Blogs

Consider this new maturation level of ERM programs

A New Era of Institutional Uncertainty

In early 2025, a provost at a large public research university convened an emergency meeting of her cabinet. The agenda had changed repeatedly over the previous several weeks as a succession of federal policy actions began reverberating across the institution. Proposed changes to graduate and professional student loan programs threatened enrollment projections. New interpretations of federal research requirements raised questions about compliance and sponsored funding. Immigration policy shifts created uncertainty for international students, postdoctoral scholars, and faculty recruitment. Heightened political scrutiny of higher education increased pressure on university leaders to communicate clearly and respond strategically.

None of these developments, standing alone, threatened the institution's viability. Collectively, however, they created something far more difficult to manage: a rapidly evolving environment in which multiple external events interacted across virtually every aspect of university operations. Financial planning, enrollment management, research administration, academic affairs, government relations, communications, and legal compliance all became interconnected in ways that traditional organizational structures were never designed to address.

What proved most striking was not the complexity of the issues themselves but the nature of the questions they demanded. The provost did not ask to review the institution's annual risk register or its latest risk heat map. Instead, the conversation centered on three leadership questions: How do these developments affect our strategic priorities? Where are we most exposed and where might new opportunities emerge? How should we approach the decision-making process when the external environment continues to change faster than our ability to predict it?

Those were not compliance questions. They were leadership questions. They also illustrate a broader reality confronting higher education. Institutional uncertainty is no longer episodic; it has become continuous. Risks emerge more quickly, interact more frequently, and increasingly cut across the boxes and lines on the org chart.

How These New Developments Impact Enterprise Risk

This changing environment should prompt an important question for those of us who work in enterprise risk: Have our enterprise risk management (ERM) programs evolved quickly enough to help institutional leaders navigate this new reality?

The question is not intended as a criticism of ERM. Quite the opposite. During the past two decades, the profession has fundamentally transformed how colleges and universities think about institutional risk. Enterprise-wide risk assessments, governance structures, mitigation plans, and board reporting have become increasingly common, and organizations such as the University Risk Management and Insurance Association (URMIA), have played a pivotal role in advancing that evolution. Institutions today possess a far more sophisticated understanding of enterprise risk than they did only a generation ago.

Ironically, however, the success of ERM has exposed its next challenge. Most mature programs have become highly effective at identifying and assessing institutional risks. Yet identifying risk is no longer the profession's greatest contribution. The more difficult challenge is helping institutional leaders make sound strategic decisions while the environment around them continues to change.

When Risk Becomes a Leadership Challenge

The risks confronting colleges and universities today differ fundamentally from those that shaped many early ERM programs. They emerge more quickly, evolve continuously, and rarely remain confined to a single operational area. A significant change in federal research policy, for example, is not simply a research administration issue. It immediately affects faculty recruitment, graduate education, institutional finances, compliance obligations, government relations, communications strategy, and long-term planning. Similarly, changes in immigration policy or student financial aid extend well beyond enrollment management, influencing workforce planning, student success, institutional diversity, and public reputation.

These issues illustrate why many of today’s risks are better understood as enterprise challenges rather than departmental risk and compliance problems. They require leaders to weigh competing priorities, make decisions with incomplete information, and balance short-term pressures against long-term institutional goals. Traditional ERM provides an essential foundation by identifying risks, assigning ownership, evaluating mitigation strategies, and monitoring progress. Those processes remain indispensable. Yet they are increasingly only the beginning of the conversation. Executive leaders must still determine how uncertainty should influence institutional priorities, investments, partnerships, and strategic direction. Those judgments cannot be derived from a risk register alone.

From Enterprise Risk Management to Enterprise Risk Leadership

This changing environment suggests that higher education has reached another important stage in the evolution of enterprise risk. The next frontier is unlikely to be found in more sophisticated scoring methodologies, additional dashboards, or increasingly detailed risk inventories. Those tools undoubtedly improve organizational awareness, but they produce limited additional value unless they also improve institutional decision-making. What higher education increasingly requires is enterprise risk leadership (ERL). I define ERL as the integration of risk awareness, strategic foresight, and executive decision-making into the leadership of the institution. Enterprise risk leadership does not replace enterprise risk management; rather, it represents its natural maturation. If ERM has focused primarily on helping institutions understand their risks, ERL focuses on helping leaders navigate uncertainty while advancing institutional mission and strategy.

