Institutional Risk Programs Frequently Asked Questions

By definition, Risk is the chance of occurrence of an event or trend that will have a negative impact on operations or fulfilment of objectives at the institutional, academic unit and/or academic support unit levels.

For more information, see the definitions page.

An occurrence as simple as a student walking on campus has potential Risk associated with it. Consider Appendix A, the occurrence of students having bad experiences while walking on campus could impact student satisfaction (Risk #22 in the institutional Risk Registry)

The University of Waterloo determines Risk by utilizing Appendix A, which is a list of seven Risk categories and thirty Risks identified through survey of senior administrators at Waterloo. These Risks are reviewed on a periodical basis.

At the institutional level, Waterloo manages Risk through its Internal Audit, Statutory Compliance, and University Risk Management Programs. Considering the University Risk Management Program, Waterloo decides on the reviews conducted by internal audit and monitors Risk through the Statutory Compliance Program.

Throughout Waterloo, many other Risk management activities take place, such as insurance, legal and immigration services, occupational health, safety office, information systems & technology services, etc. There are several bridges between those activities and the Institutional Risk Management Programs, which altogether constitute the overall risk framework of Waterloo.

Risk cannot be eliminated but it can be reduced to an acceptable level. With every decision made, opportunity is gained because Waterloo is closer to fulfilling goals of its Strategic Plan. However, Risk may emerge because alternative choices are forgone from making a decision or because processes that are involved in carrying out and achieving those goals create other Risks. 

The process of assessing Risk can be extensive. However, there are six major steps to be followed for Risk assessment and reporting:

1. Establish the context.
2. Identify the Risks.
3. Analyze the Risks.
4. Evaluate the Risks.
5. Deal with the Risks.
6. Report the Risks.

For more information, see the Risk Management Reporting Guideline about the steps to assess Risks.

As per Policy 11, senior administration (the President, vice-presidents and University Secretary) report to the Audit & Risk Committee twice per year. Risks are assessed relative to the Risk Appetite and are tracked until said Risk returns below the Risk Appetite, in addition to one more year of monitoring.

“Risk” typically has a negative connotation when associated with Institutional Risk Programs. However, Risk can be positive. For purposes of the Institutional Risk Program, positive Risks will be defined as the chance of occurrence of an event or trend that will have a positive impact on operations or fulfilment of an objective at the institutional, academic unit and/or support unit levels. 

For example, a Risk to make adjustments in funding a project is a positive Risk, because if you are able to successfully make adjustments then the project might finish under budget, which will create leftover money. When considering technicalities, completing a project with extra funds will signal mismanagement. However, the long-term impact of having extra funds will benefit the corporation, making it a positive Risk. 

Enterprise Risk Management (ERM) is not regulated in Canada, with the exception of Alberta. The University of Waterloo’s Audit & Risk Committee oversees ERM. While the Committee does not report to the government for Risk management, they labour within the parameters of Policy 11 – University Risk Management and of their mandate (Audit & Risk Committee’s Terms of reference).

Waterloo’s ERM Program is called University Risk Management to reflect the adaptations made to ERM to the specific setting of Waterloo.

Internal audit is a continuous process that is approved by the Audit & Risk Committee. It provides independent review and testing with respect to Risk management and control at Waterloo within the scope of their engagement. The internal auditors report their findings to the University Secretary and the Audit & Risk Committee and suggest recommendations.

For more information, see the Internal Audit Program.

There is no set amount of time for the completion of internal audits. The length of time varies significantly depending on the size of the audit, complexity and the drive towards completion. As a general guide, a review from scoping to the final report takes a few months. However, acting on the observations made will vary.

Reviews conducted by internal audit appear on the agenda of each meeting of the Audit & Risk Committee.

The external audit examines the financial records of the University and every year, financial statements are approved by the Audit & Risk Committee. Financial records fall under the purview of Finance.

For more information, see the Internal Audit Program.

An important component of Waterloo's corporate responsibility, the Statutory Compliance Program ensures that Waterloo complies with all laws and regulations applicable to its operations, and adheres to generally accepted standards and best practices.

For more information, see the Statutory Compliance Statement and Statutory Compliance Program.

The role of the Audit & Risk Committee consists of monitoring the effectiveness of Waterloo’s:             

• Internal controls and management information systems;
• Risk management activities.

For more information, see the Audit & Risk Committee’s Terms of reference.

The CRO executes the functions described in Section 6.4 of Policy 11 - University Risk Management. 

Waterloo, like all post-secondary institutions, is at a perpetual state of caution due to Risk. Institutional Risk Programs are necessary in order to maintain the structural integrity of Waterloo through mitigating Risks.

The Statutory Compliance Program, University Risk Management Program and Internal Audit Program work together to create the optimized Risk framework. It creates the ideal situation for Waterloo to assess and mitigate Risk with prompt efficiency and bring Risk to a residual level (where the amount of risk or danger associated with an action or event remaining after natural or inherent risks have been reduced by risk controls).

More information on the programs that work together to create the optimized Risk framework:

• Statutory Compliance
• University Risk Management
• Internal Audit

The Institutional Risk Programs should matter to you for three reasons:

1. Policy 11 requires senior administrators to report an on biannual basis; the consolidated report is carefully reviewed by the Audit & Risk Committee and helps them monitor Risks for the entire institution; senior administrators therefore require assessments from their own reports;
2. The University Risk Management and Statutory Compliance programs are helpful tools to help you manage your projects, track Risks and report on issues that need the review of a higher instance; internal audits provide a “health check” on your business processes and on implemented and to-be implemented projects, relative to industry and higher education best practices; and
3. All employees, as per Policy 11 (including, without limitation, senior administration):
   1. Are responsible for day-to-day Risk management and control within the scope of their employment responsibilities, and as directed by the senior administrator to whom they ultimately report;
   2. Are expected to conduct Risk Assessments as part of planning, decision-making, project-related and other operation activities; and
   3. Deliver Risk management reports as directed by the senior administrator to whom they ultimately report.

You may find additional information in one of the following key documents:

• Policy 11 - University Risk Management
• Risk Management Reporting Guideline
• Statement of Institutional Risk Appetite
• Institutional Risk Mitigation Strategy