Unmasking the Discipline of Risk Management

Note: This article is excerpted from the Nonprofit Risk Management Center’s book, Ready…or Not: A Risk Management Guide for Nonprofit Executives.

The discipline of risk management is incorrectly masked in mystery. Leaders of nonprofit organizations may believe that formulas can be applied to discern both the likelihood of good or harm should a risk materialize, and the price tag for those outcomes. Various tools developed by capable organizations have created this impression that a formulaic approach exists and should be applied.

It is not possible to create a formula or algorithm that will generate exact answers in such extraordinarily diverse organizations facing differing circumstances. The appropriate risk management solution for your social services agency may be entirely inapplicable to an advocacy group seeking to draw attention to its cause. No mathematical formula will provide the answers to the core questions that arise when contemplating—and deciding what to do about—risk. To “unmask” the discipline of risk management, we need first to dispense with academic definitions that describe the discipline as a mechanized series of steps that can be applied to fit all circumstances. Risk management is a discipline for dealing with uncertainty. At its most basic level, that may involve simply imagining what events could unfold in our organizations and making the slightest change in behavior to prepare for that possibility. When we pack essential items in our carry-on bag or grab an umbrella without looking in the sky or at the forecast, we’re managing uncertainty.

Uncertainty Makes Us Uncomfortable

In their book Risk-Benefit Analysis, authors Richard Wilson and Edmund A. C. Crouch write, “The very word risk implies uncertainty.” Nonprofit leaders are often uncomfortable with risk and its implication: an uncertain outcome. We want to “program” success in our organizations. But uncertainty surrounds us, particularly as we work to improve the lives of vulnerable clients, reduce pollutants in our environment, provide emergency services to victims of domestic violence, or work to find a cure for a disease that annually claims the lives of thousands. How can we accomplish these laudable pursuits without exhausting the time, financial resources and patience of our staff? While there are myriad approaches to tackling the risk management dilemma in a nonprofit, three tangible tools are within reach…and worth reaching for. These tools can be adapted to suit the culture and needs of any nonprofit, but the presence of these three tools suggests a serious approach to integrating risk management into the lifeblood of a nonprofit. We introduce these concepts below.

1. Risk Management Goals – Risk management goals provide targets and a roadmap for an organization’s risk management program. Without establishing goals, you’ll never know if you’ve made progress or realized success. A nonprofit’s risk management goals answer the questions “What” and “Why.”
2. Risk Management Committee – Despite extraordinary advances in technology, no “system” exists to manage the risks your nonprofit faces. Human insight and effort are required! Creating a risk management committee answers the question “Who.” Desirable characteristics of a risk management committee include:
   • Members/participants who bring diverse perspectives on risk;
   • Individuals who are likely to be candid about their concerns;
   • Persons who enjoy problem analysis and problem solving;
   • Individuals who can serve as credible (in some organizations,representative) ambassadors of the nonprofitfs risk management goals, objectives and activities;
   • Members who represent all levels of the organization, from the highest level of leadership (the board of directors) to front-line staff involved in the delivery of the nonprofit’s core services (e.g., counselors, recreation program managers, mentors, etc.); and
   • People who will advocate sound risk management practices, both within the work of the committee and back in their individual workplaces.
3. Risk Management Plan – A risk management plan is the compilation of a nonprofit’s risk management philosophy, goals, objectives and strategies. It is a snapshot in time of the nonprofit’s approach to managing critical risks. The Center offers a step-by-step guide to developing a risk management plan through the online tool “My Risk Management Plan” found at www.MyRiskManagementPlan.org. A thorough plan will express the nonprofit’s risk-taking appetite and strategies in a wide range of areas, including governance, employment practices, service delivery, financial management, fundraising, facilities, technology, crisis management, special events, and more. Most plans will also include reference to the risk financing strategies and approaches of the nonprofit.