Office of Risk Management

A risk assessment is the process of identifying and evaluating risks that could affect the achievement of an organization's objectives. Simply put, it asks: What could go wrong, how significant could it be, and what should we do about it?

Risk assessment begins with understanding an organization's objectives and identifying the events, conditions, or circumstances that could prevent those objectives from being achieved. Because not all risks are equal, identified risks should be evaluated based on their likelihood and potential impact.

Once risks are identified and assessed, management determines how each risk should be addressed. Depending on the circumstances, management may choose to mitigate the risk through internal controls or other actions, accept the risk, avoid the activity creating the risk, or transfer or share the risk with another party.

Risk is constantly changing. New technologies, regulations, systems, personnel, financial pressures, cybersecurity threats, and changes in University operations can create new risks or change the significance of existing ones.

For this reason, risk assessment should not be viewed as a one-time exercise. University leaders and managers should continually consider:

• What are we trying to accomplish?
• What could prevent us from achieving it?
• How likely is that to happen?
• What would the impact be?
• What controls or other actions are in place to manage the risk?
• Is the remaining level of risk acceptable?

How Internal Audit Can Help

Management is responsible for identifying and managing the risks associated with its operations. Internal Audit provides independent assurance and advisory services that can help departments evaluate risks, assess internal controls, identify potential gaps, and determine opportunities to strengthen processes.

The Office of Audit, Risk, and Compliance is available to assist University departments in understanding risk, evaluating internal controls, and developing practical approaches to managing risk while achieving their objectives.

Need Help Evaluating Risk?

Contact Internal Audit or the Risk Department for a risk assessment consultation.