Episode 17: Chief Risk and Recovery Officer: the CRO’S Changing Role Host: Mike Kearney, Partner and Chief Marketing Officer, Deloitte Risk & Financial Advisory LLP

Resilient: Confronting the COVID-19 crisis Episode 17 | June 2020

Resilient: Confronting the COVID-19 crisis Actionable insights to help businesses respond and recover Episode 17: Chief risk and recovery officer: The CRO’s changing role Host: Mike Kearney, partner and chief marketing officer, Deloitte Risk & Financial Advisory LLP

Guests: Tamika Puckett, chief risk officer, City of Chicago Luke Figora, associate vice president, chief risk and compliance officer, Northwestern University

Mike Kearney: Welcome to Resilient. My thriving and the next normal really means, compliance officer, Northwestern University. name is Mike Kearney, the Risk and Financial it’s clear that innovation and ingenuity are at They are blazing trails and helping manage Advisory CMO. For the past 16 episodes in the cornerstone. risks in their respective communities during our Confronting the COVID-19 Crisis series, the crisis. So let’s hear what they have to say. we’ve explored many challenges. What has That’s why this series is so important. Today, Tamika and Luke, welcome to Resilient. 2020 really stood out is that the rapidly evolving we’ll get more insights from the chief risk has been a challenging year. We are—can’t environment is accelerating the adoption officers of two organizations at the forefront believe it—but three months into COVID-19. and the creation of innovative approaches of the crisis. How are they approaching the And I think there’s a natural tendency for to deal with everything that is being thrown current environment? What are they doing many of us to focus on all of the challenges at leaders who are on the front line. I have to advise and guide their organizations to that are right in front of us. But I love looking to say that I am inspired by all of these respond or cover and emerge from the into the future. And one of the questions I’ve stories. It’s a testament that we, as humans, crisis? How is their role changing, and how is been asking guests recently is, what gives are remarkably resilient, whether through the organization’s view of risk management them hope for the future? I’d love to pose innovation or breaking from conventional reshaping as we emerge from the crisis? that question to the two of you. So, Tamika, thinking. There’s been an abundance of I’m joined by Tamika Puckett, the chief risk what gives you hope for the future? learnings from our guests. They give me a officer, City of Chicago, and Luke Figora, reason to be optimistic. As we all look to what associate vice president, chief risk and Chief risk and recovery officer: The CRO’s changing role| Resilient: Confronting the COVID-19 crisis E17

