Blogs

Explore the advantages of establishing links between these processes

The Current, Common Structure

Higher education enterprise risk management (ERM) programs are often embedded into administrative or operational units, whereas management of major crises – particularly “business crises” – typically occurs in ad-hoc executive-level meetings or mission-specific institutional siloes. This separation is a missed opportunity. Integrating ERM and crisis management (CM) provides benefits to both processes – and ultimately the institution itself – in maximizing the strikingly similar skillsets of successful ERM and CM practitioners, building risk leader credibility and institutional knowledge, and incorporating a more focused long-term perspective into crisis decision-making.

The typical separation between ERM and CM is problematic, though perhaps not unsurprising given the historical evolution of the disciplines. ERM emerged as its own discipline in the early 2000s and has grown in presence and importance at colleges and universities in the past decade. The ERM function often reports to finance & administration, operations, general counsel, or audit. Anecdotally, ERM programs may focus too narrowly on operational efficiency and skew toward “risk avoidance,” and URMIA members know that securing leadership buy-in is among the most vital yet difficult parts of succeeding as an ERM practitioner.

In contrast, crisis management is frequently not clearly defined as a distinct discipline (beyond emergency management or traditional risk management). Generally, CM refers to addressing an intense shock – often one unexpected in timing, size, or complexity – that could severely impact an institution’s core mission/business. CM is often led, formally or informally, by the president’s office/chief of staff, or alternatively by the provost’s office, chief operating officer, or chief of finance & administration. Its objectives are often limited to immediate problem-solving and institutional protection, and it does not routinely focus on optimizing the incorporation of long-term objectives, risk, or perspectives.

Advantages to an Integration of the Processes

These differences in the current approach belie the similarities between ERM and CM. The integration of long-term risk management (via ERM) with short-term management of actualized risks (via CM) is crucial for several reasons:

1. Similar skillsets are vital in determining practitioner effectiveness
2. Building credibility of risk leaders and broadening risk leader understanding of the executive decision-making process, specific to that institution’s key personnel, increases the influence and value of ERM
3. Incorporating a more focused long-term perspective into crisis decision-making leads to more optimal executive decision-making.

Successful ERM and CM practitioners have a significant overlap in the skillsets required to maximize effectiveness: quick and accurate issue-spotting; awareness and incorporation of broad organizational perspective and levers of influence; and the importance of fostering relationships, as opposed to technical expertise, in a bureaucratic setting.

The ability to accurately perceive organizational risk is a prerequisite for ERM success – notably, “identification” is the first of the five steps in a typical ERM cycle¹ – and similarly, crisis management experts must be able to spot risks and the interconnections between various risk vectors.

Both ERM and CM practitioners must have awareness of, and incorporate, a broad organizational perspective (not just one department/silo), and crucially, they must have the capacity and deftness to understand organizational levers of influence.

Relatedly, both ERM and CM address cross-functional risks, so someone adept at traversing organizational silos quickly and effectively will succeed in both roles. Furthermore, successful ERM and CM practitioners rely on strong relationships (either through formal organizational channels or outside of them), perfecting their approaches to influence leadership decision-making and embed concepts of risk-awareness and risk-optimization into an institution’s ethos.

Linking ERM and CM builds credibility for both functions, especially when the same leaders manage both ERM and CM. Access to leadership – and trust from leadership – is a critical factor for a successful ERM program, and is obviously critical for CM in a crisis. What better way to build trust and credibility for long-term risk management than by working through crisis moments together? More colloquially, it is the “foxhole” concept: those involved together in crisis moments are bonded through those experiences.² Like others who served on a college or university leadership team during the onset of the COVID pandemic, I can personally attest to the quickly built and long-lasting nature of relationships developed during that crisis response process. Addressing crises together ensures that ERM leadership is a trusted voice among higher ed executives. Furthermore, this advantage carries beyond the C-suite; a successful ERM program depends on regular interaction with key risk owners and managers at various organizational levels, so collaboration during crisis moments also reinforces relationship-building across the institution.

A related advantage is that linking ERM and CM builds risk leader understanding of executive decision-making processes. ERM is reliant on understanding institutional context, customs, and practices; specifically, disseminating risk-related analysis that resonates with decision-makers (executives, VP- and AVP-level stakeholders) and governing officials (board members). Successful ERM practitioners know what level and format of data are persuasive for decision-makers and thus don’t waste time on irrelevant data acquisition and analysis. Active ERM leader involvement in CM provides the valuable perspective of how decision-making and risk prioritization occur in high-stakes situations, which inform ERM leaders in conducting ERM analysis and dissemination.

Finally, incorporating ERM into CM assists in structurally including long-term perspectives into crisis decision-making. Decision-makers in crisis moments must focus on urgent threats, especially if immediate safety or organizational risks are apparent. But far too frequently, a short-term perspective crowds out sufficient consideration of long-term organization threats that may more determinatively harm the college or university. Having a strong ERM leader in discussions during crisis moments ensures long-term risks are raised at the appropriate time and not buried under an avalanche of short-term action items. More pointedly, strong risk leaders will ground their advice in the established ERM structure that was set up specifically for such long-term risk consideration. Risk leaders monitor all major risks – and have deep knowledge of high-priority risks – and as noted by technology writer Aditya Kumar, incorporating a specific ERM voice in crisis decision-making “not only minimizes potential damage but also enables organizations to leverage opportunities that emerge amidst challenging circumstances.”³

My current institution, Johns Hopkins University (JHU), intentionally integrated ERM and CM functions when introducing the chief risk officer (CRO) role in 2011, with great success. In 2023, I was hired as deputy chief risk officer (DCRO) – and my job description explicitly includes both ERM and CM responsibilities. Specific examples I’ve encountered during the past 2+ years at JHU have demonstrated the wisdom of linking ERM and CM. It is notable – but not surprising – that many of the highest-level ERM risks over that time were also instigators for crisis management moments. Fortunately, the JHU organizational setup has resulted in direct engagement of the CRO and me in those crisis moments, which I believe led to better short- and long-term institutional decision-making.

Next Steps to Create This New Functionality

If you are persuaded that linking ERM and CM would benefit your institution, here are concrete actions you can take to integrate those functions.

• First, hire for – and develop – the right skillsets for ERM/CM program leaders. Using JHU’s example: the inaugural CRO had a background in CM and emergency management, and he was paired with an F&A leader who valued ERM. As the need for capacity grew, JHU posted the DCRO position with the explicit intention to hire someone with both ERM and CM experience.⁴
• Second, consider the openness of college/university leadership to a flexible organizational structure. Linking ERM and CM is not the typical higher ed organization model, but many leaders might consider expanding ERM and CM organizational connections through a dotted-line reporting relationship or exploring the model’s benefits through a pilot program or workgroup.
• Third, develop written processes for both ERM and CM – commonalities between the processes will be apparent and can jumpstart more integrated actions. As JHU’s Chief Risk Officer Dr. Jonathan Links says: “Because ERM and CM use a surprising amount of the same muscles, creating a common structure and set of processes is the most effective and efficient approach in both spheres.”
• Finally, a crisis moment may catalyze integration between ERM and CM, so if that moment hits your institution, seek an opportunity to link ERM and CM during or after the crisis (one idea: ERM/CM integration could be a recommendation in an After-Action Report).

Ultimately, ERM and CM should not operate in separate institutional silos; aligning them will strengthen both the institution’s long-term risk management process and short-term crisis response effectiveness.

Insights Home

#InsightsArticle