“The big trick is to be relaxed about uncertainty and, if possible, to even enjoy it… It’s difficult to have an epiphany if all you want revealed is what you already know.” – John Hunt, The Art of The Idea
By Melanie Lockwood Herman
Warm Spring weather foreshadows bright green shoots in my garden and also the convening of risk oversight committees. These gatherings give board committees the opportunity to demonstrate their interest in and commitment to risk oversight. Too often, however, presenters spin a rosy and persuasive story about risk mitigation. They talk at length about what management knows, without any acknowledgment that an organization’s true, top risks are shrouded in uncertainty.
Below is my take on the typical—versus truthful—answers to the most common risk oversight questions.
| Question | What Management Says | The Truth |
|
How likely is that risk, in your view? |
We believe that, based on our strong, effective controls, the risk is quite unlikely. | We don’t know. Honestly, this risk could happen at any time. |
| Do you believe our risk management strategies for that risk are adequate? | Yes, we do. | We don’t know. The true test of our strategies is whether they protect us from disaster if and when the risk materializes. Then we will know. |
| Why did you rank that particular risk #1? | We conducted a focus group/workshop/survey and that risk was ranked #1 by a majority of participants. | Honestly, we thought it was likely to be your biggest risk concern so we put it at the top of the list. |
| Are we adequately insured? | We believe we are. We have an excellent insurance advisor (agent or broker) who has benchmarked our limits against similar organizations. S/he says we’re within “range.” | We don’t know. The only true test is an actual claim. At that moment we’ll find out if our assumptions hold up and if the limits of liability we purchased are adequate. |
| How do we compare to other nonprofits like us? | We have embraced best practices and believe our approach is consistent. | We don’t know. There are no other nonprofits exactly like us, and even if there were, we may want to take a different approach to embracing and managing risk. The bottom line is that our risk management capabilities should suit our mission, structure, and culture, not that of another nonprofit. |
How to Recast Your Risk Reports
Whether you’re new to an executive role or safely ensconced in one, the instinct to say “Yes, I’ve got that covered” is second nature. Projecting excessive worry and uncertainty are the hallmarks of leaders with short tenures. Yet we must find a way to balance confidence with realism. Telling oversight teams “We’ve got that covered” doesn’t make it so.
If you’re reflecting on how to message an update to your risk oversight team, consider crafting statements that tell the truth, inspire discussion, and demonstrate humility and learning.
Step 1. Describe your dynamic risk landscape. Ask committee members to share what they are seeing.
Begin a risk oversight presentation by sharing information on the dynamic risk landscape in which the organization’s mission lives. Elements of your risk landscape may make risks more or less likely to occur, or they may be trends or issues worth watching.
For an arts organization, the NRMC team recently identified the following risk landscape features:
- Audiences increasingly want more varied concert experiences, bringing diverse voices and perspectives
- Streaming video is the most significant growth area in the music sector
- Technology is accelerating the alternatives to live, in-person performances
- Musical genres are continuing to blur
We suggested the following discussion prompt: What additional factors, trends, or developments do you believe could impact our organization?
Step 2. Describe the management team’s view of the top 3 emerging risks (future events).
Share a one-slide view of 3 emerging risks that management is working to explore. If you worry about push-back because the list doesn’t include perennial risks (cyber threats, terrorism, participant serious injury, loss of a major funding source), include that list in an appendix. Focus the committee’s attention on areas where unknowns outweigh the knowns. If using a chart is comforting, try this format:
| Emerging Risk | What we know | What we are exploring and considering to build resilience |
| Unionization | The number of nonprofits that are unionizing is increasing, according to Gallup, and approval of unions stands at 71%, the highest since 1965. (See “Why workers at growing number of nonprofits are unionizing,” Chronicle of Philanthropy. | Despite a record result in our last employee engagement survey, we are committed to understanding opportunities to increase employee belonging and connection to the mission. We have formed a small, volunteer group to design the next engagement survey and also champion engagement strategies. |
Possible discussion prompt: What emerging risks are you seeing that could be relevant for this organization?
Step 3. Describe how the nonprofit’s approach to risk management is evolving.
Resilience, not stability, should be the goal of a risk management function. Yet many leaders insist on presenting reports that suggest sameness: We’re doing what we’ve always done and it’s just fine. Break out of that mold, and describe what’s new and changing in your approach to risk management. For example:
- We’re experimenting with a 100% volunteer risk/safety committee. Staff who volunteer are taking turns planning and leading meetings.
- Inspired by the Risk Assessment led by an external organization last year, we’re designing an internally-led assessment for next year.
- Professional development is one of the themes of our risk/safety committee meetings. Members are identifying practical ways they can increase their understanding of key risk topics.
- We have created a roadmap to show you how our risk management journey is progressing. That roadmap shows 3 views: what we have accomplished in recent years, the focus of current work, and what we hope to tackle next year.
The expression “creature of habit” is attributed to American writer Edgar Rice Burroughs, who wrote, “We are, all of us, creatures of habit… we fall naturally and easily into the manner and customs which long usage has implanted ineradicably within us.” When I book a flight, my first choice is seat 21F; 8D on a smaller plane. I generally drink the same quantity of coffee every day, with beans from a nearby roaster. Habits and rituals help us navigate our days without having to stop and overthink every move. Yet when that habit or ritual involves mythical reporting to a risk oversight committee, it’s a true missed opportunity. If your risk reporting is wrapped in certainty, consider taking off the protective layers to reveal the messy, uncertain nature of risk that lies beneath. When you do so, you might be surprised by the interesting conversation that happens!