Understand the need to embed risk oversight more deeply into your planning and governance
Drawing on Insights from Two Recent Reports
Higher education is at a critical juncture in 2025, navigating an environment shaped by financial uncertainty, political disruption, and operational complexity. The National Association of College and University Business Officers' (NACUBO) report, “State of Higher Education: Top 5 Business Issues of 2025” highlights the risks higher education institutions face—and the actions leaders can take to manage these risks as proactively as possible and strengthen resilience. “The State of Risk Oversight” report, a joint collaboration of the American Institute of Certified Public Accountants (AICPA) and North Carolina State University (NCSU) based on input from a variety of industries, discusses five key risk oversight areas. Together, these perspectives underscore the urgent need for institutions of higher education (IHEs) to embed risk oversight more deeply into their planning and governance.
Key Business Risks and Challenges Facing Higher Education
NACUBO’s survey of more than 600 business officers reveals that institutions are grappling with five interrelated issues:
- Managing Unreliable and Shrinking Funding Sources
Institutions of Higher Education (IHEs) face sudden reductions in federal grants, fluctuating state appropriations, record tuition discounting, and declining enrollment. These factors make revenue streams unstable.
- Amplifying the Value of Higher Education
Persistent skepticism about tuition, aid, and outcomes is fueling a “branding problem” for colleges. Leaders recognize the need to better communicate the societal and individual benefits of higher education while addressing affordability and student success outcomes.
Political narratives further challenge institutional legitimacy, affecting enrollment and funding. Thus the reputation and value of higher education are squarely on the line.
- Navigating Political and Policy Disruptions
Federal changes to student aid, research funding, and cost recovery rates—combined with increased state-level politicization—create planning uncertainty and governance risks. Federal changes that impact international students, including delays or changes in the student VISA process, also create financial risks to IHEs, especially those with a high percentage of international students enrolled in undergraduate and graduate programs.
- Supporting and Maintaining the Workforce
Recruiting and retaining skilled staff, coping with rising benefit costs, and addressing both morale and mental health challenges strain institutions’ ability to sustain quality operations. Many institutions struggle to offer competitive pay while maintaining fiscal sustainability.
- Meeting Rising Operational Costs
Faced with inflationary pressures, tariffs, reduced enrollment, deferred maintenance, cybersecurity threats, and compliance obligations, IHEs face steadily increasing operating costs exacerbated by reduced revenue streams – a perfect financial storm.
With Moody’s and Fitch issuing negative sector outlooks, IHEs are under pressure to rethink cost structures and resource allocation. For example, these institutions may potentially be forced to implement hiring freezes and/or reductions in workforce. Alternatively, these institutions may continue to defer funding the repair or replacement of aging infrastructure or deferred maintenance. According to Inside Higher Ed's "The Death Spiral of Deferred Maintenance", 63% of IHEs funded less than a quarter of their maintenance needs.
Unfortunately, these actions tend to increase the probability and severity of related financial, operational, strategic, and reputational risks.
Broader Lessons from Enterprise Risk Oversight
The NCSU report, based on 273 organizations across diverse industry sectors, provides a complementary perspective. Its findings reveal broader organizational practices that higher education leaders can adapt:
- Integrating Enterprise-Level Risks with Strategic Decision Making
Because most organizations’ risk management processes are not considered robust or mature in nature, opportunities are missed to better integrate risk insights into strategic planning. Risk exposures are “mostly” or “extensively” factored into decision-making in 50% of the responding not-for-profit organizations. Thus, it appears that risk-informed decision making is impaired in the balance of these organizations.
- Communicating Risk Information for Key Decision-Maker Consideration
A significant percentage of participating organizations engage in ad hoc discussions regarding risk exposures rather than scheduling meetings explicitly focused on risk concerns.
36% of the respondents from not-for-profit organizations communicate key risks as a scheduled agenda item at management meetings. 5% provide a monthly written risk management report, while 11% and 29% provide quarterly or annual reports, respectively. Compare these percentages with the 62% that engage in ad-hoc discussions at management leadership meetings. Clearly opportunities exist to elevate and socialize the reporting of emerging risks and risk mitigation progress to key decision-makers.
