Building a University Risk Register for Shared Governance

Universities make important decisions through a network of governing bodies, academic leaders, professional staff, student representatives, unions, committees, and external partners. Each group brings legitimate expertise, obligations, and concerns. A risk register gives those voices a structured way to identify uncertainty, test assumptions, and record how decisions will be managed.

For shared governance to work well, risk management must support deliberation rather than close it down. A register should not become a confidential list held by the finance office or an administrative hurdle added after a proposal has been designed. It should show what could affect teaching, research, students, staff, compliance, reputation, finances, and institutional strategy before a decision is finalised.

Australian universities operate within a distinctive environment. TEQSA expectations, state and territory funding arrangements, Commonwealth research requirements, privacy obligations, workplace law, and the needs of metropolitan and regional campuses all shape institutional risk. A practical register must reflect that setting while remaining simple enough for a committee to use during an ordinary meeting.

Governance approach	Strength	Common weakness	Useful register response
Central executive review	Fast escalation and clear accountability	May overlook local academic or student impacts	Require documented consultation and affected-party input
Committee-based review	Builds transparency and collective judgement	Can become slow or repetitive	Use defined thresholds and concise risk summaries
Decentralised faculty review	Captures operational knowledge close to the issue	Risk ratings may vary between areas	Apply common scoring criteria and moderation
Assurance-led review	Strong evidence, controls, and audit trail	Can focus on compliance over outcomes	Include educational, cultural, and community impacts
Participatory shared governance	Broad legitimacy and better implementation	Different priorities may be difficult to reconcile	Record dissent, trade-offs, owners, and review dates

Define The Register’s Governance Purpose

The first step is to state what the register is for. In a shared governance setting, it should connect risk identification with decision rights. A proposal might require approval from a faculty board, academic senate, finance committee, council, or a combination of these bodies. The register should make clear which risks belong to each forum and which issues require escalation.

This purpose statement should distinguish between an enterprise risk register and a decision-specific risk assessment. The enterprise document tracks persistent institutional exposures, such as cyber security, liquidity, workforce capability, or regulatory compliance. A decision register focuses on a particular proposal, such as merging courses, outsourcing accommodation services, opening a regional teaching site, or changing a research funding model.

Terms should be agreed before the register is used. “Risk” may mean the effect of uncertainty on objectives, while “issue” refers to a problem that has already occurred. A dependency, assumption, opportunity, and control should also have clear meanings. Plain language helps participants contribute, especially when a meeting includes academic staff, student leaders, community representatives, and professional services colleagues.

Map Risks Across The Decision Lifecycle

A strong register begins before a paper reaches a committee agenda. Project sponsors can run a short discovery workshop with people who understand the proposal from different angles. The group should consider the case for change, affected communities, data quality, implementation capacity, legal duties, financial sustainability, and the consequences of delaying action.

Useful prompts include: What could prevent the intended outcome? Who may experience harm or disadvantage? Which assumption is least certain? What would make the decision difficult to reverse? Which obligation applies to a university, a faculty, a research group, or an external provider? These prompts reveal risks that a traditional budget review may miss.

Australian context should be visible in the analysis. A campus in Townsville, Bendigo, or Hobart may face different workforce, transport, climate, and student-access conditions from a large campus in Sydney or Melbourne. Flooding, bushfires, heatwaves, housing pressure, and unreliable connectivity can affect continuity plans and capital projects. A “she’ll be right” attitude may be familiar in informal conversation, but it is not a substitute for evidence, ownership, and a tested response.

For complex proposals, scenario work can make abstract risks easier to discuss. A committee might examine a failed technology rollout, a delayed building project, or a public controversy involving student data. Carefully facilitated visual exercises, including scenario-based workshops, can help participants see how operational, ethical, and reputational consequences develop over time.

Build A Consistent Scoring Method

Risk scoring should support judgement rather than pretend to replace it. Most universities use a measure of likelihood and consequence, often expressed on a scale from one to five. Consequence categories may include financial loss, student outcomes, staff safety, research integrity, legal exposure, reputation, service continuity, and equity impacts.

The criteria need examples. A “major” financial consequence might be defined by a percentage of annual operating revenue, while a major student impact could involve widespread disruption to progression or accreditation. A low-probability event with severe consequences should remain visible even if its calculated score is moderate. The register should allow for control effectiveness and uncertainty, rather than reducing every concern to a single colour.