Tamika Puckett: Good afternoon. I have responded to COVID-19 and what you ensuring regulatory compliance from the would say that taking from the title of this saw as your primary role during the crisis. human resource and health and safety podcast, I’d say that knowing that the people perspectives. Now, as we begin to enter our from this country, and the world, for that Luke Figora: Sure. Like many others, phased reopening, my focus has turned matter, are resilient. That gives me hope I think it’s evolved over time, but the towards long-term planning, with the focus for the future. We adjust and we adapt institution responded quickly to, I would on achieving operational efficiency. So not to all of the challenges that are thrown at say, the emergent situations—what was just turning the switch back on to the way us. We survived the pandemics within the initially an international incident into a things used to be, but how can we improve pandemics, and we will get through this. domestic emergency response, and then things moving forward so that we’re in a into domestic and international recovery. much better position? Mike Kearney: I love that, the ability And so that’s how we’ve seen—a little bit to adapt. I mean, gosh, there’s so many high-level—the institution’s perspectives Mike Kearney: Tamika, you made a incredible stories about how people have change as we go through this. My role has comment that I’ve heard from many of my adapted, whether it’s working from home been somewhat interesting. So I, at the clients, and that is that they had business or teaching their kids at home, all that great outset, led the crisis management team and continuity plans. And oftentimes, they would stuff, so great answer. How about Luke— emergency response efforts. So trying to literally the words you used, “sit on a shelf,” what gives you hope for the future? coordinate all those moving pieces across and they would not have been tested. Are the university, and as we’ve now moved into you guys beginning to think about how you Luke Figora: Specifically to Northwestern recovery mode and planning for, hopefully, may change that in the future? I know that and what we’ve seen through this process, an academic experience on campus in the you’re just trying to recover at this point in I would say one thing that I’m encouraged fall, leading most of the university’s return- time, but what are your thoughts on that? and optimistic about is just how we’ve to-campus planning efforts as well. So you Like, how can you do it differently in seen our campus community come know, I started on emergency response and the future? together with a shared vision. And while crisis management and triage from minute those individual silos have opinions and to minute, hour to hour, and now, with more Tamika Puckett: So what was interesting— different work streams, I think, more than of a longer-range strategic planning element, I’m fairly new to the city. I’ve been here, I ever, we’ve jelled as a leadership team and as we think forward about how do we do think this month may make a year, so about as a campus community towards, again, what we want to do in the most safe way. So six months in is when, you know, all of this kind of that shared vision. And so it’s so it’s been an interesting journey. kind of kicked off—but I had been meeting many times, I think, in corporations or in with all of the various leadership in the institutions as large as a research university Mike Kearney: Tamika, how about you different departments. And one of the first like Northwestern, you’re not always on the and your role? How did you respond to departments I met with was our emergency same page. And I think maybe more than COVID-19, and what did you see your operations center, known as OEMC. OEMC ever before, we’ve seen that something primary role during the crisis? is responsible for COOP planning [continuity like this does bring us all together with that of operations or business continuity]. And same approach. Tamika Puckett: Sure. Well, the city of in meeting with them, some assistance Chicago has led a coordinated response was expressed from them to really enforce Mike Kearney: Isn’t it funny? I’ve seen so to COVID-19. From the very beginning, we the importance of ensuring that continuity many different examples of programs or instituted a workforce committee that’s planning is taken seriously. And believe it or changes that often takes weeks, months, made up of a cross-functional team of city not, we actually had a meeting planned to or even years to implement. I think there’s leaders. That team includes members from kick off our continuity planning sessions with a sense of urgency to do things quickly HR, the mayor’s office, law department, the city scheduled for March, the 14th. and ensure that you make an impact in the and labor. We have lots of labor unions moment, that these things that required a here, budget, and facilities management. Mike Kearney: Oh, well, that Friday, I think lot of conversation and collaboration are I’ve cochaired that team with the mayor’s that was . . . right? getting into resolution so much quicker. office, policy leadership, and human I’ve seen that in many different ways as resources. Specifically, my role has been Tamika Puckett: Friday before the well, Luke. to ensure enterprise-wide, consistent, world ended. and coordinated response, beginning with Luke, as I go through this conversation, I’m continuity of operations planning. We’ve Mike Kearney: Yeah, exactly. And maybe, going to kind of divvy up and start with each had a plan, we have a plan, but how often Luke, let me go back to you. What were of you at different times with the questions. that plan is tested is always a question. some of the most significant issues or risks So, Luke, I’m going to stick with you, and let’s Oftentimes, it sits on a shelf, but in addition that you’ve been dealing with over the last get to the meat of the conversation, and to continuity of operations planning, few months? And I guess, as you talk about that’s really how you and your organization we’ve also implemented various human those, did you feel prepared in the midst of resources policies and also focused on the crisis to address those? 2 Chief risk and recovery officer: The CRO’s changing role| Resilient: Confronting the COVID-19 crisis E17

