There has been significant discussion in recent months around the increasing cyber risk in Australia. In August, the federal government released its own cyber security strategy and announced plans to invest $1.67 billion in cyber security initiatives over the next decade.

In early September the government’s first cyber threat assessment revealed malicious cyber activity against Australia is "increasing in frequency, scale and sophistication" to become the "most significant threat in terms of overall volume and impact to individuals and businesses".

It announced an expansion of infrastructure deemed critical to include banking, health, food and “data and the cloud” and education. Such operators will be subject to “enhanced cyber security rules”.  

Staying abreast of these risks is important for universities. After all, cyber-attacks could pose a risk to one of the key drivers of Australian universities’ revenue: research. If hackers were to steal critical intellectual property, or sabotage research, rankings, reputation and revenue could take a hit, both in terms of lost intellectual property, and reputation.

Yet it’s important that this discussion does not distract higher education executives from more common, costly yet admittedly mundane risks that could also cause serious damage to research, reputation and revenue.

After all, there’s much at stake. Australian universities have consistently punched above their weight on the international scene when it comes to research rankings. Five of Australian universities cracked the top 50 in the 2021 QS World University Rankings. This performance has been supported by the billions of dollars in fees that international students have pumped into Australian universities. In turn, research rankings feed enrolment demand, in a virtuous cycle.

A fluid situation

These less headline-grabbing risks include flood, storm damage, water leakage and fire – and decentralisation of risk management, which is one of the more unique challenges impeding university risk management as a whole.

While in a shopping mall, a facilities manager may have oversight of all facilities, universities operate a rather unique model closer to the Australian federation of states and territories than to a typical organisation. Risk managers tend to work independently across faculties and even schools, which while effective in addressing localised risks, can cloud the executive’s line of sight to the most critical business risks across the organisation, which are often the most mundane.

This decentralisation can create inefficiencies in prioritising risks and allocating resources across the entire university. To avoid this, universities must view risk at a higher level to understand, prioritise and then manage those risks that can result in the biggest losses to the university as a whole.  

Water leaks can and do quickly cause dramatic damage, ruining vital equipment. Liquid damage causes 42 per cent of all losses across FM Global’s global client base, a fact which is reflected in the university sector where it also represents the largest cause of loss.

Even relatively small leaks can cause severe losses as liquid flows throughout buildings, damaging property but also critical equipment and information. It can lead to mould, and cause delays in business-critical activities such as research until costly and time-consuming cleanup and restoration are complete.

Fire, meanwhile, accounts for 16 per cent of losses across FM Global’s client base globally, and 17 per cent of losses in the university sector, and flood/surface water damage amounts to 33 per cent.

Critical exposures

To reduce the frequency and severity of water leakage-related loss, universities should develop a cohesive plan that takes the entire organisation and all of its campuses into account. Developing this should begin by keeping a regularly updated record of which rooms fall into the critical room category. Critical rooms are those which have high operational impact and house valuable contents that cannot be easily replaced, such as research labs.

The next step is to ensure that there are regular inspections undertaken of the building envelope around these critical rooms, to catch any potential leakages and take steps to reduce the likelihood of water entering the building. A robust maintenance program that tests water valves and drains, among other risk areas, should also be developed and followed.

Lastly, while preparation is proven time and time again to reduce the likelihood of loss, it can still happen. An effective response plan will allow the university to bounce back faster from liquid damage. Any plan should include having an emergency response team which is trained on a semi-annual basis on the key steps they need to carry out, a list of critical vendors for the building – including electrical, HVAC, elevator and plumbing – and identifying alternative spaces where critical work can be carried out, or room contents stored if a leak does occur.

In the case of fire, it’s critical to maintain smoke detection and fire alarm systems in accordance with the manufacturers’ instructions and maintain automatic sprinkler systems by testing water flow alarms and conducting valve inspections. Emergency response plans should ideally be updated, communicated and conducted on a regular basis.

News headlines are certainly one way to stay on top of risk trends – but they rarely tell the whole story. In fact, they can distract from the bigger picture and the more mundane threats that data tells us come back to bite universities time and again.

By identifying, making preparations for and mitigating risks like water leakage and fire, universities will be taking priceless steps to protect research, reputation and revenue at a time when it’s never been more critical.

This article was originally published in Campus Review