Search CWU Policies

PDF Version

CWU 203-22: Enterprise Risk Management (INTERIM)

Effective: August 24, 2026

Policy Review Date: February 20, 2027

Policy Executive: Senior Vice President – Finance and Administration

Responsible Office/Unit: Office of Policy and Ethics

 

Policy Statement:

Central Washington University (CWU) has established an Enterprise Risk Management (ERM) program that provides a framework to proactively identify, assess, and manage risks that may affect the agency’s ability to achieve its mission, goals, and strategic objectives per the Governor’s Executive Order 16-06.
CWU will provide management support and commitment to safety and loss control, and develop awareness of ERM through education, training, and information sharing per RCW 43.19.760, the Governor’s Executive Order 16-06 and ISO 31000.

Applicability:

This policy applies to all CWU employees and organizational units.

Content:

          Policy
          Appendix A – Roles within ERM by position

(1) Policy

A. Central Washington University (CWU) proactively identifies, assesses, and responds to risks that may affect our ability to provide our core mission services and the achievement of our strategic and performance-based objectives and their intended outcomes. CWU uses a consistent, integrated, and transparent enterprise risk management (ERM) approach to support informed decision-making and resource allocation at both the strategic and operational levels.

B. CWU will provide training and apply ERM best practices to identify and manage internal and external risk to protect resources, employees, contract staff, and the public.

C. ERM best practices will be used as an integral part of considering risk in the decision-making process through identifying risks and opportunities across all agency/college divisions, facilities, programs, and areas of operation.

D. Once a risk has been identified and prioritized, CWU will develop, implement, and monitor risk treatment strategies.

(2) Roles and Responsibilities

A. President

  1. Leads, supports, and ensures commitment to implementing the ERM ISO 31000 Purpose, Principles, Framework and Risk Management Process.
  2. Establishes and communicates their risk appetite to the Leadership Team.
  3. Makes a commitment to adopting and integrating ERM into the organizational culture.
  4. Ensures appropriate allocation of resources to support risk management activities.

B. Leadership Team (President & Divisional Vice Presidents)

  1. The leadership team provides management support and commitment to ERM.
  2. The leadership team will:
    a. Support an enterprise-wide commitment to risk management across the entire organization, from front line employees to management and from management to employees.
    b. Develop the organization’s risk tolerance and then communicate this document to all employees to support efficient and effective risk mitigation across the enterprise.
    c. Participate in risk identification and risk prioritization sessions semi-annually.
    i. Risks will be prioritized at an enterprise-wide level by analyzing the likelihood and impact of each risk.
    ii. Identify emerging risks and any significant changes to current risks.
    iii. Ensure the reallocation of resources for managing risks.
    d. Create a communication channel for risk owners of the highest scored risks to report on their risks quarterly to the leadership team.
    e. Include risk consideration as an integral part of the organization’s decision-making process.
    f. Support education, training and information sharing on ERM policies and procedures to promote enterprise-wide awareness.

C. Risk Executives

  1. For risks that fall within their purview, risk executives will work with risk owners to:
    a. Review, approve and support the implementation of risk mitigation strategies.
    b. Review mitigation strategy effectiveness for risks.
    c. Ensure the reallocation resources for managing risks.
    d. Create a communication channel for risk owners to report on their risks regularly.
  2. Participate in risk identification and risk prioritization sessions semi-annually.
    a. Risks will be prioritized at an enterprise-wide level by analyzing the likelihood and impact of each risk.
    b. Identify emerging risks and any significant changes to current risks.
    c. Ensure the reallocation of resources for managing risks.

D. Risk Coordinator

  1. The Risk Coordinator manages and facilitates the enterprise-wide effort necessary to identify, evaluate, mitigate, and monitor the agency’s strategic/operational, legal/compliance, financial, reputational, health/safety and employment risks.
  2. The Risk Coordinator will:
    a. Develop ERM tools, practices, and processes to identify, analyze and report enterprise-wide, strategic risks according to this policy and the ISO 31000 ERM framework.
    b. The Risk Coordinator will, by using the Origami ERM module, monitor and facilitate the management of risks by:
    i. Ensuring the completion of quarterly updates of the highest scored risks.
    ii. Ensuring the completion of the semi-annual updates of identified risks.
    iii. Ensuring the completion of the semi-annual prioritization of identified risks.
    iv. Attesting to compliance with the Governor’s Executive Order 16-06 annually.
    v. Managing the risk register in the Origami ERM Module.
    c. Support employee awareness and understanding of ERM through education, training, and information sharing.
    d. Coordinate reporting on risk treatment activities by risk owners to the leadership team as required.
    e. Report quarterly to the Leadership Team on the management of risks, loss history, and emerging risks.
    f. Annually review and recommend revisions to this policy.

