When institutions talk about risk management, they primarily mean two things: operational risks (i.e. things which might prevent the institution from going about its usual business, which we’ll deal with tomorrow), and reputational risks.  This latter is not generally seen as relating to the actual quality of teaching and research (that has more to do with prestige, which we dealt with yesterday); rather, it has to do with “issues management” or worse, “crisis management”.  Risks to prestige are slow moving; risks to reputation can pop up in the space of an hour or less.

Very broadly speaking, these things come in one of five varieties.

Student Misconduct: A student or group of students assaults/harasses another student, sexually or otherwise, or there is some sort of wide-spread academic cheating going on.  Practically speaking, there is little institutions can do to completely prevent these. Provided university employees aren’t actually abetting students in abusive behaviour (e.g. residence staff teaching new students racist/sexist songs), institutions tend to get judged more on how they react to the events than the events themselves.

Employee Controversy:  Sometimes, this consists of misconduct (sexual misconduct in particular) or some kind of serious ethical lapse (plagiarism, forging research results), usually, but not always, by a professor.  Sometimes it comes from treating students in a bone-headedly stupid way (hi there, Wilfrid Laurier’s Professor Rambukkana!) or when a Professor says something that gets a negative reaction from the public.

Senior Admin off the Rails:  The worst ones here are cases of embezzlement or misappropriation (rare, but it does happen) – more frequently, it’s things like persistently generous expense accounts or gross failure to contain project costs (Bonjour, UQAM!).  It also includes attempts to discipline faculty when issues of academic freedom might even vaguely be in play.

Board Conflict: When the Board starts to think the admin – and specifically the President – aren’t capable of doing the job, then you head into reputation-altering crises; UBC and the University of Virginia are the obvious recent examples, but Concordia’s Board used to have a brilliant reputation for  micromanaging and undermining the President (especially during labour negotiations), which is equally problematic.

Lightning Bolts:  Racists decide to use your campus as a place to light citronella torches.  Your campus falls for a multi-million dollar phishing scam.  Etc.

The question, from a risk perspective, is what do you do about all of this?  Some of these kinds of things are one-day wonders.  But make a mistake when dealing with an academic freedom case can irritate some of your key stakeholders (profs).  Same with appearing to be insufficiently vigilant about students’ safety.  Employees going rogue can certainly give big donors conniptions.  And if government gets the impression an institution is not being careful with public money, watch out.  So, all of this stuff matters not just for reputation, but also for relationships with key stakeholders whose support affects the institution’s ability to safeguard/increase its prestige.

So how does a good institution deal with all these issues?  What’s the right way to mitigate risk?

Good internal control systems help with financial matters.  Two rules of thumb for Boards of Directors: don’t skimp on hiring the best financial managers/controllers and always read the internal audit reports because they are GOLD.  But tighter internal controls don’t help with most of the other matters.   With students – particularly those living in residence – you need well-trained student services personnel to help socialize them a bit and help them work out what is and isn’t acceptable.  And admins, as far as disciplining or silencing profs goes, if there’s even a hint of an academic freedom issue at play – just don’t.  It never works out well.

But everything else?  To repeat, the issue is usually not whether an event occurs but how well an institution deals with its aftermath. And basically, that means two things: senior admins with excellent judgement and political savvy, and a communications department that is both on the ball and understands the subtleties of post-secondary education and its political context.

When a crisis arrives, institutions have to move swiftly to marshal the facts and consider not just their own responses but the impacts of various potential responses on various stakeholder groups (this is where the value of a good comms team is vital – UBC and McGill, for instance, have seemed to lack this at various times in recent scandals).  If there is a person in danger or distress, move immediately to give them whatever they need.  And If there is a complaint being made against someone (students, employees, whatever), the complaint must proceed relatively quickly, but not so quickly that due process gets abused.  In fact, there is usually a lot of merit in slowing an initial rush to judgement.  Not so much that justice is delayed, but just long enough for people to get over the initial rush.  My take: both l’Affaire Potter at McGill and the “Silence of the Deans” Affair at Saskatchewan would have gone much better if admins in both cases had just taken a deep breath and said “do I need to take this rash step now? Or should I come back to it in 48 hours and see if I feel the same way?”  Crucially, this is what Richard Florizone did during the dentistry student scandal at Dalhousie two years ago – an incident which I think should be considered the Gold Standard in crisis management at Canadian universities.

So, my advice to Boards is: stuff happens.  Your institution will be judged on the speed and quality of the clean-up.  Invest in systems (especially in finances and student services) where they can make a difference.  Invest in top-notch rapid-reaction teams for everything else.  And invest in leadership that can be calm in a crisis and not make judgments too hastily.  It’s all worth it.