Wie können Sie eine Richtlinie für das Risikomanagement von gemeinnützigen Organisationen erstellen?

Risk Management Committee has a significant positive effect on the overall risk management culture. While the composition of the Risk Management Committee can vary from company to company, it should be sufficiently representative to ensure different points of view on risk are considered. Based on our interviews, the best results tend to be achieved when the risk committee brings together supporting functions (finance, risk, legal, security, internal audit) and business units (operations, sales, marketing). The Committee can either deal with matters related to risk management methodology or it may participate in the decision-making process (investments, projects and other high-risk activities) or both.

1- Establish a Risk Management Committee responsible for developing, implementing, and overseeing the risk management policy. 2-By comprehensive risk assessment to identify different types of risks. 3- Categorize Risks into strategic, operational, financial, compliance and reputational risks. 4- Assess Risks w.r.t likelihood and potential impact. 5- Develop Risk Mitigation Strategies which should be specific, actionable, and tailored to each type of risk. 6- Implement the Risk Management Plan by clearly defining role & responsibilities for everyone in the organization. 7- Document the policy, review and update regularly. Train & educate staff. Establish clear communication by culture of openness. 8- Ensure legal & regulatory compliance.

While setting up a formal committee is a good start in establishing proper risk governance, it is key to laid down the foundation by identifying the type of risk(s) being assessed, monitored, and managed on a consistency basis. Different sectors of corporates and/or organisations would have very different requirements of risks, e.g. financial risks, reputational risks, regulatory risks. In particular for a non-profit organisation / social enterprise, I see reputational risk being the utmost important.

Risk management policy is essential to help your organization identify, assess, and mitigate potential risks. Here are some things that would need to be put in place: 1. A risk management committee or an officer responsible for risk management. 2. Establish a risk framework (tolerance) for the organization. 3. Communicate the risk framework to all stakeholders. 4. Monitor, evaluate and re-adjust the risk framework as implementation happens

👉 Risk Management Committee (RMC) The RMC is essential for effective risk management. It provides a forum for senior leaders to identify, assess, and manage risks across the organization. The RMC also helps to ensure that risk management is integrated into all aspects of the organization's decision-making process. 👉 Key points : 1. The RMC should be composed of independent directors and senior executives with the expertise and authority to make sound risk decisions. 2. The RMC should have a clear charter that defines its roles and responsibilities. 3. The RMC should meet regularly to review and update the risk management framework, assess the organization's risk profile, and monitor the implementation of risk mitigation strategies.

Risk assessment is a crucial step in nonprofit risk management. It helps to identify, analyze, and prioritize risks, so that nonprofits can develop and implement effective mitigation strategies - Key points: 1. Identify all potential risks, both internal and external: This includes risks to the nonprofit's mission, programs, finances, reputation, and people 2. Analyze the likelihood and impact of each risk: This will help to prioritize risks and allocate resources accordingly 3. Assess the effectiveness of existing controls and mitigation strategies: Identify any gaps or weaknesses that need to be addressed 4. Develop a risk management plan that outlines mitigation strategies for each risk: This plan should be regularly reviewed and updated

STEP 1 - STRATEGIC OBJECTIVES DECOMPOSITION Any kind of risk analysis should start by taking a high-level objective and breaking it down into more tactical, operational key performance indicators (KPIs) and targets. When breaking down any objectives it is important to follow the McKinsey MECE principle (ME - Mutually Exclusive, CE - Collectively Exhaustive) to avoid unnecessary duplication and overlapping. Most of the time strategic objectives are already broken down into more tactical KPIs and targets by the strategy department or HR, so this saves the risk manager a lot of time. This is a critical step to make sure risk managers understand the business logic behind each objective and helps make risk analysis more focused.

I found it most effective when the risk assessment is conducted with a clearly defined set of specific risk-based criteria vs a full macro review for the organisation, e.g. - a non-profit organisation would receive regular donations funding from various donors. Rather than a full KYC review of the full population, it should prioritise the review based on the profile and jurisdiction of the donor in question, and the size of the donation:

identifying gaps or weaknesses in risk management is crucial for improving resilience and ensuring that the nonprofit is well-prepared to handle potential challenges. Overall, this step lays a strong foundation for effective risk management and aligns well with best practices.

A risk assessment can be accomplished in lock-step with developing your risk management committee. Understanding the risks you face is essential, so identifying these early on is better than waiting for "perfect conditions" (like having a complete risk management committee). Using a SWOT analysis is an efficient tool you can leverage with your executive leadership team and board of directors to establish your risk baseline. From there, you can broaden the assessment as you develop your risk management committee. It's also a great idea to reach out to consultants and professionals, like a nonprofit insurance specialist, who can not only help you protect your mission but may be able to reveal ways to minimize your risk.

