How do you create a culture of risk management in your nonprofit? And what is a culture of risk management?
The Nonprofit Risk Management Center had a really nice piece last week about the culture of risk management in nonprofits, and how to establish it. From their article:
When nonprofit leaders reach out to the Center for advice on weaving risk management into the fabric of their organizations they often assume that what’s missing is a long list of policies. While adding new or updating existing policies may be in order, a bigger-picture issue almost always requires more immediate focus. That issue is the culture of the nonprofit, which may be either receptive or hostile to risk management. And, while culture change is a long term effort, starting as soon as possible will lend credence to everything else that follows.
As the article states, risk management isn’t just a list of policies or your insurance policies (that is risk financing, a part of risk management). But it is the tone that is set by board and management. The nonprofit’s ethics also come into play here. If the CEO walks out of the office with a ream of paper under their arm, what does this tell the staff? If the Executive Director says to the staff, “We can’t let the Board know anything is wrong!” what message are they communicating?
To me, and as the above article illustrates, a culture of risk management is one of always asking questions about our organizations. Typical risk management questions like, “What’s the worst that could happen?” to perhaps less typical questions such as:
- What would would happen to our event twice the amount of people showed up as we expected?
- How do we reward staff? Are we doing enough?
- Is there a better way to present out financials that will make them easier to understand?
- Are we being honest in our communications with our stakeholders?
A nonprofit organization faces risk every day just by opening its doors. If a nonprofit serves a vulnerable population such as children or the elderly they can face even greater risks. But clearly we are not letting that stand in the way of doing needed work. Managing the risks nonprofits face is critical to the success of meeting our goals and missions. The more we can make risk management a part of our daily processes, of creating that culture of risk management, the better our organizations will be.
Do you have any other ideas of questions we should be asking ourselves? Post them in the comments below. If you would like to immerse yourself in nonprofit risk management issues in a lively, intelligent and entertaining way please check out the Risk Management Center’s 2009 Risk Management and Finance Summit for Nonprofits.
As I mentioned in the post below the Urban Institute’s 
