1. GuildHE: Council Meeting 25th May 2017
Assessing and Managing Risk
Richard Young – Council Member (and Chair of Audit Committee), LIPA and Director, Uniac

2. Uniac: who we are
Shared internal audit and assurance not-for-profit service established over 25 years ago - a (nearly) unique proposition in comparison to in-house or ’big four’
Guild HE members include Falmouth University, Bishop Grosseteste University and the British School of Osteopathy – strong affinity with small and specialist institutions and big supporter of the importance of diversity and difference in the sector
Particular benefits for small and specialist providers in being part of broader shared service and benefiting from wider sharing of expertise and knowledge
Membership open to all HE providers and endorsed and recognised by HEFCE as an efficient and effective model
Dedicated (possibly largest) team of HE professional auditors with varied backgrounds (HEFCE, QAA, NUS) – not your average audit team!

3. So why do we do risk management?
HEFCE expectations of the Board:
take reasonable steps to ensure that there are sound arrangements for risk management, control and governance and value for money
annual report must include conclusions on the adequacy and effectiveness of the risk management, control and governance arrangements.
Expectations will not go away:
The responsibilities of Boards include ensuring that there is a robust and comprehensive system of risk management, control and corporate governance (Memorandum of Assurance and Accountability)
Financial Reporting Council: Revised Corporate Governance Code

4. If we are going to do it, how can we maximise the benefits
A well thought through register is a cornerstone for Audit Committee business:
Signposting the main risks
Link with assurance mechanisms
Strategic link between the Audit Committee and the Board:
Lifts the interaction away from the compliance / regularity reports

5. Experience Across the Sector
No standard template / not an exact science
Simpler the better – colour coding, 3x3 scoring
At the very least, a pointer for focus
Using the gross and the net scores
Used as a challenge – Board and Committee agendas, strategic papers, internal and external audit programmes
Clear differential between operational and strategic risks e.g. health and safety

6. Experience Across the Sector
Segregation of sector wide / uncontrollable risks:
Major changes in research funding
National immigration policy changes
Avoid risk appetite
Expectations and local registers:
Resource and priorities and not wanting to create an industry
Limited benefits of bottom up / top down

7. What is risk and capturing the real ones?
One definition: something which, if it happens, will have a direct impact – positive or negative – on the institution
Generic risk statements not ideal
Common approach of ‘Failure to…’ – actually starting from the control rather than the risk
Consequences of failure to manage the risks (impact):
Stakeholder relations and reputation
Operations
Strategy Implementation
Financial
Two or three causes / sub risks to explore the risk further

8. Strategic Risk Examples
…ones that works well….
Overseas students are not attracted to the institution:
They are unaware of the institution and / or its offerings
They are aware of the institution but not attracted
Having engaged with the institution they are deterred by the recruitment process

9. Strategic Risk Examples
…one that didn’t…..Failure of governance and management
Failure of governance and management resulting in:
Injury or death
Misappropriation of institution resources
Withdrawal of delegated authority e.g. Home Office / UKVI
….21 sub risks….

10. Other risk examples
The institution fails to comply with UKVI immigration compliance requirements:
Visa refusal rates
Student working hours
Engagement and attendance monitoring
The institution fails to comply with the General Data Protection Regulation:
Staff unaware of requirements
Not knowing / understanding all data held
Access control not aligned to data sensitivity
Real risks around cyber, the estate, staff, students (recruitment, experience, retention)…

11. Risk Management Reporting / Best Practice
Clarity of key risk – ‘risk that…leading to….because of….
Sub risks and their priority
Controls
Monitoring
Ownership
Improvement plans

12. Questions for discussion
Is a risk register a chore or seen as an aid to good management and governance?
Have you considered how you might get the most from it?
Would there be benefit in re-articulating your risks?
Does your institution's approach to risk management help drive change or simply respond to it?
How engaged are the executive in actively monitoring and managing risk and capturing this in a register? Is there a culture of effective, positive risk management?
How quickly do your risk management processes adapt to fast moving events?
Where is risk management ‘owned’ in your institution – who drives it and is this appropriate?
What are the shared risks affecting small and specialist institutions?