Cahier de recherche N°14 - ESC Pau

6. Risk GovernanceRisk governance in banks demonstrated overconfidence in risk management techniques or ability toquantify risk, and weaknesses in the way risks were governed and regulated, (Kuritzkes, 2009) leading toa ‘false sense of control’ (Belcher, 2008) and form being confused with actual operation (OECD, 2009).Weaknesses in the behavioural aspect of risk governance or factors that contributed to weakening itincluded:• Incomplete risk reporting (UBS, 2008). The poor transmission of information about exposuresto governing bodies through effective channels and the inability of boards to obtainrelevant information.• Activity rather than embedded enterprise-based risk management systems (OECD, 2009).• Inexistence of risk committees, replaced by audit committees with overloaded agendasand compliance activities (OECD, 2009; FSA, 2009).• Risk committees - where they existed - composed largely of NEDs only ‘broadly knowledgeableof their company’s risk measurement methodology’ (OECD, 2009).• Inadequate monitoring of the implementation of strategy (OECD, 2009).• Not managing risk in real time (Stulz, 2009).Although HEIs are not required to follow the Combined Code, it is viewed as a best practice benchmarkfor risk management (HEFCE, 2005). This potentially exposes universities to the performanceweaknesses that banks demonstrated.The Risk Management in Higher Education: a guide to good practice (HEFCE, 2005) identified the embeddingof risk management through the involvement of ‘as many different groups as possible within theorganisation’ as a specific weakness in universities. Despite the potential of shared governance modelsfor the ‘top-down and bottom-up elements’ of risk management, problems were reported in obtainingbuy-in from academic staff for ‘structural’ and ‘cultural’ reasons. Furthermore, as far as NEDs wereconcerned ‘the quality and quantity of their involvement’ was noted as being ‘variable’.Risk may be embedded in the university through the spreading of risk management responsibilitiesacross the organisation. However, the multi-facetted nature of HE (Shattock, 2006) means that thesheer breadth of risk elements to be covered may be problematic. Using the example of the University ofAberdeen’s Register of Strategic Risks (2008), a quick calculation reveals 59 risk elements, 13 accountablepersons, 17 responsible persons and 12 monitoring committees. This very brief overview of justone aspect of risk governance again highlights the time, resource and commitment issues that surroundcorporate governance in universities. HEFCE’s (2005) suggestion to employ dedicated risk managementstaff, and OECD’s (2009) proposal to have a risk management expert on the board are worth considering.CAHIERdeRECHERCHE N°1441