Luke Figora: I would say that there’s I can’t say that I was totally prepared. I Risk managers such as myself are now obviously been a significant number of was still trying to figure out where things being included in those C-suite strategic health and safety and logistical risks, right? were and what state they’ve been in. planning conversations with a focus on Just from the outset, international travel However, what better way to learn your qualifying and quantifying the impacts of and getting people back to the States. The organization than being thrown into the likely or unlikely threats to operations and health and safety impact drove some of the midst of an emergency? I’d say that the to our bottom line while we’re performing initial pieces of things. And then we had an biggest risk here has been ensuring, for analysis and creating an update in our unexpected kind of large move-out, right? me, enterprise-wide consistency. We’re a risk registers. We’re now experiencing the So we, all of a sudden, had to move out most workforce of about 35,000 employees, more benefits of paying closer attention to those of our students from campus and leave than 30 departments and sister agencies, low-likelihood, high-impact situations. And just a small subset around and take care of and a number of different labor unions. I think, because of this, municipalities in them. I think we were actually relatively well Traditionally, and not unlike many other particular are allocating, or at least thinking prepared to deal with those kinds of things, large government entities, we’ve operated in about allocating, resources for those black because we’ve got strong safety protocols, silos, which has resulted in inconsistencies swan–type events. we’ve got good operational leaders that can and interpretations of laws and regulatory enact most of what we need to do there. guidance, operations management, and Mike Kearney: I love that. And Tamika, I One risk that came up, I think, that we application of policy. I would say that we’ve think I have a recommendation for your adapted to, but it emerged over and over done an excellent job moving forward and new title. Maybe you call yourself, rather again, was the policy-level elements that ensuring a coordinated and consistent than the CRO, just a “worst-case scenario really interacted with students in academic response, which has set the stage to thinker.” That’s what you could go and tell programs. Things along the lines of . . . When reduce these risks moving forward and in everybody. I think that would be great. That you start focusing on the safety elements, support of increased transparency as we would tell everybody what you do. I’m being very quickly it shifted from, “Okay, well, I’m move forward. a little funny, but Luke, how about you? How back at home, and I’m safe, physically safe, has COVID-19 changed how you allocate but what does this mean for my academic Mike Kearney: Tamika, I want to stay with resources? And I’d love also for you to weigh program? Do we have to give grades? Is it you, and how has COVID-19 and the last in on this notion of rethinking how you pass/fail? What if I want to withdraw? How few months changed how you allocate approach these high-risk, low-probability does it affect my eligibility? What about my resources, maybe during kind of the crisis scenarios or risks of future. financial aid?” So there are all these policy- response? And maybe there’s some thinking level questions that were nearly impossible about how you may allocate them differently Luke Figora: Yeah, I don’t know that to anticipate in real time. Again, I think we in the future. What’s your thoughts on that? it’s changed our approach yet. I mean, adapted to those, but I’ll say that we didn’t obviously, we’re still in the midst of all this, have a playbook for all of those. And so it Tamika Puckett: Being a local government but I think by their nature, black swan events was just interesting to see the risks move entity, we don’t have a lot of flexibility in are nearly impossible to predict, and it’s from those logistical operational health reallocation of resources. In fact, like most impossible to predict the impact of them. and safety–type things to more of these cities, we’re always strapped for resources. And I think one thing that has become policy level, student activism, and public Unlike private companies and corporations, really evident to us as we’ve gone through perception–type things. we’re generally not revenue-generating, this is just how important it is to have a and we’re funded by tax dollars, so we do contingency. And you might not know what Mike Kearney: Yeah. It’s funny, because our best with what we have, but are most you’re going to apply that contingency there’s been a lot of conversations often focused on maintaining as opposed to—and here I’m thinking about financial like, “Could we have been ready for the to preparing for the unknown or what could contingency—but that there are chances pandemic?” And I actually have argued that I possibly happen. Municipalities often have that you’re going to get caught off guard by think we knew a pandemic, at some point in to make the choice between investing in something. And if you leave zero room for time, was probably coming down the pike. I optional measures of protection or fixing error and no margin, it becomes a lot more don’t think what we anticipated was shutting potholes. So do we buy the firewalls that we difficult to address. down the country and all of the issues and need to protect our cybersecurity system, risks that came out as a result of that. So or do we fix the potholes or address other I think that’s been clear in our mind, and it’s fascinating. How about Tamika? What were infrastructure needs that we have? been interesting. One other thing that I’ve some of the significant issues that the city found interesting as we’ve gone through of Chicago and you had to deal with, and did However, as these types of black swan this and as we’re in the midst of this right you feel prepared? events have become increasingly more now, when you think about kind of resource common, the job of the worst-case allocation, both financially as well as, I would Tamika Puckett: Being new to the city of scenario thinker—that would be me— say, bandwidth is . . . We’re trying to do three Chicago and still learning my organization, obviously has become more important. things at once, right? We are trying to—and

