Photo by Sasun Bughdaryan on Unsplash
Student intake that misses its target, grant funds that are accounted for late, academic data leaks, or recurring findings from external auditors. All of these are risks that can disrupt a university's objectives if they are not managed early.
This article covers why universities need risk management, the regulations and standards used as references, common risk categories, an example campus risk register, the division of roles, and the position of the SPI in risk management. Regulatory references were checked as of October 21, 2026.
Why Do Universities Need Risk Management?
Several drivers reinforce one another:
- Autonomy demands accountability. Article 63 of Law Number 12 of 2012 states that the autonomy of higher education management is based on the principles of accountability, transparency, non-profit, quality assurance, and effectiveness and efficiency.
- Standards for overseeing education. Article 34 paragraph (2) of Minister of Higher Education, Science, and Technology Regulation Number 39 of 2025 states that oversight and control of educational activities must at least include monitoring potential risks.
- Accreditation. The latest BAN-PT institutional accreditation instrument, IAPT 4.1, addresses governance that ensures mitigation of potential risks as well as good university governance practices that include risk management.
- Government internal control. For state universities that are part of government agencies, Government Regulation Number 60 of 2008 on the Government Internal Control System (SPIP) makes risk assessment one of the five elements of SPIP.
The basic concepts and stages of risk management in general are discussed in the article on risk management.
Which Regulations and Standards Serve as References?
| Reference | Relevant content | Notes as of October 21, 2026 |
|---|---|---|
| Government Regulation 60/2008 on SPIP | Five elements of SPIP: control environment, risk assessment, control activities, information and communication, and monitoring. Risk assessment consists of risk identification and risk analysis. | Applies to government agencies |
| Minister of Education and Culture Regulation 66/2015 on Risk Management within the Ministry | Each work unit, as a risk owner, applies risk management with the specified process and risk categories | Declared no longer applicable within the Ministry of Primary and Secondary Education by Regulation 5/2026. Its status for state universities under the Ministry of Higher Education, Science, and Technology should be confirmed with JDIH. |
| ISO 31000:2018 | Risk management guidelines consisting of principles, a framework, and a process | A guideline, not a certification standard. A revision is being developed by ISO. |
| BAN-PT IAPT 4.1 accreditation instrument | Mitigation of potential risks and risk management in governance | Instrument annexes may be updated; check the BAN-PT website |
| Statutes and rector regulations | Structure, guidelines, and units managing risk on campus | Differs for each institution |
A fuller explanation of the ISO 31000 framework is in the article on applying ISO 31000.
What Is the Risk Management Process on Campus?
Article 4 of Regulation 66/2015 sets out the risk management process in six stages. This sequence is in line with the general process in ISO 31000, so it is easy to use as a working reference:
- Risk identification. Listing events that could hinder objectives, for example by work unit or by core process.
- Risk analysis. Assessing the likelihood and impact of each risk to determine its level.
- Risk evaluation. Comparing risk levels with the risk appetite to set priorities.
- Risk treatment. Setting mitigation plans, owners, and deadlines.
- Monitoring and review. Regularly monitoring the implementation of mitigation and changes in risk levels.
- Coordination. Communicating results to leadership and related units.
For analysis, Regulation 66/2015 uses a three-level scale (low, medium, high) for impact and likelihood. Some campuses use a more detailed scale, such as the Hasanuddin University risk management guideline, which uses five levels of likelihood and impact.
What Are the Risk Categories in Higher Education?
Article 7 of Regulation 66/2015 divides risks into five categories: strategic, operational, financial, compliance, and fraud. As an example of campus application, Hasanuddin University Rector Regulation Number 2/UN4.1/2025 on Risk Management Guidelines breaks these categories down as follows:
| Category | Example subcategories in the Unhas guideline |
|---|---|
| Strategic risk | Academic, student affairs and alumni relations, research, innovation, community service, performance, reputation, planning |
| Operational risk | Systems and information technology, services, facilities or assets, environmental safety and order, human resources, force majeure |
| Financial risk | Revenue, expenditure, financial statement opinion |
| Compliance risk | Non-compliance with regulations, policies, and legal claims |
| Fraud risk | Fraud by leaders or employees |
These categories are an example from one university. Other campuses can set their own categories according to their mission, size, and form of management. Examples of audits for risky areas such as procurement, research funds, and academic information systems are in the articles procurement audit, research grant fund audit, and SIAKAD security audit.
What Does a Campus Risk Register Look Like?
