoring, Review & Corrective Action Communication

Goal Instill risk consciousness throughout the institution The ERM process identifies the risk owners and as such, they are responsible for risk treatment. Risk issues that cross several operations may share a solution and/or rise to the attention of upper management and consult with the Risk Management Department/RMAC for a broad based solution.

Not “One Size Fits All” There are many risks that impact different parts of the institution in different ways, hence, there may be several mitigating factors applicable in these areas. A high priority risk in one area may be a low priority or non existent in another area and this requires a flexible program to deal with them effectively.

How does this benefit UK? Works to resolve “what keeps me awake at night?” Awareness of risk issues throughout the organization Reduce costs Increase safety Makes a better managed organization by helping to achieve strategic goals Protects reputational risk Aids in legal and regulatory compliance

Risk Mapping “Risk Maps” or “Heat Maps” come in all shapes and sizes from simplistic to complicated. Our recommendation is to “Keep it Simple”, at least in the beginning and then grow into a more sophisticated risk mapping strategy.

Risk Maps – Simplistic

Risk Maps - Moderate

Low High FREQUENCY Medium High Low Student Organizations Slips, Trips and Falls Failed Response to Crisis Study Abroad Programs Work Comp Injury Sexual Abuse & Molestation Educators Legal Liability Assault, Date Rape, Student on Student Violence SEVERITYSEVERITY Third Party Use of Facility Transportati on Reputation Employment Practices E-Risks Time Element / Business Interruption Risk Map: Public University

Implementation Process Present concept and timeline to RMAC (March meeting) We will distribute risks identified in “what keeps me awake at night” to RMAC members to review and resubmit by May 1. Marsh’s Higher Ed Practice Leader, Jean Demchak, will moderate a risk prioritization session at our May 29 th meeting and demonstrate Marsh’s ERM Tool. Jean will review results at our June 26 th meeting. Administrators will assume risk ownership and Risk Management will provide guidance to the various areas of campus in risk identification and prioritizing of risks on an enterprise wide basis.

Questions ?