Material risks and opportunities impacting value
Overview: Our risk governance and management processes
In striving for greatness without boundaries, it is vital for us as a university to practise the most stringent discipline in how we manage our risks and governance processes.
The university’s ability to achieve greater heights for itself and its stakeholders depends to a large extent on how well governed and sustainable it is, which is in turn influenced by the depth and quality of risk management.
Our approach to risk and opportunity management is strategic. We identify and prioritise risks and opportunities that could influence our ability to implement the university’s strategy, and then adopt appropriate risk mitigation strategies and initiatives.
We consider the various dynamics in the external environment and align our risk management processes with the King IV Report on Corporate Governance for South Africa.
Our top risk management priorities for 2023 were risk assurance, risk tolerance and risk management.
During 2023, adding to the work already done on first and second-level assurance, we initiated a third-level assurance process, aimed at determining the top 10 risks on the NWU Strategic Risk Register.
Having introduced third-level assurance, we tested its resilience through risk audits outsourced to external audit firms. Although the outcome of the audits did not produce the assurance we had envisaged, they did provide valuable lessons for third-level assurance in 2024.
All these processes resulted in an updated top 10 risk list for the university.
Also in 2023, we expanded our risk-tolerance and risk-appetite reporting. This went beyond setting risk tolerance levels for the six NWU goals in the 2022 Annual Performance Plan (APP) and included the four enablers in the 2023 APP.
We plan to strengthen the integration of risk tolerance and risk appetite into the APP goals and enablers during 2024.
Meanwhile, we ensured that risk management remains an integral part of the strategy development and documentation process.
For instance, our new NWU Strategy: Taking the NWU forward – 2024 and beyond, explicitly acknowledges that the university subscribes to the COSO 2017 risk management framework.
In addition, we identified the risks and opportunities for the following aspects of the newly approved strategy:
- the NWU’s competitive advantage
- strategic projects
- the NWU’s goals and enablers (already started in previous years, but to be further refined).
Greatness without boundaries
Cyber security is the number one risk at the NWU. Measures to mitigate this risk include a comprehensive cyber-incident and execution management system, a cyber-security strategy, and a security information and event management plan.
Our risk management methodology includes the following stages:
How we identify our risks
Using a template, we identify, define and manage risks. Complementing this template, we then implement internal controls, set future controls and agree on action plans to manage the risks to an acceptable level.
Any risk above appetite is prioritised for focused management attention and reporting.
The Combined Assurance Forum monitors the risk registers of faculties and support departments, as well as the NWU Strategic Risk Register.
Risk reports are tabled in May and October at all Council committee meetings for governance oversight and to identify possible emerging risks.
Using our opportunities
We continually identify and update our risks and opportunities to adapt to our changing environment.
Although we refine our goals and enablers in our APPs, certain clear themes can be discerned over time. We see these as strategic opportunities that:
- continually safeguard the financial sustainability of the university;
- enable us to implement our strategy, structure and operating model;
- promote excellence in teaching and learning and research and innovation;
- establish a clearly differentiated student-value proposition;
- develop and retain excellent staff and create an equitable staff and student profile;
- enable the deployment of best-in-class IT to support the core business; and
- provide an effective financial model, policies and structure for continuing education offerings and more commercialisation opportunities.
The following tables provide an overview of the top risks that affected our ability to create value, and how we addressed them.
Cyber securityRisk ranking 1
Related material matter providing the opportunity:
Develop and implement a digital business strategy to create a competitive advantage for the NWU, ultimately unlocking a revenue stream.
(2023 APP, Goal 6).
Risks and the impact on value creation and capitals
Cyber security is not adequately addressed at the NWU and is the number one IT issue worldwide. An attack on the NWU is likely. Digital transformation will increase the cyber security risk.
Mitigating actions
Ensuring that the NWU is ready for the demands of the 4IR is a strategic priority.
We have implemented a comprehensive cyber-incident and execution management system, developed a cyber-security strategy and deployed a security information and event management plan. A single centralised platform enables abnormalities in our IT environment to be identified and escalated to the cyber-incident response team.
Environmental managementRisk ranking 2
Related material matter providing the opportunity:
Integrate and align community engagement with teaching-learning and research to develop a culture of active citizenship.
(2023 APP, Goal 3)
Risks and the impact on value creation and capitals
The lack of focus and clarity on where environmental management should belong, function and be monitored at the NWU poses a risk to sustainability and compliance.
Mitigating actions
We actively promote environmental sustainability in all our activities. We have done an Environmental Gap Analysis with an action plan to close gaps, appointed an internal and external safety, health and environment (SHE) project team and introduced a SHE system for benchmarking, development and implementation. All faculties and departments are required to manage and monitor their SHE risks/impacts.
Business model adequacy after Covid-19Risk ranking 3
Related material matter providing the opportunity:
Promote excellent learning and teaching and reposition the NWU to attain the size and shape required by market direction decisions. Strengthen research and innovation with a strategic focus on impactful globalisation.
