Risk is not something that happens to other organisations. Every nonprofit, regardless of size, sector, or history, faces risks that could damage its mission, reputation, finances, or ability to operate. The question is not whether risks exist but whether the board is managing them deliberately or simply hoping for the best.
Too many nonprofit boards fall into the second category. They operate without a risk register, discuss risks only when a crisis is already underway, and treat risk management as a compliance chore rather than a strategic discipline. This approach works right up until it does not, and when it fails, the consequences can be severe: financial losses, regulatory action, reputational damage, or even the collapse of the organisation.
This article provides a practical framework for nonprofit boards to identify, assess, prioritise, and mitigate risks systematically. It is designed for boards that want to move from reactive crisis management to proactive risk governance.
Why Risk Management Is a Board Responsibility
Risk management is fundamentally a board responsibility, not something boards can delegate entirely to management or to a risk committee. Here is why.
Legal Obligations
Directors have a duty of care that requires them to exercise reasonable diligence in overseeing the organisation. This includes understanding the major risks the organisation faces and ensuring appropriate measures are in place to manage them. A board that is blindsided by a foreseeable risk has failed in its duty of care.
Strategic Relevance
Risk and strategy are inseparable. Every strategic decision involves risk. Entering a new programme area, accepting a major grant, hiring a new CEO, expanding geographically, adopting new technology, all of these carry risks that the board should understand and accept consciously rather than discover later.
Stakeholder Trust
Funders, regulators, partner organisations, and the communities the organisation serves expect the board to exercise prudent oversight. Demonstrating a systematic approach to risk management builds trust and credibility.
Organisational Sustainability
Nonprofits operate with limited reserves and often lack the financial cushion that commercial organisations have to absorb shocks. A single poorly managed risk, whether a compliance failure, a data breach, or a funding cliff, can threaten the organisation's viability. The board is the last line of defence.
A Risk Management Framework for Nonprofit Boards
Effective risk management does not require a massive bureaucracy. Even a small board can implement a practical framework by following four steps: identify, assess, mitigate, and monitor.
Step One: Risk Identification
The first step is to systematically identify the risks the organisation faces. This means looking beyond the obvious and considering risks across multiple categories.
Financial Risks
Financial risks threaten the organisation's economic viability.
- Revenue concentration. Is the organisation overly dependent on a single funder, grant, or revenue stream? If one source provides more than thirty percent of total revenue, its loss would be a significant shock.
- Cash flow volatility. Does the organisation have sufficient reserves to manage gaps between expenses and income? Many nonprofits operate with razor-thin cash reserves.
- Cost escalation. Are key costs, such as salaries, rent, or insurance, rising faster than revenue?
- Investment risk. If the organisation has invested assets, are they managed prudently and in line with the board's risk appetite?
- Fraud and financial mismanagement. Are financial controls adequate to prevent and detect fraud?
Operational Risks
Operational risks arise from the organisation's day-to-day activities.
- Key person dependency. Would the organisation struggle to function if a specific staff member, particularly the CEO, became unavailable?
- Service delivery failure. Could programme quality decline due to staffing shortages, supply chain issues, or capacity constraints?
- Technology failure. Is the organisation prepared for system outages, data loss, or cyberattacks?
- Health and safety. Are there risks to staff, volunteers, or service users from the organisation's activities?
- Supply chain and contractor risks. Is the organisation exposed if a key supplier or partner fails to deliver?
Compliance and Legal Risks
Compliance risks arise from the organisation's legal and regulatory obligations.
- Regulatory compliance. Is the organisation meeting all its legal obligations, including charity law, employment law, health and safety regulations, and sector-specific requirements? Track these systematically through your compliance management system.
- Data protection. Is the organisation handling personal data in compliance with relevant data protection laws?
- Contractual obligations. Are grant conditions and contractual obligations being met?
- Employment law. Is the organisation compliant with employment legislation, including fair hiring practices, workplace safety, and anti-discrimination requirements?
- Tax compliance. Is the organisation maintaining its tax-exempt status and meeting all tax reporting obligations?
Strategic Risks
Strategic risks relate to the organisation's long-term direction and relevance.
- Mission drift. Is the organisation being pulled away from its core mission by funding opportunities or political pressures?
- Market changes. Are changes in the external environment making the organisation's approach less relevant or effective?
- Competition. Are other organisations duplicating the organisation's work, potentially making it redundant?
- Reputation. What events or behaviours could damage the organisation's public image and stakeholder relationships?
Governance Risks
Governance risks arise from weaknesses in the board itself.
- Board composition gaps. Does the board lack critical skills or diversity?
- Succession planning. Would a sudden departure of the chair or several directors create a governance vacuum?
- Conflicts of interest. Are conflicts identified and managed effectively?
