Risk Management Policy

All risks must be recorded and managed through the School's automated governance system (AGS) using the dedicated risk register functionality.

The likelihood of each risk materialising within the following 12 months (24 months for strategic risks) should be regularly assessed on a scale of 1 to 5:

1. Rare - Highly unlikely, but still some remote possibility of materialising.
2. Unlikely - Possible but quite improbable and not expected.
3. Plausible - Reasonably conceivable to materialise.
4. Likely - Quite probable and expected to occur.
5. Impending - Highly likely or almost certain to materialise.

The potential maximum impact of every risk, should it materialise, should be assessed in the following categories:

• Academic: Impact on teaching effectiveness and learning outcomes.
• Staff: Impact on working practices, employment or employee experience.
• Student experience: Impact on student satisfaction and overall experience.
• Financial: Impact on budgets, financial viability and sustainability of the organisation.
• Reputation: Impact on the external approval of the School and the credibility of its awards.

The impact of each risk should be rated in each category on a scale of 1 to 5, taking into account any existing mitigating controls and assurances already present to mitigate the impact of the risk should it materialise: 

1. Very low
2. Low
3. Moderate
4. High
5. Severe

The rating should be selected based on the most credible and probable worst-case, given the available information, rather than simply a best-case or worst-case scenario.

For every risk, the maximum academic impact, should it materialise, should be rated as either of the following:

• Very low - No reduction in learning or teaching quality, student satisfaction, or award quality.
• Low - No discernible impact on learning or teaching quality, student satisfaction, or award quality.
• Moderate - Impact on learning or teaching quality, student satisfaction, or award quality that can be resolved without impacting student retention, progression, or success.
• High - Material but manageable impact on learning or teaching quality, student satisfaction, or award quality that can be resolved without impacting student retention, progression, or success.
• Severe - Significant and unmanageable impact on learning or teaching quality, student satisfaction, or award quality that can be resolved without impacting student retention, progression, or success.

For every risk, the maximum impact on staff or working practices, should it materialise, should be rated as either of the following:

1. Very low - Small modifications necessary to how tasks are completed.
2. Low - Adjustments to working practices or modifications to staff roles.
3. Moderate - Potential changes to employment positions which may require formal processes.
4. High - Formal change processes to manage potential employment issues, including the risk of redeployment, or redundancies.
5. Severe - Possibility of critical skills/personnel not being available or needing to downsize staff through redundancies.

For every risk, the maximum impact on the overall student experience, should it materialise, should be rated as either of the following:

1. Very Low - No noticeable change to the student's overall campus life, access to resources, engagement opportunities, or sense of belonging.
2. Low - Minimal disruptions to certain aspects of student life, but the overall experience remains largely unchanged. Temporary inconveniences might be experienced, but they don't significantly detract from the holistic student journey.
3. Moderate - Changes that can be felt in specific areas of the student experience, such as in extracurricular activities, campus facilities, or support services. However, with proper interventions, the impact can be mitigated, ensuring a continuity of the student experience.
4. High - Substantial disruptions that might lead to students reconsidering their choice of institution or course of study. This could include extensive limitations in campus resources, lack of access to essential services, or severe disruptions in communal and social activities. Immediate action would be required to ensure student retention and satisfaction.
5. Severe - Drastic changes to the student experience where the essence of campus life, culture, or sense of community is lost. There might be long-term repercussions, affecting the reputation of the institution, with potential drops in enrolment rates or student recommendations. Major strategic interventions would be necessary to restore trust and rectify the situation.

For every risk, the maximum financial impact, should it materialise, should be rated as either of the following:

1. Very low - Little to no effect on budgets
2. Low - An effect on one or more budgets that is manageable within those budget(s).
3. Moderate - Financial consequences to the budget or budgets involved, which can be managed by underspending in unaffected budgets.
4. High - Financial repercussions that require the use of cash reserves, in-year transfers from unaffected budgets, or, transitional funding from external sources.
5. Severe - Significant financial losses we can only address through external funding.

For every risk, the maximum reputational impact, should it materialise, should be rated as either of the following:

1. Very low - No outside opposition or disapproval projected.
2. Low - Some external criticism that is unlikely to be significant enough to cause reputational damage.
3. Moderate - External criticism of the School that it is within our power to address or mitigate, thereby minimising the impact or degree of reputational damage.
4. High - Potential external criticism of the School that could lead to substantial reputational damage.
5. Severe - Negative press coverage and regulatory or governmental intervention due to significant national and international criticism.

