Enterprise Risk Management
Enterprise Risk Management (ERM) is a coordinated approach to identifying, assessing, managing, and monitoring risks that could affect the University's ability to achieve its mission and strategic objectives.
At SCU, ERM provides a university-wide view of risk, helping leadership understand where significant risks exist, how they are being managed, and where additional attention or action may be needed. ERM gives SCU a way to see risk across the University—not just within individual departments—and helps leadership focus attention on the risks that matter most to the University's mission.
Importantly, ERM does not replace the responsibility of individual departments and functions to manage their risks. Rather, it provides an enterprise-level perspective and governance framework that connects risk information across the University.
Our Enterprise Risk Framework
Risks We Consider
Strategic & Reputation | Financial | Operational | Students | Compliance & Regulatory | Safety & Resilience
Enterprise risks may span multiple categories and are assessed from an institution-wide perspective.
COSO Enterprise Risk Management Framework
SCU's Enterprise Risk Management program is based on the COSO Enterprise Risk Management—Integrating with Strategy and Performance framework, adapted to the University's higher-education environment.
The COSO framework provides the foundation for how SCU connects risk with strategy, assesses and responds to significant risks, and monitors risk over time.
Risk Ownership & Governance
Risk Management is a Shared Responsibility
Risk owners across the University are responsible for managing risks within their areas of responsibility. The Risk Management Office provides the framework, facilitates enterprise-level assessment and monitoring, identifies cross-functional themes and gaps, and brings a consolidated view of significant risks to University leadership and governance committees.
Governance
SCU's ERM program includes regular review by the University's Enterprise Risk Management Committee and reporting to the Audit & Risk Oversight Committee of the Board of Trustees.
Keeping the Risk Register Current
The University's risk environment is constantly changing. SCU periodically reviews its enterprise risk landscape using internal risk assessments, discussions with University leadership and risk owners, and external higher-education risk research.
Risks may be added, re-scoped, combined, or retired as the University's circumstances and risk profile change.