Risk Management and the role of the Audit Committee Ian Gross Head of Internal Audit & Projects Risk Management and the role of the Audit Committee Higher Education Funding Council for England

What is risk? A risk is: ‘the threat or possibility that an action or event will adversely or beneficially affect an organisation’s ability to achieve its objectives’. All HEIs have (or should have) objectives

What is risk management? Risk management is defined as ‘the systematic application of management policies, practices and procedures to the task of analysing, assessing, treating, monitoring and reporting on risks’.

Is risk management really new? Yes and no Understanding risks is not new at all - most of us have an inherent understanding of risk ; e.g. health and safety risk assessments are well established; audit and others use it However, risk management in a corporate governance sense is new. It promotes ownership of the RM process at a high level

Why manage risks? It supports the achievement of objectives It allows higher risks to be taken It reduces the chance of serious errors Risks exist at all levels: corporate/strategic, faculty, departmental, functional, personal, project . . . . So we all need to be risk managers in a way appropriate to our own responsibilities

Benefits of risk management

Why now? Implementing the latest development in corporate governance (Turnbull report) All sectors in the economy are now doing it Ongoing process of promoting good practice Accountability burden - promotes ownership of internal control and helps to provide assurance to stakeholders

Why use in HE? Improve management within HE sector Help maintain/enhance the reputation of HE It is good practice Helps encourage innovation (= risk taking) Contributes to the management of change It’s not just about financial risks, but all kinds including academic reputation

What are the types of risk in HE?

What have we done about it? Accounts direction - three year transition Briefing for senior managers/governors Hands-on guide Web-based material case studies model policy illustrative list of risks

What do we expect HEIs to do? Obtain senior manager & governor commitment and agreement to policy Establish approach, plan and commence implementation Start to embed process at all levels Manage, monitor and report on main risks Achieve balanced risk portfolio

Audit Committees & Risk Management - 1 Ensure the Committee has an independent appreciation of what constitutes good practice in risk management, e.g. by considering: - the Turnbull report & HEFCE guidance - the use of independent training for members - advice from other sources e.g. CUC - how risk management works in your own organisations.

Audit Committees & Risk Management - 2 Ensure the Committee is well informed about the University’s approach to risk management, e.g. by: - ensuring the internal auditors conduct reviews of the risk management arrangements (see HEFCE advice) - asking the Vice Chancellor, senior managers and/or the risk co-ordinator to explain aspects of it periodically . . . .

Audit Committees & Risk Management - 2 - considering the comments made by HEFCE at its periodic institutional review - ensuring the external auditors plan to satisfy themselves on the adequacy of risk management - asking for high-level risk owners to make presentations to the Committee about “their” risks . . . .

Audit Committees & Risk Management - 2 - asking for departmental and functional heads to make presentations to the Committee - making risk management a standing item on the Committee’s agenda - ensuring the Clerk to the Committee is well informed about risk management issues - asking to see the corporate level risk register periodically (say, annually)

Audit Committees & Risk Management - 2 - asking to see subsidiary risk registers and/or risk assessments periodically (e.g. for a large capital project or a re-organisation or a new IT/estates/research strategy) - ensuring that management uses risk management in a positive way, e.g to help assess opportunities arising.

Audit Committees & Risk Management - 3 Test the effectiveness of the risk management arrangements in place where appropriate, e.g. by: - enquiring how a risk assessment was actually carried out - questioning the effectiveness of the mitigating controls - directing the internal auditor’s work towards risks of concern to the Committee . . . .

Audit Committees & Risk Management - 3 - asking to see the results of the Vice Chancellor’s annual review of the effectiveness of internal control - asking for periodic monitoring reports on the high-level (and other significant) risks - ensuring that ‘early warning indicators’ are in place where appropriate - seeking management assurances on mitigating controls, further actions and residual risks . . . .

Audit Committees & Risk Management - 3 - ensuring that all corporate objectives are adequately mapped against risks - ensuring that there is a process in place to identify new or emerging risks - challenging the treatment of residual risks - ensuring that ‘further actions’ identified in the risk management process are actually undertaken . . . .

Audit Committees & Risk Management - 3 - enquiring how well risk management is embedded throughout the University and identifying areas where risk management is weak.

Audit Committees & Risk Management - 4 At the year end (November/December meeting) the Committee should: - review the Vice Chancellor’s statement of internal control and the process behind it - review the internal auditor’s annual report - review the external auditor’s management letter - report to the University Council on the effectiveness of the risk management arrangements

Audit Committees & Risk Management - 5 In summary, the Committee should: - familiarise itself with risk management - catalyse risk management - ensure appropriate audit work is undertaken - review information on risks and risk management - review internal and external audit reports - review corporate governance statements - report to the governing body.