If Covid-19 has taught us nothing else, risk management is a necessity in a world where the rate of change has increased exponentially.
Ultimately, effective management of risk helps schools achieve their objectives, while remaining better able to respond and adapt to surprises and disruptions. The management of risk is an indispensable and integral part of decision-making and subsequent execution.
Enterprise Risk Management (ERM) helps school boards and administration ensure their school makes the best decisions and achieves its objectives.
ERM is about securing “early mover” positioning in the marketplace through understanding or realization of the key assumptions underlying strategy as well as monitoring changes in the business/educational environment to ensure that these assumptions remain valid over time. Now more than ever, key assumptions need constant evaluation to ensure they remain valid.
It is not what schools know that matters; it is what they don’t know that makes the difference. It is therefore imperative to have an approach to assessing and identifying emerging risks.
A school needs a strategic perspective applied to operational risks. There is a need for an end-to-end extended enterprise view of how a school functions, with consideration for all aspects of the community and its relationships. This is essential to have an understanding of what will happen if any critical component of the school is lost for an indeterminate period.
Sooner or later, there will be a crisis that will test your school (yes, another one!). Even the most effective risk management cannot prevent this exposure. Schools may spend a lot of time guessing at probabilities, ERM will not only help with this work but also assess the speed of impact, the persistence of impact over time and the organization’s response readiness.
School administrators and the board may struggle with delineating between risk management and risk oversight. It makes sense to start both risk management and risk oversight at the same place – with the formulation of strategy, including an understanding of the key assumptions underlying the strategy. An effective functioning risk management process is important because it can help address these realities.
The structure of this process is easy to follow and will generally involve the following steps:
Identifying and ranking the risks inherent in the school’s strategy (including its goals and appetite for risk)
Selecting the appropriate risk management approaches and transferring or avoiding those risks which the school is not competent or willing to manage
Implementing controls to manage the remaining risks
Monitoring the effectiveness of risk management approaches and controls
Learning from experience and making improvements.
What is crucial to the success of the process is that risk needs to be addressed at all levels in the school and across all functions – it should be covered in some detail, yet it also needs to be co-ordinated at a school-wide level.
The risk management process is simply illustrated in Figure 1 below:
Risk needs to be managed at all levels in the school and across all functions – it should be covered in some detail, yet it also needs to be co-ordinated at a school wide (enterprise) level.
Pre-requisites to setting up the ERM process
It is critical for the school board to realize that ultimately managing risk is their responsibility and they should champion this work. The head of school and their administration is responsible for establishing and operating the risk management framework on behalf of the board.
The school’s business manager or head of school tends to add the role of risk management to his or her other responsibilities. This role should be undertaken by a risk management committee as although the head of school or business manager should undoubtedly be involved in most aspects of risk management, it is not ideal that he or she is solely responsible for risk throughout the school as they are not involved in all aspects (and aware of the risks).
The members of the risk management committee will be diverse; from the Board, the operations, and the school divisions. This committee will manage the school wide control of risks within the framework that has been set up to do this work.
Does my school need outside help?
Whilst we at Sage Consultancy would strongly recommend engaging us for our Enterprise Risk Management Services, it is not critical to employ a consultant to conduct risk assessment or set up an ongoing ERM process.
Indeed, the institute of Risk Management has produced the document ‘A risk management standard’ (which is in 14 languages and is free to download from their website). However, professional assistance from an outside resource will result in a more thorough and thoughtful outcome.
What we have found is that for smaller schools there are not the internal resources (time and personnel ) to set up and help monitor an ERM process, and in larger schools their size often means that the establishment and coordination of ERM is too unwieldy for any one person or team. This often leads to a failure to set up any risk management process until it is too late and a crisis leaves the school dealing with a loss of reputation, enrollment and income (or all three).
Finally, it is a known phenomenon that boards and finance committees often respond more favorably to research, reports and proposals from outside consultants than to internal procedures. The use of a "fresh pair of eyes", and the involvement of well experienced ERM practitioners using a process honed and tested across other schools, will also give the process a professional edge and credibility.