Risk and Risk Management

1. Risk and Risk Management

2. An intentional risk culture “Inherently, risk is neither good nor bad. Rather, how we approach risk defines the result.  “We need to identify, understand, and mitigate risks that could cause harm. At the same time, we must be open to risks that drive opportunity. Therefore, developing an intentional risk culture is equally as important as developing policies and practices that protect our students.” Donna Orem, “Developing a Risk Culture to Support School Mission and Vision,” Independent Ideas Blog (May 2019)

3. Benefits of risk management • “By proactively identifying and addressing potential issues before they occur, risk management also helps your school stop managing by crisis, ensures a safer school environment, and provides reassurance that you are taking steps to mitigate [risks]. Sound risk management allows you to: • improve strategic decision making by providing a robust picture of [your] internal and external risk environment; • systematically ensure that you comply with applicable laws, regulations, and ordinances, while also managing the risks involved in your various legal and contractual relationships; • anticipate risks and minimize threats …; and • improve your overall institutional performance.” • Alex Miller, Constance Neary, and Debra P. Wilson, Advancing Risk Management at Independent Schools, NAIS and United Educators

4. Breaking the cycle of crisis management In the past few years, several factors—updates to the Fair Labor Standards Act, the onslaught of media coverage of old claims of sexual abuse, and a high-profile case involving school liability and international travel—“have triggered an array of crisis-response fire drills in the independent school industry.” “Responding to the latest crises can lead to internal inconsistencies, creating [greater risk]. Schools can get so distracted by everyday mini-crises that they fail to deal with their most important and relevant risks. “Institutional risk management, a process corporations and higher education have used for some time, can help schools break the cycle.” Debra P. Wilson, “The Risk Management Outlook,” 2017-2018 NAIS Trendbook

5. Finding opportunities in risk “By focusing on the downside of risk, companies can overlook opportunities that provide significant possibilities for organizational innovation and new competitive advantage. “The reality is that risk and opportunity are two sides of the same coin—and both require attention by those who want to survive and thrive in the current business climate. By knowing how to recognize, manage and innovate around risk, a world of opportunity is available to companies.” Tamara Bekefi, Marc J. Epstein, and Kristi Yuthas, “Creating Growth: Using Opportunity Risk Management Effectively,” Journal of Accountancy (June 1, 2008)

6. State of risk management in independent schools • Almost all schools see the importance of risk management, but most don’t have a way to assess risk. • In a 2016-2017 survey by NAIS and United Educators (a member-owned insurance company), nine out of 10 schools said that risk management was critically important. • Eighty-five percent of the survey respondents did not have a risk register to identify the risks most critical to the school’s mission. • CFOs/business officers generally lead risk management processes. • Two-thirds of the schools responding to the survey had a designated person to handle risk management. • At 81% of them, it was the CFO/business officer. • Debra P. Wilson, “The Risk Management Outlook,” 2017-2018 NAIS Trendbook

7. Barriers to risk management in independent schools Culture: Resistance to change and entrenched practices. “To many faculty and staff, ‘risk management’ seems like a vague corporate concept that has little applicability to their institution, its mission, or their jobs.” Silos: Resistance to an institution-wide approach from departments that previously owned discrete aspects of risk management Knowledge: Discomfort at advancing risk management because of lack of formal risk management training Resources: Lacking the resources (time and money) for risk management Alex Miller, Constance Neary, and Debra P. Wilson, Advancing Risk Management at Independent Schools, NAIS and United Educators

8. Risk exposure in independent schools • Insurance claims are largely GL-related: • 81% through GL policies • 19% through ELL policies • Of GL claims, athletics-related claims were the most numerous and assault-related claims the most costly: • 31% of claims are related to athletics. • 31% of total cost of claims relate to assaults. • Of ELL claims, the highest percentage and the highest amount of losses related to employee discrimination. • Debra P. Wilson, “The Risk Management Outlook,” 2017-2018NAIS Trendbook General Liability (GL) policies protect against liability related to injuries, property damage, etc., that are related to wrongful or negligent acts. Educators Legal Liability (ELL) policies cover employees, trustees, volunteers acting on behalf of the institution, and others at the school. These policies protect against claims of discrimination, wrongful employment practices, retaliation, and sexual harassment, among others.

