{"id":3733,"date":"2026-01-16T14:56:22","date_gmt":"2026-01-16T14:56:22","guid":{"rendered":"https:\/\/sites.exeter.ac.uk\/digitalbuzzuoe\/?p=3733"},"modified":"2026-01-19T12:04:08","modified_gmt":"2026-01-19T12:04:08","slug":"strengthening-risk-management-across-digital-transformation","status":"publish","type":"post","link":"https:\/\/sites.exeter.ac.uk\/digitalbuzzuoe\/strengthening-risk-management-across-digital-transformation\/","title":{"rendered":"Strengthening Risk Management Across Digital Transformation"},"content":{"rendered":"\n

By Claire Hammond and Gareth Jones, Senior Delivery Managers, Digital Transformation Division<\/strong><\/p>\n\n\n\n

Risk management isn\u2019t just a compliance exercise – it\u2019s fundamental to delivering our ambitions. Across the Digital Transformation Division, every team and role has a part to play in identifying, understanding and managing risk.<\/p>\n\n\n\n

Risk management is how the University identifies, understands and responds to the things that could prevent us from achieving our goals. It helps us anticipate challenges, prioritise what matters most, and make informed decisions. Risk management is also about balance – if we are too risk-adverse we’ll never get anything done. As a transformation team, we are responsible for delivering major programmes of work, protecting our services, and supporting staff and students effectively, so finding the right balance is crucial.<\/p>\n\n\n\n

When we joined the Division in April 2025, we took on responsibility for overseeing the Divisional risk register in CAMMS<\/strong>, the University\u2019s corporate risk management system. While the risks we inherited were sensible, it quickly became clear that the register no longer fully reflected the realities and challenges facing the Digital team.<\/p>\n\n\n\n

Some risks had been on the register for a long time, and others lacked the clarity needed to drive meaningful action. With fresh eyes, we saw an opportunity to reset our approach.<\/p>\n\n\n\n

\n\n\n\n

Why Structure Matters in Risk Management<\/h3>\n\n\n\n

In our previous roles, we\u2019d seen the value of writing risks in a clear, structured way. Widely accepted best practice is to frame risks as:<\/p>\n\n\n\n

There is a risk that <an event will occur> because of <root causes> resulting in <impacts>.<\/strong><\/em><\/p>\n\n\n\n

This structure forces us to identify root causes, which makes it far easier to agree actions that genuinely reduce the likelihood or impact of a risk – rather than just describing the problem.<\/p>\n\n\n\n

For example:<\/p>\n\n\n\n

There is a risk of a data breach because of a lapse in security protocol, resulting in fines and reputational damage.<\/strong><\/em><\/p>\n\n\n\n

Clear structure leads to clearer thinking – and better decision-making.<\/p>\n\n\n\n

\n\n\n\n

From Theory to Practice: The Risk Workshop<\/h3>\n\n\n\n

To put this approach into practice, we brought together the Digital Leadership Team for a half-day, in-person workshop in August. The aim was simple: rewrite the risk register collaboratively.<\/p>\n\n\n\n

We began with an open question:<\/p>\n\n\n\n

\u201cWhat keeps you awake at night?\u201d<\/strong><\/p>\n\n\n\n

When ideas began to slow, we introduced a scenario:<\/p>\n\n\n\n

\u201cImagine it\u2019s 2028. UEB calls you in and says, \u2018You\u2019ve failed to deliver the Digital Strategy for 2030.\u2019 What could have happened to get us here?\u201d<\/strong><\/p>\n\n\n\n

It was a challenging exercise, but also a powerful one. It created space for honest conversation and surfaced concerns that don\u2019t always emerge in day-to-day discussions.<\/p>\n\n\n\n

\n\n\n\n

Turning Concerns into Action<\/h3>\n\n\n\n

Next, we asked:<\/p>\n\n\n\n

\u201cWhat would give you comfort for each risk or cause you\u2019ve identified?\u201d<\/strong><\/p>\n\n\n\n

This was a turning point. Many colleagues realised that much of the work already underway across the Division directly mitigates our biggest risks – but we hadn\u2019t previously articulated it that way.<\/p>\n\n\n\n

This conversation helped us:<\/p>\n\n\n\n