Impact, Likelihood and Velocity
Impact
The table below outlines how the impact level of a risk is determined in the ERM risk assessment process.
Impact Measure | High | Medium | Low |
---|---|---|---|
Financial | Annual loss of $10 million or more | Annual loss of $1 to $9.9 million | Annual loss of less than $1 million |
Operational | Significant enterprise-wide disruption | Campus-level, week-long disruption of critical service or unit | Localized (single unit/department) disruption of less than 1 week |
Reputational | Significant long-term media attention (i.e., national or international) | Likely to generate media attention in major outlets (e.g., Wash Post) or that is longer than short-term | Unlikely to generate more than limited short-term, local media attention |
Health/Safety | Illness or injury is widespread or serious, or may result in long-term illness, disability or death | Illness or injury to a group; requires medical care but does not result in long-term illness or disability | Minor illness or injuries to small number of people, treatable with first aid or basic care |
Human Capital | Affects 25% of employees or students | Affects 5-25% of employees or students | Affects less than 5 % of employees or students |
Compliance/ Legal Liability | Serious compliance exposure or legal liability | Significant compliance exposure or legal liability | Minor compliance exposure or legal liability |
Likelihood
The table below outlines how the likelihood of a risk is determined in the ERM risk assessment process.
Likelihood Measure | High | Medium | Low |
---|---|---|---|
General | Risk is probable and is likely to occur in the next 3 years | Risk is possible and has a medium chance of occurring in the next 3 years | Risk is only remotely likely and has a low chance of occurring in the next 3 years |
Peer Experience | Has occurred recently in higher education | Has occurred in higher education | Has not occurred in higher education |
Current Readiness | Ineffective or non-existent measures in place to manage risk | Existing measures to manage risk are only partially effective in limiting chance of occurrence | Existing measures to manage risk are effective in limiting chance of occurrence |
Event Frequency | Happens frequently | Happens, but infrequently | Could happen only in extraordinary circumstances |
Velocity
The table below outlines how the velocity of a risk is determined in the ERM risk assessment process.
Velocity Measure | High | Medium | Low |
---|---|---|---|
Time to Impact | Risk impact will be felt in less than 3 months after occurrence | Risk impact will be felt in 3 to 9 months after occurrence | Risk impact will be felt more than 9 months after occurrence |
Reaction Time | There will be very little or no time for reaction and response planning before serious consequences of the risk hit | There will be limited time for reaction and response planning before serious consequences of the risk hit | There will be time for reaction and response planning before the serious consequences of the risk hit |