9. Risk exposure in independent schools (cont.) Debra P. Wilson, “The Risk Management Outlook,” 2017-2018 NAIS Trendbook

10. Areas of risk (exposure and opportunity) in independent schools • Financial • Operational • Technological • Environmental • Regulatory • Compliance • Competitive strategic • Litigation • Reputational • Political • Cultural • Ronald C. Wanglin and Denise K. Gutches, “Enterprise Risk Management for Independent Schools,” Presentation at CAIS-CA Trustee/School Heads Conference (2014)

11. Level of risk management “For some time the corporate world, as well as some larger nonprofits, has engaged in an advanced form of risk management known as Enterprise Risk Management (ERM). ERM is a process led by senior leadership that extends the concepts of risk management across the enterprise. While aspects of ERM may be helpful, they are often too complex and overwhelming for most independent schools. From our perspective, risk management should develop naturally as your school’s traditional risk management program expands over time. As long as you work toward a collaborative, ongoing risk management program that repeatedly identifies, assesses, and manages risks across your institution, you are on the right track.” Alex Miller, Constance Neary, and Debra P. Wilson, Advancing Risk Management at Independent Schools, NAIS and United Educators

12. Enterprise risk management in higher education “Whereas risk management has historically been confined to specific domains (compliance, internal audit, safety, insurance) and often managed in silos, institutions today are realizing their risk portfolio is inherently interconnected…. Schools are finding they need the infrastructure—governance, data, processes, and culture—to be prepared for the threats (and opportunities) that will determine whether they can survive or thrive…. By taking an ‘enterprise’ approach to risk management, schools can be more proactive and prepared: avoiding, accepting, mitigating, sharing, or exploiting risk where possible, or responding more effectively when issues, incidents, and crises do materialize.” Deloitte, “Significant Risks Facing Higher Education: Taking an Enterprise Approach to Risk Management” (2018)

13. Risk areas in higher education Business Model Risks: Factors that impact the sustainability of higher ed include tuition dependency, education delivery mix, endowment rules/expectations, recruiting and targeting goals, etc. Reputation Risks: Risk factors, amplified by institutions’ increased presence in social media, include brand management, campus safety, and student activism. Operating Model Risks: Inadequate processes, people, and systems can affect an institution’s ability to function effectively. They can involve operational efficiency, third-party vendors, accreditation, facilities and asset management, talent management, etc.Enrollment Supply Risks: Enrollment can be impacted by immigration and federal policies, growing economic markets, market demand, rising student debt, etc. Compliance Risks: Higher ed faces a growing array of regulations. Deloitte, “Significant Risks Facing Higher Education: Taking an Enterprise Approach to Risk Management” (2018)

14. Key Concepts/Approaches

15. Diagnosing your risk culture “The Institute for Risk Management (IRM) suggests that, in designing a strong risk management program, every organization should first assess their current risk culture [shared values, beliefs, knowledge, and understanding about risk] and then define the culture they desire so that they can take deliberate steps to achieve the desired outcome. “By framing a risk management program in this way, schools can ensure that they are examining risk from both a harm prevention and opportunity lens simultaneously. Organizations with well-defined risk cultures will generally weather crises more effectively, as well as take appropriate risks during times of great change.” Donna Orem, “Developing a Risk Culture to Support School Mission and Vision,” Independent Ideas Blog (May 2019)

16. Diagnosing your risk culture (cont.) • Risk Culture Diagnostic Questions: • “What tone do we set from the top? Are we providing consistent, coherent, sustained, and visible leadership in terms of how we expect our people to behave and respond when dealing with risk? • How do we establish and maintain sufficiently clear accountabilities for those managing risks and hold them to their accountabilities? • What risks does our current culture create for the organization, and what risk culture is needed to ensure achievement of our goals? • Do we acknowledge and live our stated values when addressing and resolving risk dilemmas? Do we regularly discuss risk dilemmas in value terms, and does it influence our decisions? • How do our structure, processes, and reward systems support or detract from development of our desired risk culture?” Donna Orem, “Developing a Risk Culture to Support School Mission and Vision,” Independent Ideas Blog (May 2019)

17. Diagnosing your risk culture (cont.) • Risk Culture Diagnostic Questions: • “How do we actively seek out information on risk events and near misses and ensure key lessons are learned? Do we have sufficient organizational humility to look at ourselves from the perspective of stakeholders and not just assume we’re getting it right? • How do we respond to whistle-blowers and others raising genuine concerns? • How do we reward and encourage appropriate risk-taking behaviors and challenge unbalanced risk behaviors (either overly risk-averse or risk-seeking)? • How do we satisfy ourselves that new joiners will quickly absorb our desired cultural values and that established staff continue to demonstrate attitudes and behaviors consistent with our expectations? • How do we support learning and development associated with raising awareness and competence in managing risk at all levels?” Donna Orem, “Developing a Risk Culture to Support School Mission and Vision,” Independent Ideas Blog (May 2019)

18. Identifying opportunities Strategies to identify new opportunities and give consideration to those that have been neglected because of perceived, but unexamined, risk: “Learning from the past.... signals that were ignored, missed opportunities, and business surprises can provide insight into organizational blind spots. Customer sensitivity. Trying to understand customers in a way that the competition does not Learning from others.... Scanning [of the environment, potential competitors, etc.]... Scenario planning... Identifying market gaps and changing the game... Idealized design and competing in advance... Market sensitivity. Recognizing where and how the market is changing and moving quickly to adapt can be key to innovation.” Tamara Bekefi, Marc J. Epstein, and Kristi Yuthas, “Creating Growth: Using Opportunity Risk Management Effectively,” Journal of Accountancy(June 1, 2008)

