

Material risks and opportunities impacting value
Overview: our risk governance and management processes
With the additional risks and opportunities associated with the Covid-19 pandemic, we had to apply our minds to explore these, expand our way of thinking to mitigate the risks and harness the opportunities, and evolve to be able to navigate the "new normal".
Our strategic approach to risk and opportunity management entails identifying and prioritising risks and opportunities that could influence our ability to implement the university's strategy, and adopting appropriate risk mitigation strategies and initiatives.
In doing so, we take into account the demands of and uncertainties in the external environment and align our risk management processes with the King IV guiding principles. This approach ensures streamlined processes and procedures in accordance with the prescripts of the King IV code.
Risk
Uncertainties in the higher education sector, largely related to uncertainties about financial matters and the funding model for universities
Risk
The demand for organisational change and ongoing transformation
Risk
Risks related to academic matters (teaching and learning, research and innovation and academic administration)
Risk
Ensuring compliance
Risk
Risks related to student life, both in the academic andnon-academic environments
Risk
IT risks (including cyber security) and university systems
Risk
Commercialisation
Risk
Operational risksHow we prioritise our risks and opportunities
The NWU's strategic goals are the point of reference for prioritising, defining and assessing our risks. We use a template for risk identification and risk definition, coupled with a comprehensive process of implementing internal controls and action plans to address the causes of risk and manage the risks to an acceptable level. All risks above appetite are prioritised and highlighted for reporting purposes.
Certain risks tend to be interrelated and can often be grouped into clusters. For the past few years, we have been using a risk-cluster categorisation approach to identify the material risk clusters that are important for the university's strategy, governance and management, performance and future planning.
These clusters are listed in the following table where we describe the risks related to each cluster and give a short summary of the associated mitigation strategies. (For more information, refer to our risk register.)
Related material matter: Ensure financial sustainability. (Annual Performance Plan [APP], Enabler 4) ![]()
Risks that may put our financial stability under pressure were additional expenses and reduced income levels brought about by the Covid-19 pandemic, uncertainties around the proposed fee regulation model, reservations about the sustainability of government’s funding model, an overdependence on a dominant source of income (government subsidies and NSFAS) and student debt.
Capital affected:![]()
Mitigation measures included the acceptance of a financial impact model containing all the mitigation plans included by Council. The mitigation strategies include fundraising and endowment initiatives to ensure new sustainable sources of income, building available reserves to cover one year of operational expenses, building optimal relationships with funders and facilitating start-up capital by the Technology Transfer and Innovation Support office.
Related material matter: Govern, lead and manage in a sustainable and transformed way with
an effective operating model (APP, Enabler 1) 
Risks in this cluster included insufficient level of diversity in staff and student environments, escalation in sexual and gender-based violence, poor implementation of the unitary business model, uncertainties around the language plan implementation, and difficulty in recruiting and retaining talented staff.
Capitals affected:
Mitigation measures included a well-defined student recruitment and admission process; a scarce-skill allowance; building employment equity targets into the performance agreements of management members; retention strategies; clear position profiles for senior management; diversity targets; an Employment Equity Policy, and language plans for faculties and support departments.
Related material matters: Intensify research and innovation (APP, Goal 2) and
promote excellent learning and teaching, and reposition the NWU to attain the size
and shape required by market direction decisions. (APP, Goal 1) 
In this cluster, we focused on risks such as a decline in research funding and research, poor financial support to postgraduate students, loss of opportunity income, subsidy and loss of return, limited infrastructure planning for teaching and an insufficient global engagement/internationalisation effort.
Other risks were an apparent lack of preparedness for a blended learning environment, uncompetitive salaries, slow external processes for approval of qualifications/programmes, over and under enrolment, and the perceived inability to meet marketplace expectations if graduates do not find employment quickly enough.
Further risks were declines in student throughput and student success, and the possibility that undergraduate and postgraduate academic offerings and related services may not be sufficiently responsive, price appropriate and of the required quality and standard.