3 Chief risk and recovery officer: The CRO’s changing role| Resilient: Confronting the COVID-19 crisis E17

I’ll speak a little bit about Northwestern— push my way to have a seat at the table and understands the value in evaluating we are trying to get people back on campus really justify why it should be there. I haven’t a situation to determine what the that need to be back on campus tomorrow. had that experience here. I’m the first of possible outcomes might be. Also the key, I We wanted to reopen our research labs to my position, and she made the position a think . . . What she got was not just the ensure that research continues. So we’re cabinet position so that risk management evaluation, but also using experiences and trying to do that, while at the same time could be a focus. What I would say to those these types of events to evaluate them, to planning for the fall and how we get 20,000 who have to fight to have a seat at the table determine how you might do things students back on campus to resume an is to keep fighting, keep making yourself differently to prevent them from occurring academic program, while at the same time heard, and use scenarios like what we’re and reoccurring. And that’s really one of her planning for the long run and looking at experiencing right now. These are the key focuses regarding liability management opportunities to make structural changes unlikely situations that have high impacts. for the city. We pay out a lot of money. It’s to the university that make the most Use these to demonstrate why you should been in the newspapers and, you know, sense, right? have a seat at the table. liability claims. And so the primary focus of just evaluating, using the information, using And so you’re trying to do three things at Mike Kearney: There’s almost a couple of our experiences to make ourselves better. once. And those three things don’t always follow-up questions. So it sounds like what perfectly align with each other, and you’ve you’re saying is, you have, or you will in the Mike Kearney: Great. Luke, I’d love to get got to figure out how to allocate resources future, almost always use some scenario your thoughts on this. Hopefully you’re as across each one of those. And that’s been planning—not necessarily to say that these fortunate as Tamika, but what would you just an interesting thing to go through, as things are going to happen—but if they recommend to other CROs to demonstrate we’ve tried to navigate this process. On your happen, here are the risks that potentially the value of risk to their leaders? What second question, we actually just were in would be present, and here’s some things advice do you have for them? the process of giving an ERM update to our that we should do. Is that kind of the process board of trustees, and it is notable. We’ve that you’re going through, or is it something Luke Figora: No, I mean, I’ve been luckily got a ton of high-impact scenarios that are different from that? similar, I think. We’ve got an organization just relatively low-likelihood, and just by that is in tune with risk. And I think, for the the sheer nature of math, those tend to Tamika Puckett: That’s absolutely the most part, the higher education industry kind of fall lower on a priority list, the way process. It’s been great that I’ve been here is. In many ways, colleges and universities they kind of average out. And again, I don’t at the time that I arrived, because I’m not are just big balls of risk when you figure know if we’ll give those more attention or so sure that, had we not had a risk manager students and athletes and police forces and less attention in the future, because we’re involved with workforce management, dorms and kind of go through the laundry trying to navigate this one right now, but it’s that we would have consistency across the list of things we get to deal with every day. definitely been something that has at least board. So use this as an example, and use I think people are pretty well kind of in raised its head as we’ve gone through this. these situations as examples, to show why tune with that and understand the reasons planning is necessary. why you need to be plugged in to kind of Mike Kearney: Absolutely. And I guess one the upside and the downside. You know, of the questions I would have for you guys Mike Kearney: Tamika, why do you think I actually have a slightly different thought is, as senior risk officers, I’m guessing you the mayor gets risk management? Was it on some of this stuff, just something that probably have a seat at the table now more just something that’s in her DNA? And what I’m starting to think about looking forward, than ever, but one of the questions, a lot of you are articulating is, she either gets it, or which is, I kind of wonder if this whole event times, I get from my clients is, how do you another executive doesn’t, and when they is actually going to make things slightly help leaders—and I’m talking about kind don’t get it, it makes it a whole lot more harder for some risk officers or risk leaders. of the nonrisk leaders—really understand difficult, because then you’re spending the importance of risk management? And a lot of your time and effort trying to And again, I think Tamika absolutely . . . in obviously, they probably understand it all a demonstrate how ERM or risk management terms of, it’s on everyone’s radar, right? lot more now than they used to, but what matters. But is there anything you could tie Like, we are all living and breathing this guidance would you give one of your CRO back to her experience that kind of points to all day long right now, and people get it. colleagues or peers, what advice would you how she got it and why she brought you in to Every decision we make has an element have for them on this question? do the work that you’re doing? of risk, and they’re exceedingly cognizant of that. But when I think that someday, Tamika Puckett: That’s an interesting Tamika Puckett: I would think that . . . this pandemic is over, and we’ve got some question. And I say that because I consider Mayor Lightfoot is a long-time public degree of normalcy, I kind of wonder if those myself very lucky in that my boss, Mayor servant of the city. She’s been here. She’s risks that we used to focus on, people start Lori Lightfoot, has made risk management been in various different organizations and saying, “Well, we navigated a once-in-a- a priority for the city of Chicago. In other departments that have been . . . that serve lifetime pandemic that turned things on its organizations, I will say I’ve had to kind of the public. She’s an attorney. So she head, and how big of a deal is IT security, or 4 Chief risk and recovery officer: The CRO’s changing role| Resilient: Confronting the COVID-19 crisis E17

