Risk Management Policy 

About the Risk Management Policy

Risk management refers to the practice of identifying potential risks in advance of them taking place, assessing them and taking action to reduce the likelihood of the risk happening, or its impact if it does happen. 

The Risk Management Policy is documented below on this web page and sets out the University’s approach to risk management.  The Policy is considered by the Risk Oversight Group, Executive Board and Audit Committee before being approved every year by Council, the University’s governing body.  

For advice on risk management or the Risk Management Policy, please contact the Risk and Information Governance Team: 

Matthew Stephenson, Tel 01274 233021, Email: m.stephenson5@bradford.ac.uk 

Kim McIntosh, Tel: 01274 233131, Email: k.e.mcintosh@bradford.ac.uk  

The Risk Management Policy is stated below:

 

 

Risk Management Policy

Approved by:	Council
Executive Board Sponsor:	University Secretary
Author:	Assistant Head (Casework, Risk and Information Governance), Legal and Governance Department
Date Approved:	1 March 2023
Next Review Date:	22 November 2023
Version Number:	3.3
Applicable Statutory, Legal or National Best Practice Requirements:	OfS Accounts Direction
Equality Impact Assessment Completion Date:	16 November 2020

This document can only be considered valid when viewed via the University website. If this document is printed into hard copy or saved to another location you must check that the version number on your copy matches that of the one on the University website.  Approved documents are valid for use after their approval date and remain in force beyond any expiry of their review date until a new version is available.

1. Introduction

1.1 Risk is the effect of uncertainty on objectives with an effect being something which is a deviation from an expected outcome. This could have either a positive or negative effect. Risk is typically expressed in terms of:

• Risk Sources
• Potential Events
• Consequences; and
• Likelihood

1.2 Risk management is a coordinated activity to direct and control the risks an organisation faces.

1.3 The University recognises the need to adopt a systematic risk management approach to ensure systems and processes effectively manage identified risks.

1.4 The benefits of this approach are that it:

   1.4.1   supports strategic and operational planning and decision making;

   1.4.2   supports academic standards and continuous improvement of academic activities;

   1.4.3   protects the University’s reputation and standing;

   1.4.4   increases productivity;

   1.4.5   supports effective use of resources;

   1.4.6   promotes continuous improvement;

   1.4.7   helps focus the internal audit programme;

   1.4.8   reduces the impact of unexpected events and shocks;

   1.4.9   reassures stakeholders and partners;

   1.4.10 reduces the need for crisis management; and

   1.4.11 optimises the benefit of new opportunities.

2. Responsibilities for Risk Management

Governance

2.1 Council is ultimately responsible for ensuring that an effective process of risk management is embedded at all levels in the University and covering all aspects of business and academic activity.

2.2 Council considers risk and controls and receives regular reports from both the Executive Board and Audit Committee. Reports to Council focus on providing the appropriate level of assurance that the processes and controls to identify and manage risk are working effectively.

2.3 Audit Committee will provide more detailed scrutiny and oversight of the risk management framework on behalf of Council. Audit Committee will assess the adequacy of arrangements for risk management and for internal financial control. This will include the detailed periodic review of the Corporate Risk Register, annual review of the overall statement of institutional risk appetite and consideration of the high-level review of work conducted by both the University’s internal and external auditors around the adequacy of relevant systems of internal control.

2.4 The Audit Committee will provide the necessary assurance and recommendations that will enable it to recommend to Council whether to approve the Corporate Risk Register and the annual risk appetite.

Management

2.5 The Executive Board, led by the Vice-Chancellor, is charged with responsibility for overseeing implementation of the Risk Management Policy.

2.6 The University Secretary is the University’s executive lead for risk management and will ensure that the Executive Board receives regular updates on the University’s corporate risk register, highlighting any significant recommendations and will oversee university-wide engagement with operational risk management.

2.7 The Executive Board will receive regular reports on risk management from the Risk Oversight Group, which oversees the implementation and operation of the risk management framework on behalf of the Executive Board.

