Policy Title Risk Management Policy Policy Number -0 Functional Field Related Policies Responsibility of Issuing Office Governance and Management Policy of Making University Policies Risk Management Office Quality Assurance Office Status Active In-revision Proposed Draft # Draft # Approved By Approval Date Effective Date Academic Council and University Council Approved by AC on th January 0, Res. no. AC/0-//. Approved by UC on --0, qarar no.6/0. Revision History Number Date By Main Changes Revision # 9//0 Dr. Salim Al-Harthi in consultation with QAO Revision # // Dr. Salim Al-Harthi Revision # //0 Dr. Salim Al-Harthi Revision # 9//0 QAO Revision # Contact Office Risk Management Office Changes to be aligned with essential steps to develop SQU risk management plan and changes recommended by SQU stakeholders Changes recommended by the Academic Council Changes recommended by the Academic Council Final revision of Arabic version and matching it with the English version
e-mail address Phone Number 70 salim@squ.edu.om. POLICY TITLE Risk Management Policy. DEFINITIONS AND ABBREVIATIONS In the context of this policy and for better consistency, the following terms have the meaning given against each one:. Risk Risk is an event that may adversely (threat) or favorably (opportunity) affect the achievement of SQU vision, mission and strategic objectives. It is assessed in terms of frequency and severity.. Risk Management Risk management is a systematic process of identifying, assessing, controlling, recording, and monitoring risks. It aims at eliminating or reducing risk damages and seizing opportunities to achieve objectives. Risk management includes the necessary infrastructure and responsibilities to administer the process.. Gross Risk. Net Risk Gross risk is a risk before applying controlling or mitigating measures. Net risk is a risk remaining after applying controlling or mitigating measures. In this policy, risks are considered as net risks since control measures are in place.. Risk Appetite Risk appetite is the level of tolerance applied by an institution in accepting risks; i.e. degree of the institutions acceptance of risks, or how much risk the university is ready to accept. In this policy, risks above a defined score (frequency x severity) are considered unacceptable; the score is taken as 9..6 Risk Assessment Risk assessment is the process of systematically determining the level of the severity and frequency of an event. To have a consistent approach to risk assessment, standardized scales are to be used across the university. See tables..7 Risk Identification Risk identification is a process through which threats and opportunities events are determined. Information on their magnitude, timing, and reasons are also determined in the process. The university uses a variety of methods in identifying risks. These may include surveys, internal and external workshops, individual or group interviews, staffstudents meetings, audit reports, departmental meeting and review of documentations and reports..8 Early Warning Indicators Early warning indicators are mechanisms designed to provide the management with information on any development or problems relating to risks and effectiveness of control measures or sudden change in the observed trends. Such information is normally included in monthly monitoring reports forwarded to the person(s) responsible for managing risks..9 Risk Register
Risk register is a file containing a prioritized list of risks together with information on risk identification, risk assessment, control measures and risk ranking..0 Control or Mitigating Measures Control or mitigating measures refer to actions (e.g. operating bylaws, regulations, policies,procedures and best practices) used to reduce the negative impact of a risk and enhance the likelihood of seizing an opportunity and also the level of adherence by staff to such measures.. POLICY STATEMENT (SQU) is committed to applying appropriate risk management practices in its activities to minimize the unfavorable effect of risks and to seize different opportunities.. PURPOSE/ REASONS FOR POLICY The purpose of the policy is to:. adopt a systematic and consistent approach to risk management. ensure and embed risk management good practices. help ensure the achievement of SQU objectives. help in seizing opportunities and reducing losses. better inform decision-making.6 foster risk management culture.7 assist in better allocation and use of resources.8 assure stakeholder trust and confidence. GENERAL PRINCIPLES The following main principles constitute the basis of this policy:. Risk management is fundamental in achieving SQU set objectives.. SQU staff in general and senior mangement in particular are expected to always promote risk management good practices while conducting activities.. Risk assessment will be conducted on all new initiatatives, projects and programs prior to commencement.. Risks will be assessed using the risk score matrix given in this policy.. All risks shall be aligned with the university risk appetite given in this policy..6 This policy is a guideline and not prescriptive. Line managers and staff are expected to apply their good judgement in applying this policy..7 A Risks Register is kept at the relevant unit as well as the central SQU Risk Management Office, which records all identified risks..8 This policy considers all types of risk, including those related to Health, Saftey and Enveronment (HSE). 6. SCOPE OF APPLICATION All Units of the University
