Organisational risk management

What is organisational risk management?

A risk is something uncertain: it might happen or it might not. It matters because, if it happens, it affects your objectives. The Institute of Risk Management (IRM) separates a risk from an issue. An issue is an unplanned event that has already happened and needs action.

Risk management is any activity to identify and control the level of risk facing your objectives. For an NGO this includes losing a major grant, fraud, staff safety, data loss, partner failure and reputation damage. Our separate guide on project risk registers covers one project. This article covers risks to the whole organisation.

The UK Charity Commission explains why it matters. Trustees should regularly review the risks in all areas of the charity's work and plan to manage them, so they can achieve their objectives and protect funds and assets. The Commission's guidance also expects a statement about risk management in the annual report.

How does the process work? Five steps

Most risk standards, including the one the IRM follows, are based on ISO 31000. Here is a simple version.

1. Set the context. Write down your objectives. You cannot identify risks until you know what you are trying to achieve.
2. Identify risks. Be methodical. The IRM suggests thinking by categories such as strategic, project, financial and operational, and asking colleagues and stakeholders, for example in a workshop.
3. Assess each risk. Rate likelihood (how likely) and impact (how serious) on a simple scale, for example low, medium, high.
4. Respond. Decide what to do. The IRM uses the "four Ts": Treat, Tolerate, Terminate or Transfer.
5. Monitor and review. Check regularly, update the register, and record why scores changed.

What are the four Ts?

What goes in a risk register?

A risk register pulls the key parts of risk management together. The UK Charity Commission's guidance describes it as listing risks, their assessment, controls in place, responsibilities, monitoring and follow-up action. For a small NGO, a spreadsheet with these columns is enough:

Which risks do NGOs often miss?

• Dependence on one donor or one leader. See diversify funding and succession planning.
• Fraud and weak controls. See fraud prevention for small NGOs.
• Staff safety and wellbeing, including travel limits and stress.
• Data and digital security, such as lost laptops or shared passwords.
• Partner and supplier failure, or delays in delivery.
• Compliance, including donor rules and registration.
• Reputation, including safeguarding failures.

Humanitarian Outcomes' handbook on NGO risk management says a risk register should be built from the ground up, with each office and function identifying and ranking its own risks, which then feed an organisation-wide register compiled at least once a year. A small NGO can do the same with its programme, finance and admin leads.

How do you keep the register alive?

The IRM warns about a common mistake: people list risks, record actions, file the register and never open it again. To avoid this:

• Review risks regularly. The IRM says fast-moving projects may need weekly checks, while strategic risks may need quarterly review.
• Check if your actions work. If the risk score has not moved, change the action.
• Update the register after every review, with the reason for each change.
• Produce a short risk report for management and the board: score changes, new risks, closed risks.
• Make risk a standing item at management meetings.

Set a simple rule: risks rated high go to the board at its next meeting.

What about operating in Myanmar?

Access limits, banking restrictions, price changes, power and internet outages, and staff safety can change quickly. Review those risks more often than once a quarter, and agree in advance who may make decisions when the director cannot be reached. Keep plans for continuity, such as backing up records and storing contact lists off site. Read also emergency preparedness planning for small NGOs. Do not record sensitive security details in widely shared documents.

Laws and donor rules vary. Check your grant agreements and local requirements, and ask a qualified adviser where needed.

How EMPO can help

EMPO is a trusted training and consultancy provider and one of Myanmar's leading names in practical NGO training, based in Yangon, with 1,200+ people trained and 15 partner organisations. Our organisational development service helps teams build risk registers, policies and governance routines, in English and Burmese, online or in person across Myanmar. See our services or contact us.

Sources

• Charities and risk management (CC26) — Charity Commission for England and Wales, GOV.UK
• Risk management for charities: getting started — Institute of Risk Management
• NGO Risk Management: Principles and Promising Practice — Humanitarian Outcomes for InterAction, 2016