Huge Management Challenge

1. Enterprise Risk Management:What is it and Why Relevant to Higher Education?Mark BeasleyDeloitte Professor of Enterprise Risk ManagementNC State University

2. Huge Management Challenge Declining Resources Slowing Demand for College Grad Value of Research in Question Endowment Challenges Urbanization Attract / Retain Faculty Expertise Population Growth New Delivery Competitors (for profit) Online Open Access (MOOCs) Athletics Physical Security / Public Access

3. Huge Management Challenge Increasing Expectations and Greater Demands for Transparency Declining Resources Slowing Demand for College Grad Value of Research in Question Endowment Challenges Urbanization Attract / Retain Faculty Expertise Population Growth New Delivery Competitors (for profit) Online Open Access (MOOCs) Athletics Physical Security / Public Access

4. How easy would it be to articulate your institution’s process for managing risks? 1 2 3 4 5 6 7 8 9 10 Very Very Difficult Easy

5. Real Question:Is Risk Management viewed as Compliance Exercise Loss Prevention – Risk Mitigation Strategic Tool Driver of Innovation for Long-Term Viability

6. Strategic View of Risk Management Range of Uncertainty What is your institution’s process for monitoring and responding to emerging uncertainty surrounding core value drivers? Time Core Drivers of University’s Success Observe Performance Later

7. Traditional Risk Mgt Approach Housing/Food Service Teaching Security and Safety Research Human Resources IT Risks Legal Risks Reputation Risks Admissions Delivery Funding Compliance

8. Are Silos Accounting for This? Interconnected – with a cascading impacts Declining Resources Slowing Demand for College Grad Value of Research in Question Endowment Challenges Urbanization Attract / Retain Faculty Expertise Population Growth New Delivery Competitors (for profit) Online Open Access (MOOCs) Athletics Physical Security / Public Access

9. Does Process Apply a Strategic Lens to Risks? Range of Uncertainty Emerging Competitors Fundamental Shift in Role of Higher Ed Permanent Funding Reductions Time Core Drivers of University’s Success Observe Performance Later

10. Embracing Enterprise Risk Management for Long-Term Value • ERM is a process, effected by an entity’s board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, manage risks to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives. • Committee of Sponsoring Organizations of the Treadway Commission • (COSO 2004) (see www.coso.org) Strategic Purpose

11. Starts Here Strategic Risk Framework Business Model and Strategy Controls, Communication, and Monitoring Risk Identification Internal Environment Risk Response Risk Assessment Source: The Committee of Sponsoring Organizations of the Treadway Commission

12. Start with Understanding Key Value Drivers Increased Funding/Resources Mission and Brand of University Your “Sweet Spot” Cost and Efficiency Savings

13. Identify Business Drivers and New Initiatives Flagship University Status & Funding What are current drivers of mission and brand? Increased Funding/Resources World Renowned Faculty Mission and Brand of University National Applicant Base What are strategies to grow mission and brand? Promote Research In Emerging Technologies Cost and Efficiency Savings Embrace Flexible Delivery Models Increase International Partnerships

14. To what extent is that picture clear for senior management and board? 1 2 3 4 5 6 7 8 9 10 Not at Very All Much So

15. Analysis of Business Model & Strategies • What must go right for “crown jewels” and strategies to achieve success? • Key inputs • Key processes and technologies • Key people • Key expectations

16. Analysis of Business Model • What assumptions are we making about ability to sustain value? • How assumptions developed? • Impact if assumptions are volatile? • How changes in assumptions currently monitored?

17. You are positioned to understand and influence the view of these issues

19. Strategic Risk Framework Business Model and Strategy Controls, Communication, and Monitoring Risk Identification Internal Environment Risk Response Risk Assessment Source: The Committee of Sponsoring Organizations of the Treadway Commission

20. Identify Business Drivers and New Initiatives Potential Risks Flagship University Status & Funding Increased Funding/Resources World Renown Faculty Potential Risks Mission and Brand of University National Applicant Base Potential Risks Promote Research in Emerging Technologies Cost and Efficiency Savings Potential Risks Embrace Flexible Delivery Models Potential Risks Increase International Partnerships

21. Strategic Lens to Sustainability Risks • What might emerge and impact critical elements for“crown jewels” and strategies to be successful? • Processes, people, technologies • How might assumptions shift? • Impact if Volatile, How Monitored? Risks and Opportunities

22. Time Horizon 2 to 3 Years 10-15 years Short-term and Long-term issues

23. Identifying Key Risks – A Variety of Methods Interviews Workshops Risk & Opportunity Inventory Surveys and Checklists Scenario Analysis Internal/External Audit

24. “Pre-Mortem” Analysis Identify 3 of the most like causes for your college or university October 2, 2023 New York – Just ten years ago, the reputation and brand of faculty and students at Your University were at all time highs with no end in sight. What a difference a decade makes, with Your University’s reputation and brand significantly tarnished…..

