The Implementation of Risk Management" (A Case Study at State Islamic University of Walisongo Semarang, Indonesia)

INTERNATIONAL JOURNAL OF MULTIDISCIPLINARY RESEARCH AND ANALYSIS ISSN(print): 2643-9840, ISSN(online): 2643-9875 Volume 08 Issue 11 November 2025 DOI: 10.47191/ijmra/v8-i11-50, Impact Factor: 8.266 Page No. 6323-6336 IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6323 The Implementation of Risk Management" (A Case Study at State Islamic University of Walisongo Semarang, Indonesia) Munjin1, Didin Kurniadin2 1UIN Saizu Purwokerto, Faculty of Teaching Training 2STAI Sayed Sabiq Indramayu ABSTRACT: This research discusses the risk management process applied at Islamic State Universities with a case study at UIN Walisongo Semarang. The research seeks to describe and analyze the risk management process by using interviews and documentation techniques. The analyzed data used was an interactive model, including data collection, data reduction, data presentation, and conclusions. The result showed that risk management has been well running at UIN Walisongo Semarangan, even though there is no risk management committee, and it is still attached to the Internal Supervisory Unit. The risk management process used the AS/NZS 31000:2009 standard which consists of the process of establishing context, risk identification, risk analysis, risk evaluation, risk handling, monitoring and review, and communication and consultation. If it is assosiated to the reputation of higher education, UIN Walisongo risk management has prepared anticipatory steps related to the reputation of the institution. These steps are damage control, reputational risk assessment, and management academic community control. KEYWORDS: Risk Management, Process of Risk Management, Higher Education A. INTRODUCTION Historically, risk management was initially applied to industries of insurance companies by considering risk, as the expected loss, multiplied by the risk value asset as the basis for the insurance premium coverage the company pays (Fasiha, 2014). The decade of the 1990s was a period of risk management revitalization marked by the awareness of business actors, policymakers, and regulators in various parts of the world. Awareness of the management urgency was triggered by the major financial disasters of the early 1990s, such as the case of Britain's Barings Bank in Orange County, California and Daiwa Next Bank, a German metals company, Procter & Gamble of the United States, etc. (Anwar, 2002). These events also happened in Indonesia. Due to failed investments, significant corruption struck Petamina corporation, which suffered a loss of Rp. 580 billion. This event was caused by the commissioners who obtruded to take over BMG's ROC block whose production did, in turn, not meet expectations, which was only 225 of the targeted 825 barrels per day. So, the production of the BM blog was closed because it does not have economically feasible (Praja, 2021). Still according to Praja, the occurrence of internal compliance violations is most likely due to the existence of GCG principles that are properly not implemented, especially the principles of transparency and accountability between commissioners, members, and the board of commissioners members. As a result, the internal compliance risk, at first, transformed into a legal risk for Pertamina as a whole, and Karen (the commissioner) was convicted of corruption case. Apparently, the risk of corruption does not only occur in public companies, but also happened in universities, both public and private. Indonesia Corruption Watch (ICW) found 37 cases of alleged corruption in universities during the last of 10 years 2006-2016. ICW said the amount of state losses caused by corrupt practices occurred at the university was Rp. 218,804 billion. Meanwhile, the actors who were involved in the 37 corruption cases consisted of at least 65 people, including academic managers, local government employees and the private sector. Most perpetrators are employees and officials both structural and university, as many as 32 people. The Chancellor or Vice Chancellor is the second most prominent actor with 13 actors. (Paat, 2016). The events figured in the paragraph above resulted in very significant state losses. Thus, the incidents inspired business practitioners, especially in the field of banking services and other financial institutions, to create tools that can be practiced by The Implementation of Risk Management" (A Case Study at State Islamic University of Walisongo Semarang, Indonesia) IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6324 top management to proactively monitor changes in the external environment and analyze decisions made by their operations managers. (Jukadi & Sopandi, 2018). The tool is a process for identifying, assessing, managing, and communicating risks, both risks arising from interactions between the organization and the external environment, as well as risks resulting from inappropriate decision-making. This process is known as risk management. Risk management is a new wave of solutions for management to face the challenges in a modern business (Widnya, 2019). In addition, Clough and Sears mention risk management is defined as a comprehensive approach to dealing with all events that cause losses (Clough & Sears, 2015). Meanwhile, Smith, in detail, defines risk management as the process of identifying, measuring, and controlling financially a risk that threatens the assets and income of a company or project that can cause damage or loss to the company (Smith, 1998). In order to