1. Risk Assessment and Management
2012 OCASI Executive Directors Forum
October 23, 2012
Westin Prince Hotel
Presented by Suzanne Gibson

2. Welcome
A MIND SNACK:
“Risk management is probably one of the most important things an
organization does. And when you think about risk, you think about
financial. Risk can actually impact on almost every part of the
organization. So risk management is actually the identification of
threats to an organization, analyzing those threats for significance,
and then either eliminating that risk, transferring it, mitigating it or
deciding to go forward even though the risk exists.”
Carl Henderson, Housing Expert
Risk Assessment and Management 2

3. Introductions
 Your name and organization
 One thing you know about
risk management
Risk Assessment and Management 3

4. Session Goals
1. To define what risk management is and explore the different
categories of risk within non-profit and charitable organizations.
2. To discuss approaches to managing risks and devising strategies
to respond to them.
3. To review a medley of tools and resources to support Board and
staff related risk management work.
4. To uncover and provide very practical solutions, suggestions and
approaches that will help your organization to be more alert and
responsive to risk.
5. To devise next step actions that result in your organization
integrating risk management into its ongoing work.
Risk Assessment and Management 4

5. Session Guidelines
1. Always open for questions.
2. No question or idea is stupid - divergent ideas
snap us open!
3. Let’s engage everyone.
4. Respect the speaker.
5. Let’s have fun and stay open to sharing and to
each other’s experience!
6. Let’s test and share our assumptions.
7. Let’s not dispose but rather propose.
8. Let’s note points of confidentiality.
9. Other(s)
Risk Assessment and Management 5

6. What is Risk?
Governance is defined as “the overall processes and structures
used to direct and manage an organization’s operations and
activities.”
Canada’s Panel on Accountability and Governance in the Voluntary Sector
Ultimately, we are accountable to the public.
Risk is anything that threatens the ability of your organization to
accomplish its mission and preserve its reputation. It is measured
in terms of consequences and likelihood.
Risk Assessment and Management 6

7. Risk is anything that threatens the ability of your
Risks organization to accomplish its mission and
preserve its reputation. It is measured in terms of
consequences and likelihood.
Our work has become increasingly complex and
the possibility of litigation is greater than ever.
There are 2 ways organizations encounter risk:
 Risks affecting the organization
 Risks directly affecting Board members
Risk Assessment and Management 7

8. Risk Management
Risk management includes the culture, processes, and
structures that are directed towards the effective
management of potential opportunities and adverse
effects.
Do you have processes and structures in place?
What is your culture like with respect to risk?
Risk Assessment and Management 8

9. Why Risk Management?
The Downside
Under liability legislation, the organization and/or
individual directors may be held responsible for
payment of damages if reasonable precautions are
not taken to protect clients, staff and the general
public from harm.
The Upside
Risk management With effective risk management, you can take
results in
organizations calculated risks to create, build and establish
proactively and opportunities for your organization, clients and
mindfully taking tenants. You can be generative and dynamic and
advantage of know that you are assessing risk mindfully and with
opportunities that due diligence. Opportunists love risk
arise
management!
Risk Assessment and Management 9

10. Why Risk Management?
Fast-paced rapidly changing context
 Constantly changing environment with shifting legislation and
challenges related to compliance
 A diverse population with high priority clients - with more complex
needs
 New legislation, technologies and research - information overload!
 Changes and shifts in the funding environment (increased focus on
risk management, greater transparency/accountability, etc.)
 Increased alliances and partnerships
 Increased focus on effective governance and management
Others?
Risk Assessment and Management 10

11. Complexity Theory: Thoughts to Ponder
• Simple: baking a cake - few moving parts that follow a
predictable trajectory
• Complicated: sending a rocket to the moon - many
moving parts that follow several predictable trajectories
• Complex: raising a child - many moving parts that have
no predictable trajectories
Getting to Maybe, F. Westley
Risk Assessment and Management 11

