Charity governance and risk

I've read many job descriptions for charity trustees over the past couple of years, having been a trustee myself, and for several years leading risk management in a large non-profit organisation. Most of the ones I've been looking at have been for charities working in neurodiversity or mental health as that's the kind of charity I've been advising. 

There's something I've noticed about almost all of them. Most of the role definitions for trustees cover the same ground:

Being the guardians of mission, vision and values

Overseeing policies and standards

Challenging management

Advocating for the charity

Fundraising

Financial oversight

As well as specific skills such a grant application writing that the board feels its need to adds to its strength.

What has surprised me is how infrequently anything to do with risk is mentioned, even in role descriptions for large charities. Unfortunately, I've found that's representative of how many charity boards approach risk. They handle it as they would something fresh from a blast furnace. One reason for this reluctance is that risk is seen both as dangerous and as a constraint, and not something that enables innovation and new directions. In fact, proper risk management can reassure a board that they understand and accept the risk of change.

You could argue that understanding risk is embedded in the trustee role, but my experience has been that trustees don't often see it that way. And sometimes, that means they miss understanding (or even noticing) significant risks that are about to blow a hole in their strategy or their sustainability. Even the Charity Commission's own general guidance for trustees only mentions risk in passing in relation to finances,  although it has published a useful guide to charity risk in general. This takes a rather traditional approach, and not especially strategic in its outlook. It does mention that risks can arise from not doing things as much as they can from doing things,  and it acknowledges that "...risks which have very high impact and very low likelihood of occurrence are now accepted by many as having greater importance than those with a very high likelihood of occurrence and an insignificant impact."

These are usually the most interesting risks to explore. I don't mean the "meteor strike hits the office"-type risk But the thing that is foreseeable, such as fraud or a safeguarding scandal, but which everyone feels "could never happen here."

Consider the amount of time many boards give to reviewing performance compared to the time they spend on risk. Yet, everything about performance reporting is in the past; everything about risk is in the future.

Other things that are often overlooked in a charity's risk culture are:

What is our appetite for risk? 

What early warning signs would tell us that a risk is getting more likely

Worst case, what will we do if it *does* happen?

Identifying the early warning signs is a valuable thing to do in itself as it brings in a lot of conscious awareness of what's happening outside the organisation as well as inside: always a good thing. Being alert to changes in the air early on can, literally, save your organisation. Ignoring them usually means that you have lost valuable time to act.

Similarly, risk registers often focus on mitigating the chances of a risk (and sometimes its impact), and leave it unclear what the organisation will do if those mitigations fail. Having at least some idea of a Plan B can give the trustees and management a significant head start in surviving the fallout.

Above all, though, the risk appetite is one of the essential building-blocks of strategy: it relates directly to the decision-making that will enable or inhibit achieving the organisation's objectives. Developing it alongside your strategy will enable risk to be used right through the organisation as a management tool and not just something for the board to consider and review three or four times a year. 

There's a lot more to be said about using risk as a creative force. And obviously this is a partial and subjective view. But if you are recruiting trustees, are a trustees, or are thinking of becoming one, please think about putting at the heart of the discussion. Risk is a very human thing, so begin there: thinking about what risk means to you personally, when you've avoided it and when you've embraced it, and why, is a good starting point.

A shorter version of this can be found on LinkedIn.

I'm interested in anyone's experience of risk in their own organisations, past and present, and how it helped and hindered.

Please use the contact form to follow up or for more information.