Capitals affected: 
Mitigation strategies at play here included a budgetary process to focus on sustaining research, merit bonuses for qualifying postgraduate students who received NSFAS funding during undergraduate studies, strategic funds for postgraduate bursaries and an internationalisation policy, as well as a wellorganised process for cooperation agreements.
With regard to infrastructure, mitigating steps included the Strategic Intelligence committee aiming to redesign the system to ensure effective use of infrastructure; provision for infrastructure planning as part of our budgeting planning, and the establishment of a space management project.
Further actions included an induction programme on blended teaching and the implementation of a blended model aimed at enhancing student access and success.
Measures to improve student success were admission and placement tests to guide admission into second or third choice qualifications, measuring tools to track student success, faculty plans to enhance throughput, and support interventions such as supplemental instruction, group and individual tutorials, student advisors and student support walkin services.
More detail about our mitigation actions is included in our risks register.
Related material matter: Govern, lead and manage in a sustainable and
transformed way with an effective operating model. (APP, Enabler 1) 
Risks receiving attention in this cluster were inadequacies in environmental management and information governance, disaster recovery and business continuity, fraud prevention, the inconsistent application of the Policy on Academic Integrity, and a lack of compliance with health and safety laws and regulations, other statutory requirements, licences and other legal requirements.
Capitals affected:
Mitigation measures included business continuity planning and contingency planning for key processes such as registration, as well as the implementation of the Digital Business Strategy.
Other measures were an audit plan on environmental management, and continual occupational health and safety training, monitoring and awareness campaigns. The 2020 internal audit plan addressed risks around academic integrity. We also have a policy and rules on academic integrity.
Related material matter: Develop a clearly differentiated student value proposition
(APP, Goal 4) 
Promote excellent learning and teaching and reposition the NWU to attain the size
and shape required by market direction decisions.(APP, Goal 1) ![]()
In this cluster, the risks were student safety on and off-campus, the possible negative effect of “standardising” student life across campuses and the management of student life in a new structure.
Other risks include inadequate measures to create a welcoming student environment, inadequacies in student leadership skills, and the possibility of student unrest.
Capitals affected:
Mitigation strategies included various security projects across all campuses, awareness and training programmes on LGBTQ+ and other human rights issues, student leadership training, and emergency contingency plans for student unrest.
Related material matter: Develop best-in-class information and communications
technology to support the core business. (APP, Enabler 2) 
Related material matter: Govern, lead and manage in a sustainable and
transformed way. (APP, Enabler 1) 
In this cluster, a risk receiving attention was the fact that cyber security is not addressed adequately, a risk that may increase with our digital transformation.
Other risks included IT provisioning for certain administrative and academic functions not being optimal, and uncertainties around the digital business strategy which could lead to delays in new system design and implementation.
In addition, a possible inadequate disaster recovery plan within IT could halt our operations.
Capitals affected:
Mitigation measures included the implementation of a cyber-incident and execution management system, development of a cybersecurity strategy and using the best-in-class firewall solution.
Other steps taken were the audit plan executed
annually by Internal Audit, and institution-wide
network access control and penetration testing.
Furthermore, we have an enterprise-wide digital
business strategy as part of our strategic positioning.
Related material matter: Promote excellent learning and teaching, and reposition the NWU to
attain the size and shape required by market direction decisions. (APP, Goal 1) 
Promote excellent learning and teaching and reposition the NWU to attain the size and shape required by market direction decisions.(APP, Goal 1)
The commercialisation environment looked into the failure of licensees or spin-out ventures to commercialise, along with commercialisation risks such as the offering of non-compliant service level providers, income not coming to the NWU, and missing out on commercialisation opportunities.
Capitals affected:
Mitigation measures included making provision for an effective financial and operating model and a management structure for continuing education, increasing commercialisation opportunities and finalising the establishment of the Unit for Continuing Education, as well as the policy on continuing education. Commercialisation focused on undertaking due diligence and creating standardised licensing agreements.