12. Risk Management
 Defining risk tolerance and managing risks can assist
an organization in meetings its objectives and thriving.
 Risk management usually involves everyone including
the Board, Executive Director, staff and volunteers.
Many activities involve risk management including
drafting policies/procedures, setting service goals,
and financial and other reporting.
Risk Assessment and Management 12

13. Board’s Role in Risk Management
The Board usually has overall responsibility for risk
management and it delegates through policy and
approval to the Executive Director and staff most of the
detailed aspects of identifying, assessing and managing
the risks that the organization faces.
Risk Assessment and Management 13

14. Board’s Role in Risk Management
The nature of the Board’s involvement in risk
management will vary based on the size and
scope of the organization and its staff:
In larger organizations, Directors can rely on
staff to manage day-to-day risks and the Board is
involved in policy approval, strategies and major
decisions.
In smaller organizations where staff may have
less experience or skill, the Board may be more
hands-on.
Which type of organization are you?
Risk Assessment and Management 14

15. What Are Major Risks Your
Organization May Encounter?
Risk Assessment and Management 15

16. What Are Major Risks?
Loss of funding
Fraud
Natural disasters
Inadequate response to an emergency
Loss or theft of information
Personal injury
Abuse
Asset management/Property maintenance
Excessive increases in the cost of human or other resources
Volunteer or employee misconduct
Others?
Risk Assessment and Management 16

17. Types of Risk
Risks are interrelated and evolve into different categories.
Categories of risk can include:
(i) Financial: The risk of fraud, financial failure and decisions
based on inadequate or inaccurate information: Proper
accounting, Limits, Fraud, Financial Challenges, Funding,
Investments, Taxation, Insurance, etc.
(ii) Operational Risk: The risk of loss or impeded
service/program delivery resulting from inadequate or failed
processes, people or systems, or from external events: Real
Estate, Physical Premises, Programs and
Services,Technology/Information Technology, Human
Resources, Branding, Media and National Relationships,
Crisis Management/Business Continuity/Contingency
Planning, etc.
Risk Assessment and Management 17

18. Types of Risk
Categories of risk can include:
(iii) Legal/Regulatory/Compliance: The risk of
adverse outcomes due to non-compliance to laws,
rules, regulations, obligatory practices, standards or
other legal requirements: Applicable Legislation,
Litigation, Key Legal Documents, Government Relations,
etc.
(iv) Strategic:The risk arising from improper or
ineffective strategies or lack of responsiveness to
changes in the environment: Strategic Plan, Strategic
Partnerships, etc.
Risk Assessment and Management 18

19. Types of Risk
Categories of risk can include:
(v) Governance: The risk of ineffective oversight
and poor decision-making: Lines of Authority,
Board Operations, Policies and Procedures,
Information/Reporting to Board, etc.
(vi) Reputational Risk: The risk that negative
stakeholder impressions regarding the
organization’s practices, actions or inactions
may cause a decline in the organization’s
programs and services, ability to raise funds,
brand and/or goodwill in the community.
Check out ONPHA’s Governance Audit
Risk Assessment and Management 19

20. Managing Risk
• Active process of identifying and assessing risks
and developing responsive action plans to manage
risk factors
• Generally, Board undertakes strategic review while
staff manage and assess operational implications
and legislated limitations
• Need to devise a risk management strategy - start
by defining the amount of risk a Board is prepared
to take
Capacity to take risk depends on both
insurance and financial reserves.
Risk Assessment and Management 20

21. Risk Assessment
• Promote a discussion around the risks facing
your organization and identify top risks that
require action
• Assist the board in understanding the risk
strengths and weaknesses of the organization
• Assist in setting overall priorities, work effort and
overall risk tolerance.
Risk Assessment and Management 21

22. Risk Assessment
Risk Scale
 High Impact, High Likelihood – Immediate Action
required and extensive control activity essential.
 High Impact, Low Likelihood – Manage and monitor,
consider contingency planning
 Low Impact, High Likelihood – Management effort
worthwhile
 Low Impact, Low Likelihood – Accept but monitor
Key questions to ask when assessing risks:
1. Could this risk affect the organization’s ability to meet its
objectives
2. How likely is the risk to occur?
3. How serious might it be?
4. Should or can something be done to reduce the risk?
5. How can we be prepared to respond to problems.
Risk Assessment and Management 22

