RMG.3/08-09

THE UNIVERSITY OF WARWICK

University Risk Management Policy:

Seeking Opportunities and Minimising Threats

Proposed additions are underlined, deletions struckthrough.

Context and Purpose

The University has been operating a formal University risk management procedure since 2001/02. The process has included identifying risks and relevant management controls and then monitoring those University-wide risks which have been identified as the most significant. The University now seeks to embed the principles of good risk management and opportunity identification in all levels of decision-making. In doing so it aims to ensure that any new process is not overly bureaucratic but acknowledges the need to provide evidence of good practice where this is being achieved. To support this development of risk management at Warwick, we reviewed our risk management procedure in 2007/2008. Some changes to our procedure are being implemented as a result.

The implementation of the University’s Risk Management Policy does not only affect those risks which would have a direct, quantitative financial impact on the University’s operations but also highly qualitative areas of risk, for example the University’s reputation and external profile. Risk management and the identification of opportunities is undertaken at the University of Warwick as a positive business driver that should encourage innovative and entrepreneurial approaches to the activities we undertake while assessing and accounting appropriately for the risks that the University faces. In developing the University’s approach to risk management it is acknowledged that it is important to ensure we pursue new beneficial areas of activity and identify new ways of undertaking our existing activity which further our institutional goals, despite potential elements of risk as there could be higher associated risk in taking no action.

The Risk Management Policy is only part of the system of internal controls operated by the University. The internal controls system encompasses a number of elements that facilitate effective and efficient management and governance of the institution. These include the setting of University goals within our University Strategy, the monitoring of key performance indicators, budgeting and business planning arrangements, policies and procedures to control risks (including insurance), internal and external auditing and the consideration of reports by the Audit Committee and the Council on internal controls within key areas of activity. The University’s business continuity planning and the health and safety processes are also increasingly aligned to the risk management process.

The Council is ultimately accountable for ensuring that risk management and the identification and pursuit of opportunities are undertaken by the University. The Council must be kept informed of the University’s total risk portfolio when reaching its decisions as well as receiving appropriate reassurance as to the effectiveness of the processes in place to monitor and assess the University’s risks. While ultimate accountability rests with the Council, individual senior managers are best placed to monitor risks and the appropriate controls that are in place on a ‘real time’ basis. The Council must therefore delegate, to a significant degree, the role of managing University risks on a day to day basis to the University’s senior management team and the consideration of the effectiveness of the University’s Risk Management Policy and Procedures to the Audit Committee.

The University Risk Management Policy outlines the University’s broad approach to risk management and the general responsibilities of those involved in risk management. It should be read in conjunction with the University Risk Management Procedure which provides details as to the methodology used to implement the Policy.

Aims

The aims of the University Risk Management Policy are:

To aid University strategic and business planning and the identification and consideration of new opportunities at all levels.

To enable efficient planning and prioritisation of University resources.

To help decision-makers avoid unnecessary difficulties and to make effective plans.

To support management consensus in decision-making.

To support appropriate recognition and accountability.

To ensure relevant and consistent communication relating to risk management and opportunity identification to the Council.

To set and manage the risk portfolio of the University.

To meet the statutory responsibilities of the University such as the Statement of Internal Controls in the University’s accounts.

Roles in Relation to Risk Management and Opportunities Identification, Control and Assessment

The incorporation of good risk management and opportunities identification into management and decision-making is important at all levels of the University. That being the case, the following list outlines the responsibilities of those individuals and groups who have specific roles within the University’s risk management and opportunities identification process.

3.1	University Risk holder: The senior manager within the University who has the responsibility for monitoring and making an initial assessment of the status of an area of risk identified on the University Risk Register and alerting the University to any significant change in status on a termly basis. The risk holder may not necessarily be empowered to take direct action to control the risk but should alert those individuals or bodies who should.

3.2	Heads of Department: All heads of academic, academic-related, commercial and service departments should incorporate the principles of good risk management and opportunities identification within their planning and decision-making, encouraging those within their department to do the same. This ongoing process will include undertaking an annual assessment of departmental risks and potential opportunities in relation to the department’s strategic priorities. This should be discussed at a departmental staff meeting or as part of a departmental away day or equivalent. To support risk management at departmental level, each Head of Department is advised to nominate a senior colleague as a risk management and business continuity contact. Departments are expected to report the outcome of risk assessment within the 5 Year Planning Process, the Strategic Departmental Review Process and potentially within any Internal Audit undertaken of the area of activity. Any significant changes to a departmental risk assessment outside this schedule, for example following a discussion at a staff meeting, should be reported to the Operational Risk Management Group, via the Deputy Registrar’s Office.

