Getting Started with Enterprise Risk Management

Recognizing and managing risk is different than managing strategy. Thinking about risk centers on negative threats and failures versus a strategic focus on opportunities and successes. It is a counterintuitive mental model for most nonprofit leaders. In general, risk is hard to discuss because people tend to overestimate their ability to control life events that are actually controlled by chance. Behavioral scientists have found that people are inclined to be overconfident about their ability to predict risk, yet lack the ability to predict the full range of outcomes that can occur. There is a tendency to extrapolate from recent experience and apply this understanding and perception to an uncertain future. This confirmation bias drives us to favor information that supports our position and to discount information that challenges or contradicts this viewpoint. It becomes even more challenging when an event diverges from expectations, because most people escalate and cling tighter to their views and commitments.

These biases play out in an organization’s inability to talk about and explore mistakes and failures without judgment. The uncertainty with which most nonprofits operate and the human inclination to confirmation bias explains why leaders and organizations often overlook, discount, and delay action on emerging risks. Early warnings often come as ambiguous smoke signals and symptoms that suggest that something is amiss. Early warnings investigated and resolved differentiate false alarms from critical alerts.

Enterprise risk management is a disciplined way of dealing with uncertainty and threats. It creates an awareness that helps organizations identify and control risks. As a way of thinking and acting, risk management requires cultural and organizational discipline in the form of management processes and policies. By codifying performance expectations in rules and preferred actions, an organization’s policies and business processes enable staff to cope with uncertainty. By strengthening business processes and policies, leaders are able to prevent lapses, promote quality and protect vital resources. ERM provides a framework for identifying risks and deciding what to do about them and in what priority. Because risk is ever present in all nonprofits and NGOs, risk identification, assessment, and mitigation planning should be integrated into all aspects of organization activity.

A guiding framework for recognizing and acting on risks might look like this:

Step 1. Look for risks by asking what could go wrong in the future and what has gone wrong in the past in the organization and in similar organizations. In what ways is the organization vulnerable to risk? Could these risks recur?

Step 2. Consider the ways risks could affect the organization and where these risks would hit hardest within the organization. Use scenarios to stress test operations. What risks should be prioritized and handled first?

Step 3. Consider ways to control risk and risk reducing mitigation actions that could be taken. What are we prepared to do or change in order to reduce risk? What capacity and resources can be deployed to address risk?

Step 4. How will we knit together our risk mitigation efforts to make an ERM program and plan? How will we integrate ERM activities into our other quality improvement and performance management activities? Who should be involved in developing and implementing solutions?

Step 1. Taking Stock of Your Organization and Its Readiness for ERM

As you begin thinking about introducing ERM to your organization, you will want to take stock of your organization’s readiness to engage in this kind of focused effort (Figure. 2.2). It helps to think through questions that will allow you to gauge how open or prepared your board and staff members are for a deep dive into the mechanics of your organization’s operations. Start by thinking about your organization’s legal structure and its life cycle, culture, and experience with planning. Here are some questions to consider: Are we a start-up or legacy organization or something in-between? Do we have an annual goals document developed with board, department, and program managers and staff? Have we implemented a strategic or business plan successfully before? Are board and staff comfortable working across departments, programs, and divisions? Are we an internally-facing organization making management hires and promotions from within? Are staff members comfortable with accountability and performance expectations? Are we comfortable talking about risk and mistakes? How receptive is our organization to change?

Here are some additional questions to consider at the beginning of your ERM planning process.

Step 2. Find Champions and Build a Team

Thinking about your organization as the sum of its parts helps everyone take responsibility for identifying and managing risk. Engaging program, department, and division heads, managers, supervisors, front-line staff, volunteers, and boards in thinking about risk increases the likelihood that issues will be identified early. The earlier a problem is identified, the greater the chances are of resolving it before it turns into a crisis or does damage. It allows many eyes and ears to look and listen for things that could harm your organization and affect its ability to achieve its goals or do high-quality work.

The idea behind ERM is to take a comprehensive look at risk within departments, job functions, and across the entire organization. Within each functional area of operation—whether it be a program or line of business, finance, back-office administration or support —your team can assess vulnerabilities related to their job duties or areas of responsibility. You will want to establish a solution-oriented and non-judgmental environment to encourage your project manager or team to share information, be forthcoming about mistakes made, acknowledge weaknesses, and propose solutions to risks identified in their operation.

