Risk management
Since SORP 2000 required trustees to make a statement in their annual report concerning risk management processes, charities have been undertaking risk assessment. However, all too often this has been seen as a negative process, identifying potential problems and then considering ways of avoiding them. In fact, risk management can be a more positive process whereby organisations can not only consider the areas where they are vulnerable, but consider how they may enhance their chances of succeeding in those areas. What actions can a charity take to increase the probability that they will succeed with their strategy? Constructive use of risk management techniques can draw out the positive management responses available to an organisation.
Options for risk management activities
Risk management can be organised in a number of different ways and involve different activities. Some examples are shown below:
Risk workshops
Workshops are one way to involve trustees and staff in the process of risk assessment, and a significant amount of the work to develop a list of potential risks can be undertaken in this way. Workshops can be useful as a way of getting teams to work together, and we have also led a number of workshops with both senior managers and trustees present, which have successfully drawn out attitudes to risk. This can be developed into a corporate profile of acceptable risks as a guideline to staff.
Review of existing risk management process
It may be useful to assess the extent and quality of the risk management work already undertaken. The outcome of this exercise would be an overall assessment of the extent to which the organisation uses risk management as a tool for directing management activity, areas of concern and an outline plan of further work.
Risk register
The information gathered on identified risks can be drawn together into a risk register, used to then assess and prioritise risks. This forms the basis of future work on controls.
Risk assessment of new activities
Assessing and evaluating the risk profile of new projects or developments can feed into the decision-making process. Once a decision has been made, the techniques can be used to monitor the project’s progress.
Controls mapping
Having understood the risks facing an organisation, a helpful next step is to map the existing controls in place and identify gaps in those controls. This can be undertaken at a high-level, mapping overall controls to cover most of the organisation. It can also be undertaken at a more detailed level in one particular department to produce flowcharts of the business processes, identify controls and then make recommendations for improvements to the processes and controls.
What will this achieve?
Risk management supports the management and governance of the charity. Professional help with risk management will mean that your organisation:
· looks at high risk areas of the operations, not just financial risks to the charit
· helps managers to find improved ways of working and of achieving the charity’s objectives
· focuses on current operations, identifying future actions and management responses to identified risks
· cuts across departmental boundaries, looking at charity-wide issues
· develops knowledge of controls among managers to manage identified risks and eliminate pointless procedures
· undertakes “real-time” assessment of new projects or processes, helping to ensure the success of complex implementations.