NACUBO

My NacuboWhy Join: Benefits of Membership

E-mail:   Password:   

 Remember Me? | Forgot password? | Need an online account?

Business Officer Magazine
Loading

Deflect Reputational Risk

When a crisis threatens, can campus leaders quickly activate your risk management plan to counter the slings and arrows? Experts advise steady vigilance and repeated hands-on practice.

By Margo Vanover Porter

*Reputation is a major driver of value for a university," says Mark S. Beasley, Deloitte Professor of Enterprise Risk Management, North Carolina State University (NC State), Raleigh. "Anything that paints your reputation in a bad light is a ding in that asset. We've seen a host of reasons—athletic scandals, a security event, or a research debacle—that can harm reputations."

Underscoring that reality, the 2012 Annual Crisis Report, released in June by the Institute of Crisis Management, notes education in its list of top 10 crisis categories.

In a Business Officer article in November 2012, authors from United Educators Insurance noted that changes in attitude and environment have placed immense pressure on institutions' ability to respond appropriately to emergency and crisis situations. "With every large-scale event ... the federal government raises the bar for crisis readiness through issuance of regulation, guidance, and funding," the article explained. Add the compressed news cycle to the mix, and you have the ingredients for many a misstep when responding to an emergency or a high-profile situation that puts the university—and its leadership—in a bad light.

To read the Spanish version of the article, click here.

The bottom line: Your institution's reputation requires careful and constant protection, say risk management experts.

Kathy E. Hargis, director of Lipscomb University's office of risk management in Nashville, divides a university's risk into four—maybe five—categories. "We have financial, operational, strategic, and compliance risks," she explains. "A lot of people believe that not monitoring or managing any of those four risks could have direct impact on your reputational risk. It can be a cause and effect. By not paying attention to those four, you create the fifth risk. Others believe reputation is its own separate category. I think it's a little bit of both."

In a Perfect World

To respond to the multiple threats that can arise on campuses, institutions need a comprehensive plan of attack, according to Beasley, which is why NC State has adopted an enterprise risk management (ERM) system.

"Not all universities have a formalized process to pinpoint their most significant risks," he says. "Their major mistake is being ill-informed about the big risks on the horizon, which puts campus leaders in the position of reacting to an event rather than proactively managing a risk before it occurs. The lack of risk management oversight leads to a reputation issue, because the university can't manage the process fast enough to contain negative reactions once the crisis starts unfolding." (For suggestions on ways to develop an effective risk management approach, see the companion article, "En Garde With ERM.")

Perspective

For a report on developing an ERM strategy, see the Perspective article, "Enterprise Risk Management Can Be a Strategic Opportunity," at www.nacubo.org.

Hargis reports that Lipscomb University also takes an ERM approach. "A risk management program has proven to be an effective way to mitigate not only reputational risk but financial, operational, and compliance risks to a university," she says. "It helps students, administrators, and board members know the most likely events to prepare for.

"By identifying those in advance, institutions can put plans in place to help mitigate the related impacts before they converge into a crisis event that could damage reputation. No matter your institution's size or type, don't ever think, 'This could never happen to us.' We don't have to look too far in the past to find lessons learned the hard way from a this-will-not-happen-here mentality."

Flashback ... 21 Years Ago

In an August 1992 Business Officer article on ethics and perception ...

"Ethics and image are often one and the same. We live in a world in which perception has become reality in many cases. The image of an institution is often influenced by the perception of impropriety. ... In few places in our society is the fragile issue of public trust more critical than our college and universities."

EARLE E. MORRIS JR., comptroller general of South Carolina, in a speech at the 1992 SACUBO Annual Meeting

In a perfect world, an institution's risk management plans could identify and mitigate upcoming threats before they reach maximum warp, she says. "Obviously, we don't live in a perfect world. Reality is that some things are unavoidable, such as a tornado hitting our campus. We can't control natural disasters, but we can be prepared for them by developing crisis management plans and business continuity plans."

Each institution's plan is unique, Hargis continues, because no two institutions face the same threats. "What works well in one institution may not work exactly the same way or may be ineffective in another," she emphasizes. "It's important on the front end to do a vulnerability assessment to determine the hot topics within your organization."

While Janice Abraham endorses creating a formal written plan, the president and CEO of United Educators in Chevy Chase, Maryland, advocates spending equal or more time on conducting simulations that will identify areas that need more attention or that haven't been addressed. She mentions the 80/20 rule in which most time is spent on developing the plan rather than practicing it; she believes the effort should be the other way around—20/80.

Susan Whealler Johnston, executive vice president and chief operating officer, Association of Governing Boards of Colleges and Universities, Washington, D.C., agrees that practice is critical to an acceptable outcome in times of trouble. "Any time you have a well-developed process that you don't practice, what you've got is good writing," she says. "Without practice, you may not get the result you need when you need it. At least annually, review lines of communications, first things to do, and who talks to whom. Practice sharpens everybody's focus."

