CONTENTS
PUP RISK MANAGEMENT STRUCTURE
RISK AREAS
As applicable in the Asia HEI’s as identified in the 2010 ADB Study:
DEFINITIONS OF AREAS
COMPLIANCE - Risk created by failing to follow government, state or local law, regulation or University policy or procedure that safeguards the University from legal exposure.
FINANCIAL - Risk that may result in loss of physical assets or financial resources.
OPERATIONAL - Risk that affects ongoing day-to-day management processes.
DEFINITIONS OF AREAS
STRATEGIC - Risk that affects the University's ability to achieve its objectives.
REPUTATIONAL - Risk that affects the perception that others have of the University.
BROAD RISK AREAS
2018 PUP RISK MANAGEMENT COMMITTEE
CHAIR:
Dir. REALIN C. ARANZA
CO-CHAIR:
Dir. TOMAS O. TESTOR
2018 PUP RM COMMITTEE
RISK ISSUES | SECTOR | MEMBER |
COMPLIANCE | Quality Assurance Center | Dr. Sanjay P. Claudio |
| PASUC | Dr. Guillermo O. Bernabe |
| Internal Audit | Engr. Kathleen N. Macapagal |
FINANCIAL | Fund Management Office | Dir. Catherine C. Oposa |
| Accounting Office | Dir. Christopher M. Cahayon |
| Budget Office | Dir. Florenita E. Imperial |
| | |
2018 PUP RM COMMITTEE
RISK ISSUES | SECTOR | NAME |
OPERATIONAL | VP for Academic Affairs | Prof. Raquel G. Javier |
| Human Resource Management | Chief Joel M. Munsayac |
| Medical Services | Dir. Ma. Liza T. Yanes |
| Facility Management Office | Dir. Arleth P. Delos Angeles |
| Branches and Campuses | Dir. Norberto V. Caturay |
| VPSAS/Registrar/Admissions | Prof. Adelio O. Sulit |
| Information and Communications Technology Office | Dir. Lutzer U. Reyes |
| Safety and Security Management | Dir. Jimmy M. Fernando |
| DRRMC | Dir. Jean Paul G. Martires |
| | |
2018 PUP RM COMMITTEE
RISK ISSUES | SECTOR | NAME |
STRATEGIC | Office of the President | Ms. Susan C. Luna |
| Internal Audit Office | Engr. Joseph Vincent E. David |
REPUTATIONAL | Institutional Planning Office | Ms. Criselda M. Ligon |
| Legal Office | Atty. Joanna Marie A. Liao |
| Communications Management Office | Prof. Kriztine R. Viray |
| | |
SPECIFIC FUNCTIONS
WHO | FUNCTIONS |
Chairperson / Unit Heads |
|
Deans and Directors |
|
SPECIFIC FUNCTIONS
WHO | FUNCTIONS |
Vice President |
|
President and Board Members |
|
SPECIFIC FUNCTIONS
WHO | FUNCTIONS |
University Risk Management Committee |
|
Audit Compliance and Risk Committee |
and
|
RM COMMITTEE FUNCTIONS
PUP RM SUB-COMMITTEE
OF YOUR SELECTION
RM SUB-COMMITTEE FUNCTIONS
LECTURE - WORKSHOP PROPER
RISK MANAGEMENT PROCESS
Risk Identification
Risk Assessment
Risk Communication
& Monitoring
Risk Mitigation
RISK IDENTIFICATION
Purpose: To identify specific risk for a broad risk area
Goal: Reveal subject risk areas and identify risk statements for a broad risk area. Use plain language and be specific.
