When an individual hears the term risk, he/she usually thinks of the financial institutions whose mismanagement of risk was instrumental in causing the 2008 financial crash. But all organizations, including colleges and universities, face various types and levels of risk, which threaten to harm the institutions and their ability to fulfill their missions. Today, as higher education institutions face increasing levels of scrutiny and competition for students, donor dollars and government funding, it is imperative that they focus more on assessing, preventing and managing the risks they face. Issues such as fraud or intentional or unintentional loss of nonpublic personal information can reverberate quickly, especially in an age of social media and networks, and harm the reputation of an institution. In this article, the author introduces Enterprise Risk Management (ERM), a process for identifying, analyzing, responding to, and monitoring risks, and discusses how it has been widely adopted in the financial world. ERM is designed to help complex organizations identify a broad spectrum of potential threats, assess those threats--both in terms of their likelihood and impact of their occurrence--and design responses to those risks. Financial risks are one facet of this approach. The author stresses that higher education administrators should recognize that implementing a more formal risk-based approach takes time, and many institutions have had success by taking an incremental approach. ERM also requires that auditors reorient their own audit plans to concentrate on areas posing the greatest risk.