In spite of its stellar reputation as an educationalinstitution, Penn State failed to communicate and execute the mostrudimentary risk management protocols in the Jerry Sandusky sex abuse scandal, risk management expertssay.

With a timeline dating back to 1994, when Penn State defensive linecoach Jerry Sandusky launched The Second Mile nonprofit program forat-risk boys, multiple incidents of alleged sexual abuse wentunreported to the appropriate authorities, resulting in a situationwhere liability escalated from potentially damaging todevastating—with the university and even third parties nowpotentially liable.

“It's shocking that somehow the real values professed by theinstitution—which after all, is in the business of kids—weren'tfollowed,” said Kevin Ribble, executive vice president ofmanagement liability specialists Edgewater Holdings Ltd. andpresident of Comply AmericaInc.

“Many organizations refuse to believe their colleagues arecapable of such heinous acts so they won't see the signs. Theystart out with denial but when confronted with reality, start toget defensive,” said Melanie Herman, executive director of theNonprofit Risk ManagementCenter, a national resource organization that advisesnonprofits on a wide array of risk and liability issues, includingchild abuse prevention. “The best organizations recognize that thebetter course is to confront it and think about they could do toprevent it in the future.”

A key risk management tenet—whether an incident involves sexualabuse, sexual harassment or a dangerous condition in a facility—isto investigate any allegations, Herman said. “Everyone in theorganization must take it seriously, and every organization has anobligation to look into allegations. If you see something and it'signored, an organization is far more likely to be heldpersonally liable in the long run because you ignored the conditionor report.”

And because The Second Mile is a nonprofit that is technicallynot sponsored by Penn State, the organizations directors andofficers, and even its corporate sponsors, might now be heldliable, Ribble said.

Also Read: Penn State's Exposure to Civil Litigation Not Blocked byImmunities

The common thread in all the reported incidents is that none ofthe witnesses seem to have known where and how to legally reportthem, Ribble said. According to the timeline, Sandusky had beencaught in sexually compromising positions with underage boys in1998, when a boy's mother reported her suspicions to universitypolice; in 2000, when a school janitor witnessed Sandusky withanother boy; and in 2002, when a graduate assistant witnessed yet athird incident.

In the latter two incidents, which witnesses reported to theirsupervisors and ultimately to Penn State head coach Joe Paterno,university employees should have known that under law they arerequired to report suspected incidents of child abuse to theappropriate family services authority, Ribble said. “If you seesomething that might lead to the harm of a child, you're obligatedby law to report to family services or the police, and if it's anemergency, to dial 911. So nobody followed the rules, but frombottom up, reporting requirements that should be insisted upon wereviolated.”

It's “mystifying” that Penn State ignored the type of riskmanagement principles—including a written statement ofinstitutional protocol distributed to all employees and fullysupported by management—that insurance professionals instillin even the smallest businesses working with children, Ribble said.Although he did not have access to any of the university's employeemanuals, a review of the student handbook indicated that itoutlined “all the right values,” but should also include astatement that reporting any suspected crime involving children isboth a personal and administrative responsibility and that failureto do so is a felony.

In addition, failure to report suspected child abuse cases inmost school districts will result in the loss of coaching licensesand teaching certificates, Ribble said. “Reporting requirements area fundamental value to a coaching staff, even if they're workingwith college students, and especially in dealing with young kids.The fact that it's absent all the way through is the thing that isespecially disconcerting,” he said.

Although prevention of such incidents is important, respondingto an actual event is equally important, Herman said. “Like anywrongdoing, sometimes even when an organization does everything tominimize the likelihood of harm, incidents happen. The organizationmust also think of what to do if it does happen, which is animportant part of risk management.” And the key is to do the“caring, compassionate and appropriate thing to do, to take thehigh road, not try to cover your tracks to prevent a lawsuit.”

The book “Exposed: A Legal Field Guide for NonprofitExecutives,” which Herman coauthored with Mark E. Chopko,Esq., includes a chapter on “Protecting Vulnerable People fromAbuse.” The five basic guidelines adopted in 1992 by the Conferenceof Catholic Bishops would have applied in the Penn State case,Herman said. They are:

1. Respond promptly to all allegations of abuse where there isreasonable belief that abuse has occurred.
2. If such an allegation is supported by sufficient evidence,relieve the alleged offender promptly of their ministerial dutiesand refer them for appropriate medical evaluation andintervention.
3. Comply with the obligations of the civil law as regardsreporting of the incident and cooperating with theinvestigation.
4. Reach out to the victims and their families and communicatesincere commitment to their spiritual and emotional wellbeing.
5. Within the confines of respect for privacy of the individualsinvolved, deal as openly as possible with members of thecommunity.

“Our recommendation to client organizations is, how would youwant to be treated if yur loved one were victimized under similarcircumstances?” Herman said. “The golden rule is a great rule toapply to day-to-day risk management.”