Method:
RISK IDENTIFICATION: SAMPLE
Subject Risk Areas | Risk Statements |
Air quality(fires/smoke, toxins, secondhand smoke, fume hood exhaust) | Air emissions exceed Air Operating Permit (AOP) limits. |
Electronic equipment/computers/ batteries | Large waste stream with little or no disposal options. |
Permits and licenses | Revocation of radioactive materials license. |
Security | Unauthorized access or use of restricted materials. |
RISK ASSESSMENT
Goal: Prioritizing your Risks
Method:
RISK ASSESSMENT: SAMPLE
Likelihood of Occurrence:
Rank | Measures of Likelihood | |
1 | Rare | May only occur in exceptional circumstances (e.g., less than once in 10 years). |
2 | Unlikely | Could occur at some time (e.g., at least once in 10 years). |
3 | Possible | Might occur at some time (e.g., at least once in 5 years). |
4 | Likely | Will probably occur (e.g., at least once per year). |
5 | Almost Certain | Expected to occur in most circumstances (e.g., more than once per year). |
RISK ASSESSMENT: SAMPLE
Impact of Occurrence:
Rank | Measures of Impact | |||||
Injuries | Financial Loss (underdevelopment) | Asset Loss | Interruption of Services | Reputation and Image | ||
1 | Insignificant | No injuries | <P1M or <1% of Budget | Little or no impact on assets | < ½ day | Unsubstantiated, low impact, low profile or no news items |
2 | Minor | First aid treatment | P1M - P10M or 1% of Budget | Minor loss or damage to assets | ½ - 1 day | Substantiated, low impact, low news profile |
RISK ASSESSMENT: SAMPLE
Impact of Occurrence:
Rank | Measures of Impact | |||||
Injuries | Financial Loss (underdevelopment) | Asset Loss | Interruption of Services | Reputation and Image | ||
3 | Serious | Medical treatment | P10M - P20M or 2% of Budget | Major damage to assets | 1 day – 1 week | Substantiated, public embarrassment, moderate impact, moderate news profile |
4 | Disastrous | Death or extensive injuries | P20M - P50M or 6% of Budget | Significant loss of assets | 1 week - 1 month | Substantiated, public embarrassment, high impact, high news profile, third party actions |
RISK ASSESSMENT: SAMPLE
Impact of Occurrence:
Rank | Measures of Impact | |||||
Injuries | Financial Loss (underdevelopment) | Asset Loss | Interruption of Services | Reputation and Image | ||
5 | Catastrophic | Multiple deaths or severe permanent disabilities | >P50M or >6% of Budget | Complete loss of assets | > 1 month | Substantiated, public embarrassment, very high multiple impacts, high widespread news profile, third party actions |
RISK ASSESSMENT: SAMPLE
Documenting Risk Assessment
Purpose: To assess risk statements and classify them according to risk types.
Goal: Identify the risk types associated with each risk statement, and the impact and likelihood of each risk. Identifying this information in a single chart will help determine risk prioritization.
RISK ASSESSMENT TEMPLATE
Risk Statement | Risk Types (check one or more) | Department(s) Affected | Impact | Likelihood | |||||
Operational Risk | Financial Risk | Compliance Risk | Strategic Risk | Reputational Risk | Other Risk | ||||
Air emissions exceed air operating permit | | | X | | | | Environmental Health and Safety | 3 | 2 |
RISK MAP
Catastrophic | 5 | 5 | 10 | 15 | 20 | 25 |
Disastrous | 4 | 4 | 8 | 12 | 16 | 20 |
Serious | 3 | 3 | 6 | 9 | 12 | 15 |
Minor | 2 | 2 | 4 | 6 | 8 | 10 |
Insignificant | 1 | 1 | 2 | 3 | 4 | 5 |
IMPACT | | 1 | 2 | 3 | 4 | 5 |
| LIKE-LIHOOD | Rare | Unlikely | Possible | Likely | Almost Certain |
RISK MAP LEGEND
Legend | Meaning |
Extreme | Significant capability loss and the achievement of objectives are unlikely. |
High | Significantly degrades the achievement of objectives or capability. |
Substantial | Will degrade the achievement of objectives or capability. |
Medium | May degrade the achievement of some objectives or capability. |
Low | Little or no impact on the achievement of objectives or capability. |
Highest
Likelihood
Highest
Impact
Lowest
Likelihood
Lowest
Impact
DOCUMENTING CHIEF RISKS
Purpose: To prioritize risk from highest to lowest
Goal: Rank chief risks and identify which ones should receive priority attention in the mitigation process.
