Risk: the University of California ERM program reduces the costs of risk and borrowing.

• Author: Bugalla, John

[ILLUSTRATION OMITTED]

In December 2005, the University of California's Department of Risk Management was renamed Risk Services, reflecting a new, broader approach to identifying and managing risk using an enterprise-wide approach. By identifying and analyzing the full cost of risk, the university was able to develop strategic plans for reducing costs and freeing up resources that could then be used for meeting the university's mission goals of teaching, research, and public services. Approaching risk from a strategic standpoint has helped reduce the chances of loss, create greater financial stability and protect the university's resources.

The overall strategy was to develop a data warehouse that could manage all the risk information being collected by the groups, existing programs, and initiatives throughout the system. This data was to be used with the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework to analyze processes, risks, and controls system-wide. (COSO, which is sponsored by five major professional associations, develops frameworks and guidance on enterprise risk management, internal control, and fraud deterrence.) A key objective was to examine the university's total cost of risk for potentially negative consequences or missed opportunities.

One of the major functions of the Office of Risk Services is to develop and implement a system-wide enterprise risk management (ERM) program for identifying risks, implementing risk controls, and selecting proper risk responses. The university's campuses and medical centers all have different operational needs and different needs for defining and classifying their data. Faculty, staff, and students need to be able to identify and manage the risks associated with their activities in ways that align with the university's mission.

REDUCING THE COST OF RISK

All programs and costs associated with the University of California's ERM program are funded by an internal premium that is determined by independent actuaries. Insurance premium dollars totaling $20 million a year are shifted to loss-prevention and loss-control activities, and the university has used that money to reduce the cost of risk by $493 million since the program started in fiscal 2003.

The university created a data repository for risk and controls related information, known as the enterprise risk management information system (ERMIS), to determine exactly where its limited resources should be deployed. The objectives for this system include the following:

1. Improved quantitative analysis capabilities.

2. Improved analytical and reporting capabilities.

3. Support for leading risk governance and compliance processes.

4. System-wide visibility, with local flexibility.

5. Scalability without additional burden on university staff.

   The university's ERMIS is based on customized web-based business intelligence software that helps quantify and track pre-defined key performance indicators (KPIs). Deployed in February 2009, the application has been configured to integrate claims data (losses), corporate data (exposures), and other information sources in an effort to create a centralized data management environment.

   The Office of Risk Services also provides additional users with access to ERMIS, based on requests, and demand has been high. Once users are granted access, the system makes location-specific data available, in conjunction with enterprise trends on user privileges. This practice has helped improve the university's...