University risk team will focus 2025–26 deep dives on research, reputation and student experience

At the Oct. 2025 Audit and Compliance Committee meeting, Associate Vice President Katherine Bonison presented an annual enterprise risk management (ERM) update and outlined the program’s planned deep dives for 2025–26.

Bonison said ERM, which the university adopted in 2022, is intended to surface enterprise-wide themes and align mitigation with the university’s strategic priorities. “Enterprise risk management is fairly new to the University of Minnesota,” she said, adding that ERM organizes unit-level work into an enterprise view so leaders can discuss priorities, mitigation and risk tolerance.

Bonison reviewed peer benchmarking through the Big Ten ERM consortium and national surveys, noting the university mostly aligns with peer institutions but that third-party vendor management surfaced more prominently in the broader higher-education list than it did at the university. She identified recurring themes raised in interviews across campuses, including artificial intelligence and the effects of decentralized, siloed structures on consistent standards and processes.

The executive oversight committee selected three topics for 2025–26 deep dives: research, reputation and student experience. Bonison described the ERM cycle as a continuous loop of identifying risk themes, conducting deep dives, and working with risk owners on mitigation and measurement; examples of current mitigation work included a leadership talent framework for consistent onboarding and finance-led approaches to facilities maintenance funding.

Bonison said next steps include refining governance and oversight, coordinating ERM work with the university’s new strategic roadmap and improving operational tools such as the program’s website and training materials. She told trustees the ERM team will revisit cadence and audience for risk surveys as governance and resourcing decisions evolve.