Significant risks facing higher education: Getting to the roots of risk

Background

This report discusses our perspective on the most significant risks and risk drivers that we believe stakeholders in institutions of higher education should consider. Our perspective is informed by a variety of stakeholders whose viewpoints range from operational to strategic, as it is critical to gather insights across the entire spectrum (figure 1).

Before we dive into the discussion around the significant risks and risk drivers, it is critical that you, the reader, understand how we have defined them. As we will discuss, clarity on definitions is not only important for reading this report but is also a critical foundational element of effective risk management.

Risks and risk drivers

“Risk” is a term that is often defined inconsistently. Given this, we utilize the following definitions for “risk” and “risk driver” to frame our perspective.

• Risk is defined as a state of uncertainty where the answer to “Did the risk occur?” can be a binary yes or no, with some possibilities being undesirable outcomes.
• Risk drivers can either be:
  • Continuous factors, often referred to as “trends,” that influence the likelihood or impact of a risk
  • A risk that could influence another risk’s likelihood or impact

We recognize that definitions of risks and risk drivers are not distinct, which may make this complex and challenging to comprehend from the outset. While all risks can be risk drivers, not all risk drivers are actual risks (figure 2).

Risks can have both risk drivers and secondary risks. A primary risk can have direct risk drivers—risk driver 1 and risk driver 2 (figure 3). Additionally, it can have a secondary risk, which itself has direct risk drivers—risk driver 3 and risk driver 4.

We present these definitions not only to contextualize our perspective but also because we contend that consistency in defining risk is critical for an ERM program, as it is a core enabler for leadership to effectively prioritize resources for response efforts. More specifically, when an ERM program defines risk and the level of granularity consistently, an analysis of risk can be performed to identify the risk drivers influencing an institution’s total risk exposure, thus leading to optimized allocation of resources to response efforts.

The following discussion regarding significant risks and risk drivers utilizes the definitions outlined above, which is important to note because some risks and drivers may be framed or classified differently than is commonplace today.

Part 1. Significant risks facing higher education institutions

As mentioned earlier, this is not a compendium of all risks posed to institutions. It is a group of significant risks that are likely over the next one to three years, many of which are traceable to or exacerbated by the risk drivers discussed in Part 2.

Risk of cyber breaches

Digitalization of transactions, processes, records, and even relationships has caused institutions (and most other organizations) to rely heavily on information technology systems. This reliance has generated benefits such as improved efficiency, better communication, and enhanced data management. However, it has also introduced significant risks to data privacy and security.

The problem is serious and getting worse. From March 2022 to March 2023, the average cost of a cybersecurity breach reached US$3.7 million.¹ Ransomware attacks—in which cybercriminals encrypt an institution’s data and demand a ransom for the decryption key—have targeted organizations across sectors and have surged.² According to the “2024 state of ransomware in education” report by Malwarebytes, ransomware attacks against higher education institutions rose from 68 in 2022 to 116 in 2023, a 70% increase.³

Unsurprisingly, cybersecurity is ranked first on the annual EDUCAUSE Top 10 list of issues facing colleges and universities.⁴ In response, institutions are focusing on more robust identity and access management, considering zero trust security frameworks, and turning to virtual chief information security officers, among other tactics.

Common cyber risk drivers:

Inadequate security practices: Weak or outdated password policies, lack of multi-factor authentication, poor security configurations, and other issues leave systems vulnerable to hackers.

Bifurcation of academic versus administrative IT practices: Research and academic IT practices differ from administrative IT practices. These policies and practices can sometimes be bifurcated across academic and administrative factions, resulting in vulnerabilities.

Unintentional errors and lack of training: Insufficient awareness may lead to an employee accidentally sending confidential information to the wrong recipient or revealing sensitive or confidential information on social media. Faculty and staff need training on everything from passwords to multi-factor authentication and beyond.

Insider threats: Disgruntled, terminated, or opportunistic employees can harm the institution or exploit access to the school’s data or funds for personal gain.

Vulnerable systems: Several factors are increasing the vulnerability of systems, including a large number of legacy, on-premise IT systems combined with the lack of vulnerability management systems and the prevalence of “bring your own devices,” all contributing to increasing vulnerabilities on campus.

Third-party risks: Partners, vendors, or others can take advantage of access or vulnerabilities due to insufficient due diligence and vetting of their employees or failure to exercise the institution’s right to audit.

Scams: Phishing and social engineering can trick people into revealing personal information about themselves, senior leaders, or trustees or into sharing intellectual property or sensitive organizational information.

Common strategies to help mitigate cyber risk

Mandating user-level tools: Establish policies and procedures regarding strong passwords and multi-factor authentication.

Educating employees: Regularly train employees on leading cybersecurity practices and how to recognize phishing attempts, scams, impersonations, and other tactics aimed at obtaining access to systems.

Encrypting sensitive data: Encrypt data at rest and in transit to protect it from unauthorized access. Use encrypted communications for the most sensitive and valuable data.

Updating software: Keep software up to date with the latest security patches and use accurate software inventories to keep abreast of updates and phaseouts.

