Impact, Likelihood and Velocity

Risk Assessment Process

Impact

The table below outlines how the impact level of a risk is determined in the ERM risk assessment process.

Impact Measure High Medium Low
Financial Annual loss of $10 million or more Annual loss of $1 to $9.9 million Annual loss of less than $1 million
Operational Significant enterprise-wide disruption Campus-level, week-long disruption of critical service or unit Localized (single unit/department) disruption of less than 1 week
Reputational Significant long-term media attention (i.e., national or international) Likely to generate media attention in major outlets (e.g., Wash Post) or that is longer than short-term Unlikely to generate more than limited short-term, local media attention
Health/Safety Illness or injury is widespread or serious, or may result in long-term illness, disability or death Illness or injury to a group; requires medical care but does not result in long-term illness or disability Minor illness or injuries to small number of people, treatable with first aid or basic care
Human Capital Affects 25% of employees or students Affects 5-25% of employees or students Affects less than 5 % of employees or students
Compliance/ Legal Liability Serious compliance exposure or legal liability Significant compliance exposure or legal liability Minor compliance exposure or legal liability

 

Likelihood

The table below outlines how the likelihood of a risk is determined in the ERM risk assessment process.

Likelihood Measure High Medium Low
General Risk is probable and is likely to occur in the next 3 years Risk is possible and has a medium chance of occurring in the next 3 years Risk is only remotely likely and has a low chance of occurring in the next 3 years
Peer Experience Has occurred recently in higher education Has occurred in higher education Has not occurred in higher education
Current Readiness Ineffective or non-existent measures in place to manage risk Existing measures to manage risk are only partially effective in limiting chance of occurrence Existing measures to manage risk are effective in limiting chance of occurrence
Event Frequency Happens frequently Happens, but infrequently Could happen only in extraordinary circumstances

 

Velocity

The table below outlines how the velocity of a risk is determined in the ERM risk assessment process.

Velocity Measure High Medium Low
Time to Impact Risk impact will be felt in less than 3 months after occurrence Risk impact will be felt in 3 to 9 months after occurrence Risk impact will be felt more than 9 months after occurrence
Reaction Time There will be very little or no time for reaction and response planning before serious consequences of the risk hit There will be limited time for reaction and response planning before serious consequences of the risk hit There will be time for reaction and response planning before the serious consequences of the risk hit