Strategic Risk Management: Looking at Both Sides Now

By Melanie Lockwood Herman and George L. Head, Ph.D.

An effective nonprofit manager has a thoughtful perspective on his or her organization's past, and an educated idea of what lies ahead. Some of you dream big — predicting large new grants, praiseful national publicity and a growing demand for your services. Others of you see your organizations marching forward focused and methodical, but often without great notice or public fanfare, in pursuit of your mission. You may feel confident about what the future may bring and your ability to manage resources in a way that leads to a fruitful and productive future, but none of you really know exactly what tomorrow will look like. Events that you cannot fully foresee may make your nonprofit's tomorrow much different — worse or better — than it is today. And without a crystal ball, or omnipotence, you will not know. All you can expect from yourself and others is the ability to weigh the potential losses and gains to your nonprofit's mission in order to make the best possible judgement to preserve that mission.

Events that change your perception of your nonprofit's tomorrow may happen unexpectedly, and usually very suddenly. They arise from risk — that is, from the possibility that the future may be surprisingly different from what you expect. These surprises may bring bad or good results, generating threats of losses or presenting opportunities for gains. Most times, a risk encompasses both; the trick is to determine if the gains will outbalance the losses in terms of your mission.

Traditionally, the discipline of risk management has been devoted to addressing threats of accidental loss. In this traditional insurance-and-safety context, the most risk management could ever accomplish was to reduce or eliminate losses from accidents, so that a nonprofit or other organization could, at best, "safely remain as it always has been." This perspective has not addressed nonaccidental risks of loss from poor business judgment or from errors in forecasting client needs; nor has it entertained the possibility for gain from risk.

Strategic risk management embraces both the upside and downside of risk. It seeks to:

  • counter all losses, both from accidents and from unfortunate business judgments, and
  • seize opportunities for gains through organizational innovation and growth.

The result is that risk management, at its best, enables your nonprofit (or any organization) to "be all it can be."

What Is Risk?

A risk is a possibility that something will occur. When you choose to take a risk, it is wise to aim to lessen any negative impact and increase any positive impact that might happen. Risk is associated with events whose chances of happening (occurrence) are greater than zero, but less than 100 percent. Where change occurs (as in the future), risk arises.

Most nonprofits, by their very nature, actively seek change. The sought-after change might be the well being of the constituents or communities that are the focus of the nonprofit's mission. For any community-serving nonprofit to succeed, its world must change; it cannot stand still, or expect to remain perfectly stable. Nonprofits exist in the larger world, which by its very nature changes. So here is the paradox: Change brings risk, but without change and the attendant risk there could be no progress. Nonprofits are about progress, thus they are about change, and need to learn to tolerate a level of instability, unpredictability, risk. A nonprofit cannot do business without incurring some level of risk, just as a human being cannot exist without incurring some level of risk

What you expect the future to bring, and how you prepare for your vision of the future, greatly affects the amount of risk confronting the organization you manage. If you have one set of very specific expectations for your organization's future, and thus are unprepared to accept any other version of the future should it occur, then your organization faces great risk. You will have no plans, other than Plan A. Strategic risk management is about visualizing other scenarios of the future and having a Plan B, a Plan C and perhaps a Plan D in your hip pocket. This will lessen the surprise for the organization.

For example, if you expect that no employees will be injured on the job this year then your nonprofit almost certainly will be surprised and unable to respond appropriately when a key person suffers a work-related injury. Or if you never expect or prepare for an unusually large donation from an unforeseen benefactor, you will be amazed when a philanthropist asks what good uses your nonprofit will make of the $1 million that she wishes to donate. Surprised and unprepared, your nonprofit may have to restructure or suspend services to clients while adjusting for the absence of the injured key person. Surprised and unprepared, with no clear, inspiring plan to use the offered $1 million, your nonprofit may lose this gift to another cause or organization that this generous benefactor suddenly finds to be more with it and thus deserving.

But if you are prepared for a broader range of potential future outcomes, your nonprofit faces less uncertainty. With more enlightened expectations and better preparation, you will lessen the surprise when the disability of a key staff member requires that you restructure job assignments and take advantage of cross-training to maintain fairly normal operations until the disabled staff member returns or can be permanently replaced. Similarly, some thoughtful long-range planning and study of other successful nonprofits' growth should enable you to visualize your mission, funding options and alternative operating methods to the point that your organization can constructively welcome an unexpected major patron.

Dealing effectively with a downside risk such as a key person's disability and an upside risk such as windfall-donations are both instances of strategic risk management.

Strategic risk management ...

  • Counters downside risks by:
  1. reducing the possibility of occurring (probability) and scope (magnitude) of losses; and
  2. financing recovery from these losses.
  • Seizes upside risks by:
  1. searching for opportunities to more fully, more certainly and more efficiently achieve a nonprofit organization's mission; and
  2. developing plans to act on these opportunities when the future presents them.

Strategic risk management encompasses both the downside risks of loss and the upside risks of gain. Realistic expectations for potential future scenarios and thorough preparation to handle the full range of possibilities are essential to empowering an organization to be all it can be in a less-than-fully predictable world.

Why Manage Risk?

