February 2005/11 (web only)
Good practice
Guidance
This report is for information and guidance
Risk management in higher education
A guide to good practice, prepared for HEFCE by PricewaterhouseCoopers
This report draws on good practice in the higher education sector and elsewhere, providing practical guidance to higher education institutions on enhancing and embedding their risk management processes. It complements earlier guidance published by HEFCE, and is aimed at all those involved in the risk management process within institutions, particularly risk managers, audit committees and governing body members.
Table of contents and executive summary (read on-line)
Download
Guidance
[ MS Word 631K |
Zipped Word 192K |
Adobe PDF 401K |
Zipped PDF 308K ]
Contents
- Executive summary
- Introduction
- Involvement of the governing body
- Risk appetite
- Resourcing
- Exploring and assessing the risks
- Actions for improvement
- Prioritisation of risk reporting
- Embedding risk management
- Sharing risk management knowledge
Appendices
- A Self-assessment checklist for audit committees
- B Organisations that contributed to this guidance
- C Index of examples
- D Further reading
- E Glossary of terms
Executive summary
Purpose
1. This report draws on good practice in the higher education sector and elsewhere, providing practical guidance to higher education institutions on enhancing and embedding their risk management processes. It complements earlier guidance published by HEFCE (in particular HEFCE 01/28).
2. The guide is aimed at all those involved in the risk management process within institutions, but is particularly relevant for risk managers, audit committees and governing body members. It is also commended to the related bodies funded by HEFCE.
Key points
3. Institutions in the higher education sector are moving from achieving technical compliance with the Turnbull Report and with HEFCE requirements, and are now looking to realise the benefits of having implemented risk management. These include the ability to take better-informed decisions about opportunities, and to constructively address new patterns of risk.
4. The guide describes different techniques used by institutions to obtain maximum benefit from risk management, including drawing on the expertise of the governing body, academic staff and internal audit. It examines different models of resourcing risk management, scoring risks and reporting on them. It also looks at how different institutions have embedded risk management.
5. In the best-run organisations, risk management is synonymous with good management and good governance. It is not considered as a bolt-on to existing practices, or a separate exercise simply to meet regulatory requirements.
6. This guide was prepared by PricewaterhouseCoopers on behalf of HEFCE.
Action required
7. As with the previous HEFCE guidance on risk management, this guide is not prescriptive. It is recognised that there is no single correct approach to managing risk in institutions.