Risk and Opportunity Management

At Hasan Kalyoncu University, risks and opportunities are managed under the KYS.PR.06 Risk Assessment Procedure within the scope of the TS EN ISO 9001:2015 Quality Management System. The purpose of the procedure is to set out the methods and principles for identifying, analysing and evaluating risks and opportunities that may affect the achievement of the institution’s aims and objectives within the quality management system, and for planning, implementing, monitoring and continuously improving the appropriate actions.

1. Scope and Basis

The procedure covers the activities carried out in all academic, administrative and support units of the University, and the risk and opportunity assessment activities of senior management, unit managers, academic and administrative staff and all other stakeholders involved in these processes.

The procedure has been prepared on the basis of Higher Education Law No. 2547, the Higher Education Quality Council (YÖKAK) Institutional Accreditation Programme criteria, the TS EN ISO 9001:2015 Quality Management System Standard, the TS ISO 31000 Risk Management Standard, Occupational Health and Safety Law No. 6331 and the provisions of the Regulation on Occupational Health and Safety Risk Assessment concerning the handling of risks and opportunities, together with the University’s relevant internal regulations.

2. Key Concepts

Concept	Definition (KYS.PR.06)
Risk	The positive or negative effect on objectives of uncertainties that may affect the University’s achievement of its strategic aims and objectives and the fulfilment of its duties.
Opportunity	A positive condition or situation that supports the improvement of processes, the enhancement of performance or the achievement of objectives.
Internal / External Risk	Internal risk: risks to which units may be exposed while carrying out their activities. External risk: risks arising from events beyond the control of units.
Risk Appetite	The level of risk that the University is prepared to accept in pursuing its strategic aims and objectives and that is defined as tolerable should it materialise.
Risk Tolerance	The acceptable range of deviation within the defined risk appetite.
Residual Risk	The level of risk remaining after the measures and controls taken to reduce the likelihood or impact of the risk.
Risk Owner	The unit or person responsible for managing and monitoring the risk and implementing the necessary actions.

3. Duties and Responsibilities

Quality Commission (chaired by the Rector): identifying risks, gathering expectations and requests, setting risk priorities, reviewing risks annually, and evaluating changes and improvements to procedures and processes.
Directorate of Strategy and Quality: coordinates risk management work and reports periodically to the Quality Commission; provides technical support and guidance so that risk management processes operate effectively in all units; identifies training needs in risk management and coordinates and delivers training activities.
Faculty / unit managers and unit quality officers appointed by official letter: responsible for carrying out the processes defined within the quality management system.

4. Identifying Risks and Opportunities

Risks and opportunities are identified taking the following inputs into account:

assessments carried out by process owners,
strategic plan and institutional objective analyses,
internal and external audit results,
process performance indicators and monitoring results,
stakeholder feedback, satisfaction surveys and complaints,
nonconformities and corrective action records,
Management Review meeting outputs,
changes in legislation and legal requirements,
internal and external environment analyses and the needs and expectations of interested parties.

Where necessary, strategic analysis methods such as SWOT Analysis are used. According to the Quality Manual, threats and weaknesses identified through SWOT analysis are treated as risks; the current threats and weaknesses identified in the SWOT analysis carried out under the Strategic Plan are evaluated in the risk analyses of the relevant units. Strengths and opportunities are defined in the strategic plan.

In the objective cards of the 2023–2027 Strategic Plan, risks and strategies are defined for each objective alongside its performance indicators (Strategic Plan, pp. 74–84).

5. Risk Assessment Method: 5×5 Risk Matrix

Risks are assessed with the 5×5 Risk Matrix Method, taking into account the likelihood of occurrence and the impact the risk would have if it occurred:

Risk Score (R) = Likelihood (L) × Impact (I)

Score	Likelihood	Impact (Severity)
1	Very Low — The risk is not expected to occur, but may arise in extraordinary and exceptional circumstances.	Acceptable — An insignificant risk requiring no management; it does not affect the process directly or indirectly.
2	Low — May occur if certain conditions arise; its occurrence is not expected.	Noteworthy — A risk that does not affect the process directly but affects it indirectly.
3	Medium — Similar situations have occurred from time to time or may occur under certain conditions.	Moderately Significant — A threat-level risk that must be monitored and kept under control and could disrupt the process at any time.
4	High — Similar situations have recurred, or the risk is expected to occur.	Significant — A risk that seriously disrupts processes or even brings them to a halt.
5	Very High — The risk is almost certain to occur as long as current conditions continue.	Critical — An unacceptable risk requiring definite and urgent intervention.