Developing disaster recovery, incident response, and data-backup plans: Create and regularly update disaster recovery, incident response, and data backup plans to address and mitigate breaches and reduce the number of false notifications.

Faculty and staff attrition

Faculty and staff attrition, whether voluntary or involuntary, exposes institutions to loss of expertise and institutional knowledge, which can create knowledge gaps and undermine quality and efficiency. High attrition increases recruitment and training costs and diverts resources from other priorities. It can result in discontinuity of education and mentorship, impacting student satisfaction and learning outcomes. High turnover tends to diminish morale and engagement among remaining faculty and staff, who may feel overburdened and insecure in their jobs. Persistent attrition can damage the institution’s reputation and make it less attractive to prospective faculty, staff, and students.⁵ It can also be a symptom of other, perhaps deeper, problems.

The percentage of full-time, exempt staff members who left their jobs nearly doubled over two years—from 7.9% during the academic year of 2020 to 2021 to 14.3% during the academic year of 2022 to 2023.⁶ A survey of 4,782 employees conducted in September 2023 by the College and University Professional Association for Human Resources found that key reasons for employees leaving included better pay and benefits (45%), lack of career advancement opportunities (30%), and dissatisfaction with institutional leadership (25%).⁷ Job satisfaction was the strongest predictor of retention, with higher satisfaction associated with a lower likelihood of employees seeking other employment.⁸

Risk of attrition drivers

Inadequate remote work opportunities: Lack of remote work options can lead to turnover as faculty and staff seek more flexibility and enhanced work/life balance.

Lack of career advancement opportunities: Lack of promotion and other career advancement and enhancement opportunities generate dissatisfaction and prompt employees to leave for positions with clearer pathways to professional growth.

Uncompetitive pay and benefits: Inadequate compensation and benefits have been frequently cited as primary reasons for faculty and staff leaving their positions.

Strategies to help mitigate the risk of attrition

Promoting work/life balance: Implement flexible work arrangements, including remote work options and flexible scheduling, and provide support, such as child care, for working parents.

Enhancing compensation and benefits: Explore enhanced salary and benefits to confirm that they remain competitive by benchmarking against peers as well as adjacent industries. Offer comprehensive benefits packages that meet the diverse needs of employees.

Fostering professional development: Provide clear pathways for career advancement and professional growth while investing in programs to enhance knowledge and skills.

Improving workplace culture: Create a more inclusive and supportive workplace culture where employees feel valued and recognized.

Student activism risks

Student activism primarily refers to assemblies by students, faculty, or other stakeholders to advocate for social, political, or environmental change. Assemblies include protests, sit-ins, and other gatherings aimed at influencing university policies, raising awareness of specific issues, or advocating for broader societal changes. Activists can also demand the resignation of leaders or faculty members, “canceling” speakers, or divestiture of endowment funds in a certain company or country. Handled poorly, activism can lead to disruption of student life and campus operations, safety and security hazards, legal and compliance issues, and reputational risk.

The spring of 2024 saw an increase in student activism across the country.⁹ The news media headlines were riddled with examples of students setting up tent encampments to protest and counterprotest foreign conflict. Election cycles also heighten political awareness among students and faculty, generating further advocacy around issues such as voter rights, policy changes, and candidate support.

Colleges and universities anticipate more demonstrations during the 2024 to 2025 academic year; in response, administrators are revising rules on free speech and demonstrations. Many of the revised rules include time, place, and manner restrictions on assemblies. For example, the University of South Florida requires approval for tents, canopies, banners, signs, and amplifiers and bans activity after 5 p.m. and during the last two weeks of a semester.¹⁰ Many others have set similar policies.¹¹

Student activism risk drivers

Lack of communication: Failure to affirm the institution’s commitment to education and order on the one hand and to free expression on the other can create a void that enables activists to control the conversation.

Lack of enforcement of clear policies: While many colleges and universities have announced policies and rules around student activism, some may not have made them clear. University leaders have the right and responsibility to prohibit aggressive, destructive, or unlawful behavior that disrupts learning or threatens safety. To that end, policies should specify potential consequences for such conduct.

Mission and campus culture: Colleges and universities serve to foster learning through the exploration of ideas with a diversity of thought and active debate. In this setting, colleges and universities may struggle with managing the fine line between appropriate and instructive self-expression, with potentially harmful and nonproductive behaviors. 

Strategies to help mitigate the risks posed by student activism

Navigate free speech issues carefully: Public colleges and universities are legally required to uphold First Amendment freedoms (including the right to speech and assembly) on their campuses. Private universities are not, although many have promised students to support free speech. Policies that enable leaders, students, and other stakeholders to navigate this landscape can help to mitigate the risks.¹²

Guard institutional reputation: Leaders need to balance the interests of multiple stakeholders while guarding the institution’s reputation when addressing risk events arising from activism. Prospective and current students value their freedom of expression, while parents, alumni, donors, and the public may more highly value campus order and safety. Tracking stakeholder sentiment by listening to stakeholders and monitoring social media will enable leaders to gauge the effect of various policies and contemplated responses.

