By Melanie Lockwood Herman
The recent, abrupt change in weather this week offered a reminder about the importance of preparation. Yesterday morning I retraced my steps into the house to retrieve a pair of gloves for the drive to the office. I was not prepared for the cool temperature and rather surprised to see my normally bright yellow car sporting a frosty overcoat.
As I donned gloves for first time this season, the cliché “hand in glove” came to mind. I reflected on how thoughtful planning and goal-setting are integral components of sound risk management. As we explore ways to manage risk in a nonprofit, it’s important to set goals and plan. The concepts go “hand in glove.” A traditional approach to risk management however will often lead to activity-based goals. The risk management committee or “team” creates activity-based goals by identifying the steps it will take to understand and manage risk. For example, the team may agree that it will design and deliver spring and fall safety briefings for all paid and volunteer staff. Or the team may set a goal of creating a social media policy prior to the next Board meeting.
In his book, Mission Impact, Robert M. Sheehan, Jr., an author, academic and management consultant, contrasts activity-based goals with outcome-based goals, noting that “Unfortunately, outcome-based goals are all too rare in organizations.” Sheehan adds that “It seems much easier to list the activities that an individual or team is going to work on rather than the specific outcomes that the activities are intended to produce.” [emphasis added]
The emphasis on activity-based goals is evident in risk management programs that begin with generating risk information, with a lion’s share of the effort devoted to listing, sorting and ranking risks onto a “heat map” or “risk register.” This leaves precious little time and energy for actually applying that information to decisions so that the organization is better managed and the likelihood of achieving objectives is improved.
That’s not to say that the process of uncovering and understanding risks is superfluous. Both elements are essential to effective risk management. You can’t manage an organization in the face of risk (I’m thinking positive risk as well as downside risk!) unless you first take the time to understand what events, circumstances and forces within or outside your control could impact mission fulfillment. However, failing to consider an outcome-based approach to the risk management process is a missed opportunity.
For example, instead of beginning with the more traditional process of list making and risk ranking, consider asking your Board or the Risk Management Committee to brainstorm:
- What will our organization look like after we have strengthened our risk management efforts?
- What do we expect to know or understand “then” that we don’t know or understand now?
- What do we hope to accomplish in terms of achieving our strategic objectives, building organizational resilience and increasing confidence among key stakeholders?
- How will we measure the value-added impact of our efforts?
- How will we hold ourselves accountable?
- How will we capture both what works and what doesn’t work (risk of failure, anyone?) into our learning loop?
Sheehan reminds his readers that “failing when trying new ideas” should be seen as “a learning opportunity.”
We are approaching a season of time-honored traditions. During the upcoming holiday season many of us will be drawn to the familiar. As any hostess who has experimented by serving fish stew as the main course for Thanksgiving Dinner can attest, doing the unexpected and taking bold risks is sometimes out of order. While I would recommend that you stick with turkey, ham or a familiar vegetarian alternative for your Thanksgiving feast, I hope you won’t fear taking a non-traditional approach when it comes to creating or updating your risk management program. Rather than accepting an activity-based approach that seems familiar and comforting, consider trying something new and taking risks, such as experimenting with an outcomes-based goal-setting process.
Melanie Lockwood Herman is Executive Director of the Nonprofit Risk Management Center. She welcomes your feedback on this article and questions about the NRMCs resources at Melanie@nonprofitrisk.org or 703.777.3504. The Center provides free and affordable risk management tools and resources at www.https://nonprofitrisk.org/ and affordable consulting assistance.