Terminology

Risk is defined as the potential for undesirable outcomes.

RISK INVENTORY is the document listing all of the enterprise risk items of concern to the institution at a point in time.

Enterprise risk management is defined as the practice of identifying, assessing, addressing, monitoring, and modifying risk of a strategic and operational nature across campus. This practice encompasses both the formal mitigation process as well as any informal efforts to reduce the impact and/or likelihood of potential undesirable outcomes relating to strategic or operational risk.

Traditional risk management seeks to reduce financial uncertainty. The options available include: tolerating the risk in its present state, treating the risk to reduce its potential financial impact or the likelihood of a financial impact, transferring the potential financial impact to others, and terminating the risk to avoid any financial impact. Risks of this nature are usually limited to those with “first-party” (property) loss potential, and those with “third-party” (legal liability) loss potential. The most frequently used approach to managing traditional risk is to purchase insurance. Doing so reduces the institution’s financial uncertainty.

Risk mitigation is the process of taking action to reduce the impact and/or likelihood of potential undesirable outcomes.

RISK MONITOR is the document listing risk items that have been removed from the Risk Register (the result of successful mitigation efforts) and are now less of a concern. Nonetheless, enough concern remains to continue treating and monitoring the risk.

RISK OWNER is the person (or persons) designated as having primary responsibility for addressing a particular risk. A single individual is chosen as LEAD RISK OWNER. for risks with multiple risk owners.

RISK REGISTER is the document listing the enterprise risk items considered to be the most serious at a point in time. The Risk Register is a sub-set of the Risk Inventory.

Each risk entering the formal risk mitigation process will have a RISK SUMMARY WORKSHEET completed by its designated risk owner(s).
Submissions for consideration of items as additions to the Risk Inventory shall begin with the completion of a risk summary worksheet by the party or parties concerned.

Every item on the Risk Register will have a risk summary worksheet completed/updated by a risk owner at least annually. These risk summary worksheets and any subsequent updates become part of the RISK ROLL-UP REPORT. Updates to risk summary worksheets are expected to be completed annually at a minimum. The Risk Summary Roll-Up Report is also updated annually at a minimum.

A mitigation scoring rubric establishes a numerical representation of progress toward risk mitigation goals for each risk on the Risk Register. These scores are displayed on a color-coded bar chart known as the RISK MITIGATION PROGRESS DASHBOARD.
This Dashboard is updated as risk summary worksheet updates are received. It is presented to the Board of Trustees and President for review at least on an annual basis.

A. IDENTIFY – Issues perceived to have the potential for significant adverse impact on the institution are recommended for consideration.
B. ASSESS – Certain of these risks are selected to be formally assessed for potential impact and likelihood.
C. ADDRESS – Following a formal assessment, individuals are assigned oversight and ownership responsibilities for actions currently being taken, and actions under consideration, to reduce the potential impact and likelihood of undesirable outcomes.
D. MONITOR – Mitigation actions are monitored by those with risk oversight responsibilities along with the institution’s senior leadership team. Establishing and tracking measurable milestones are parts of the institution’s formal risk mitigation process. Measurable milestones are established to gauge progress toward risk mitigation goals.
E. MODIFY – Risk mitigation actions that are not satisfactorily progressing toward intended mitigation goals are modified.