Take Action on Risk: Make a Plan, Not a List

“Research has shown that of all forms of human motivation the most effective one is progress. Why? Because a small, concrete win creates momentum and affirms our faith in our further success.” – Greg McKeown, Essentialism

Are you a compulsive or habitual list maker? If so, you’re not alone. Many risk management professionals love to make lists. Traditionally, lots of risk management efforts start and revolve around a list of risks.

We at NRMC aren’t asking you to give up list-making, but we urge you not to make a list the centerpiece of your risk management efforts.

Our team has seen nonprofit risk programs with lists that totaled nearly 200 risks. Risk lists can quickly fill with clutter that distracts your team from the most important issues you face. We encourage you to try risk action planning instead. This approach will help your organization make progress to fortify your mission and build resilience and readiness for risks that could have the biggest impact on your mission.

Your team can approach risk action planning in a variety of ways. We encourage you to pick an approach and jump in. You can always change course later, or start a different kind of plan when you finish one. Consider these options for how to make a risk action plan. Perhaps your team will form its own hybrid of these approaches.

Take a bite. Pick one risk that really worries your team. Brainstorm how that risk could play out for your organization. Try one of our worksheets, “Time For Action” and “Broaden Your Perspective,” to help you consider possible scenarios and actions.

Have a meal. Make a plan for how you will address several risks your organization faces, interrelated or not. Consider the relationships among the risks and how your team’s actions on one risk could affect others. Your process might show you that seemingly unrelated risks have relationships to each other. That work could help you surface mitigations to address multiple risks. Explore NRMC’s “Action Planning” worksheet to ensure you’re thinking through the decisions you need to make and the perspectives you need to gather. Fight the temptation to get bogged down in the details of each risk. Focus on the commonalities: how would your organization adapt its operations to these types of disruptions? What opportunities and challenges would they create for your nonprofit’s ability to achieve its mission? What can we do today so we’ll be more prepared if any of these risks manifest?

Plan all the courses at the gala. You could think of your risk action plan as a menu of the major activities your risk team will undertake throughout the year. To do this, your team will need to brainstorm the biggest risks you face, prioritize the most important ones, and determine which you will take action on and how. The “Action Planning” worksheet could aid you here as well.

Whatever approach you choose, identify timeframes for action. Spell out when you expect to make decisions and have risk mitigations in place. Identify who you will gather input from before choosing your course of action, and who will execute the next steps in your plan. Estimate how much mitigations will cost and consider whether the cost of mitigations eclipses the potential cost of the risk. Make sure you include diverse perspectives from across the organization. And don’t stop at the first ideas that come to mind when brainstorming how a risk might play out. Things rarely happen the way you expect them to.

Set aside time to test your action plans in a workshop, tabletop exercise, or drill. What potential issues surfaced that didn’t arise in your original brainstorming? Adjust your plan as needed.

If your organization approaches risk with practical action plans rather than exhaustive (and exhausting) lists, you’ll build your ability to respond to emerging risks. You’ll begin to understand your organization’s risk appetite—the amount of risk your team deems necessary to achieve priority objectives and advance the mission. You’ll find yourselves drawing on lessons from previous experiences when a new risk appears, even if the two risks differ. You’ll grow together as a team.

Lists have their place: the grocery store, the day-to-day tasks of life. But when you stop believing that a list is the main ingredient in your risk recipe, the possibilities are endless.

Rachel Sams is a Consultant and Staff Writer at the Nonprofit Risk Management Center. She has experienced personal risk action planning in her relationship to social media. Reach out to her with questions or thoughts about how your organization approaches risk action planning at rachel@nonprofitrisk.org or 505-456-4045.