risk management plan department of education

School operations

Risk Management – Schools

• Step 1 — Establish the context
• Step 2 — Risk identification
• Step 3 — Risk analysis
• Step 4 — Evaluation
• Step 5 — Risk treatment
• Step 6 — Communication and consultation
• Step 7 — Monitoring and review
• Step 8 — Recording and reporting

This policy sets out the requirements for schools to identify and manage risks that might affect their students, staff or operations.

Managing risk means considering the effect of uncertainty (whether positive or negative) on school objectives.

Schools must proactively manage risks by following the department’s Risk Management Process for Schools set out in the Guidance tab .

Managing risk involves:

• identifying and assessing risks and controls
• documenting risks in a risk register (or equivalent)
• implementing actions and treatments to manage identified risks
• monitoring risks, including regularly reviewing risk registers
• reporting on risks.

Managing risk is everyone’s responsibility, as explained in the department’s Three Lines of Defence External Link model.

Identifying and managing risk maximises schools’ ability to make sound decisions to:

• deliver the best possible outcomes for the school and the community
• meet Victorian community and government expectations for accountable and responsible use of public finances and resources
• safeguard student and staff wellbeing.

Assessing and documenting risk

All schools must use the department’s Risk Management Process for Schools when assessing and documenting the risk(s) associated with:

• Emergency and Critical Incident Management Planning
• Child Safe Standards
• OHS Management System (OHSMS) Overview
• Buses – Owned, Hired or Chartered by a School

When assessing the risks listed above, schools must document the identified risks in a risk register. A template risk register is available in the Resources tab .

Schools may also assess and document risks for:

• development and review of the school’s Annual Implementation Plan (AIP)
• development and review of the school’s School Strategic Plan (SSP)
• community events such as school fetes, concerts and science fairs
• school projects/programs such as infrastructure builds
• lesson planning associated with higher risk activities such as science experiments or food technology classes.

If a school is uncertain whether a risk assessment is required, they must contact the Planning, Risk and Governance Branch for clarification and advice.

Monitoring risks

Schools must monitor risks for those mandatory risk assessments outlined above.

Schools may monitor identified risks by:

• including a standing item to review the school’s current and emerging risks on the school leadership meeting agenda
• undertaking a review of all risks associated with delivery of the AIP and the SSP at least once every 6 months
• reviewing all risk registers as necessary or when advised.

Reporting risks

Schools may report and escalate relevant risks to stakeholders, for example, school council, regional directors, Senior Education Improvement Leaders etc through appropriate channels.

Communication of this policy

Principals/school leadership are responsible for:

• providing staff with relevant training opportunities to support staff to manage risks at an operational level
• ensuring that all school staff follow departmental policies and processes, as risk management is integrated into other policies and processes.

Risk register templates are available on the Resources tab to document identified risks and their treatment and controls. Note that some templates include examples of controls or assessments which will need to be reviewed/updated to suit your specific context.

School leadership teams (principals and business managers) can contact the Planning, Risk and Governance Branch for specific risk advice and risk training workshops. Email: [email protected]

Printed copies of the Risk Management Process for Schools pocket guide (available in the Resources tab ) can also be ordered from the Branch.

Definitions

Objective An objective is an aspirational, results-oriented statement describing what your school intends to achieve within the set timeframe, and describes what successful delivery would entail.

Risk The effect (whether positive or negative) of uncertainty on objectives.

Risk management The identification, analysis, assessment and prioritisation of risks to the achievement of an objective.

Risk management involves the coordinated allocation of resources to:

• minimise, monitor, communicate and control risk likelihood and/or impact, or
• maximise the potential presented by opportunities.

Risk management includes coordinated activities to direct and control risks to the achievement of an objective.

Risk register A formatted list that records identified risks, assesses their impact and describes the actions (controls) to be taken to mitigate them. Typically, it describes the risk, the causes for that risk and the responsible person or group for managing it.

