Effective Risk Management and Mitigation Strategies in Academic Institutions (Full Transcript)

Speaker 1: You know, kind of associated with risk is, of course, risk mitigation. And I think one of the things coming out of the pandemic is that institutions need to look really carefully at how they manage permission continuity in the event, in these kinds of events. And Penn has been pretty robust over the last several years in developing mission continuity planning and tabletop exercises across the entire institution. And that put us in a pretty good place when kind of on two days notice, the entire institution went remote on there that kind of everybody knew what they were supposed to do. And there was a manual for kind of how this was going to work. And that's really helpful about communicating with senior leadership and the board. At Penn, we're set up, and I'm going to speak specifically to research risk, because that's my area. I'm associate vice provost for research services at Penn, so that's kind of my wheelhouse. We have a senior risk management committee, advisory committee, that advises the vice provost for research on risks of research activities. And that committee also develops, through our compliance office, a risk assessment that goes to the trustees twice a year. So we keep the trustees very well informed of what we're identifying as the research risks at Penn. We are a big decentralized entrepreneurial place, so we are not risk averse. It's kind of by nature, but we are very mindful of the need to understand what our risks are and to manage and mitigate.

Speaker 2: Great. Yeah, and it's interesting, but thank you for kind of outlining how you identify and assess your risk. I did want to briefly mention, I think that sometimes that can get a little bit confusing because there actually can be multiple groups in an institution who are doing risk assessments. So some of you, for example, may have been asked to talk about a risk assessment by more than one person, so that can be confusing. So I do want to kind of outline that really quickly. I think, number one, it could be occurring through an enterprise risk management program or a risk management group, right, that we've been talking about. It could also be occurring from a compliance group, specific to compliance. So from a research element, you could get that more targeted view as well. And then also, it could be happening through internal audit. An internal audit does their risk assessment to help them develop their internal audit plan for the year, for the couple of years. And so I think, you know, at most institutions, there's kind of a goal to wrap those together so that there is consistency and maybe the same folks can go to the same meetings, but everyone's in a different maturity level as they try to build some of those programs out. So just wanted to kind of set the stage there. If you do happen to get involved from a risk assessment perspective, there could be more than one happening on campus at any given time. So just something to think about.