The Risk of Having a Passive Approach to Risk

It is helpful, arguably essential, for charities to understand and manage their risks. In practice, this involves identifying the risks, then mitigating the risks to protect the things that are important to the charity such as reputation, finances and effective operational delivery. The risks and mitigating actions are usually documented in a risk register, but what happens after this can distinguish poor practice from effective practice.

In some organisations, the completed risk register is ‘put into a drawer’ and brought out periodically for review. This is an example of poor practice as risks can change quickly, especially if your charity is operating in a volatile, uncertain, complex and ambiguous (VUCA) environment. Failure to proactively monitor risks and to review them as often as needed can result in charities inadvertently taking more risk than intended.

A more effective way of dealing with risk would be to use a well-established and evidence-based approach, such as Project Risk Analysis and Management (PRAM) from Association for Project Management, the Chartered body for the project profession. In addition to providing clear processes on how to manage risk proactively, such approaches provide a range of alternative responses that can be used for mitigating risks. For example: accepting risk, reducing risk, insuring against risk, sharing risk, or transferring risk.

The underpinning assumption in this article has been that we always want to reduce risk, but that is not necessarily the case. It may sometimes be that a charity needs to take more risk in order to achieve its charitable objectives.

The optimum level of risk that a charity wishes to take is known as its risk appetite and it is useful to understand this before identifying and mitigating risks. Charities may choose to have an over-arching risk appetite that is applied broadly. However, it is increasingly common to have a more nuanced approach to risk appetite. For example, a charity may wish to minimise (and ideally remove) any risk associated with safeguarding vulnerable adults or children, but it may want to increase the risk it takes in relation to disruptive marketing on social media.

Reflection Questions

1. Does your charity have a passive or a proactive approach to risk management? What single action could you take to improve the impact of risk management in your charity?
2. Is there a common understanding of risk appetite across your charity? For example, does the board’s risk appetite match that of the executive team and/or the volunteer community?