by Rachel Sams
Wondering if your organization needs to hire someone to handle risk management full-time?
Every nonprofit, and every risk management journey, is different. We can’t offer you a magic formula that will tell you whether you need to hire a risk manager, but we can definitely tell you what factors to weigh as you consider the question.
For most nonprofits that create a risk function, there’s no single reason. Typically, multiple factors come together to make it the right decision for the organization. Here’s a look at some signs that could indicate your nonprofit needs to hire a risk leader, and some things to think about if you decide to explore that.
Reasons You Might Want to Hire a Risk Pro
List the reasons you think your nonprofit might need to hire a risk manager. Compare them to our list of good indications that a nonprofit should consider hiring a risk professional. How much overlap do you see?
- Your nonprofit experiences rapid growth.
- Your board has a high level of interest in risk management and wants more staff resources dedicated to it.
- You work with a lot of personally identifiable information (PII)—for example, in health care. The stakes for safeguarding that data are high, and you will need to build out extensive systems to protect it. If this is the #1 reason you want to hire a full-time risk professional, you might need a specialist, with tech risk expertise, versus a generalist.
- Your work includes higher-risk endeavors, such as serving youth, the elderly, or clients with intellectual and developmental disabilities; overseas operations; adventure programs; or extensive travel. Among other considerations, this means more year-round work to manage your insurance portfolio, a good fit for a full-time risk management position.
- You have examples of risk management in place, in various functions and departments, such as policies and internal controls in your finance function, and thorough candidate vetting in your hiring function. But you worry that there are gaps elsewhere. If you want to build a more holistic approach to risk management or sync up capabilities that live in silos, you might need a full-time risk professional to champion that work.
- You have subgrantees or third parties performing high-risk activities or operating in high-risk environments. This often requires thorough up-front contract crafting and review to ensure that responsibility for risk is clearly assigned and all parties have appropriate insurance.
How to Set a New Risk Manager Up for Success
As you prepare to hire a risk manager, some interim steps can help your nonprofit give that person the best possible chance to be successful. These steps can also you help you build the case and the budget for the new position.
- Identify a person or people on staff who can take on some risk management responsibilities as a subset of their role. This can be a development opportunity for talented staff and help your organization lay the groundwork for the future.
- Work with your insurance broker or reach out to NRMC to identify basic risk management steps you can put in place right away.
- Ask your team members what percentage of their time they spend on risk management, as your nonprofit defines it. What could they do with that time if they weren’t spending it on risk issues?
- Ask peers (in a CFO roundtable, etc.) who have a risk management position if they can share a job description. See what items from that job description would fit well with your nonprofit’s culture.
- Consider the criteria for this position. Many people hiring a risk manager seek someone with 5 or 10 or even more years of experience in risk management in a nonprofit. But this discipline can absolutely be learned on the job—and that might be a great way for your organization to build risk management capacity.
- Consider your reporting structure. Which senior leader oversees risk today or reports on risk issues at board meetings? Or which senior leader is enthusiastic about evolving risk in your nonprofit? That’s likely the person your risk manager should report to.
If your nonprofit has never had a full-time risk manager, creating the role can feel daunting. It presents challenges as well as opportunities. A risk manager can bring a new lens to issues your nonprofit has struggled with, and identify commonalities across departments. Whether you decide to hire a full-time risk manager or not, the more you understand about your nonprofit’s approach to risk, the better positioned you’ll be to improve it.
Rachel Sams is a Consultant and Staff Writer at the Nonprofit Risk Management Center. Reach out to her with questions or thoughts about when to hire a risk manager at rachel@nonprofitrisk.org or (505) 456-4045.