All Hands on Deck

David Pajak, director of risk management and chief emergency management officer, Syracuse University, believes that testing crisis response plans has become a common occurrence on campuses these days. He points out that two conditions—the objectives of the exercise and availability of resources—typically determine whether the tests are tabletop or full-scale exercises.

"If an exercise has the potential to be picked up or noticed, the general population should be notified prior to the event that it is a simulation," he warns. "This can be accomplished by press releases as well as signage in the area where you are conducting the practice. Syracuse University has done this for its summer exercises."

In early summer, when NC State practiced a simulated event for a physical threat, Beasley indicates he received advance notice. "You want to make it as real as possible, but you don't want to alarm the public and create a disaster from the simulated disaster," he says.

A group of Nashville universities collaborated in July on a tabletop exercise involving an aggressive shooter, reports Hargis. They started out by setting the scenario and every 30 minutes or so updating the first responders with changes. "With each new piece of information, you have to reassess and modify your responses," she says. "As in real life, you never have all of the information until after the fact. It's easy to be a Monday morning quarterback, but you have to make the best decision with all of the information you have at the time." 

Abraham suggests picking a specific event—perhaps a major accident or an athletic scandal—to rehearse your institution's response. "Without a doubt, just like a fire drill, you need to practice who you are going to call; who is going to speak; who is going to develop talking points and key messages; what kind of notices go out to the public, the campus, and the external community; and who talks to the press, both local and national."

If the practice run does involve your athletic program, you will need to rehearse how you would reach out to donors in real life, she adds. "Who would make the calls, and what would they say? Who would craft the message? Thinking through those answers should be part of your crisis response."

"The lack of risk management oversight leads to a reputation issue, because the university can't manage the process fast enough to contain negative reactions once the crisis starts unfolding."

Mark S. Beasley, North Carolina State University

It's also a good idea to watch how other organizations respond to tragedies. Hargis tweaked her institution's risk management plan after both the Sandy Hook elementary school shooting and the Boston Marathon bombing, particularly in the area of social media updates. "We try to monitor events as they are unfolding at other places to determine what works well and what doesn't, and then make comparisons to our plan," she says. "Our plan is a living document. You can't create a plan, put it on the shelf, and pull it out when something happens. Things change. You need to update it and test it to see what works. Every time we have a tabletop, we test our plan and try to find ways to improve it."

After each tweak, she ensures that the appropriate stakeholders understand any plan changes and their related roles. "With any type of crisis management plan, no one person can do it all," she says. "It takes a village, so to speak, to implement."

What Not to Do

Abraham indicates that a leader's actions immediately after a crisis can cause more problems and greater harm to reputation than the original crisis. "We have found in 26 years of serving higher education that the unexpected must be expected," she says. "It's not 'Will your campus have a crisis?' It's when. Even with perpetual reminders in newspapers and the media, campuses don't spend enough time preparing to respond to these crises, which can create more harm than healing after the event occurs."

According to Abraham, many senior leaders don't have enough expertise on hand to adequately address a major campus scandal. "The tragedy at Virginia Tech, the ongoing challenges at Penn State, the issues that occurred at Duke University: These are the big, above-the-fold headlines that nobody on a campus is prepared to address. Even the very best campus communication experts are not prepared for the satellite trucks and onslaught of attention and questions that accompany such catastrophes."

"If you don't tell your story, someone else will paint that picture—and that someone else may not have all the pieces and give misinformation."

Kathy E. Hargis, Lipscomb University

In Abraham's opinion, ill-prepared institutions typically have four responses to a crisis, all of which will cause reputational damage:

1. Providing no response. Leaders ignore the situation and hope it goes away. It seldom, if ever, does. Meanwhile, members of the press-whose curiosity has been piqued—keep digging.

2. Replying "No comment." "This is almost worse than no response," she says, because it implies guilt.

3. Offering disorganized, conflicting statements. "One person says one thing, and someone who is not authorized says something else," she explains. "People talk at cross-purposes, sort of like Keystone Cops."

4. Issuing a verdict before examining the facts. Abraham indicates that she has seen examples of presidents and chancellors who—without conducting an investigation or knowing all the facts—have immediately responded to the press with, "I have complete confidence that we did nothing wrong." Or just the opposite: "These people are guilty. We're getting them off campus. They did something that doesn't uphold our values."

Any one of these approaches can have catastrophic consequences, she says. "If we look at where reputational harm occurs, it's usually one of these four responses that make it worse rather than better. A leader's role after a crisis is to begin to take immediate steps toward healing and getting the campus refocused on its mission. Those four responses delay that process and divert energy."

