Risk Management
Risk Management at HSC helps to establish a structured process for recognizing, evaluating, mitigating, and monitoring risks to facilitate our institution in fulfilling its mission and objectives. This continuous approach helps to identify, assess, prioritize, and address risks that might affect strategic roadmap, mission and purpose. Risk Management involves a step-by-step method to efficiently manage risks in a cohesive manner, enabling our institution to proactively handle risks and achieve their objectives.
Risk management is like wearing a seatbelt while driving. It involves identifying, assessing, and preparing for potential problems that could happen in any situation, just like we anticipate a possible car accident by wearing a seatbelt. By recognizing and understanding these risks, people and organizations can take steps to minimize their impact or prevent them from occurring. It’s about being prepared and taking precautions to stay safe and avoid or lessen the impact of unexpected events.
Brand/Reputation Risk
Risks arising from adverse events, including ethical violations, a lack of sustainability, systemic or repeated failures and/or poor quality or perceived negative social sentiment.
Compliance Risk
Risks related to violations of federal laws and regulations, state laws, and regulations, local municipal laws, case law, accreditation standards, University policies and procedures, and contractual obligations, including contractual agreements, employment contracts, and collective bargaining agreements.
Environment, Social and Safety Risk
Risks related to injury, damage, or health and safety of the faculty, staff or students of UNT Enterprise, including impacts caused by accidental or unintentional acts and external events such as natural disasters and social sentiment.
Financial Risk
Risks related to physical assets or financial resources, such as: tuition, government support, gifts, research funding, endowment, budget, accounting and reporting, investments, credit rating, fraud, cash management, insurance, audit, financial exigency plan, overall debt, etc.
Governance Risk
Risks arising from misaligned priorities, policies, authority, responsibilities, and/or ineffective or disproportionate oversight of decision-making, strategy, or performance.
Operational Risk
Risks arising from inadequate, poorly designed or ineffective/inefficient internal processes. This includes any internal and external event that disrupts normal business operations relates to delivering academic programs, conduct research, manage vendor relations and manage facilities.
People Risk
Risks encompassing the vulnerability an organization faces to inadequate workforce planning; ineffective talent acquisition and management; negative impact on employee well-being; insufficient adherence to institutional culture, environmental and social standards; and increasing economic risk due to increasing labor costs.
Strategic/Mission Risk
Risks or opportunities related to achieving the UNT Enterprise’s mission.
These risks can arise from identifying and pursuing a strategy that is poorly defined, based on flawed or inaccurate data, fails to support the delivery of commitments, plans, and objectives to our customers, due to a changing micro and macro environment.
Opportunities may arise from pursuing an innovative, creative strategy or addressing a need.
Technology Risk
Risks arising from technology insufficiently meeting business needs, services delivery failures, deficient developmental processes, lack of resilience, or security threats that may disrupt or negatively impact business operations.
Risk Methodology
At HSC, we use a structured approach to manage potential risks. Our method involves identifying, evaluating, and addressing risks that could affect our goals. We prioritize these risks and continuously monitor and manage them. This helps us proactively handle challenges and maintain a safe and successful environment for all.
Likelihood Rating Scale
Likelihood is the probability with which a risk event or threat is estimated to occur within a specified timeframe.
Take into account:
- Volume -- The higher the volume of transactions, the more likely a risk event or threat can occur.
- Complexity -- The more complex a transaction, process, or strategy, the more likely a risk event or threat can occur.
- Issues -- If issues have occurred in the past, the more likely a risk event or threat can occur in the future.
- Changes -- If an area is going through changes, the more likely a risk event or threat can occur.
1- Very Unlikely | 2- Unlikely | 3- Possible | 4 - Likely | 5 - Very Likely |
The event may occur only in exceptional circumstances. (less than once in 10 years) | Not expected but the event may occur at least some time. At least once between 5 and 10 years. | The event could occur at some time. At least once between 1 and 5 years. | The event will probably occur in most circumstances, once per year | The event is expected to occur or has occurred and is expected to continue an impact more than once per year. |
Impact Rating Scale
Impact is the measurement of the effect or consequence of the event or threat has on UNT System and its component institutions. Please note that the dollar impact is a rough guide and not an absolute. In some cases, an attribute (e.g. Reputation) may have a devastating impact, even though the dollar amount might be low.