anticipate that problem, universities need to enforce control over any risks that arise or implement risk management. Risk management in educational institutions has also an important role, because universities cannot escape from corruption risks. The phenomena show that several educational institutions have implemented management. However, the processes and procedures are somewhat different compared to financial and business companies. The risk management process in universities starts with risk identification, risk measurement, risk control and risk evaluation. These processes are continuous and involve the whole strategy in implementing it. (Raanan, 2009) Juridically, the risk management of State Higher Education Institutions is mentioned in Government Regulation Number 60 of 2008 concerning Government Internal Control System (SPIP) particularly articles 13 to 17. In the Regulation, it is implied that the leaders of government agencies should, both central and regional, apply risk management principles in handling existing resources which lead to achieve the objectives stated before. For the sake of an accurate risk assessment, the application of risk management in government agencies is absolute and obligation. It is aimed that the risk or obstacle can accurately be overcome and the institution's objectives can effectively be realized (Pemeritah, 2008). In the Appendix to Government Regulation Number 60 of 2008, concerning the List of Government Internal Control Tests in Part II of Risk Assessment, it is stated that the Heads of Government Agencies formulate risk management approaches and risk control activities needed to minimize risk and the evaluators must concentrate on setting agency goals, identification and analysis of risks as well as risk management when changes occurred (Kartika, 2015). Risk management is defined as a system or process carried out by personnel at every level of the organization to identify and manage risks to ensure organizational goals can be achieved (Rejda, 2006); (Thomas, 2010). Furthermore, Warburg said that risk management is a complete set of policies, and procedures, which are owned by the organization, to manage, monitor, and control the organization's exposure to risk (Warburg, 2004). In line with Warburg, Lam explained that Enterprise Risk Management is a comprehensive, integrated framework, to manage credit risk, market risk, economic capital, risk transfer to maximize firm value (Lam, 2004). However, according to the researcher, it is a way of identifying uncertainty regarding the occurrence of an event. In the statistics language, risk is measured by the variance of what is expected (expected value). This element of uncertainty often causes a loss or damage. Losses from the element of uncertainty (risk) can be manifested in various activities; both in economic, social, business and legal activities (Cassidy & Mattie, 2001). Studies on risk management have been produced by many universities, but ironically there are still very few universities in Indonesia that explicitly apply risk management in their institutions. This is may be due to the manager's perception that risk management is considered as something unurgent and a cause of fuse. In fact, almost all well-known universities abroad have implemented comprehensive risk management. For example, colleges in Europe which implement risk management have sharply risen compared to the previous decade (Vught, 2008). Another example is universities in the UK that have developed risk management in collaboration between the Higher Education Funding Council for England (HEFCE) and the leading consultant Pricewaterhoucecoper (HEFCE, 2005). There are several reasons why universities should apply risk management. Among others are the increasingly complex demands of the stakeholders, the lack of understanding of governance, the non-profit principle, and the autonomy of higher education. As a follow-up to the government regulation, state universities, especially those with Public Service Agency (BLU) status, have started implementing risk management. There are at least three factors that require them to implement risk management; namely the existence of government regulations, risk management advantages in achieving organizational goals, and the status of the university, BLU. By perpetrating risk management, university managers can prevent losses before befalling the institution. Because, risk is the possibility of an event which has impacts to loss or failure in achieving organizational goals (Griffiths, 2005); (Hanafi, 2006); (Standards Australia Limited, 2022); (Australia, 2007). The Implementation of Risk Management" (A Case Study at State Islamic University of Walisongo Semarang, Indonesia) IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6325 By performing risk management, State Universities can identify risks, the impact of their obstacles to meet the institutional goals and objectives, and prepare the most appropriate way to deal with it. In addition, the elements of uncertainty make the college managers pay more attention to matters relating to risk. They may try to identify the types of risks that may be appeared and how to mitigate them satisfactory. Based on preliminary observations, UIN Walisongo Walisongo Semarang with BLU status under Ministry Religious Affairs control have an awareness to implement risk management. This consciousness can be seen from the implementation of a probity audit approach in the procurement process of goods and services, budget reviews and activity reports (interviews, 2023). The Internal