FAQ

A risk is a possible event, situation, or condition that could affect what the university is trying to achieve.

Enterprise Risk Management is a structured approach to identifying, assessing, managing, and monitoring risks that could affect the university’s ability to achieve its goals.

McMaster has an ERM program to proactively identify, assess, and mitigate threats across the institution — supporting better decision-making, strengthening accountability, and helping leaders understand key risks before they become major issues.

The Enterprise Risk Management Department does not directly manage the risks at the university. Risk management is a collective effort by all risk owners and all members of the McMaster community. The ERM team coordinates the activities that exists to identify, analyze, mitigate, and monitor internal and external risks that threaten institutional, departmental, and/or project goals at the university.

The ERM program looks at risk management strategies holistically, or from the perspective of the entire organization. The ERM framework includes risks that fall into one of the following categories:

• Teaching & Learning
• Research & Innovation
• Operational Resilience
• Financial sustainability
• Strategy & Growth
• People & Culture
• Reputation & Trust

Risk is owned by the leaders and departments responsible for the activity, process, or decision where the risk exists. The ERM Department supports and coordinates, but it does not own every risk.

A risk assessment is a process used to understand a risk — including what could happen, how likely it is, how serious the impact could be, and what actions are needed to manage it.

Reach out to the ERM Team directly. You do not need to have a fully formed concern — if something feels like it could affect your team’s goals or the university’s operations, that is worth a conversation. The ERM Team can help you think through, document it appropriately, and determine next steps.

After a risk is identified, it is assessed, assigned to the appropriate owner, documented, and monitored. Where needed, mitigation actions are developed and progress is tracked over time.

Risks should be reviewed regularly. Higher-priority risks may be reviewed more often, especially when circumstances change or new information becomes available.

Yes. The ERM Team can be engaged to support risk identification, assessment, and monitoring for specific projects, major initiatives, or institutional partnerships. Early engagement is encouraged, particularly for high-complexity or high-stakes work.

Contact the ERM Team at entrisk@mcmaster.ca to request guidance, templates, training, or support for a risk discussion or assessment.

Please contact the Enterprise Risk Management Team for consultation regarding any of the following matters:

• McMaster’s insurance portfolio (including automobile and driver insurance details).
• Contract reviews relating to insurance provisions in agreements.
• Risk consultation and decision support.
• Crisis Management Group (CMG) support.
• For support on any operational risks or needs of the University.

The Enterprise Risk Management Department can provide consultation and advice but does not provide approval of projects and initiatives.

You can download the Certificate of Insurance Request Form and submit it to the Enterprise Risk Management Department.

Visit our page on Certificates of Insurance for more information on completing the form.

Information and resources on McMaster’s insurance portfolio can be found on our Insurance Page.

The Enterprise Risk Management Department provides contract review support relating to insurance in third party agreements. Please contact the ERM Team to request a contract review.