E. Risk Owner

  1. Appointed by a Risk Executive to manage a particular risk.
  2. Develops and implements mitigation plans and controls for assigned risks.
  3. Monitors assigned risks to ensure the mitigation strategies are controlling the risks.
  4. For risk owners with the highest scored risks:
    a. Updates risks quarterly using the Origami ERM module as assigned by the Risk Coordinator.
    b. Reports the status of assigned risks – controls, gap analysis, mitigation progress and risk metrics - to the leadership team quarterly.
  5. For all other risks owners:
    a. Updates risks semi-annually using the Origami ERM module as assigned by the Risk Coordinator.
    b. Reports the status of assigned risks – controls, gap analysis, mitigation progress and risk metrics - to the risk executive and/or leadership team as needed.

F. Supervisors

  1. Supervisors apply ERM in all aspects of operations and actions.
  2. Supervisors will:
    a. Set the standards and expectations of staff with respect to addressing risks.
    b. Ensure internal control processes are implemented, maintained, and monitored to manage risk.
    c. Support ERM training for all employees.

G. All Employees

  1. All employees are responsible for understanding and supporting the agency’s efforts to identify, eliminate or manage risk.
  2. Employees will identify and communicate risks to their supervisor or the Risk Coordinator.

(3) Method, Timeline and Scoring Criteria for Identifying and Prioritizing Risks

A. Risk identification will occur in a brainstorming session with the executive team/leadership team. After the initial session, new risks will be identified in a brainstorming session semi-annually, prior to the semi-annual risk prioritization session.

B. Risk Prioritization will occur after risks have been identified. The Origami ERM module ERM Plan will be used to prioritize (score) the identified risks.

1. Risks are scored by determining the likelihood of each risk occurring within the next two years, and by determining the impact of the risk if it did occur.

a. Likelihood and Impact are scored as shown below:


b. All leaders score ALL risks. The likelihood scores are averaged, and the impact scores are averaged; then the average likelihood score is multiplied by the average impact score, resulting in a final risk rating and risk score between 1-25. 

           
c. The rating scale for risk scores is shown in the table below: 

            

(4) Definitions

A. Enterprise risk management is the process of planning, organizing, leading, and controlling the activities of an organization in order to minimize the effects of risk. ISO 31000 is the international standard for the practice of risk management. It is an enterprise-wide approach that proactively identifies, assesses, and prioritizes strategic risks, followed by the allocation of resources to minimize, monitor, and control the likelihood and impact of risks occurring, or to maximize opportunities.

B. Origami ERM Module is a list of identified risks, the risk rating and score of each risk, the current controls, treatment plan, risk metrics and who is accountable for managing the risk. This module, owned and maintained by the Department of Enterprise Services, allows risk coordinators a software solution to streamlining all ERM processes.

C. Risk Executive is tasked with oversight of an identified risk. This normally means that the risk resides in a division/program that the risk executive is responsible for.

D. Risk Coordinator manages and facilitates the enterprise-wide effort necessary to identify, evaluate, mitigate, and monitor the agency’s strategic/operational, legal/compliance, financial, reputational, health/safety and employment risks.

E. Risk identification means the process of identifying risks that might enable or impede the agency’s ability to provide its core mission services or meet its strategic objectives, i.e., brainstorming session.

F. Risk owner means the person with the authority and accountability for managing a particular risk.

G. Risk prioritization is the process of evaluating identified risks to determine the likelihood and impact of each risk, resulting in a risk score and rating.

History:

8/24/2026 Interim policy approved by A. James Wohlpart, President

Appendix A – Roles within ERM by position

 

(1) Leadership Team

A. President
B. Provost and Executive Vice President for Academic Affairs
C. Senior Vice President for Finance and Administration
D. Vice President for Student Engagement & Success

(2) Risk Executives

A. President
B. Provost and Executive Vice President for Academic Affairs
C. Senior Vice President for Finance and Administration
D. Vice President for Student Engagement & Success
E. Vice President of University Advancement
F. Vice Provost for Institutional Transformation / Associate Vice President for Information Services
G. Associate Vice President of Marketing and Communications
H. Director of Athletics
I. Director of Civil Rights Compliance & Title IX

(3) Risk Coordinator

A. Director of Policy and Ethics