The IRM program evaluates risk across five foundational categories (i.e., impact):
| Strategic | Long-term goals, higher education trends, enrollment, and academic mission alignment. |
| Operational | Day-to-day processes, technology infrastructure, staffing, business continuity, and adherence to federal/state laws, regulations, standards, and contracts. |
| Financial | Budget sustainability, resource allocation, investment management, and revenue streams. |
| Health & Safety | Physical safety, environmental health, facilities, natural disasters, and global travel. |
| Reputational | Public trust, institutional integrity, brand identity, and stakeholder perception. |
Additionally, IRM considers the chances that a risk may occur (i.e., impact):
| Remote | It could happen, but probably never will. |
| Unlikely | Not expected, but there is a minimal chance that it could within the next 5 years. |
| Possible | It’s happened before and/or could happen, but there is no immediate expectation that it will within the next 5 years. |
| Probable | Current conditions indicate that it is more likely than not to occur within the next 5 years. |
| Certain | This will happen within the next 5 years, if not sooner, in almost every scenario. |