7. POLICY OWNER Risk Management Office 8. APPROVAL BODY University Council 9. PROCEDURES Below are the main elements of risk management procedures. It must be stated that there is no one standard procedure for risk management. 9. Internal and external environment: Risk management process starts with understanding the university internal environment. This environment includes university values, objectives, academic and quality standards, bylaws, policies, procedures, risk appetite, management structure and delegation of authorities. Understanding university internal environment is essential in assessing risks. In addition, risk management should consider external environment including statuary regulations, competition, and reputation. 9. Identifying, prioritizing, categorizing and exploring risks: Before starting any new initiative or activity, the university must identify associated risks. These are obtained from various sources including face-to-face interviews with individuals or groups, workshops, documentations, reports, questionnaires feedback, and meetings. The identified list of risks may be prioritized so as not to be very exhaustive. It is suggested to limit, whenever possible, the university risk list to 0 main risks. Prioritizing risks could be reached by consultation with university community or by managerial decision. Risks can be grouped under different categories to ensure full coverage of activities. Risks could be grouped as strategic, operation, financial, health and safety, reputation, compliance, teaching and learning, human resources, reporting, research, and students. Once risks are identified, each must be explored. This may include clearly defining each risk, contributing factors, existing control measures and early warning indicators. An example is given Table below: Table Risk identification card Risk: Declining student progression in the foundation program Risk Category:Teaching and Learning Frequency: Risk Assessment Severity: Score: 6 Risk owner Director of Foundation Program Definition Student intake is defined as the number of new students enrolling in the foundation program in September of each academic year Contributing factors. Introduction of new academic standards. Introduction of new syllabus. Unfamiliarity with newly introduced rules Existing control measures Early warning indicators Additional control measures. Lack of needed study skills. Peer teaching observation. Annual program syllabus review. Effective communication of new rules. Review of teaching materials. Students surveys 6. Aligning teaching and learning approaches with new standards. Students semester results. Number of withdrawal cases. Raised related issues in students/staff meetings. Peer teaching observation. Student surveys findings. Consider including additional entry requirement. Review program contact hours. Introduce independent student learning approach to enhance progression rate.test mathematic competencies at entry
Frequency Risk Management Policy 9. Risk assessment Risk assessment is the process of systematically determining the level of the severity and frequency of an event. To have a consistent approach to risk assessment, standardized scales are to be used across the university. Table gives different frequency levels and description of each level. Frequency Level Rare Seldom Occasional Probable Frequent Table Description of frequency levels Description Occurs in extraordinary circumstances, not likely to occur in 0 years time. Unusual, happens once in -0 years. Happens from time to time, once in - years Occurs several times (e.g. four times) a year Occurs more frequently, once a month The levels of severity are given in Table together with the description of each level. Severity Level Insignificant Minor Marginal Serious Catastrophic Table Description of severity levels Description Activity continues, minimum cost loss < OR x, (e.g. <000), reputation intact, no injury to persons and revenue is unaffected. Activity continues with slight difficulty, cost loss between OR x-and OR x, (e.g. 000-000), reputation internally affected, injury required first aid only, revenue is insignificantly affected. Activity disrupted, considerable cost losses between OR x and OR x, (e.g. 000-0000), injury to persons needing medical treatment, reputation damaged and revenue affected slightly. Activity seriously disrupted, serious cost loss between OR x and OR x, (e.g. 0000-00000) injury requiring hospital admission, reputation seriously damaged and revenue is considerably affected. Activity stopped, large cost losses>ro x, (>00000), reputation very seriously damaged, serious injury (death or permanent injury) to persons, unable to resume activity and revenue is greatly affected. There are no standard values for cost lost at each level; however, recommended values are given in brackets. Once a risk frequency and severity are defined, risk scores are calculated as: Frequency times (x) Severity. A by risk score matrix is suggested to assess risks; this matrix is widely accepted within the higher education sector. Table below shows such a matrix including various scores. Scale Table Risk assessment score matrix (Frequency x Severity) Severity Insignificant Minor Marginal Serious Catastrophic Rare Seldom Occasional Probable Frequent 6 8 0 6 9 * 8 6 0 0 0 The units concerned within the university may want to define these as per existing practices of tolerance. * SQU Acceptable Risk Level