Control A control is any existing measure that modifies risk such as uniform policy or staff succession plan.

Controls are methods or procedures that assist in achieving objectives, safeguarding assets, ensuring financial information is accurate and reliable and supporting compliance with all financial and operational requirements.

Identifying current controls and their effectiveness is one of the most important aspects of risk management. It allows you to better understand the elements that are impacting the likelihood and/or consequence of a risk.

Treatment A risk treatment is an action you undertake to reduce a risk to an acceptable level, by adding new or improving/modifying existing controls.

Related policies

Relevant legislation.

Public Administration Act 2004 (Vic) External Link (section 81, part 1b)

Reviewed 12 May 2023

• Print whole topic

Policy last updated

11 May 2023

• School councils

Planning, Risk and Governance Branch

Please subscribe to our blog

• September 28, 2023

The Five Keys to Risk Management for Higher Education Boards

• --> Written by Toni Hoy

As fires, school shootings, and public scandals at colleges and universities hit the headlines, risk management for higher education is taking center stage for boards. Potential legislation targeting campus safety is also putting added pressure on higher education boards, motivating them to focus more intently on risk management.

Risk management requires boards of higher education institutions to take an enterprise-wide view of risk oversight. As risks evolve and change in priority, risk management is also evolving and changing.

How College and University Boards Are Making Risk Management a Priority

The risk management landscape for colleges and universities is starting to look different in recent years than in the past. For example, the 2022 United Educators Top Risks Survey , highlighted the following changes in the priorities of risks at colleges and universities:

• Risks related to recruitment and hiring leaped from 14 th place to 3 rd place.
• Student mental health ranked 5th (included in the survey for the first time).
• External pressures (economic, societal, and political) were a non-issue for the last few years, but are now in the top ten.
• Risks related to the past pandemic and future pandemics dropped to 20 th place.

In other statistics, 67% of college and university leaders cited enrollment and retention of students as a top risk priority, followed closely by data security, which is a concern for 65% of higher education leaders.

Boards must also be concerned about the outlook for higher education, which isn’t strong. According to FitchRatings , the outlook in 2023 is “deteriorating” compared to the prior year. Higher Ed Dive cites an S&P Global press release, which shows the outlook for higher education as “mixed” — slightly more optimistic than the FitchRatings assessment.

College and university boards are making risk management for higher education a priority by evaluating the change in risks and the potential for them to occur. Considering the drastic changes in the risk profile of higher education institutions, boards are taking steps to reduce their liabilities and keep students and faculty safer.

To combat and mitigate risks, college boards can take a  five-step approach  to risk management for higher education that includes identifying, analyzing and evaluating risks, implementing a risk management program, and monitoring their efforts.

1.      Identifying Risks

The first key to developing any risk management plan is to identify potential risks, which is no small task. Senior administrators are a valuable resource for understanding the issues that drive various risks in this industry, as they have a “boots on the ground” perspective.

Colleges and universities face a variety of types of risks, such as:

• Insurance risk
• Strategic risk
• Financial risk
• Operational risk
• Compliance risk
• Reputational risk

In assessing potential risks, boards need to evaluate their risk profile and align it with the institution’s philosophy, goals, and objectives. Identifying risks may require boards to work with multiple investment managers and financial experts. Furthermore, boards must connect the dots between the top risks and relate them to the various types of risks listed above.

For example, the top risk priority for colleges and universities is enrollment and retention, and decisions about improving enrollment could involve strategic risk, financial risk, operational risk, and reputational risk.

Many colleges and universities have specific types of operational risks. Certain institutions that have a strong focus on research must factor in risks related to handling toxic materials, safe laboratory practices, designing research facilities, and similar risks. These types of operational risks often correlate with compliance risks in the research fields such as laws and regulations that govern medicine and science.

