1 of 44

2 of 44

3 of 44

CONTENTS

  • The PUP Risk Management Structure
  • Broad Risk Areas
  • The PUP RM Committee
  • RM Committee Functions
  • The RM Sub-Committee
  • RM Sub-Committee Functions
  • The Risk Management Process
  • Commonly Found Risks in Higher Education

4 of 44

PUP RISK MANAGEMENT STRUCTURE

5 of 44

RISK AREAS

As applicable in the Asia HEI’s as identified in the 2010 ADB Study:

  • Compliance
  • Financial
  • Operational
  • Strategic
  • Reputational

6 of 44

DEFINITIONS OF AREAS

COMPLIANCE - Risk created by failing to follow government, state or local law, regulation or University policy or procedure that safeguards the University from legal exposure.

FINANCIAL - Risk that may result in loss of physical assets or financial resources.

OPERATIONAL - Risk that affects ongoing day-to-day management processes.

7 of 44

DEFINITIONS OF AREAS

STRATEGIC - Risk that affects the University's ability to achieve its objectives.

REPUTATIONAL - Risk that affects the perception that others have of the University.

8 of 44

BROAD RISK AREAS

  • Academic Affairs
  • Buildings and Grounds
  • Business Continuity
  • Computer and Information Services
  • Environmental Health and Safety
  • Budget and Financial
  • Human Resources
  • Safety and Security
  • Student Services

9 of 44

2018 PUP RISK MANAGEMENT COMMITTEE

CHAIR:

Dir. REALIN C. ARANZA

CO-CHAIR:

Dir. TOMAS O. TESTOR

10 of 44

2018 PUP RM COMMITTEE

RISK ISSUES

SECTOR

MEMBER

COMPLIANCE

Quality Assurance Center

Dr. Sanjay P. Claudio

PASUC

Dr. Guillermo O. Bernabe

Internal Audit

Engr. Kathleen N. Macapagal

FINANCIAL

Fund Management Office

Dir. Catherine C. Oposa

Accounting Office

Dir. Christopher M. Cahayon

Budget Office

Dir. Florenita E. Imperial

11 of 44

2018 PUP RM COMMITTEE

RISK ISSUES

SECTOR

NAME

OPERATIONAL

VP for Academic Affairs

Prof. Raquel G. Javier

Human Resource Management

Chief Joel M. Munsayac

Medical Services

Dir. Ma. Liza T. Yanes

Facility Management Office

Dir. Arleth P. Delos Angeles

Branches and Campuses

Dir. Norberto V. Caturay

VPSAS/Registrar/Admissions

Prof. Adelio O. Sulit

Information and Communications Technology Office

Dir. Lutzer U. Reyes

Safety and Security Management

Dir. Jimmy M. Fernando

DRRMC

Dir. Jean Paul G. Martires

12 of 44

2018 PUP RM COMMITTEE

RISK ISSUES

SECTOR

NAME

STRATEGIC

Office of the President

Ms. Susan C. Luna

Internal Audit Office

Engr. Joseph Vincent E. David

REPUTATIONAL

Institutional Planning Office

Ms. Criselda M. Ligon

Legal Office

Atty. Joanna Marie A. Liao

Communications Management Office

Prof. Kriztine R. Viray

13 of 44

SPECIFIC FUNCTIONS

WHO

FUNCTIONS

Chairperson / Unit Heads

  • Foster and encourage an environment where managing risk is accepted as each person’s day-to-day responsibility.
  • Ensure that the principles and practices of risk are communicated and embedded into strategic and operational practices and planning processes.
  • Notify extreme risks to the Dean or the relevant Sector Vice President(s).
  • Update progress on risks as requested.

Deans and Directors

  • Manage risks within the Faculty and Schools and other associated areas such as Research Institutes.
  • Monitor and review compliance with the Risk Policy.
  • Notify extreme risks to the Sector Risk Master of University Risk Management Committee (for reporting through that Committee to the President and Board Members).
  • Update progress on risks as requested by the University Risk Management Committee.

14 of 44

SPECIFIC FUNCTIONS

WHO

FUNCTIONS

Vice President

  • Manage risks within the Sector.
  • Ensure that adequate resources are available to implement the Risk Policy and to monitor and review risks in accordance with the Risk Management Handbook.
  • Notify extreme risks to the Sector Risk Master of University Risk Management Committee (for reporting through that Committee to the President and Board Members).
  • Update progress on risks as requested by the University Risk Management Committee.

President and Board Members

  • As the principal academic and chief executive officer of the University, the Vice-Chancellor and President is responsible for the academic standards, management and administration of the University, including risk.
  • Ensure that the principles and practices of risk are communicated to staff and embedded into strategic and operational practices and planning processes.
  • Foster and encourage an environment where managing risk is accepted as the day-to-day responsibility of all individuals.

15 of 44

SPECIFIC FUNCTIONS

WHO

FUNCTIONS

University Risk Management Committee

  • Oversee the University’s Risk Management program.
  • Advise on risk strategy, policy and operations.
  • Provide risk reports to the President and Board Members, Audit Compliance and Risk Committee, and other agencies/stakeholders as required.