9. Risk appetite and control measures The university is to decide on acceptable risk exposure levels, risk appetite. Existing control measures and effectiveness of risk management are considered when deciding on risk appetite. In addition, higher risks require stringent control measures coupled with effective management. In this policy, any risk score equal or above 9 is considered unacceptable, which warrants additional control measures, sharing risk or stopping the activity. Table below indicates risk rating and tolerability levels: Table Risk rating details Risk Score* Rating Color code Description Tolerability Comments & &,6&8 9,0&,6, 0& Very low (VL) Low (L) Medium (M) High (H) Very high (VH) *: Frequency X Severity Green (G) Light Green (LG) Yellow (Y) Orange (G) Red (R) No or little harm, activity undisrupted. Minimum costs loss <RO x. Negligible effect on achieving objectives Impact can be recovered within a day. Minor harm, activity is slightly disrupted, slight financial loss <RO x. May have slight effect on achieving objectives. No permanent impact. Could be recovered within days. Moderate damages, activity is marginally disrupted, moderate financial losses between ROx and RO x, reputation may be damaged. Expected difficulties in achieving in operational objectives. Could be recovered within months. Significant damages, activity is disrupted, large financial losses >OR x and reputation is badly affected. Considerable operational difficulties in achieving objectives. Strategic objectives are affected in part. Very serious damages, activity is severely disrupted, heavy financial losses >OR x 6 and reputation is severely damaged. If not treated will impact on operational and strategic objectives. Acceptable Acceptable Tolerable Unacceptable Unacceptable Keep conditions, continue with control measures. Review and report annually. Keep control conditions, continue with measures. Review and report annually. Make changes in conditions, continue with or improve on control measures and /or modify objectives to reduce risk. Monitor and report biannually. Reduce the severity. Impose strict control measures to reduce to a tolerable level and/or set new objectives. Monitor and report regularly. Stop the activity, transfer responsibility, outsource, and/or set new objectives. Detailed control plan must be developed. Monitor and report regularly. 9. Early warning indicators Early warning indicators are tools used to inform the management on the effectiveness of risk management process. Such indicators help decision-makers to take preventive or preemptive measures before the situation deteriorates. The effectiveness of the risk management process is a function of the appropriateness of the control measure, changes in risk frequency and severity, and changes in the activities. Risk managers and officers would want to identify indicators that will give information on any identified risk. Some examples are listed below:. Risk: Weak students; Indicators: class tests, assignments and attendance.. Risk: Quality of teaching; Indicators: Students surveys, quality of handouts and other teaching materials and teaching assesment and quality of exams.. Risk: Plagiarism; Indicators: Consistency in applying policies, number of reported cases and imposed penalties.
Early warning indicators alert management that additional actions may be needed. Key performance indicators may be used as warning indicators. Appendix I shows Risk Management Organizational Chart. 9.6 Risk register Risk register is a file containing prioritized list of risks together with information on risk identification assessment and control measures. The information recorded in the risk register is periodically reviewed by the Central Risk Management Office as well as Line Managers each in their respective area of discretion. Reviewing risk register is important in finding out if certain risks are dying and if there are new emerging risks. The standard format for the type of information recorded in the register is given in Appendix II. 0. RELATED POLICIES Policy of Making University Policies and SQU bylaws. RESPONSIBILITY FOR IMPLEMENTATION The Vice Chancellor shall have overall responsibility of risk management. The Vice Chancellor is assisted by a Risk Management Office, Risk Management Officers (At the moment chair of HSE) in various units, and staff responsible for managing and reviewing risks. The organizational chart of risk management is given in Appendix I.. The Risk Management Office (RMO) role is to:.. Facilitate risk management activities and advise the Vice Chancellor on strategic and operational risks... Identify and prioritize strategic and operational risks in consultation with the Vice Chancellor... Ensure availability of risk management resources... Ensure effective communication of risk management strategies, risk reporting and risk escalation processes with the risk management officers across the university... Review major risks identified and monitor progress in risk management plan...6 Decide on accepting, managing, sharing, or avoiding risks...7 Report on compliance of university units with this risk management policy...8 Receive and issue monitory reports on management of risks...9 Annually report to the Vice Chancellor on the effectiveness of risk management processes and make recommendations for improving risk management policy and procedures...0 Review risks and risk assessment procedures and scales... Disseminate risk management good practices and provide support to various university levels... Set the ground for and encourage the university community to foster a culture of risk management within the university... Establish and maintain a university risk register.. Each academic and non-academic unit will designate a Risk Management Officer who will be the owner of the risk policy in his/her unit.his/her responsibilities include:.. Liaise with the Central Risk Management Committee.. Update the unit risk register... Monitor adherence to risk management at the unit s level... Identify emerging new risks and disappearing old ones... Report to line manager on management of risks within the unit. 6
