RMG.6/08-09

UNIVERSITY OF WARWICK

University Risk Management Procedure 2008/09

Proposed additions are underlined, deletions struckthrough.

Enhancing Knowledge and Understanding

Continued effort will be invested in a communications campaign highlighting the benefits of risk management and opportunity identification to academic, commercial, administrative and support departments, endeavouring to link this where possible with the University’s Business Continuity planning and Health and Safety processes. This exercise will include the compilation and dissemination of good practice in the practical application of risk management and advice on the University’s approach and its application, in particular highlighting where good risk management has added value.

Identification of the University’s Significant Risks and Associated Controls

Departments will be asked to undertake an annual assessment of departmental risks and potential opportunities in relation to the department’s strategic priorities. This should be discussed at a departmental staff meeting or as part of a departmental away day or equivalent. As previously, the majority of academic departments and administrative and commercial units will be required to report on their risk assessment undertake a ‘SWOT’ analysis (strengths, weaknesses, opportunities, and threats) as part of the annual Five Year Planning process. These departments will also be asked to identify key departmental risks to the achievement of their strategic objectives and to assess the potential risks in undertaking any proposed new activities. Consideration of these assessments will be given by the following bodies for the relevant departments:

University Group or Committee	Departments who would be considered
Academic Resources Committee (ARC)	All non-devolved academic departments
Academic and Service Departments Annual Review (ASDAR)	All central administrative departments
Commercial and Related Activities Group (CRAG)	All commercial and earned-income departments
Financial Plan Sub-Committee (FPSC) and the Steering Committee	All devolved academic departments and those not included above
Operational Risk Management Group	All departments

Detailed advice and guidelines in undertaking this analysis will be considered on an annual basis by the Risk Management Group and distributed within the five year planning process guidelines issued by the Finance Office.

The main purposes of this exercise are threefold:

To provide a focused opportunity for individual units to consider existing and future opportunities and the associated current and future risks against their strategic objectives.

To provide relevant and consistent information to University decision-making bodies to enable them to prioritise effectively the allocation of University resources.

To aid in the identification and assessment of the University’s key risks and contributing factors to be included in the University Risk Register and to ensure the University is aware of the total risk portfolio and the cost (including opportunity cost) of risk mitigation activity.

Any significant risks, including those opportunity costs as a result of opportunities that may not be taken up, will be considered at the relevant group as identified above. The relevant group will take the risk assessments into account when prioritizing newly proposed bids and will report any significant risks to the Financial Plan Sub-Committee.

Coinciding with this process, the Operational Risk Management Group will Deputy Registrar’s Office will collect and review the SWOT analyses and identified departmental risks included in the departmental Five Year Plan submissions to determine whether there should be any amendments proposed to the University’s Risk Register or factors highlighted in the returns that would significantly impact the status of the risks already identified on the University Risk Register.

The proposed University Risk Register for the following year will be considered by the Steering Committee following consultation with Senior Officers and the Senior Management Team. The Council will receive the list of University Risks normally in the Summer Term, with an outline of the key risks (normally not more than ten in number) and the associated management measures being implemented and proposed to reduce the risk status. It is likely that the University Risk Register will not significantly change each year unless the University Strategy is significantly changed. The University risks presented to the Council will focus primarily on those University strategic risks which cut across a number of areas of the University and which are not necessarily fully covered within the delegated responsibility of the sub-Committees of the Council.

The University classifies risks into the following eight categories based on those categories suggested by the HEFCE:

R	Reputation
T	Teaching / the student experience
Res	Research
S	Staffing issues
SA	Estates and Facilities / Health & Safety
F	Financial issues
O	Organisational issues
IT	Information and IT

While these categories can be helpful in identifying the key are of the risk, risks will often be interdependent and may cross a number of the above categories.

