Insights: Janice Abraham on Risk Readiness
The economic downturn presents a compelling case for engaging in enterprise risk management—so argues Janice Abraham, president and chief executive officer of United Educators, in this interview with Business Officer.
By Nikki Krawitz
The course of economic events since September 2008 presents as compelling a case as any for engaging in enterprise risk management (ERM), argues Janice Abraham, president and chief executive officer of United Educators, Chevy Chase, Maryland. Assessing circumstances, big and small, that could knock your institution off track should be standard practice, believes Abraham. The good news, she says, is that ERM doesn’t require a cumbersome, consultant-driven process: “It’s about asking questions.”
In this interview with Business Officer, Nikki Krawitz, vice president for finance and administration at the University of Missouri System, Columbia—engaged in its own ERM initiative—asks Abraham how leaders should approach ERM and who must be involved.
How would you characterize enterprise risk management, and what is driving the current focus on ERM within higher education?
ERM as a discipline started in the business world, initially within financial services, as a way to get all functions within an organization to consider their risks and opportunities—what could happen that would prevent them from accomplishing their mission and what opportunities exist for achieving or even exceeding goals. While the business world embraced ERM from a regulatory and good governance standpoint, educational institutions have been slower to start thinking about ERM as an integrated business tool, a way to help everyone—trustees, presidents, provosts, CFOs, department heads, and frontline supervisors—identify early warning signs of something that may jeopardize success.
In some ways doesn’t this resemble the SWOT (strengths, weaknesses, opportunities, and threats) analysis that many institutions go through as part of their strategic planning process?
That’s really what ERM is—identifying opportunities and threats in relation to your strengths and weaknesses, but with an added focus on deciding how you will respond. Most of the institutional SWOT analysis I see is focused heavily on assessing strengths. When it comes to weaknesses, the thought or planning is not always as rigorous. And, because SWOT analysis is usually done in conjunction with strategic planning, which may only take place every three to five years, it may not remain as relevant.
So, what is the best way to make ERM part of your institutional mind-set?
ERM is really intended to be part of routine planning processes rather than a separate initiative. The ideal place to start is with buy-in and commitment from the board and senior leadership. I think a good time to start is when we regularly ask people to think about the next year, or the next 5 or 10 years. The annual budget process is [the time] when we make requests to initiate programs or services or begin laying the groundwork for new capital projects, for instance. This is when we should also ask staff and faculty to think about potential risks. Of course, ERM also requires asking how external events or circumstances might impede our ability to meet goals or maintain operations. For example, if fuel prices go up significantly, what maintenance programs will we need to delay? Where will we shift resources to make up the difference? Would we need to consider layoffs? This is essentially about turning your entire campus staff into risk managers in the “big R” sense. I think some try to make ERM too complicated, but this doesn’t have to be a term paper. It can be a one-pager.
What strategy might work best for institutions that are at the initial stages of ERM implementation and need to gather support and input?
One approach is to first engage campus leaders and academic and administrative directors at different levels in the organization. Schedule informal one-on-one interviews asking them to identify their concerns—what keeps them up at 2 o’clock in the morning? This can build support as you roll out your ERM program institutionwide. Key to making this routine is to ensure that communication goes full circle. Talk about the risks you’ve identified and how you might address them—perhaps by recruiting in a particular area, or opening up satellite campuses, or reinforcing the professional development for faculty and staff. When people know ERM is expected and valued, then everyone gets better at identifying and assessing risk. Foremost your president, his or her cabinet, and your governing board must set the tone and make it known that this is a worthwhile endeavor for the entire college or university—from student and academic affairs, to your development office, to your physical plant.
It seems that whenever people hear “risk assessment” or “risk management,” they think in terms of internal audit. How is ERM different?
Internal audit is focused on compliance and regulatory issues on the financial side, which essentially assess whether an institution is adhering to the operational policies and procedures it has established, such as an institution’s cash control policy, purchasing policy, endowment spending and investment policies, and research protocols. ERM assumes a more holistic approach—hence, the word enterprise. So, ERM may consider changing demographics, an institution’s ability to access credit, faculty and staff talent, and how each of those areas impacts current and future goals and the capacity of the institution to accomplish its overall mission.
Now, good internal auditors do engage in a sweeping review of the institution, and they have a critical and indispensable role to play and have been great champions of ERM. But for internal audit to run ERM is, I think, somewhat like having the fox guarding the henhouse. If they actually run the process, I’m concerned that they lose their most important function, which is as an independent reviewer of operations.
To the point of who should be in charge, I know some suggest ERM be managed out of the general counsel’s office. What’s your thinking on that?
I am less hung up on who the champion should be as long as that person has the time, resources, ability, and influence to make it happen. If general counsel wants to lead an institution’s ERM initiative, I would support that involvement if the person has the voice and the enthusiasm to provide strong backing of the process. I do think that most general counsel offices have so many tactical and operational challenges filling their plates that ERM may not get the longer-term sustained support that it requires.
For many institutions, the CFO is a likely candidate to carry the banner forward. More so than most, [CFOs] typically have that long-term perspective because they oversee the management of endowments in perpetuity and the construction of buildings for which they are responsible for decades. And yet, I know of one campus where the dean of students led the charge.
What differences have you noticed between implementation of ERM within higher education and within the corporate sector?
Overall, I think the business world is more accustomed to asking competitive questions, like, “Who’s going to eat our lunch?” Corporate leaders are trained to think about adverse outcomes and about making investments and recalibrating the business plan in an environment that is constantly changing. This is not as apparent in the culture of many higher education institutions.
ERM requires a level of candor and transparency that can sometimes be challenged within higher education, which by nature is an optimistic industry. Because we’re constantly promoting our institutions to our community, our donors, our students, and the faculty we want to recruit, to take time to become sober in spirit and talk about bad things that could happen is, understandably, a difficult discussion to have. Yet, at the same time that we focus on increasing student population, we need to evaluate whether changing demographics could eventually put our enrollment numbers in the tank.
Now, it may be difficult to look at the person whom you’re asking for $5 million, or who will plead your case on the floor of the state legislature, and be brutally honest about the potential risks your institution faces. However, I also believe that most stakeholders feel greater comfort when we are honest about our vulnerabilities—if we can also tell them what we plan to do in response.
At the University of Missouri, we’re trying to develop an ERM framework that helps us identify, relative to our strategic goals and objectives, the potential risks, mitigating action steps, and residual risk we agree we can live with. Regarding the latter, how should CFOs help others think about appropriate levels of risk and risk tolerance?
That’s probably the hardest part of this process. How much of our capital can we afford to lose? How low can our state support dip before we become a different kind of campus? How far can our enrollment numbers drop before this jeopardizes our revenue needs? What if our research funding decreases by 10 percent? What if it increases by 10 percent?
It’s difficult to quantify much of this, or to set specific guidelines and thresholds in each area and then establish appropriate backstops to mitigate adverse impacts. Yet, if nothing else, the candor required by these discussions provides an opportunity to unload our fears and begin doing some constructive contingency planning. While the conversations are hard, they’re also healthy. To not have a discussion about risk tolerance can ultimately do a disservice to our institution by catching us off guard when the unexpected happens. At its core, ERM is about putting all your cards on the table, asking tough questions, and then developing plans so that you’re always ready to respond to potential risks and opportunities.
NIKKI KRAWITZ is vice president for finance and administration at the University of Missouri System, Columbia.