how big of a deal is the safety?” Again, you Mike Kearney: Luke and Tamika, I’m need an academic affairs kind of subgroup, pick and choose whatever you want to focus actually really curious, because it obviously and we’re going to need a mass care on. I wonder if it’s going to minimize the way may change the way that we identify and subgroup,” and all these things that were some of those risks that we’ve had in the monitor risks, but my gut instinct—I’d love actually relatively specific to a pandemic past and worried about, when you compare to get your thoughts on this—is that the event. Now, again, this pandemic was much it against what we just all went through, if way maybe we prepare for crisis, even larger than any pandemic we would have that makes sense. though we may not know what crisis is ever planned for or drilled for, but yeah, I coming down the pike, may change. And I think it just reinforced . . . Having that chassis Mike Kearney: It does. It’s almost like remember talking to a lot of clients, and we there is helpful at a minimum. you’ve created this new bias, because had research that said every organization, there’s some self-confidence in the fact on average, is probably going have some Mike Kearney: That’s actually really helpful. that we just navigated the most difficult sort of a crisis once every five years, and Tamika, what are your thoughts? crisis ever, and now all these little risks that executives would never disagree with you. we’ve been talking about for years aren’t The challenge was, when you took that, Tamika Puckett: I would agree with Luke that big of a deal, because if they somehow which is “I don’t know when it’s going to on that matter. Having a plan does give you materialize, we could get through that too. happen and I will actually deal with it when it some foundation as to how to work through That’s fascinating. I haven’t actually heard happens,” and you brought that up against and manage through these types of black that that perspective. I don’t know what all of the other priorities that they have— swan events, or any event, for that matter. Tamika . . . If you’ve got similar thoughts, and you guys have touched on some of For the city of Chicago, we can’t close our I’d love your reaction to what that Luke them—it was difficult for them to focus on doors and turn our lights off. Like a lot of just shared. that. Rightfully so. But do you think that’s private-sector companies can, we can send going to change in the future? Whereas they some of our folks home, but we provide Tamika Puckett: No, that was very say, “You know what, we probably weren’t as public safety services. We provide public insightful, and I had not considered that. It prepared.” And obviously, that’s different for health services and infrastructure services, was extremely insightful. My eyes actually every industry and every organization, but water, trash, things of that nature. And got big when he said that. I was like, “Wow. do you think that they’re going to pay more so we have to figure out a way, we have You know, I could definitely see that attention to crisis preparedness and maybe to manage through these crisis in these happening.” The only thing I would say that what they did in the past? And maybe, Luke, types of situations. And certainly, having a might caution us against doing or seeing it I’ll start with you and then, Tamika, you could crisis preparedness plan was helpful in this that way is when we start to quantify and give your thoughts? situation. I think what it has additionally put the dollars on it. When we’re looking at done for us is make us look at other ways the bottom line and looking at the impacts, Luke Figora: I think most organizations of operational efficiency. What are some although we can survive it, do we want to have to become more and more aware alternatives that we can implement in order experience the losses that come with not of this, just given everything else that’s to ensure that we can continue to operate in taking it as seriously or not necessarily been going on in the world over the last things such as pandemics or any other black addressing it like we would have in the past couple years. I think we all understand swan event? pre–COVID-19? the importance of crisis management. I will say that what’s become clear, right, for Mike Kearney: Awesome. So I want to turn Luke Figora: Yeah. We’re in the middle of an something like this is there’s zero way to our conversation to ERM, and everybody event that truly turns the higher ed industry, plan for all the elements in advance. And that listens to this podcast are not ERM and kind of what we think we are in the role every tabletop drill that you do, you’re never experts. So there’s obviously a framework, we play, upside down. But we are based on going to be able to plan out each individual and there’s principles that bring enterprise bringing people together for them to learn. issue that’s going to come your way. At risk management to life. I know that both of We think there’s benefit to that happening Northwestern, we had a pandemic plan and, you are very close to that. I’m curious, and in person, the shared experience, building yes, that pandemic plan had been on the change to Tamika, I’m going to I’m going to a community, and all of a sudden, we’re in shelf for a couple years, and we hadn’t really start with you so that we continue to mix it a world where we can’t do that as well, or actively tested it in a while. up. Do you see ERM, the principles and/or it’s much harder to do. And so I do wonder, the framework, changing at all as a result of coming out of this, if it’ll give us another But I’ll say that even having that shell there COVID-19, or you could also take it, do you reason to look at the business model and helps you know—and again, by no means see how you apply those principles changing those things that we think make us unique did we have everything figured out in over time? as an industry and the value that we bring advance—but it gave us a structure. And and make sure that we’re doing everything we didn’t have to—and I’m thinking at the Tamika Puckett: I think that we’ll see a we need to do to protect that. earliest outsets of the pandemic—we didn’t more widespread application of existing have to figure out, “Oh, well, we’re going to ERM principles moving forward. ERM was 5 Chief risk and recovery officer: The CRO’s changing role| Resilient: Confronting the COVID-19 crisis E17

