Microsoft Word - Enterprise Risk Management (NEW)

Enterprise Risk Management Policy – 10/7/2021

Page 1 of 4

ENTERPRISE

RISK

MANAGEMENT

POLICY

Policy Type:

Management

Initially
Approved:

December
10, 2012

Policy Sponsor:

General Counsel and
University Secretariat

Last
Revised:

October 7,
2021

Primary
Contact:

Risk Management

Review
Scheduled:

October 2026

Approver:

Board of Governors

OVERVIEW

The University acknowledges that there is an element of uncertainty associated with all activities.
Due to the University’s desire to be creative and innovative, the diverse nature of the University’s
teaching, scholarship and service activities, and the fact that not all uncertainties can be transferred
to third parties through insurance policies, contracts or waivers, the management of Risks and
opportunities at all levels of the organization is imperative.

PURPOSE

The  University  is  committed  to  increasing  awareness  and  fostering  a  shared  responsibility  for
managing  uncertainties  at  all  levels  of  the  organization.  A  clearly  defined  Enterprise  Risk
Management  Policy  supports  this  commitment.  This  Policy  is  intended  to  help  the  University
achieve  its  mission  and  vision  and  to  maximize  the  efficient  use  of  the  University’s  available
resources by:

●

Assisting in decision making processes that will identify and mitigate potential risks;

●

Taking advantage of new opportunities; and,

●

Tracking and improving the management of existing uncertainty.

SCOPE

All activities undertaken or being considered by all Members of the University Community.

POLICY STATEMENT

GENERAL PRINCIPLES

1.1

The  University  will  manage  Risks  and  opportunities  to  achieve  its  mandate  and
protect the University community and its assets.  It will maintain a proactive, long-
term,  and  sustainable  Enterprise  Risk  Management  strategy  to  support  the
achievement of the University’s strategic objectives.

Enterprise Risk Management Policy – 10/7/2021

Page 2 of 4

1.2

The management of Risks and opportunities is a shared responsibility and must be
carried out at all levels of the University.

ENTERPRISE RISK MANAGEMENT

2.1

The  Audit  and  Risk  Committee  of  the  Board  of  Governors  is  responsible  for  the
oversight  of  University  Risk  and  for  establishing,  approving  and  periodically
reviewing  and  revising  the  University’s  Risk  Tolerance  and  the  related  ranking
methodologies for identified Risks, through consultation with Executive Leadership.

2.2

The University will establish and maintain an Enterprise Risk Management program
to oversee appropriate controls, management and mitigation strategies of all
identified Risk.

2.3

Risk Management will establish an ERM Risk Council to oversee the Enterprise Risk
Management program and to monitor identified Risks within the Risk Registry and
make recommendations to Provost's Council and President's Executive Committee
on identified and potential Risks to the University.

2.4

Each identified Risk will be assigned a Risk Owner who is responsible for:

Complying with the Enterprise Risk Management program;

Developing Risk Treatments to mitigate identified Risk to a tolerable level in
accordance with the University’s approved Risk Tolerance levels;

Establishing a culture of risk assessment in decision-making at all levels of
management within their Units; and

Managing and monitoring the effectiveness of Internal Controls and Risk
Treatment on the Residual Risk.

2.5

The President delegates the University’s Enterprise Risk Management coordination
activities to the Risk Management team who provide support to Units to identify and
manage Unit Risks in accordance with the Enterprise Risk Management program.

DEFINITIONS

(1)

Internal Control:

the processes put in place by Risk Owners that seek to reduce
the likelihood of risk events occurring or their impact should risk
events materialize

(2)

Enterprise Risk
Management:

a university-wide, systematic, comprehensive and coordinated
process of identifying, measuring, managing and disclosing key
risks of the University

(3)

Executive
Leadership:

the President, Vice-Presidents, and other support staff as
deemed necessary.

Enterprise Risk Management Policy – 10/7/2021

Page 3 of 4

(4)

Key Risk Indicators
(KRIs):

are metrics that indicate that a risk event may happen in the
near future (leading indicator) or that a risk event has already
occurred (lagging indicator).

(5)

Operational Risk:

a risk driven by exposure to uncertainty arising from daily
operational business activities

(6)

Policy:

the Enterprise Risk Management Policy

(7)

Residual Risk:

the Risk remaining after Risk Treatment

(8)

Risk:

the effect of uncertainty on objectives.

An  effect  is  a  deviation  from  the  expected  –  positive  and/or
negative.

Objectives  can  have  different  aspects  (such  as  educational,
financial,  experiential,  health  and  safety,  and  environmental)
and  can  apply  at  different  levels  (such  as  strategic,
organization-wide, project, product and process).

Risk is often characterized by reference to potential events and
Outcomes, or a combination of these.

Risk is often expressed in terms of a combination of the Impact
of  an  event  (including  changes  in  circumstances)  and  the
associated Likelihood of occurrence.

Uncertainty is the state, even partial, of deficiency of
information related to, understanding or knowledge of, an
event, its Impact, or Likelihood.

(9)

Risk Owner:

a Senior Leadership or Executive Leadership position that has
been assigned ownership to manage a particular Risk

(10)

Risk Registry:

the documented list of risks and associated risk ratings, controls
(either planned or in place) and the status of these risks.

(11)

Risk Tolerance:

the organization’s or stakeholder’s readiness to bear the Risk
after Risk Treatment in order to achieve its objectives. Note:
Risk Tolerance can fluctuate and be influenced by legal or
regulatory requirements

(12)

Risk Treatment:

the process to modify Risk

Treatment can involve:

● Accepting the Risk

● Reducing the Risk

● Transferring the Risk

● Avoiding the Risk

(13)

Senior Leadership:

means either (i) any Employee who both reports to a Vice-
President or President and leads a Department and (ii) any
other person designated as a Senior Leader by PEC

Enterprise Risk Management Policy – 10/7/2021

Page 4 of 4

(14)

Strategic Risk:

exposure to uncertainty arising from long-term business
planning and execution

(15)

University:

means Mount Royal University