by Melanie Lockwood Herman
This article was inspired by the writings of Diana Del Bel Belluz, M.A.Sc., P.Eng., President of Risk Wise Inc., a Toronto-based risk management consulting firm. To read Diana’s inspirational eZine, visit www.riskwise.net.
“We can rebuild him. We have the technology.” Some readers may recall these statements from the opening credits for The Six Million Dollar Man, the popular T.V. show which ran for four years beginning in January 1974. During the opening sequence, viewers were invited to suspend disbelief and preconceived notions about medical science and embrace the idea that government doctors could transform an injured astronaut into a crime-fighting superhuman.
As I meet with nonprofit leaders across this country, I am frequently reminded that the leaders of the U.S. nonprofit sector “have the technology” to implement key risk management policies in their organizations. But I’ve seen over and over again, that simply having the tools (sample policies, anyone?) and structure (whether it’s top down or matrix management) may not be enough to insulate your nonprofit from the cold breezes and after-shocks of unmanaged risks.
Many leaders begin their risk management journey by seeking examples of policies and procedures used by similarly situated nonprofits. Finding and adapting the tools for managing risk in your nonprofit is not the biggest challenge you face. The hardest part of effectively managing risk is changing the culture of your organization.
In a recent article appearing in the informative eZine published by her company, Risk Wise, Diana Del Bel Belluz writes: “The challenge of adopting a culture of risk management extends to all sectors. A survey Risk Wise conducted earlier this year revealed that many government departments have not yet fully embedded risk management into their business practices. This is true despite having put in place frameworks and processes for integrated risk management.”
Diana offers what she terms “catalysts” to help leaders embed a risk management culture in their organizations.
Catalyst #1: Establish Clear Risk Management Objectives, Strategies, Roles and Responsibilities
Diana explains that leaders “need to be explicit about what needs to be accomplished, how, by when, and who is responsible for what.” Risk management is a discipline where jargon and technical lingo abound. To persuade busy staff in your nonprofit organization that risk management is worth their time and effort, it must be articulated in terms that relate closely to the organization’s mission and to their role in delivering the mission. According to Diana, “In many public and private sector organizations, strategic objectives are more like a list of hopes and dreams than they are meaningful and measurable targets that both inspire and hold people to account.”
ASK YOURSELF: Does my nonprofit have explicit risk management objectives and strategies? Are roles and responsibilities for identifying and managing risk known throughout the organization? If key personnel are unaware of their role in identifying and managing risk, risk management cannot come to life in your nonprofit.
Catalyst #2: Articulate Risk Appetite & Tolerance
As we consult with nonprofit leaders across the country, few are able to articulate the risk appetite and tolerance of their organizations. Countless leaders have asked the Center to provide benchmarks or studies demonstrating the average insurance limits and deductibles selected by comparable organizations. We explain that selecting limits and deductibles begins with determining the risk appetite and tolerance of the organization—versus examining what others have decided to do. These questions remind me of the response given by countless mothers in response to the whining child who complains, “But Jimmy is doing it!”
It is difficult, if not impossible, to implement effective risk management strategies in an organization that has yet to consider and articulate its appetite for risk taking.
ASK YOURSELF: Has my organization articulated its risk appetite and tolerance? If people don’t know what the criteria are for decisions, risk management cannot come to life in your organization.
Catalyst #3: Use Risk Intelligence to Drive Excellent Performance
According to Diana, “If we define risk as events or conditions that create uncertainty around the achievement of objectives, then clearly, risk and performance are linked.”
She explains the concept with the following example:
Imagine ‘knowledgeable staff’ is a key performance driver for providing top-notch tutors in an after-school program and the associated risk factors are the ability to hire and train staff to the required level of knowledge. If we notice a downward trend in the knowledge level of new recruits or that people are completing our training programs without achieving the level of knowledge required, we can intervene in a timely manner. But if we don’t know about or own up to the facts or reality, performance will inevitably suffer.
ASK YOURSELF: Has my organization linked its risk and performance indicators? If you don’t understand how risk can affect your objectives and don’t establish and track risk indicators, risk management cannot come to life in your organization.
Catalyst #4: Foster Dissent and Inquiry
Business guru Peter Drucker advises that the kind of decisions the executive has to make “are made well only if based on the clash of conflicting views, the dialogue between different points of view, the choice between different judgments.”
In his book Why Great Leaders Don’t Take Yes for an Answer, Michael Roberto explains that decision-makers need to foster conflict and dissent to ensure “that the course of action selected enables the organization to achieve its performance objectives in a way that optimizes resources and balances risk better than all other plausible alternatives.”
A culture of candor is essential in a nonprofit organization that seeks to balance the drive for mission fulfillment with the need to operate with transparency and accountability. Whether it’s a board-level discussion about strategic programming opportunities, or the downside risks associated with a proposed collaboration, your nonprofit’s leaders should embrace the expression of divergent views. According to Diana, “For a risk assessment process to be effective, it must bring to the surface all critical information for the decision at hand. This can’t be achieved if the organization has a culture of silence in which people are afraid to speak the truth.”
ASK YOURSELF: Does my organization foster dissent and inquiry in its strategic decision-making? If the truth can’t be heard, risk management cannot come to life in your nonprofit.
The subjects of culture change and effective risk management will be addressed in a forthcoming book from the Nonprofit Risk Management Center. Information on the book will be featured in a special edition of the Center’s e-News. Check your email inbox for details.
Melanie Lockwood Herman is Executive Director of the Nonprofit Risk Management Center. She welcomes your questions, comments and feedback on this article. Melanie can be reached via email or at (703) 777-3504.