- Board-management boundary. Is the board overstepping into management, or alternatively, failing to provide adequate oversight?
The identification process works best when it draws on multiple perspectives. Hold a dedicated risk identification session, either at a board meeting or a board retreat, where directors, and potentially senior management, brainstorm risks across all categories. Supplement this with a review of past incidents, industry reports, and regulatory guidance.
Step Two: Risk Assessment
Once risks are identified, each one needs to be assessed based on two factors: the likelihood of it occurring and the impact it would have if it did.
Likelihood Scale
Use a simple scale to rate likelihood:
- Rare. The risk is unlikely to occur. It is theoretically possible but has not happened before and conditions do not favour it.
- Unlikely. The risk could occur but is not expected. Similar events have happened elsewhere but not in this organisation.
- Possible. The risk may occur. There is a reasonable chance based on current conditions.
- Likely. The risk is expected to occur at some point. There may be early warning signs already visible.
- Almost certain. The risk will occur unless action is taken. It may already be materialising.
Impact Scale
Similarly, rate the potential impact:
- Insignificant. Minimal effect on the organisation. Can be managed within normal operations.
- Minor. Some disruption but manageable with existing resources. No lasting damage.
- Moderate. Significant disruption requiring a dedicated response. May involve financial loss, service interruption, or stakeholder concern.
- Major. Serious impact on the organisation's operations, finances, or reputation. Recovery would take considerable time and resources.
- Catastrophic. Threatens the organisation's viability. Could result in closure, major legal action, or permanent reputational damage.
Risk Matrix
Plotting each risk on a likelihood-versus-impact matrix creates a visual picture of the organisation's risk profile. Risks that are both high likelihood and high impact demand immediate attention. Risks that are low likelihood and low impact may only need monitoring. The matrix helps the board prioritise where to focus its risk management efforts.
Step Three: Risk Mitigation
For each significant risk, the board and management need to agree on a mitigation strategy. There are four fundamental approaches to risk mitigation.
Avoid
Eliminate the risk entirely by not undertaking the activity that creates it. For example, if a proposed international expansion carries unacceptable legal and financial risks, the board might decide not to proceed.
Reduce
Take actions to decrease the likelihood or impact of the risk. This is the most common approach. Examples include diversifying revenue sources to reduce funding concentration risk, implementing cybersecurity measures to reduce data breach risk, or creating succession plans to reduce key person dependency.
Transfer
Shift the risk to another party. Insurance is the most common form of risk transfer. The organisation pays a premium in exchange for the insurer bearing the financial impact if the risk materialises. Other forms of transfer include outsourcing high-risk activities or using contractual clauses to allocate risk to partners or suppliers.
Accept
Acknowledge the risk and decide to bear it. This is appropriate for risks that are low likelihood and low impact, or where the cost of mitigation would exceed the potential loss. The key is that acceptance should be a conscious decision, not a default. The board should document which risks it has decided to accept and the reasoning behind that decision.
For each risk in the register, document:
- The risk description.
- The risk category.
- The likelihood and impact ratings.
- The current controls already in place.
- Additional mitigation actions planned.
- The person responsible for managing the risk.
- The timeline for implementing mitigation actions.
Step Four: Risk Monitoring
Risk management is not a set-and-forget exercise. Risks change over time. New risks emerge. Existing risks may increase or decrease in severity. Mitigation actions need to be tracked for completion and effectiveness.
The Risk Register
The risk register is the central tool for ongoing risk management. It is a living document that captures all identified risks, their assessments, mitigation strategies, and current status. The register should be reviewed and updated regularly, at minimum quarterly.
A well-maintained risk register typically lives within the board's governance platform alongside meeting papers, minutes, and compliance records. This ensures it is accessible to all directors and integrated into the board's regular workflow.
Board Reporting
Management should report on risk to the board at every meeting, or at minimum quarterly. Risk reports should cover:
- Any changes to existing risks, including upgrades or downgrades in likelihood or impact.
- New risks identified since the last report.
- Progress on mitigation actions.
- Any risk events that have occurred and how they were managed.
- Changes to the external environment that may affect the risk profile.
Keep risk reporting concise and focused. A one-page summary with a traffic-light rating system for each major risk category is more useful than a lengthy narrative.
Deep Dives
In addition to regular reporting, schedule periodic deep dives into specific risk areas. For example, the board might dedicate a session each year to cybersecurity risk, financial sustainability risk, or regulatory compliance risk. These deep dives allow for more thorough examination than regular meeting time permits.
Building a Risk-Aware Culture
Effective risk management is not just about frameworks and registers. It requires a culture where risk awareness is embedded in how the organisation thinks and operates.
