Risk Management Strategy

The principal objectives of this strategy are:

• To embed risk management within the University’s operations and processes as a valuable and positive business management tool, helping the University to identify and evaluate opportunities as well as threats
• To assist the University’s resilience, and its ability to thrive in an uncertain environment
• To raise awareness of the principles and benefits of the risk management process and to obtain staff commitment to the principles and practices of risk control.

The University accepts that it must take some risks in order to achieve its goals, and to realise expected benefits. The University is committed to ensuring that risks taken will be controlled and managed, and exposure will be kept to an acceptable level.

The University acknowledges that the level of exposure carried by different activities will vary, and its threshold for accepting varying levels of risk will change depending on the risk area under consideration, the specific objectives involved, the subsequent activities undertaken, and the projected benefits.

The University is clear that it will reject or closely manage any activity that has the potential to cause significant financial or reputation harm to the institution, most notably where these might endanger the University’s ongoing viability, its ability to achieve its key strategic goals, or its ability to meet its regulatory and/or legal obligations.

The University defines Risk Appetite based on the following categories:

Based on these categories, the University’s institutional baseline Risk Appetite is defined as “moderate” to “open”. This means that, while maintaining a level of prudence, the University is generally willing to consider all options, and will accept moderate levels of risk in the pursuit of its objectives, albeit with a preference for options or activities that limit exposure, even if the rewards are likely to be similarly limited.

While a general appetite of moderate to open is in place, it is recognised that risk appetite will vary according to the objectives pursued and the linked activities undertaken. For example, the University would give consideration to activities which carry elevated levels of risk where it can be shown that the anticipated outcomes are realistically achievable, and likely to deliver enhanced benefits. Acceptance of risk, irrespective of risk appetite, should always take account of the likely benefits an activity will deliver.

At strategic level, risk appetite is applied to the University’s identified risk areas as follows:

1. Teaching quality (averse)

As it is essential that high standards of teaching quality are maintained, we should not be open to any risk regarding academic standards. We should, though, look to evolve the way we deliver our teaching, taking a creative approach whilst maintaining quality. Therefore, the overall risk appetite in this areas is averse.

2. Programme development (Moderate)

We should be willing to accept a moderate level of risk in programme development to allow for innovation and exploration of new markets.

3. Transformative and internationally recognised research (Open)

We should be open to accepting an elevated level of risk where we are exploring transformative and internationally recognised research. Our capacity for financial investment using internal funds is limited, so the balance of this financial risk should sit more with partners. However we should ensure that staff time is made available to explore opportunities.

4. Enterprise and innovation (Open)

Similar to above, although capacity for financial investment will be limited, we should be open to exploring opportunities at a relatively elevated level of risk, and ensure that staff time is made available to do this.

5. Seek out partnership and collaboration (Open)

Partnerships and collaborations are important for the overall University portfolio, profile and cultural development. A key aspect of them, though, it is to deliver a net contribution to the University’s finances. Given this, the risk appetite in this area should be set at open. All partnerships will be risk assessed but we should be willing to accept elevated levels of associated risk where potential financial benefits are significant.

6. Financial security (Averse)

Although we should be open to exploring innovative developments, partnerships and investment, we should be prudent when it comes to our overall financial security. This will require a careful consideration of the balance of risk and reward when considering activities that require significant investment, along with consideration of the appropriate level of “risk capital” which can be made available.

7. Environmental and social responsibility (Moderate)

We should have a high appetite for innovative practices in this area but this will have to be moderated by ensuring that innovations will result in key positive deliverables and will not be financially prohibitive.

8. Reputation (Averse)

Our reputation is key to attracting students and staff and creating partnerships.

Although we can build this reputation through developments where we are accepting of an elevated level of risk, our base position on reputation should be averse to risk.

9. Compliance (Avoid)

We should not be prepared to accept any level of risk on compliance. This covers our legal obligations, where failure to comply can have financial and reputational consequences and/or risk our ability to operate as a University.

10. People and Culture (Averse)

We need to maintain a culture that allows us to fulfil our purpose to create a better society through education, research and innovation, and by providing a supportive and creative learning environment in which students and staff thrive. This includes provision of an excellent student experience, and well supported staff.

We should adopt a relatively low risk strategy in this area but be open to creative thought around ways to improve the student and staff experience.

11. Major change activities (Moderate)

In order to thrive and evolve we will have to consider major change activities (such as the Innovation Park and Commercial Zone). This will have to be tempered though by careful management of operational, cultural, reputational and financial risk.

1. Court

The Court sets the overall risk appetite for the University. It is responsible for ensuring that a system of risk management, evaluation and review is established, including control and accountability. It formally reviews the Corporate Risk Register and Risk Management Strategy once a year.

2. Audit and Risk Committee

The Audit and Risk Committee is responsible for assessing the adequacy and effectiveness of risk management control and governance arrangements and for reporting its conclusions to Court. It formally reviews the Corporate Risk Register and Risk Management Strategy twice a year.

3. Senior Leadership Team

The Senior Leadership Team is responsible for ensuring that the University’s risk management, evaluation and review process is effectively applied, taking into account the University’s risk appetite. This is both to support the achievement of the University’s strategy and to ensure that risks connected to core University operations are appropriately managed. The primary tools for this are the Risk Management Strategy and the Corporate Risk Register.