Audit Unit (SPI) of Semarang has conducted audits on the process of procuring goods and services from the planning, implementation, to maintenance processes. So, the this research wants to describe and analyze the Risk Management process, and also its impact to the university reputation. B. THEORETICAL FRAMEWORK 1. Risk Risk is related to uncertainty, this occurs due to lack of information about what will happen. Something uncertain can be beneficial or detrimental. Regan defines risk as a possibility that causes or suggests harm or danger. Mehr defines risk as uncertainty that creates a beneficial possibility known as an opportunity, while uncertainty that causes adverse consequences is known as risk (Mehr & Hedges, 1977). Hanafi classifies risk into two, pure risk and speculative risk. Pure risk is a risk when the possibility of loss and the possibility of profit does not exist. Examples: fire, accident, flood, and others. While speculative risk is a risk where we expect losses as well as profits. (Hanafi M, 2009) In this world, we inevitably face uncertainty. This element of uncertainty often causes a loss. This phenomenon is a universal trait, almost always exists in all aspects of human life. Losses from this element of uncertainty (risk) can manifest in various activities, both in the economic, social, and legal fields. To overcome all risks that may occur, a process called risk management is needed. Risk management is a management activity carried out at the executive leadership level, namely the activity of finding and systematically analyzing losses that may be faced by the company due to risk and the most appropriate method for dealing with losses associated with the level of company profitability (Kamal, 2019). Thus, the risk is a combination of the likelihood and consequence of an adverse event. Thus, there is a need for risk management which is important for an organization, including higher education institutions, because educational activities cannot be separated from risks that can interfere with the sustainability of achieving educational goals. Educational institutions and other organizations will always be faced with risks coming from interns or externs of the educational institution. 2. Risk and Uncertainty Risk has many meanings and connotations. In simple terms, risk can be interpreted as the possibility to experience a loss, risk is someone or something that causes or suggests danger (Regan, 2003). Lowrance defines risk as the probability and impact of an adverse event. In other words, the risk is the condition of the possibility of adverse deviations from the expected or desired results (Vaughn, 1996). Another definition of risk is the negative impact of vulnerable activities, taking into account the probability and impact of the risk (Stoneburner & Goguen, 2001). Risk is a measure of potential powerlessness to achieve all program or institution goals related to costs, schedules and technical barriers. Furthermore, risk has two components, namely the probability of failing to achieve a certain outcome, and the consequences of failing to achieve that result. Conceptually, the risk for each event is a function of likelihood and impact. And, as the likelihood or consequence increases, so does the risk. (Harorld Kerzner (Kerzner, 2003). Because the term uncertainty is often associated with risk (sometimes even interchangeably), the meaning between the two terms needs clarification. Uncertainty refers to a statement of mind characterized by doubt, due to the lack of information about what will and will not happen in the future. Meanwhile, the antonym of uncertainty is belief or uncertainty about a particular situation. Risk involves two concepts, probability and impact. These two risk concepts are the most frequently discussed. Unfortunately, the concept of past history is often not used as one of the considerations in identifying risks. In fact, some researchers only pay attention to events that will occur in the future. This phenomenon can result an incomplete risk management system. Considerations about the past cannot be changed anymore, but events that happened in the past may happen again (Gleißner, 2019). 3. Risk Classification According to Morgan, risk can be classified as follows: (Morgan, 2021) The Implementation of Risk Management" (A Case Study at State Islamic University of Walisongo Semarang, Indonesia) IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6326 a. Financial and non-financial risks Financial risk causes financial loss. Financial risk consists of 3 elements, namely individuals or organizations that carry risks, assets or income lost due to financial risks, an event that causes losses. Meanwhile, the non-financial risk is a risk that has no financial consequences. b. Dynamic and Static Risk Dynamic risk is the result of economic changes which can arise due to the external environment, namely the economy, industry, competitors and consumers. This change is not controlled but has the potential to bring losses to the company, and is difficult to detect it. While static risk is a loss that occurs even though there is no change in the economy. Static risk does not come from society so it is easy to predict and overcome (Aven, 2016). c. Pure and Speculative Risk Speculative risk is the possibility that brings profit or financial loss, while pure risk occurs in situations when there is only one financial loss or benefit. d. Fundamental and Particular Risks Fundamental risks come from the surrounding environment or nature, which can have a large enough impact because humans