Another area of great risk is college athletic activities, where risks include injuries, equipment safety, facility safety, crowd control, and traffic control. Risks in this area could encompass insurance risk, financial risk, operational risk, and reputational risk.

2.      Analyzing Risks

Colleges and universities won’t have to look too far to find tools to help them analyze their risks . The most effective tool is a  matrix  in which risk management teams can classify risks as low, medium, high, or extreme.

Templates are also helpful for evaluating and prioritizing risks. In analyzing risks, your board will get a clearer picture of how a certain risk impacts policies and processes.

3.      Evaluating Risks

Evaluating risks is different than analyzing risks because it involves understanding how a particular risk will impact the institution overall. Minor risks may be worth taking, while major risks require greater planning and consideration.

A good strategy to evaluate risks is to list all activities within each classification and enter the associated risks for each activity. These steps will help teams assign a risk score based on the severity of the risk and the probability of it occurring. The matrix is also a helpful tool for listing ways to mitigate or manage each risk.

4.      Implementing a Risk Management Program

Each step of a risk management program requires risk management teams to revisit the institution’s strategy, goals, history, and condition of the campus, including the property, students, and resources.

Before determining how best to implement risk management for higher education programs, risk management teams must develop shared definitions for risk management terms to reduce communication problems during the next step – monitoring and reviewing the risk management plan.

5.      Monitor and Review the Risk Management Plan

To ensure accountability, boards may decide to designate a particular individual who is responsible for creating and implementing the risk management program and developing a timeline. The risk manager should develop a risk portfolio, which can provide the basis for validating and prioritizing risks as they emerge.

The board must play a continual role in overseeing and monitoring the risk management program, as risks affect nearly every part of higher education. This responsibility extends to ensuring that all stakeholders do their part to protect the institution from risk.

Board Technology Provides a Secure Platform for Risk Management Planning

Together, a strategic risk management plan and technology support good governance principles to ensure the sustainability of today’s higher education institutions. With a platform like BoardEffect, risk management for higher education is much easier for boards to tackle, as it has the necessary tools and features to get the job done efficiently.

BoardEffect features a secure platform that ensures secure communications. As an added benefit, board administrators can set up granular permissions to control who has access to various parts of the risk management process.

See how BoardEffect, a Diligent Brand, can help your higher education board strengthen your risk management and organizational resilience. Request a demo today.

INTERESTED IN LEARNING MORE?

See how BoardEffect can streamline governance processes for your board of directors while improving overall performance.

How Your Mission-Driven Organization Can Get More Strategic with Technology

  Charity and nonprofit boards play a vital role in guiding their organizations toward success.…

What Recent Data Breaches Signal to Nonprofit Organizations

Hackers strike once again, this time causing a data breach at a prominent New York…

How Can a Start-up Benefit From Board Portal Software?

One of the greatest things about starting a new nonprofit or other type of organization…

• previous post: Cybersecurity and Managing Reputational Risk for Mission-Driven Organizations
• next post: Public Trust in Nonprofits: What Boards Need to Know

©BOARDEFFECT 2023 •  ALL RIGHTS RESERVED •  PRIVACY POLICY

• BOARD PORTAL SOFTWARE
• BOARD MEETING CYCLE
• ANNUAL MEETING CYCLE
• BOARD DEVELOPMENT CYCLE
• CLIENT SUCCESS
• WHITEPAPERS
• BOARD PORTAL BUYER’S GUIDE
• CONTACT SUPPORT
• REQUEST A DEMO

Everything You Need to Know About Risk Management in Schools

As school administrators grapple with the challenges presented by the COVID-19 pandemic, they are realizing, more than ever before, the importance of risk assessment in schools. The stakes are high, so understanding risk management and developing a risk management plan for your school is critical. 

Below, we will go over the key concepts of risk management in schools. 

What Is Risk Management?