It is useful to record both the inherent risk and the residual risk. Inherent risk describes exposure before controls are applied. Residual risk reflects the position after current controls and planned actions are considered. If the residual rating is accepted, the accountable officer should document why the exposure is tolerable and identify the conditions that would trigger renewed review.

Calibration sessions improve consistency across faculties and divisions. Participants can rate sample scenarios separately, compare their reasoning, and agree on common interpretations. This is especially important where a university includes health, engineering, law, education, arts, and research-intensive units with very different operating profiles.

Assign Ownership And Evidence

Every material risk needs an accountable owner with authority to act. The owner is not necessarily the person who performs each control. For example, a deputy vice-chancellor may own the risk associated with a major partnership, while procurement, legal, information technology, and faculty teams operate specific controls.

Each entry should describe the cause, event, consequence, existing controls, treatment actions, due date, responsible officer, assurance source, and escalation threshold. Vague actions such as “monitor closely” provide little value. Better actions identify an approval gate, a data check, a training requirement, an independent review, or a contingency arrangement.

Financial risks require particular discipline. Delayed reimbursement, unclear cost allocation, and inconsistent evidence can affect cash flow and the credibility of a grant portfolio. A practical grant billing guide can inform control design where research offices and finance teams need shared milestones for invoicing, acquittals, and sponsor reporting.

Ownership should also account for Indigenous engagement, accessibility, privacy, and community impact. A decision can be financially controlled and still create unacceptable consequences for particular groups. Where Aboriginal and Torres Strait Islander communities, local partners, or culturally significant knowledge are affected, the register should identify the appropriate engagement process and evidence of respectful consultation.

Bring The Register Into Deliberation

The risk register should appear in the decision paper, not as an appendix that few people read. A concise summary can show the highest-rated exposures, unresolved disagreements, proposed treatments, and the decision points requiring committee judgement. Members should be able to see what management recommends, what evidence supports that position, and where uncertainty remains.

Shared governance depends on a genuine opportunity to influence the outcome. Consultation that occurs after the preferred option has been selected is likely to produce frustration and procedural resistance. Meeting papers should therefore allow sufficient time for review, particularly when proposals affect course closures, staffing models, campus services, research partnerships, or student fees.

The register should capture dissent without treating it as administrative failure. A committee may agree to proceed while recording that some members consider the consultation inadequate or the implementation timeline unrealistic. This record protects institutional memory and helps future reviewers understand how the decision was reached.

A decision log can sit alongside the register. It should record the resolution, conditions of approval, delegated authorities, matters reserved for further consideration, and the date for post-decision review. This makes governance more transparent and prevents risk treatments from disappearing once the meeting has ended.

Review Performance And Refresh The Register

Risk registers lose value when they become static spreadsheets. Review frequency should match the speed and volatility of the decision. A major construction project, international partnership, or student information system may need monthly review, while a stable policy risk could be considered quarterly or twice a year.

Performance indicators should test whether treatments are working. Useful measures include the age of overdue actions, control failures, complaints, audit findings, budget variance, project milestone slippage, data incidents, staff turnover, and student progression outcomes. Indicators should be interpreted rather than collected mechanically. A low number of reported incidents may indicate effective prevention, weak reporting, or limited awareness.

Assurance should come from more than the risk owner. Internal audit, academic quality teams, safety specialists, privacy officers, student representatives, and external reviewers can provide different perspectives. At an Australian university, consultation with state regulators, professional accreditation bodies, funding agencies, or local emergency services may also be relevant to particular risks.

At the end of a major decision cycle, the committee should review what actually happened. Were the original assumptions accurate? Did controls operate as described? Were affected groups heard? Did new risks emerge? Lessons should be transferred into policy, planning, budget decisions, and future registers so that governance improves through experience rather than repeated surprises.

A university risk register becomes valuable when it turns uncertainty into shared work: clear evidence, accountable action, visible trade-offs, and scheduled review. TASSCUBO members can strengthen this practice by comparing templates across institutions, testing scoring criteria with colleagues, and bringing real governance cases to professional development and peer networks. Use the next significant proposal as a pilot, document what the register changes, and make that evidence part of the decision itself.