Manage potential backlash: Failure to manage backlash contributed to administrators at top schools having to resign in the aftermath of campus demonstrations. In addition to adroit management of student activism, leaders should establish and maintain ongoing, trust-building communication with all stakeholders. Student activists generally constitute a relatively small percentage of the student population and an even smaller percentage of all stakeholders. So, cultivating the support of those larger percentages—including student government—can cushion the institution and its leaders and reputation from backlash.

Natural disaster risks

Natural disaster risks encompass the effects of events like floods, earthquakes, hurricanes, tornadoes, wildfires, and other major disasters. Climate change may heighten these risks by causing more frequent and severe weather events that threaten campus infrastructure and the safety of students, faculty, and staff. These risks can affect the operations, infrastructure, and financial stability of institutions. Potential impacts involve damage to campus buildings, requiring costly repair and recovery efforts, and disruptions to academic schedules.

Statistics indicate that natural disasters are becoming more frequent and serious in magnitude.¹³ For example, severe storms have resulted in the largest number of billion-dollar climate disasters in the last decade, with 99 total events.¹⁴ Weather patterns, including El Niño, La Niña, North Atlantic Oscillation, and Pacific Decadal Oscillation,¹⁵ can increase natural disaster risks on campuses by intensifying weather events such as rainfall, flooding, and storms. The development of expensive infrastructure in or near vulnerable areas also increases the risk of loss from natural disasters.

Natural disaster risk drivers

Failure to gauge potential impacts: An institution’s location impacts the likelihood and significance of this risk. Many colleges and universities in the United States are close to the coast, rendering them vulnerable to tropical storms, rising sea levels, and flooding.¹⁶ Institutions in California and the Midwest may see an increase in the number and duration of wildfires.¹⁷

Unprepared campus and local infrastructure: Inadequate or poorly maintained campus-level or state or local infrastructure can amplify risks associated with natural disasters by compromising emergency response capabilities, thus increasing vulnerability to hazards and hindering effective communication and evacuation efforts.

Deferred maintenance: As colleges and universities fall behind on deferred maintenance of their campus infrastructure, the rising frequency and severity of natural disasters could lead to less resilient infrastructure and increased financial loss.¹⁸

Strategies to help mitigate natural disaster risks

Review resources and standards: Resources such as Ready.gov for Campus, US Department of Education’s natural disaster resources, and the Federal Emergency Management Agency’s Higher Education Program can enable risk-related and operational functions to prepare the institution and stakeholders for extreme weather events. At the more local level, institutions need to review available resources, the roles of first responders, evacuation plans, and lessons learned from responses to past natural disasters.

Evaluate the financial impact: The case for comprehensive preparedness can be clarified by evaluating the potential financial impact on the institution. While disaster preparedness can be costly, natural disasters have inflicted billions of dollars in damages on facilities. Impacts include the cost of repairs and rebuilding, lost tuition revenue, and increased operational costs due to prolonged closures and recovery efforts. Higher education institutions should use scenario analysis and tabletop exercises to understand potential impacts and craft optimal responses.

Inform stakeholders: A detailed communication plan is crucial in any crisis. It should define roles and responsibilities, establish primary and backup communication channels, consider all stakeholders including students, faculty, and staff, and cover communications before, during, and after a natural disaster.

Lend a hand: As an important part of the community, the college or university can build goodwill and trust by, at minimum, having plans that will reduce or not add to burdens placed on local response resources. If possible—and only within proper legal, safety, and commonsense boundaries—staff, faculty, and leadership should assist the community in appropriate ways, such as offering transportation or temporary housing to disaster victims.

Classification of student‑athletes as employees

On July 12, 2024, the Third Circuit Court in Johnson v. National Collegiate Athletic Association (NCAA) ruled that student-athletes are not barred from being considered employees under the Fair Labor Standards Act. As a result, colleges and universities may be required to classify student-athletes as employees. Significant legal, financial, and operational implications may emerge for institutions, athletic programs, and student-athletes. This classification creates the need to develop an onboarding infrastructure to reduce the administrative burden on campus human resources departments and to address the legal, compliance, financial, and tax implications for the institution.

The House v. NCAA class action lawsuit challenges the NCAA’s restrictions on student-athlete compensation. The outcome of ongoing settlement negotiations will likely impact student-athletes’ employment status.¹⁹ The settlement estimates a US$135,000 annual salary for football and men’s basketball student-athletes.²⁰ Moreover, increased unionization efforts among some segments of student-athletes, primarily in football and men’s and women’s basketball, could occur.²¹

Student-athlete reclassification risk drivers

Scope and legal rules regarding an athletic program: Specific risks to the institution will depend upon the status and finances of their athletic programs and the applicability of legal developments and emerging rules driven by case law, settlements, and legislative changes, including:

• NCAA rule changes allowing student-athletes to profit from their name, image, and likeness²²
• National Labor Relations Board’s stance on classifying student-athletes as employees under the National Labor Relations Act²³
• Court rulings challenging the traditional amateurism model (NCAA v. Alston and NCAA v. House)²⁴
• Legislative proposals introduced to redefine the relationship between student-athletes and their institution and to reclassify them as employees²⁵

Stakeholder and public sentiment: Increased media focus on the financial issues surrounding student-athletes has amplified support for their reclassification as employees and moved public sentiment toward institutions treating student-athletes more equitably. That generally means recognizing the academic and athletic demands placed on student-athletes and financially rewarding their contribution to their schools.

