This section aims to present the operational risks identified by the interviewees, as well as their frequency of occurrence in the excerpts drawn from the various interviews. This analysis highlights the most recurrent and significant risks within the universities under study (see Table 1), where frequency corresponds to the number of participants who mentioned each concept.

This study was conducted in accordance with fundamental ethical principles, including informed consent from participants, as well as the assurance of anonymity and data confidentiality, which were used exclusively for scientific purposes.

Table 1. Cross-map analysis of the concept “operational risks”.

Source: authors.

In summary, the interviews conducted with the respondents allowed us to identify the main operational risks faced by Moroccan public universities and thus provide an answer to our first operational research question:

Q1. Do Moroccan public universities have a clear understanding of theiroperational risks?

Indeed, the respondents were able to identify a significant number of operational risks, though not all of them. This is largely due to the absence or insufficiency of an operational risk register organized by area of activity.

This section analyzes the practices implemented by Moroccan public universities to address operational risks.

It is based on contingency theory, which holds that risk management does not rely on a single model but must be adapted to the specific characteristics of each organization (size, resources, structure, and institutional context). This approach allows the observed arrangements to be understood in relation to their context, whether formalized or informal.

In this perspective, the analysis does not rely on international standards, as these are based on generic frameworks that are not sufficiently adapted to the diversity of contexts.

The objective is therefore to highlight the diversity of mechanisms through which Moroccan public universities manage their operational risks.

This section analyzes the practices implemented by Moroccan public universities to respond to operational risks.

We have chosen not to rely on international standards to assess the practices in place. This approach is justified by the adoption of contingency theory, which asserts that there is no single valid risk management method suitable for all organizations. Thus, each university can legitimately adopt mechanisms tailored to its own specificities.

Our objective is therefore to highlight the range of mechanisms—whether institutionalized or informal—through which Moroccan public universities manage their operational risks.

4.2.1. Formal Operational Risk Management Framework

The formal operational risk management framework refers to a structured system designed to systematically identify, assess, and manage operational risks.

On March 10, 2020, the standard organizational chart for Moroccan public universities introduced the creation of new departments, including the Audit, Management Control, and Quality Assurance Department (ACGAQ). This department brings together several key functions and includes operational risk management among its missions.

According to the interviews conducted, the ACGAQ Department is involved in operational risk management both directly and indirectly:

In a limited number of cases, direct management is handled by auditors, who act as risk managers through the development of risk maps, enabling the identification, analysis, assessment, and treatment of risks. However, in 50% of situations, it is carried out by heads of units, based on an informal risk management approach.Indirect risk management is primarily ensured by internal audit activities, which, through audit reports, contribute to the identification, analysis, and treatment of risks while issuing recommendations aimed at strengthening their control. Management control also plays a role in this process by supporting risk identification and analysis through the monitoring of indicators and various projects, although this function is not yet operational in all Moroccan public universities. In addition, quality assurance is involved in around 50% of public universities, contributing to the identification and analysis of weaknesses as well as to risk treatment, notably through the implementation or updating of organizational frameworks that support risk control and continuous improvement of operations (Figures 1-4).

Figure 1. The operational risk management ensured by the heads of units.

Figure 2. The internal audit function of UPM.

Figure 3. The management control function of UPMs.

Figure 4.The quality function of UPMs.

Data from the interviews reveal that no function is exclusively dedicated to operational risk management. This situation is explained by two main reasons:

The lack of institutionalization of this function in the official organizational chart of Moroccan public universities.

“There will be no function dedicated to operational risk management as long asit is not institutionalized.”—Vice President of a Moroccan Public University (statement from a single interviewee).

The absence of a regulatory framework mandating the adoption of such a function at the national level.

In contrast, the majority of respondents indicate that an initiative is currently underway to formalize a specific operational risk management framework. The delay in its implementation is explained by several factors:

The low prioritization of risk management in university strategic plans.The lack of an institutionally approved risk management policy, especially by University Councils.The lack of awareness and risk culture at all hierarchical levels.

In this context, the efforts deployed by universities remain limited, although some signs of progress are beginning to emerge. However, the current performance of the ACGAQ Department appears constrained due to several challenges:

The recent creation of the department, which is still undergoing organizational integration.The multiplicity of missions, which spreads resources thin and blurs priorities.The lack of strategic and operational support.The shortage of qualified human resources.The insufficient specific skills, worsened by the lack of ongoing training.

Ultimately, operational risk management in Moroccan public universities still largely relies on a traditional, reactive, and informal approach. Each risk is addressed in isolation, without capitalizing on experience or embedding the risk management process in the organizational memory.

4.2.2. Informal Framework for Operational Risk Management

The informal operational risk management framework refers to the use of non-formalized management processes for the treatment of identified risks, implemented in an isolated manner, without coordination or a structured methodological framework.

Based on a corpus of semi-structured interviews, and after data preprocessing (cleaning, removing stop words, correcting errors, standardizing the data, etc.), we used the qualitative analysis software NVivo 11 to generate a word cloud. This visualization is based on the weighted frequency of terms and aims to highlight the most recurrent expressions used by respondents, in order to reveal non-formalized operational risk management practices as they emerge from their discourse.

The word cloud is used as a descriptive and exploratory tool to identify lexical regularities within the collected data.

The most salient expressions, particularly those related to non-formalized operational risk management practices, are highlighted in bold within the figure (see Figure 5).

Figure 5. Word cloud related to operational risk management.

In this perspective, the detailed analysis of responses makes it possible to highlight the most frequently mobilized practices, presented in Table 2, where frequency corresponds to the number of participants who mentioned each concept.

Table 2. Cross-map analysis of the concept “operational risk management.

Source: authors.

Table 2 highlights informal operational risk management practices, some of which recur frequently. The most commonly cited are professional training, follow-up meetings, implementation of the organizational chart, and staff awareness-raising.

In the majority of Moroccan public universities, operational risk management still relies on a traditional “silo” approach. This method involves isolating each operational risk to address it separately, without considering possible interactions between them ([1]). Each type of risk is thus treated as autonomous, leading to fragmented management ([11]). This mode of management is generally carried out informally.

However, this method presents notable limitations. It lacks coherence, especially when similar risks are handled differently ([8]). Moreover, it overlooks the interdependencies between risks, which reduces the overall understanding of their nature and impacts ([13]). By addressing risks one by one, universities deprive themselves of an in-depth and systemic view of risk management ([8]).

In contrast, modern operational risk management favors a holistic and integrated approach. It advocates for the simultaneous consideration of different risks as well as their interactions ([9]). This approach enables universities to better anticipate and manage events that could negatively affect their performance ([12]). This process is based on a formal and structured framework.

Currently, in most Moroccan public universities, formal risk management systems are still under development. Although these systems bear different names, they all pursue a common goal: to identify, prioritize, and quantify risks with the aim of improving their management ([14]). As for Informal mechanisms, they remain predominant and continue to address critical operational risks individually in the absence of a clear and consolidated institutional framework.

Consequently, these observations lead us to propose actions to improve operational risk management in Moroccan public universities (UPM):

Adopt a formal operational risk management policy, validated by the University Council, to establish it as an institutional reference document.Foster collective awareness through an annual risk management awareness day.Pilot the operational risk management process in one or two university units to assess its relevance before a full-scale rollout.Organize targeted continuous training sessions on operational risk management (identification, assessment, treatment, monitoring, etc.).Develop an operational risk map by unit (departments, faculties, services).Implement an operational risk monitoring dashboard (indicators, alerts, action plans, deadlines).