- Investing in Leadership to Support Effective Risk Oversight
Evidence exists that certain executives, including some boards of directors, are reluctant to invest time and resources in risk oversight. According to NCSU, “often that reluctance is based on a lack of leadership and tone at the top that reinforces the need for and value of more robust, enterprise-wide risk management.”
Rather than assigning responsibility for management of the organization’s risk management process to one individual, many organizations have moved to or are moving towards a risk management committee to oversee the process and the top risks identified by that process.
In the not-for-profit sector, 37% of such committees meet quarterly, and 26% meet on a monthly basis.
- Strengthening Risk Management Fundamentals
Emerging risks receive the least scrutiny relative to information technology, compliance, financial, and reputational risks. Unfortunately, such emerging risks tend to score high in terms of velocity and severity of impact and thus should be given formal, priority consideration.
Also, risk assessment tends to be qualitative, often focusing on the strength of applicable controls, rather than quantitative. 42% of non-for-profit respondents use a blend of these techniques, but lean towards qualitative assessment. More work is required to develop robust metrics to monitor emerging risks, such as key risk indicators that can be used to monitor movement in risk conditions over time.
- Continuing the Journey Towards Enhanced Risk Management
Risk insights bring value to strategic decision-making; however, at the senior leadership level, risk management competes with more important priorities and the resources required to fuel these priorities. Some leaders believe that the investments required to enhance the process do not outweigh the benefits. Others believe that risk is adequately managed by a decentralized, distributed approach. Thus, a holistic, enterprise-level approach is unnecessary.
Also, leadership may tend to exclude risk management from strategic discussions, thus undermining the function’s value and potential contributions to the organization.
However, key stakeholders are continuing to demand enhanced risk management processes, with direct involvement of senior executives. To some extent, this shift has been triggered by unanticipated risk events that have negatively impacted the organization – financially, reputationally, or both.
The NCSU report provides discussion topics for each of the five risk oversight areas noted above and ends the report with ten questions to consider concerning an organization’s existing ERM program.
A Path Forward for Institutions
The findings noted by both reports suggest that IHEs engage in the following activities to mitigate risks and challenges:
- Diversify and Stabilize Revenue Streams
Expand fundraising, partnerships, online learning, and non-traditional student enrollment. Re-think tuition models to reduce reliance on discounting.
- Embed Risk into Strategic Planning
Use enterprise risk management (ERM) to connect top risks—such as funding instability and workforce shortages—directly to institutional priorities.
- Strengthen Risk Communication
Establish regular, structured reporting of risk exposures to executives and boards. Charge management-level committees with performing risk assessment and implementing mitigation strategies. Ensure risk insights are linked to core strategies and investment decisions. Finally, articulate risk appetite and risk tolerances to guide risk-informed decision making.
- Invest in Workforce Sustainability
Balance competitive compensation with workplace culture improvements. Explore flexible staffing models, leadership development, employee assistance programs, and benefits redesign.
- Address Rising Costs with Long-Term Planning
Create comprehensive infrastructure plans, leverage shared services, and build contingency reserves to manage rising costs and deferred maintenance.
- Rebuild Public Trust
Proactively communicate higher education’s value through data-driven storytelling about student success, workforce readiness, and community impact
Conclusion
The convergence of financial instability, political headwinds, operational challenges, and public skepticism makes 2025 a defining year for higher education. Institutions that treat risk management as a strategic enabler—not just as a compliance exercise or a check-the-box routine to satisfy the board —will be best positioned to navigate uncertainty, protect their missions, and restore confidence in the sector.
The challenges identified by NACUBO underscore the sector-specific issues challenging higher education in 2025, while NCSU’s ERM report highlights the governance and oversight practices needed to address them. Together, they point toward a more integrated, proactive approach—where higher education leaders not only traverse today’s fiscal and political headwinds but also build resilient institutions capable of sustaining their missions in a volatile environment.
Insights Home
#InsightsArticle