UW Risk Assessment

1. UW Risk Assessment Overview of Risk Assessment

2. UW Risk Assessment Overview of Risk Assessment Process Gather Information on Risk Universe Identify High Level Risk Categories Interview Key Stakeholders Review Peer Institution Risk Assessments Gather Financial Information Identify auditable Units Identify Key Processes Rank Auditable Units Select Audit Projects

3. UW Risk Assessment Gather Info on Risk Universe • Review UW ERM PRocess • University documents related to ERM • Prior Year Risk Assessments • Review Risk Assessments • Evaluate what worked, what could be improved • Review Organization Structure

4. UW Risk Assessment Identify High Level Risk Categories • Strategic • Impairment to the Strategic Mission of the University • Operational • Impairment of day-to-day operations of the University • Compliance • Failure to comply with laws, regulations and internal policies • Financial • Loss of financial resources or assets • Reputational • Risk that public image or reputation is damaged by actions of a unit or individual

5. UW Risk Assessment Interview Process • First year – over 75 interviews • Deans, Vice Provosts, Vice Presidents, Administrators, Medical Center CFO’s • Second Year – 30 plus interviews • Deans, Vice Provosts, Vice Presidents, Administrators,

6. UW Risk Assessment Interview Key Stakeholders • Board of Regents • Interviewed Chair and Vice Chair of BoR • President / Provost / Dean SOM • Near end of process to provide interviewee with information gathered to date

7. UW Risk Assessment Review Peer Institution Risk Assessments • Obtained copies from other institutions • OUS • Ohio State • Minnesota • Reviewed for Unique Higher Ed Risks • Higher Ed • Medical Centers • Grant • ICA

8. UW Risk Assessment Gather Financial Information • Obtained Financial Budget information for all Units • Obtained financial Information for both Medical Centers • Grouped budgetary information into Auditable Units

9. UW Risk Assessment Identify Key Processes • IA Management Team reviewed processes around campus and the medical centers • Attempted to capture the larger more common processes across each operating unit • i.e. Payroll, HR, Inventory, Budgeting • Identified unique processes • To identify specific areas of concern • Units which had not been audited in the past • Specific requests by management for audit • New and developing areas of operation • Large projects

10. UW Risk Assessment Rank Auditable Units by Risk Categories • Reputational Risk to the Institution, • Strategic Impact, • Financial Significance, • Management’s Interest/Concerns, • Significant Processes, • Compliance Requirements, • Information Systems Complexity, • Control Environment Stability, • Prior Audit Coverage & Prior Year Issues, and • International / Global operations.

11. UW Risk Assessment Review of Highest Ranked Units • Revisited Interviews: • To identify specific areas of concern • Units which had not been audited in the past • Specific requests by management for audit • New and developing areas of operation • Large projects

12. UW Risk Assessment IA Management Selected Units • Selected Units form the “Auditable Units” • Selected projects based on input from all of the above