Audit Compliance and Risk Committee

  • Identify and monitor the exposure of the University and its subsidiaries to environmental, occupational health, welfare and safety risks and all other operational risks, including financial and business risks, and risks associated with litigation, conflicts of interest, fraud, theft and third-party liability.

and

  • Monitor and review the policies and procedures of the University and its subsidiaries with respect to financial and other operational controls relating, including but not limited to, risks identified, the appropriate and effective exercise of delegated authority and the reporting of significant risks, however arising.

16 of 44

RM COMMITTEE FUNCTIONS

  • Identify Core Risks in their Sector
  • Assess Possible Resolution
  • Mitigate
  • Communicate
  • Monitor

17 of 44

PUP RM SUB-COMMITTEE

  • Chief of Units
  • Staff

OF YOUR SELECTION

18 of 44

RM SUB-COMMITTEE FUNCTIONS

  • Identify Process Risks in their Sector
  • Assess Possible Resolution
  • Mitigate
  • Communicate
  • Monitor

19 of 44

LECTURE - WORKSHOP PROPER

20 of 44

RISK MANAGEMENT PROCESS

Risk Identification

Risk Assessment

Risk Communication

& Monitoring

Risk Mitigation

21 of 44

RISK IDENTIFICATION

Purpose: To identify specific risk for a broad risk area

Goal: Reveal subject risk areas and identify risk statements for a broad risk area. Use plain language and be specific.

Method:

  • Interview
  • Personal Inspection
  • Review of pertinent documents

22 of 44

RISK IDENTIFICATION: SAMPLE

Subject Risk Areas

Risk Statements

Air quality(fires/smoke, toxins, secondhand smoke, fume hood exhaust)

Air emissions exceed Air Operating Permit (AOP) limits.

Electronic equipment/computers/ batteries

Large waste stream with little or no disposal options.

Permits and licenses

Revocation of radioactive materials license.

Security

Unauthorized access or use of restricted materials.

23 of 44

RISK ASSESSMENT

Goal: Prioritizing your Risks

Method:

  1. Likelihood of Occurrence – probability or frequency
  2. Impact of Occurrence – consequence or severity

24 of 44

RISK ASSESSMENT: SAMPLE

Likelihood of Occurrence:

Rank

Measures of Likelihood

1

Rare

May only occur in exceptional circumstances (e.g., less than once in 10 years).

2

Unlikely

Could occur at some time (e.g., at least once in 10 years).

3

Possible

Might occur at some time (e.g., at least once in 5 years).

4

Likely

Will probably occur (e.g., at least once per year).

5

Almost Certain

Expected to occur in most circumstances (e.g., more than once per year).

25 of 44

RISK ASSESSMENT: SAMPLE

Impact of Occurrence:

Rank

Measures of Impact

Injuries

Financial Loss (underdevelopment)

Asset Loss

Interruption of Services

Reputation and Image

1

Insignificant

No injuries

<P1M

or <1% of Budget

Little or no impact on assets

< ½ day

Unsubstantiated, low impact, low profile or no news items

2

Minor

First aid treatment

P1M - P10M

or 1% of Budget

Minor loss or damage to assets

½ - 1 day

Substantiated, low impact, low news profile

26 of 44

RISK ASSESSMENT: SAMPLE

Impact of Occurrence:

Rank

Measures of Impact

Injuries

Financial Loss (underdevelopment)

Asset Loss

Interruption of Services

Reputation and Image

3

Serious

Medical treatment

P10M - P20M

or 2% of Budget

Major damage to assets

1 day –

1 week

Substantiated, public embarrassment, moderate impact, moderate news profile

4

Disastrous

Death or extensive injuries

P20M - P50M

or 6% of Budget

Significant loss of assets

1 week - 1 month

Substantiated, public embarrassment, high impact, high news profile, third party actions

27 of 44

RISK ASSESSMENT: SAMPLE

Impact of Occurrence:

Rank

Measures of Impact

Injuries

Financial Loss (underdevelopment)

Asset Loss

Interruption of Services

Reputation and Image

5

Catastrophic

Multiple deaths or severe permanent disabilities

>P50M

or >6% of Budget

Complete loss of assets

> 1 month

Substantiated, public embarrassment, very high multiple impacts, high widespread news profile, third party actions

28 of 44

RISK ASSESSMENT: SAMPLE

Documenting Risk Assessment

Purpose: To assess risk statements and classify them according to risk types.

Goal: Identify the risk types associated with each risk statement, and the impact and likelihood of each risk. Identifying this information in a single chart will help determine risk prioritization.

