Experts share their thoughts on risk management for mission-driven boards

 

Board service today demands more than traditional oversight; it requires a proactive approach to navigating complex and evolving challenges. From financial stewardship to strategic decision-making, board members play a pivotal role in shaping organisational resilience.

One area that often takes new or even seasoned members by surprise is risk management. While it may not carry the immediate allure of strategy or innovation, understanding and addressing risks is fundamental to ensuring long-term success. For new or even experienced board members, learning risk management is a crucial function of board service.

After all, as Patrick Downes, a managing partner with corporate governance firm Governance Ireland notes, “Risk management might not sound like the most thrilling topic for many boards, but in truth, it’s one of the most important conversations we should be having. And, done right, it can be surprisingly powerful.”

We asked experts in both voluntary and elected board service to share what board members should know about risk management and how they should be prepared to act.

Risk management is a core board responsibility

Dr. Chad Bledsoe, President, Montgomery Community College: “Ultimately the board has the responsibility of ensuring that the institution is meeting its mission. And that can’t be done without adequate oversight of financial resources, of the risk that we all take on, whenever we talk about providing services, equipment, training, employing teachers, all of that.”

Dr. Froswa’ Booker-Drew, President, Soulstice Consultancy: “It’s more than just discussing great status reports and updates of what a board does; it is about making sure that the organisation is not placing itself in a position of liability, that the organisation is aware of all the risks that may exist and how they can put in protocols to ensure that the organisation is able to continue its mission.”

Risk management is part of the fiduciary responsibility held by every board member — the legal and ethical duty to act in the best interest of the organisation. A skilled approach to risk management protects the financial, reputational and legal status of the mission-driven organisation or municipality.

The board and administrators should begin with a shared understanding of what risk management is and how the board should approach it. Keep information about your organisation’s risk management efforts in an accessible, consistent location, like your board management solution.

Risk management education is crucial for boards

Gwen Dombroski, Manager of Legislative Services/Clerk, County of Renfrew, Ontario: “Legal and regulatory compliance is a critical component of risk management for public boards. Members must be well-versed in relevant laws, acts and regulations. This requires educating yourself on the board role and often relies on guidance from staff, other seasoned board members or legal experts. I feel the educational aspect is essential for informed decision-making and protecting both yourself and the board from legal repercussions and public scrutiny.”

Andrea Walsh, Senior Director, Mission Driven Organisations, Diligent: “A lot of risk comes down to ensuring that the fiduciary responsibility is exercised effectively. But risk comes in lots of forms as well, and having the capacity to understand and ensure that the board is well informed on all of the activities involved in the strategic direction is critical.”

A board can approach risk management effectively with the right training — both onboarding and in regular development throughout member service. Everboarding, which creates opportunities for learning throughout the board service lifecycle, is also an effective approach to keep members up to date on risk management and engaged with the topic.

Risk management should be reasonable and realistic

Maya Tussing, Partner and Co-Founder, Fairlight Advisors: “One risk boards face is simply not having realistic budgets, where they’re not considering the financial impact of risks. Many nonprofits own real estate and don’t calculate the costs of owning that real estate. Or they are leasing their property and haven’t thought about what if their landlord is going to raise their rents and their options if that happens. Can they even move? Maybe their mission is focused on the community in that area, and, if zoning changes or rents rise, they can’t leave and go virtual or move to another community. These are risks that they have to embed into their budgets and to their risk management platforms or programs.”

Diarmaid Ó Corrbuí, CEO, Carmichael: “Risk management can be a very tricky area to get right for their organisations. I have seen risk management systems that on paper look very sophisticated and comprehensive but are far too complicated and difficult to manage. As a result, they do not really help the board in their risk oversight responsibilities. I have also seen situations where boards do not systematically look at the risks their organisations face and agree how best to manage and mitigate those risks. The challenge is to develop a risk management system that is appropriate and manageable for your nonprofit.”

The leadership team’s shared understanding of risk is a core component in ensuring the organisation’s risk management plan is comprehensive — but not overwhelming. Boards must understand the real risks their entities face and put their efforts into plans that avoid or minimise those risks. The goal is to achieve the right-sized risk management plan for your entity.

Safeguard your organisation

Build organisational resilience and drive smarter decisions with our essential guide to governance, risk and compliance. Packed with actionable tips and best practices. Get the guide!

_________________________________________________________________________

Risk management is a tool for public engagement and building trust

Margaret Corbett, Deputy City Clerk, City of Niagara Falls, Ontario: “We think about what we are at risk of doing and what is the potential harm if we are not acting in a responsible manner. So, as council and staff, we work together to make sure that we’re supporting each other appropriately, especially for the overall benefit of the citizenship.”

Steve Schroeder, Board Member, Sun Prairie Area School District: “Most boards delegate risk management, in the traditional business sense, to the administration. That said, I think the board needs to be concerned about risk from the perspective of the image of the board and the school district.”

Gwen Dombroski, Manager of Legislative Services/Clerk, County of Renfrew, Ontario: “Handling public funds requires oversight and accountability. It is important to engage with audits and pay attention to financial reports to ensure fiscal responsibility. Due to the public nature of these roles, members are subject to public engagement and questions, especially with public funds, which can impact personal lives and professional reputations.

“Public-facing boards, particularly within the public sector, must maintain a high level of transparency to uphold public trust. It is crucial to become well-informed in your position and seize every opportunity for training to stay knowledgeable in your role. Many board positions are voluntary or offer a nominal stipend, requiring you to balance these responsibilities with your professional roles. This can potentially lead to conflicts of interest or added pressure from your primary occupation, alongside increased scrutiny.”

