Risk Management

 

Risk Wheel

 

Risk Management at HSC helps to establish a structured process for recognizing, evaluating, mitigating, and monitoring risks to facilitate our institution in fulfilling its mission and objectives. This continuous approach helps to identify, assess, prioritize, and address risks that might affect strategic roadmap, mission and purpose. Risk Management involves a step-by-step method to efficiently manage risks in a cohesive manner, enabling our institution to proactively handle risks and achieve their objectives. 

Risk management is like wearing a seatbelt while driving. It involves identifying, assessing, and preparing for potential problems that could happen in any situation, just like we anticipate a possible car accident by wearing a seatbelt. By recognizing and understanding these risks, people and organizations can take steps to minimize their impact or prevent them from occurring. It’s about being prepared and taking precautions to stay safe and avoid or lessen the impact of unexpected events. 

Brand/Reputation Risk

Risks arising from adverse events, including ethical violations, a lack of sustainability, systemic or repeated failures and/or poor quality or perceived negative social sentiment. 

Compliance Risk

Risks related to violations of federal laws and regulations, state laws, and regulations, local municipal laws, case law, accreditation standards, University policies and procedures, and contractual obligations, including contractual agreements, employment contracts, and collective bargaining agreements. 

Environment, Social and Safety Risk

Risks related to injury, damage, or health and safety of the faculty, staff or students of UNT Enterprise, including impacts caused by accidental or unintentional acts and external events such as natural disasters and social sentiment. 

Financial Risk

Risks related to physical assets or financial resources, such as: tuition, government support, gifts, research funding, endowment, budget, accounting and reporting, investments, credit rating, fraud, cash management, insurance, audit, financial exigency plan, overall debt, etc. 

Governance Risk

Risks arising from misaligned priorities, policies, authority, responsibilities, and/or ineffective or disproportionate oversight of decision-making, strategy, or performance. 

Operational Risk

Risks arising from inadequate, poorly designed or ineffective/inefficient internal processes. This includes any internal and external event that disrupts normal business operations relates to delivering academic programs, conduct research, manage vendor relations and manage facilities.  

People Risk

Risks encompassing the vulnerability an organization faces to inadequate workforce planning; ineffective talent acquisition and management; negative impact on employee well-being; insufficient adherence to institutional culture, environmental and social standards; and increasing economic risk due to increasing labor costs.  

Strategic/Mission Risk

Risks or opportunities related to achieving the UNT Enterprise’s mission. 

These risks can arise from identifying and pursuing a strategy that is poorly defined, based on flawed or inaccurate data, fails to support the delivery of commitments, plans, and objectives to our customers, due to a changing micro and macro environment.  

Opportunities may arise from pursuing an innovative, creative strategy or addressing a need.  

Technology Risk

Risks arising from technology insufficiently meeting business needs, services delivery failures, deficient developmental processes, lack of resilience, or security threats that may disrupt or negatively impact business operations.  

 

Risk Block ResizedRisk Methodology

 

At HSC, we use a structured approach to manage potential risks. Our method involves identifying, evaluating, and addressing risks that could affect our goals. We prioritize these risks and continuously monitor and manage them. This helps us proactively handle challenges and maintain a safe and successful environment for all.

 

Likelihood Rating Scale

Likelihood is the probability with which a risk event or threat is estimated to occur within a specified timeframe.

Take into account:

  • Volume -- The higher the volume of transactions, the more likely a risk event or threat can occur.
  • Complexity -- The more complex a transaction, process, or strategy, the more likely a risk event or threat can occur.
  • Issues -- If issues have occurred in the past, the more likely a risk event or threat can occur in the future.
  • Changes -- If an area is going through changes, the more likely a risk event or threat can occur.
1- Very Unlikely2- Unlikely 3- Possible4 - Likely5 - Very Likely
The event may occur only in exceptional circumstances. (less than once in 10 years)Not expected but the event may occur at least some time. At least once between 5 and 10 years.The event could occur at some time. At least once between 1 and 5 years.The event will probably occur in most circumstances, once per yearThe event is expected to occur or has occurred and is expected to continue an impact more than once per year.

Impact Rating Scale

Impact is the measurement of the effect or consequence of the event or threat has on UNT System and its component institutions. Please note that the dollar impact is a rough guide and not an absolute. In some cases, an attribute (e.g. Reputation) may have a devastating impact, even though the dollar amount might be low.