A risk register is a list of risks with their assessment and treatment plans. The following example is illustrative and uses a scale of 1 to 5:
| Risks | Category | Likelihood | Impact | Risk owner | Treatment plan |
|---|---|---|---|---|---|
| New student intake below target | Strategic | 3 | 4 | Vice rector for academic affairs | Review of low-demand study programs and broader promotion |
| Late accountability reporting for research grants | Financial | 4 | 3 | Head of the research institute | Reporting calendar, deadline reminders, and staged verification of evidence |
| Student data leak | Operational | 2 | 5 | Head of the IT unit | Access control, data backups, and regular security testing |
| Procurement not in line with regulations | Compliance | 3 | 4 | Head of the procurement unit | Procurement compliance checklist and review before contracts are signed |
| External auditor recommendations not followed up | Compliance | 3 | 3 | Head of the related unit | Monthly follow-up status monitoring by leadership |
| Misuse of assets | Fraud | 2 | 4 | Head of the general affairs bureau | Regular stock-taking and segregation of duties |
Each key risk should come with indicators that are monitored regularly so changes in its level are quickly visible. This concept is discussed in the article on key risk indicator.
Who Is Involved in Campus Risk Management?
The management structure differs from campus to campus. In the Hasanuddin University guideline, for example, the parties include the rector, risk owners at the work unit level, risk officers who assist risk owners, the Risk Management Center, which reports to the vice rector for planning, development, and finance, and the SPI.
This division can be mapped using the IIA Three Lines Model: unit leaders as risk owners in the first line, the risk management unit in the second line, and the SPI in the third line.
What Is the Role of the SPI in Campus Risk Management?
Several regulations and campus guidelines mention the role of the SPI explicitly:
- State universities with BLU financial management. Minister of Finance Regulation 129/PMK.05/2020 assigns the SPI to test and evaluate the implementation of internal control and the risk management system.
- PTKN. PMA 25/2017 states that the SPI's functions include preparing an internal control risk map.
- Example of a campus guideline. In the Unhas guideline, the SPI oversees compliance with the implementation of risk management and plays a consulting and assistance role. The main risk profile set by the rector is also submitted to the SPI as a basis for audit planning.
In practice, the SPI uses the results of risk management to prepare a risk-based oversight plan, then assesses whether mitigation is actually working. The SPI does not take over risk ownership from unit leaders. How to prepare an audit plan from a risk profile is discussed in the articles on risk-based audit and risk management audit. The position of the SPI itself is discussed in the article University SPI. The link between risk management and governance and compliance is discussed in the article GRC in universities, and preparing the annual plan from the risk profile in the article University SPI annual audit plan (PKPT).
How Can a University Start Risk Management?
- Set a risk management policy and guidelines through a regulation of the institution's leadership.
- Designate the managing unit, risk owners in each unit, and reporting lines.
- Agree on risk criteria: likelihood scale, impact scale, and risk appetite.
- Start with core processes, such as student admissions, finance, procurement, research, and information systems.
- Prepare a risk register for each unit, then consolidate it into a university risk profile.
- Monitor the implementation of mitigation regularly and report to leadership.
- Involve the SPI to provide assurance on the effectiveness of implementation.
What Are Common Mistakes in Campus Risk Management?
- The risk register is a mere formality. The risk list is filled in just before accreditation or an audit, then never updated.
- Risks are copied from other campuses. Risks should be derived from the campus's own objectives and processes.
- Mitigation without owners or deadlines. Treatment plans are hard to monitor when it is unclear who is responsible.
- The SPI manages risks itself. If the SPI runs the risk management function, its independence in providing assurance may be compromised.
- Results are not used in decisions. The risk profile should feed into planning and budgeting.
How Does Internal Audit Software Help?
Audithink is internal audit software, not an organization-wide risk management system. Its role is on the SPI side: the risk assessment feature helps map risk areas for audit planning, supported by audit planning, work program templates, notifications, follow-up monitoring, and automated reports. Campus audit needs are discussed further on the page Audithink for Educational Institutions.
FAQ About University Risk Management
What is university risk management?
University risk management is a structured process for identifying, assessing, treating, and monitoring risks that may hinder campus objectives in both academic and non-academic areas.
What is the regulatory basis for risk management on campus?
Relevant references include Law 12/2012, Ministerial Regulation 39/2025 on monitoring potential risks, Government Regulation 60/2008 on SPIP, Minister of Education and Culture Regulation 66/2015, and each campus's rector regulations.
What are the risk categories in higher education?
Regulation 66/2015 uses five categories: strategic, operational, financial, compliance, and fraud. Campuses can break these down further, for example into academic, research, reputational, and information technology risks.
What does a campus risk register contain?
A risk register contains the risk, its category, causes, likelihood and impact assessment, risk level, risk owner, treatment plan, deadline, and monitoring status.
What is the role of the SPI in risk management?
The SPI provides assurance on the effectiveness of risk management and uses the risk profile to plan audits. The SPI does not take over risk ownership from unit leaders.
Is ISO 31000 mandatory for universities?
ISO 31000 is a guideline, not a requirement for certification. Many campuses use it as a reference when preparing their risk management guidelines.
Conclusion
Risk management helps universities exercise autonomy accountably. The keys are risk categories that fit the campus context, an up-to-date risk register, clear risk owners, and an SPI that provides independent assurance.
If the SPI at your campus wants to prepare a risk-based audit plan and monitor follow-up more neatly, schedule an Audithink demo.
