GuildHE: Council Meeting 25th May 2017 Assessing and Managing Risk Richard Young – Council Member (and Chair of Audit Committee), LIPA and Director, Uniac

Uniac: who we are Shared internal audit and assurance not-for-profit service established over 25 years ago - a (nearly) unique proposition in comparison to in-house or ’big four’ Guild HE members include Falmouth University, Bishop Grosseteste University and the British School of Osteopathy – strong affinity with small and specialist institutions and big supporter of the importance of diversity and difference in the sector Particular benefits for small and specialist providers in being part of broader shared service and benefiting from wider sharing of expertise and knowledge Membership open to all HE providers and endorsed and recognised by HEFCE as an efficient and effective model Dedicated (possibly largest) team of HE professional auditors with varied backgrounds (HEFCE, QAA, NUS) – not your average audit team!

So why do we do risk management? HEFCE expectations of the Board: take reasonable steps to ensure that there are sound arrangements for risk management, control and governance and value for money annual report must include conclusions on the adequacy and effectiveness of the risk management, control and governance arrangements. Expectations will not go away: The responsibilities of Boards include ensuring that there is a robust and comprehensive system of risk management, control and corporate governance (Memorandum of Assurance and Accountability) Financial Reporting Council: Revised Corporate Governance Code

If we are going to do it, how can we maximise the benefits A well thought through register is a cornerstone for Audit Committee business: Signposting the main risks Link with assurance mechanisms Strategic link between the Audit Committee and the Board: Lifts the interaction away from the compliance / regularity reports

Experience Across the Sector No standard template / not an exact science Simpler the better – colour coding, 3x3 scoring At the very least, a pointer for focus Using the gross and the net scores Used as a challenge – Board and Committee agendas, strategic papers, internal and external audit programmes Clear differential between operational and strategic risks e.g. health and safety

Experience Across the Sector Segregation of sector wide / uncontrollable risks: Major changes in research funding National immigration policy changes Avoid risk appetite Expectations and local registers: Resource and priorities and not wanting to create an industry Limited benefits of bottom up / top down

What is risk and capturing the real ones? One definition: something which, if it happens, will have a direct impact – positive or negative – on the institution Generic risk statements not ideal Common approach of ‘Failure to…’ – actually starting from the control rather than the risk Consequences of failure to manage the risks (impact): Stakeholder relations and reputation Operations Strategy Implementation Financial Two or three causes / sub risks to explore the risk further

Strategic Risk Examples …ones that works well…. Overseas students are not attracted to the institution: They are unaware of the institution and / or its offerings They are aware of the institution but not attracted Having engaged with the institution they are deterred by the recruitment process

Strategic Risk Examples …one that didn’t…..Failure of governance and management Failure of governance and management resulting in: Injury or death Misappropriation of institution resources Withdrawal of delegated authority e.g. Home Office / UKVI ….21 sub risks….

Other risk examples The institution fails to comply with UKVI immigration compliance requirements: Visa refusal rates Student working hours Engagement and attendance monitoring The institution fails to comply with the General Data Protection Regulation: Staff unaware of requirements Not knowing / understanding all data held Access control not aligned to data sensitivity Real risks around cyber, the estate, staff, students (recruitment, experience, retention)…

Risk Management Reporting / Best Practice Clarity of key risk – ‘risk that…leading to….because of…. Sub risks and their priority Controls Monitoring Ownership Improvement plans

Questions for discussion Is a risk register a chore or seen as an aid to good management and governance? Have you considered how you might get the most from it? Would there be benefit in re-articulating your risks? Does your institution's approach to risk management help drive change or simply respond to it? How engaged are the executive in actively monitoring and managing risk and capturing this in a register? Is there a culture of effective, positive risk management? How quickly do your risk management processes adapt to fast moving events? Where is risk management ‘owned’ in your institution – who drives it and is this appropriate? What are the shared risks affecting small and specialist institutions?