26. Strategic Risk Framework Business Model and Strategy Controls, Communication, and Monitoring Risk Identification Internal Environment Risk Response Risk Assessment Source: The Committee of Sponsoring Organizations of the Treadway Commission

27. How confident are you that senior management and board have consensus view of top 10-15 biggest risks for university? 1 2 3 4 5 6 7 8 9 10 11 Not at Very All Confident

28. Likelihood Scale

29. Impact Ratings Potential impact over the next 2 years (Rating, Definition, Examples): 1. Negligible – Examples: Virtually no change in funding; very little, if any, impact on quality of student applicant profile ; very little, if any, impact on faculty recruitment and retention; no significant negative media attention or harm to reputation; peer ranking unchanged; and/or development fundraising goals still met. 2. Minor – Examples: 5-9% dip in funding; slight drop in student applicant quality; minor drop in recruitment and retention; a few negative media stories lasting 1-2 days in local media outlets; drop of 3-5 places in peer rankings; and/or 5% drop in development fundraising. 3. Moderate – Examples: 10-15% drop in funding; noted reduction in applicant quality; moderate drop in recruitment and retention; negative media stories in statewide media outlets; drop of 6-8 places in peer rankings; and/or 6-9% drop in development fundraising. 4. Serious – Examples: 15-19% drop in funding; 10% drop in applicants and drop in applicant quality; departure of key faculty and loss of corresponding grants; negative news stories lasting up to a week in statewide media outlets; drop of 9-11 places in peer ranking; and/or drop of 10-15% in development fundraising. 5. Catastrophic – Examples: 20% or more drop in funding; 15% or more drop in number of applicants; loss of AAU membership; accelerated departure of key faculty and loss of corresponding grants; breaking negative news stories carried by major state and/or national media outlets and for extended period of time; drop of 12 or more places in peer ranking; and/or drop of 16% or more in development fundraising.

30. Other Issues to Consider Velocity – speed of onset Persistence/Momentum Preparedness

31. Prioritized Inventory of Risks Tier 1 – top 10 Tier 2 – top 20 Other

32. Strategic Risk Framework Business Model and Strategy Controls, Communication, and Monitoring Risk Identification Internal Environment Risk Response Risk Assessment Source: The Committee of Sponsoring Organizations of the Treadway Commission

33. Risk & Return Opportunity to Connect Risks and Opportunities

34. Choose Your Risk Response • Tolerate • Risk Acceptance • Terminate • Eliminate or avoid risk • Transfer • Risk Sharing • Treat • Mitigate or control risks

35. Example of “Bow-Tie” Analysis PROACTIVELY MANAGING “CAUSES” PROACTIVELY MANAGING CONSEQUENCES

36. Strategic Risk Framework Business Model and Strategy Controls, Communication, and Monitoring Risk Identification Internal Environment Risk Response Risk Assessment Source: The Committee of Sponsoring Organizations of the Treadway Commission

37. KPIsvs. KRIs Historical Forward Looking

38. Goal of KRIs… Help provide “peak around the corner”

39. Proactive Management of Emerging Risks Range of Uncertainty KRIs Trigger Points Time Core Drivers of Value Revise Strategies

40. Creating Dashboards

41. KRIs to Monitor Emerging Risks Potential Risks Flagship University Status & Funding KRIs Increased Funding/Resources World Renown Faculty Potential Risks KRIs Mission and Brand of University National Applicant Base Potential Risks KRIs Promote Research in Emerging Technologies Cost and Efficiency Savings Potential Risks KRIs Embrace Flexible Delivery Models Potential Risks KRIs Increase International Partnerships

42. Strategic Risk Framework Business Model and Strategy Controls, Communication, and Monitoring Risk Identification Internal Environment Risk Response Risk Assessment Source: The Committee of Sponsoring Organizations of the Treadway Commission

43. Culture is King

44. Perceived Barriers to ERM

45. Leadership • Champion is facilitator – not the risk manager • Lead and educate university leaders on risk management processes • Need executive endorsement • E.g. - Letter from Chancellor or board • Leverage existing risk functions • Look for opportunities to build on existing infrastructures (e.g. Balanced Scorecard) • Develop risk mindset throughout day-to-day decision-making • Challenge – linking performance incentives with risk management

46. Strategic Risk Framework Business Model and Strategy Controls, Communication, and Monitoring Risk Identification Internal Environment Risk Response Risk Assessment Source: The Committee of Sponsoring Organizations of the Treadway Commission

47. 1st Page of Google Search on “ERM” Interested in Learning More….www.erm.ncsu.edu About 12,500 Visitors a month

48. Mark S. Beasley Deloitte Professor of Enterprise Risk Management NC State University Mark_beasley@ncsu.edu 919.515.6064 www.erm.ncsu.edu