2.4 Review of Related Literature
2.4.9 Aspects of ERM Implementation in the context of HEIs
Why is Risk Management important in higher education? It is through tracing the history of risk management that we learn that in the twentieth century risk management began as an isolated discipline and had long been associated with the concept of insurance and financial sectors alone. It is only recently, beginning in the 1990s, that risk management was identified to be a corporate function which encompasses all areas of an institution, including higher education institutions. HEIs started to conceive a better and more solid risk identification process, and therefore effect ERM implementation as an essential element of organisational change (Deck 2015, p. 32). In their comprehensive literature review of ERM implementation in higher education, Perera et al. (2020, p. 156) argued that traditional risk management has no longer been the solution to HEIs:
“It has been identified the poor practices of Traditional Risk Management (TRM) approach were the main courses for the recent global crises (Sithipolvanichgul, 2016). It is advocated that a proper risk management solution is needed to resolve problems and challenges faced by businesses in this dynamic work settings.
Under this situation, Enterprise Risk Management (ERM) has emerged as an effective solution to safeguard businesses from the possible disasters and optimizing the value of the firm enhancing the benefits for stakeholders.”
“Risk management is [therefore] so important because it enables institutions to potentially avert crises and lessen the impact of those that do occur” (Vandenberg 2017). Raanan (2009, p. 55) argues that “as the academic world is going through a period of unprecedented change, it must also adopt advanced,
state of the art management methods, approaches and techniques.” He also confirms that “there is no reason why these institutions cannot adopt a management tool which is relatively easy to deploy, inexpensive, and has the potential of improving management’s performance quickly – the tool of risk management” (p. 55). The importance risk management and risk-management-based approaches have on UAE HEIs in specific have been cited by few recent educational and risk management researchers (El- Refae and Belarbi 2015; Al-Jundi and Ahmad 2016). Al Jundi and Ahmad (2016) make it very clear why risk management as a model is essential for UAE HEIs: “According to the UAE Commission for Academic Accreditation (CAA), Ministry of Higher Education and Scientific Research, any proposal for the accreditation of any program, should demonstrate awareness of risks of all aspects of the initiation of the program and its delivery. So, it is necessary for any higher educational institute, before applying for any program accreditation to have a concrete process for managing the risk (CAA, 2011)” (p. 68).
Therefore, one of the most important reasons why risk management is important in the UAE higher education context is the requirement for a specific rigid model of accreditation and assessment as was first presented in the first section of this study.
As well stated by Rubino (2018, p. 203), “the relevance of the role played by the ERM is widely recognized by the academic (Jensen, 1993; Spira and Page, 2003; Power, 2004; Rubino and Vitolla, 2012a; Mikes and Kaplan, 2014) and professional literature (COSO, 1992, 2004 and 2017; ISACA, 2012 and 2013)”. Even though during the first decade of the 21st century, risk management was not addressed in the context of academic or higher education context (Hargreaves 2008; Raanan 2009; Rubino 2018;
Hillson 2019), a good deal of literature dealing with risk management and its effects in the higher education context has started to show up in the education field only over the past two decades (Cassidy et al. 2001; Helshoot and Jong 2006; Austin et al. 2013; Beneke 2011; Hommel and King 2013;
Lundquist 2013 and 2015; Bin Md. et al. 2014; Sum and Saad 2017; Vandenberg 2017; Deloitte 2019).
The traditional risk management literature in higher education context provides for several approaches to manage uncertainty, or risk, in large-scale organisations, institutions or universities, “with a focus on minimizing cost and schedule overruns” (Moore and Shangraw 2011, p. 2). Hargreaves (2008) suggests that universities started to at least assume the minimal risk of curriculum designing. He advocated approaching the curriculum design within a measured and careful mode of risk. In so many examples of higher education institutions, risk management was not taken seriously (Raanan, 2009). At that time, it was found also by Raanan (2009) that only a few researchers such as Watson (2004), Menoni (2006), Graven (2007) and Gabel (2008) investigated risk management issues in higher education.
All fields that require a corporate governance and management would definitely face risks of some kind in their processes, which as stated before in this study would entail going through different levels of uncertainties. The importance of risk management in higher education was investigated by David Hillson, or as universally known as the Risk Doctor, more than anyone else in the field. In the Risk Doctor website, Hillson is introduced as “an international thought-leader in risk management, with a global reputation as an excellent speaker and award-winning author. Hillson (2016) highlights the importance of ERM as “an essential tool in helping to bring more understanding of those risks; it enables the organization to be more prepared, more resilient to change and more ready to minimize threats and to seize opportunities.” (p. 15). Additionally, Kumar (2016) argues that there are eight factors that determine the importance of ERM as a discipline in general:
“1) Regulatory developments [Basel I and II, COSO Commission, Cadbury Code 1992, Australia/New Zealand (AS/NZS) Risk Management Standard of 1995 which as updated in 1998, Sarbanes – Oxley Act of 2002, SEC added requirements in 2010, Dodd-Frank Wall Street Reform and Consumer Protection Act 2009-2010]; 2) Rating agency views; 3) The COSO Report; 4) Basel; 5) Economic Capital; 6) Conglomerates; 7) Convergence of financial products, markets, globalization; 8) Board attention due to public’s demands for certain assurances.”
Additionally, Kumar (2016, p. 89) argues that “the top-level elements of enterprise excellence are growth strategy and risk management” The reason why risk management is so important now is because of the myriad of issues that have changed over the past few years. Serving in higher education institutions for quite some time would tell of how different it is now. What is different now is there is much less margin of error for institutions and a greater opportunity for something wrong to happen. There is a general discussion nowadays that the business model in higher education may not be sustainable for a lot of institutions having a handle on what things or occurrences could happen that could derail institutions is more important now than it was probably ten years ago. Therefore, the things that could change for an academic or educational institution that can really put it in peril as the studies show shook a lot of institutions to their foundation. Competition now and who is looking for our students is very different now than it used to be before. Therefore, boards need to be more engaged in looking on the horizon with the institution on what sorts of things could derail its plans.
On its website, Deloitte lists five categories of higher education risks which provide justifications for ERM adoption in HEIs: “Business model risks, reputation risks, operating model risks, enrollment supply risks, and compliance risks”. According to Deloitte.com “these risks begin to show why the higher
normal of perpetual discomfort. According to Deloitte.com, taking an enterprise approach to risk management for universities can be more proactive and prepared avoiding, accepting, mitigating, sharing, or exploiting risk where possible, or responding to higher education issues and challenges more effectively when they arise. As such, higher education institutions, in the view of Deloitte, are under increasing pressure from government authorities, the public, and members of the universities communities to manage risks.
In summary, in the early 21st century years most of the academic works and research on risk management covered only profit organizations or businesses, not universities. In this sense, the greater the uncertainty, the greater the risk. Since risk is everywhere, there is a need for risk management everywhere, but we need to start by identifying it. Crane et al. (2013) argue that the first step in the risk management process is to identify and classify the potential risks. As concluded by Hillson (2016), because there is no doubt risk is present and recognized as inevitable and unavoidable in every lane of the human venture, so there is an equal need to handle risk in the best possible manner.