are not able to control it. For example, earthquakes, landslides, tsunamis, hurricanes, and others. If the event hits a wide area, then the fundamental risk will be even greater. Meanwhile, particular risks come from individual activities, so the impact can still be estimated or anticipated in advance because it is local. For example, turbine explosions, shipwrecks, maybe a collision, house fires, and bank robberies (Akkizidis, 2019). e. Operational Risk Operational risk is the risk faced by the company when conducting daily business activities. It is caused by the fact that the actual loss, which occurs due to internal processes. So, it can affect client satisfaction, reputation and shareholder value, while increasing business volatility. It can also be managed to maintain losses within a certain level of risk tolerance, namely, the amount of risk that a person is ready to accept in pursuing his goals. In addition, management is determined by balancing the cost of repairs against the expected benefits. Operational risk focuses on how things are accomplished within an organization, and is often associated with active decisions relating to how the organization functions and what its priorities are. (Crouhy & Mark, 2001), (Kinton, 2021). The business areas belonging to operational risk are very broad. To simplify, it can be divided into two components, operational failure risk and operational strategy risk. The risk of operational failure comes from the potential for failure in handling the business. People, processes, and technology are a company's tools to achieve institutional goals, and one of these factors can sometimes result in multiple failures. Therefore, the risk of operational failure can be concluded as the risk coming from human, process or technological failure in a business unit. The risk of operational failure is difficult to anticipate due to the uncertainty element, because it also arises from environmental factors such as the entry of new competitors that can change the business paradigm, policy changes, tsunamis, and other similar factors that are beyond the company's control. Furthermore, all kinds of businesses rely on people, processes, and technology outside the business unit, and the potential for failure is also contained in these factors. The type of risk existing beyond the company's control is also called operational dependency risk (Smith S., 2018). 4. Enterprise Risk Management There are four main stages in the risk management process (Moeller, 2007), namely; risk identification, risk assessment or measurement, risk prioritization and response planning, and risk monitoring. Risk identification generates a list of potential risks. Risk measurement provides information about the possibility of occurrence and the impact if the risk occurs. Risk prioritization and response planning are follow-up actions taken by management to overcome existing risks based on risk priorities and trends. Risk management activities include increasing the probability and impact of positive events and minimizing the probability and impact of undesirable events on project objectives. The followings are several definitions of risk management. a. According to ISO 31000:2018, risk management is a systematic process of implementing policies, procedures, and practices related to risk communication and consultation activities, determining the scope, context, and risk criteria, implementing a risk assessment consisting of risk identification, risk analysis, and risk evaluation, risk treatment, monitoring and review, recording, and reporting (Publikasi, 2021) b. Enterprise Risk Management is a comprehensive and integrated framework, to manage credit risk, market risk, economic capital, and risk transfer, to maximize firm value (Lam, 2004) c. Enterprise Risk Management (ERM) is a process influenced by management, board of directors, and other personnel of an The Implementation of Risk Management" (A Case Study at State Islamic University of Walisongo Semarang, Indonesia) IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6327 organization, applied in the setting of strategy, and covers the organization as a whole, designed to identify potential events that affect an organization, manage risks in tolerance of an organization, to provide reasonable assurance regarding the achievement of organizational goals (COSO, 2004). d. Meanwhile, according to KMK Number 577/KMK.01/2019, risk management is a systematic and structured process supported by a risk-aware culture to manage organizational risk at an acceptable level in order to provide adequate confidence in achieving organizational goals (Pemerintah, 2019). Meanwhile, the risk management process is the systematic application of management policies, procedures and practices for the tasks of establishing context, identifying, analyzing, evaluating, implementing, monitoring, and communicating risks. The essence of risk management is a process to identify risk factors and then assessing and reducing both their effects and probabilities, as well as monitoring their progress (Srinivas, 2019). Techniques in risk management were first developed by and for banking, recently other types of businesses such as insurance, the corporate industries, and even non-profit institution practice it. The main purpose of a risk management system for non-profit institutions is to identify the risk factors that affect income sustainability and to measure the combined effect of these factors. In implementation, the risk management process is a universal process, so it can handle individual problems or all types of business units, both service and manufacturing organizations (McShane, 2018). Risk management is a very useful method applied in companies that always face interchange risks. Some of the benefits offered by risk management are: 1) Avoid the possibility of unexpected results and cost more; 2) Enhancing openness and transparency in decision-making and management processes; 3). Produces a more systematic process and provides a better understanding of activities regarding a problem related to an activity; 4). Streamline the form of reporting to meet the needs of the company. 