Is Non-Profit Risk Management Good Enough?

Why should risk management be less mature in non-profits than in businesses? I could argue that as stewards of large amounts of donated money (government, corporate, foundation, and individual), we should see a more robust risk culture, not less.

The problem is that good risk management costs money (though it may ultimately save more than it costs). Still, there is hope. According to the 2023 State of Risk Oversight report, non-profits' risk management programs and processes are expanding. Funders should be very excited about this; many look for risk maturity before providing significant funding. But how many would be comfortable with a budget that included substantial costs to improve risk management?

An analysis of non-profit leader responses in the report shows that 72% of non-profits report that risks are growing in volume and complexity. Yet only 25% of non-profit organizations report that their risk management oversight is "mature" or "robust." This is concerning given that in the same study, 61% of non-profits describe themselves as "risk averse" or "strongly risk averse."

The report has some encouraging signs. 64% of the non-profits in the survey report having a management-level risk committee, and 70% report risks regularly to the board (at least annually but 11% at every board meeting. I would love to know the profiles of the non-profit organizations included in the survey. My experience with small non-profits suggests a minimal understanding of risk management and little in the way of formal risk management policies, processes, and strategies, except to address particular risks (e.g., child safeguarding).

Still, particularly among smaller non-profits, there is a definite shortage of financial and people resources and a definite shortfall in expertise, to upscale risk management. One of the organizations whose board I chair needs to hire a new ED. The skill set required includes fund-raising, finance, program administration, fund-raising, PR, marketing, people management, fund-raising, and "other duties as assigned" by the board. Oh yes, and risk management. When there are barely enough funds to pay for an ED, perhaps a Development Director, and then program and administrative staff, how can a smaller non-profit even consider hiring a risk professional?

What is the answer? I'll explore some options in a future post. But next, I'll ask, "Does Risk Management Matter for Non-Profits?".