Based on the granular impact assessment, the overall impact rating of each risk will be calculated (automatically by the AGS) based on the following weighted formula: 

(3 x Academic + 2 x Student experience + Staff + Financial + Reputation) / 8

An overall score shall be calculated (automatically by the AGS) for each risk based on the following formula:
(Probability of materialising) X (Overall impact rating)

Since each factor is on a scale of 1 to 5, the overall score will be on a scale of 1 to 25, labelled as:

Operational:

• Very low (1 to 3)
• Low (4 to 6)

Strategic:

• Medium (8 to 10)
• High (12 to 16)
• Very high (Over 16)

The School must systematically mitigate risks by documenting the following in the risk register:

• Prevention: Measures to reduce the likelihood of risk materialisation.
• Alleviation: Measures to minimise adverse effects if the risk occurs, such as backup plans.
• Plans: Current and future steps to improve risk scores.
• Target Score: Expected risk rating (red, amber, green) after mitigation.

Departmental directors must actively engage with the risk register routinely as part of their operational management. In collaboration with the Quality, Compliance, and Audit Committee, they are responsible for routinely identifying, assessing, and monitoring risks relevant to their departments.

They should foster a culture where risk awareness is integrated into daily operations, not just considered during audits or reviews. Staff at all levels should feel empowered to raise concerns early, knowing that they will be acted upon promptly.

Risks should be identified through ongoing monitoring of departmental activities, stakeholder feedback, and external benchmarking. Departments must hold risk review meetings at least fortnightly to evaluate risks using both quantitative and qualitative measures. High-priority risks must be addressed immediately, and all identified risks must be recorded in the risk register and reported to relevant committees.

The School must develop and maintain comprehensive scenario planning processes to prepare for potential "what if" situations, including regulatory changes, pandemics, and IT failures. This involves creating specific action plans for each identified scenario, conducting regular drills or simulations to test these plans, and updating them as necessary to reflect changes in the external environment or internal operations.

In the event of a major incident or crisis—such as financial mismanagement, cybersecurity breaches, or campus safety events—the School must activate its immediate response strategy. This includes notifying key stakeholders within the first hour, initiating a crisis management team, and following predefined communication protocols. Recovery plans must be implemented promptly to minimise disruption, and all actions documented in an incident report for review.

All staff must undergo regular risk management training to ensure they can identify, assess, and escalate risks effectively. Training should occur annually, with additional refresher sessions provided as needed. The School must also run regular awareness campaigns to promote a risk-conscious culture and keep staff informed of any changes to risk management procedures.

The Quality, Compliance, and Audit Committee meets at least three times a year, aligned with key dates in the operating cycle. Its responsibilities with regards to risk management, as outlined in the Governance Structure Statement, include:

1. Reviewing and reporting on the School’s internal control, mitigation systems, and risk management processes.
2. Reviewing and reporting on insurance and other risk management mechanisms.
3. Advising the Board of Governors and other bodies on quality and compliance matters.
4. Overseeing, reviewing, and reporting on the Strategic and Operational Risk Registers.
5. Reviewing and reporting on the integrity of financial statements, formal financial announcements, and communications with the Office for Students.
6. Reviewing and advising on the effectiveness of internal and external audit functions.
7. Reviewing and advising on legal and regulatory compliance.
8. Reviewing and advising on ethical standards compliance.
9. Reviewing and reporting on the operational efficacy of Health and Safety arrangements.
10. Investigating, resolving, and reporting on alleged ethical or other breaches involving the Executive Committee or Academic Board, while breaches by other principal bodies are addressed by the Board of Governors.
11. Advising on the appointment and removal of accountants and auditors.
12. Advising on annual financial statements, performance, and reports.
13. Investigating and reporting on suspected financial irregularities.

Projects may require their own risk register and management. 

When proposing any substantial new initiative or change to ongoing activities, departmental directors must:

1. Identify and assess potential risks.
2. Maintain a project-specific risk register. If the project impacts the entire School, include these risks in the School's risk register.
3. Regularly submit a summary report to:
   • Executive Committee
   • Quality, Compliance, and Audit Committee
   • Board of Governors (only if strategic, sensitive, or high-impact risks are identified)

The risk management policy must be reviewed and updated at least annually to reflect changes in the external environment, regulatory requirements (including OfS standards), and the School’s internal risk landscape. This process should include a commitment to learning from past incidents and making necessary adjustments to enhance the policy’s effectiveness.