1. Why is Risk a Four Letter Word? CSG – January 2014

2. Presenters John Spadaro (Brown) Charley Kneifel (Duke) Susan Kelley (Yale) Steven Sather (Princeton) Donna Tatro (Princeton) Risk – Volunteering to participate in a panel – and being the only one to make it.

3. Defining Risk There is a general body of work Gartner, Harvard Business Review, Sandman, … Peter Sandman Risk = Hazard + Outrage High Outrage Reputational risk using Healthcare.gov as the worst case scenario Fracking / Fracking Communication Earlier Discussions Discussion about innovation from Wednesday afternoon – Discussion about change management

4. Risk = Hazard + Outrage Safe Voluntary Natural Familiar Not Memorable Not Dreaded Chronic Knowable Individually Fair Morally Irrelevant Trustworthy Sources Responsive Processes Risky Coerced Industrial Exotic Memorable Dreaded Catastrophic Unknowable Controlled by Others Unfair Morally relevant Untrustworthy Sources Unresponsive Process Peter Sandman (psandman.com)

5. Is All Risk Bad? Some risk is good – fostering innovation Is risk bad if it is changing how we run our general ledger? Balance between ITIL and Innovation – are they compatible? Every new service needs X, Y, Z before going into production Is everything a beta or … (anecdote about CoLab) What’s the process here – does the audience have defined processes and owners for identifying, calculating, documenting, assessing risk? What is IT doing to keep up the speed and balance the risk? Agile development? However, being innovative should not be a “get of jail free card” for not following ITIL processes when called for -

6. Some Discussion Points The line between IT and business risk is disappearing; risk and accountability for risk acceptance should be owned by the business units Per Sandman, do we overestimate risk because of outrage Lack of transparency over how we estimate / measure risk Lack of overt governance of risk acceptance and risk driven investment Some percentage of the project portfolio should be allocated to higher risk / potentially high return initiatives (again with transparency and intent) What’s the right balance between risk and reward – what’s the real risk (back to conversation about how do we measure risk)