5). Better output or results in the form of efficiency and effectiveness of the activities of a department; 6). Appropriate assessment of innovative processes to expose risks before they actually arise and allow informed decisions on the value of the possible cost benefits (Framework, 2016). A company can apply an effective strategy to avoid or reduce the amount of loss that can be suffered as a result of the risk from adverse event. The application of risk management in a company can increase control over company risk so unexpected events will not happen in the future. Logically, the risk of loss will decrease with increasing control, so that the final result obtained by the company is an sustainable profit that eventhough an adverse event occurs. 5. Activities in Risk Management The approaches taken in implementing risk management in an organization may vary according to the character and risk appetite of each organization. Risk appetite is the tendency of an organization to face and assess risk. The behavior shown by an organization to risk is different. Perhaps for an organization engaged in the service sector, the risk of being tarnished will have a higher impact than the risk of the safety of its employees. However, for organizations engaged in mining, for example, work safety is a high-impact risk (Luko, 2013). There are six main processes in project risk management identified by the Project Management Body of Knowledge (PMBOK). The six processes are: a. management risk planning, b. risk identification, c. Qualitative risk analysis, d. Quantitative risk analysis, e. Risk response planning, f. Control and risk monitoring (NKD, 2021) According to the Australian/New Zealand Risk Management Standard (AS/NZS 4360:2004), the risk management process is divided into main and driving activities. The main activities consist of conducting communication and consultation, monitoring, and review. The risk management process provides general guidance and can be applied to a very wide range of activities, either individuals, organizations, the public or private sector. Meanwhile, according to ISO 31000: 2018 Risk Management Guidelines, the risk management process is a systematic process of implementing policies, procedures and practices related to risk communication and consulting activities, determining the scope, context, and risk criteria, implementing risk assessments which consist of risk identification, risk analysis, and risk evaluation, risk treatment, monitoring and review, recording, and reporting (Jacobus, 2021). The Implementation of Risk Management" (A Case Study at State Islamic University of Walisongo Semarang, Indonesia) IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6328 In more detail, the risk management process is divided into six steps. 1) Communication and Consultation Communication and consultation with internal and external stakeholders should be carried out at all stages of the risk management process. A communication and consultation plan should be developed at an early stage. Communication should cover issues related to the risk, their causes, consequences (if known), and steps to be taken to address them. Effective external and internal communication and consultation should be carried out to ensure that those responsible for implementing the risk management process and stakeholders understand the reasons for how decisions are made, and the reasons why certain actions are required. 2) Establishing the Context By establishing organizational context, external and internal parameters to be taken into account in managing risk, and establishing risk scope and criteria. While, many parameters are similar to considering the design of the risk management framework when creating the context for the risk management process. These factors considered in more detail and, in particular how they relate to the scope of a particular risk management process. 3) Risk Assessment Risk assessment is a process that includes risk identification, risk analysis and risk evaluation. 4) Risk Treatment Risk treatment involves selecting one or more options for dealing with risks and implementing those options. When implemented, the treatment provides or modifies the control. Risk treatment involves the process of assessing risk treatment, deciding the level of residual risk that can be tolerated, if not, then a new risk treatment is created, and followed by assessing the effectiveness of the treatment. 5) Monitoring and Review Monitoring and review should be a part of the risk management process plan and involve inspection and supervision and can be done periodically or ad-hoc. Responsibilities for monitoring and review should be clearly defined. The progress of the risk treatment implementation produces performance measures incorporated into management performance, measurement, and reporting of external and internal activities. The results of monitoring and review should be recorded and reported externally and internally, and should also be used as input for the review of the risk management framework. 