Enterprise Risk Management (ERM) is the process of identifying, analyzing and managing risks to increase the probability that the University will achieve its strategic objectives by providing the methodology for integrating risk into the strategic planning and resource allocation process.
Cyclically, we ask Risk Owners to identify and review any Enterprise Risks they may have and analyze them to determine the potential effects on the University. To analyze risks consistently we all use the same criteria to determine a risk score using likelihood and impact.
If at anytime you have questions about completing your Enterprise Risk Management Scorecard, please feel free to contact us at riskmanagement@trentu.ca.
What is Risk?
Risks are all the events that could happen that will affect whether your goals turn out the way you had planned. These can have positive or negative outcomes.
What is a Risk Score?
Once identified, a risk must be analyzed to determine its potential effects on the University. A Risk Score is developed by assessing two variables:
- The likelihood and imminence of a risk event or condition occurring
- The consequences of threat event of condition (Impact).
Both likelihood and impact are rated on a scale of 1 to 5. Tables to assist with rating can be found in the sections below
How to Score Likelihood?
When analyzing risks we must consider how likely the risk will occur. Using the table below we are able to score this on a scale of 1 to 5.
Likelihood | |
| Almost Certain (5) | We expect that the risk will occur many times a month We fully expect the risk to occur The risk is already happening |
| Likely (4) | We expect that the risk will occur at least once a year We expect that the risk will most probably occur |
| Possible (3) | We expect that the risk will occur once in 3 years We expect that the risk may occur at some time and we think it more likely than not |
| Unlikely (2) | We expect that the risk will occur once in 10 years We expect that the risk may occur at some time, and we think it less likely than not |
| Rare (1) | We expect that the risk will occur in 50 years We expect that the risk may occur only in exceptional circumstances but that it is highly doubtful that it will |
How to Score Impact?
Impact is rated on a scale of 1 to 5 based on the table below:
Impact Rating | ||||||||
| IMPACTS | Financial | Human | Interruption | Environmental | Relationship/Image | |||
| Injury/Illness | Faculty/Staff/Experience | Business Interruption | Interruption to Teaching | Interruption to Research | ||||
| Very High (5) | Above $5M cash impact | Deaths (Single or Multiple) | <Intentionally Blank> | Inability to provide key administrative functions at critical times | Inability to provide teaching activities university wide for more than 2 weeks | Loss of access to grant funding for 1 year | Incident causes sustained long term harm t environment (ie. damage lasts greater than a month) | Sustained front page adverse national (>2 weeks) media coverage International media (>1 week) coverage |
| High (4) | Between $2M - $5M cash impact | Multiple people with serious long-term injury Intensive Care | Low morale university wide Negative university wide student experience | Inability to provide key administrative functions over a sustained but non-critical period | Inability to provide teaching activities university wide for up to two weeks Cancellation of examinations | Long term loss of research arm (ie. loss of animal research facility) Cancellation of a significant research project | Incident causes sustained medium term harm to environment (ie. damage lasts greater than a week) | Intermittent adverse (<2 weeks) National media coverage |
| Medium (3) | Between $1M - $2M cash impact | One person with serious long-term injury | Low morale within a single administrative department or faculty Negative student experience within a faculty | Inability to provide key administrative functions intermittently | Inability of multiple faculties to provide teaching activities for up to one week Examinations postponed | Cancellation of multiple research projects | Incident causes short term harm to environment (ie. damage lasts no greater than 72 hours) | Sustained front page (>2 weeks) adverse local media coverage Public demonstration of students and/or community concern |
| Low (2) | Between $250,000 to $1M cash impact | Single or multiple minor injuries requiring off campus treatment | Low morale within a single unit | Performances of key administrative functions are reduced for sustained periods | Inability of multiple faculties to provide teaching activities for more than a day | Cancellation of a single research project Sustained complaints from sponsors | Incident causes intermittent harm to environment over a period of time | Intermittent adverse local and University (<1 week) media coverage |
| Very Low (1) | Up to $250,000 cash impact | Single or multiple minor injury requiring first aid | Localized low morale | Performance of key administrative functions are reduced intermittently | Inability of one faculty to provide teaching activities for a single day | Intermittent complaints from sponsors | Incident causes minimal harm to environment (ie. damage lasts no greater than a day) | Intermittent adverse coverage contained to University media |
How to Determine Risk Score using Likelihood & Impact?
Now that we have determined the Likelihood and Impact of our Enterprise Risk we can map it to our Risk Score using the chart below. Depending where our Risk sits in the chart will determine if the Risk Score is Extreme, High, Medium or Low.
For example, if the Risk Impact is 4 and the likelihood is 3 then our Risk Score is High.
Determining Risk Management Objective
After we have analyzed and scored our risk, we then need to determine what the Risk Management Objective will be. In other words, how do we treat this risk going forward?
As we know, not all risk is bad, and thus we have both Opportunity Treatment Techniques and Threat Treatment Techniques depending on the type of risk you have. Below is a list of all treatment options available:
Opportunity Treatment Techniques
| Options | Description |
| Accept | No Action is taken, due to cost/benefit decision |
| Alternate | Considering other feasible steps to minimize risks |
| Enhance | Actions to increase the likelihood of impact related to the risk |
| Exploit | Taking advantage of the current situation |
| Share | Partnerships with internal departmental and programs or external partners |
Threat Treatment Techniques
| Options | Descriptions |
| Accept | No Action is taken, due to a cost/benefit decision |
| Alternate | Considering other feasible steps to minimize risk |
| Avoid | Avoiding or exiting the activities which increase the risk |
| Reduce | Actions to reduce the likelihood or impact related to the risk |
| Transfer | Transferring or sharing a portion of the risk, to finance (Insurance) |