Implementing Enterprise Risk Management: Case Studies and Best Practices

CHAPTER 9 Lessons from the Academy: ERM Implementation in the University Setting

ANNE E. LUNDQUIST

Western Michigan University

The tragedy at Virginia Tech, infrastructure devastation at colleges and universities in the New Orleans area in the aftermath of Hurricane Katrina, the sexual abuse scandal at Penn State, the governance crisis at the University of Virginia, American University expense-account abuse, and other high-profile university situations have created heightened awareness of the potentially destructive influence of risk and crisis for higher education administrators.¹ The recent Risk Analysis Standard for Natural and Man-Made Hazards to Higher Education Institutions (American Society of Mechanical Engineers–Innovative Technologies Institute 2010) notes that “resilience of our country's higher education institutions has become a pressing national priority” (p. vi). Colleges and universities are facing increased scrutiny from stakeholders regarding issues such as investments and spending, privacy, conflicts of interest, information technology (IT) availability and security, fraud, research compliance, and transparency (Willson, Negoi, and Bhatnagar 2010). A statement from the review committee assembled to examine athletics controversies at Rutgers University is not unique to that situation; the committee found that “the University operated with inadequate internal controls, insufficient inter-departmental and hierarchical communications, an uninformed board on some ...