29 of 44

RISK ASSESSMENT TEMPLATE

Risk Statement

Risk Types (check one or more)

Department(s) Affected

Impact

Likelihood

Operational Risk

Financial Risk

Compliance Risk

Strategic Risk

Reputational Risk

Other Risk

Air emissions exceed air operating permit

X

Environmental Health and Safety

3

2

30 of 44

RISK MAP

Catastrophic

5

 5

 10

 15

 20

25 

Disastrous

4

 4

 8

 12

 16

 20

Serious

3

 3

 6

 9

 12

 15

Minor

2

 2

 4

 6

 8

 10

Insignificant

1

 1

 2

 4

 5

IMPACT

1

2

3

4

5

LIKE-LIHOOD

Rare

Unlikely

Possible

Likely

Almost Certain

31 of 44

RISK MAP LEGEND

Legend

Meaning

Extreme

Significant capability loss and the achievement of objectives are unlikely.

High

Significantly degrades the achievement of objectives or capability.

Substantial

Will degrade the achievement of objectives or capability.

Medium

May degrade the achievement of some objectives or capability.

Low

Little or no impact on the achievement of objectives or capability.

Highest

Likelihood

Highest

Impact

Lowest

Likelihood

Lowest

Impact

32 of 44

DOCUMENTING CHIEF RISKS

Purpose: To prioritize risk from highest to lowest

Goal: Rank chief risks and identify which ones should receive priority attention in the mitigation process.

Priority (1=highest)

Risk

Risk Level (Impact x Likelihood)

Notes

1

Lab fire

25

Lab fires may occur overnight or on weekends and may have serious impact.

2

Flooding

15

The campus is located in a flood zone. Flooding regularly occurs during heavy rain events, and electronic equipment is vulnerable.

33 of 44

MITIGATION

Broad range of actions to prevent a loss from occurring or to respond to losses that has already occurred.

Method: Utilize and implement internal controls

34 of 44

DOCUMENTING RISK MITIGATION

Purpose: To list existing internal controls and design potential controls

Goal: To identify gaps in existing internal controls and brainstorm potential controls to address these gaps.

35 of 44

RISK MITIGATION: SAMPLE

Subject Risk Area: Environmental Health and Safety

Risk Statement: Lab fires that jeopardize student and staff safety

Existing Internal Controls (those that are already in place)

Control

Description of Control

Type of Control

Notes

Sprinkler System

Sprinkler systems are installed in all the labs and are set off when there is excessive smoke or fire.

Operational (Engineering)

Sprinklers can lead to water damage of other areas.

Must be checked regularly.

36 of 44

RISK MITIGATION: SAMPLE

Potential Controls (those that should be put into place)

Control

Description of Control

Type of Control

Cost

Timeline for Implementation

Notes

Manual on mixing hazardous chemicals

Guidelines on which chemicals can and cannot be mixed together.

Education Awareness

Two hours per lab for EHS officer to teach guidelines.

2-3 weeks

37 of 44

RISK COMMUNICATING & MONITORING

Purpose: To organize and evaluate existing internal and potential controls and establish communication and monitoring protocols.

Goal: Reveal gaps in existing internal controls and evaluate potential measures that can be taken to mitigate each risk. Create communication and monitoring measures for follow-up purposes.

38 of 44

 

Risk Iden-tification

Baseline (W/O

Mitigation)

 

Risk Mitigation

With Mitigation (Existing and Potential )

Risk Communication and Monitoring

Risk Reference

Risk Area: Risk Statement

Likelihood

Impact

Existing/ Potential Controls

Policy and Procedures

Education and Awareness Training

Operational Controls

Oversight, Monitoring or Executive Controls

Audit Controls

Other Controls

Likelihood

Impact

Responsible Person

Timeline

Cost of Mitigation

Scheduled Date to Revisit Plan

Ex

Chemistry Labs: lack of guidelines endangers students

4

3

Existing Controls

Staff need to do X as outlined in Y

Policies and procedures are explained

Protocols are X, Y, and Z

Supervisor reviews for accuracy and completeness

Labs are audited every 3 years

1

1

Mr. Juan

 3weeks

Training = P65 per employee plus labor costs

06/15/18

Potential Controls

Staff must follow new guidelines

Staff will be required to attend mandatory orientation

New guidelines and insurance policy will be set by external party

Mr. Jones reviews supervisor’s evaluation for accuracy and completeness

Labs will be audited every 2 years

39 of 44

OTHER SAMPLES

40 of 44

COMMON RISK IN HEI

EXAMPLES:

Broad Risk: STUDENT SERVICES

Specific Risks:

1. Failure to safeguard confidential information.

2. Failure to obtain proper licensing and accreditation

41 of 44

COMMON RISK IN HEI

EXAMPLES:

Broad Risk: PHYSICAL PLANT

Specific Risks:

1. Destruction of property

2. Outdated and physical equipment

42 of 44

COMMON RISK IN HEI

EXAMPLES:

Broad Risk: FINANCIAL MANAGEMENT

Specific Risks:

1. Inaccurate or untimely financial reports

43 of 44

COMMON RISK IN HEI

EXAMPLES:

Broad Risk: INFORMATION TECHNOLOGY

Specific Risks:

1. Requirements and IT opportunities are not adequately considered

44 of 44