already rapidly spreading. It’s been heavily Mike Kearney: I love that Luke and I guess leaders about ERM, how do you position it? used in the private sector for a number building off on that, if you were to go and And you can also build off on this question of years and started to transition into talk with one of these unit leaders and around how does it help them make government entities over more recent talk about the value of ERM, how would better decisions? times. I believe that businesses, as well as you describe how ERM, can help them public entities, are experiencing the benefits make better decisions? And if there’s other Tamika Puckett: I certainly think that of being proactive in identification and benefits that you would emphasize in risk . . . While they shouldn’t define your management of risks, as opposed to reliance convincing them that this is an approach, a strategy, they definitely should inform upon reactive measures such as insurance. framework that would help them run their your strategy. I think that awareness and So I do think that the application of ERM organization more effectively, what would consideration towards the possibilities principles as they exist will be more widely you say to them? are . . . what should be considered and used and applied. taken into account. Luke Figora: Yeah, I mean, I always say Mike Kearney: Awesome. Luke, what are that risk should not drive decision-making, Mike Kearney: We are nearing the end, your thoughts? right? Risk should not set your strategy, and I have one last question that I think is but you should have a strategy and you critically important to all the CROs and risk Luke Figora: I agree. I think we’ll continue should be aware of the risks kind of to that. professionals out there, and what I’d love to see things ERM kind of evolve towards And kind of a proactive, ERM, risk-sensitive to do—and Tamika, I’m going to start with strategy, right? And we’ve seen that in approach will help you more likely than not you—is, I want to get your perspective on recent updates of ERM models, this kind achieve your strategy, you know, without what you believe CROs should do in the of importance of tying it to institutional the downside. And so that’s how I always future to be perhaps better prepared for strategy. And I think, you know, here, this is talk about it with them. You know, we’ve the next crisis. And you can take it in any just a great reinforcer of a major risk that’s got local budget management and all this direction that you want. So, Tamika, what you know, again impacting the strategy kind of stuff and everyone’s got a degree do you think CROs should do to be better of many companies and institutions. And of you know, operational autonomy and, I prepared for the next crisis? so I think we’ll continue to see a tie there. always tell people, to the extent that we can And again, I think we’ll see more and more help you think through your local risks, it’s Tamika Puckett: I think that CROs should interest. We talked about senior leaders, going to help you be successful at the end definitely educate their organizations as to but I think we’ll see more and more interest of the day, and that’s in turn going to help the benefits of risk management from an of in our world that we kind of call local you with resource allocation and rankings enterprise standpoint. I think CROs should business owners, right. So, you know, and everything else. So, I actually don’t think be involved in planning from a strategic individual VPs or unit heads look to more it’s too hard of a sell. I do think people are standpoint and also from a response embed elements of risk management, ERM, pretty sensitive to this at this point. standpoint. Creating your business strategy, at their local levels, right? And you know, your operational strategy, as you look we’ve got a business school, med school, Mike Kearney: I think the one thing that forward—a lot of companies do this at the communications and all the things you you’ve said and as a big learning for me beginning or prior to the beginning of their would expect at a research university. And and what I oftentimes will share with my fiscal year—ERM should be be included you know, each one of those schools has a clients that I just want to emphasize is in those conversations. In addition, ERM slightly different risk profile and I think what you started with strategy and you also should also inform your business continuity you’ll start to see them do. We’ve seen it said that risk shouldn’t drive strategy. plans, so the what-ifs, as I mentioned before, again, some of this has been public, we’ve But one of the things that has oftentimes are considered, and so that we’re being talked about, you know, our business school been disconnected and I think has not more proactive as opposed to reactive. has seen some real disruption in executive served ERM well is not connecting it to education, which depends on travel whatever, whether you call it strategy or Mike Kearney: With that, Luke, take us from abroad and locally and companies the organizational priorities or what have home. What would be your advice for a sponsoring executive seminars. And that’s a you, but if you at least speak in the leaders CRO so that they’re better prepared for the risk that the rest of our campus doesn’t face vernacular, like here are the things that are next crisis? as much. So I think you’ll start to see that important to you, here’s what you want to those principles applied at some local levels. achieve. And we’re going to help you think Luke Figora: Yeah, I think we are uniquely And again, it’ll be on a risk owner to, or a risk about those risks and manage them. It’s adept to obviously navigate crisis situations. officer to aggregate all this stuff across the often the greatest place to start, at least in It’s part of why we’re here. And so, again, institution and tie it to an institutional kind my experience. I think most of us are prepared, but one of view of risk. thing I would really say—and this hearkens Tamika, what about you, what are your back to a talking point I’ve used a little more thoughts on this question? When you talk to generally kind of when speaking about my 6 Chief risk and recovery officer: The CRO’s changing role| Resilient: Confronting the COVID-19 crisis E17

