/Institutions/University-of-Dubai/json/2024-2025/Policy-and-Procedure-Manual-local.json

/Institutions/University-of-Dubai/json/2024-2025/Policy-and-Procedure-Manual.json

Policy and Procedure Manual 2024-25 > Mission Organization and Governance > Risk Management Policy

Risk Management Policy

The objectives of the Risk Management Policy are to:  

1. Establish a comprehensive risk management framework for all University activities.

2. Ensure that management decisions take into account relevant risks.

3. Integrate operational risk processes into the management of University programs.

4. Cultivate an environment and culture of risk accountability, where faculty and staff take responsibility for governing risk management.

 

1. The University will demonstrate a commitment toward implementing its risk management to protect and preserve its financial, physical and human assets. 

 

2. The University RMC has been established as a committee to provide advice and counsel to the UD Senior Management pertaining to risks related management issues. 

 

3. The University will allocate appropriate levels of responsibility to specific personnel to oversee related insurance coverage or allocated financial resources in the implementation of its operational risk to ensure an adequate mitigation plan. 

 

4. The risk management plan, delegation of responsibilities to RMC members, and risk mitigation strategies will undergo approval by the President on an annual basis, with additional reviews as necessary.

 

5. To ensure the successful execution of the risk management strategy, the University will provide comprehensive training in risk management principles, methodologies, and processes to all staff involved in institutional governance. This includes the VPAA, Deans, Directors, Managers, and all UD employees.

 

6. The University integrates risk management principles and practices seamlessly into both strategy development and day-to-day operational processes. The risk management process is systematically applied in the following key activities:

• Annual strategic planning.
  
  
• Launching new projects/initiatives.
  
  
• Change management processes.
  
  
• Incident management procedures.
  
  
• RMC (Risk Management Committee) meetings.

 

The University's risk management process follows a systematic approach, involving the assessment, treatment, monitoring, review, recording, and reporting of risks across all departments. The University's Risk Management Plan details the following five iterative and cyclical steps:

 

• Step 1 – Establish the context 

• Step 2 – Identification of risks 

• Step 3 – Analyze the risks 

• Step 4 – Evaluating the risks 

• Step 5 – Treating the risks

 This process is illustrated in Figure 1 below:

Figure 1: Risk Management Process

A. The results of these steps are documented and reported as part of the monitoring and review activities, as detailed in Section 3.

B. Risk appetite:  The University recognizes that its risk appetite is continually changing as it responds to internal and external changes. At any one time, the University may be willing to accept additional risk in one area while reducing in another. As part of the annual UD risk review, the risk appetite will be assessed against current strategic and operational needs & formalized within the Annual Risk Management Plan.

C. Risk Dimension: The assessment of all identified risks is based on the appraisal of five risk dimensions which have been determined to effectively align with the CAA Standards for Institutional licensure (SIL) and the Standards for Program Accreditation (SPA). These risk dimensions are:

• President 

• Internal Audit Team Members 

• Risk Management Committee

• QAIE Department

• Risk Management Executive 

• Deans/Department Managers/Risk Champions

• Risk Owners 

C. Recording and Reporting 

The University reporting relating to risks and their management utilizes a hierarchical risk reporting structure, represented in the figure below.

As outlined in Appendix III, the University has established specific documents for the recording and reporting of risks. These documents encompass:

• Risk assessment worksheet (Appendix IV)

• Risk Register (Appendix V)

• Master Risk register 

• Annual Risk assessment report

The Risk Management Committee is responsible for maintaining a comprehensive master risk register for UD, which meticulously documents all identified risks along with the corresponding mitigation strategies. This register serves as a consolidated compilation of individual departmental risk registers, accessible for senior management. Additionally, the committee will deliver an annual risk report to senior management, facilitating a thorough review and soliciting valuable feedback.

D. Monitoring and Review

The University shall maintain a system of continuous monitoring of identified risks to assess their changing nature and significance.

Risk owners and designated responsible parties shall conduct periodic reviews of risk indicators and events to ensure that the risks remain controlled and that mitigation strategies are effective.

The University will regularly conduct scheduled reviews of the risk management implementation activities and keep the Risk Management Implementation Action Plan (Appendix II) updated with progress.

 

8. Related Documents

8.1 University Documents

1. Risk management committee terms of reference

2. Risk Management Plan

8.2 Reference Documents

1. ISO 31000: 2018 Risk Management Guidelines

2. OSHAD-SF Technical Guideline- Process of Risk Management

3. IEC 31010, Risk management — Risk assessment techniques

4. ISO 31073:2022(en) Risk management — Vocabulary 

5. PD ISO/TR 31004:2013: Risk management — Guidance for the implementation of ISO 31000

Appendices

Appendix I: Risk Management Responsibilities

Appendix II: Risk Management Implementation Action Plan Template 

Appendix III: Risk Management Records 

Appendix IV: Risk Assessment Worksheet

Appendix V: Risk Register