Tone at the Top
The board sets the tone. If directors take risk seriously, ask probing questions about risk management, and hold management accountable, the organisation will follow. If the board treats risk as a compliance exercise to get through quickly, management will treat it the same way.
Open Communication
Staff and management should feel safe reporting risks and near-misses without fear of blame. Organisations that punish risk reporting drive risk underground, where it becomes invisible until it erupts as a crisis.
Learning from Incidents
When risk events do occur, conduct a thorough post-incident review. What happened? Why? What controls failed? What can be learned? Document the findings and update the risk register and mitigation strategies accordingly.
Training and Development
Ensure directors have the knowledge they need to exercise effective risk oversight. This may include training on the organisation's risk profile, governance responsibilities, emerging risk areas like cyber threats or data protection, and the board's risk management framework.
The Role of Committees in Risk Management
Risk management can be supported by the board's committee structure. There are several models.
Dedicated Risk Committee
Larger boards may establish a standing risk committee responsible for overseeing the risk management framework, reviewing the risk register, and reporting to the full board. This model provides dedicated focus but requires sufficient board members with relevant expertise.
Audit and Risk Committee
A common approach is to combine risk oversight with the audit function. The audit and risk committee reviews both financial controls and the broader risk register, ensuring alignment between financial oversight and risk management.
Full Board Oversight
Smaller boards may handle risk management as a full board responsibility, dedicating a portion of each meeting to risk review. This can work well if the board is disciplined about maintaining focus and does not allow risk discussions to consume disproportionate time.
Whichever model you choose, the full board retains ultimate responsibility for risk oversight. Committees make recommendations and conduct detailed work, but the board as a whole must be satisfied that risks are being managed appropriately. For more on structuring committees effectively, see our guide to board committees.
Common Risk Management Mistakes
Focusing Only on Obvious Risks
Boards often focus on the risks they can see, like financial shortfalls or regulatory requirements, while overlooking less visible but equally dangerous risks like key person dependency, data protection vulnerabilities, or reputational threats. A structured risk identification process helps counteract this bias.
Confusing Risk Management with Risk Elimination
Risk cannot be eliminated. The goal is to manage risk to an acceptable level, not to create a risk-free environment. Boards that try to eliminate all risk often end up paralysing the organisation, preventing it from taking the calculated risks needed to fulfil its mission.
Treating the Risk Register as Static
A risk register that is created once and never updated provides a false sense of security. Risks are dynamic. The register must be reviewed and updated regularly to remain useful.
Ignoring Strategic Risks
Many boards focus their risk management efforts on operational and compliance risks, which are easier to define and measure. Strategic risks, like mission drift, market irrelevance, or reputational damage, are harder to quantify but can be far more consequential. Give strategic risks the attention they deserve.
Lack of Accountability
Every risk in the register should have a named owner who is responsible for managing it. Without clear ownership, risk mitigation actions drift and nobody is accountable when things go wrong.
Risk Appetite and Tolerance
One of the board's most important risk management decisions is defining the organisation's risk appetite: how much risk the organisation is willing to accept in pursuit of its mission.
Risk appetite is not uniform across all areas. An organisation might have a high appetite for innovation risk, meaning it is willing to try new programme approaches that might fail, while having a low appetite for compliance risk, meaning it insists on strict adherence to all regulatory requirements.
The board should articulate its risk appetite clearly and communicate it to management. This provides a framework for management decision-making. When a new opportunity arises that carries significant risk, management can assess it against the board's stated risk appetite rather than guessing what the board would approve.
Risk tolerance is related but distinct. It defines the specific boundaries within the overall risk appetite. For example, if the board's risk appetite for financial risk is moderate, the risk tolerance might specify that no single funder should provide more than twenty-five percent of total revenue.
Integrating Risk into Strategic Planning
Risk management and strategic planning should not exist as separate processes. Every strategic decision carries risks, and every risk has strategic implications.
During strategic planning, the board should identify the risks associated with each strategic goal and ensure mitigation strategies are in place. During risk reviews, the board should consider whether the risk profile has shifted in ways that require strategic adjustments.
This integration ensures that the organisation pursues its strategy with eyes open and manages its risks in the context of its strategic ambitions. For more on the board's strategic role, see our guide to strategic planning for nonprofit boards.
Conclusion
Risk management is not about preventing bad things from happening. It is about being prepared, making informed choices about which risks to accept, and ensuring the organisation can withstand and recover from adverse events.
The framework outlined in this article, identify, assess, mitigate, and monitor, is straightforward to implement and scalable to any size of nonprofit. The key is commitment. A risk register that is maintained, a board that asks the right questions, a culture that encourages openness about threats, and a management team that is held accountable for risk mitigation.
Every nonprofit faces risks. The boards that govern most effectively are those that face them deliberately, systematically, and with the courage to act on what they find.