Using a risk rating system to rank risks based on probability and severity ensures a clear and structured assessment process. Categorizing risks into strategic, operational, financial, legal, or reputational allows for a focused allocation of attention and resources, making it easier to manage risks efficiently. This method also supports informed decision-making regarding which risks to accept, transfer, or avoid, thereby enhancing the overall risk management strategy. It's a practical and logical step towards ensuring that critical risks are addressed appropriately.

🎯 Prioritizing and Categorizing Risks 👉 Key Points: 1. Prioritizing and categorizing risks is essential for effective risk management. 2. Risks should be prioritized based on their significance and urgency. 3. A risk rating system can be used to rank risks according to their probability and severity. 4. Risks can be categorized into different groups, such as strategic, operational, financial, legal, or reputational. 🗣️ This process will help organizations to determine which risks need more attention and resources, and which risks can be accepted, transferred, or avoided.

STEP 2 - IDENTIFYING FACTORS, ASSOCIATED WITH UNCERTAINTY Once the strategic objectives have been broken down into more tactical, manageable pieces, risk managers need to use the strategy document, financial model, business plan or the budgeting model to determine key assumptions made by the management. Most assumptions are associated with some form of uncertainty and hence require risk analysis. Risk analysis helps to put unrealistic management assumptions under the spotlight. By the end of this step risk managers should have a list of management assumptions.

Which step would identify the risk tolerance? I don't see this in any of the steps. Before you can prioritize anything, tolerance levels are required for each type of risk. Otherwise, what is your measure of how you will categorize anything?

Once you have a general "benchmark" based on your risk assessment, you and your leadership and board can prioritize the importance of each risk to address them individually. Risks can be prioritized by considering many factors, including risk-to-reward, severity of risk impact, and categorical effects related to different operations of your nonprofit organizations. For instance, you may identify a risk impeding your financial stability and prioritize addressing that risk to move programs forward. Once you've triaged your list of known risks, update your internal records and board minutes to decide how to edit them regularly.

Here are some key elements of a risk response plan: 1.Objectives:What are the goals of the risk response plan? 2.Strategies:What actions will be taken to mitigate or avoid the risk? 3.Tasks: What specific steps need to be taken to implement the strategies? 4.Timelines: When will the tasks be completed? 5.Responsibilities: Who is responsible for completing each task? 6.Contingency plans: What backup plans are in place if the risk response plan fails? 7.Communication and reporting protocols: How will the risk response plan be communicated to relevant stakeholders? How will the progress of the risk response plan be reported? 8.Monitoring and evaluation mechanisms: How will the effectiveness of the risk response plan be monitored and evaluated?

STEP 3 - PERFORMING RISK ANALYSIS The next step includes performing a scenario analysis or the Monte-Carlo simulation to assess the effect of uncertainty on the company's strategic objectives. Risk modelling may be performed in a dedicated risk model or within the existing financial or budget model. There is a variety of different software options that can be used for risk modelling. The outcome of risk analysis helps to determine the risk-adjusted probability of achieving strategic objectives and the key risks that may negatively or positively affect the achievement of these strategic objectives. The result is strategy@risk.

From my own experience, this is the area where many smaller organisations don't do so well. They can see and acknowledge the risks, but don't always have the resources or supports needed to address them. This is where a clear, relevant risk register is vital in highlighting to the Management/Executive/Board where the biggest risks currently sit and which should take priority in addressing them.

Once you've curated a top-notch list of risks your nonprofit faces, you can create risk response plans to appropriately address each risk based on the level of priority you and your team placed on it. That said, be careful not to bite off too much you can't handle. You'll already have an annual plan and strategic goals, so shoot for addressing 1 to 3 risks every 90 days, if possible. Doing more will reduce your capacity to focus on other priorities of leading your organization. Once you've developed a risk response plan for your top 3 risks, detail what you'll need, who will be involved, and what metrics and deadlines you'll use to stay on track.

Comprehensive risk response provide and opportunity to mitigate the identified risk and clearly make out an effective back_up plan against reoccurrence.