3.3	Senior Officers and Senior Management Team: The Senior Management Team will act as ‘sponsors’ of the implementation and further enhancement of the University Risk Management Policy and Procedure and will facilitate communicating these to Heads of Departments. The University’s Senior Officers and Senior Management Team will implement and actively manage the University Risk Management Policy and Procedure within their respective areas of responsibility. They will encourage understanding and application of the Policy and Procedure to Heads of Department, share good practice in relation to risk management, and identify and recommend any changes necessary to the Policy and Procedure. Senior Officers will consider and assess on a regular basis the University risks on the University Risk Register and will review (and propose amendments if required) on an annual basis the University’s Risk Register and recommend the University’s key risks to the Steering Committee.

3.4 Steering Committee: The Steering Committee will incorporate the principles of good risk management and opportunities identification in their planning and decision-making. They will continue to consider the risks associated with the decisions taken and instigate action where the Committee has concerns regarding the management of any of the risks. To facilitate this, any reports seeking a significant policy or financial decision should include a brief paragraph summarising the key risks and indicating what measures are in place to address them. The Committee will consider on an annual basis (typically in the summer term) the University’s key risks as part of the approval of the University Risk Register and recommend the University’s key risks to the Council. The Committee will also review the risk status summary of the University’s key risks on a termly basis before consideration at the Council.

3.5	Strategic Risk Management Group: The Strategic Risk Management Group will oversee the implementation of the University Risk Management Policy and Procedure, particularly the engagement of academic departments with the risk management and opportunities identification process. The Group will consider the risk management and opportunities identification guidelines that will be provided to departments as part of the annual 5 year planning process. The Group will also receive reports from the Operational Risk Management Group on significant changes to departmental-level risks. The Group will normally consider and assess on a termly basis the University risks on the University Risk Register in conjunction with the Senior Management Team and will review (and propose amendments if required) on an annual basis the University’s Risk Register and recommend the University’s key risks to the Steering Committee. The Group will also receive reports from University Committees that consider risk management and related issues and a summary of risks associated with projects running under the University Strategy.

3.6	Operational Risk Management Group: The Operational Risk Management Group is responsible for monitoring the University’s insurance portfolio and establishing operational and insurance risk priorities and monitoring management measures. The Group will consider summaries of departmental risk assessments with the aim of providing feedback and identifying common themes. The Group reports to the Strategic Risk Management Group, recommending changes to the University risk register in the light of departmental risk assessments and advising on departmental risk management and business continuity processes. The Group also has responsibility for considering business continuity plans.

3.7	Deputy Registrar’s Office: The Deputy Registrar’s Office is responsible for communicating and encouraging understanding of the University’s Risk Management Policy and Procedure across the University, facilitating their implementation and sharing good practice in their application. The Deputy Registrar’s Office will support the identification of any necessary amendments to the Policy and Procedure and will ensure the timely consideration of risk management issues by the appropriate groups and that the outcomes of these discussions are appropriately communicated to the relevant stakeholders.

3.8	Internal Audit: Internal Audit has a significant role in assessing the effectiveness of the University’s internal controls and advising the Audit Committee as to the effectiveness of the University Risk Management Policy and Procedure as part of that process. The Internal Audit’s reporting to the Audit Committee will include the controls in place in relation to risk management. Internal Audit will also assist in communicating to departments the University’s Risk Management Policy and Procedure and good practice in relation to risk management.

3.9	Audit Committee: The Audit Committee will advise the Council as to whether the Risk Management and Opportunities Identification Policy and Procedure are appropriate and effective. The Audit Committee will receive regular reports and presentations on the internal controls and management of the University’s significant risks. The Committee will consider the Risk Management Annual Report in addition to advice from Internal Audit as to the effectiveness of the University Risk Management Policy and Procedure. The Committee will also report its findings to the Council as to the effectiveness of the University’s Risk Management Policy and Procedure.

3.10	Council: The Council will determine how the University perceives risk and the University’s total risk portfolio. The Council will consider and approve the University’s Risk Management Policy and Procedure and the University’s key risks. The Council, on the advice of the Audit Committee, will ensure there is an effective ongoing process for identifying, evaluating and managing the risks faced by the institution and will consider on a regular basis the status of the key risks facing the institution.

October 08

Governance\Risk Management\RiskManagement Policy Dec08.docm