The Risk Management Process

By the Nonprofit Risk Management Center

Measures to address risk should be practical and within the reach of the organization. Every nonprofit, from the largest to the smallest, can and should take time to look into the future and predict both downside and upside risks. In fact risk management is extremely important for small nonprofits with limited resources to draw on when things turn out differently than they expect. It is up to each nonprofit to select the strategies and approaches that is can afford and reasonably accomplish.

The risk management process as taught by the Nonprofit Risk Management Center consists of five important steps. When followed judiciously, the steps become part of the nonprofit’s decision-making process and become stronger with each use. The steps are listed here and then applied to a sports and recreation program as an example.

  1. Establish the context. Examine the mission, history and culture of your nonprofit to gauge how the risk management program should be structured to increase the potential of its success. Given the organization’s resources and needs, consider how broad in scope the risk management effort will be. Focus on a specific area (i.e., client safety) or specific functions (i.e., governance or operations).
  2. Appraise risks. Identify exposures to events that cause different outcomes than those expected. Begin with listing a wide range of risks and then separate between concerns requiring immediate attention and those that pose negligible threats to the nonprofit’s mission and survival.
  3. Decide what to do and communicate the decision. Evaluate alternative methods for addressing the nonprofit’s exposures to risk and select the most practical, affordable and effective approach for each targeted risk exposure.
  4. Act on your decision. Implement the strategies that the risk management team selected.
  5. Follow up and adjust. Monitor the results. How is the policy working? Is there a reduction in accidents, injuries, near-misses? Is production or service improved? Strategies that are not working as expected should be adjusted to meet the needs of the nonprofit and new strategies should be adopted to fill any gaps.

Sports and Recreation Application

Risk is inherent in any sports or recreation program. To remove the potential of risk or injury completely would change the fundamental nature of the sport. To change the way coaches, officials and administrators access risk often makes the difference between safety and injury. In sports and recreation, the risk management process may play out as follows:

  1. Establish the context. Consider the venue in which your sports program operates. Look at resources, the nature of activities offered, the nonprofit’s past history with accidents and loss, its perspectives on risk taking, the experiences and skill of participants and their ability to handle issues that arise.
  2. Appraise risks. Review the places that damage or injury can occur to people, property or the nonprofit’s reputation. Evaluate possible policies, procedures, personnel selection, training, supervision and equipment to protect participants from injury.
  3. Decide what to do and communicate the decision. Select one or more of the possible options. Communicate changes in to coaches, administrators, event/game officials, athletes and parents/guardians to ensure consistent use and application.
  4. Act on your decision. Purchase additional or updated equipment and show players how to use it safely. Train staff to use playing area checklists (pre and post game) that you create. Start using the selected rule change(s).
  5. Follow up and adjust. Monitor the results. Include periodic review (before and after the game) of playing surfaces, sports equipment and personal protective equipment to ensure that they remain in good condition for use. Note accident, injury and near-misses. Have these incidents declined based on implemented changes in policy or procedures? If not, return to step one and re-analyze the situation to develop new strategies.

The Nonprofit Risk Management Center welcomes your questions at 703.777.3504 or