Many schools spend an inordinate amount of time developing strategic plans that are printed onto glossy paper and used almost solely to promote the school and its vision to its students, parents and, most importantly, prospective parents. But are these glossy plans based on a school’s strategic risks, or are they marketing statements or, even worse, just glib rhetoric?

However, schools know that strategic planning is an absolute essential if they want to prepare for future growth and manage current and emerging risks. It is also essential if a school is genuine about meeting its mission and attaining its vision. But many schools will still develop a plan before they identify and link the plan to their strategic risks. Basically, they place the cart before the horse.

Earlier this year, School Governance wrote in Five Critical Risks (and Opportunities) that Schools Should Be Engaged with in 2022:

“As school governing bodies and school leaders continue to deliver on their 2022 plans and start to spend time planning for 2023, there are simple, practical steps that they can take which will help turn these risks into opportunities:

• openly discuss and explore risks - both current and emerging
• allocate sufficient time at governing body meetings for the discussion of risks and strategy
• amend your current strategic risk registers and strategic plan to ensure that new or emerging risks will be sufficiently mitigated against (emphasis added)
• regularly assess the likelihood and impact of these risks and conduct/attend workshop mitigation strategies.”

Understanding and Identifying Strategic Risk

For a useful and easy-to-read guide to strategic risks and the difference between strategic and operational risks, see this Ideagen blog article where they note that strategic risk:

“refers to the events or decisions that could potentially stop an organisation from achieving its goals. It also refers to the danger of an organisation’s strategic choices being incorrect, or not responding effectively to changing environments”.

Strategic risks can be written like this:

• Failure to effectively implement and monitor and report on implementation of the strategic plan
• Failure to identify strategic risks and effectively implement controls to manage these risks.

On the other hand, operational risks are risks that are associated with business operations and the risks will vary depending on the nature and scope of operations (the organisation’s ‘operational profile’). They also arise from the compliance obligations that are associated with operations – again based on the operational profile. For example schools with boarding houses have additional compliance risks associated with that aspect of their operations.

Schools that understand risk and risk management (enterprise risk management) use a range of techniques to identify their risks including:

• analysing their Strengths, Weaknesses, Opportunities and Threats through SWOT analyses
• identifying and analysing risk indicators such as complaints received/incidents
• analysing loss events such as insurance claims records and unfair dismissal applications
• considering potential uncertainties, such as ongoing government per capita grants, that may prevent a school from fulfilling its mission
• undertaking a review of historical performance (where have things gone wrong in the past)
• more general processes such as feedback loops and brainstorming sessions.

However, one common mistake in risk identification is to use only one or two identification techniques. This can lead to a failure to identify all the key risks. For example, a brainstorming exercise tends to lead to a risk list that reflects the concerns at the time that the exercise was conducted or of the particular group involved.

In addition, while many organisations use risk management as an effective tool for controlling specific operational risks, for example, child protection risk, only a few are making the link between this activity and the positive impact effective enterprise risk management can have on the achievement of their strategic objectives. It is not difficult to understand this link if a school considers how their strategic objectives could easily be ‘derailed’ by significant and ongoing failures to manage key operational risks within their organisation.

The Role of the Governing Body

If a governing body is governing effectively, then a substantial portion of their time will be spent on strategic planning and strategic issues such as developing, reviewing, communicating and monitoring the implementation of their strategic goals and strategic risks including:

• monitoring the performance of the principal and the governing body
• having a strategic plan and monitoring the implementation of the plan
• understanding their school’s educational service and being aware of the latest educational research to leverage the opportunities that they present
• monitoring and articulating the school culture and ethos.

These issues have not been missed by the regulators. They are looking closely at the accountability of school governing bodies in relation to these specific issues and others. These are not matters that any school governing body should leave to chance.

Putting the Cart Behind the Horse

It is crucial before commencing a strategic planning process that schools identify and focus specifically on their strategic risks first. The identified strategic risks should inform the strategic plan and enable schools to set pillars or goals that are achievable and measurable.

However, if a school uses their current ‘glossy’ strategic plan to determine their future strategic risks, they are, in essence, putting the cart before the horse.

It is essential to use strategic risk to determine a school’s future strategic intentions or goals. Strategic risks require a capability to foresee and play out scenarios that may be many years ahead. This may be necessitated by the need to plan and prepare years in advance. These may be risks with no, or poor, tactical solutions, therefore it’s necessary to take a strategic (holistic, integrated and long-term) view of solutions.

Enterprise Risk Management as a Solution

Schools that embrace enterprise risk management (ERM) and effectively implement an integrated ERM Program, can expect to experience some (if not all) of the following benefits:

• a significant increase in the likelihood of achieving strategic goals and objectives
• avoidance of ‘fire-fighting’ as reactive management gives way to proactive decision-making
• enhanced ability to identify and manage future threats and opportunities
• enhanced ability to comply with legal and regulatory obligations
• avoidance of adverse risk events, or at least minimisation of the impact if these events are to occur
• establishment of a reliable basis for decision-making and planning as key non-financial information becomes readily accessible by management and board members alike
• improvement of operational effectiveness, business processes and controls
• the ability to allocate internal resources more effectively
• minimisation of business complexity and optimisation of transparency
• enhanced reputation management
• increased shareholder/stakeholder value.

Using ERM to support the achievement of strategic objectives requires organisations to ensure that specific risks (strategic) that could prevent achieving strategic objectives (or goals or pillars) are identified at the time that the strategic plan is being developed.

Risk identification and risk management are important both in the formulation of a strategic plan as well as being important after the plan has been formulated. Most strategic planning processes should start by asking: “What are the strategic risks that we face?”. The strategic plan can then be developed to address some or all of these risks. Risk management is also important after the plan has been formulated as any strategic plan will create risks associated with the adoption of a particular strategy and these risks must be identified and managed. There are also two very significant strategic risks that go with all strategic plans, and that is, firstly, the risk that the organisation has adopted the wrong strategy and, secondly, the risk that the organisation fails to effectively implement the strategy. So risk identification and risk management are at the beginning of the strategic planning process and at the end of the process.