Enterprise Risk Management: Learning to Harmonize

By Shulamith Klein, Michael Mandl, and Stephen Sencer, this is one of two related articles in the December issue of Business Officer:

To manage for potential threats, Emory University worked from the most basic operational level upward to fine-tune a strategy that’s now part of its overall planning process.

Over the past two years, Emory University, Atlanta, has built an enterprise risk management system tailored to the higher education environment. The process, which involved more than 100 staff and faculty, was a useful and productive experience for Emory, and the resulting ERM system is now integrated into our planning and evaluation of administrative issues. It is not perfect, it does not rely on outside consultants, and it does not use three-dimensional cubes. But, it does constitute a significant step forward in Emory's ability to manage its risk, prepare for adverse occurrences, and ensure that senior management is communicating with those in the field about key issues facing the university.

The ERM process began at Emory when a number of developments, some national in scope and others unique to our campus, focused attention on corporate governance. On the national level, notorious corporate governance failures such as Enron and WorldCom had heightened scrutiny of all large corporations, including nonprofits. In addition, several higher education institutions had been publicly criticized for failing to handle adverse events effectively, with the allegedly inadequate response gaining as much or more attention as the underlying event.