Related material matters: Govern, lead and manage in a sustainable and
transformed way. (APP, Enabler 1) 
Ensuring the financial sustainability of the NWU. (APP, Enabler 4) 
Operational risks included the academic project facing challenges around ineffectiveness and inefficiencies of support functions, possibly leading to loss of income and potential growth, loss of staff and negative impact on the reputation and ranking of the NWU.
Other risks were absenteeism and loss of valuable staff owing to low staff morale.
Capitals affected:
Mitigation measures included a project to optimise space management and receipt of a substantial grant from the DHET to optimise our infrastructure development.
We are also to further strengthen our integrated planning for academic infrastructure.
Risks and Covid-19
The following risks with regard to the Covid-19 pandemic's financial and related impacts received high priority and were included and described in our risk register as follows:
- The large number of additional expenses, as well as reduced income levels, brought about by complying with the lockdown and the accompanying regulations.
- Increases in outstanding debt due to parents not being able to pay/refusing to pay since the NWU was not conducting business as usual.
- The risk impact was categorised as severe and the likelihood as certain, resulting in an inherent risk rating of 25 and a financial impact of R161 338 000. After considering the control established (the financial impact model with the mitigation plans approved by Council) which was rated as adequate, the residual risk rating came down to 13, which is still above the risk appetite of the NWU.
Using our opportunities
As part of the risk-cluster approach, we continually identify opportunities to adapt to our changing environment, explore new pathways and evolve to become more.
The opportunities we consider vital are those that:
- continually safeguard the financial sustainability of the university
- enable us to implement our new strategy, structure and operating model
- promote excellence in teaching and learning and research and innovation
- establish a clearly differentiated student value proposition
- develop and retain excellent staff and create an equitable staff and student profile
- enable the deployment of best-in-class information technology to support the core business
- provide an effective financial model, policies and structure for continuing education offerings and increased commercialisation opportunities.
Steps taken in 2020
The focus of the ongoing refinement of risk management was on strengthening the internal control environment, for instance through the continual review of policies and the current drive towards the governance and management of ethics.
The emphasis on an improved description of internal controls assisted in the mitigation of risks, both in the understanding of the risk and in the pursuit of managing the relevant risks to acceptable levels.
The continued implementation and improvement of the electronic risk management approach contributed to more systematic risk management. The focus allowing risk owners to link risks to the operations and quality enhancement within a particular business process provided an opportunity for the integration of controls.
Clear conventions have been established for the use of information sources for ongoing risk management purposes. These sources include existing data source owners (finances, strategic intelligence, people and culture) and information shared at governance levels and in the annual integrated report. Risk management was rolled out to faculty level and a number of support departments by sharing developments related to internal controls and how these controls secure the sustainability of the NWU.
Improved monitoring was introduced in 2020.This entails conducting various internal and external evaluations to monitor risk management and internal controls implemented for mitigation purposes.
The following graph indicates the status of residual risks for 2020 of the NWU strategic risk register, after the consultation phase with risk owners.
