SOME THOUGHTS ON MANAGING RISK IN THE COMMUNITY AND VOLUNTARY SECTOR

1. SOME THOUGHTS ON MANAGING RISK IN THE COMMUNITY AND VOLUNTARY SECTOR Owen Keenan Middlequarter

2. Why manage risk? • Nonprofits have important compliance responsibilities which must be met • Running a nonprofit organisation is serious business – it needs to be taken seriously: e.g. as a service provider/ employer you have serious responsibilities towards those whose lives are significantly dependent on how you perform • You will quickly lose credibility with funders and the general public if you are seen to be cavalier in the way you operate • If your mission and your work matter, you can’t leave them hostages to fate, negligence or abuse – achieving your mission means being in control of your destiny

3. Risk as a reality • Risk is a reality of the world we live in – in fact it can be the reason we do what we do! • Nothing is achieved by denying or shying away from risk • Risk can potentially undermine everything you seek to achieve…but • Embracing and managing risk can enhance your performance and effectiveness

4. Embracing risk/Risk tolerance • Acknowledging the reality of risk empowers and gives control of your destiny • Embracing risk provides a focus for identifying, prioritising and managing critical risks • It is important to recognise that it is not a question of eradicating risk but of minimising and managing those risks that, unmanaged, threaten your business • It is also a matter of acknowledging and accepting those risks that are inherent in the important work that you do

5. Identifying and assessing critical risks • This is an iterative process • The identification of risk should be an inclusive process involving all stakeholders • Identified risks can be grouped and ranked • There are potentially an infinite number of risks – it makes sense to prioritise in terms of a “top ten” • It is important to identify linkages between risks and to identify actions that would have a disproportionately positive impact • It is important to get management and Board buy-in on the key risks identified

6. Setting a baseline and planning to manage your key risks • Once you have agreed what your “top ten” risks are, honestly assess what the current state of play is in relation to each one – this is your baseline • Determine what successful management of each risk would look like – and quantify the “gap” • Establish a series of actions – with a timeframe – and assign specific responsibility for managing each risk • Assign specific lead responsibility for managing the overall risk management process • Establish effective reporting and monitoring processes

7. Building a risk-aware culture – Board, management and staff • Managing risk is a task for the whole organisation – not an individual • Risk and its management needs to explicit and built into the everyday processes of the organisation • In particular, the Board needs to give guidance on its appetite for risk and to establish appropriate reporting processes that demonstrate its active interest and concern • Staff need to be encouraged to reflect on risks and how they could potentially undermine their efforts • The “top ten” risks should be kept under continual review and updated as appropriate

8. How do you prepare for the worst happening? • Acknowledge that it can, and very possibly will! • Be proactive - develop worst case scenarios and identify specific actions that would be appropriate • Consider what would happen if several risks occurred at the same time • Establish and “road test” your crisis management strategy • Identify third parties who might be supportive – include them in your planning

9. A few words on …reputational risk • Your reputation is possibly your biggest asset – it needs to be protected at all costs • It can take many years to earn your reputation but you can lose it in an instant • Your reputation is vulnerable to virtually any one, or combination of your risks occurring • In a worst case scenario it is preferable to be able to demonstrate that you had taken reasonable steps to prepare for the crisis, rather than none at all • Damage to your reputation can last for many years and impact negatively on your capacity to raise funds, recruit high calibre staff, provide effective services and influence policy etc.

10. A few words on …crisis communications • If you don’t manage your communications, somebody else will • Don’t go to ground – you should never be more visible than when you’re managing a crisis • Be honest and truthful – don’t drip-feed the media • Have a crisis communications strategy that involves management and Board – and practice it • Ensure that you are always able to contact key colleagues and have time targets for responding