If you want to understand how tough it is to run a university anywhere in the world today, just read the news. From student and staff safety to students apparently behaving badly, fee protests to governance issues: university managers have their hands full battling the many risks they face.
This is why many universities have risk management policies, teams and processes. The problem is that, as research I’m currently conducting has showed, institutions’ attempts at formal risk management tend to be limited to a regulatory, compliance-based approach in line with government requirements but goes no further. There’s little actual integration of formal risk management principles in daily decision-making at all management levels.
So while an institution identifies and assesses risks and logs these in a risk register, this is often a once a year effort that happens just before internal audit and annual reporting. Theoretically, the risk register should be a live document that continues to inform decision making during management meetings throughout the year. In practice, it often becomes the last meeting item that universities never get around to.
This means that an institution’s risk register becomes a costly artefact that adds no real value. Its contents will appear in internal audit documents and annual reports, but will not actually mitigate a university’s risks in a meaningful way.
One of the reasons for this is that working with – and even just thinking about – risk is difficult. Risk has to do with uncertainty; people struggle to conceptualise and manage that which they are unsure about.
My colleagues and I are busy with research on the use of data from risk-related news reports to facilitate the risk identification and assessment process. We hope to present some of this research at a conference later in 2017.
Although relationships between media reporting and risk perception have been researched in the climate change and health science fields, the constructive use of data gathered from news articles in higher education risk management hasn’t been actively reported in the academic literature.
Risk and human influence
Risk is about uncertainty in the sense that, as author and risk management guru Douglas W. Hubbard puts it, “something bad could happen”. Human beings struggle to identify and manage events we’re uncertain of – those which haven’t happened yet. It’s far easier to focus on what’s already gone wrong. That’s why managing the operational fallout of current and recent risk events is – erroneously – called risk management.
But your judgement is impaired during stressful and uncertain times. Psychologists Daniel Kahneman and Amos Tversky explained why in their seminal 1974 work showed that while it’s natural to focus on that which is recent and available to us when we’re making decisions, it comes with an inherent danger: we may neglect to identify and manage other, equally probable and even more damaging risks.
This very human limitation makes implementing risk management difficult in all organisations. It’s certainly not limited to the higher education sphere, and is equally common in corporate spaces and other complex organisations.
All of this may suggest that formal risk management is a lost cause. But our research provides an evidence-based way of looking at risk that allows managers to learn from others’ experiences, creating a collective institutional memory. If universities are willing to learn from their counterparts all over the world – and to carefully monitor the news – they can go a long way to mitigating risks in a practical, helpful manner.
Understanding and reacting to risk
In practice, overburdened university management teams often simply don’t have the time or the resources to actively share their risk experiences with other institutions by, for instance, setting up email or phone conversations, or organising face to face meetings.
That’s where news reports, freely available on the internet, come in.
As part of our ongoing higher education research project, we’ve used news reports about universities to identify the kinds of risks other higher education institutions should be planning for.
These reports also provide information about the expected frequency of events related to these risks, as well as causes and good and bad responses to such events. Using news reports as guidelines for decision making will allow university councils and management teams to base their decisions on information from other universities’ experiences.
The news reports cover a range of topics, including access, animal rights, discrimination, ethics, fraud, free speech, funding, gender, governance, protest, quality, racism, rankings, religion, research, safety, sexual assaults, social media and teaching.
All of these issues can negatively impact a university’s ability to deliver on its objectives. In doing so, they indicate potential risks that should be planned for.
Once we’ve collected event reports, we link to the risk types that university managers must consider when making decisions as part of their roles. This is illustrated in the diagram below.
Asking the right questions
With these reports in hand, university stakeholders ought to be able to ask pertinent risk-related questions about their own institutions. These questions should be raised both before a risk event occurs and afterwards.
Such questions include:
Has the risk been identified?
How was it assessed?
What was the cause of this risk event?
What is the risk management plan should the risk event occur?
How do we know that this is a good plan?
If these questions can’t be answered, the university may face serious consequences to its reputation. Its governance may be compromised and it could even face litigation.
University management teams must guard against being so focused on recent events – for instance, student protests in South Africa or academic strikes in Kenya – that they don’t plan for other possible risk events. They can do so effectively by looking to other institutions’ experiences and lessons, and using the information to mitigate risk in this way.