We all manage risk in our daily lives. When we cross the street, order food (let’s say a fried oreo), or call an old friend, we are analyzing the pros and cons of each action, along with associated risks. Will I make it across the street in time?  Will the fried food catch up to me? Is my old friend going to be the same as they were in the past? 

During this deliberation process, our mental lives are uncontrolled, populated with hundreds of reasons supporting and rebuking each possible action. While this chaotic approach to risk management works for most of us in our daily wanderings, a more controlled approach must be taken when assessing and reducing risks in our schools.  

Risk management is the process of making and taking action on decisions that will minimize the adverse effects of risk on an organization. In schools, possible risks include injury of a student, a lawsuit filed by an angry parent, or damage to the school's reputation. 

While a lawsuit sounds scary as a school administrator, it is best to focus on preventing the first example: any harm or danger to a student.This focus will give you the motivation needed to follow through with your risk management strategy since it's a person at risk, not the organization's finances. This motivation is key, especially when risk management is a process that lasts all year. 

Why Is Risk Management Important in Schools?

Risk management is important because it keeps your students, faculty, and finances safe from any harm, while also protecting your financial assets and lowering your legal liability. Not only will developing a risk management plan for your school reduce the chances of risks, but it will also mitigate the effects of those risks if they should occur. 

For example, if you do have a student that is showing symptoms from COVID-19 during the school day, you will already have a response plan in place to make sure the adverse effects stop there. You'll be able to prevent the spread. 

Risk management comes with these benefits for school administrators: 

• Protect people from harm.
• Limit the possibility of a lawsuit.
• Safeguard your public reputation.
• Reduce potential losses in revenue. 
• Make your students, teachers, and parents feel safe. 

Risk is prevalent in any mission, from exploring outer space to educating our children. The goal is not to eliminate all possible risks (that's impossible and would lead to a pretty boring life). The goal is to manage the risks appropriately. Here, we will show you how to do so, by creating a risk management plan for your school. 

How to Create a Risk Management Plan for Your School

1) identify risks.

Before you can develop response plans, you need to know which risks are out there. Some will be obvious, such as a COVID-19 infection, while others will be more hidden, such as an unsafe part of the playground.  

To track down every risk, brainstorm with your team. Also, include other stakeholders and industry experts in your identification process. They might have experience which sheds light on risks your team hadn't thought about. 

Once you have found all the risks, put them in a centralized location, accessible to your entire team. That way, your team can continuously monitor the risks. It also helps to divide your risks up into categories. For example, you could have a section for operational risks and one for financial risks. Or, you could separate them by parts of the school-day, by creating categories like recess risks or cafeteria risks.

2) Assess Each Risk's Likelihood and Impact 

Once you have the list of risks, you can start analyzing each one.Start by going through the list and giving them a likelihood score (low to high). Then, give them an impact score (low, moderate, or severe).  

Image Source: Risk Academy

You can also assign probabilities or numbers to each riskYou can use these numbers in this formula to calculate each event's risk. 

Risk = Probability x Impact.

Then, put the organized matrix of risks into a live document where your team members can track and update them. For instance, if one child became sick from a certain contagious skin infection, then the probability, and therefore risk, of the event would increase. 

3) Create Response Plans

Next, you should create plans to lessen the chances of risks occurring and responses if the risks should occur. A plan to lessen the chances of risk of infection on a school bus could be limiting bus capacity. And, a response would be what actions to take if a child shows symptoms on the bus. 

 Remember, the magnitude of loss prevention measures taken in schools for each risk depends on the risk's probability and severity. So, when creating response plans, you need to keep your resources (time, budget) in mind. It's unwise to spend a lot of a teacher's time on preventing a low probability, low impact risk, like a student losing their favorite pencil. 

4) Choose a Lead for Each Risk

In the book, "Influence", Robert Cialdini writes about how social psychology influences our actions. 

In one passage, he shares advice that could be life-saving. If you were to ever feel a stroke coming on while in a large group (a concert, train station, etc.) you should point to someone and say, "You, yes, you in the green shirt. Call 911. I'm in trouble and need help."  

