For anyone intrinsically involved in higher education Happy New Year! As the new academic year begins it is a good time to take the temperature of universities across the UK.
There have been plenty of concerns around the sector but a report from Universities UK and London Economics: The economic impact of higher education, teaching, research and innovation, underlines the significant impact HEIs have on national and local economies and communities.
In summary, the Report highlights:
- Universities support more than three quarters of a million jobs (768,000), of which nearly half (382,500), are indirect, employed by local businesses such as restaurants and retailers who benefit from the economic stimulus universities create.
- Higher education makes a £130 billion contribution to the UK economy.
- There is a huge economic benefit to a variety of sectors across the UK, including government, health and education. This has an economic output of £52.8 billion and supports 444,244 jobs.
This research contextualises the important contribution HEIs make beyond the campus community. But with stakes high if an institution fails in any way, there is concern and conjecture around the sustainability and resilience of HEIs.
Resilience can be defined as ‘the capacity to recover from difficulties’ and resilience should be an important focus for the insurance and risk management professionals, within institutions and those advising and supporting them.
Respond
Recent examples of significant incidents across the sector have been well-documented. These include major fires, cyber attacks and data breaches, group legal actions, industrial action and student protests, as well as issues arising from the pandemic.
Looking ahead, resilience issues may arise from financial provision, loss of international students, legacy physical infrastructure and changes to regulatory oversight.
These examples show that an organisation must be able to respond effectively and recover as quickly as possible, at the most difficult of times. They also highlight how the best responses involve cross-institution collaboration.
For example, a data breach involves the data protection officer, HR, IT, legal and student liaison. Externally, support is required from data breach response providers, insurers, solicitors and PR & media departments.
Recover
Defining resilience as the capacity to recover, bringing together contributors from many departments across an HEI is essential. This can include: business continuity, estates and facilities, finance, insurance, IT and data management, Health and Safety, Communications, legal and regulatory & compliance.
Many institutions now have a risk and resilience department. This is a positive move to concentrate and focus on an institution’s understanding of their exposures and response plans and initiatives.
Having an understanding of an institution’s resilience requires work on data gathering, assessing and testing in relation to:
- Existing and projected staff and student numbers
- The extent and particulars of an institution’s estate and buildings
- Income and revenue sources
- Major incident, business continuity and disaster recovery plans
- Insurance programme coverage and response triggers, including specifically business interruption and cyber liability cover
- Regulatory obligations and compliance.
Gathering and assessing this data and formulating it into a single report aides debate, analysis and decision-making.
It also enables discussion around the existence and efficacy of existing plans and processes that address how an organisation recovers from a risk event, irrespective of how it arises and where it emanates from.
It is also important to discuss and agree the length of time of a recovery for each event, what interim plans look like to deliver core activities, and when business as usual can be reinstated. This is a nuanced topic as institutions may feel their ability to recover and reinstate teaching provision has improved post-pandemic. Online teaching may be viewed as BAU, but there may be limitations imposed by the regulator.
Equally, it is recognised that in recent years supply chains have lengthened and the likelihood of local stakeholders intervening in future planning, especially around heritage builds, could extend recovery times significantly.
An ability to provide evidence of resilience and how an institution recovers from a significant incident is now considered an absolute requirement for an institution’s internal and external stakeholders. These typically include senior executive board, trustees, external auditors, insurers and the sector regulator.
Oversight from the regulator has already been witnessed on student protection plans. Each higher education provider registered with the Office for Students must have a student protection plan.
Student protection plans set out what students can expect to happen should a course, campus, or institution close. The purpose of a plan is to ensure that students can continue and complete their studies, or can be compensated if this is not possible.
There is an expectation that student protection plans are reviewed and refreshed regularly. They should link intrinsically into existing or any future updated contingency or recovery plans.
There have been recent examples of course failures, and with tighter budgets and fewer students, the non-renewal of some courses. The regulator will take a closer look at such moves and be keen to understand how institutions are supporting students while maintaining academic rigour and fulfilling their own charters and strategic objectives.
A formal risk and resilience project helps an institution address all these topics, and bring together the voices and inputs of different individuals, divisions and teams.
Risk and resilience plans evidence a commitment to appropriate response and recovery, and consolidate and identify what an HEI needs to address.