Mary M. Barnett, Virginia Community College System, is president of the Association of College and University Auditors. Mark Paganelli, of the University of Tennessee System, is the immediate past president of that organization. In Business Officer they explain and take a look at the growth of Internal Audit Committees and some ramifications.

This is an excellent source of information if your planning role will in any way intersect with these issues, as it most likely will.

These good resources are shared at the end of the article:

To start work on a strategic risk assessment, consider these useful resources:

• Risk assessment toolkit. Click here  to access NACUBO's materials and guidance on risk management. 

• Searchable database. To also assist with ERM, the Association of College and University Auditors (ACUA) has created a risk "dictionary," listing hundreds of risks facing higher education institutions, as well as the corresponding controls to help mitigate those risks. The dictionary (available for ACUA members at the ACUA Web site) is a searchable database that is updated often and is an important resource when implementing an enterprise risk management process at a university or college.

• ERM map. David Crawford, audit manager emeritus for the University of Texas System, has created a risk assessment application. Risks and controls are mapped to the institution's mission and presented in a "heat map," a graphic representation that highlights data with different colors. Such a visual is easy to present to the board and senior management and clearly shows the areas of greatest concern. This methodology has been used at several institutions in Texas and Tennessee and is currently being used at the Virginia Community College System.

• Overview and case study of ERM activities in higher education. Read the cover story, "Ensemble Performance," and a companion article, "Learning to Harmonize," in the December 2008 Business Officer.

In some ways doesn’t this resemble the SWOT (strengths, weaknesses, opportunities, and threats) analysis that many institutions go through as part of their strategic planning process?

That’s really what ERM is—identifying opportunities and threats in relation to your strengths and weaknesses, but with an added focus on deciding how you will respond. Most of the institutional SWOT analysis I see is focused heavily on assessing strengths. When it comes to weaknesses, the thought or planning is not always as rigorous. And, because SWOT analysis is usually done in conjunction with strategic planning, which may only take place every three to five years, it may not remain as relevant.

So, what is the best way to make ERM part of your institutional mind-set?

ERM is really intended to be part of routine planning processes rather than a separate initiative. The ideal place to start is with buy-in and commitment from the board and senior leadership. I think a good time to start is when we regularly ask people to think about the next year, or the next 5 or 10 years. The annual budget process is [the time] when we make requests to initiate programs or services or begin laying the groundwork for new capital projects, for instance. This is when we should also ask staff and faculty to think about potential risks. Of course, ERM also requires asking how external events or circumstances might impede our ability to meet goals or maintain operations. For example, if fuel prices go up significantly, what maintenance programs will we need to delay? Where will we shift resources to make up the difference? Would we need to consider layoffs? This is essentially about turning your entire campus staff into risk managers in the “big R” sense. I think some try to make ERM too complicated, but this doesn’t have to be a term paper. It can be a one-pager.