Risks of Enterprise Risk Management

Make no mistake, creating an ERM framework is a good idea. For many obvious reasons, and even for reasons not so readily apparent, creating a process to mitigate risk can save your school’s reputation.

What then is the risk of mounting an effort to create an ERM framework for your school? After the risk assessments, after the evaluation phase, once all risk ratings have been hashed out and the documentation is published to your board, to administrators and other stakeholders, what then? The biggest risk is simple: take no action.

Two questions: is it better to be unaware of a risk that comes to fruition with no framework in place that may have identified the risk leading to effective mitigation…or…is it better to have a risk framework in place where a risk was identified and nothing was done to avoid the issue the risk caused? This is something I discuss with all the schools I work with when beginning an ERM effort.

There is no easy answer to these questions, however, both pose a danger to your school. If you’re unaware of risks in your school, especially certain risks that could be high-danger, therefore, potentially high-dollar risks, you may place your school’s administration near the threshold of negligence. And that could get ugly. On the other hand, if you already have a long list of risks that has been rated and published to your internal school community and no action has been taken to mitigate any of the risks, that could get ugly as well.

If you believe in the ERM process, then action can be taken during the creation of the framework and mitigation steps for high risks should begin immediately after the risk identification and evaluation steps are complete.

Once the initial ERM stages are complete, an essential component of the mitigation process is to name a “risk champion” in your organization. The primary responsibility of the risk champion is project management. A process should be created that is repeatable and measurable to ensure a systematic approach to managing and mitigating risk.

The risk champion may face some pushback along the way. During risk assessments, an acceptable school tradition once considered part of the fabric of the institution may now be a high-risk practice. The risk champion as well as the school’s administration should consider the risk in today’s litigious environment and take appropriate action. However, the school’s risk appetite may come into play here. In this case, the school must be aware of the potential downside of assuming this risk prior to taking it out of mitigating plans.

Aristotle’s thought on “probable impossibilities are to be preferred to improbable possibilities” somehow figures into all this, although I can’t be sure. I’ll have to wrap my head around it and provide any conclusions in a future post.

School Communication

Communicating with a school community is necessary and important. There are several effective strategies to keeping families well-informed, ranging from Remind to SchoolCircle to Google and many more. There are also email distribution lists used to reach those in your school community.

From faculty providing information regarding individual classes, to coaches, club supervisors and administrators, all have justifiable reasons to have access to publish messages. Similarly, distribution lists are sometimes preferred for small groups within a school, or distribution lists can be global, reaching all in a school who have provided a viable email address.

Controlling these functions can be tricky. Some questions that should be asked are:

  • Does your school have a communication policy covering all aspects of providing information to the school community?
  • Is there a high-level user of communication apps responsible for assigning roles?
  • What controls are in place to ensure the appropriate people within a school have publishing rights?
  • Are there reasonable approval controls in place ensuring inappropriate messages are not sent to a group within a school?
  • Is there a monitoring process in place for messages sent to the school community?
  • Are distribution lists provided only to the appropriate members of your school?
  • What process is in place to ensure email accounts for terminated employees are immediately disabled?



For 17 minutes, beginning at 10:00 AM on March 14, students across our country (and other countries) will walk out of school in remembrance of those killed in Marjory Stoneman Douglas High School. And they walk out in protest of gun violence in schools. This can be as divisive an act as the media or school superintendents portray it, or it can be a poignant, powerful teaching moment. If history has taught us anything, it’s probably best to get on the right side of this movement. Although, sad as it is, and no argument can be summoned from any depth to counter this claim: as a culture, we’ve learned nothing from history. Nothing. “There is no present or future – only the past, happening over and over again – now.” That’s Eugene O’Neill.

Until we learn, there will be more school massacres; it’s no longer a matter of if it will happen, it’s a matter of when and where, then a body count. How is this overwhelming risk effectively mitigated?

There is no single solution to the problem. Eric Harris and Dylan Klebold, Columbine High School, Seung Hui Cho, Virginia Tech, Adam Lanza, Sandy Hook Elementary, Nikolas Cruz, Marjory Stoneman Douglas High School – and this is only a partial list; what has been done other than allow this madness to continue? Not much. It appears our elected officials don’t give a damn about our school children. Our students need to take the helm on this issue.