The most straightforward answer to the question: "Why manage risk?" is Manage risk to reduce potential losses and to increase potential gains. But to make strategic risk management a daily reality for your nonprofit, you need more concrete operational goals. Five good reasons for a nonprofit to manage risk are:

  1. to counter losses,
  2. to seize opportunities,
  3. to reduce uncertainty,
  4. to be a good citizen, and
  5. to fulfill a community-serving mission.

1. To Counter Losses

In traditional risk management, where accidental losses are the sole focus of attention, countering these losses is the essence of risk management. Countering accidental losses involves reducing the probability, magnitude, or unpredictability of accidental losses; and financing recovery from accidental losses that cannot be prevented.

Traditional risk management techniques for reducing accidental losses involve either "avoiding" or "modifying" the activities that may generate accidental losses. Techniques to finance accidental loss that cannot be avoided use either the "retention" of the financial burden of these losses within the nonprofit organization, or the "sharing" of this burden with other organizations beyond the specific nonprofit.

For example, if a nonprofit that provides recreational opportunities to youth chooses to transport clients to and from the facilities each day, it is exposed to many property and liability losses from roadway accidents. To reduce the probability of these accidents, the nonprofit may decide not to provide transportation for these youth ("avoidance"). Alternatively, the nonprofit may continue transporting children, but only after making sure that its drivers are well trained, the vehicles are well maintained, and the routes traveled are the safest possible (three examples of "modifying" activities to reduce the probability of an accident occurring or to lessen loss exposures).

To pay for losses from roadway accidents that may strike the nonprofit, it may pay for minor losses from its own funds ("retention"), or may contract with a separate bus company for this transportation (in effect, "sharing" the financial burden of these accidents). Another way the nonprofit could share the costs of these accidents is to buy physical damage and liability insurance for its own buses. Under such insurance, the insurer would pay for the nonprofit's property and liability losses that fall within the scope of this insurance, leaving the insured nonprofit to pay for only those elements of its losses that go beyond the limits of this coverage.

2. To Seize Opportunities

Innovation and seeing possibilities others have overlooked are touchstones of nonprofit managers' success. When these management insights let you identify opportunities for gain, strategic risk management better enables us to seize these opportunities. While virtually nothing can assure total future success, strategic risk management encourages you to:

  • create, or be watchfully open to, opportunities;
  • evaluate opportunities as they develop;
  • remain ready to act on those opportunities that appear promising;
  • introduce new operating procedures that grasp chosen opportunities in timely ways and, if they prove successful, making these new operating procedures part of the organization's routine activities; and
  • assess over time whether seizing each chosen opportunity has benefited the organization and those whom it serves.

3. To Reduce Uncertainty

Uncertainty in the future and as a state of mind is reduced by gathering more data on which to base better predictions and by anticipating and preparing for a wider range of outcomes.

The results for your nonprofit are better decisions and more confident decision-makers. More accurate forecasts of the future make better decisions possible. Managers are better able to make decisions that more effectively advance the nonprofit's mission, and — if they do make a wrong decision — are better prepared to take prompt corrective action. Reduced psychological uncertainty among managers makes them more confident in moving forward, more optimistic in making the changes that the realization of their mission requires, less agonized by paralyzing doubts, and able to sleep restfully at night. Just as it does for their organizations, good strategic risk management enables the individual managers and board members of a nonprofit to make the most — avoid the worst and capture the best — of an always unpredictable world.

4. To Be a Good Citizen

Organizations, as individuals, are good citizens when they act according to accepted standards. Being a good citizen involves both obeying the law and behaving ethically. Activities that fulfill both legal and ethical requirements have the added benefit of reducing the probability that the organization will be sued and — particularly important for nonprofits — foster a favorable public image for the organization. Thus, acting as a good citizen tends to insulate an organization from liability losses (a downside risk) and opens opportunities for an organization to gain positive public support (an upside risk).

5. To Fulfill a Community-Serving Mission

Nonprofit organizations perform many functions in the public that neither governments nor profit-seeking firms could, or would wish to, perform. In exchange for these community-serving efforts, federal and state governments grant nonprofit organizations some significant tax and regulatory advantages that others do not have. In return, these governments expect nonprofit organizations to devote their resources as effectively as possible to the purposes expressed in their mission statement.

Strategic risk management is an essential part of this public trust to make the most effective use of your nonprofit's resources for community service. On the one hand, strategic risk management aims to prevent these resources from being needlessly sacrificed to accidental losses caused by risks with more downside than gain. On the other, strategic risk management strives to nourish a nonprofit's resources to grow toward greater mission fulfillment by empowering it to seize risks with more upside than loss. Nonprofits cannot avoid risks altogether. Changing the world or your next-door neighbors' tomorrow for the better requires managing risks in enlighten ways. It requires Enlightened Risk Taking.

Melanie Lockwood Herman is executive director and George L. Head, Ph.D. is special advisor at the Nonprofit Risk Management Center.

This article was adapted from the text of a forthcoming publication from the Nonprofit Risk Management Center: Enlightened Risk Taking: A Guide to Strategic Risk Management for Nonprofits. The Center is now accepting advance orders for this new book, along with the companion publication, Enlightened Risk Taking: The Workbook. Note: Both publications will be shipped mid-October 2002.