Impact, Likelihood and Velocity

Impact

The table below outlines how the impact level of a risk is determined in the ERM risk assessment process.

Impact Measure	High	Medium	Low
Financial	Annual loss of $10 million or more	Annual loss of $1 to $9.9 million	Annual loss of less than $1 million
Operational	Significant enterprise-wide disruption	Campus-level, week-long disruption of critical service or unit	Localized (single unit/department) disruption of less than 1 week
Reputational	Significant long-term media attention (i.e., national or international)	Likely to generate media attention in major outlets (e.g., Wash Post) or that is longer than short-term	Unlikely to generate more than limited short-term, local media attention
Health/Safety	Illness or injury is widespread or serious, or may result in long-term illness, disability or death	Illness or injury to a group; requires medical care but does not result in long-term illness or disability	Minor illness or injuries to small number of people, treatable with first aid or basic care
Human Capital	Affects 25% of employees or students	Affects 5-25% of employees or students	Affects less than 5 % of employees or students
Compliance/ Legal Liability	Serious compliance exposure or legal liability	Significant compliance exposure or legal liability	Minor compliance exposure or legal liability

The table below outlines how the likelihood of a risk is determined in the ERM risk assessment process.

Likelihood Measure	High	Medium	Low
General	Risk is probable and is likely to occur in the next 3 years	Risk is possible and has a medium chance of occurring in the next 3 years	Risk is only remotely likely and has a low chance of occurring in the next 3 years
Peer Experience	Has occurred recently in higher education	Has occurred in higher education	Has not occurred in higher education
Current Readiness	Ineffective or non-existent measures in place to manage risk	Existing measures to manage risk are only partially effective in limiting chance of occurrence	Existing measures to manage risk are effective in limiting chance of occurrence
Event Frequency	Happens frequently	Happens, but infrequently	Could happen only in extraordinary circumstances

The table below outlines how the velocity of a risk is determined in the ERM risk assessment process.

Velocity Measure	High	Medium	Low
Time to Impact	Risk impact will be felt in less than 3 months after occurrence	Risk impact will be felt in 3 to 9 months after occurrence	Risk impact will be felt more than 9 months after occurrence
Reaction Time	There will be very little or no time for reaction and response planning before serious consequences of the risk hit	There will be limited time for reaction and response planning before serious consequences of the risk hit	There will be time for reaction and response planning before the serious consequences of the risk hit