Residual heat map report
| 21 #0 |
22 #0 |
23 #0 |
24 #0 |
25 #0 |
| 16 #1 |
17 #0 |
18 #0 |
19 #0 |
20 #0 |
| 11 #0 |
12 #1 |
13 #3 |
14 #1 |
15 #0 |
| 6 #9 |
7 #5 |
8 #2 |
9 #0 |
10 #1 |
| 1 #1 |
2 #7 |
3 #6 |
4 #8 |
5 #0 |
Key to risk indicators
| Risk Indicator Key | ||
| Name | Number of risks | Description |
| High | 1 | The risk is potentially disastrous and will hinder the achievement of objectives and/or lead to the collapse of business and/or project |
| Medium | 5 | The risk could have serious impact on operations. A risk that can be managed with some additional resources, budget and maintenance effort. |
| Low | 17 | A risk that is unlikely to occur, but if it does occur it can be managed under normal operating conditions |
| Minor | 22 | A risk event that holds no significant threat to the organisation, employees or stakeholders |
Top 10 residual risks
| Rank | Risk | Description of risk |
Residual risk |
| 1 | Cyber security | Cyber security is not adequately addressed at the NWU and is the number one IT issue worldwide. An attack on the NWU is likely and digital transformation will increase the risk. |
16.00 |
| 2 | Digital Business Strategy | Digital transformation will have a severe impact on operational models, structures, people, processes and roles. |
16.00 |
| 3 | Environmental management | The lack of focus in this regard poses a risk to sustainability and compliance. |
13.50 |
| 4 | Information governance, business continuity programme and disaster recovery programme | Inadequacies around a focused approach on information governance, disaster recovery and business continuity could hamper our operations. |
12.80 |
| 5 | Covid-19 financial impact | Covid-19 was declared as a national disaster, with all the different levels of lockdown and the accompanying regulations that severely impacted the economy and the ability to continue with business as usual. |
12.50 |
| 6 | Research | Decline in research funding and research, and possibility of inadequate quality research products. |
12.00 |
| 7 | Fee regulation | Uncertainties around the proposed fee regulation model, leading to uncertainty around sustainability. |
10.00 |
| 8 | Business processes | Academic project in jeopardy because of the ineffectiveness and inefficiencies of support functions, possibly leading to loss of income and potential growth, loss of staff and a negative impact on reputation and rankings of the NWU. |
8.00 |
| 9 | Internationalisation | Insufficient global engagement/internationalisation effort, with the effect that the NWU has little international exposure, hampering our ability to attract international staff, students, investment and sponsoring of research. |
8.00 |
| 10 | Postgraduate students | Poor financial support to postgraduate students resulting in loss of student income and discontinuity from undergraduate to postgraduate progression. Furthermore, the dependency of postgraduate numbers on bursaries. |
7.20 |
Improving the effectiveness of risk management
A highlight of 2020 was the approval of a Risk and Compliance Management Policy by Council in March 2020.
Effective assessment of risk exposure and risk management is essential to us, especially on the operational, managerial and governance levels where risks are controlled.
Our combined assurance model is aligned with the good-practice governance principles in King IV and aims to incorporate and optimise all relevant assurance services, functions and structures. These are the university management committee, academic and support managers, the NWU's registrar, a designated risk and compliance officer and the Audit, Risk and Compliance Committee.
Two other structures involved in risk management are the Compliance Committee and the Combined Assurance Forum (CAF). Internal Audit also plays a substantial role in establishing an environment conducive to risk management.
Continuous assessment of risk
Regular reporting of risks takes place at the appropriate governance level, and all oversight structures receive twice-yearly updates on the status of risk management in these categories.
We identify potential risk events that might emerge and assess the likelihood of these occurring and their potential impact. Our assessment scale includes ratings for impact, probability, control effectiveness and residual risk.
Furthermore, we link responsible business process owners to each risk.
While the University Management Committee is responsible for overall management and control of risk, each risk owner remains responsible for ensuring that appropriate abatement strategies are established. Risk owners also provide feedback on the progress of managing the particular risk event, and ensure that the risk register is updated regularly.
Thus, operational managers are at the heart of the university's risk management project, taking responsibility and accountability for this.
From the above, our stakeholders may rest assured that all efforts were made in 2020 to continue to identify, assess and manage the relevant potential risk consequences on the university's effectiveness and efficiency.
PROF MARLENE VERHOEF
REGISTRAR DESIGNATED WITH
RISK RESPONSIBILITY
MR THABO MOKGATLHA
CHAIRPERSON: AUDIT, RISK AND
COMPLIANCE COMMITTEE
STATEMENT ON RISK MANAGEMENT