The Board Will See You Now:
When Research Risk Goes Enterprise

Slide 1

The Board Will See You Now: When Research Risk Goes Enterprise

My work brings together legal, compliance, and enterprise risk management in a large physician organization. That puts me in the middle of decisions where clinical priorities, business objectives, and fiduciary responsibilities meet.

Research is part of that same environment. The physicians delivering care and the people conducting research contribute to a shared mission, but they often work within different funding arrangements, reporting structures, and expectations. Understanding how those pieces fit together is essential when a research issue reaches executive leadership or the board.

Slide 2

Objectives

I want to connect three things:

1. How funding and policy volatility can turn a research compliance issue into an enterprise risk.
2. How ERM and financial governance tools help us assess and manage that exposure.
3. How to communicate the risk and the available responses in a way executives and boards can use.

That last part matters. We can understand a research problem thoroughly and still struggle to explain why someone responsible for the whole organization needs to act.

Slide 3

Black Swans: When Research Risk Moves Faster Than Governance

Horses, zebras, and the limits of experience

Medical students learn, “When you hear hoofbeats, think horses, not zebras.” Start with the most likely explanation. That is sensible, provided we keep looking when the evidence does not fit.

Boards spend much of their time on familiar issues: billing variances, technology updates, staffing, and financial performance. Those are the horses. The danger is becoming so accustomed to them that we stop considering what else could be coming. Hospitals invest in diagnostic capabilities because sometimes the hoofbeats really are zebras. ERM serves a similar purpose in the boardroom.

Nassim Nicholas Taleb’s Black Swan describes an event outside our expectations with extreme consequences, which can be beneficial or catastrophic. The name comes from the old European assumption that all swans were white. Black swans in Australia exposed the flaw in treating limited experience as proof of what was possible.

We make the same mistake when we look at past results and conclude that something cannot happen because it has never happened to us. Our assumptions can leave us blind to the exposure.

Johns Hopkins: a single study reaches the institution

In 2001, Ellen Roche, a healthy 24-year-old research volunteer, died after participating in a Johns Hopkins study involving inhaled hexamethonium. The federal investigation led to the suspension of roughly 2,400 human-subject studies approved through the affected review boards. Research under separate assurances was outside the suspension. Resumption required corrective action and further review.

Think about the speed and scale of that change. An issue in one study became an institutional oversight problem affecting thousands of other studies. Researchers far removed from the original study depended on the same research protections and approval systems.

Duke: the financial consequences of research misconduct

In 2019, Duke agreed to pay $112.5 million to settle False Claims Act allegations concerning fabricated or falsified research used in 30 federal grants. The work involved a technician in an airway physiology laboratory, and the allegations reached the government through a former employee’s whistleblower lawsuit. The settlement resolved allegations without a determination of liability.

A laboratory’s work can support grant applications and publications well beyond its own walls. A problem with the underlying data can therefore reach across the institution. The financial and reputational consequences are much larger than the laboratory where it began.

A funding decision can create a similar shock

NIH’s February 2025 attempt to impose a 15% indirect cost rate showed how quickly a policy change could threaten the financial assumptions supporting research. Changes in federal priorities around DEI and other research areas also raised questions about ongoing funding, award conditions, and the consequences of certifications made to obtain payment.

Leadership has to consider its dependence on those funding assumptions, including the possibility that decisions outside the institution will change them abruptly. We cannot assume that the normal budgeting and committee calendar will give us enough time to respond.

Slide 4

Two Lenses: Research Mission vs Enterprise Risk

I think of this as two countries with one passport.

From the business perspective, the questions concern revenue, reputation, operational mission, and responsibilities to shareholders, trustees, or regents. From the research perspective, they concern advancing science, scientific autonomy, research ethics, regulations, and funding restrictions.

Research often operates in silos. An investigator may see an issue as a matter for the study team or the department. An executive may see a successful research program bringing in revenue and assume the underlying operation is healthy. Neither has the whole picture.

At Hopkins, the consequences extended across the studies relying on the affected oversight systems. At Duke, the allegations concerning laboratory data reached grants and institutional finances. Internal reporting lines did not contain the exposure.

This is where revenue blindness becomes dangerous. Grant income, publications, and prestige can make people reluctant to question the work producing them. We need to be able to ask whether that success is supported by sound practices and whether concerns can reach someone outside the department who has the authority to act.

Slide 5

Why Leadership and Boards Care: from Revenue to Accountability

Revenue and financial sustainability

A researcher may be focused on securing the next award and keeping a study moving. Leadership also has to consider the resources committed to that work and whether the organization can continue supporting it. That difference creates friction when new funding brings costs the award will not cover.

Reputation and mission

A research program’s reputation and the institution’s reputation are intertwined. In an integrated healthcare organization, research sits alongside patient care, hospitals, and health plan operations. A research controversy or disruption can affect how people view the wider organization and its mission.

Operational continuity and fiduciary accountability

Executives report to the board on the health of the institution. They need to understand whether a research issue could disrupt operations, require additional financial support, or compromise the organization’s ability to meet its obligations. Research leaders need to connect their funding and operational concerns to those responsibilities.

Slide 6

ERM: A Rosetta Stone

ERM gives research and institutional leadership a common language. It helps translate what is happening in a department into information the board can use to carry out its responsibilities.

Governance framework

We need a shared understanding of the objectives, the relevant risks, who owns them, and who has authority to make decisions. That lets people work within agreed boundaries and recognize when an issue needs to move beyond their own reporting line.

Prioritization tools

A consistent framework lets us assess risk alongside opportunity and compare competing demands for resources. We can connect a project-level decision to the institution’s risk appetite rather than having each department make its own assumptions about what the organization is willing to accept.