..6 Inform the unit s community on university risk management issues...7 Encourage risk management culture within the unit.. Line managers are responsible for:.. Ensuring that staff under their supervision apply risk management where applicable... Giving staff enough and clear information on this policy, in particular during induction programs... Nominating a risk management owner... Developing and maintaining risk register at the unit level... Ensuring the review of the risk register...6 Ensuring the effectiveness of risks control measures within the unit...7 Assigning staff who would effectively manage and review risks...8 Documenting good practices and risk incidents.. Quality Assurance Office reviewing feedback information, aligning with related policies, assisting in and disseminating good practices and reporting on effectiveness.. ISSUING OFFICE Risk Management Office. REVIEW. The Risk Management Office shall annually evaluate the effectiveness of this policy.. The Quality Assurance Office shall report on adherence and effectiveness of this policy across the university.. KEY RISKS Identifying potential risks associated with the introduction of policies, in particular new ones, is considered a good practice. Line managers have the responsibility to embed risk management practices in their day-to-day operations. This may include taking the necessary measures to eliminate or control such risks. Main risks associated with this policy are listed below:. Inability to identify risks appropriately.. Not having early warning indicators.. Inconsistency in adherence to the policy across the university.. Communication and reporting on risks fail to reach decision makers in a timely manner.. Lack of enthusiasm to risk management concept.. APPENDICES APPENDIX I RISK MANAGEMENT ORGANIZATIONAL CHART APPENDIX II RISK REGISTER APPENDIX III RISK MANAGEMENT PROCESS FLOW CHART 7
APPENDIX I. RISK MANAGEMENT ORGANIZATIONAL CHART Vice Chancellor Director of Risk Management Office Coordination, follow-up and records keeping Dept./Unit Strategic and Operational RM Dept./Unit Academic RM Dept./Unit 8
Teaching Financial Strategic Category Risk Management Policy APPENDIX II. RISK REGISTER The following table shows one sample template for therisk register. N o Risk Risk Assessment Frequency x Severity Score & Rating Contri buting factors Control measures Additional suggested actions Responsibility Risk owner Observed frequency and dates Risk Ranking 6 7 8 9 0 9
APPENDIX III. RISK MANAGEMENT PROCESS FLOW CHART Understand internal and external environment. Understand related university values, objectives, academic and quality standards, bylaws, policies, procedures, risk appetite, management structure and delegation of authorities. Understanding university internal environment is essential in assessing risks.. Understand related external environment including statuary regulations, competition and reputation. Identify, prioritize, categorize and explore risks. List risks associated with an activity. Use interviews, questionnaires, review of documentations and workshops.. List problems or difficulties encountered in the past.. Link risks with objectives, financial impact, scale of impact( e.g. whole university). Establish a list of 0 to 0 risks. Risks may be grouped as: Strategic, Financial, Reputation, Students Experience, Teaching and Learning, Research and Reputation, or risks may be grouped as per the OAAA Quality Audit manual chapters.. Identify risks and list contributing factors, control measures and early warning indicators Assess risks. Establish severity and frequency levels.. Establish risk score; risk score= severity X frequency. Consider accepted risks; consult risk appetite. Consult risk appetite and identify control measures. Consider university readiness to risk exposure.. List existing control measures. High expectations require high control measures and resources. Identify additional control measures to effectively manage risks.. Share or outsource risks if it is believed that risks cannot be affectively managed. Identify early warning indicators Risk managers and officers would want to identify indicators that will give information on any identified risk. Some examples are listed below:. Risk: Weak students; Indicators: class tests, assignments and attendance.. Risk: Quality of teaching; Indicators: Students surveys, quality of handouts and other teaching materials and teaching observations.. Risk: Budget overspending; Indicators: Monthly budget variation analysis. Risk: Plagiarism; Indicators: Consistency in applying policies, number of reported cases and imposed penalties. Risk Register. Record relevant risk information in a Risk Register. Recorded information includes: Risk title, assessment, contributing factors, control measures, additional actions, responsibility and observed frequency and dates. 0