(2023 APP, Goal 1 and 2)
Risks and the impact on value creation and capitals
Since the Covid-19 pandemic, universities have had to re-invent their business models to compete effectively and, in some cases, take advantage of unprecedented demand for tertiary study. An inadequately focused approach on managing the post-Covid-19 situation impacts directly on the NWU's governance and management, and could hamper its sustainability in the short, medium and long term.
Mitigating actions
Teaching-learning delivery and support must be conducive to excellence and innovation at all times, including in pandemic conditions. This commitment is embedded in the NWU’s purpose statement, brand promise and 2015-2025 Strategy.
In 2023, therefore, we focused on preparing the NWU to embrace the new world of work and study, benefit from the gains of implementing the Digital Business Strategy, and address digital risks.
IT, the Centre for Teaching and Learning and Space Management are facilitating strategic future-fit projects. These include an integrated facilities project, student information system renewal, the work-integrated learning and service learning (WISL) system, e-assessment and proctoring platforms/software, and further development of the NWU learning management system.
Greatness without boundaries
Strategy for digital transformation gets the green light
The NWU Council approved the Digital Business Strategy at its meeting on 22 June 2023.
This strategy ties in with Goal 6 and Enabler 2 in the university’s Annual Performance Plan. These are about implementing a business strategy to create a competitive advantage for the NWU, and establishing an integrated technology platform for a digital future.
The Digital Business Strategy will enable us to build a technology ecosystem that integrates students, staff and partners to deliver an exceptional customer experience.
As part of the new Digital Business Strategy, we are preparing for a new student information system to boost operational efficiencies and create a better experience for users.
The implications and demand for digital
transformation on the NWU’s businessRisk ranking 4
Related material matter providing the opportunity:
Develop and implement a Digital Business Strategy to create a competitive advantage for the NWU and ultimately unlock alternative revenue streams.
Establish a holistic and integrated university technology platform to provide a solid foundation for a digital future.
(2023 APP, Goal 6, Enabler 2)
Risks and the impact on value creation and capitals
IT provisioning for certain administrative and academic functions is not optimal and IT is short-staffed. Uncertainties over the direction of the Digital Business Strategy lead to delays in new system design and implementation. Digital transformation will also have a major impact on operational models, structures, people, processes and roles.
Mitigating actions
We are strengthening the foundation for the digital future by:
- ensuring stable, scalable, hybrid, manageable and responsive infrastructure;
- using composable infrastructure to make data centre resources as readily available as cloud services;
- establishing a long-term integration platform to ensure business agility through rapid deployment of standardised shared services;
- ensure a secure digital environment and start building the technology ecosystem that integrates students, partners, employees and “things” to deliver an exceptional customer experience; and
- establish a responsive IT operating model, known for agility, competent people, best practices, innovative culture and well‑looked‑after staff.
Information governanceRisk ranking 5
Related material matter providing the opportunity:
Develop and implement a Digital Business Strategy to create a competitive advantage for the university and ultimately unlock alternative revenue streams.
Govern, lead and manage in an agile, collaborative and integrated way towards an optimally digitised university environment.
(2023 APP, Goal 6, Enabler 1)
Risks and the impact on value creation and capitals
An inadequately focused approach to information governance implementation could hamper our operations and expose the NWU to compliance risks.
Mitigating actions
We are focusing on business continuity planning, contingency planning for mission-critical processes and implementing our Digital Business Strategy. We also have a compliance management process, compulsory training for all staff on the Protection of Personal Information Act (POPIA), and are reviewing the Policy on Academic Integrity. An information governance coordinator will be appointed to focus on implementing the Information Governance Framework.
Business continuity plans and
disaster recovery plansRisk ranking 6
Related material matter providing the opportunity:
Govern, lead and manage in an agile, collaborative and integrated way towards an optimally digitised university environment.
Establish a holistic and integrated university technology platform to provide a solid foundation for a digital future.
(2023 APP, Enabler 1 and 2)
Risks and the impact on value creation and capitals
Inadequacies around disaster recovery and business continuity management could hamper the NWU's operations and lead to compliance risks, financial losses and reputational damage.
Mitigating actions
Business continuity planning and contingency planning should be built into the execution of key processes such as registration. The implementation of the Business Continuity Planning Policy should be approved by Council and business processes should be refined to remove redundancies. The Technology and Information Governance Committee has approved the Cybersecurity Strategy, and targets have been set and achieved for improving the NWU’s cybersecurity detection capabilities.
Funding and fee regulationRisk ranking 7
Related material matter providing the opportunity:
Ensure financial sustainability and optimal performance with due consideration of macro-economic conditions and a drive towards digital transformation.
(2023 APP, Enabler 4)
Risks and the impact on value creation and capitals
The government funding model is not sustainable, and the higher education sector requires more information on this model from the DHET.
The unofficial regulation of fee increases since 2016 adds to the uncertainty and there is a lack of clarity on processes the DHET has already commenced to regulate fees.
Mitigating actions
We have developed an internal financial impact model that we update constantly. It accounts for all variables that might impact on the financial performance of the NWU. We are also focusing on fundraising and endowment initiatives, building available reserves to cover one year of operational expenses, optimising relationships with funders and facilitating start-up capital through the Technology Transfer and Innovation Support Department.
