Make no mistake, creating an ERM framework is a good idea. For many obvious reasons, and even for reasons not so readily apparent, creating a process to mitigate risk can save your school’s reputation.
What then is the risk of mounting an effort to create an ERM framework for your school? After the risk assessments, after the evaluation phase, once all risk ratings have been hashed out and the documentation is published to your board, to administrators and other stakeholders, what then? The biggest risk is simple: take no action.
Two questions: is it better to be unaware of a risk that comes to fruition with no framework in place that may have identified the risk leading to effective mitigation…or…is it better to have a risk framework in place where a risk was identified and nothing was done to avoid the issue the risk caused? This is something I discuss with all the schools I work with when beginning an ERM effort.
There is no easy answer to these questions, however, both pose a danger to your school. If you’re unaware of risks in your school, especially certain risks that could be high-danger, therefore, potentially high-dollar risks, you may place your school’s administration near the threshold of negligence. And that could get ugly. On the other hand, if you already have a long list of risks that has been rated and published to your internal school community and no action has been taken to mitigate any of the risks, that could get ugly as well.
If you believe in the ERM process, then action can be taken during the creation of the framework and mitigation steps for high risks should begin immediately after the risk identification and evaluation steps are complete.
Once the initial ERM stages are complete, an essential component of the mitigation process is to name a “risk champion” in your organization. The primary responsibility of the risk champion is project management. A process should be created that is repeatable and measurable to ensure a systematic approach to managing and mitigating risk.
The risk champion may face some pushback along the way. During risk assessments, an acceptable school tradition once considered part of the fabric of the institution may now be a high-risk practice. The risk champion as well as the school’s administration should consider the risk in today’s litigious environment and take appropriate action. However, the school’s risk appetite may come into play here. In this case, the school must be aware of the potential downside of assuming this risk prior to taking it out of mitigating plans.
Aristotle’s thought on “probable impossibilities are to be preferred to improbable possibilities” somehow figures into all this, although I can’t be sure. I’ll have to wrap my head around it and provide any conclusions in a future post.