Strategies to mitigate student-athlete reclassification risks

Clarifying the impacts: Engage legal experts, such as the institution’s Office of General Counsel and outside counsel, to clarify the applicability and implications of employment law and labor relations to position the institution to respond fairly and judiciously.

Reviewing policies: Thoroughly review existing human resources policies and processes to identify gaps where updates are needed for student-athletes classified as employees.

Collaborating internally: Partner with the athletics administration, HR leadership, and the Office of General Counsel to understand potential impacts and develop a strategic response, with a focus on financial matters and institutional mission.

Evolving related programs: Develop practical and ethical supportive programs such as recruiting, onboarding, and policy training for coaches, training staff, athletics administrators, and student-athletes.

As previously noted, we are not attempting to present a comprehensive review of all risks, as they are too many, varied, and unique to each institution to be fully covered here. Rather, we are presenting considerations to approach risks and risk management by identifying each risk to the institution along with the context in which it is occurring, institutional-level drivers, and potential steps to take in response.

Part 2 takes a similar approach to risk drivers. These factors pervade the environment, potentially driving risks that impact every college and university. It can be helpful to consider risks to the institution as those that are unique to that institution, while risk drivers span the entire sector.

Part 2. Significant risk drivers to higher education institutions

Thinking and working at the level of risk drivers enables college and university leaders and risk managers to effectively address risks. It helps them to identify the factors contributing to an increase or decrease in risk, such as increased politicization of higher education leading to a change in regulatory priorities.

Understanding risk drivers also enables risk managers to develop a panoramic view of the risk landscape. This allows them to clearly see the interrelatedness of risks and strategically allocate resources to manage them. All of this supports ERM, resulting in improved efficiency and effective risk management.

Managing risks at institutions has become far more critical and complex than in the past. The nature and number of risk drivers reflect the increased complexity of the ecosystem, characterized by heightened economic pressures, diminished trust in institutions, rapid climate change, proliferating technology, evolving regulatory and compliance demands, and a more diverse applicant pool and student body.

Evolution in Department of Education regulation

In June 2024, the US Supreme Court overturned “Chevron deference,” named for the landmark Chevron USA Inc. v. Natural Resources Defense Council (1984) case. The 2024 decision may reduce the interpretative deference of the courts to federal agencies by obligating courts to determine whether an agency’s actions are consistent with the words of the statute and the intent of Congress.²⁶ By the same token, the “Chevron doctrine” in effect directed courts to reject agencies’ interpretation of statutes unless there’s clear authorization from Congress to accept them.²⁷ While the impact on higher education remains to be seen, the decision may limit federal agencies, including the US Department of Education (ED), authority to issue and enforce broad regulations.²⁸

In addition, in June 2023, the Supreme Court ruled against using race in college admissions decisions, leading many colleges and universities to reevaluate their affirmative action, legacy admissions, and athletic recruiting policies and practices.²⁹ Also, the ED published three updates on its expectations under its extensive October 2023 Financial Value Transparency and Gainful Employment regulations. These regulations, slated to take effect on July 1, 2024, apply to institutions participating in Title IV Federal Student Aid programs.³⁰ Collectively, these two regulations strive to require colleges and universities to provide student and financial information to ED to evaluate the effectiveness of their programs. Given that most colleges and universities participate in the Title IV program, adherence to these regulations will be compulsory for institutions going forward.

Taken together, these rulings from the Supreme Court will alter how ED regulates higher education, which may place long-standing practices in higher education at odds with new or revised regulations. This will require colleges and universities to quickly pivot their processes and operations. Though the full impact of these rulings on higher education is still unclear, they will influence how the Department of Education regulates the sector. Colleges and universities will need to maintain a flexible relationship with the department to adapt to probable changes in the future.

Risks linked to evolving ED regulation

New legislation: Given the potential change in the enforceability of ED guidance, legislators may look to codify standards in legislation. Federal legislation could differ from the current guidance issued by ED.

Loss of Title IV funding: Reduced clarity in ED requirements for receiving Title IV funds may lead to legal action, potentially affecting other areas as well.

Strategies to navigate the evolution of ED oversight

Legal guidance: Evaluate more often the necessity and timing of the institution’s need to obtain guidance from attorneys and legal experts in its decision-making and policymaking processes.

Legal monitoring team: Establish a dedicated team or individual to monitor and respond to legal and regulatory developments.

Strengthen compliance programs: Implement robust compliance programs to enhance adherence to regulatory requirements.

Regular compliance training: Conduct periodic training sessions for faculty and staff on regulatory changes and compliance obligations.

Proactive communication strategy: Develop a proactive communication strategy to manage public perception and maintain stakeholder trust in the institution’s leaders and decision-making, while seeking ways to reach underrepresented applicant populations.