6). Recording the Risk Management Process Risk management activities must be traced. In the risk management process, records can be the basis for improving methods, tools, and overall processes. Meanwhile, risk management includes certain methods and techniques to deal with known risks, identify who is responsible for the risks, and provide cost and time estimates to reduce these risks. This activity includes planning and implementation with the aim of reducing risk to an acceptable level. The evaluator who assesses the risk should start from the risk identification process and develop treatment options and approaches to suggest to the program manager who should carry out implementation. 6. Risk Management in Government Agencies Risk management in Indonesian government agencies is regulated in Government Regulation (PP) No. 60 of 2008 concerning the Government Internal Control System (SPIP). Risk management is one of the five elements of SPIP, namely the element of risk assessment. PP No. 60 of 2008 stipulates the Financial and Development Supervisory Agency (BPKP) as the supervisor for the implementation of SPIP. BPKP encourages all government agencies to implement SPIP and risk management, one of them is the Ministry of Finance. This institution is one example of a government agency that has implemented SPIP, especially risk management, in a structured and systematic way. Because, it has organizational structure arrangement and framework of the isk management process. The Ministry of Finance issued the Minister of Finance Regulation No. 191/PMK.09/2008 concerning the implementation of risk management in the Ministry of Finance. There are 5 main elements in the implementation of risk management at the Ministry of Finance, namely 1) risk management charter, 2) risk management structure, 3) risk management implementation strategy, 4) risk management process, and 5) risk reporting (Guide , 2009). Risk management at the Ministry of Finance adopts a three-level control model, consisting of policy level control, operational level control, and control supervision. Policy level control is responsible for coordinating, facilitating, and monitoring the effectiveness and integrity of the risk management process. While, the policy level control is carried out by the risk management committee. Operational level control is directly responsible for day-to-day risk management and control and it is conducted by the head of risk management and the risk owner The Implementation of Risk Management" (A Case Study at State Islamic University of Walisongo Semarang, Indonesia) IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6329 unit (ANSI=ASSE, 2011). Inspectorate General and external auditors perform an independently assessment concerning the effectiveness of the risk management implementation at all levels of echelon I and to the relevant stakeholders. 7. Risk Management in Higher Education Why should universities implement risk management? Because, practicing it, Higher Education can maintain the pillars of Good University Governance, creating a new pattern of organization that makes risk an early warning tool. Because the human resources existing are limited, the mitigation process focused on risk should be more paid attention. (Ruzic-Dimitrijevic & Dakic, 2014). Meanwhile, risk in higher education is classified into 2, namely risk based on type and risk based on the aspect. The former includes strategic risk, managerial risk, and operational risk. And the latter covers the aspects of budget management, human resource management, infrastructure, information & technology, and academics As we know, risks do not only occur in the industrial sector but also in the education field. Universities in Indonesia, both public and private, are facing enormous risks compared to the previous year. This is because universities must protect their reputation in order to survive in the midst of increasingly complex problems as a result of intense competition and increasingly rigid regulations. In addition, problems that often arise in the management of higher education include the low understanding of governance. The good or bad of an organization, including a university, is largely determined by its governance. The better the governance, the better the organization will be in carrying activities and development out (Ruzic-Dimitrijevic L., 2014). Beside the governance factor, another problem faced by colleges is the principle of not-for-profit oriented. The principle requires a university to prioritize social values over profit. This principle seems to keep or restrict universities from looking for and developing business opportunities by maximizing existing resources. Colleges are afraid of what they are doing is reputed and neglected the not-for-profit principle. As a result, the income of universities, especially private ones, is usually based on students’ fees. The next problem is the autonomy of higher education institutions, and it is closely related to governance. Universities can not maximize their authority to make regulations in order to minimize all possibilities that will occur and cause universities to suffer losses (Martini, 2020). To anticipate this phenomenon, it is necessary for universities to control any risks that arise some time (Clough & Sears, 1991). 