Priority (1=highest) | Risk | Risk Level (Impact x Likelihood) | Notes |
1 | Lab fire | 25 | Lab fires may occur overnight or on weekends and may have serious impact. |
2 | Flooding | 15 | The campus is located in a flood zone. Flooding regularly occurs during heavy rain events, and electronic equipment is vulnerable. |
MITIGATION
Broad range of actions to prevent a loss from occurring or to respond to losses that has already occurred.
Method: Utilize and implement internal controls
DOCUMENTING RISK MITIGATION
Purpose: To list existing internal controls and design potential controls
Goal: To identify gaps in existing internal controls and brainstorm potential controls to address these gaps.
RISK MITIGATION: SAMPLE
Subject Risk Area: Environmental Health and Safety
Risk Statement: Lab fires that jeopardize student and staff safety
Existing Internal Controls (those that are already in place) | |||
Control | Description of Control | Type of Control | Notes |
Sprinkler System | Sprinkler systems are installed in all the labs and are set off when there is excessive smoke or fire. | Operational (Engineering) | Sprinklers can lead to water damage of other areas. Must be checked regularly. |
RISK MITIGATION: SAMPLE
Potential Controls (those that should be put into place) | |||||
Control | Description of Control | Type of Control | Cost | Timeline for Implementation | Notes |
Manual on mixing hazardous chemicals | Guidelines on which chemicals can and cannot be mixed together. | Education Awareness | Two hours per lab for EHS officer to teach guidelines. | 2-3 weeks | |
RISK COMMUNICATING & MONITORING
Purpose: To organize and evaluate existing internal and potential controls and establish communication and monitoring protocols.
Goal: Reveal gaps in existing internal controls and evaluate potential measures that can be taken to mitigate each risk. Create communication and monitoring measures for follow-up purposes.
| Risk Iden-tification | Baseline (W/O Mitigation) |
| Risk Mitigation | With Mitigation (Existing and Potential ) | Risk Communication and Monitoring | ||||||||||
Risk Reference | Risk Area: Risk Statement | Likelihood | Impact | Existing/ Potential Controls | Policy and Procedures | Education and Awareness Training | Operational Controls | Oversight, Monitoring or Executive Controls | Audit Controls | Other Controls | Likelihood | Impact | Responsible Person | Timeline | Cost of Mitigation | Scheduled Date to Revisit Plan |
Ex | Chemistry Labs: lack of guidelines endangers students | 4 | 3 | Existing Controls | Staff need to do X as outlined in Y | Policies and procedures are explained | Protocols are X, Y, and Z | Supervisor reviews for accuracy and completeness | Labs are audited every 3 years | | 1 | 1 | Mr. Juan | 3weeks | Training = P65 per employee plus labor costs | 06/15/18 |
Potential Controls | Staff must follow new guidelines | Staff will be required to attend mandatory orientation | New guidelines and insurance policy will be set by external party | Mr. Jones reviews supervisor’s evaluation for accuracy and completeness | Labs will be audited every 2 years | | ||||||||||
OTHER SAMPLES
COMMON RISK IN HEI
EXAMPLES:
Broad Risk: STUDENT SERVICES
Specific Risks:
1. Failure to safeguard confidential information.
2. Failure to obtain proper licensing and accreditation
COMMON RISK IN HEI
EXAMPLES:
Broad Risk: PHYSICAL PLANT
Specific Risks:
1. Destruction of property
2. Outdated and physical equipment
COMMON RISK IN HEI
EXAMPLES:
Broad Risk: FINANCIAL MANAGEMENT
Specific Risks:
1. Inaccurate or untimely financial reports
COMMON RISK IN HEI
EXAMPLES:
Broad Risk: INFORMATION TECHNOLOGY
Specific Risks:
1. Requirements and IT opportunities are not adequately considered