To prevent mishandling the media, Abraham advocates identifying and developing a relationship with an expert in crisis communication or public relations long before a tragedy occurs. 

"These crises tend to occur off-hours when the president isn't there, and somebody else is not able to respond," she says. "Identify an expert ahead of time, so he or she knows the culture and value of the institution and can help the leadership team immediately craft a response. It's not going to control what faculty and students stay, but if the institution and leadership are responding in a thoughtful and honest manner, the press will be less inclined to stand outside the dining hall interviewing people."

"Chief business officers need to recognize that reputation is probably the greatest asset the campus has."

Janice Abraham, United Educators

Hargis likes the idea of bringing in outside PR experts for a major disaster, as long as they are ready to go. "You have to have a great team of people who are on the front line from the very minute the story is unfolding," she says. "I can't stress that enough. If you don't tell your story, someone else will paint that picture-and that someone else may not have all the pieces and give misinformation."

When You Have Nothing to Hide

Risk experts repeatedly emphasize the need for transparency. Without it, they say, reputations will surely suffer.

"At our institution, we want to be transparent in all of our dealings," Hargis says. "The reputation of any institution relies on ethical and moral decisions. Anything other than that undermines reputations."

Beasley recounts a situation in which an institution became ensnared in an athletic scandal, eventually resulting in the resignations of the football coach, the athletic director, a major fundraiser, and ultimately the chancellor. "Where did they make missteps?" he asks. "They were very slow in being transparent to the root causes of major problems. It took newspaper lawsuits to force the university to release information, so the newspaper kept digging around and finding more information—all starting with poor management of a football player and his relationship with a professional sports agent. If the institution's leaders had been more transparent about what they were finding and what they knew, the perception is that the damage to the university's leadership team and reputation may not have been as severe."

He recalls another situation, this one at his own university, a number of years back, over lack of transparency about a hiring decision that eventually culminated in resignations by the chancellor, provost, and chair of the board of trustees. The person being hired: the governor's wife. "In that particular case, the chancellor denied having conversations related to this specific hiring decision," he explains. "When the press found an e-mail to the contrary from the chancellor, his credibility was destroyed and he had to resign."

In Beasley's opinion, this problem originated over a lack of transparency and was magnified when the chancellor responded off-the-cuff—and inaccurately—to media questions. Instead of saying, "Let me get back to you on that," the chancellor chose to say, "I don't recall having a conversation about that hiring decision." 

Wrong choice.

"There is wisdom in preparing," he says, "and part of that preparation is to have prearranged relationships with organizations that can help you manage and communicate in a crisis. Don't try to wing it."

What About the Board?

Where does the board of trustees fit into risk management? Trustees shouldn't be involved in day-to-day operations, Johnston points out. "Their job is to hold the administration accountable for risk management and to receive regular reports on the top issues that have the greatest potential to damage the institution's reputation, such as treatment of the endowment or safety of students. Those issues vary according to the institution."

Of course, the board should be made aware that the institution has an up-to-date crisis plan that is practiced regularly, Abraham notes. "As part of the plan, the president should reach out to the board during a crisis, explaining what is happening and what the institution is doing."

The conversation might go something like this: "You could see us on ESPN or in a story in the Wall Street Journal. This is how we are responding."

Abraham emphasizes that board members should not take questions from the press. "Boards should know who speaks for the institution—usually the president," she says. "Unless it's a specific crisis about the president, the board should support the president in his or her plan. The board's role is to make sure the campus has a plan that is practiced and they should support fulfillment of the plan when the crisis occurs."

At Lipscomb University, Hargis does not leave board communication to chance. "In our plan, we designate one person, in our case the chief of staff, who is the right-hand person of our president, whose primary role in our crisis management plan is to stay abreast of developments and communicate with the chairman and members of the board about the situation as it develops and get information back from them. Our board members live all over the country so it's not always easy to convene a meeting. What you don't want to happen is have a board member be uninformed and caught off-guard by an outside entity or agency."

Other tips shared by risk managers include:

  • Predetermine when to mobilize a response team. At Syracuse University, Pajak coordinates with predetermined departments when a crisis, such as a blizzard, affects the entire campus or a situation overwhelms the ability of one department to continue to fulfill its mission. For example, if the student health center were overrun by a pandemic and the public relations office swamped by calls, the university's response team would mobilize to assist the affected department.
  • Get acquainted with your local emergency responders. "You need to know who your partners are," Hargis says. "Build relationships with emergency responders before a crisis occurs. Trying to build relationships in the midst of a crisis will hurt you."
  • Take crisis management seriously and devote resources to training. "Chief business officers need to recognize that reputation is probably the greatest asset the campus has," Abraham says.

In the end, says Abraham, "We go to extraordinary efforts to protect our fiscal and physical and human assets. Do we put the same energy into our reputation?"

