Fundamentals of Risk Management: Definitions, Categories, and Governance
The Fundamentals domain tests whether you can define risk precisely, classify school exposures correctly, and place risk work inside a governance framework. Questions often ask you to distinguish risk from hazard, identify which category an exposure belongs to, or explain what a board, superintendent, and risk manager each do.
Core rules and concepts
- Risk is the effect of uncertainty on objectives; the effect may be positive or negative. A hazard is a source of harm, such as worn playground surfacing or an unsecured ladder. Risk is what that hazard might do to your objectives.
- Pure risk has only downside: property damage, liability, employee injury. Speculative risk can produce gain or loss, such as renting facilities for revenue or issuing a bond for a stadium.
- Objectives come first. Without a stated objective, a risk register is only a hazard list.
- Typical school categories include property; liability (general, educators legal/employment, auto, cyber, athletic); human capital; student activities; transportation; food service; construction; environmental (mold, asbestos, lead); compliance; reputational; and strategic or financial.
- Enterprise risk management principles: integrated, structured and comprehensive, customized, inclusive, dynamic, based on best available information, sensitive to human and cultural factors, and continually improving.
- The process runs from scope and context to identification, analysis, evaluation, treatment, and then communication, consultation, monitoring, and review throughout.
- Governance follows a three lines pattern: departments own their risks, the risk function coordinates and advises, and internal audit gives independent assurance. The board sets policy, appetite, and oversight; administration implements.
- Risk appetite is how much risk the district will accept while pursuing objectives. Tolerance is acceptable variation around a specific objective. Capacity is the maximum risk the district could bear before mission or financial failure.
- Total cost of risk equals premiums plus retained losses plus risk control costs plus administrative costs. This metric links the fundamentals to the funding domain.
Worked example
A district adopts the objective of no serious playground injuries. A hazard review finds worn surfacing, a broken swing seat, and inconsistent supervision. The hazard is the surfacing; the risk is the effect of uncertainty, meaning injury, litigation, budget strain, and reputational damage, on the objective. Incident logs show 14 injuries in two years, concentrated at one school. Against a tolerance of three playground injuries district-wide per year, this is above tolerance, so treatment is required. Because the objective was set first, the district can later measure whether treatment worked.
Traps that cost marks
Equating risk management with buying insurance. Treating retained risk as no risk. Using risk and hazard interchangeably. Ignoring strategic or upside risk. Writing a register with no owners or review dates. Assuming a low-frequency exposure is low risk when severity is catastrophic.