Financial risks may be the most obvious threats to the well-being of not-for-profits, but these organizations need to worry about other risks as well — from their reputation in the community to their volunteers’ conduct. If you don’t have a comprehensive risk management plan, your not-for-profit may be courting unnecessary danger.
Your risk list
The first step is to identify your organization’s greatest risks. Some are common to most not-for-profits, such as:
• Dishonest staff, volunteers, donors or clients,
• Financial losses,
• Threats to physical and intangible property,
• The unexpected departure of key employees,
• Loss of donor and community goodwill, and
• Revocation of tax-exempt status.
What are your organization’s specific risks? For example, you may rely heavily on state governmental grants, your endowment may be invested in high-performing but risky securities, board members may not always adhere to your conflict-of-interest policy or volunteers may accept cash donations without staff oversight. Increasingly, online hackers and the unmonitored use of social media by staffers threaten not-for-profits.
Identify your areas of greatest risk exposure and then determine how you’d act if forces beyond your control challenged them. For example, if your cash-strapped state government eliminated your funding, where would you apply for new grant money? How would you keep your programs operating in the meantime?
Prioritize financial threats
Managing and protecting financial resources is the biggest challenge for most not-for-profits, so start building your risk management plan there. Address any acts that could lead to the loss of value of financial assets — including theft, fraud, misuse of funds, poor investment decisions and inappropriate selection of sponsors and partners.
Then establish policies and procedures to prevent such losses. For instance, by requiring your organization to maintain a certain amount in a cash reserves account, your board can manage the risk that at some point you’ll confront a budget shortfall or financial emergency.
Formal internal controls also are essential. Mandate proper oversight by senior management and board members, and document procedures for authorizing transactions, securing assets, and preventing and detecting fraud.
Cover all the bases
Don’t try to develop a risk management policy alone. To ensure you’re covering all the bases, involve your board, managers, insurance company, legal counsel and financial advisors. Depending on the risk, you might also want to talk to staff members and volunteers for a ground-level perspective.
If, for example, your organization serves children, you can’t afford to overlook a single risk. Some measures may seem obvious, such as obtaining liability waivers from parents, conducting criminal background checks on adults who will work with the children and maintaining up-to-date records of the children’s allergies and medications. But have you considered a photo-taking policy? What about procedures to follow in the event of an accident? Do staff members and volunteers know what to do if they spot a stranger lurking outside your playground?
After you develop a detailed plan to address such risks, communicate it to staff and volunteers and provide training, if necessary. Also keep in mind that risk management is an ongoing process, so your not-for-profit should continually review and revise policies and procedures to address emerging risks.
Insurance protection
Insurance also helps not-for-profits offset risk. Aside from general (or commercial general liability) policies, some specialty products are available, including:
• Property,
• Accident and injury,
• Auto,
• Product liability (if your not-for-profit sells anything to the public),
• Directors and officers (D&O), and
• Professional liability (malpractice).
An insurance professional can help you decide which policies you need and provide information about limits, deductibles and cost.
Of course, insurance won’t solve all of your risk issues. Tax-exempt status and fundraising capacity can’t be protected by insurance. And not even the best or most inclusive insurance policy will help you repair damage to your reputation. That’s why you need a complete risk management plan in place to complement your insurance coverage.
Positive Side Effects
The risk assessment process is actually very helpful with increasing the board’s understanding of the organization and helping the board focus on what is important. Even the longest term board members will learn something new about the organization as the risks are discussed. The process of prioritizing risks has a similar direction focusing effect of strategic planning. We all understand the benefits of an educated and focused board.
Complex undertaking
Risk management is a complex undertaking. You likely already have some policies and procedures in place, but to ensure you’ve taken steps to mitigate the biggest and most costly risks, consult with your accounting and legal advisors.
Please contact Michael Borowitz with any questions or for more information on this topic at [email protected].