Data-reporting processes: Confirm processes are in place to collect data and report to ED in a timely manner to comply with Financial Value Transparency regulations.

Decline in US population growth

The United States has seen a reduction in the growth rate of the demographic inclined to pursue higher education. This can strongly impact enrollment rates, financial resources, and strategic planning. Economic instability and job insecurity, which render people less confident about their financial futures and tend to lower birth rates, are fueling this.³¹ There are also changes in social norms, with more people delaying marriage and childbirth to focus on careers and personal goals. The high cost of living, child care, and education itself further discourages parenthood.³²

The anticipated “enrollment cliff” in 2025 largely relates to a steady decline in the national birth rate over the past 17 years, with births falling by 23% from 2007 to 2022.³³

Population in large and moderate-sized US counties grew, while that of small counties declined over the last few years.³⁴ Specifically, from 2022 to 2023, the population in counties with over 100,000 people averaged a growth of 0.76%. In fact, the population in counties with fewer than 10,000 people decreased by 0.27% on average, compared with a 0.35% decrease the previous year.³⁵

Risks commonly linked to population decline

Enrollment decline: With fewer students enrolling, colleges and universities face decreased tuition income, affecting their financial stability and necessitating budget cuts. This can impact faculty, staff, and resources available for students and potentially lead to merger and acquisition activity.

Recruitment challenges: As college enrollment declines, the pool of students available for employers to recruit also decreases. Consequently, companies may need to adjust their recruitment strategies and invest more in training and development to bridge the skills gap. Moreover, institutions may have to work harder to protect their educational missions and reputations.

Reduced role in the local economy: Institutions play a crucial role in their local and regional economies. Declining enrollment can lead to reduced economic activity—and employment—in the college or university and the surrounding community, affecting local businesses and services.

Strategies to help navigate the decline in population

International recruitment: Develop strategies to attract international students and build global partnerships.

Study-abroad initiatives: Create and promote study-abroad programs and international exchanges.

Industry collaboration: Collaborate with local industries and major employers to gauge what expertise and skills they are seeking and how the college or university might help them address their training and development needs.

Adult education: Engage nontraditional audiences by creating flexible pathways for adult learners to complete their education and adapting academic offerings to support populations beyond the 18- to 24-year-old demographic.

Overdependence on tuition for revenue

Tuition dependence is defined as the ratio of net tuition revenue to total revenue. High tuition dependency—defined as 60% or greater reliance on tuition and student fees for core revenues—puts an institution’s finances at risk, given even small downturns in enrollment and retention.³⁶ The impact of the COVID-19 pandemic may have exacerbated this issue, yet pandemic-related aid may have masked longer-term financial issues, with closures of private colleges becoming commonplace as a result.³⁷

Data from the 2022 Integrated Postsecondary Education Data System reveals that about 25% of institutions are tuition-dependent.³⁸ Tuition dependency is rising among public and private institutions, with a higher percentage of core revenues being derived from student tuition and fees. Moreover, non-tuition sources of revenue are also under pressure. Giving to colleges and universities is declining, with the most recently available data showing inflation-adjusted giving down 5% in 2023.³⁹ Even amid reduced federal stimulus funding, state support for higher education was up 10% in fiscal 2024,⁴⁰ but that is expected to decline in the future.⁴¹

Risks commonly linked to tuition dependency

Budget shortfalls: During even small downturns in student enrollment and retainment, budget shortfalls are typically the first sign of overdependence on tuition and fees. Unless that overdependence is addressed, it can lead to deficits that must be funded.

Insolvency: An increase in the time needed to pay operating expenses—or a default on debt—generally indicates even more pressing financial problems.

Layoffs and program closures: Unless they are well-rationalized, layoffs of faculty or staff, as well as partial or complete closing of programs (or a school within a university), indicate financial problems that can lead to bankruptcy or the closing of the whole institution.

Strategies to help navigate tuition dependency

Boost fundraising efforts: Step up fundraising activities, particularly planned giving among active alumni and major or repeat donors.

Grant acquisition: Apply for research and other grants and actively recruit faculty and researchers with a proven record of successful grant applications and grant-funded research.

Tuition reset: Consider a properly implemented tuition reset, which means reducing the “sticker price” for tuition. Several regional institutions have used resets with good results, particularly when they emphasize their brand and value rather than the reduced tuition.⁴²

Expense reduction: Reduce operating expenses, particularly by automating all that can be automated, consolidating or eliminating redundant processes and activities, or making the difficult decision to discontinue academically valuable but unprofitable programs or activities.

Asset utilization: Maximize revenues from the institution’s existing asset base, for example, by renting out facilities when possible.

