Risk management includes activities to:

1. reduce the probability and magnitude of losses; and
2. finance recovery from these losses.

The old adage that an ounce of prevention is worth a pound of cure really applies here. Every nonprofit agency faces risk. In fact, nonprofit agencies must take risks to fulfill their missions, and move forward. Risk management is a tool that will reduce uncertainty, but not totally eliminate all risk.

By attempting to identify and then manage threats that could severely impact services or image, boards help ensure financial stability, individual safety, and service quality. A board that conducts risk management is fulfilling its legal duties of care and diligence while safeguarding assets.

We all have heard horror stories about problems related to risk management, or the lack thereof! Consider the following scenarios and what havoc could have resulted:

• A board treasurer who “borrowed” program funds for personal use
• A program’s personnel procedures without an employee grievance procedure
• A board treasurer who kept all of the financial records at home and then had a breakdown, so no could access them
• The library that continues to classify literacy staff as “contractual,” even though they have worked full time for a number of years
• The affiliate that hired a “flasher” without checking references to learn that this had been an issue in past jobs
• The volunteer who fell in the large pothole in the parking lot

Do these scenarios sound preposterous? They all occurred and are examples of a lack of risk management, where safeguards were not in place.

Risk Management Assessment

This should be done at least annually.

1. Identify potential risks. What can go wrong? Some risks, like fraud, may be common to all nonprofit organizations. Others, like protecting the safety of tutors or students in a one-to-one environment, may be more specific to literacy organizations.
2. Prioritize these risks. How likely are they to happen? What will be the impact on your organization? You may want to do nothing about activities that are unlikely to happen or that may have minimal impact. Some of the most common risks are injuries on the job, property damage, employment practices, fraud, and lack of legal compliance.
3. Select how you will manage risks that you feel are important. There are four possible ways to address them:
   
   a. Modify the activities so that there is an acceptably low chance of harm and financial impact. This is usually done through policies and procedures. For example, check references of prospective employees.
   
   b. Avoid the activity. For example, tutors may not drive students, and students may not transport tutors.
   
   c. Accept the risks and the financial consequences. Every organization must decide if it wants to purchase insurance. It may decide that there is minimal risk of a liability suit, and not purchase insurance. It may determine that the impact of a volunteer suing after an accident is too high, and buy insurance.
   
   
4. Share the risk. For example, by hiring a payroll service you transfer to another entity the responsibility for timely and accurate payment of taxes.
5. Monitor your progress, and evaluate this annually.

• Are facilities safe?
• Have there been discussions about insurance coverage (general liability, D & O, etc.)?
• Are agency policies up-to-date and in compliance with legal requirements?
• Are there financial controls to minimize threat of theft, fraud, and waste?
• Are all records kept in a central location?
• Are critical documents kept in a fireproof box? Are there copies of data from the computer in this box or another safe site?
• Are personnel files, other confidential records, and checkbooks in a locked drawer?
• Are emergency numbers posted near an accessible phone?
• Are prospective employees screened?
• Are there clear and consistent personnel policies that are applied to all employees?
• Do you keep detailed records of all incidents or accident claims?
• Are copies of budgets, board minutes, permits, and contracts readily available?
• Do you respect the wishes of donors?
• Does your board enforce its policies, including conflict of interest? Does it monitor finances?
• Do you require a volunteer application, and do you supervise volunteers?

Some organizations create risk management committees to get started. Keep in mind that the goal is not to eliminate all risk, but to reduce uncertainty. Be sure that your actions are realistic, and take into account your human and financial resources. An annual review will allow you to expand activities as resources allow. Also, activities should not be so cumbersome that they substantially interfere with the provision of services.

According to a fact sheet prepared by the Nonprofit Risk Management Center, “Crisis prevention is doubly important for small public entities, companies and nonprofit organizations. Small organizations often have fewer resources to draw on when a crisis erupts.” Although small literacy programs may not be able to afford insurance, they can take steps “to prevent the preventable and prepare for the unavoidable.”

Brenda Gray
Washington State Liaison

Your board made the right decision. Hiring someone who is a relative of an employee is a conflict of interest. Although you want to hire your son, treat this like any position. Develop a job description, advertise the position, and interview the top candidates. One of these candidates could be your son. To avoid the perception of favoritism, be sure that several people conduct the interviews. If your son is the best candidate, he will get the job.

Fisher, James C. & Cole, Kathleen M. Leadership and Management of Volunteer Administrators. San Francisco: Jossey-Bass Non Profit Sector Series, 1993.

Grobman, Gary M. The Nonprofit Handbook. Third Edition. Harrisburg, PA: White Hat Communications, 2002. Includes a good chapter on risk management.