Enterprise Risk Management at Your School: Getting Started Constance Neary, VP for Risk Management, United Educators Debra Wilson, Legal Counsel, National Association of Independent Schools

Education’s Own Insurance Company Why Enterprise Risk Management (ERM)? Sustainability Preparedness Strategic planning Internal controls Mission 2/27/2014Enterprise Risk Management at Your School2

Education’s Own Insurance Company ERM Defined A collaborative process, led by senior leadership, that extends the concepts of risk management and includes:  Identifying risks across the entire enterprise  Assessing the impact of risks to the operations and mission  Developing and practicing response or mitigation plans  Monitoring the identified risks, holding risk owners accountable, and regularly scanning for emerging risks 2/27/2014Enterprise Risk Management at Your School3

Education’s Own Insurance Company ERM Process Call to Action Risk Identification Risk Assessment Mitigation Planning Report and Monitor 2/27/2014Enterprise Risk Management at Your School4

Education’s Own Insurance Company Key Players Board of Trustees  Audit Committee Head of School Senior Leadership  CFO or Business Officer Risk Owners Risk Management Committee 2/27/2014Enterprise Risk Management at Your School5

Education’s Own Insurance Company Step 1: Call to Action Communicate  Commitment to process  Importance to school  Enlist support and participation Key Roles  Board  Head of School 2/27/2014Enterprise Risk Management at Your School6 Call to Action Risk Identification Risk Assessment Mitigation Planning Report and Monitor

Education’s Own Insurance Company Step 2: Risk Identification Focus and scope  Ongoing process  1 st – Priority risks or existing risk register  2 nd – Dig deeper for additional risks Key Roles  CFO or Business Officer  Senior leadership 2/27/2014Enterprise Risk Management at Your School7 Call to Action Risk Identification Risk Assessment Mitigation Planning Report and Monitor

Education’s Own Insurance Company Independent School Risk Register Abuse of students/ interactions with adults Crisis management Curriculum redesign Employment practices Facilities/deferred maintenance Health center IT infrastructure International students School security Shifting demographics Study abroad programs 2/27/2014Enterprise Risk Management at Your School8

Education’s Own Insurance Company Step 3: Risk Assessment Evaluate  Likelihood risk will occur  Impact of risk on mission  Optional – velocity Risk scoring Key Roles  CFO and Business Officer  Senior leaders 2/27/2014Enterprise Risk Management at Your School9 Call to Action Risk Identification Risk Assessment Mitigation Planning Report and Monitor

Education’s Own Insurance Company Independent School Heat Map 1) Abuse of students 2) Crisis management 3) Curriculum redesign 4) Employment practices 5) Facilities management 6) Health center 7) IT infrastructure 8) International students 9) School security 10) Study abroad programs IMPACT LIKELIHOOD 2/27/2014Enterprise Risk Management at Your School10

Education’s Own Insurance Company Risk Score Score Risk IMPACT 1-2 Insignificant/Mid3 Moderate4-5 Significant/Catastrophic Minimal impact on annual operations, reputation or financial condition. Could delay plans in place, short-term programs affected, and require moderate management effort; 1-6 months’ recovery. Long-term and significant effect on ability to recruit students, faculty, financial support; material breach of confidence & reputation. x LIKELIHOOD 1-2 Unlikely3 More Likely4-5 High Probability Unlikely to happen in the near future and no immediate action is needed. More an likely to occur and management should begin to mitigate. High probability event/risk will occur within a year; immediate action plans needed. = TOTAL RISK SCORE 2/27/2014Enterprise Risk Management at Your School11

Education’s Own Insurance Company Step 4: Mitigation Planning Ownership Subject matter expertise Management plan with timetable Key Roles  Senior leaders  Other risk owners  RM Committee 2/27/2014Enterprise Risk Management at Your School12 Call to Action Risk Identification Risk Assessment Mitigation Planning Report and Monitor

Education’s Own Insurance Company Risk Management Plan/Report Date Name of Risk Owner Description of Risk Risk Score (likelihood X impact) Risk Objective/Treatment Risk Score after Treatment 2/27/2014Enterprise Risk Management at Your School13

Education’s Own Insurance Company Case Study: Study Abroad Programs Your school sends students on three school trips every spring break, which last roughly ten days. Two of the trips use host families and the third uses a third party vendor to manage travel around the country. Have you planned for these program risks? 2/27/2014Enterprise Risk Management at Your School14

Education’s Own Insurance Company Risk Assessment Ownership? Individual? Team? Overall risks?  Host family trips? Third party vendors? Others? Likelihood? Impact? Score? 2/27/2014Enterprise Risk Management at Your School15

Education’s Own Insurance Company Risk Management Planning Trip review and approval Training / Orientation – students, staff, and parents Host family vetting Third party vendor vetting Waivers and Releases / Informed Consent Insurance 2/27/2014Enterprise Risk Management at Your School16

Education’s Own Insurance Company Culture Points / Risk Dilemmas Host families – worth the risk? Third party due diligence? Transportation due diligence? Not all parents attend orientation session 2/27/2014Enterprise Risk Management at Your School17

Education’s Own Insurance Company Step 5: Report and Monitor Report to board  Top 5 to 10 risks  Approach with other risks Monitor progress  Questions followed by updates Key Roles  Board/Audit Committee  Head of School  CFO or Business Officer 2/27/2014Enterprise Risk Management at Your School18 Call to Action Risk Identification Risk Assessment Mitigation Planning Report and Monitor

Education’s Own Insurance Company Common Good Practices Branding the ERM process Tone at the top  Board and Head of School Limiting scope and mission creep Use of consultants Creating a discipline 2/27/2014Enterprise Risk Management at Your School19

Education’s Own Insurance Company Common Concerns and Pitfalls Micro-management by board Exposure to potential liability Appropriate use of legal counsel ERM as a project Over-emphasis on risk identification 2/27/2014Enterprise Risk Management at Your School20

Education’s Own Insurance Company All information provided is of a general nature and is not intended to address the circumstances of any particular individual or entity. No one should act upon this information without appropriate professional advice after a thorough examination of the facts of the particular situation. Copyright © 2014 by United Educators Insurance, a Reciprocal Risk Retention Group. All rights reserved. Contents of this document are for members of United Educators only. Permission to post this document electronically or to reprint must be obtained from United Educators. Constance Neary Vice President for Risk Management Two Wisconsin Circle, Fourth Floor Chevy Chase, MD