Walking a Tightrope? ERM Can Help
March 9, 2022

If risk wasn’t a nagging concern for nonprofits before the pandemic, it certainly is now. Health risks to staffers, volunteers and clients, and financial threats, including declining donations and increased incidence of fraud, now likely keep many executive directors up at night. But enterprise risk management (ERM) can help nonprofit organizations find firmer ground. Here’s how.

Portfolio Purview

ERM is a comprehensive program that considers an organization’s entire portfolio of risks. Rather than attacking every risk equally, ERM compares risks and strategically deploys resources depending on their likelihood and potential impact.

For example, you may be mildly cautious about reputational risks and very averse to financial risks. With ERM, you can contain those risks with the greatest potential impact and respond nimbly to others.

It Takes Teams

Experienced financial advisors and risk-management consultants can help you set up an ERM program. Generally, you’ll want to start by establishing a risk management governance structure with assigned roles and responsibilities. Your nonprofit’s executives and board should define your organization’s risk tolerance and make clear its commitment to the program.

Next, your organization should assemble a cross-departmental committee to develop the program. Different departments may have different perspectives on certain risks. For example, a finance manager might think inaccurate reporting of program information is less consequential because it’s unlikely to affect revenues or expenses. Your public relations manager may disagree, arguing that such errors could affect how donors and other supporters view your nonprofit.

Assessing and Planning

Your cross-departmental committee’s first task is to identify risks. It should conduct interviews with management and staff and, possibly, clients. Then, the committee will be ready to rank risks based on your organization’s tolerance and their potential impact. Which are most likely to occur? Which could cause the most harm? The bottom line: Which threats are most likely to prevent you from accomplishing your mission?

Once risks are identified and prioritized, the committee can devise a plan to mitigate them appropriately. For each risk, it should determine whether to accept, reduce or avoid it. And it should implement controls, processes and procedures accordingly. The committee is then charged with rolling out the plan. This should include communicating it throughout the organization.

Continual monitoring

The ERM process isn’t over, even after your roll-out. You’ll need to continually monitor key risks and performance indicators and make appropriate adjustments.

© 2022

You might also like

Don’t Be Surprised by a Sudden Influx of Support

Don’t Be Surprised by a Sudden Influx of Support

When a Category 5 hurricane struck a coastal community, its most prominent health and human services charity was prepared to act with rescue plans, supplies, emergency shelters and well-trained staffers. What the nonprofit wasn’t prepared for was a sudden influx of...

read more
Building a Better Nonprofit: Rules for Restructuring

Building a Better Nonprofit: Rules for Restructuring

There are many reasons why a 501(c) tax-exempt organization might consider restructuring. For example, a financially struggling nonprofit might decide to join forces with another organization to cut costs and share resources. Or a nonprofit might decide to change its...

read more