Declining student mental health

Concerns over student mental health have intensified since the pandemic, with increasing numbers of students experiencing stress, anxiety, depression, eating disorders, and similar challenges. Often exacerbated by academic pressures and financial strain, mental health issues can impair academic performance and engagement in campus life.⁴³ In severe cases, students could harm themselves or others.⁴⁴

More than 60% of college students meet the criteria for at least one mental health problem, which is a nearly 50% increase since 2013.⁴⁵ A recent survey of more than 3,600 students found that 70% of respondents have struggled with mental health since starting college.⁴⁶ Only half that number (37%) sought mental health resources at their colleges. The reasons? Negative past experiences or concerns about the effectiveness of care, social stigma, cost, and uncertainty about how to access those resources.⁴⁷

The “Student mental health landscape” report by Wiley, which surveyed more than 2,500 students, found that more than 80% are facing some level of emotional difficulty, with more than 25% citing significant struggles.⁴⁸ Challenges included balancing school with work or family (59%), paying for tuition (50%) and living expenses (49%), and uncertainty about how to prepare for a career (41%).⁴⁹

Risks commonly linked to student mental health

Student transfer and dropout: Declining mental health can result in students dropping out or transferring to another school, which can impact an institution’s enrollment, ranking, and reputation.

Declining student success: Declining mental health can negatively impact grades and graduation rates, which could diminish the institution’s rankings and reputation and generate additional financial strain and emotional suffering for students.

Student safety and security: Declining mental health can potentially increase instances of safety events, including violence toward oneself or others.

Strategies to navigate declining student mental health

Counseling services expansion: Expand the availability of on-campus and telehealth counseling services, for example, by partnering with local providers to address rising demand when needed.

Peer-mentoring initiatives: Develop peer-mentoring and support programs and formally work to increase students’ engagement with one another, with faculty, and with the institution.

Mental health awareness: Deploy mental health literacy and awareness campaigns to reduce any stigma associated with anxiety, depression, and other conditions.

Faculty-training programs: Train faculty and staff to recognize mental health warning signs and symptoms and the next steps to take. (Nearly half of students in the Wiley survey noted that extra support from their instructors had a positive impact on their mental and emotional health.)⁵⁰

Early-detection systems: Use early detection systems, including mental health screening tools and predictive analytics. These tools can detect potential mental health challenges based on academic performance, visits to the infirmary, and other indicators.

Wellness programs: Promote wellness programs and support in areas such as nutrition, exercise, relationship management, and stress reduction.

Evolving demand for program offerings

Demand for program offerings changes due to shifts in student interest and sentiment toward certain degrees, certificates, majors, minors, and specializations influenced by marketplace needs for skills and expertise. Institutions need to understand and prioritize students’ preferences to retain high enrollment, student satisfaction, and national or regional reputation and rank.

Science, technology, engineering, and mathematics, as well as business and occupational courses, are now widely sought after due to their higher labor market returns despite potentially higher short-term psychic costs (a type of social cost that reflects the stress or reduction in quality of life) for students. Education, social sciences, and humanities have experienced the largest losses in bachelor’s degrees, while business and health professions have increased the most.⁵¹

Institutions are modifying programs and majors to attract prospective students and to meet local, regional, and national employment needs. Schools are also adopting course-sharing models to expand their academic offerings and create new programs to better meet student needs while saving money.⁵² Some institutions have achieved higher rates of enrollment and retention by offering microcredentials—short-term, skills-focused training that enables students to demonstrate competency in a focused area.⁵³

To remain relevant, most colleges and universities must evolve and adjust program offerings to fit current market needs.⁵⁴ That applies to course delivery as well. Demand for online course offerings has increased immensely as students have prioritized flexibility to help manage their family or work responsibilities.⁵⁵

Risks commonly linked to evolving demand for program offerings

Reduction in public financial support: Institutions may face potential challenges in securing funding if they do not adapt their program offerings to align with evolving student interests and market needs.

Postgraduate employment: Students may encounter limited career opportunities if their academic programs do not adjust to provide the skills and knowledge required by the labor market.⁵⁶

Program closure: If colleges and universities misalign their courses with student preferences, they may experience under-enrollment and suboptimal use of resources, such as faculty time and classroom space.

Student transfer and dropout: Institutions may see a decrease in positive student sentiment and educational experiences if they fail to keep pace with changes in demand.

Strategies to help navigate the evolving demand for program offerings

Labor market analysis: Monitor and analyze labor market data to identify emerging fields and skills in current, near-term, and future demand.

Pipeline preparation: Prepare a pipeline of offerings and identify resources needed to support new programs and courses geared to emerging academic interests and career paths.

Interdisciplinary programs: Promote and develop interdisciplinary programs that combine multiple fields of study to foster innovation and well-rounded education.

Faculty development: Offer continuous professional development opportunities to enable faculty to stay current in their fields and deliver relevant course material.

Collaborative partnerships: Establish partnerships with other educational institutions, industry, and community organizations to expand program offerings and provide students with additional learning opportunities.

Lack of institutional agility in decision-making

Institutional agility refers to an institution’s ability to adapt and respond to internal and external change. Colleges and universities benefit from agility in various dimensions, including curriculum adaptability, operational flexibility, technology adoption and integration, financial resilience, strategic responsiveness, and stakeholder engagement. Institutions that exhibit low levels of agility find it hard to navigate challenges and seize opportunities, thus increasing their exposure to negative developments.

