Dear Senior Leadership Team and Risk Owners:
Last year, in compliance with UNC Policy 1300.7, the System Office advanced the annual enterprise risk assessment process. During that process, we asked senior leadership and the risk owners to refresh the System Office Risk Register and to map identified risks to the refreshed strategic plan goals adopted by the Board of Governors at the Board's May 2022 meeting. This year as the new Director of Risk Management, I look forward to working with you during the annual enterprise risk assessment process. The Risk Review Board, comprised of Senior VPs and other advisory members, were briefed of the below 2023-2024 steps for collecting the annual data for the System Office's Risk Register:
1. ERM staff will send prior year risk register information to SVP, Directors, and risk owners for each section.
2. Staff will review risk registers to address the following:
* How have we addressed existing risks that have been reported? Should they still be included in the risk register or removed?
* What additional risks have arisen?
3. Risk Owners meet with ERM staff as well as Audit staff to discuss items on the risk register for classification of impact, probability and urgency. Any additional items will be discussed for inclusion in the risk register. Meetings will be conducted during the first two weeks of March and should last no longer than one hour.
4. ERM Staff will compile risk register data for each section and send to SVP for approval and finalization.
5. Finalized risk registers for each section will be sent back to ERM for compilation and analysis by ERM.
6. Once compiled and analyzed, ERM staff will submit data to the SO Risk Review Board for discussion and preliminary presentation preparation.
7. ERM staff will prepare a presentation of the formal risk register for the CARMC to be approved by the SO Risk Review Board.
8. Presentation of Risk Register to SO Risk Review Board for approval.
9. Approved Risk Register and presentation submitted and presented at September BOG-CARMC meeting.
I have attached a chart summarizing the 2022-2023 System Office approved Risk Register, an excel spreadsheet summarizing the timeline for collecting data for the risk register, a template for the 2023-2024 risk register collection and the UNC Strategic Plan Goals Summary.
Please send all responses to the soerm@northcarolina.edumailto:soerm@northcarolina.edu inbox. Should you have any questions, please feel free to contact me directly at bkheckle@northcarolina.edumailto:bkheckle@northcarolina.edu or office number 919-827-8507.
Thank you, Bryan
BRYAN HECKLE, CIC, CPCU, CRM Director of Enterprise Risk Management The University of North Carolina System 223 S. West Street Suite 1800 Raleigh, NC 27603 Office: 919-827-8507 Email: bkheckle@northcarolina.edumailto:bkheckle@northcarolina.edu
[cid:image002.jpg@01D93C62.A05EF6E0] www.northcarolina.eduhttps://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.northcarolina.edu%2F&data=05%7C01%7Cbkheckle%40northcarolina.edu%7C2b1b16d9633f42ccb40d08daede56c5e%7Cb693ed9d92e14e39b82e02f6fea6991e%7C0%7C0%7C638083866864550307%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=hOe6fF7sqqRCi74G0Sg%2FWrW2dUq2PERn5fTHHSSCO6c%3D&reserved=0
E-mails sent to or from this e-mail address that relate to public business are public records and may be subject to public access under the North Carolina public records law