Risk Analysis Matrix (Likelihood × Impact)
Likelihood Impact	1 Acceptable	2 Noteworthy	3 Moderately Significant	4 Significant	5 Critical
5 Very High	5	10	15	20	25
4 High	4	8	12	16	20
3 Medium	3	6	9	12	15
2 Low	2	4	6	8	10
1 Very Low	1	2	3	4	5

Risk Score	Assessment and Action to Be Taken
15–25 · Urgent Action	Risk-reducing action is planned and implemented immediately to bring the risk down to an acceptable level; corrective action is initiated if a nonconformity occurs; the necessary resources are allocated and the matter is reported to senior management. The action is completed as soon as possible and its effectiveness is evaluated.
9–12 · Significant	Actions to reduce the risk are planned and implemented; their effectiveness is monitored so that the risk is brought down to an acceptable level. The actions are completed within the planned time and their results are evaluated.
6–8 · Acceptable	Existing controls are maintained; improvement actions are planned where deemed necessary. Actions are implemented according to plan and reviewed periodically.
1–5 · Low	Existing controls are considered sufficient; no additional risk-reducing action is required. The risk is monitored and reviewed periodically within existing processes.

6. Responding to, Monitoring and Reviewing Risks

Identified risks are evaluated by process owners in light of their risk levels, and control actions are planned and implemented to eliminate, reduce, accept or turn the risk into an opportunity. The response options defined in the procedure are reducing the risk, accepting the risk, transferring the risk and avoiding the risk. The effectiveness of the measures taken is monitored by process owners and the Directorate of Strategy and Quality.

Risk analyses are reviewed at least once a year or whenever needed. If risks materialise despite control measures, if the risk level changes, or if new risks and opportunities emerge, the process owner reassesses the risk; where necessary a Corrective Action Form is initiated and the Risk Analysis Plan is updated. Risk assessment results are evaluated at Management Review meetings and improvement actions are planned.

7. Identifying Opportunities

Opportunities are identified by considering matters that may contribute to the University’s strategic objectives, improve process performance, increase stakeholder satisfaction and support institutional development. Identified opportunities are evaluated in terms of feasibility and benefit, and improvement actions are planned and monitored. Opportunities may be considered in areas such as new education models, digitalisation, process improvement, meeting stakeholder expectations, efficient use of resources and developing institutional capacity.

8. Unit Risk Analysis Plans

For each risk, unit risk analysis plans record the risk description, the measure taken, the related document, likelihood, impact, risk score, risk category, risk treatment method, responsible person, deadline, resources and how the results will be evaluated; in addition to the initial assessment, a residual risk assessment is also carried out.

Within the 2026 update, risk analysis plans have been prepared for the following administrative units:

Document No.	Unit
KYS.PL.01 (PDF)	Directorate of Strategy and Quality
BH.PL.01 (PDF)	Directorate of Corporate Communications
KD.PL.01 (PDF)	Directorate of Library and Documentation
KE.PL.01 (PDF)	Directorate of the Guesthouse
ÖİM.PL.01 (PDF)	Student Affairs Office
PM.PL.02 (PDF)	Directorate of Staff
SA.PL.01 (PDF)	Directorate of Purchasing
SKS.PL.01 (PDF)	Directorate of Health, Culture and Sports
YİM.PL.01 (PDF)	Directorate of Correspondence and General Records

At the Management Review meeting of 22.04.2025, it was reported that the common risks of the faculties had been revised in the Faculties Risk Table, which is open to the shared use of faculty quality representatives, and that the faculties had drawn up the faculty-wide risks to which they are subject.

9. Development of Risk Management (PDCA)

Date	Development
20–22.11.2023	In cooperation between the Directorate of Strategy and Quality and the Turkish Standards Institution (TSE), “ISO 31000 Risk Management System Standard” training was provided to faculty/school quality coordinators, administrative unit quality representatives and staff working on quality documents.
21.02.2024	At the Quality Commission Management Review meeting, information was given on updating the risk plan and the risk assessment procedure and putting them into use, in line with the recommendation made by TSE during its review visit the previous year.
22.04.2025	At the Management Review meeting it was reported that the risk tables of the processes had been revised in January/February 2025, and it was decided that risk analyses would be updated once a year.
28–29.04.2025	In the TS EN ISO 9001:2015 recertification audit, one minor nonconformity relating to risk management (clause 6.1) was identified; reviewing the risk tables and risk management training were planned as corrective action.
16–17.10.2025	TS ISO 31000 Risk Management Training certified by TSE was organised for the institution’s quality representatives.
07.07.2026	At the Management Review meeting it was discussed that the Risk Procedure and the risk tables of the processes had been revised and that significant risks had been identified with the units and preventive work started; it was decided to monitor risks and opportunities relating to the education and training, research and development, quality management system and social contribution processes and to hold a Risk Workshop.
21.07.2026	A Risk Management Workshop was held with the participation of academic and administrative unit quality officers. Unit-based risks were identified on the basis of unit performance indicators, process performance results, monitoring and evaluation outputs and external evaluation results; units developed improvement proposals for the risks relating to their own processes.
30–31.07.2026	In the TS EN ISO 9001:2015 1st Surveillance Audit, the handling of risks and opportunities was also evaluated; the clause 6.1 nonconformity identified in 2025 was found adequate and closed, and no nonconformity was identified in the audit.