Step 3. Engage Managers, Staff, and Board in Risk Assessment

Talking about risk and how to avoid it is an essential part of enterprise risk management. Educating board officers, managers, employees, and volunteers about risk will help prevent mistakes caused by ignorance and will ground all activities in an awareness and understanding of organizational culture and ways of working. People must fully understand what they need to do, how they may do it, and what they cannot do.

Just like a focus on program quality or performance, it is important to make conversations about risk and risk awareness an everyday activity. Setting the tone at the top and reinforcing risk awareness through training, supervision, annual staff performance reviews, and in standing meetings creates a climate where managers and staff can actively engage in risk identification and assessment activities and provide regular updates as the process unfolds.

Here are four ways to communicate your commitment to better manage risk and your intention to engage all board, staff, interns, and volunteers in risk awareness and enterprise risk management activities.

Introduce the concepts of risk and risk management when you onboard new employees, interns, volunteers, and board members. Hold an orientation and provide a description of the organization’s approach to risk management in handbooks for new employees, board members, interns, and volunteers. The orientation will have a broader focus but it should include a discussion of performance, a definition of risk, and description of risk management activities.

Build a risk management focus into training and supervision. Provide training, annual refreshers, and regular supervision for staff, interns, and volunteers so they learn the organization’s goals, values, expectations, and desired practices. Include a discussion of risk and how to handle it as an ongoing conversation in each session.

Include risk management discussion items on standing meeting agendas. Incorporate a discussion of risk and risk management into regularly scheduled monthly or quarterly meetings with staff to help them identify risk in their areas of responsibility, discuss how risk is handled now, and create a plan for how to more effectively manage and mitigate risk.

Establish a risk committee or vest a standing committee with responsibility for monitoring risk. Include a discussion of risk and risk management at board meetings and task one board committee with responsibility for monitoring implementation of ERM plan activities. Help the board understand the organization’s risks and risk profile. Accept that like quality improvement and performance management, risk identification will be ongoing and that engaging in active governance around risk mitigation activities is important.

When beginning an ERM planning process, it is important to know that the board and senior management team are ready to commit the time needed to construct and implement the plan. Whether staff led or consultant facilitated, the board, project manager or team selected to lead the ERM effort must set the tone at the top and insure that the necessary risk mitigations activities outlined in your ERM plan (policies, processes, and practices) are implemented. Your organization will be well served if you convene a work group of managers, staff, and volunteers to help inform the project manager or team during ERM plan development. The configuration of team members will depend on what makes sense for your organization. It’s important to constitute an ERM planning team that spans program, administrative, financial, and back-office functions. What’s key is putting together an enthusiastic and engaged ERM team and doing the necessary preparation to communicate ERM to managers and line staff.

It’s important to consider the readiness and receptivity of staff and volunteers to the ERM process and devise a plan to address concerns, resistance, and apathy. This can be done in a kick-off meeting and through smaller department or program discussions. You can use the time to inform, educate, and raise awareness of organizational risk, why mitigation is necessary, and why ERM is everyone’s concern and responsibility.

Step 4. Frame out the Process

This book includes templates to simplify the risk assessment and mitigation plan development process. The templates are available in a paper or app format. Using these templates as guides will allow you to jump-start your ERM planning and create a first-generation plan. Over time, your team can customize or adapt the framework to meet your needs.

The templates and other guides in The Nonprofit Risk Book will help you focus your time and resources on creating an ERM plan in real time. The plan itself can be developed over a period of weeks, depending on the size of the organization and capacity of the ERM project manager or team. Implementation and monitoring activities will typically roll out over a 6 to 9-month period and run between 12 to 18 months, depending on the plan scope and the infrastructure in place. Start the process by creating a description of the ERM process, it’s goals and a timeline for your ERM planning process and share it with your staff and board.

Step 1. Risk Identification

Start with a mix of general framing and specific questions to guide your thinking and begin to surface issues, patterns, or trends. This section offers four approaches you can take to identify the risks that matter for your organization.

In this section, you will find several tools to help you organize your risk assessment activities and makes sense of your findings.

Step 2. Risk Assessment

How vulnerable is your organization to risk? Identifying risk is only part of the story. You need to weigh risks to decide which are priorities and warrant immediate attention, and which could have outsize effects on your organization. In most nonprofits, risk clusters on the service and program side of the house and in the finance area. But risk is also found in other functional areas of the organization where leaders are far less likely to take note and where fewer processes are in place to identify vulnerabilities or exposure.

When moving from risk identification to risk assessment, start from what you know and what you worry about. Think about the things that keep you up at night—what we call your worry list.