Monitoring and Evaluation of University Risks

Risks are managed on a daily basis by those responsible for the wide-range of activities undertaken by the University. This distribution of responsibility for risk management highlights the importance of ensuring that understanding of the University’s approach to risk management is communicated widely to University decision-makers as set out above. The University also needs to ensure that key institutional risks are monitored against the University’s agreed strategic objectives. Additionally, decisions must be taken in the knowledge of an accurate assessment of the current level of risk faced by the University and whether a certain decision will increase or decrease the University’s total risk portfolio. To facilitate this, a summary report from the Deputy Registrar’s Office will be considered at one meeting of the Council each term outlining the current status of the University’s key risks as reported by risks holders (normally eight to ten in number) and whether the risks have increased, decreased or stayed the same. A brief summary will be included of any additional controls established or planned to minimise the risk for those where the risk has increased.

University Risk holders will be requested to review the University Risk Register each term and to assess the current status of the residual risk (i.e. the risk after all actions planned and being taken to reduce the level of risk have been taken into account). This risk status update will be facilitated primarily by consideration of the University Risk Register at the Senior Officers’ Group and the Risk Management Group with a revised Risk Status Summary report being considered at the Steering Committee in advance of it being submitted to the Council. In the Summer Term, a review and assessment of the University’s Risk Register in addition to the current status of any new and exsiting risks will take place as set out above.

University Risks will be ranked by both the scale of the impact and the likelihood that the risk will occur on a numerical scale from one to four. The impact and likelihood scores of the risk will be calculated after taking into account all of the mitigation measures being taken to reduce the level of both the severity of impact and the probability of the risk.

To assist in scoring the likelihood and impact of the risk, the following notional definitions will be considered.

Likelihood Score (of occurring within the next 4 years)

1	Improbable (1-20%)
2	Not likely (21-50%)
3	Likely (51-80%)
4	Very likely (81-100%)

Impact Score

1	Will impair achievement of one or a small number of strategic goals. (Financial impact on University annual surplus under approximately £250,000)
2	Will impair achievement of a number of strategic goals and/or significantly impair one strategic goal. (Financial impact on University annual surplus between approximately £250,000 and £500,000)
3	Will significantly impair a small number of strategic goals. (Financial impact on University annual surplus at approximately between £500,000 and £1 million)
4	Will significantly impair a small number of strategic goals and/or halt the achievement of one or more strategic goal(s). (Financial impact on University annual surplus over approximately £1 million)

The following four-tier ‘traffic light’ system of status indicators will then be applied to establish the overall status of the risk by adding the likelihood score and the impact scores together:

7 or 8	Red	Problematic	Requires urgent attention and decisive action
5 or 6	Amber/Red	Mixed	Requires substantial attention, some aspects need urgent attention
3 or 4	Amber/Green	Satisfactory	Some aspects require substantial attention, some good
2	Green	Good	Requires refinement and systematic implementation

This method of assessing threats will also be used, where appropriate, by Heads of Departments when considering departmental risks, the AQSC in assessing teaching quality risks, and when proposals for significant new initiatives are considered. The approximate financial impact associated with each risk impact score, however, is relevant at a University-wide level. The amounts given are notional only for those predominately financial risks, acknowledging that most University risks will have wider implications and, therefore, impact is primarily defined against the achievement of the goals set out in the University Strategy.

Review of the Risk Management Policy and Procedure

The Senior Assistant Registrar responsible for Risk Management will submit to the Audit Committee in the Summer Term a brief annual summary report on the risk management measures taken throughout the year as well as any proposed changes to the University Risk Management Policy or Procedure. The Deputy Registrar’s Office will consult the Senior Officers and the Senior Management Team in compiling this report. The report and the views of the Audit Committee will be considered by the Council to provide the appropriate assurance that the University Risk Management process is operating effectively. Consideration of the Risk Management Annual Report by the Audit Committee in the Summer Term will also allow the Committee to consider risk management issues alongside the consideration of the Annual Internal Audit Strategy and Plan.

October 2008

Governance\shared\Risk Management\RiskManagement Procedure Oct08.docm