Risk Is Manageable. Surprise Is Not.

What university trustees and foundation directors should be assessing before risk becomes crisis

In my last article, I stated that board service is not an honorary appointment. The next question is practical: What should the board actually be watching?

Most institutional crises do not begin as crises. They begin as signals: a recurring operating deficit, declining enrollment, an accreditation concern, a weakening fundraising pipeline, an unresolved audit finding, leadership turnover, a cybersecurity vulnerability, a scholarship obligation growing faster than available resources, or a piece of land suddenly being discussed as a source of operating cash.

Each issue may be manageable independently. The danger often comes when several begin moving in the wrong direction at the same time. That is where risk oversight becomes one of the board’s most important responsibilities.

AGB places responsibility for enterprise risk oversight with the full governing board, while emphasizing that individual committees should incorporate relevant risk into their work. But another distinction deserves more attention.

One Mission. Two Boards. Different Responsibilities.

Many colleges and universities have an affiliated foundation that raises, invests, manages, or stewards philanthropic assets on the institution’s behalf. The two organizations may work closely. They may share staff. The university may provide accounting, HR, technology, legal, advancement, or other services to the foundation. The president may serve on both boards. Their strategic priorities may be intentionally aligned.

But they are still separate entities.

The university and foundation share a mission, but each board has distinct fiduciary responsibilities and its own lines of accountability.

That means the two boards should not be receiving identical risk dashboards.

What the University Board Should Be Watching

1. Enrollment and Market Position

Primary committee: Enrollment, Academic Affairs, or Student Success Shared with: Finance

Boards should see applications, yield, retention, net tuition revenue, discount rate, demographic trends, competitive position, and program demand.

The larger question is whether students will continue choosing the institution and whether the enrollment model is financially sustainable.

2. Student Outcomes

Primary committee: Academic Affairs / Student Success

Boards should monitor four-year graduation, time to degree, student debt burden, licensure performance, career placement, graduate-school placement, and economic mobility.

An institution can increase enrollment while weakening outcomes. The board needs visibility into both.

3. Financial Sustainability

Primary committee: Finance Shared with: Audit

Boards should understand liquidity, unrestricted cash, operating performance, recurring deficits, debt and covenants, reserves, cash-flow trends, and capital requirements.

A single deficit may be manageable. Recurring deficits accompanied by deteriorating liquidity tell a different story.

4. Accreditation, Regulation, and Compliance

Primary committees: Academic Affairs + Audit/Compliance

Boards need visibility into accreditation status, unresolved findings, Title IV exposure, audit issues, internal controls, litigation, and federal and state regulatory requirements.

Trustees do not need to become compliance officers. They do need to understand which failures can materially threaten the institution.

5. Leadership and Succession

Primary committee: Governance / Executive

Boards should monitor presidential performance, leadership stability, succession, critical vacancies, and organizational capacity.

A pattern of turnover among presidents, CFOs, enrollment leaders, advancement leaders, or auditors can signal risk.

6. Facilities, Technology, Cybersecurity, and Institutional Assets

Primary committees: Facilities / Finance / Technology / Risk

Boards should understand deferred maintenance, property utilization, technology infrastructure, cybersecurity, insurance, real-estate exposure, and capital requirements.

For institutions holding valuable land, the board should also understand what it owns, what it is worth, and which assets may represent long-term strategic value.

7. Strategic Execution

Owner: Full board

Committees may monitor individual priorities, but the governing board ultimately owns institutional strategy.

The board should know whether the strategy it approved is actually being implemented and whether the assumptions behind it remain valid.

The Foundation Board Has a Different Risk Map

An affiliated foundation exists to support the institution, but its board has fiduciary obligations to the foundation itself. That creates a different set of questions.

1. Fundraising Pipeline and Donor Concentration

Primary committee: Development / Advancement

The board should understand how much giving depends on a small group of donors, whether the major-gift pipeline is strong, whether pledges are collectible, whether annual donors are being retained, and whether campaign performance is consistent with projections.

A large gift can make fundraising results look strong while masking weakness underneath.

2. Cash, Reserves, and Commitments

Primary committee: Finance

The foundation needs to understand its own cash position, operating reserves, scholarship commitments, outstanding pledges, transfers promised to the institution, and administrative obligations.

University need does not automatically equal foundation liquidity.

3. Endowment and Investment Governance

Primary committee: Investment Shared with: Finance

Boards should monitor investment performance, asset allocation, liquidity, manager performance, spending policy, underwater funds, and long-term purchasing power.

The foundation must preserve and manage those assets in accordance with donor restrictions, governing policy, and applicable law.

4. Donor Intent and Restricted Funds

Primary committees: Stewardship / Programs + Finance

The foundation must know what the donor authorized, whether scholarship awards align with fund agreements, whether endowed funds are spent appropriately, whether naming commitments are honored, and whether restricted gifts are used only for their designated purposes.

This is fiduciary stewardship.

5. Audit, Controls, Compliance, and Independence

Primary committees: Audit + Governance

The foundation board should assess internal controls, audit findings, conflicts of interest, related-party transactions, board independence, state nonprofit requirements, and compliance with the foundation’s governing documents and affiliation agreement.

6. Foundation Leadership and Operating Capacity

Primary committee: Governance / Executive

Boards should monitor executive performance, succession, advancement staffing, investment oversight capacity, data systems, CRM integrity, gift administration, and stewardship infrastructure.

An ambitious fundraising strategy without the capacity to administer gifts properly creates its own risk.

Where the Two Entities Meet

This is where governance can become complicated.

A foundation may outsource payroll, accounting, HR, IT, legal services, advancement functions, gift processing, or other operations to the university. The university may rely on the foundation for fundraising, investments, scholarships, and transfers supporting institutional priorities.

Those arrangements can work well, but they can also create confusion about authority and accountability. That is why a strong institution-foundation agreement matters.

Boards should be able to answer:

• Who owns the function?

• Who performs the function?

• Who supervises the people performing it?

• Who bears the financial or fiduciary risk?

• Which board receives the information?

• Who has authority when something goes wrong?

Coordination should be intentional. Accountability should remain clear.

Every Significant Risk Needs an Owner

Risk cannot simply appear on an annual heat map. Every material risk should have a management owner, a board committee responsible for oversight, a leading indicator, and a threshold for escalation.

When a risk crosses organizational boundaries, both boards should understand how responsibility is divided.

A major scholarship program, for example, may involve the university determining student eligibility, the foundation holding restricted scholarship funds, advancement stewarding the donor relationship, finance processing transfers, and student affairs communicating with recipients.

That is one mission, but it is several distinct responsibilities.

Good governance makes those responsibilities visible.

Watch for Convergence

One bad metric rarely defines a crisis. Multiple deteriorating indicators should prompt the board to pay closer attention.

For the university, that might be declining enrollment combined with recurring deficits, weakening liquidity, and accreditation concerns.

For the foundation, it might be declining donor participation, weak pledge collections, growing scholarship commitments, and pressure to use long-term assets for current needs.

Across both entities, a distressed institution, a cash-constrained foundation, and unclear agreements about who controls what can create serious governance pressure.

That is precisely when clarity matters most.

Risk Management Creates Strategic Options

The earlier a board understands emerging risk, the more choices the organization retains. It has more time to restructure, recruit, adjust programs, strengthen fundraising, build partnerships, protect assets, and address regulatory issues before they become existential.

That is why risk management belongs in the strategic conversation. Its value is not simply identifying what could go wrong. It gives leadership and the board time to decide what to do.

Risk is manageable. Surprise is not.

Strong governance reduces the number of institutional surprises everyone later says they should have seen coming.