The COVID-19 pandemic and the rapid pivot to remote emergency operations exposed a weakness in most college risk management plans that were often written with the siloed approach in which campuses have historically operated. While campus divisions might have developed contingency plans if their operations were interrupted, few institutions had worked out what would happen if the entire campus was forced to close for weeks or months on end.
The ability to respond to a global pandemic is only one of many potential risks that colleges and universities of all sizes and complexities face today. From a campus shooting to national disasters to a cyberattack to a campus protest or major macroeconomic shifts, the current environment demands that institutions be more agile and deliberate about connecting and integrating the various offices around campus in planning for, averting, and managing the aftermath of a crisis, ultimately becoming more risk-aware institutions.
Managing risk is no longer purely the domain of the general counsel’s office or the audit committee of the board, but of every campus function. Coming out of the pandemic, many institutions began to pivot away from their traditional views of risk management and instead, risk offices have been elevated, and given a “seat at the table” for key decisions. In this era, where the crisis du jour is the new normal on campuses, higher education leaders must put more time, effort, and resources toward what is referred to as “left of boom” (figure 1). That’s the time before a disruptive event, when institutions can prepare and potentially avert a crisis, or at least substantially minimize its impact.
Planning should focus on high-consequence or -impact events with the highest likelihood of occurring (e.g., hurricanes, active shooters, and cyberattacks) aligning with the amount of preparation that can be arranged in advance. These activities can take many forms including policies, community engagement, communications, and preparedness plans. It’s critical that these risks are managed through a campuswide lens to identify strategic and reputational risks that can impact an institution’s ability to meet its missions and goals. This approach to enterprise risk management allows institutions to build risk into the strategic decisions of senior leaders and board members, better positioning the university to accomplish its objectives.
Meanwhile, the “right of boom” is the set of events that follow a crisis. The measure of success here is not to try and avoid all disruption but rather to make the disruption “less bad.” Investment in preparedness is what enables that outcome, knowing that there will be some high-consequence/low-probability events, or “black swans,” that can only be anticipated after the fact.
The ability of a campus to both prepare for and respond to a crisis is dependent on its physical infrastructure as well as human resources and leadership. Yet, with few notable exceptions, higher education institutions have failed to modernize these resources. The current state of risk management and resiliency on most campuses is far below the level of most other complex enterprises, including the federal government. The status quo is usually a risk officer who is embedded in the finance function and typically combined with internal audit and compliance with little authority to engage critical stakeholders (senior management or the board) on not only what risks exist but also the institutional plan for embracing—and most important—recovering from an unforeseen event. Because higher education institutions have survived depressions and world wars, colleges tend to be overconfident about forecasting the future and too narrow in their assessment of the range of outcomes that may occur.
In scenario-planning and stress-testing, institutions must ensure they don’t suffer from organizational biases that drive leaders to favor information that supports their positions and suppress information that contradicts them.1 In the face of a disruptive event, it’s also critical to have the appropriate leaders in place who are empowered to make decisions, but also include cabinet-level leaders in strategic decisions related to risk in an effort to break down silos that typically manifest in institutions.
Confidence in leadership is a key element to community trust in a time of uncertainty. Ensuring that the board, the president, and the rest of the executive leadership team are capable and prepared to show up during a crisis is significant in helping the organization get through a crisis and eventually recover.
Higher education leaders must take this moment to take stock of risk management processes and plans. Are the right leaders selected that represent each faction of the institution involved in the identification, assessment, prioritization, and response to the most likely and highest-impact risks to the institution? Does the board have a process in place to receive the right level of information at the right time and the ability to reevaluate these risks as the environment in which the institution operates evolves? And—importantly—for those risks that are deemed highest-impact/most salient, are institutional resources aligned to both mitigate the risk (left of boom) and respond quickly and appropriately (right of boom)?
The authors would like to thank the following colleagues for their sizeable contributions to the report: Tiffany Dovey Fishman, Pete Fritz, Cynthia Vitters, and Jake Braunsdorf. They would also like to thank the participants in Deloitte’s inaugural Forum on the New Era of Higher Education, whose perspectives and insights helped shape the contents of the report.
Cover image by: Sonya Vasilieff and Sofia Sergi
