Enterprise Risk Management (ERM) gained a foothold in higher education during the first decade of the 21st century. College and university governing board members came to their board service with the perspective and experience of having served on corporate boards and in corporate leadership positions where ERM was in active use. Trustees asked senior leaders at colleges and universities to begin ERM programs. As a result of these requests and financial pressures, public and private institutions are now implementing ERM business processes to support strategic and annual planning and also analyses of major new initiatives. Institutional leaders are evaluating not only the downside of risk (i.e., what could go wrong) but also the upside--the opportunities presented by taking on additional risk. These authors state that, even though enterprise risk management engages the entire higher education institution, IT organizations have an opportunity to use ERM to move beyond a services function toward providing strategic value to the institution. The article presents the four steps of ERM: (1) Identify risks: create a risk register; (2) Assess the likelihood of risks and their impact on the institution; (3) Develop a risk management plan; and (4) Measure, track, and communicate risk. By leveraging ERM, IT leaders are well positioned to engage with senior administrators and with others throughout the organization.