Poor financial support to
postgraduate studentsRisk ranking 8
Related material matter providing the opportunity:
Strengthen research and innovation with a strategic focus on impactful globalisation.
(2023 APP, Goal 2)
Risks and the impact on value creation and capitals
Poor financial support to postgraduate students results in loss of student income and discontinuity from undergraduate to postgraduate level. Postgraduate numbers are dependent on bursaries.
Mitigating actions
A postgraduate funding model provides merit bursaries to qualifying students who received NSFAS funding during their undergraduate studies. Strategic funds are made available to a limited number of potential candidates. A special fund is being established to provide funding according to the academic rules, linked to a maximum study duration.
Research qualityRisk ranking 9
Related material matter providing the opportunity:
Strengthen research and innovation with a strategic focus on impactful globalisation.
(2023 APP, Goal 2)
Risk and the impact on value creation and capitals
Poor quality of research products could lead to a decline in or inadequate resources for research and research chairs.
Mitigating actions
The NWU budget focuses on sustaining and enhancing the research function. Control sheets are used to monitor the spending of research funds and processes are in place to detect and manage academic misconduct. Internal Audit executes ongoing compliance audits on the Academic Integrity Policy and webinars on academic integrity are held. The SCIMAGO tool (for assessing scientific domains) is used to independently determine the quality of research products before any research paper is sent to journals.
DiversityRisk ranking 10
Related material matter providing the opportunity:
Develop a clearly differentiatedstudent value proposition with a focus on creating an inclusive environment aimed at developing students holistically through structured and unstructured co-curricular programmes which are relevant, desirable and meet students’ needs.
Attract, develop and retain excellent staff and create an equitable staff profile.
(2023 APP, Goal 4 and 5)
Risks and the impact on value creation and capitals
Insufficient levels of diversity in the staff and student environment could undermine the university strategy.
Mitigating actions
Employment equity targets are built into the performance agreements of Senior Management Committee members. An Employment Equity Policy is in place to ensure that the university creates equal opportunities for all its employees and to remove all barriers. Succession planning has been finalised, starting with the UMC and mission-critical positions. A control mechanism to monitor and approve non-designated appointments has been implemented.
Key to risk indicators:
| Name | Value | Description | Colour |
| Minor | 4 | A risk event that holds no significant threat to the organisation, employees or other stakeholders. | Green |
| Low | 10 | A risk that is unlikely to occur, but if it does occur, can be managed under normal operating conditions. | Yellow |
| Medium | 15 | The risk could have a serious impact on operations. It can be managed with some additional resources, budget and maintenance effort. | Orange |
| High | 25 | The risk is potentially disastrous and will hinder the achievement of objectives and/or lead to the collapse of business and/or projects. | Red |
The top 10 risk movements for 2023 were as follows:
| Risk number | Risk name | Initial risk rating | Previous risk rating | Current risk rating |
| 42 | Cyber security | 16 | 20 | 20 |
| 40 | Environmental management | 12 | 16 | 16 |
| 233 | Business model adequacy after Covid-19 | 16 | 16 | 16 |
| 234 | The implications and demand for digital transformation on the NWU’s business | 16 | 16 | 16 |
| 20 | Information governance | 12 | 12 | 12 |
| 231 | Business Continuity Plan and Disaster Recovery Plan | 12 | 12 | 12 |
| 232 | Funding and fee regulation | 12 | 12 | 12 |
| 3 | Postgraduate students | 7 | 12 | 12 |
| 9 | Research quality | 12 | 12 | 12 |
| 6 | Diversity | 6 | 9 | 9 |
The risk heat map for the NWU
The number in the top left-hand corner of each block indicates the residual risk rating and the # indicates the number of risks at that rating on the NWU risk register.
Conclusion
Risk management is part of the strategic mindset of the university and we continue to refine our understanding and management of risk.
We are intensifying efforts to integrate risk management into the day-to-day operations of the NWU and ensure that opportunity management remains an inherent part of risk management.
At operational level, the NWU continues to use electronic risk management software that integrates risk management, compliance management and audit matters.
Risk reporting takes place at various levels: at the UMC, the ARCC, Combined Assurance Forum, faculty management committees and at all the Council committee meetings in May and October.
The reports submitted to Council committees in 2023 focused on integrating risk appetite and risk tolerance into the 2023 APP. Reporting also emphasised pertinent aspects of the Strategic Risk Register, particularly where risk is linked to the relevant area of expertise and oversight of a particular committee. Each Council committee is required to identify emerging risks on an ongoing basis.
COUNCIL STATEMENT ON RISK MANAGEMENT
The NWU Council, as the final decision-making body of the university, affirms that it is endowed with the responsibility and accountability for the effectiveness and efficiency of the risk-management process. It is continually apprised of developments by means of management and audit reports on the management and risk coverage processes; and had been provided sufficient assurance over the past year from all relevant assurance providers.
the NWU Council on 13 June 2024.