2.8 The Risk Oversight Group will be chaired by the University Secretary and shall provide detailed review and consideration of the Corporate Risk Register and local risk registers and the mitigations and assurances contained in each. The Risk Oversight Group will report on a quarterly basis to the Executive Board identifying and rating the key institutional risks to delivery of the strategic objectives.

2.9 Members of the Executive Board are responsible for local arrangements for risk management within their own areas including ensuring an appropriate level of scrutiny for the risks. They also have responsibility for ownership of corporate risks ensuring identification and alignment of risks for which they are responsible with University strategy and KPIs and, where appropriate delegated to other managers, the treatment of risks through delivery of agreed actions to mitigate identified risks.

2.10 The Executive Board will provide regular reports to Audit Committee.

Wider responsibilities

2.11 Identification, assessment and management of risk is an essential element of the work of all University Committees, Boards, Faculties and Directorates, as well as part of the Project Management Framework.

2.12 All staff with management responsibility are expected to have an understanding of the nature of risk associated with their area of responsibility as well as appropriate escalation procedures.

2.13 Risk management training will be provided as part of the management training programme to support the operation of the risk management framework. Specific personnel will be mandated to complete the training.

3. Risk Appetite

3.1 As part of the Risk Management Framework, the University will consider the amount and type of risk that is acceptable in the pursuit of its business objectives and agree a Risk Appetite Statement.

3.2 The Risk Appetite Statement will be reconsidered on an annual basis.  

4. Risk Management Framework

Risk Registers

4.1 Risks identified by the University are documented in risk registers.

4.2 The University Corporate Risk Register documents the University’s main strategic risks.

4.3 Local risk registers are in place for each faculty and directorate and in relation to some specific activities such as compliance with UKVI requirements.

4.4 For every risk, both corporate risks and local risks, the risk registers include:

• the risk definition (or title);
• the causes, effects for that risk;
• the appetite for that risk (for corporate level risks only);
• the risk owner;
• the risk lead (if different to the owner);
• existing controls and mitigations;
• the details of the assurances that each mitigation is effective and the amount of confidence that may be derived from the assurance;
• the impact and probability scores and overall rating;
  • of the risk prior to any mitigations taking effect (inherent risk score);
  • of the risk as a result of the mitigations in place (residual risk score);
  • of the level of risk the University would find acceptable (target risk score) (for corporate level risks only); and
• planned further controls to reduce residual risk to an acceptable level.

These elements of the risk register are reviewed and updated on an ongoing basis.

4.5 The University uses a three lines of assurance approach to provide confidence, based adequate and appropriate evidence that mitigations are in place and operating effectively. The three lines of assurance are:

• first line: departmental management provides assurance that mitigations are in place and operating effectively via internal checking and oversight mechanisms;
• second line: University management, governance structures and input from other Directorates separate from the department responsible for the risk, provide assurance that mitigations are in place and operating effectively;
• third line: third parties such as partners, inspectors, auditors, regulators and customers provide feedback and checking mechanisms to assure that mitigations are in place and operating effectively (this may or may not include oversight of first and second line assurances);

4.6 Operational oversight of the risk register is undertaken by the Risk Oversight Group reporting to the Exec Board with formal oversight by Audit Committee at each of its meetings on behalf of the University’s Council.

4.7 The identification of key institutional risks informs the corporate risk register and is derived from the perspective of the members of The Executive Board, the Risk Oversight Group and local management teams who consider factors such as the international, national, regional and local developments, competition, changing environment, resources and potential problems or opportunities for the University,

4.8 Risk registers are formally reviewed and updated at least quarterly by Faculty or Directorate Management teams of through other equivalent channels determined by Deans/Directors.

Internal Audit

4.9 Internal audit reinforces the risk management approach, with the programme of reviews based on the key risks of the University and to provide assurance to managers and the Audit Committee that:

• a process is in place to identify key risks;
• a response to managing individual risks has been adopted; and that
• appropriate and timely action is taken to improve risk management.

4.10 The internal audit planning process involves engagement with University management to identify the risks associated with delivery of the University’s strategic objectives. These are cross-referenced with the University risk register and are subjected to a risk assurance exercise.