Risk assessment looks at what risks or vulnerabilities are present in the organization or its operating environment. Risk can surface in all nonprofit organizations and in any department, program, or operational function. When risk emerges, it is typically due to a breakdown, lapse, or omission in one or more of the key operating pillars of an organization. These key pillars include your people, policies, practices, business processes, and technology.

People. Do you have the right people in the right jobs? Are your programs and operations staffed by people who can perform at or above expectations in their jobs? Do you have a sufficient number of staff and supervisors to perform critical activities? How do you handle human error or mistakes? How do you supervise and support staff and volunteers to prevent fraud, collusion, inefficiency, theft, inappropriate behavior, or poor performance? Does your organization have a code of ethics and statement of values?

Policies. Are the organization’s rules and protocols formalized in writing and clearly and regularly communicated to staff, board, and recipients? How do you test for comprehension, understanding, and implementation? Are program and department manuals current and do staff members receive an orientation and annual refresher training? Do you update your policies annually to reflect current conditions, regulatory or industry changes, and new services or revenue streams? Do your policies include notification and escalation processes, internal controls, and supervisory sign-off? Do you have a risk policy?

Practices. Is practice consistent from person to person in your program, department, or division? How does your organization prepare employees and volunteers to think about risk, quality, and performance? How do you train, supervise, modify, correct, or use progressive discipline to improve performance and effectiveness and to reduce risk?

Processes. Are your business processes formalized and standardized? Do they flow from your policies? Do you have a notification and escalation process for critical information, untoward events or incidents? Does everyone understand the decision-making processes? Does your organization have a formal process for identifying, addressing, and tracking risk in each program, division, or department?

Technology. What technology solutions can you use to identify risk? Do you use automated financial management, talent management systems, electronic case records, or purchase cards? Are your data systems linked or tied to a quarterly dashboard report? How do you use the data you collect to identify areas of risk or issues to be addressed? Do you have a sensitive data inventory (where data is kept, acceptable use, records retention, encryption, security) and disaster recovery system?

In any risk assessment, the organization must evaluate an array of factors that might lead or contribute to a loss or claim or otherwise contribute to exposure.

Here are some tips to consider as you begin your risk assessment process:

Step 3. Organize and Describe Risks

Create a taxonomy to categorize your organization’s risk by function, department, division, and program. Remember that risk occurs in all corners of nonprofit and NGO operations. Use the taxonomy to group similar risks under a single broad operational category. Look for risk in obvious and less obvious places. A standard nonprofit risk taxonomy covers all nonprofit operations and activities.

Throughout the book, we use the functional areas above as categories to illustrate where risks occur and how risk can emerge. There is a chapter dedicated to risks and risk considerations for each functional area.

To understand the origin of risk, your organization will engage in an exercise to pinpoint causal factors. The underlying factors that interact to create risk or the conditions in which risk can grow are called drivers. Use the five organizational pillars described previously in Step 2 (Risk Assessment) of this chapter as a framework to explore the forces that cause or restrain risk in your organization.

There are three other considerations that enrich understanding about the nature and importance of risk in nonprofits and NGOs: location, recurrence, and capacity to cure. Each of these considerations fleshes out your understanding of risk in your organization. They shed light on the dark corners of hidden or poorly understood risk to help you better understand what it will take to prevent or mitigate risk in your organization.

Likelihood/Impact Matrix

Likelihood and impact are two dimensions used to assess the degree of harm that can result if a risk in your organization is not addressed. Likelihood is defined as the probability that a risk has, can, or will occur in the organization. The likelihood rating ranks the risk as very likely, moderately likely, or not very likely to occur. Impact is defined by how significant the effects of the risk could be on the organization. It answers the question of how serious the consequences would be if this risk occurred. Would the risk have a high, medium, or low impact?

You can use a two-by-two matrix like the one shown in Figure 2.6 to rank the risks on your list according to likelihood and impact. You take the risks identified in your Risk List and, in a discussion with your team, place each risk in the box that reflects your best thinking on the probability and effect it would have on your organization. Each box in the matrix corresponds to a scaled value, one that runs from high-to-low likelihood and another that runs from high-to-low impact. There is no single right way to forecast the likelihood or estimate the impact of risk. It helps to have your team involved in this exercise to add perspective and offer differing points of view.

Reaching team consensus on risk likelihood and impact will help you make decisions about resources needed and mitigation strategies with confidence. Figure 2.6 illustrates how a Likelihood/Impact Matrix might be completed by a nonprofit or NGO. The risk matrix tool answers the question: how vulnerable is your organization to risk?