Inside Higher Ed’s “2024 Survey of College and University Presidents” found that the primary challenge for presidents today (25% of respondents) relates to financial constraints on their university.⁵⁷ While a limited budget can work against agility, updating management methods and decision-making processes costs relatively little out of pocket. In addition, lack of agility itself increases financial vulnerability.

For example, agility can be undermined by high staff turnover, which in turn can be minimized through better management, working conditions, and career pathing (as well as improved pay and benefits). Employee engagement provider Culture Amp suggests that, across sectors, 18% of North American employees are looking to move into new roles in 2024,⁵⁸ so monitoring employee sentiment may be valuable.

Artificial intelligence promises to impact higher education. Inside Higher Ed’s survey also found that 50% of presidents are optimistic about AI’s impact on higher education, but only 18% say their institution has adopted or published policies governing the use of AI.⁵⁹

Risks commonly linked to a lack of agility

Vote of no confidence: Institutional leaders are more likely to experience a vote of no confidence if their organizations fail to keep abreast of the times due to bureaucracy, lack of vision, or failure to execute change management effectively.

Faculty and staff attrition: Similarly, faculty and staff are more likely to leave an environment in which getting things done becomes unnecessarily challenging.

Board executive action: If the institution falls behind its peers and its brand suffers due to sclerotic management, the board becomes more likely to take executive action that supersedes the institution’s administration.

Reduction in alumni and donor financial support: Alumni and donors become more likely to reduce financial support when they see that rigid and unresponsive leaders have failed to navigate change amid disruption.

Strategies to help navigate the lack of agility

Agile budgeting model: Institutions need to use a flexible budget model that enables shifts during the budget cycle and builds agility in planning and budgeting.

Change management skills: Leaders often need to improve their change management skills, particularly in today’s environment of rapid evolution and diminished trust in institutions.

Frequent leadership assessments: Increasing the frequency of leaders’ external, internal, and self-assessments to identify areas requiring improvement, mitigate biases in decision-making, and determine necessary adjustments.

Higher education disruptors: Institutions need to identify the forces most likely to disrupt the higher education environment—such as AI, demographic change, and diminishing views of its value—and respond accordingly.

Mission-driven communication: Leaders should communicate with stakeholders about their commitment to the institutional mission while recognizing the need to adjust strategy to fulfill that mission in today’s environment.

Deferred maintenance

Deferred maintenance is defined as the backlog of activities to perform if facilities and equipment (including IT systems) are to reach or extend their anticipated useful life and market value. This causal factor is often overlooked due to its perceived mundanity and misguided attempts to save money. Moody’s states that as of 2024, higher education institutions face a total of US$950 billion in deferred maintenance costs for facilities over the next 10 years.⁶⁰ In 2020, the backlog of deferred maintenance was estimated at up to US$100 per square foot.⁶¹

Decisions made decades ago about facilities are producing a sharp uptick in the need for reinvestment. Life-cycle investments to address the needs of facilities built in the 1970 and 2005 waves of construction will place high pressure on institutions. Those two construction surges are generating equipment and system life cycles that will overlap in about 10 years.⁶²

Due to their low visibility and slow-motion impact, it is relatively easy to give maintenance of existing facilities lower financial priority than building new facilities. However, maintenance cannot be deferred over the long term without incurring serious risks. Moreover, space is growing, but space utilization is declining.⁶³ Institutions are building new facilities and expanding their footprint rather than reinvesting in current facilities, which can be a recipe for trouble.

Risks commonly linked to deferred maintenance

Injury or health risks: Exposure to toxic, dangerous, or fatigued materials, poor ventilation, lack of sufficient heating or cooling, off-gassing of volatile organic chemicals, or equipment malfunction can jeopardize the safety of students, faculty, and staff.

Disruption of classes or operations: The preceding conditions can lead to disruptions in classrooms, labs, or housing or the closure of facilities.

Cyber breach: Frequent software patching, neglecting to update it, or failing to maintain a proper software asset management program can increase the risk of cyber breaches.

Financial losses: Deferred maintenance may lead to higher insurance premiums or legal actions due to accidents, incidents, or inspections involving facilities and equipment. Moreover, poorly maintained facilities and equipment may lead to higher operating expenses due to reduced productivity and energy efficiency.

Strategies to navigate the risks of deferred maintenance

Asset inventory evaluation: Inventory all physical assets of the institution (including IT systems and software) and evaluate and prioritize the assets worth investing in based on their age, condition, value, expected lifespan, cost to maintain, and strategic value to the institution.

Maintenance and succession planning: Create a maintenance plan and a succession plan for facilities and equipment based on the foregoing considerations and on a cost-benefit analysis.

Footprint reduction strategy: Consider reducing the institution’s physical footprint, potentially by selling or leasing assets to other organizations, a step that may yield financial benefits.

Tech-enhanced maintenance: Adopt technologies to improve the efficiency of maintenance and repairs, such as diagnostic devices and embedded monitoring and notification tools that flag when maintenance or replacement is or will be needed.

Politicization of higher education

The politicization of higher education refers to the increasing influence of political ideologies, agendas, and conflicts on academic institutions. Politicization can impact an institution’s governance, curriculum, research, and learning environment, as well as student life, enrollment, and retention. The allocation of research grants and funding can be influenced by political considerations, which may skew the focus of academic research.

