Risk Management

This guidance aims to give an overview of risk and risk management for charities and voluntary organisations, drawing on, and with links to, resources from the Charity Commission and NCVO (National Council for Voluntary Organisations).

1.        What is risk?

“For charities, a risk can be defined as "any event or action that may harm an organisation's ability to achieve its charitable objectives and execute its strategies". This definition means that risk is not confined just to the financial affairs of the organisation, but to all areas of the charity's operations.” (www.ncvo-vol.org.uk)

The Charity Commission defines risk as “the uncertainty surrounding events and their outcomes that may have a significant impact, either enhancing or inhibiting any area of a charity’s operations”

Risks can be internal (as a result of an aspect of your operation), or external (arising from changes which may be beyond your control, but impacting on your work).

Some internal risks: safety of premises; actions of staff and volunteers; failure of budgetary control; safety of users

Some external risks: cuts in public sector funding to charities; changes in legislation and regulations affecting your work

The Charity Commission is clear that “risk is an everyday part of charitable activity”.  Whilst taking some risks are essential to an organisation's development and growth, effective risk management is essential to continuing resilience and good governance.

2.        Why is risk management important for charities?

“Charities should regularly assess and review the risks they face in all areas of their work and plan for the management of those risks. A robust risk management process will enable the charity to look at how its assets and resources can be protected and put to best use. Some charities will have a legal obligation to report on their risk management processes in their annual reports.” (www.charity-commission.gov.uk)

Effective risk management helps to ensure that trustees and staff:

3.        What does risk management involve?

The risk management process includes three elements:

3.1.        Risk assessment

Trustees, staff and volunteers should consider the potential risks in all aspects of their work, including current activities and before making any decisions that affect the charity’s future. For example, the decision to bid competitively to deliver a contract could have significant risks, either as a result of winning or losing the contract.  Winning the contract might mean a strain on your ability to deliver other core services, loss of staff who are not happy with the contract specification and loss of donors who see you become more aligned with a statutory agency.  Losing the contract might mean loss of funding, damage to reputation and lowering of staff morale.

Tools such as a SWOT analysis (strengths, weaknesses, opportunities and threats) and PEST analysis (political, economic, sociological, technological changes) can help you to identify further risks.

The Charity Commission recommends that organisations identify potential risks arising in five areas:

  1. Governance e.g. conflicts of interest, undertaking activities beyond charitable objects, loss of key people
  2. Operations e.g. customer satisfaction, competition from other similar organisations, high staff turnover
  3. Finances e.g. cashflow problems, pension liabilities
  4. Environment and external factors e.g. adverse publicity, change in government policy
  5. Law and regulation e.g. compliance with service delivery standards, compliance with reporting requirements

A list of the possible areas to consider is included in Annex 2 of Charities and Risk Management

3.2.        Risk analysis

The next step is to analyse the possible impact of the risk and how likely it is to occur.  There are a range of different mechanisms for allocating a weight to these two factors, the most simple being:

Impact can be measured on a number of different scales e.g. insignificant (1) to catastrophic (5); low (1), medium (2),  high (3) or on the basis of cost to the organisation (lost income, penalties etc) if the situation occurs.  For charities, the descriptor with a numerical scale are probably most relevant. The Charity Commission’s guidance on risk uses insignificant to catastrophic:

Descriptor

Score

Example

Insignificant

1

* no impact on service  

* no impact on reputation

* complaint unlikely    

* litigation risk remote

Minor

2

* slight impact on service    

* slight impact on reputation    

* complaint possible    

* litigation possible

Moderate

3

* some service disruption    

* potential for adverse publicity-avoidable with careful handling

* complaint probable    

* litigation probable

Major

4

* service disrupted    

* adverse publicity not avoidable (local media)    

* complaint probable    

* litigation probable

Extreme/

catastrophic

5

* service interrupted for significant time    

* major adverse publicity not avoidable (national media)    

* major litigation expected

* resignation of senior management and board    

* loss of beneficiary confidence

Likelihood again could be remote (1) to highly probable (5) (Charity Commission’s suggested scoring), or low(1), medium (2), high (3).  

Descriptor

Score

Example

Remote

1

may only occur in exceptional circumstances

Unlikely

2

expected to occur in a few circumstances

Possible

3

expected to occur in some circumstances

Probable

4

expected to occur in many circumstances

Highly probable

5

expected to occur frequently and in most circumstances

The potential risk is calculated as Impact X Likelihood.  For example an insignificant impact occurrence (1) which is highly probable (5) would have an overall score of 1 x 5 = 5.  An occurrence which would have a major impact (4) which is probable (4) would score 4 x 4 = 16

Find out more on pages 15 and 16 of Charities and Risk Management

You may find it helpful to use a traffic light approach (red, amber, green) to highlight the risks needing most consideration.

 I 

M

Extreme/

catastrophic      5

10

15

20

25

30

P

Major                4

8

12

16

20

24

A

Moderate          3

6

9

12

15

18

C

Minor                2

4

6

8

10

12

T

Insignificant      1

2

3

4

5

6

1

Remote

2

Unlikely

3

Possible

4

Probable

5

Highly probable

 L I K E L I H O O D

The Charity commission have a suggested more simple approach  for small charities.

3.3.        Risk management

Do you have a risk management statement in place?  

What does a risk management statement need to include?

RVA’s return for 2010 -11 includes the following statement on risk management

“The Management Board has conducted a review of the major risks to which the Charity is exposed. Where appropriate systems and procedures have been established to mitigate the risks the charity faces. This has led to the development. of a strategic plan which will enable the charity to secure the resources necessary to deliver its strategic aims. Internal control risks are minimised by the implementation of procedures for authorisation of expenditure and new projects. Procedures are in place to ensure compliance with health and safety for staff, volunteers, clients and visitors to the charity. These procedures are periodically reviewed to ensure that they continue to meet the needs of the charity. The Board will continue to carry out periodic reviews of risks and mitigation measures.”

4.        Risk and opportunity assessment

It is important to “weigh up” the risks and opportunities of any new venture. You might be considering setting up a new project, starting a service within your existing project or delivering an existing service in a different way.  As well as the risks, (how damaging the impact could be and the likelihood of this occurring) as shown above, you can use a similar process to assess the scale of any possible opportunity against the likelihood of you achieving this return.  

For example:

You run a drop-in centre for people from Asian communities and want to start a new service offering an interpreting service to vulnerable clients. They need welfare benefits advice but have difficulty accessing existing services because they do not have any English, or they struggle to understand because English is not their first language. You know that there are many agencies providing the advice your clients needs but they do not have easy access to interpreting services.

By completing fully researching the opportunity available you can establish:

The scale of the opportunity:

  • the need for interpreting services and when/where they are most needed
  • would clients use the service or rely on their families to interpret for them
  • what agencies and/or clients could pay for the services
  • could you secure funding to subsidise the service?

The likelihood of it being successful and giving you the return you need:

  • the competing interpretation services available
  • would advice agencies contact you to provide the service (this might depend on your reputation, existing relationships etc)

You can then compare the scale of the opportunity created and the likelihood of it being successful against the potential risks before making a decision to go ahead.

5.        Further information

The Charity Commission’s guidance, Charities and Risk Management is a good starting point.

Contact RVA’s Advice Team (advice@rva.org.uk) for further help.

January 2013



Reading Voluntary Action promotes strength within Reading's voluntary sector by providing information, access to resources, volunteer recruitment and training to people who work in or with charities, community groups and voluntary organisations.


info@rva.org.uk
0118 937 2273
Reading Voluntary Action, 3rd Floor Central Library, Abbey Square, Reading RG1 3BQ