19. Managing risk and preventing crises in independent schools: The risk management cycle “Implementing an official institutional risk management process provides a mechanism that prompts schools to do it proactively and on a schedule…. Essentially, risk management involves identifying risks, analyzing risks, treating risks, and monitoring the process. These tasks are completed in a cycle.” Debra P. Wilson, “The Risk Management Outlook,” 2017-2018 NAIS Trendbook

20. Managing risk and preventing crises in independent schools IDENTIFY RISKS: “Develop processes to identify risks and create a risk register, listing the risks your institution is committed to managing. You can identify a comprehensive list of risks or just start the risk management process by identifying three or four top risks.” ANALYZE RISK: “This analysis focuses on the likelihood that each risk will occur and the severity of its impact if it does occur. By evaluating risks in this way, you can decide how to respond to each risk and how to prioritize your efforts. Scorecards and heat maps can help.” Alex Miller, Constance Neary, and Debra P. Wilson, Advancing Risk Management at Independent Schools, NAIS and United Educators

21. Managing risk and preventing crises in independent schools (cont.) TREAT RISK: Treat risk by “avoiding, mitigating, transferring, retaining, or accepting each risk or using some combination of these options. For example, you could address the risk of sexual molestation by training employees on reporting requirements while transferring the financial risk through insurance coverage. The result of this step is a treatment or mitigation plan that your school commits to implementing.” MONITORING THE PROCESS: “Through monitoring, your school continually assesses how environments have changed and whether risk treatments are working as expected.” Alex Miller, Constance Neary, and Debra P. Wilson, Advancing Risk Management at Independent Schools, NAIS and United Educators

22. Keys to actionable risk management “Commit to a sustained and sustainable process. Know your resources. Keep your process manageable. Focus on your most urgent risks. Engage your stakeholders.” Alex Miller, Constance Neary, and Debra P. Wilson, Advancing Risk Management at Independent Schools, NAIS and United Educators

23. Keys to actionable risk management (cont.) Commit to a sustained and sustainable process.“Every institution can sustain some level of effort by gearing the scope of risk management to its available resources. Whether that means starting with a single risk or a dozen, it is possible to create an ongoing process that will be successful at your institution. Whatever process your institution uses to manage risk, the most important thing is to repeat it regularly, at least once each year.” Alex Miller, Constance Neary, and Debra P. Wilson, Advancing Risk Management at Independent Schools, NAIS and United Educators

24. Keys to actionable risk management (cont.) • Know your resources. “Who will be performing risk management, and how much time will that person have to spend on it?” • Risk committees: A successful risk management committee will assist—and not inhibit—the business officer in the risk management process…. [The committee often includes] facilities staff, human resources, public safety, dean of students, and faculty.” 24% of schools have a risk management committee. • Other help [such as]individual risk owners and outside consultants: 28% of schools have hired an outside consultant, [most often] in areas of specific expertise (e.g., playground safety/building security). • Existing efforts: Identify current risk management practices. • Help from peers: “Invite risk managers or business officers from other schools to walk around campus and talk about what they see.” Alex Miller, Constance Neary, and Debra P. Wilson, Advancing Risk Management at Independent Schools, NAIS and United Educators

25. Keys to actionable risk management (cont.) Keep your process manageable. Three common approaches, each with its own pros and cons: Top down: “School leadership, often with input from the board of directors, decides which risks pose a significant threat [or present opportunities] to the school.” Bottom up: “The bottom-up approach involves a wider swath of your institution’s community. Your school uses interviews, workshops, audits, or surveys to poll faculty and staff on risks.” Middle: “The business officer or risk manager does not receive assistance from above or below.” Alex Miller, Constance Neary, and Debra P. Wilson, Advancing Risk Management at Independent Schools, NAIS and United Educators

26. Keys to actionable risk management (cont.) • Focus on your most urgent risks. • “Early on, it is important that your risk management process create demonstrable value for your institution…. Evaluate your risks. Start by measuring their likelihood and impact so you can prioritize addressing them: • Likelihoodrefers to the probability an incident involving a specific risk will occur at your school within a specific time period (typically one year). • Impactrefers to the likely magnitude of harm if the risk does occur.” Alex Miller, Constance Neary, and Debra P. Wilson, Advancing Risk Management at Independent Schools, NAIS and United Educators

