Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Enterprise Risk Management topic
No spam. Unsubscribe anytime.
University risk office to broaden survey pool, pursue scorecard and annual risk profile
Summary
The University's ERM team said it will reopen and broaden an institutional risk survey to include frontline employees, update the institutional risk profile annually, and explore a scorecard and deep dives to track mitigation progress.
At the same meeting, Associate Vice President for Health, Safety, and Risk Management Katharine Bonneson outlined plans to resume and expand the University’s Enterprise Risk Management program, including a broader survey of campus stakeholders, annual risk profiling and new tools to track risk mitigation.
Bonneson said ERM was established in 2022 and has been "paused" while governance structures were reconsidered; she told Regents the program will restart deliverables and intends to update the risk profile each spring and return to the Committee in the fall with the updated profile.
The ERM update identified political and economic uncertainty, artificial intelligence, data security and enrollment as top risks in higher education peer groups. Bonneson said the University will broaden its survey pool beyond leaders to include frontline employees, student employees and faculty so the risk profile reflects more diverse perspectives.
On tracking mitigation, Bonneson described plans for prioritized "deep dives" into selected risks and said the ERM team is considering a scorecard product to monitor whether the University is becoming more resilient or losing ground on specific issues. She said governance groups will decide how public and how frequent such products should be.
Board members asked whether the University should increase the cadence of information security updates; Bonneson and Chief Auditor Gaalswyk said the Committee could consider more frequent briefings, and Bonneson deferred technical detail to Brian Valen, who told the Committee that security programs exist to identify and manage threats but acknowledged that "no information security is going to be perfect".
Bonneson said the team plans to launch the updated survey in the next two to three weeks, complete the updated risk profile, pursue governance alignment over the summer and return to the Committee in the fall with results and recommended next steps.