About this, statements from school superintendents have surfaced and to their credit, many of these men and women are clearly in support of a peaceful act of remembrance and protest. Others though, have said the walkout is a disruption of the daily activity, clearly stating students will face disciplinary action if they walk. This is a myopic, ill-informed stance. Students shouldn’t be threatened for taking part in this event, they should be celebrated and encouraged.

And disruption? Those school superintendents against this movement are ruefully unaware that disruption of the normal routine, a peaceful disruption, is the only way to get noticed, it’s the only way to have the world stop, if only for a moment, to recognize there are people who want change. These students are trying to ram a very large stick in the spokes of an even larger wheel to say…NO MORE.

There is historical precedent for this movement. Similar activity on the part of students of our country in the ’60s and early ‘70s forced change. Martin Luther King, Jr. led a civil rights revolution that changed policy in our country. Mahatma Gandhi advocated a non-violent dissent against British rule of India. Will this movement have a similar impact? Time will tell.

Schools should, of course, take a critical look at their security protocols, and address any issues, if that hasn’t happened already. But school security is not the only answer, no more than gun control is the only answer, if that’s an answer at all. There must be more.

School communities need to be part of the solution. Engaging school families in a healthy discussion about this issue is necessary. An examination of a school’s culture is also necessary; a close look, maybe a deeper dive than some would be comfortable with, but it must be done. Ask the right questions, find out what, if anything, lurks under what is seen day to day in your school.

And what can be done with political correctness? People are reticent about speaking up when they see something amiss: this too must change. About school shooters, the signs were there, the warnings were missed, nothing was said, nothing was reported. This is a recurring theme in all instances where children were killed in schools. There will be bumps in the road no doubt, like any cultural change in a school, but some hurt feelings are far better than headlines about another mass shooting.

I hope all educators support these students on March 14. It may be the beginning of a powerful agent of change so desperately needed.



School Violence

Yet another school shooting. This time in Florida. Tongues are wagging in Washington D.C. and just about everywhere else: we need to do something, we don’t need to do anything, it’s guns, it’s neglected kids, locals are saying we all missed the warnings. There is no shortage of opinions, just solutions. And whether or not it’s spoken aloud, it’s on everyone’s mind: when and where will this happen again?

All schools are vulnerable to this type of abhorrent incident. Schools should be a place of inclusion and accessible to students, families and neighbors, yet we all want our schools, where our kids spend a great deal of time, to be safe and secure. Armed guards? Armed faculty? Walls and barbed wire? Metal detectors? It’s a tough needle to thread: we all want schools to open and accessible, yet we need to make them safe.

Answers to this issue won’t be found here sadly, just more questions.

  • Has your school preformed an in-depth risk assessment of your security protocols?
  • Have you ever examined your school’s culture – a thorough examination to take a good look at it on a DNA level?
  • Can access to fire alarms somehow be restricted to faculty and staff by a key fob maybe, or is that against fire codes?
  • Maybe local fire codes need to be examined as well?
  • Are you engaged with your school community enough to hold open forum on this sensitive topic?
  • Your school and your school community, are they attuned to potential issues?
  • Are you taking steps to educate your school and your school community on procedures to follow in the event warning signs present?
  • What are the signs?

Just more questions, no solutions. We all need to ask the questions – ask the right questions. Collectively we can come upon the answers. There isn’t just one answer though, but one thing is certain, the status quo just can no longer be the rule.




Risk Appetite

There has been some talk recently about risk appetite: what it means and how it relates to a strategic plan, or even day-to-day operations.

An essential component of an Enterprise Risk Management effort: your organization’s risk appetite must be closely aligned with your strategic plan and with your approach to risk and risk mitigation efforts.

Simply stated, your risk appetite is the level of risk you are willing to assume relative to mitigation efforts required to be in place. For example, what level of risk is your organization willing to assume by making changes to your admissions strategy? Considering a more routine example, what risks are you willing to assume by creating a new program for students, or planning a student trip?