STEP 4 - TURNING RISK ANALYSIS INTO ACTIONS Risk managers should discuss the outcomes of risk analysis with the executive team to see whether the results are reasonable, realistic and actionable. Based on the risk analysis outcomes it may be required for the management to review or update the entire strategy or just elements of it. This is one of the reasons why it is highly recommended to perform risk analysis before the strategy is finalised. At a later stage the risk manager should work with the internal audit to determine whether the risks identified during the risk analysis are in fact controlled and the agreed risk mitigations are implemented.

Nothing can take the place of documentation, especially when it comes to board minutes or committee meetings. Once the top risks have corresponding risk response plans assigned to address them in congruence with the nonprofit's annual or strategic goals, it's time to establish an overarching risk management program that will act as the universal documented publication for responding to and addressing any risk in the future. The risk management program will include a specific risk response plan, how these objectives will be accomplished, and through what means (people, technology, etc.). Once documented, it will act as the risk committee's bible for risk management.

Clearly communicated and documented risk policy helps to institutional risk Management and provide opportunity for future reviews the room for improvement on new and upcoming (emerging)risk.

There are a few common pitfalls to consider when documenting and communicating the risk management policy which include: a) Lack of clarify and specificity in the use of risk management language and taxonomy. b) lengthy and complex documents which are difficult to comprehend c) Absence of Key Stakeholders' involvement d) Inadequate communication to all staff e) Lack of contextualisation where the ignorance of real-world scenarios f) No mechanism for updates or revisions on risk documents g) Lack of buy-in and engagement of top management h) Missing training and support i) Non-alignment to organisation's core values j) Limited documentation and accessibility

Another way to improve the effectiveness of the policy or the risk management framework is attach a measure of performance to it, that is easily quantifiable. For example; How is it achieving the intended goal or objectives? How many risks have been mitigated as a result of the policy? Is the internal control environment as whole maturing? How well do staff understand and appreciate its need? etc

It is generally considered a good idea to document an organisation’s attitude and commitment to risk management in a high-level document, such as a Risk Management Policy. The policy may describe the general attitude of the company towards risks, risk management principles, roles and responsibilities, risk management infrastructure as well as resources and processes dedicated to risk management. ISO31000:2018 also provides guidance on risk management policy.

The only thing worse than not having a risk management policy is having one that you do not follow. This is admitting that there is a standard that you are supposed to follow and you failed to follow it. A plaintiff's attorney will jump for joy when they find out this has happened because it makes their job infinitely easier. Please do not adopt a policy you do not follow.

Implement the risk management policy by clearly communicating it to all staff and volunteers. Provide training on policy procedures and responsibilities. Assign roles and designate accountability for policy enforcement. Establish monitoring mechanisms to track policy compliance and effectiveness. Regularly review incidents and near-misses to identify areas for improvement. Conduct periodic audits to assess policy adherence and update as needed. Foster a culture of risk awareness and accountability throughout the organization.

I would add a couple of points: - First identify the processes that you have as a non-profit organisation, so that you can do the risk assessment on each of them separately. It will facilitate the assessment and keep people focused while doing it. - In terms of identifying different risks from scratch, the organisation can use existing risk taxonomies on the web, which will at least give them a starting point. - Once processes and types of risks are identified, then the risk assessment takes the form of an exercise, where for each process we assess each type of risk.

1 Define Risk and decide the scope of risk you want to manage 2 Define mechanisms to identify and quantify various risks, enforce frameworks to create a control system, establish a root cause analysis process, deploy controlled corrective actions, test preventive actions and scale them and lastly create an efficacy check mechanism 3 Describe the needs ( FTE, Data, Tools) and get them 4 Set up reporting mechanisms 5 Set up kaizens and automation team

The above contributions are helpful in forming a risk management program. I would add two things: 1. Most importantly, what is your risk appetite, or tolerance for the risks you have identified and assessed? If you do not know the organization's risk appetite, you will manage all risks equally. Risk appetite should be set by the Executive Team of your company, at the advice of the Risk Committee. Once you know the executives' risk appetite for the strategic, operational, financial and compliance risks facing the company, you can make better decisions about which risks you can accept as is, and which ones need further mitigation. 2. The advice provided in this article applies in general to risk management--not just to non-profit.

NFPs are more susceptible to reputation and regulatory risks than any other entity. Special attention to socio-cultural dynamics of the community they serve and regulatory regime of the geographic location they operate in, are critical.

Just like in the corporate sector, defining a risk management policy should start with the strategy and goals of the non-profit itself. Once the goals of the charity and the sector that it operates in are well understood and defined, then you can begin the process of documenting what areas of risk apply to you, what your appetite for risk is, performing granular assessments like RCSA or Key Risk Assessments etc. But it all starts from understanding what you are trying to achieve.