27. Keys to actionable risk management (cont.) Engage your stakeholders. “Over time you will need to involve more stakeholders in your mitigation and monitoring efforts…. One way to address [cultural barriers to] risk management is to show how it is central to your institution’s mission and goals.” Alex Miller, Constance Neary, and Debra P. Wilson, Advancing Risk Management at Independent Schools, NAIS and United Educators

28. Four common risks schools should avoid 1. Employee practices: Hiring, firing, and basic communication “Having clear processes for hiring, firing, and employee communications can help reduce your risk…. When it is necessary to terminate an employee who has not performed to your school’s standards, there must be a well-documented trail of failed goals and missed opportunities.” 2. Insurance policies: Broker relations and basic insight “The nuances of different policies are easily overwhelming for even the most seasoned administrators. Finding a trusted broker is key…. You should know what policies you currently have, what events are covered, and what events are not … and what is included in your school’s portfolio [of health care coverage].” ISM, “Four Common Risks All Schools Should Avoid” (February 28, 2019)

29. Four common risks schools should avoid (cont.) 3. International student programs: Homeland Security compliance “Your school’s PDSO [Principal Designated School Official] is responsible for maintaining the Student and Exchange Visitor Information System (SEVIS) with accurate and current information…. Although you might work with an agent who takes on the responsibility of obtaining student information, it is your school’s responsibility to maintain and accurately report these records.” 4. Crisis communication: Too much, too little, all the wrong channels “A well-crafted crisis communication plan will define: who is part of the communication chain if (and when) there is an emergency, how messages will be delivered (for example: phone, text, email, social media), what is in your school’s crisis communication tool kit, and some pre-prepared responses for media questions.” ISM, “Four Common Risks All Schools Should Avoid” (February 28, 2019)

30. The board’s role in risk management • “When trustees make risk management part of the board’s agenda, they send a message throughout the school community that risk management is part of everyone’s responsibilities, … a school-wide priority.” • Frame the program “Once the board sets risk appetite or tolerance parameters, it establishes the framework of the program to keep risk within acceptable limits. The board should encourage development of a program that is comprehensive but realistic. • Establish risk priorities“Trustees will need information on the frequency of risks and the likely severity of risk repercussions in order to decide which risks are the most pressing for the school to address … often available through the school’s insurance broker or company [and data from government agencies].” • Laura A. Kumin, “The Roles of Trustees and Heads in Managing Risk,” NAIS Advisory

31. The board’s role in risk management (cont.) • Approaching risk: Cost/benefit analysis “As fiduciaries, trustees must decide how to use the school’s finite resources to the best advantage in a risk management program. Cost/benefit analysis is a useful tool to determine the relative costs of managing different risks and the cost of achieving an acceptable level of risk in a given area.” • Support the head: “Board support for the head’s effort to manage risk is critical, particularly in areas that affect reputation and relationships within the campus community.” • Fulfill the leadership role “Board members can also help in their individual capacities by making their professional expertise available.” Laura A. Kumin, “The Roles of Trustees and Heads in Managing Risk,” NAIS Advisory

32. NAIS advisories that address specific areas of risk: • Recommendations for Independent School Leaders From the Independent School Task Force on Educator Sexual Misconduct (2018) • Minimizing the Legal Risks in Reductions in Force (2011) • The ADA and Independent Schools (2016) • The Admissions Process: What Can We Ask? What Should We Do? (2018) • “Risk Management for Study Abroad and Domestic Trips for Students,” Independent Ideas Blog (Feb 19, 2019)

33. Resources • Donna Orem, “Developing a Risk Culture to Support School Mission and Vision,” Independent Ideas Blog • Alex Miller, Constance Neary, and Debra P. Wilson, Advancing Risk Management at Independent Schools, NAIS and United Educators • Debra P. Wilson, “The Risk Management Outlook,” 2017-2018NAIS Trendbook • Tamara Bekefi, Marc J. Epstein, and Kristi Yuthas, “Creating Growth: Using Opportunity Risk Management Effectively,” Journal of Accountancy • Ronald C. Wanglin and Denise K. Gutches, “Enterprise Risk Management for Independent Schools,” Conference Presentation • Deloitte, “Significant Risks Facing Higher Education: Taking an Enterprise Approach to Risk Management” • ISM, “Four Common Risks All Schools Should Avoid” • Laura A. Kumin, “The Roles of Trustees and Heads in Managing Risk,” NAIS Advisory • The Independent School Task Force on Educator Sexual Misconduct, Recommendations for Independent School Leaders From the Independent School Task Force on Educator Sexual Misconduct • NAIS, Minimizing the Legal Risks in Reductions in Force • NAIS, Americans with Disabilities Act and Independent Schools • NAIS,The Admissions Process: What Can We Ask? What Should We Do? (2018) • NAIS, “Risk Management for Study Abroad and Domestic Trips for Students,” Independent Ideas Blog(Feb 19, 2019)