To establish your level of risk appetite, two objectives need to be met. First, to appropriately formulate your risk appetite, detailed risk assessments must be completed. A thorough understanding of your risk inventory must be established with appropriate stakeholders: identify high likelihood and high impact risks across all divisions and business functions. Second, you need be sensitive to your institution’s comfort level regarding risk. An effective Enterprise Risk Management framework will provide keen insights into all risks facing your institution and help you develop an appropriate risk appetite.

While there are many terms to describe levels of risk appetite, here are just a few.

Enthusiastic: Understanding the risks involved, willing to proceed with this knowledge because a new venture is worthy of assuming risks: benefits far outweigh risks.

Thoughtful: There may be a need for certain risk mitigation efforts.

Guarded: Risk assessments produced a number of risks requiring strong mitigating controls prior to moving forward.

Radioactive: Run far, far away.


Social Media

Love it, hate it, use it, or don’t use it, in whatever form it takes, social media isn’t going away in the foreseeable future.

Arguments pro and con are as abundant as there are social media outlets: it provides avenues for networking, it promotes isolation, it is a conduit for information sharing, it’s a conduit for misinformation. The list goes on.

On a scale of low risk to a devastating hit to your school’s reputation, the use of social media may seem trifling and a simple school policy would suffice. However, that isn’t the case. A policy governing the use of social media in schools should be thoughtful, detailed and well publicized.

The misuse of social media could negatively impact a school’s reputation and the ways it can happen are as numerous as there are users. It is well known that teens don’t always fully understand the consequences of their actions. When I was young, my reckless actions usually took place on a baseball field somewhere, resulting in a trip to the emergency room for stitches or x-rays. The impact was isolated. With the abuse of social media however, a thoughtless post or a provocative photo could have a widespread negative impact to another individual, a group of people, or an institution.

If your school doesn’t have a social media policy, create one. If there is a policy in place, take a closer look to ensure it covers as much as possible to help protect your students, your faculty and your school’s reputation.

Regarding social media policies, some things to consider:

  • All policies related to the use of social media by the student population should be as comprehensive as possible. This is a complicated risk; there must be some thought behind developing a policy, or bolstering an existing policy. Consult with students, parents, (all stakeholders) to help develop strong policies. It may also be advisable to speak to your school’s attorney for guidance.
  • If your school has an immersion, or experiential learning program, ensure a social media policy specifically addresses how students can and cannot take advantage of social media. This should also cover all school-sanctioned student trips.
  • If your school is using social media in the classroom as part of your curriculum (which can be very useful and productive), ensure risks are properly identified and adequately mitigated.
  • Policy language should clearly stipulate consequences for the abuse of social media.
  • Social media policies should remain dynamic. They must be disseminated to all stakeholders (e.g., students, parents, faculty, staff). Review and amend these policies often. Avenues for social media become available quickly and school governance must keep up. Reminders, updates and other information regarding social media policies should also be published often to help keep this information in the light of day.
  • Social media connection or interaction between students and faculty/employees (outside of approved and closely monitored school use) is never a good idea. It should be clearly stipulated in any policy this is prohibited.

Risk is a Shared Responsibility

Be proactive. Identify risks and mitigate them successfully before…before they come to fruition and cause your school pain.

There is nothing magic about an Enterprise Risk Management framework and there is nothing painful about the process. What it takes is an eagerness to identify risks with an open mind and a willingness to set mitigation efforts in motion.

The philosophical approach I use throughout the ERM process is simple: ERM helps keep your school off the front page of the newspaper. And lately there are far too many front-page stories:

Boston Globe – Abuse alleged in 2004 at St. George’s

Boston Globe – Ex-teacher barred from prestigious N.H. school

Vanity Fair – A Brief History of Boarding-School Scandals

Would an ERM framework prevent these horrible circumstances? Maybe. However, what ERM provides is a greater awareness of risk. ERM also reinforces the notion that identifying and mitigating risk is a shared obligation, not just the responsibility of your risk officer, or senior staff.

Banyan Risk Management Consulting can help you begin an ERM conversation at your school or organization.  Everyone is a stakeholder, everyone is in this together.