23. Risk Management
• Establish a risk register to track significant organizational
risks (in addition to the top 5) that require attention over
time.
• Develop action plans to address the risk.
• Management options include:
• Avoiding/eliminating risk (remove unsafe equipment)
• Transferring risk (hire a contractor with insurance for a
service)
• Mitigating risk (develop policies and procedures to
reduce exposure)
• Accepting risk (include funds in the budget as a
contingency)
The process can be more
Risk Assessment and Management complex or more simple. 23

24. Risk Management
3 Simple Questions to Facilitate a
Discussion
1. What could go wrong?
2. What will we do to prevent it from going
wrong?
3. What will we do if it does go wrong? Can
we afford it?
Document all discussion points.
Risk Assessment and Management 24

25. Risk Management
Taking the Questions Through a Scenario
Choose a potential risk currently arising within your
organization. Share the details and then run through the
questions.
3 Simple Questions to Facilitate a Discussion
1. What could go wrong?
2. What will we do to prevent it from going wrong?
3. What will we do if it does go wrong? Can we
afford it?
Risk Assessment and Management 25

26. Risk Management
You may want to establish and conduct an
annual risk assessment process, aimed at
identifying the top 3-5 risks to the organizations
and establishing associated action plans if
required.
•Half day training and discussion
•Discuss whether it is possible and advisable to strike
a working committee of the Board with the Executive
Director to review and work through a risk
management process.
Risk Assessment and Management 26

27. A More Formal Approach to R Management
isk
Devise a risk management committee to develop a
strategy:
• define risk management objectives
• develop a list of conceivable risks
• measure the likelihood of each risk and levels of acceptable
risk
• focus efforts on risks with high likelihood and impact
• develop a mitigation strategy and a prevention strategy for
each risk - consider key capacity/resource issues
• step back to determine risk response work (compare costs
with benefits of potential responses)
• establish financial controls and response protocols including
information and communication
• monitor your risk management work for enhancements
Risk Assessment and Management 27

28. R Processes
isk
• Internal Processes - interviews, surveys,
brainstorming, discussions
• External Review - comparisons with others, peer
sharing, benchmarking, case studies, promising
practices, etc.
• Expert Assistance - risk consultants, audits,
facilitated workshops and trainings, etc.
Risk Assessment and Management 28

29. Risk Management
Tools:
• This Risk Management Toolkit including the Governance
Audit
• Chartered Accountants of Canada: 20 Questions
Risk Assessment and Management 29

30. Problem Solving
Decision Making
1. need to understand and define the issue/problem.
2. examination of problem: research, brainstorm, seek input, have
discussions, assess risk, etc.
3. determine the outcome you want to achieve.
4. generate possible solutions - analyze the options and pros and cons.
5. use a committee to explore the issue and provide recommendations.
6. make the decision.
 consensus building
 decision by majority rule
7. document and implement the decision: consider what resources and
who will do what, when. Address any risk issues with strategies.
8. communicate it to all key stakeholders.
9. evaluate the decision: learn from the decision process and the quality of
decisions made. Another decision may be needed to solve a problem
that is not being addressed
How do you make decisions that mitigate risks?
Risk Assessment and Management 30

31. Risk Management
Query
What action(s) will you take forward as a result of this
session?
Risk Assessment and Management 31

32. Risk Management - In Closing
“I think sometimes we have a habit of not wanting to share bad
news and often we see risk as a bad news story and we’re
responsible. I look at it a little differently. I think if we don’t talk
about risk then we could fall into a huge trap and open our
organization and our residents up for more risk. So for me, it’s
exciting when we can talk about it and figure out how to address
it. So bring it forward, talk about it. You are going to feel much
more confident.”
Patti Bell, Executive Director, Blue Door Shelters
Thank you for participating.
Risk Assessment and Management 32