4.11 Risk assurance identifies the key controls in place to manage each risk and the sources of assurance available. The internal audit programme of work is informed by areas highlighted where controls could be enhanced or where additional assurance may be required by senior management or by the Audit Committee. 

Risk Oversight Group

4.12 The Risk Oversight Group is chaired by the University Secretary and reports to the Executive Board and supports consistency of practice for risk management and business continuity throughout the University.

4.13 Its role is to:

• consider emergent risk areas, advising the Executive Board as appropriate;
• oversee the development and maintenance of the University’s overall risk management and business continuity infrastructure and framework, at institutional and sub-institutional level, ensuring consistency of practice and reporting, and making recommendations to the Executive Board as appropriate; this includes ensuring the adequacy, relevance and strategic alignment of the institutional risk register;
• oversee the University’s risk exposure, keeping under review new and emergent risks, ensuring appropriate horizon scanning (both within and outside the HE sector), reporting to the Executive Board as appropriate;
• consider the institutional risk appetite and potential differences between different business areas and institutional activities, making recommendations to the Executive Board as appropriate:
• to review the institutional risk register, ensuring that it provides a comprehensive and current assessment of institutional risk, aligned to key performance indicators and institutional strategy, with appropriate risk mitigation actions;
• to undertake deep dive reviews of corporate level risk, assessing all aspects of the risk and identifying any further elements of the risk not previously documented;
• to undertake reviews of local risk registers, specifically assessing specific highly rated local risks and identifying any further local risks not previously documented and considering the escalation or de-escalation of issues to the institutional registers; and
• to facilitate regular updates and discussion on business continuity planning and ensure the regular review of the University’s Business Continuity Plans and their alignment with related plans and policies (e.g. emergency planning, disaster recovery).

Project Risks

4.14 Parallel arrangements are in place for project-based risks.

4.15 Each Project Board is responsible for the management of risks for each project. These can be escalated to the Executive Board.

4.16 In addition, the Executive Board will receive a regular report from the Project team on the status of any projects and any risks to delivery.

4.17 Furthermore, a representative from the Programme Management Office is a member of the Risk Oversight Group to ensure effective linkage between project-based risks and other University risks.

5. Risk Management Process

5.1 Risks are identified through assessing what circumstances or events will impact on the delivery of the University’s strategy and operational objectives and priorities and are captured in the either the Corporate Risk register of local risk registers.

5.2 An assessment of each risk will be undertaken to ascertain the likelihood and scale of impact of each risk. Every risk is given a score from 1-5 for impact and probability which is then multiplied for an overall risk rating.

5.3 These risk ratings are then colour coded to enable the quick identification of the overall significance of each risk:

• Green: Low (risk rating of 1-4)
• Amber: Medium (risk rating of 5-9)
• Red: High (risk rating of 10-15)
• Dark red: Exposed (risk rating of 16-25)

5.4 This rating will inform the required risk controls.

5.5 The University uses risk management software and a standard risk register format to complete the risk evaluation process involving risk identification, cause, impact assessment, category of risk, probability, risk control and action assessment.

5.6 Due diligence and good management practice dictate that identified risks are actively managed thorough established controls and that further controls to reduce residual risk to an acceptable level are developed and captured as appropriate. Systematic documentation and monitoring of key risks and management actions with identified early warning and performance indicators of effectiveness will be undertaken. This supports the development of targeted risk treatment plans.

5.7 As the University’s risk management activity matures, further developments will be embedded into the University’s Risk Management Framework.

6. Monitoring

6.1 All strategic risks are owned by a member of the University Executive Board. Executive Board members are also responsible for local risk management within their own Faculties and Directorates.

6.2 Senior managers are charged with reporting to the Executive Board any issues arising from this process.

6.3 All staff are expected to escalate all known risks to a level of management that can effectively respond.

7. Legal, Regulatory and EDI compliance

7.1 Risk owners will ensure that risk controls have appropriate regard to legal and regulatory requirements and the University’s commitments to equality, diversity and inclusion.

8. Policy review

8.1 This policy will be formally reviewed on at least a three-yearly basis with a Risk Appetite Statement being approved annually.