Charities need to take risks as well as avoid them, so trustees and managers should draw up a policy to put these in context.  Charities often deal with risk by preparing a register of all the things that could go wrong. But a long list, ranked for probability and impact, does not necessarily mean that you are managing risk.

A better approach is to start by having a conversation among trustees and senior managers about what the risk policy of your charity ought to be. This is about setting the tone from the top. But it is not about avoiding or minimising all risk: a charity’s risk policy needs to state where the charity is prepared to take risks as well.

A simple risk policy for a hypothetical children’s charity might state: 
“ABC Charity is committed to improving life outcomes for children. The charity is completely intolerant of all risks to children and young people. But to fulfil the charity’s objectives, it has to raise funds and will therefore accept some risk in undertaking new fundraising activities.”  
Setting the initial framework allows the board to see the risk register in a context. The trustees of ABC Charity might question whether enough risk is being taken in fundraising. This changes the tone of the conversation at board level, which is too often focused on avoiding risk. 

Five Major Risks

Board members are also much more likely to engage with high-level analysis of the strategic risks if they are small in number. This approach
does away with number-based ranking and relies instead on descriptions of the risks and regular monitoring. It can be helpful to think in terms of
the big five risks:

Impact:
ABC Charity runs a number of programmes to improve children’s lives. While it believes that the programmes are well run and are well received,
it needs evidence of outcomes. Unless the charity is able to demonstrate impact, it will not be achieving its objects and is unlikely to receive future
funding.
Reputation: 
A charity’s reputation is everything, but it can be a slippery concept. Boards and senior managers need to understand how reputation weaves
through everything a charity does. Inadvertently, you could be giving out contradictory messages that jeopardise your reputation. In fundraising, for
example, you might adopt an ethical fundraising policy, but then give the fundraising team aggressive targets; which will matter most to the team?
Compliance:
While not a high-level strategic issue, boards do need assurance that this is being dealt with properly. Compliance is not simply a box-ticking
exercise. For ABC Charity, the inspection of a children’s nursery school by Ofsted will be crucial to its reputation and will help the board understand whether quality standards are being maintained, providing assurance that the operational team is delivering planned services.
Financial Sustainability:
This relies heavily on other strategic risk areas. A charity that is failing to demonstrate impact may find it difficult to source funding, for example. And non-compliance may damage reputation and jeopardises funding. But financial sustainability also has other aspects: does the charity have a
viable business model, or can funders see the value to them in what the charity does and are they prepared to continue paying for it? If a charity delivers fantastic services, but the costs are so high that no one is prepared to pay the price, then it is not viable. And with scaling down, some charities are finding that their management and overhead costs are now too high in proportion to their size. So financial sustainability risks are not simply about future funding, but also about the structure of the charity’s finances.

Finally, the board needs to consider whether there is a risk area that is specific to the charity. This may well link back to the risk policy and amplify a particular area of concern that needs to be managed well. The charity may be part of a federation, for example, with risks arising from the actions of others who share your name. Or the charity may be a membership organisation, with risks that the members and management team fall out of step and conflict ensues. These are the big picture issues often missed off a conventional risk register, because the process tends to focus on the detailed listing of risks in various categories. To manage risk well, your charity’s board needs to engage in regular discussions with senior managers about the big five.

source sayer vincent september 2019