Politicization can affect institutions in many ways. Special-purpose funding through student financial aid is a crucial source of revenue, but it can extend the federal government’s influence over colleges and universities beyond research. It entails compliance with a variety of federal reporting requirements on issues such as teacher preparation and gender equity in athletics.⁶⁴ Similarly, political pressures can lead to changes in the curriculum, where certain subjects may be emphasized or de-emphasized based on ideological leanings.⁶⁵

As seen in campus protest policies, allowing for free speech while maintaining an inclusive environment can become difficult and characterized by debates over what constitutes hate speech versus protected speech.⁶⁶ In addition, issues related to race, gender, and other dimensions of identity can become highly politicized, influencing campus policies and the learning experience.⁶⁷

Risks commonly linked to politicization

Uncertainty around public funding: The influence exerted by government bodies through policymaking and appointments can create uncertainty around public funding.⁶⁸

Student activism: Polarization and conflict on campus generated by political forces and student activism can disrupt campus life and lead to calls for disinvestment, “canceling” speakers, or changes to the curriculum.

Decline in applications: Applicant, parental, or student sentiment resulting from news reports, educational experiences, social media, or word of mouth shaped by the political climate or a school’s reputation may lead to decreased applications or enrollment.

Faculty or staff attrition: Politicization at an institution and its resulting reputation regarding ideological beliefs and priorities can lead to turnover of the institution’s leaders⁶⁹ and attrition in faculty and staff.⁷⁰

Strategies to help navigate the risks of politicization

Building trust: Engaging with student and community groups and the full range of stakeholders to build trust and promote civil discussion while emphasizing that education remains the fundamental purpose and mission of the institution.

Active dialogue: Leaders should use protests as educational opportunities and consider dialogue with protesters, even those violating policies.⁷¹

Consistent policy enforcement: Once clearly defined and well communicated, institutions should ensure that policies are applied consistently and fairly without discrimination based on personal viewpoints.

Collaborative response strategies: Colleges and universities should develop viable strategies in collaboration with student government, faculty, and other key stakeholders to respond to politicization, including pressures to divest endowment funds in certain countries or companies.

Getting to the roots of risk

Each section above includes considerations for responding to the identified risk or causal factor. This should be considered a broad yet practical template for actions that will go deeper than populating a risk register and rating risks. Those are necessary and useful steps, but they cannot address the driver or cause of a risk and cannot enable the most efficient risk management methods and allocation of resources.

Addressing institutional risk drivers can enable higher education institutions to address the risk and its financial, operational, legal, compliance, reputational, and other impacts across the institution.

The following steps can help legal, compliance, and risk managers to better support the leadership in executing their risk-related roles and responsibilities:

• Identify and assess not only specific risks and risk drivers but also how they could impact all functions, facilities, and stakeholders.
• Develop and evaluate a range of responses to risks based on their financial, operational, legal, reputational, and other impacts, and provide steps to take to address the causes of those risks.
• Monitor how shifts in the political environment could impact the risk environment given the potential for regulatory and legislative change, as well as in the overall risk landscape.
• Consider the following elements of risk management in light of your institution’s risks, risk drivers, risk profile, and current approaches to managing risk:
  • Risk methodologies: Periodically refresh your approaches to identifying and assessing risk and risk drivers; for example, internal surveys supplemented by interviews and external research can deliver more robust assessments than any single method.
  • Risk management tools: Technological tools for monitoring and assessing risks, such as data analytics and risk sensing, have improved significantly in recent years. Governance, risk, and compliance systems have also improved and assisted in integrating the various aspects of the system, such as business continuity, controls, and vendor and document management, among others.
  • Techniques: Certain techniques can improve both efficiency and effectiveness of risk management. These include segmenting risks and risk drivers and accelerating prioritization of risks by focusing on those that have intensified or diminished the most, or those on which stakeholders in surveys and interviews exhibited the most divergent views.
• Migrate toward true ERM. Colleges and universities should consider adopting or improving their ERM capabilities in the near term. Today’s risks and risk drivers demand in-depth approaches. Risk cannot be managed in silos nor by the risk management functions alone. They are too widespread and interrelated for those approaches to work. ERM enables leaders and risk managers to integrate risk management across the organization, instill risk awareness and procedures into everyone in the organization, and get to the roots of risk.

Navigating the heightened risk landscape

It is no exaggeration to say that the risks that colleges and universities now face have never been more numerous or potentially damaging. Demographics, economics, politics, regulations, technologies, and other factors have created a risk landscape that challenges even the most well-funded and seemingly secure institutions. Even these institutions are experiencing challenges, while those at the opposite end of the spectrum are struggling to survive.

Legal, compliance, and risk managers and the leaders and boards they support will likely see little if any, diminishment in risk. The risk drivers are too numerous and deeply rooted for that to occur. This means that those charged with managing risk and supporting the leadership will need to exercise constant vigilance, sound judgment, and deep commitment to their students, faculty, staff, community, and all other stakeholders in the educational mission.