MARGO VANOVER PORTER, Locust Grove, Virginia, covers higher education business issues for Business Officer.

^ Top

Preventing Conflicts of Interest

You don't want to pick up a newspaper and read that a member of your board of trustees voted with his pocketbook instead of his fiduciary responsibility, says Susan Whealler Johnston, executive vice president and chief operating officer, Association of Governing Boards of Colleges and Universities (AGB), Washington, D.C. "Most boards have conflict of interest policies as a mechanism to control that risk," she says. "The problems arise with how those policies are implemented." 

Or, not implemented, as the case may be.

For example, she cites a hypothetical instance in which a board member with a conflict is allowed to remain in the room during a conversation and is not asked to clarify his or her relationship to the subject at hand. "If a board doesn't police itself for policy-related conflicts of interest, that is the road to a major risk problem because it appears the service is compromised. It's easy enough in local communities for a newspaper to get hold of an exchange that occurs between a board member and an institution, particularly when it looks as if the board member isn't acting as a good fiduciary but to benefit from the connection that board service offers."

Johnston thinks an effective approach is to charge a committee with implementing the policy and then ensuring that it is reviewed and is signed annually by the appropriate individuals. "Conflicts occur all the time," she says. "They don't have to be negative. Outcomes arise from the way the situation is handled."

She adds that if a member of the board gets a very large contract from your institution, be ready for a barrage of questions and be forthright about answering them. "That's a clear and all-too-common example that certainly raises eyebrows."

^ Top

No More Board Blind Spots

What your board members don't know could hurt your institution.

In a 2009 survey conducted of trustees, presidents, and administrators by the Association of Governing Boards of Universities and Colleges (AGB) and United Educators (UE), fewer than half of respondents (41.7 percent) reported that they frequently or routinely monitored reputational risks. If your board members don't know enough to fulfill their fiduciary responsibilities, your institution should establish a plan for deepening its understanding, from providing pertinent information to scheduling regular updates.

Knowledge is power, and in this case, knowledge of possible reputational risks can afford your board the power to avoid or mitigate those risks. Here are five questions your board members should know enough to ask—and you should be able to answer.

1. What are the connections between reputational risks and other types of risks facing our institution? Serious financial or safety issues can damage your institution's reputation. Financial fraud, investment scandals, sexual assault, and loss of life are serious problems and can have a lingering negative effect on how the institution is perceived by students, donors, potential faculty and staff, the surrounding community, and other constituents.

In discussions of enterprise risk, boards should spend time making connections between reputational risks and other types. This will help them complete the picture of risks facing the institution.

2. Could the way in which our board conducts its business result in reputational risk to the institution? If good governance policies and procedures are not developed and followed, the answer is "Yes." Governance risks are real, and while actual governance failures are rare, they are noteworthy.

All too often, problems occur when best practices have been adopted but not implemented. Having a state-of-the-art conflict of interest policy but failing to follow it can bring reputational harm to the board and institution. When an institution lacks transparency and a good process for presidential compensation and assessment, for example, negative press can result. To avoid these failings, boards should regularly assess their own performance and develop and implement improvement plans.

3. Does our board identify upside as well as downside risks? Much of the conversation around risk focuses on negatives-actions and situations that could harm the institution and impede progress toward achieving its mission. Paying serious attention to ways in which the institution's reputation could be damaged and determining how to avoid or mitigate those risks are good practices.

But what about the positive side? What strategic risks could strengthen the institution and polish its reputation? Would a campus expansion or new partnerships provide greater financial stability? Would the institution's reputation be enhanced? How would the reputation be affected if the institution put resources into bolstering its research efforts?

Boards should consider reputational risk in positive terms, as well as negative.

4. What are our blind spots? What are we not anticipating? Often a large percentage of board membership is composed of alumni of the institution, people with a tendency to see their alma mater's strengths more easily than its weaknesses. Some boards lose their independence by relying too heavily on trusted administrators and failing to use their own critical judgment about potential risks. These blind spots can keep a board from effectively and realistically looking beyond its established heat maps—a visual way to communicate the likelihood and potential impact of the risk—to speculate on new or unexpected risks.

Boards are most helpful to the institutions they serve when they bring fresh thinking, hard questions, and independent judgment on all issues, including reputational risks.

5. Where do our discussions of reputational risk belong? Should they be assigned to a board committee, such as the audit committee? Should the executive committee own this topic? Or should the full board engage in discussions? AGB and United Educators found that board-level discussions of institutional risks occur primarily in finance and audit committees. Another option: You can assign each board committee responsibility for reviewing the reputational risks that fall within its purview.

SUSAN WHEALLER JOHNSTON is executive vice president and chief operating officer, Association of Governing Boards of Colleges and Universities, Washington, D.C.

^ Top