Risky Business: Risk Management and the Not-for-Profit

Changes made by the Australian Charities and Not-for-profits Commission (ACNC) to increase the accountability and transparency of the NFP sector mean charities and other NFPs will now be expected to have greater ownership over their financial investments and risk management strategies.

These changes are not a bad thing, in fact quite the contrary. They’ve been established to ensure that the foundations for increasing the scale and scope of Impact Investing in Australia are in place. In other words, the Government is preparing to significantly expand its investment in NFPs and social enterprise, but it’s laying down some ground rules first.

How NFPs respond to these changes is very important to the future of Impact Investment in Australia, where investors in social or environmental challenges are using impact measures to determine where to invest their capital. Charities and other NFPs need to position themselves to own and manage the risk inherent within their operations, and — like for-profit organisations — ensure that their funding and capital investment has positive impact not just in the short-term, but well into the future.

Why Have a Risk Management Framework?

Changes to policy and legislation, economic upheaval and the re-allocation of funding all have the potential to become detrimental to the success of your organisation if not properly managed and accounted for.

In order to create positive long-term impact, NFPs must look beyond simply registering and reporting to the ACNC. They need to work to establish ownership of their investments and operations in order to indemnify themselves against risks like changes in policy and governance and broad-scale economic upheavals. One of the simplest and most effective ways they can do this is by establishing a risk management framework.

Competing priorities and a lack of understanding about who is responsible for addressing the issues of risk management have left many NFPs with little or no risk management framework in place. As Australia expands its commitment to Impact Investment, organisations that fail to demonstrate an effective risk management framework will find themselves not only facing any number of potential calamities, but also – more importantly – overlooked when it comes to the assignment of funding and capital investment. For obvious reasons, funding bodies and investors will favour more forward-looking organisations and social enterprises that are capable of identifying, minimising and managing risk. In short, any NFP without a sound and effective risk management framework will be seen as a poor investment.

So Who’s Responsible?

A common obstacle in the governance of NFP organisations is determining who’s responsible for risk management. For this purpose we define ‘governance’ as the role of defining the organisation’s long and short-term goals, direction, limitations and accountability frameworks, and ‘management’ as the administration of everyday operations, including the allocation of resources. In other words, governance determines what the organisation does and what it should become in the future. Management determines how the organisation will reach those goals and aspirations.

Responsibility for establishing a risk management framework that can anticipate, assess and manage potential threats to the operation and profitability of the organisation belongs to the organisation’s governing body or board.

Risk Management 101

Risk management is not about being pessimistic or looking for potential disasters. It’s simply about being aware of potential risks and setting up appropriate plans and guidelines to identify, assess and minimise risk. Although some might see establishing a risk management framework as time-consuming and a waste of resources, if done properly it can allow the organisation to operate far more efficiently and effectively with minimal complications, and empower staff to anticipate and assess challenges well before they become problematic.

Most risks fall under one of two headings – strategic or operational. Strategic risks are those that have the potential to harm or damage your organisation in a serious – often public – way. These are the ‘front page’ disasters that can bring down your entire organisation, for example illegal or disreputable activity or association with undesirable individuals or organisations. Operational risks are anything that can have a negative impact on the way your organisation operates day-to-day. These might include a reduction in funding, poor employee engagement or mismanagement of resources.

Below is a brief outline on how to establish a simple but effective risk management framework for your NFP organisation:

Step 1

Identify the range of risks that might affect the organisation across all its areas of operation, including (but not limited to) change of government policy, economic climate and the re-assignment of funding.

Step 2

Assess each risk in importance, impact and the likelihood of it occurring. This can be done using a simple table or spreadsheet.

Step 3

Identify at least one strategy for minimising and managing each risk, including individual responsibilities and who will accept ownership of – and be accountable for – the risk.

Step 4

Establish a regular reporting process so you are continually revising, updating and re-assessing your risks and risk management strategies.

Step 5

Establish a framework auditing procedure so you can be sure your risk management framework remains relevant and effective.

Owning and implementing an effective risk management framework will soon be considered essential for all NFPs, charities and social enterprises that want to secure and sustain a profitable operation. Establishing your framework should be a fairly straightforward process and, if done properly, one that creates an invaluable planning and management tool that will help ensure the sustainability and positive impact of your organisation, both today and well into the future.

This article was previously published in the 2013 Better Boards Conference Magazine, July 2013. Please note that some of its subject matter is reflective of the original publication date.