Black Swan readiness

Rapid changes in funding or policy may require decisions between scheduled reporting cycles. ERM should provide a way to reassess the exposure, bring the right people together, and escalate a decision while there is still time to act. The framework needs to accommodate a funding pivot or a major change in research priorities.

Slide 7

Research Governance Perspective

Research decisions sit within several overlapping obligations: federal grant requirements, the ethical principles reflected in the Belmont Report, executive actions, and the restrictions attached to individual awards. Scientific autonomy also matters. Researchers need the independence to pursue credible work, supported by an institution that understands what that work requires.

What indirect costs support

Indirect costs include the facilities and administration supporting research. Facilities include such costs as buildings, equipment, operations, and maintenance. Administration includes accounting, personnel, and the other services needed to operate the research program.

Modified total direct costs, or MTDC, define the cost base to which an indirect rate applies. The base matters as much as the percentage. Increasing the eligible portion of a subaward from $25,000 to $50,000, for example, can increase indirect recovery without changing the rate. The applicable agency rules and award terms determine which threshold applies; NIH’s 2026 implementation notice retained the earlier indirect-cost provisions.

Autonomy needs support

Scientists want to do the science. When familiar funding becomes less reliable, they look for other ways to continue the work. Different sponsors bring different rules and rates, and someone has to manage that complexity.

Consider the workload of an institutional review board. Faculty reviewing complex protocols need enough time and support to do the work well. Cutting administrative or pre-award capacity can leave the institution with the same responsibilities and fewer people able to meet them. The Hopkins example should prompt us to look at the capacity of the oversight system as well as the individual protocol.

Slide 8

Indirect Rates

Phrasing matters when we explain indirect costs to leadership. A percentage does not tell a health plan or hospital executive what is at stake. Those leaders are also responsible for patient care, operations, and regulatory obligations. We need to explain how research funding affects those responsibilities.

“Why not just have multiple indirect rates?”

Different arrangements can support different rates. On-campus and off-campus work may have different cost structures. Federal agencies and industry sponsors may impose different award conditions or reimbursement limits. Managing multiple rates requires an understanding of the underlying cost pools, the applicable rules, and the accounting needed to apply them correctly.

Each additional arrangement can increase the compliance burden. It has to be administered by people who know which costs belong where and which requirements apply to the award.

What a lower rate means for the organization

If recovery falls and the costs remain, the institution has to decide how to cover the difference. It may need to provide more support from other operations, reduce research capacity, or consider whether it can continue the work at all.

That is why the attempted 15% cap caused such concern. Research programs had facilities, staffing, and administrative commitments built around their funding arrangements. A sudden reduction in recovery could change their viability without changing the work they were expected to perform.

Slide 9

The Paradox of Research Funding: Cutting Costs Can Increase Risk

Layoffs, furloughs, downcoding. Those can look like obvious responses when funding falls. We need to understand what they actually do to the institution’s costs and obligations.

The immediate savings may not be there

Take a severance policy that provides two weeks of pay for each year of service. For a 20-year investigator, that is 40 weeks of pay. A reduction intended to save money can create a substantial immediate expense. The timing of the funding loss, the severance obligation, and the work that still needs to be done all matter.

We also have to consider the facilities and administrative costs supporting a negotiated indirect rate. Reducing those costs has implications for the underlying cost structure and for rate administration and renegotiation.

The responsibilities remain

Saving a $75,000 audit or compliance salary may look attractive in a budget discussion. The decision also changes the institution’s ability to identify problems. The exposure associated with research integrity or grant compliance can be far larger than the salary saved.

Think again about Duke. The government is funding research on the premise that the work and the representations supporting payment are reliable. Fabricated data can undermine that premise across multiple awards. Repayment exposure and potential False Claims Act damages need to be considered alongside the apparent savings from reducing oversight.

I want the decision makers to understand both sides of that choice: what the institution saves and what it becomes less able to prevent, detect, or manage.

Slide 10

Reacting to the Rapidly Evolving Funding Climate

Regulatory parkour is a fair description: navigating changes involving DEI, vaccines, and MAHA in an institution with the turning radius of a small moon.

Changing federal priorities can affect what research is funded, how we apply for grants, and the requirements attached to the work. Meanwhile, the institution still has its own policies, employment commitments, facilities, and approval processes.

Travel is a simple example. An organization’s travel policy and the requirements of a federal award may not line up neatly. The team has to satisfy both. A decision that works under one set of rules can create a problem under the other.

ERM helps us identify those conflicts and get them to people who can resolve them. We need to know who is assessing a change, which operations and awards are affected, and what decisions require executive attention. We also need to be able to revisit a decision as the requirements and funding picture evolve.

Slide 11

Alternative Funding Sources: New Revenue, New Risk

When federal support becomes less dependable, alternative sponsors can keep important research going. We also need to look for the icebergs we cannot see from the revenue figure alone.

What happens when a sponsor offers an indirect rate below the institution’s negotiated federal rate? The costs still have to be supported. We need to understand the difference between what the award reimburses and what it takes to perform and administer the work, then identify how the uncovered costs will be funded.

Different rates and award terms create accounting and compliance questions as well as financial ones. Accepting an award should involve a clear understanding of those conditions and of the resources required to meet them.

The options differ by institution. A university may be able to consider endowment resources or other funds, subject to restrictions and competing priorities. A nonprofit research operation may have fewer alternatives. In a healthcare organization, additional support for research competes with other commitments, including patient care.

ERM helps us assess whether the opportunity justifies that commitment. We need to understand the scientific value, the full cost, the sponsor’s requirements, the available resources, and the risk the institution is prepared to accept. That gives leadership a basis for deciding whether and how to support the work.

Slide 12

Thank You and Questions

Thank you. I welcome questions about how these issues arise in your organization, including the points where research, finance, compliance, and board responsibilities meet.