This shift changes the purpose of enterprise risk. Risk management becomes less an administrative process and more a strategic capability. Presidents, provosts, chief business officers, chief risk officers, and governing boards engage with risk not because they have fiduciary responsibility for or oversight of operational functions, but because nearly every consequential institutional decision involves balancing competing uncertainties. Strategy, budgeting, research investments, enrollment planning, and organizational change all become opportunities to apply enterprise risk thinking. At the same time, mature institutions begin discussing opportunity with the same rigor traditionally devoted to threats, recognizing that innovation and institutional resilience depend upon informed risk-taking rather than risk avoidance.

Experimenting with ERL: A University Prototype

One prototype of enterprise risk leadership is emerging at the University of Maryland, Baltimore (UMB), where the institution's enterprise risk management program has gradually evolved from a traditional risk management process into a broader leadership framework. Several years ago, UMB intentionally linked its enterprise risk assessment directly to the university's strategic planning process, requiring its schools (i.e., colleges) and administrative units not only to identify strategic goals but also to evaluate the principal risks that could prevent their achievement. Rather than treating ERM as a parallel but disconnected administrative exercise, risk assessment became embedded within strategic planning itself, allowing executive leadership to consider institutional priorities and enterprise risks simultaneously. This integration shifted the purpose of ERM from documenting institutional vulnerabilities to informing strategic decision-making.

The university's governance structure further reinforces this approach. Strategic institutional risks are considered by the Council of Advisors in Leadership Involved in Broad Risk Analysis Throughout the Enterprise (CALIBRATE), an executive-level advisory committee chaired by the provost and composed of senior leaders representing the university's major academic and administrative functions. CALIBRATE focuses on institutional-level risks, evaluates their strategic implications, and develops recommendations for the president.

Complementing this work is the Enterprise Risk Management Implementation Committee (ERMIC), a broad cross-functional group representing academic affairs, research, finance, information technology, student affairs, emergency management, legal affairs, communications, and shared governance. Together, the two committees create an organizational structure in which enterprise risks are examined from both operational and strategic perspectives before informing executive decisions.

Following the 2024 presidential election, UMB confronted a different category of uncertainty. The pace of federal policy changes affecting research, immigration, financial aid, civil rights, and regulatory compliance made it increasingly difficult for even mature ERM processes to respond quickly enough. Rather than relying solely on periodic risk assessment cycles, UMB established the Issues Management Advisory Group (IMAG), chaired personally by the president and convened weekly.

IMAG brings together senior leaders from across the institution, including the president, provost, chief business officer, general counsel, research leadership, communications, government relations, student affairs, human resources, academic affairs, and other key functions to assess emerging federal developments, evaluate their strategic implications, coordinate institutional responses, and communicate decisions across the university. IMAG was not created to replace ERM; it was created to complement it by providing an executive forum for continuous strategic sensemaking during periods of rapid external change.

Viewed together, CALIBRATE, ERMIC, and IMAG illustrate an important distinction between enterprise risk management and enterprise risk leadership: ERM provides the institutional discipline for identifying, assessing, and prioritizing enterprise risks. ERL extends that foundation by ensuring that executive leadership continuously interprets emerging uncertainty through the lens of institutional mission and strategy. Weekly conversations among senior leaders become as important as annual risk assessments because they enable the institution not simply to manage risk, but to lead through it.

Taking Action Rather Than Waiting for Uncertainty to Subside

Enterprise risk leadership represents a natural evolution from enterprise risk management. It is not another committee, another reporting requirement, or another framework layered onto existing processes. Instead, it is the maturation of enterprise risk management into a leadership discipline that equips institutions to anticipate disruption, make more informed strategic decisions, and pursue ambitious missions despite uncertainty rather than waiting for uncertainty to subside. Risk has always been part of higher education. What has changed is the expectation placed upon institutional leaders. Their challenge today is no longer simply managing risk. It is leading confidently through it.

Insights Home

#InsightsArticle