8. Review of Related Literature Research related to risk management in universities has been carried out by many experts, including (Malik & Bukby, 2020) and (Lai, 2014). The studies conducted in the well-known university concluded that everyday universities are always faced with risks, therefore they are required to find effective strategies out to overcome these risks. Brewe, in his research, wrapped up that universities are, today, increasingly paying attention to perform risk management and looking the effective strategies (Brewe, 2011). In addition, they add that universities also face progressively complex challenges in a competitive global environment which can raise risks manifested in different forms. The next researches are conducted by (Puntervold, 2017), (Mukhlis, 2018), and (Cameron, 2019). They drew conclusion that risk management plays an important role in maintaining the image of the university. A higher education institution will collapse soon if it is unable to mitigate the risks that appeared. When compared with these researches, there are some similarities and differences with the study that will be conducted by researchers. The similarity is in the theme, namely risk management in higher education. While the difference lies in the focus of the study. Malik and colleagues focus on the urgency of risk management and its role in brand sustainability in universities, but researchers more focus on the risk management process, the procedures, and the influence on the university reputation. C. METHOD OF RESEARCH This study uses a descriptive-qualitative approach with a multi-case study research design (Bogdan & Taylor, 1998). Moleong said that qualitative research is research using a natural setting with the intention of interpreting phenomena that occur and are carried out by involving various existing methods ( Moleong, 2008) A case study design is a study including two or more research targets with different cases. The research targets can consist of people, events, settings and documents, and studied in depth as a totality, according to their respective settings or contexts. This is intended to understand the various meanings existing between the variables. (Cresswell & Creswell, 2018) This research will be conducted by using a case study research design because the research location is a higher education institution under different ministries, the Ministry of Education and Empowerment and the Ministry of Religion. Thus, these two institutions must have different characters. The Implementation of Risk Management" (A Case Study at State Islamic University of Walisongo Semarang, Indonesia) IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6330 Data and Research Data Sources Data is essential to reveal a problem, and to answer research problems formulated. What conveyed by the informants is, according to Sugiono, the main source of qualitative data, (Sugiono, 2003) whether the data was obtained verbally through interviews or in written form through document analysis or survey responses. There are, in this study, two data sources, primary and secondary data sources. Data will be obtained by observing and recording directly, such as interviews and observations (Soeryabrata, 1998). Meanwhile, the main data or informants in this study are people who are directly involved in universities, especially those related to risk management. The key informants are the Vice Chancellor for administration and finance, the head of risk management, the personnel of the Internal Supervisory Unit, Deans, Lecturers and Internal Auditors. They will be supported by data related to the problem being researched, such as relevant literature, documents, books, and photographs to need. (Zuchdi, 2003). Data Collection Techniques The data collection methods used are observation, interview, and documentation. The researcher is the main instrument of data collection supported by a recording device, camera, interview guide, and other necessary tools. For more details, the data collection techniques used are as follows. Observation method will be carried out by observing and systematically recording the symptoms being investigated. Observation can also be interpreted as a method of intentionally collecting data (Hasan, 2002). The type of observation used by the researcher is non-participant one, namely being present at the research location but not participating in the activities carried out. Interview is a conversation carried out by two parties, namely the interviewer and the interviewee. The type of interview used is an in-depth interview, the researcher prepares a list of questions in order not to leave the theme under study but remains flexible (Denzin & Lincoln, 1994). Documentation is a way to collect data or records of past events. Documents can be in the form of writing, pictures, or someone's monumental works (Arikunto, 2011). The data obtained from the documentation method include the vision and mission of the institution, organizational structure, risk registers, work programs, and other supporting data. Data Analysis Techniques Data analysis is the most important part of the scientific method, because data analysis is used to solve research problems. The raw data collected needs to be grouped and selected to answer the problems posed before. The analytical technique used is the data analysis technique proposed by (Miles & Huberman, 1984). He stated that activities in qualitative data analysis were carried out intensively and continuously until completed and saturated. The analysis techniques consist of data reduction, data presentation, and drawing conclusions. The meanings that emerge from the data must always be tested for truth, suitability, and validity (Singarimbun & Effendi, 1989) D. FINDING AND DISCUSSION 