Best Practices and Good Ideas for Engaging Your Board in ERM

Transcription

1 Best Practices and Good Ideas for Engaging Your Board in ERM Moderator Susan Johnston Executive Vice President Association of Governing Boards Panelists Richard Cordova Executive Director, Internal Audit University of Washington Leigh Goller Executive Director, Audit, Risk & Compliance Duke University Horacio Valeiras Member, Board of Visitors Virginia Tech University Boards and Risk Management 45% of board members, presidents, and CFOs strongly agree that risk management is a priority at their institutions. 44% report that discussions occur as needed. 39% report that their institution conducted an ERM process in the last two years. 39% say they are getting enough information about risk. 25% say the institution is doing a good job of identifying, assessing, and planning for institutional risk. A Wake Up Call: Enterprise Risk Management at Colleges and Universities Today, AGB/UE,

2 How Effectively Do Boards Oversee Institutional Risk? Strongly Agree or Strongly Disagree Unsure Agree or Disagree The board has organizational oversight of risk in our institution. 87%** 13% 0% Our institution has a formal ERM process. Our ERM process is effective. 70% 29% 1% 92% 7% 1% **Compares to 33% in Board Discussion of Major Risks Board members and senior administrators regularly discuss major risks identified through ERM Survey 2016 Survey Every board meeting 9% 24% Every year 24% 28% Every other year 3% 2% As needed 51% 36% None of the above 14% 7% Other 11% 3% 2

3 Board Engagement in ERM Overly engaged 2% Somewhat over engaged 4% Appropriately engaged 61% Somewhat under engaged 26% Not actively engaged 6% Do not know/ Not sure 1% Where Do Board Level Discussions of Risk Occur? 1. Audit Committee 6. Student Affairs Committee 2. Full Board 7. Academic Affairs Committee 3. Finance Committee 8. Facilities Committee 4. Executive Committee 9. Governance Committee 5. Investment Committee 10. Development Committee 11. Risk Committee 3

4 Who Leads the Institution s ERM Process? President 17% Financial/administration officer 40% Chief risk officer 12% Chief compliance/audit officer 5% Chief legal officer 2% Chief academic officer/provost 0% Other 5% A shared responsibility of two or more people 19% Importance of Reputational Risk Reputational risk is more important to this institution/system now compared to three years ago. Strongly Agree 32% Agree 52% Disagree 16% 4

5 Campus climate, diversity, protests Sexual assault, Title IX Financial, business model, enrollment Top Three Reputational Risks Last 3 Years Next 3 Years Board Engagement with Reputational Risk STRONGLY DISAGREE 2 DISAGREE 41 AGREE 48 STRONGLY AGREE Source: AGB/UE 2017 Board Survey 5

6 Best Practices and Good Ideas for Engaging Your Board in ERM Moderator Susan Johnston Executive Vice President Association of Governing Boards Panelists Richard Cordova Executive Director, Internal Audit University of Washington Leigh Goller Executive Director, Audit, Risk & Compliance Duke University Horacio Valeiras Member, Board of Visitors Virginia Tech University Risk Management Process Evolution 2005: What is risk? Develop common risk language and assessment tools 2010: What is the risk? Mature risk assessment process and discussion of risks Emphasis on risk awareness and comparison with other risks Track changes over time to evaluate mitigation strategy : What is the risk strategy? Leverage ongoing discussion of risks to evaluate risks across silos and prioritize resources Recognize complexity and interdependency of the risk landscape Expect relative risks evaluation and prioritization across silos Focus on active risk management: what we do in addition to what we know about our risks in the shortand long term horizons 6

7 Risk Universe and Board Engagement Risk Universe and Board Engagement Risk Universe and Board Eng Risk Dashboard Assessment Area Name & Year 1 Statement 1 2 Statement 2 3 Statement 3 4 Statement 4 5 Statement 5 6 Statement 6 7 Statement 7 8 Statement 8 9 Statement 9 10 Statement Statement Statement 12 Tolerance/ Appetite Adaptability Risk Owner(s) H/M/L H/M/L Legend: Risk level assignment (no change from prior year) NEW New risk statement Risk increased within tier compared to prior year assessment Risk decreased within tier compared to prior year assessment Risk increased to next tier compared to prior year assessment Risk decreased to next tier compared to prior year assessment 7

8 Risk Profile Title 8