career or about kind of the path you know, provide value. That is a fantastic way to end kind of leadership path, you know—is how it. So, Luke and Tamika, I really appreciate essential it is to understand every element your time. I know both of you are extremely of your business and the business model busy. We’re still right in the middle of the and the triggers that potentially disrupt that. pandemic, among other things. So thank you I think where risk officers sometimes lose for your time and all of your insights today. credibility or impact is, you’re being siloed and maybe not being as in tune to how Luke Figora: Thanks for having us, Mike. things really operate. Appreciate it.

I’ve been able to get a firsthand look at some Tamika Puckett: Absolutely. Thank you. of this stuff, and we’ve seen the pandemic has impacted the endowment, obviously Mike Kearney: Thank you, Tamika and it’s impacted cash flow, it just more Luke. Amazing, amazing insights. We’ve generally impacts the student experience covered a lot of topics over the last couple in grading and academic accreditation. months, and we have an incredible backlog And if you have a good understanding of of guests that are going to continue to bring all that stuff, you can help tie it together, to you. But I want to hear from you. What because I think what we see is, across topics do you want to hear about? Let me institutions, there’s very few people that know. You can hit me up on LinkedIn or really understand everything. And so, yeah, Twitter; for those of you who have, thank that’s my big talking point is, understand you. It is incredibly helpful to hear from you, every single element that you can about and it helps us prioritize which topics we your organization, about your company, bring to you next. For more insights across about how the business works and where all aspects of COVID-19, just go to deloitte. there are thresholds, and that’ll help you be com on our COVID page. You can also listen able to navigate these situations in a way to the Resilient podcast on Apple Podcasts, that actually brings—like Tamika said at the SoundCloud, Stitcher, Google Play, and even outset—kind of play the coordinating body Spotify. Until next time, stay safe and that brings all these things together in a way remain resilient. that hopefully brings a good result at the end of the day.

Mike Kearney: Oh, I love that. It’s almost like, be a student of your organization. There’s oftentimes so much emphasis and focus on the more technical elements of risk management. And, Luke, what I’m hearing you say is, that’s great—well, you didn’t say that, but I’m going to infer that— that’s great, but what really effective CROs or risk management professionals do is understand the organization, that business, the university, the city, so that they could

About Deloitte Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the “Deloitte” name in the United States and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting. Please see www.deloitte.com/about to learn more about our global network of member firms.