1. Risk Management Process Procedure is a sequence of steps that must be taken to carry out a process in order to achieve a certain goal. Procedures provide answers to the question "how" to accomplish a series of activities systematically and organized so that targets can be achieved effectively and efficiently. Risk Management Procedures are prepared to guide the implementation of Risk Management by risk owners so that it is integrated, systematic and structured. The Risk Management process at UIN Walisongo Semarang is carried out by all levels of management and all employees through each Risk Owner Unit. The Risk Management process consists of several stages, namely communication and consultation, establishing context, risk assessment which includes risk identification, risk analysis and risk evaluation, risk management as well as monitoring and review. Comprehensive risk assessment of all work units at UIN Walisongo Semarang. In carrying out risk assessments and developing risk management, they use performance results, deepening of strategic targets and with in-depth experience to identify and analyze risks. The number and level of detail of Risk Management procedures is adjusted to the needs of the organization and takes into account the level of detail of procedures in the quality management system. The risk management process is carried out by all leaders and employees of the Work Unit within UIN Walisongo Semarang. Bellows are the result of the process risk evaluation based on its impact. The Implementation of Risk Management" (A Case Study at State Islamic University of Walisongo Semarang, Indonesia) IJMRA, Volume 08 Issue 11 November 2025 www.ijmra.in Page 6331 Table 1. Risk Based on Impact Category Category of Risk Impact Total Persentage Reputation Impact 1 13,50 Operational Impact 18 51,42 Compliance Impact 2 5,71 Strategic Impact 2 5,71 Policy Impact 9 25,71 TOTAL 32 100 Table 2. Impact Based Risk Risk based on impact Explanaition Total Persentage 1 Not significant 0 0 2 Less Significant 0 0 3 Currently 2 6,25 4 Significant 27 84,375 5 Very Significant 3 9,375 TOTAL 32 100 Table 1 shows the number and percentage of identified risks based on their impact (ranging from insignificant impact to very significant impact). No risks were found to have an insignificant impact, they covered the largest number of risks, namely 27 or 84.375 percent. There are risks or 9.375 percent that have a very significant and 2 risks or 6.25 percent that have a moderate impact. In other words, the 27 risks that have been identified have a "catastrophic" impact or 4 to 5. One of the five risks is a risk that has a reputational impact, namely that the PDTT Report is not confidential and is known to unauthorized parties. This is a reputation impact risk that has the second highest priority. Furthermore, from the four faculties and one Internal Review Unit institution, there are 32 operational impact risks as shown in the table above. At the Faculty of Da'wah and Communication, there are two policy risks, namely increasing the quality of innovative Da'wah and Communication research for the benefit of Islam, Science and Society and Increasing the quality of service for community development based on research in the field of Da'wah and Communication that is integrative and useful. On the other hand, research is one of the important things in contributing to science. With the institutional change to become a university, the Public Service Agency is adapting the academic research model to research that has sales value. This is very challenging for higher education institutions, considering that research output must go through the dissemination stage to the public as a form of higher education tridharma accountability. Meanwhile, at the Faculty of Science and Technology there is one strategic risk, namely improving the quality of science and technology education and teaching based on unity of knowledge. At the Faculty of Tarbiyah and Teacher Training there is one strategic risk, namely the development and application of local wisdom values in the development of Tarbiyah and Teacher Training. These two targets at the faculty have a very strategic position, because issues related to scientific integration are still a priority scale at all State Islamic Universities. Equally important is respect for local values, so that students are not uprooted from their cultural roots. The next key risk is improving the quality of professional faculty governance to ISO standards. FTIK and the Faculty of Da'wah and Communication place it as a reputation risk with a score of 24. This risk is closely related to accreditation, both study program accreditation and institutional accreditation. The risk of accreditation for both study programs and institutions that do not comply with standards is a "scourge" for the majority of universities in Indonesia. With the transfer of institutional status to Public Service Agency higher education, it is necessary to prepare adjustments to higher education tridharma quality standards and policies. This is demonstrated by the differences in assessment instruments for academic study programs and applied study programs at a higher education institution. At the Faculty of Psychology and Health, there are risks related to curriculum development related to improving the quality of science and technology education and teaching based on the unity of knowledge. The curriculum must be in line with the expected mission, vision, type of faculty and institutional culture and its existence is important for parties in the public and