Risk management

Pobal Community Services Programme 2014

Guidance note on

RISK MANAGEMENT

This is an informal introductory note to the topic of Risk Management, drafted to assist Community Services re-contracting in 2014. It is, we hope, also useful for other community service companies and co-ops in reviewing their plans. This note has been drafted to provide initial guidance only and is not a comprehensive or definitive guide.

What does risk management mean to your organisation?

Before your board can effectively oversee the management of risk, it needs to know what the term “risk” means for your organisation. People tend to interpret the word differently. To some, “risk” means “threat” — something that could harm the organisation or prevent it from achieving its objectives¹. Others see risk as including “opportunity” — something that could help the organisation to achieve new objectives or improve its ability to achieve existing ones.

Risk takes many forms but, for the purpose of this note, we mean anything that affects an organisation’s ability to meet its objectives and preserve its reputation. Organisations are more likely to consistently meet their objectives when they have effective processes for identifying and managing risks. They may do so by considering and addressing risk under a number of categories which include:

• 
  Compliance risk — the risk of fines and other regulatory penalties for such offences as failure to remit payroll deductions, violation of privacy laws, etc. Also, restrictions on the use of funds from donors and funding agencies.
  
• 
  External risk — the risk of becoming irrelevant, losing the support of the public and funding sources, and failing to respond to economic, demographic and other trends.
  
• 
  Financial risk — the risk of fraud, financial failure and decisions based on inadequate or inaccurate information and/or systems.
  
• 
  Governance risk — the risk of ineffective oversight and poor decision-making by the board and management of the company/co-op.
  
• 
  Information technology risk — the risk that the information technologies used in the organisation may not provide dependable service and accurate, secure information that is available when needed.
  
• 
  Operational or Programme risk — the risk of poor service delivery, day-to-day crises, and misuse or neglect of human capital and other resources.²
  
• 
  Reputation risk — the risk of losing goodwill, status in the community, and the ability to raise funds and appeal to prospective volunteers.
  
• 
  Strategic risk — the risk of inappropriate or unrealistic programmes and initiatives, and failure to keep the organisation strong and relevant.
  

Because there are different ways of defining risk, it is of critical importance that the board, staff and (where appropriate) volunteers, all have a common understanding of what the term “risk” means in terms of their individual responsibilities.

Identifying and managing major risks
Some risks could severely affect the organisation’s ability to achieve its objectives and continue operations. It is a principal tenet of risk management that the major risks are identified and managed. A risk analysis that is simply a list of all possible risks in all possible eventualities does not provide the board and staff with the information required to direct their attention and resources to dealing with the most significant and likely risks. Below we list some examples of major risks. We then discuss how to go about identifying these in your organisation and devising a course of action.
Examples of major risks

• 
  Loss of a major source of funding
  
• 
  Reductions in the market value of investments and the income from them
  
• 
  Unsuccessful fund-raising projects
  
• 
  Fraud
  
• 
  Failure of a project or strategic initiative
  
• 
  Inadequate responses to emergencies
  
• 
  Irrelevance because programs or services are no longer in demand or distinctive
  
• 
  Excessive increases in the cost of human and other resources
  
• 
  Actual or alleged sexual misconduct or abuse by an employee or volunteer
  
• 
  Loss or theft of information
  
• 
  Inability to perform critical functions that depend on technology
  

Risk management involves:

A basic risk analysis involves working systematically through a comprehensive list of questions such as those below. It is useful to do this in a workshop style meeting with a cross section of participants that bring a variety of perspectives and experience. In a community organisation, this is best done with the board and manager/other senior staff. The first part of the task usually involves creating a list of risks and giving them some level of importance by asking three questions.

• 
  What could happen that would affect our ability to meet our objectives?
  
• 
  How likely is it to occur?
  
• 
  How serious might it be?
  

There are a number of risk analyses methodologies, some of which may use a scoring system to provide a level of objectivity. Whether or not scoring is used, asking the questions above helps to establish the extent to which risks are (a) likely and (b) serious, and this allows you to prioritise your list. Once prioritised, the next stage is to make plans to minimise the risks. To do that, consider the questions:

• 
  What should we do to reduce the risk?
  
• 
  How can we be prepared to respond to problems?
  

The resulting analysis and actions, in table form, is often referred to as a Risk Register. While large organisations might have a separate risk register or risk management plan, in smaller organisations the plans and actions arising from the analysis might be factored into an annual business or work plan, and monitored through regular board meetings. The main risks would then form some of the agenda items of board meetings.

An exercise like this could be carried out annually by a board as part of an annual review or planning session. For those organisations not familiar with the process it may be useful to engage an outside/independent facilitator. This would not only help you to establish your own risk register, but would also provide a format and the experience to be able to undertake your own future risk analyses.
More reading

http://www.wheel.ie/sites/default/files/ReducingTheRisk_sample.pdf

http://www.icaew.com/en/technical/charity-and-voluntary-sector/volunteering/charity-trustee/charity-trustee-role-and-responsibilities-new/maximising-the-benefits-from-effective-risk-management

http://knowhownonprofit.org/how-to/how-to-identify-assess-and-manage-the-risks-associated-with-trading

1^ This is particularly true in the Community Services Programme where a majority of service providers will reference the threat of the loss of public funding as the principal risk, despite many other possible risks being evident.

2^ Community Services that work with children, young people and other vulnerable client groups will encounter specific operational risks.