By Melanie Lockwood Herman
Frameworks for understanding and managing risk within organizations—often referred to as risk management “standards” exist in various forms throughout the world. Last week I had a wonderful opportunity to participate in the ongoing discussion about how voluntary standards and regulatory oversight of industry inspire, encourage and in some cases, coerce adherence to protocols that increase the safety of products and services. The opportunity arose from an invitation to discuss “Risk Management Standards for Nonprofit Organizations: Challenges and Opportunities,” at the International Conference on Risk Assessment and Management, sponsored by the United Nations Economic Commission for Europe (UNECE) in Geneva, Switzerland.
The conference attracted speakers and participants from numerous countries in Europe as well as representatives from Africa, Asia, South America, the Middle East and North America. During the segment of the conference in which I was called on to speak the familiar topic of “culture” came up several times. My reference on the topic was that the most disciplined application of a risk management standard can be diminished by an organizational culture that insists on diverting risk management responsibility to a single staff member.
During the period 2004-2005 the NRMC had an opportunity to design a number of risk management tools for use by nonprofits in Australia and New Zealand. During this time period we were exposed to the Australian/New Zealand Risk Management Standard (known as AS/NZS 4360: 2004), which was subsequently adopted throughout the world. Its widespread acceptance led to the development of what is being referred to as “the first global risk management standard.” That standard, which was published in November 15, is known as ISO 31000:2009. The new standard is the result of a multi-year international collaboration of top risk management experts from around the world. Also released this year is an accompanying piece, ISO/IEC Guide 73:2009, Vocabulary for Risk Management.
The new “global” standard offers yet another definition of risk:
[Risk is] the effect of uncertainty on objectives.
By including a reference to objectives, the new definition puts risk in context, something we have been urging nonprofit leaders to do since 2004. Leaders intuitively understand that risk arises and is shaped by the mission and goals of their organization, but unfortunately that intuitive grasp is often diminished when it comes time to addressing risk. Audiences of nonprofit CEOs and board leaders will often tell me that “risk is necessary,” and “risk is important…we have to take risks!” but later request a checklist to help them simply (and inexpensively!) avoid or eliminate the risks their organizations face. We’re eager to rush to “solve” the “problem” of risk rather than first reflecting on its role in advancing the mission of our organizations and its relationship to the goals and objectives that are essential for mission fulfillment. The availability of risk management standards, including the recently published ISO 310000:2009 can be helpful in our journey. But no standard obviates the need for reflection and ongoing dialogue about risk-taking and risk management.
As we engage in conversations about risk in our organizations we must also learn to cope with factors and influences beyond our scope of control. In some cases factors beyond our control (e.g., improving economic conditions) may support the realization of critical objectives, while in other instances that which we don’t control may impede mission fulfillment.
Perhaps nowhere is this more evident for nonprofits than financial matters. As many leaders across the country work to finalize budget projections for FY 2010 a great number are reflecting on the failure to accurately forecast the events of 2009. What signs did we miss? What steps could have been taken to minimize poor results in the current fiscal year? What additional information would have been instructive as budget projections were developed? Who in the organization—perhaps staff or board members—has special expertise, perspective or insights that should be tapped as we finalize the budget for the coming year?
While it is human nature to be eager to move past what was for so many nonprofits a very difficult year, sound risk management implores us to take time to reflect on the reasons our forecasts were inaccurate or “mistakes were made.” The missions of our organizations deserve this focus, and doing so can only improve the quality of our planning work for the year ahead.
Melanie Lockwood Herman is Executive Director of the Nonprofit Risk Management Center. She welcomes your feedback on this article and your questions about any risk management topic. Melanie can be reached at: Melanie@nonprofitrisk.org.