Risk Management: Contain Threats Before They Become Critical

Financial risks may be the most obvious threats to the well-being of nonprofits, but these organizations need to worry about other risks as well — from their reputation in the community to their volunteers’ conduct. If you don’t have a comprehensive risk management plan, your nonprofit may be courting unnecessary danger.

Your risk list

The first step is to identify your organization’s greatest risks. Some are common to most nonprofits, such as:

  • Dishonest staff, volunteers, donors or clients
  • Financial losses
  • Threats to physical and intangible property
  • The unexpected departure of key employees
  • Loss of donor and community goodwill
  • Revocation of tax-exempt status

What are your organization’s specific risks? For example, you may rely heavily on state governmental grants, your endowment may be invested in high-performing but risky securities, board members may not always adhere to your conflict-of-interest policy or volunteers may accept cash donations without staff oversight. Increasingly, online hackers and the unmonitored use of social media by staffers threaten nonprofits.

Identify your areas of greatest risk exposure and then determine how you’d act if forces beyond your control challenged them. For example, if your cash-strapped state government eliminated your funding, where would you apply for new grant money? How would you keep your programs operating in the meantime?

Prioritize financial threats

Managing and protecting financial resources is the biggest challenge for most nonprofits, so start building your risk management plan there. Address any acts that could lead to the loss of value of financial assets — including theft, fraud, misuse of funds, poor investment decisions and inappropriate selection of sponsors and partners.

Then establish policies and procedures to prevent such losses. For instance, by requiring your organization to maintain a certain amount in a cash reserves account, your board can manage the risk that at some point you’ll confront a budget shortfall or financial emergency.

Formal internal controls also are essential. Mandate proper oversight by senior management and board members, and document procedures for authorizing transactions, securing assets, and preventing and detecting fraud.

Cover all the bases

Don’t try to develop a risk management policy alone. To ensure you’re covering all the bases, involve your board, managers, insurance company, legal counsel and financial advisors. Depending on the risk, you might also want to talk to staff members and volunteers for a ground-level perspective.

If, for example, your organization serves children, you can’t afford to overlook a single risk. Some measures may seem obvious, such as obtaining liability waivers from parents, conducting criminal background checks on adults who will work with the children and maintaining up-to-date records of the children’s allergies and medications. But have you considered a photo-taking policy? What about procedures to follow in the event of an accident? Do staff members and volunteers know what to do if they spot a stranger lurking outside your playground?

After you develop a detailed plan to address such risks, communicate it to staff and volunteers and provide training, if necessary. Also keep in mind that risk management is an ongoing process, so your nonprofit should continually review and revise policies and procedures to address emerging risks.

Insurance protection

Insurance also helps nonprofits offset risk. Aside from general (or commercial general liability) policies, some specialty products are available, including:

  • Property
  • Accident and injury
  • Auto
  • Product liability (if your nonprofit sells anything to the public)
  • Directors and officers (D&O)
  • Professional liability (malpractice)

An insurance professional can help you decide which policies you need and provide information about limits, deductibles and cost.

Of course, insurance won’t solve all of your risk issues. Tax-exempt status and fundraising capacity can’t be protected by insurance. And not even the best or most inclusive insurance policy will help you repair damage to your reputation. That’s why you need a complete risk management plan in place to complement your insurance coverage.

Complex undertaking

Risk management is a complex undertaking. You likely already have some policies and procedures in place, but to ensure you’ve taken steps to mitigate the biggest and most costly risks, consult with your financial and legal advisors.