Senior Leadership Team meetings will have a specific agenda item on risk at least every quarter. It is the responsibility of Senior Leadership Team members to identify and raise new risks under this item or flag up existing risks where there is a concern that they may be moving into a higher category.

If possible, an assessment (or re-assessment) of the new or increased risk should be undertaken in advance of the Senior Leadership Team meeting, using evaluation tools in the Risk Management Strategy, to allow discussion and agreement of the risk categorisation. Where a risk is particularly high profile, or difficult to assess, it will be considered further by SLT, Audit and Risk Committee or Court if required.

In addition, the Senior Leadership Team will undertake a fuller review of the Corporate Risk Register on a quarterly basis. This will involve a review and re-assessment of the categorisation of risks; progress on mitigating actions; and monitoring of residual risk.

4. Schools and departments

Schools and departments must ensure that risk is managed effectively in line with the University’s Risk Management Strategy and is reviewed and reported appropriately. Risks should be recorded in the school/department risk register, which should form part of the operational plan.

Schools and departments should formally review all arrangements for risk management affecting their activity each quarter, with updates more frequently if circumstances change. New or increased risks should be flagged to the Senior Leadership Team for possible inclusion in the Corporate Risk Register as required.

Project risks should be managed effectively in line with the University’s Risk Management Strategy. Where material, project risks should be recorded in the school/department risk register.

5. Individuals

All staff are responsible for ensuring that consideration of risk is part of the normal operation of the University. They should undertake their job within risk management guidelines, including compliance with all control measures that have been identified. Each individual member of staff has a responsibility for bringing any new or increased risk to the attention of their head of department or division.

6. Internal audit

Internal audit provides comments on the adequacy of the process in place to identify risk and the effectiveness of the control measures in place. It makes recommendations to management. Recommendations, along with planned management actions are presented to and monitored by the Audit and Risk Committee.

As indicated above, the responsibility for identifying risk sits with staff at all levels of the University.

When identifying risk, consideration should be given both to threats to which the University has to react and to risks associated with active decisions being considered by the University. The University’s Risk Management Strategy should be used to evaluate an identified risk and consider whether escalation is required. The process for the escalation of risk is also set out below.

The escalation process follows the roles and responsibilities set out above and is summarised below

1. Individual

Consider if identified risk should be escalated to school/department level.

2. School/department

Consider risk for inclusion in school/department risk register and whether the risk should be escalated to Senior Leadership Team.

3. Senior Leadership Team

Consider risk for inclusion in Corporate Risk Register and whether it requires to be highlighted to the Audit and Risk Committee for specific discussion.

4. Audit and Risk Committee

Consider risks in the Corporate Risk Register and whether any need to be discussed at Court level, taking account of the advice of Senior Leadership Team

5. Court

Consider risks identified for discussion and other risks identified as part of its work.

Not all risks faced by the University will be of the same magnitude or significance. In addition, the University does not have the resources to manage every single risk it faces. A key purpose of the evaluation stage is to filter out the risks that need to be managed from the risks that simply need to be monitored.

Each risk is assessed for the likelihood it will happen and the impact if it does happen, using a 4x4 evaluation matrix below.

Risk Criteria to support evaluation of Impact and Likelihood are provided below. Please note, these guidelines are intended to aid the process of judging the potential impact/severity of a risk. They are not intended to be comprehensive or exact. In many cases the assessment of risk may require aggregating impacts of different types, and also the possible cumulative effect of different risks happening at the same time.

When assessing impact, in many cases, the highest rated score from multiple impacts will be used. For example, a risk may have a measurable financial impact but a major reputational impact. In such a case the impact assessment would be major. The overall assessment will, in all cases, require an element of judgement by management.

In broad terms risk can be addressed using one of the four methods below:

• Tolerate: Accept the risk, either because it is insignificant or additional actions would not be beneficial.
• Treat: Take cost effective actions to reduce either the likelihood of the risk happening, the impact, or both.
• Transfer: Let someone else take the risk (eg. by insurance or passing responsibility for the risk to a contractor); however, some level of risk is likely to be retained by the University.
• Terminate: Agree that the risk is too high and do not proceed with the project or cease the current activity.

Where a risk is to be treated or transferred it is likely that this will be captured in the Corporate Risk Register. Each risk identified should have a ‘risk owner’. The risk owner should be responsible for co-ordinating any activity required to manage the risk, and for monitoring the situation to see if the level of risk changes.

The Corporate Risk Register measures inherent risk if no action is taken and residual risk following mitigating actions. Residual risk is also assessed at each review and any change recorded.

Actions are split into existing actions and actions for further control. If actions for further control are required to manage a risk it is for the risk owner to propose what action is appropriate, and to ensure that these are taken. Where possible, actions for further control should be SMART (specific, measurable, achievable, realistic and timely). If it is clear that an action for further control will continue in the long term it should be moved into existing actions.

As noted above, the Corporate Risk Register is monitored and reviewed on a quarterly basis by the Senior Leadership Team, twice a year by the Audit and Risk Committee and once a year by Court.

Some risks could impact on the ability of the business to continue operating during times of change or disruption. These risks will feed into the business continuity planning processes. Consideration will be given to having specific business continuity plans in place should these risks happen.

Certain risks emerge which could mean major disruption to our business, senior management teams, employees or accommodation. These risks will be dealt with as part of the University’s business continuity planning process.