You are here
A new era for managing risk
July 31, 2020
How does the university manage risk? It’s something many of us may never think about, at least not consciously, until we are faced with a crisis situation like COVID-19. Fortunately, UBC’s Office of Enterprise Risk and Assurance (ERA) thinks about it every day and provides regular insights on current and emerging risks to UBC’s leaders, faculty and staff. This helps them prepare to respond to events that could significantly harm our people, our operations and our reputation if not properly managed.
Building a best-in-class enterprise risk and assurance function
ERA was created in April 2018 to integrate two previously separate portfolios: Enterprise Risk Management and Internal Audit, and expand the scope of Internal Audit activities beyond financial risks to address the full spectrum of risks that UBC manages. The internal audit function was renamed Internal Assurance, to reflect its broadened and elevated mandate; however, the discipline of internal audit remains embedded into all assurance activities.
The university created its first Chief Assurance and Risk Officer and appointed Jennifer Kain to build and lead this new best-in-class enterprise risk and assurance function that would provide forward-looking strategic insights to organizational leaders and management.
ERA’s mandate includes the prevention and investigation of improper financial activity and the promotion of ethical financial conduct (as per UBC Financial Investigations Policy – SC15). The team collaborates with key stakeholders, including the Comptroller and the AVP Finance and Operations (UBCO), to meet university needs such as the fraud education roadshow to provide the university community with tips on preventing, identifying and reporting fraud.
ERA also supports the Audit Committee of the Board of Governors in fulfilling its governance role, which includes providing oversight of UBC’s Enterprise Risk Management Program and ensuring the greatest risks to UBC are being managed effectively.
Taking a proactive approach to managing risks at UBC
ERA championed adding pandemic risk to the university’s risk register in fall 2019, before COVID-19 was known. This gave management the opportunity to formally assess the risk and determine what additional actions were required to put the university in a strong position to navigate a pandemic emergency, should one arise.
“There are a variety of risks that need to be managed appropriately, so the university can achieve its vision and successfully deliver its wide-ranging strategies,” says Jennifer. “As custodians of the university’s risk register, one of our primary responsibilities is to facilitate management’s assessment of risks, which includes considering how likely it is that the risk will occur, and what the impact would be if it does.”
The formal assessment process that ERA facilitates enables management to determine how much effort and cost is required to appropriately address each risk and provides a mechanism to ensure the necessary actions are taken.
Helping leaders to make informed decisions and manage risk
“ERA does not make management decisions nor implement measures for managing risk, that is the responsibility of leadership and management within the university, supported in many cases by Safety and Risk Services (SRS)” explains Jennifer. “Our value to the university comes from the fact that we are independent, objective strategic partners.”
With COVID-19, UBC’s SRS department is responsible for the day to day management of the university’s pandemic plan. ERA’s role is to assess how well the pandemic risk is being managed and to provide insights on how other risks may be impacted by the pandemic. In collaboration with management, they consider a range of potential risks such as:
- How are cybersecurity or procurement risks altered with so many people working from home?
- Are internal controls for managing fraud still intact?
- How will COVID-19 impact the mental health of faculty, staff and students?
ERA also provides ongoing risk and assurance to one of the university’s top strategic initiatives: the Integrated Renewal Program (IRP) and Application Ecosystem Program (AEP). ERA’s strategic partnership role is considered vital to the project’s success.
Attitudes towards risk vary but taking a risk isn’t always bad
Jennifer’s goal is to continue to build and lead a diverse and talented team to deliver premier enterprise risk and assurance services that significantly contribute to the university’s overall success. Jennifer and her team also continue to invest time to build strategic partnerships across the university to advance the risk culture at UBC.
"The work that Jennifer and her team are undertaking on IRP is extremely valuable as they are partnering with the program sponsors and team members to identify risks that could compromise the overall success of the Workday implementation and provide practical recommendations on how these risks can be managed.” - Santa J. Ono, President and Vice-Chancellor.
“I regularly hear people make statements that risk is bad, but that’s not always true,” says Jennifer. “We usually can’t operate without some level of risk – that applies at work and in our personal lives. However, attitudes towards risks, at a personal and organizational level, can vary greatly."
ERA has the expertise and frameworks to help people identify risk and evaluate it in the context of the university’s attitude towards that type of risk. Typically, organizations will have a very low risk appetite for areas like health, safety, security and fraud, but may be more willing to take on more risk when it comes to innovation and transformation programs, due to the value that can be achieved in these areas.
“What is important is to understand the risks we take, so we can ensure they align with the university’s values and position and have plans to mitigate them before we move forward,” explains Jennifer.
Risk-informed decision making is integral to the university’s success. ERA will partner with you to provide trusted and impactful risk and assurance insights. You can contact the team by emailing firstname.lastname@example.org.