Why so forward? Well, when you pick a leader, you assign them responsibility, and the selected person is, therefore, more likely to take immediate action. On the other hand, if you were to just sit there and yell for help, the response would lag. Every person, no matter how kind or caring, would pause and look at everyone else, wondering who is most qualified or equipped to help. 

So, for each response to each risk, you need to select a leader.That way, if the event should take place, there will be no confusion on who needs to begin the response plan. The leader will put water on the fire as quickly as possible.  

5) Make Contingency Plans

Because life seems to love testing us, even risk responses have associated risks. Sometimes the first response plan will go wrong because you lack the right resources at the time. Or, perhaps the circumstances are slightly different than your team had anticipated. For example, sometimes afire renders one escape route unusable. You need another safe way out. 

So that these possible problems don't completely derail your response efforts, you need contingency plans (plan Bs) for each risk, especially the most likely and severe ones. Make sure to put these in your centralized location also, and ensure the owner of the risk is aware of the plan B.  

6) Continuously Monitor Risks

New risks will come into play as the school year progresses, especially during such unprecedented times, So, it's critical to monitor your risks and continue adding new ones or editing the probabilities of old ones.This is where a management system designed for running schools comes in handy. 

Best Practices for Managing Risk This School Year

Since the biggest aspect of risk management this school year is controlling the spread of COVID-19, here are some steps schools are taking to manage it. 

1) Limit Bus Capacity

"The best option for children getting to school would be for their parents to drop them off," says Dr. Tina Tan, Northwestern University pediatrics infectious disease specialist.  

Of course, this isn't an option for every parent, but the more who can make the sacrifice the better. Along with a limited bus capacity, disease experts, such as 

 Dr. Judith Guzman-Cottrill, say to keep the bus windows open if possible.

2) Enforce Entry Guidelines

It's important to keep infected individuals out of the school so that they don't infect others. Powering through illness used to be a trait of the strong in our society.  However, we need to change this idea and stay home if we feel the slightest touch of illness. 

K-12 administrators should make clear policies on when students and teachers must stay home. They also need to create response plans in case a few teachers are out for a prolonged period of time. 

3) Have a Plan Ready for if Someone is Sick

If a child or teacher starts to show symptoms in the classroom, you need to have a clear plan on what to do next. This should be one of your highest priority risks to plan for since both the possibility and severity are rather high in this climate.  

4) Clean and Disinfect Regularly

High touch surfaces need to be cleaned regularly, according to CDC guidelines.So, get together with your team and assess which surfaces these are in the school. These are usually doorknobs, bathroom doors, and sink areas.  

5) Stagger Cafeteria Times

Eating lunch requires removing face masks, so social distancing is extra crucial here.  

6) Move Your Work Online

Of course, not everything can be done online, but certain tasks can be. Identify what needs to be done in person and what doesn’t. For example, parents don’t need to come into the schools for an update; you can send messages to them via text or email. Or, rather than passing paper from schools to students to parents and back, do it digitally.

You Don't Have to Do it Alone

It can be a complex process enacting a risk management initiative in your school. Even after your risk assessment, there is a lot to keep track of.You have to continuously update and report on risks. Plus, you must give every administrator transparency into how the risk management strategy is working. 

There are tools you can use to help and plenty of resources. Risk management is an ongoing process, and it has to be collaborative to succeed.Don’t worry about doing it all at once; get together with your team, make a plan, and track your progress. As school administrators grapple with the challenges presented by the COVID-19 pandemic, they are realizing, more than ever before, the importance of risk assessment in schools. The stakes are high, so understanding risk management and developing a risk management plan for your school is critical. 

Related Resources

Risk management in schools: essential know-how for safety, what to look for in an after school management software, four ways to manage covid-19 risk in classrooms, is a student management system the best choice for your school.