1- Very Unlikely2- Unlikely 3- Possible4 - Likely5 - Very Likely
Experience insignificant inefficiencies, damage, litigation, reputation, and/or financial losses, resulting in potential losses of < .1% of Total Assets.

Experience minor inefficiencies, damage, litigation, reputation and/or financial losses, resulting in potential losses,

between 0.1% AND 0.25% of Total Assets.

Experience moderate inefficiencies, damage, litigation, reputation and/or financial losses, resulting in potential losses,

between 0.25% AND 0.5% of Total Assets.

Experience significant inefficiencies, damage, litigation, reputation and/or financial losses, resulting in potential losses,

between 0.5% AND 0.75% of Total Assets.

Experience severe inefficiencies, damage, litigation, reputation and/or financial losses, resulting in potential losses of more than

>0.75% of Total Assets.

 

Velocity Rating Scale

Velocity is the estimation of how quickly the risk event or threat may occur, representing the amount of time UNT System and its component institutions would have before experiencing the event. This can also be defined as speed of onset.

1- Minimal2- Low Speed3- Moderate Speed4 - High Speed5 - Rapid Speed
The risk event occurs over the course of more than 1 academic year. There will be time for reaction and response planning before serious consequences of the risk hit.The risk event occurs over the course of >9 months; more than two academic semesters. There will be somewhat time for reaction and response planning before serious consequences of the risk hit.The risk event occurs over the course of 3 - 9 months; between 1 to 2 academic semesters. There will be limited time for reaction and response planning before serious consequences of the risk hit.The risk occurs over the course of 1 - 3 months or within an academic semester. There will be very little time for reaction and response planning before serious consequences of the risk hit.The risk event occurs rapidly, with little to no warning. There will be no time for reaction and response planning before the seriousness consequences of the risk hit.

 

Resourcing Rating Scale

 

Resourcing is the measurement of sufficient resource allocation to manage and mitigate the risk event or threat.

 

1- Optimally Resourced2- Adequately Resourced3- Moderately Resourced4 -Inadequately Resourced5 - Not Resourced
Optimal number of readily available or deployed resources to manage the riskAdequate number of readily available or deployed resources to manage the riskModerate number of resources available or deployed to manage the riskInadequate number of available or deployed resources to manage the riskNo immediately available or deployed resources to manage the risk

Control Effectiveness Rating Scale

Control Effectiveness is the measurement of how effective your controls or perform risk management activities reduce the risk event or threat to an overall acceptable level.

1- Very Effective2- Effective3- Moderately Effective4 -Ineffective5 - Nonexistent
The risk is adequately and very effectively controlled and / or managed to reduce the risk to an acceptable level. (e.g., fully automated, or outsourced)There are effective controls and / or risk management activities in place to reduce the risk to an acceptable level.There are moderately effective controls or risk management activities in place to reduce the risk to an acceptable level. (e.g., manual controls)There are ineffective controls or risk management activities in place to reduce the risk to an acceptable level.There are no controls or risk management activities in place to reduce the risk to an acceptable level.

 

Example

 

(Likelihood x Impact) +Velocity= INHERENT RISK

(4 x 4) +1= 17

 Inherent Risk Score = 17

 

Resourcing + Control Effectiveness = RESPONSE

3 + 2= 5

 Response Score = 5

 

Inherent Risk Score-Response Score=RESIDUAL RISK

17-5 = 12

Residual Risk Score = 12

 

Risk Prioritization = 2

Risk Graph2

Risk Prioritization

 

Tier

Definition

1

  • May have a significantly disruptive effect on HSC and its ability to perform core business functions
  • Requires immediate leadership attention, response, and/or moderate to high resource allocation to be managed to an acceptable level

2

  • May have a moderately disruptive effect on HSC and its ability to perform core business functions
  • Requires close monitoring and should be prioritized for response efforts and resource allocations after Tier 1 risks are addressed

3

  • May cause routine, minor disruption to core business functions
  • Requires monitoring to ensure risk does not increase, but response efforts are not immediately required

 

 

Contact Us teal phone

Contact Information 

For inquiries regarding our risk management practices, contact compliance@unthsc.edu 

 

 

This page was last modified on November 14, 2023