1- Very Unlikely | 2- Unlikely | 3- Possible | 4 - Likely | 5 - Very Likely |
Experience insignificant inefficiencies, damage, litigation, reputation, and/or financial losses, resulting in potential losses of < .1% of Total Assets. | Experience minor inefficiencies, damage, litigation, reputation and/or financial losses, resulting in potential losses, between 0.1% AND 0.25% of Total Assets. | Experience moderate inefficiencies, damage, litigation, reputation and/or financial losses, resulting in potential losses, between 0.25% AND 0.5% of Total Assets. | Experience significant inefficiencies, damage, litigation, reputation and/or financial losses, resulting in potential losses, between 0.5% AND 0.75% of Total Assets. | Experience severe inefficiencies, damage, litigation, reputation and/or financial losses, resulting in potential losses of more than >0.75% of Total Assets. |
Velocity Rating Scale
Velocity is the estimation of how quickly the risk event or threat may occur, representing the amount of time UNT System and its component institutions would have before experiencing the event. This can also be defined as speed of onset.
1- Minimal | 2- Low Speed | 3- Moderate Speed | 4 - High Speed | 5 - Rapid Speed |
The risk event occurs over the course of more than 1 academic year. There will be time for reaction and response planning before serious consequences of the risk hit. | The risk event occurs over the course of >9 months; more than two academic semesters. There will be somewhat time for reaction and response planning before serious consequences of the risk hit. | The risk event occurs over the course of 3 - 9 months; between 1 to 2 academic semesters. There will be limited time for reaction and response planning before serious consequences of the risk hit. | The risk occurs over the course of 1 - 3 months or within an academic semester. There will be very little time for reaction and response planning before serious consequences of the risk hit. | The risk event occurs rapidly, with little to no warning. There will be no time for reaction and response planning before the seriousness consequences of the risk hit. |
Resourcing Rating Scale
Resourcing is the measurement of sufficient resource allocation to manage and mitigate the risk event or threat.
1- Optimally Resourced | 2- Adequately Resourced | 3- Moderately Resourced | 4 -Inadequately Resourced | 5 - Not Resourced |
Optimal number of readily available or deployed resources to manage the risk | Adequate number of readily available or deployed resources to manage the risk | Moderate number of resources available or deployed to manage the risk | Inadequate number of available or deployed resources to manage the risk | No immediately available or deployed resources to manage the risk |
Control Effectiveness Rating Scale
Control Effectiveness is the measurement of how effective your controls or perform risk management activities reduce the risk event or threat to an overall acceptable level.
1- Very Effective | 2- Effective | 3- Moderately Effective | 4 -Ineffective | 5 - Nonexistent |
The risk is adequately and very effectively controlled and / or managed to reduce the risk to an acceptable level. (e.g., fully automated, or outsourced) | There are effective controls and / or risk management activities in place to reduce the risk to an acceptable level. | There are moderately effective controls or risk management activities in place to reduce the risk to an acceptable level. (e.g., manual controls) | There are ineffective controls or risk management activities in place to reduce the risk to an acceptable level. | There are no controls or risk management activities in place to reduce the risk to an acceptable level. |
Example
(Likelihood x Impact) +Velocity= INHERENT RISK
(4 x 4) +1= 17
Inherent Risk Score = 17
Resourcing + Control Effectiveness = RESPONSE
3 + 2= 5
Response Score = 5
Inherent Risk Score-Response Score=RESIDUAL RISK
17-5 = 12
Residual Risk Score = 12
Risk Prioritization = 2
Risk Prioritization
Tier |
Definition |
1 |
|
2 |
|
3 |
|
Contact InformationFor inquiries regarding our risk management practices, contact compliance@unthsc.edu |
This page was last modified on July 5, 2024