2007 Risk Management Resolutions

It's Never too Late to Begin Anew

By Melanie Lockwood Herman

Although the first month of your New Year is history and no doubt you have already made progress on many of your annual resolutions, we'd like to suggest three really important ones from a risk management standpoint. Unlike a resolution such as jogging 10 miles that can be painful to achieve and potentially cause injury, the risk management resolutions the Center offers are low risk and high reward. Followed carefully they will improve the good health of your nonprofit and increase the odds that your organization will be successful in advancing its mission. Another piece of good news: Rather than overwhelm you with pages of "to do" items, we present three straightforward resolutions. Each resolution includes a list of follow-up steps. Choose those steps that suit your nonprofit.

#1 Turn a Vendor Into a Partner

An insurance professional (typically an agent or broker) should be a valued business partner. Too many nonprofit leaders view their insurance agent or broker as a vendor. This is a narrow view that doesn't take into account the potential value an insurance professional could bring to your nonprofit. A skilled, savvy agent or broker can:

help the staff and board of the nonprofit appreciate current and emerging risks and exposures;
alert the organization's key personnel to appropriate safety and risk management measures;
shop for the most comprehensive coverage at a price the nonprofit can afford;
advise the nonprofit's leaders about the need for high limits or additional lines of coverage;
serve as an effective advocate and professional advisor when the nonprofit faces a claim; and
assist the nonprofit's leaders understand the nature and details of the insurance program for which the organization has spent precious resources.

If you're keen to turn your insurance vendor into a true partner, consider taking one or more of the following steps:

Check out the firm's Web site to learn more about its client base, published services, areas of expertise, and access to the insurance marketplace. Remember that a relationship is a two-way street. Just as you expect them to check out your nonprofit, the firm should be able to count on your willingness to click your way to a basic understanding of the firm.
Invite your agent to talk with you (by telephone or in person) about the services he/she can provide. Keep talking until you have a solid understanding of the resources available to you.
Consider developing a broker services agreement that outlines the services and assistance you require and they are willing to provide. Remember that the agreement will be of little use unless it contains specific expectations and tasks. Give yourself extra points for including deadlines and accountability measures!
Ask your insurance professional to help you identify the steps required to make your nonprofit an account that underwriters are eager to write.

#2 Get the Board on Board: Add a Risk Report to the Board's Agenda

In the United Kingdom the boards of registered charities are required to understand and on a regular basis to review the major risks facing their organization. (See www.charitycommission.gov.uk.) Charity boards are also required to ensure that systems have been established to manage those risks. Despite a wealth of resources available on the topics of governance and board leadership, little mention is made of the board's responsibility for risk awareness and risk management. Rather than bemoan the board's interest in the topic, nonprofit leaders must commit to bringing the topic of risk to the board's attention. Strategies for doing so include:

Add a statement about risk management responsibility to the board's job description. For example:

The board of directors is responsible for understanding the major risks to which the charity is exposed, reviewing those risks on a periodic basis, and ensuring that systems have been established to manage those risks. The term "risk" refers to the uncertainty surrounding events and their outcomes that may have a significant effect, either enhancing or inhibiting: operational performance; achievement of the nonprofit's mission, goals and objectives; or meeting expectations of stakeholders. "Major risks" are those risks which have a high likelihood of occurring and would, if they occurred, have a severe impact on operational performance, or achievement of goals and objectives, or could damage the reputation of the charity.
Add the subject of "major risks review" or "risk assessment for ABC Nonprofit" to the board's meeting agenda at least once annually. Add a report on major risks and risk management strategies as a recurring item in the executive director's report contained in the board meeting materials.
Schedule a briefing to the board delivered by a risk management consultant or other expert on a facet of risk facing the organization.

Responsibility for the oversight of a nonprofit rests with the board of directors and as such their involvement in the key aspects of the risk management process is essential. This doesn't mean that the board of directors is expected to undertake each aspect of the risk management process alone. In all but the smallest charities, the board is likely to delegate elements of the risk management process to paid staff professionals. At a minimum, the level of involvement should be such that the board is fully aware of major risks facing the organization and can articulate the organization's principal strategies for managing risk.

The board's responsibilities are likely to encompass:

ensuring that the identification, assessment and mitigation of risk is linked to the achievement of the charity's operational objectives;
ensuring the process covers all areas of risk, including financial, governance, operational and reputational risks, and is focused primarily on major risks;
ensuring that the process seeks to produce a risk exposure profile that reflects the trustees' views as to levels of acceptable risk;
reviewing and considering the principal results of risk identification, evaluation and management; and
ensuring that the risk management is ongoing and embedded in management and operational procedures.

#3 Practice What You Preach: Get Your Policies in Sync

During the past year the Center has been working closely with a Washington-based nonprofit that serves teens in the United States and abroad. Our most recent engagement for this nonprofit was a policy implementation initiative, where we were asked to assist in the updating of a voluminous policy manual for staff and participants. At the start of the project we discovered the following realities:

Some of the policies were so convoluted that they were subject to widely varying interpretations.
In some cases, staff found it nearly impossible to comply with the strict requirements of a policy.
On occasion, staff disagreed with the intent of the policy and voluntarily chose not to comply.
Many staff acknowledged never reading the entire policy manual, citing its volume as a barrier.

The goals of our policy review and updating project included:

getting the staff on board before the revised policies were put to bed;
making certain that all policy language was unambiguous;
differentiating between required policies and suggested strategies; and
providing a policy road map with clear guideposts for personnel.

The lessons from this project and other client initiatives the Center has tackled in recent months can be applied in your organization. These lessons emerge in many consulting projects where our staff are asked to recommend changes to existing policies and procedures. Follow some or all of the steps below to get your policies in tune with reality at your nonprofit.

Review your written policies in order to identify policies that are 1) out of date, 2) poorly written, or 3) routinely ignored.
Rid your organization of any unnecessary (e.g., dated or no longer needed) policies. For example, is it really necessary that all female staff wear light-color hosiery?
Solicit volunteers from your staff to fix what needs fixing.
Establish a timeline for rewriting the broken policies and drafting new policies that reflect your current circumstances, environment and service delivery.
Circulate a draft of the revised policies to a wide audience representing varied perspectives.
Schedule a briefing or a series of briefings to introduce the new policies and solicit questions.
Distribute electronic and print versions of the revised policy manual, far and wide.
Hold your personnel accountable for adherence to the new policies.

When You Want Help

Remember that the Nonprofit Risk Management Center exists to help nonprofits address risk management challenges. We're here to take your phone calls and e-mails on any imaginable risk management topic. We offer frank risk management advice and point you to resources and materials that will help you better understand the dilemma you're facing and the solution we recommend. To access this free service, click here.

Melanie Herman is executive director of the Nonprofit Risk Management Center. She welcomes your feedback or questions about any of the topics covered in this article. Melanie can be reached at (202) 785-3891 or by e-mail.

Library