Planning should focus on high-consequence or -impact events with the highest likelihood of occurring (e.g., hurricanes, active shooters, and cyberattacks) aligning with the amount of preparation that can be arranged in advance. These activities can take many forms including policies, community engagement, communications, and preparedness plans. It’s critical that these risks are managed through a campuswide lens to identify strategic and reputational risks that can impact an institution’s ability to meet its missions and goals. This approach to enterprise risk management allows institutions to build risk into the strategic decisions of senior leaders and board members, better positioning the university to accomplish its objectives.
Meanwhile, the “right of boom” is the set of events that follow a crisis. The measure of success here is not to try and avoid all disruption but rather to make the disruption “less bad.” Investment in preparedness is what enables that outcome, knowing that there will be some high-consequence/low-probability events, or “black swans,” that can only be anticipated after the fact.
The ability of a campus to both prepare for and respond to a crisis is dependent on its physical infrastructure as well as human resources and leadership. Yet, with few notable exceptions, higher education institutions have failed to modernize these resources. The current state of risk management and resiliency on most campuses is far below the level of most other complex enterprises, including the federal government. The status quo is usually a risk officer who is embedded in the finance function and typically combined with internal audit and compliance with little authority to engage critical stakeholders (senior management or the board) on not only what risks exist but also the institutional plan for embracing—and most important—recovering from an unforeseen event. Because higher education institutions have survived depressions and world wars, colleges tend to be overconfident about forecasting the future and too narrow in their assessment of the range of outcomes that may occur.
In scenario-planning and stress-testing, institutions must ensure they don’t suffer from organizational biases that drive leaders to favor information that supports their positions and suppress information that contradicts them.1 In the face of a disruptive event, it’s also critical to have the appropriate leaders in place who are empowered to make decisions, but also include cabinet-level leaders in strategic decisions related to risk in an effort to break down silos that typically manifest in institutions.
Confidence in leadership is a key element to community trust in a time of uncertainty. Ensuring that the board, the president, and the rest of the executive leadership team are capable and prepared to show up during a crisis is significant in helping the organization get through a crisis and eventually recover.