Risk management very much falls under the umbrella of public accountability and representing the organsation well. For public boards, this means managing relationships with the electorate, but for private organisations, the board is still accountable — to donors, volunteers, government oversight and more. Developing a risk management plan, and sharing it where appropriate, can build relationships with the very stakeholders your board relies on for support. Keep your risks plan in your board management software so it can be easily found by board members and key stakeholders.

Risk management is more than preventing harm

Scott Bridgen, Managing Director Audit and Risk, Diligent: “Ninety-nine percent of the world focuses on negative risk, and understandably so. But we could potentially do more. We could say, for example, reduce the time frame. We could take more risk because we will be able to make informed decisions because we understand how deep we need to go to make those decisions. Ultimately that’s what we’re trying to do, make better business decisions. And both sides of risk management give us the ability to do that.”

Patrick Downes, Managing Partner, Governance Ireland: “In my experience when people hear ‘risk’, they often think of disaster planning or worst-case scenarios. But to my mind that’s only half the picture. Good risk management is about asking, What are we trying to do? And then being honest about what could get in the way — or what might happen if we don’t act.”

Well-meaning boards can err by thinking of risk management as simply avoidance — avoiding the potential harms that come from, say, cyber crime or environmental disaster. But risk management also requires fully understanding where the organisation wants to go and removing obstacles to getting there. Unsurprisingly, this is why risk management falls in line with the board’s strategic work.

Some organisations create risk management subcommittees, but whether or not your organisation pursues that structure, teams must ensure risk-related work is not done in a vacuum but is fully integrated with the bigger-picture thinking of the board.

Dottie Schindlinger, co-founder of Board Effect and executive director of Diligent Institute: “Sometimes it’s not fraud and abuse. Sometimes we’ve strayed a little bit from our mission to try to go get this one grant fund because look, that money’s available and we really need that money. And that’s called mission creep. Suddenly we start to add to our mission to go get those dollars. And it’s really important that the board is there to help steer the organisation and safeguard against those sorts of things.”

The ultimate purpose of risk management is to establish the best possible circumstances for your entity. While this means avoiding bad outcomes, it also includes setting up your organisation or entity to succeed.

After all, what is a missed opportunity if not risk? This thinking reaches the heart of the strategic thinking the board undertakes, and the question “Where do we want to go?” should be a part of all discussions.

Be prepared to act on possible or imminent risk

Andrea Messina, CEO, Florida School Boards Association: “It is always the responsibility of board members to mitigate and manage risk. Sometimes, that comes in form or reporting to legal or HR something that may have been heard in passing or even deliberately shared with a board member. I like to remind board members that if they hear something and fail to report it and it happens again, they, too, now are culpable. Board members need to set the example for risk mitigation if they ever expect others to manage risk effectively.”

Maya Tussing, Partner and Co-Founder, Fairlight Advisors: “What are some risks? Well, there are plenty. For example, you can have a key person risk. It can be a major hit to an organisation if an executive director or a very successful fundraiser leaves. Many fundraisers rotate every four to five years because they have to refresh their donor base. Those are risks that are natural, and nonprofits should be prepared for them. However, a lot of organisations are not prepared for that.

“Other risks can be legal challenges or regulatory challenges, particularly for nonprofits that are supporting or servicing at-risk communities or communities that have high regulations like children, seniors, those in the healthcare area.”

Having a risk management plan in place is just the beginning. Board members should be ready to act on the plan when situations call for it. After all, a plan is no more than pieces of paper — or document in your board management system — if it doesn’t trigger immediate steps.

Boards should have regular conversations about risk management

Patrick Downes, Managing Partner, Governance Ireland: “For volunteer boards, many of whom are juggling roles, responsibilities, and real-world constraints, it’s easy to treat risk as something that sits in the finance or audit file or with the audit and risk committee. But actually, I think that risk should be part of everyday conversations – not a tick-box exercise once or twice a year.”

Diarmaid Ó Corrbuí, CEO, Carmichael:

“Developing a good and robust risk management system, using best practice templates relevant to your nonprofit is only the start of having an effective risk management system in place, it needs to be understood, owned and embedded into the governance systems. An effective risk management system is one where the board takes one of its key risks from its risk register at each meeting of the board and has a robust and informed assessment of the risk and its management. As in many key governance tasks, the quality and rigor of the assessment can be much improved by having a board sub-committee with specific responsibility for risk management and for preparing the analysis to assist the board in its assessment of the risk.”

Risk management is not a one-and-done board topic. Build risk discussions into every board meeting. This is easy to do with software that streamlines your meeting agendas, along with an accessible document library that all board members can access.

Read our other expert-led articles:

• Experts share top tips for AI governance
• Experts share their thoughts on board engagement
• Experts share tips for mission-driven organisations on ED&I
• Experts share their thoughts on ethics in the charity boardroom
• Experts share their thoughts on board development

Benefits of using your board management software to help support risk oversight for the board

A feature-rich board management solution like those offered by Diligent includes tools that help the board’s risk management efforts.

With a single dashboard for information and action items, the software interfaces ensure every member knows their current priorities and due dates. Easy-to-use templates allow administrators to create board books quickly and implement recurring discussion topics without unnecessary effort. A searchable document library can store training opportunities, with automated tasks prompting members to complete their training.

Additionally, with granular permissions and quick publishing, documents about your board’s risk management actions can be shared with important stakeholders or the public.

As a BoardEffect customer on the Diligent One Platform, your board will also be able to access Diligent AI Risk Essentials, helping to simplify risk oversight with AI-powered benchmarking to identify relevant risks quickly and help with guided onboarding and educational resources.

Risk management is a core duty of both elected and volunteer boards. With the board management solutions offered by Diligent, your organisation can take a more effective, efficient and successful approach to avoiding and mitigating risk. Let us know when we can introduce you to one of our board management solutions.