Michigan Nonprofit Association
MNA Members     (login)
RESOURCES

FAQ's about Risk Management

Developed by the Nonprofit Risk Management Center for the Michigan Nonprofit Association as part of the Satellite Office Program. For more information about the topics covered here, contact Mike Corbin at MNA.

Risk Management for Nonprofit Organizations

Q: What Is Risk Management?

A: The Nonprofit Risk Management Center defines "risk" as "the possible deviation from what you expect to occur." An effective nonprofit can't operate successfully without taking risks. Risk is an inherent part of existence. Community-serving nonprofits must accept varying degrees of risk in order to accomplish their missions. Therefore, a risk management program doesn't seek to eliminate all risk within an organization. Instead, it provides a framework for balancing and understanding which risks are inherent within the organization and for empowering staff to make good choices in dealing with these risks.

The Center defines risk management as "a discipline for dealing with uncertainty." From uncertainty about continued funding for vital programs, to uncertainty about the motivations of individuals seeking paid employment or volunteer service opportunities, every nonprofit must confront risk on a day-to-day basis. The key to a successful risk management program is to ensure that the organization manages risk by design, and not by default. While it's not possible to prevent a storm from brewing, there are many risks that can be addressed through thoughtful planning and creative problem solving.

Because it's a way to anticipate and manage future events, risk management incorporates a decision-making process to determine how best to deal with the potential for loss. In the nonprofit sector, risk management focuses on identifying and dealing with risk as it applies to an organization's core assets: its people, property, income, and goodwill.

Identifying risk in terms of cost and timing is important. While many risk management decisions take place in anticipation of loss, the risk management decision-making process is also essential in the wake of a crisis for damage control. Therefore, effective risk management assists the organization not only in helping to prevent loss - but also in coping with a loss once it has occurred.

Risk management is a pragmatic process with real-world implications. An organization can't simply craft a plan and then put it on the shelf. Risk management is a way of thinking that must permeate the whole organization - from the most senior board member to the CEO to the newest volunteer. Understanding that dealing with risk is everyone's responsibility ensures that risk management becomes an integral part of the organization's life.

Even if a nonprofit organization develops and implements an outstanding risk management program, the organization still faces the possibility that a client may be injured or the organization might be sued - even for frivolous reasons. Responding to the legal summons in a lawsuit is compulsory, and defending the organization requires the expenditure of funds and the use of human resources. An effective risk management program can simplify the process by enabling the nonprofit to demonstrate that it followed the appropriate steps or procedures in its activities - evidence that could help the organization prevail in a lawsuit.

Back to Top

Q: Doesn't Insurance Cover the Risks Faced by an Organization?

A: Often nonprofit managers believe that simply purchasing insurance eliminates risk. Insurance is a means of transferring some of the financial consequences of a risk to another party. Simply purchasing insurance doesn't reduce the likelihood of a mishap, nor does it eliminate many aspects of nonfinancial risk to a nonprofit.

Although the third party, usually an insurance company, agrees to assume a degree of financial obligation for losses, your nonprofit continues to have responsibility for managing the risk. In addition, losses can lead to increases in insurance premiums and, in some cases, the cancellation of a policy. Securing similar coverage through another carrier could be problematic, or very costly.

Back to Top

Q: What are the key steps in developing a risk management program?

A: There are five steps in the Risk Management Process. Adapting this process to meet the needs of your nonprofit is a simple way to integrate risk management into your operations.

  1. Establish the context - The risk management process begins with identifying the role of risk within the organization. Some organizations are risk averse while others are extreme risk takers; the nonprofit's position on the risk-taking continuum will affect the nature of the risk management program. Another consideration is how important the practice of risk management is to the organization and the level of resources the nonprofit is willing and able to commit to the process. Ideally, the board and staff should support and encourage the use of effective risk management techniques.

    Some of the questions you might ask in identifying the context for risk management in your nonprofit include:

  • What is the nonprofit's view of risk - something to be avoided or a natural part of the organization's operations and mission?
  • What barriers or potential barriers exist to the development of a risk management program? What issues will make it particularly challenging for this nonprofit to establish a risk management program?
  • Are there any signs or motivating factors that will increase the organization's receptivity to risk management activities?
  • Which internal stakeholders should be involved in the development of a risk management program?
  • Which external stakeholders should be involved in the creation of a risk management program?
  • How supportive is the board of directors and staff to developing a risk management program? Will they have to be "sold" on the idea?
  • What organizational strengths will support a risk management program?
  • What organizational weaknesses may impair our ability to establish a risk management program?
  1. Identify risk - Risk identification is essentially the process of determining what can happen, why, and how. In many small to mid-sized nonprofits, a committee comprised of staff and volunteers identifies the nonprofit's risks in a brainstorming session.

    There are several ways of making certain you "cover the bases" when you undertake the process of identifying risk for your nonprofit. One approach is to first identify the functional areas in the organization, such as governance, fund raising, community service initiatives, special events, and administrative operations. Use these functional categories as headings for the risks identified in the brainstorming process.

    Another approach is to simply ask: "What uncertainties threaten our mission?" After a long list of risks has been identified, the team working on the project can assign appropriate headings. There is no right or wrong way to go about the process. The goal of risk identification is to consider and articulate the risks facing the organization, without neglecting any potentially serious risks.

  2. Evaluate and prioritize risk - So how do we make sense of risk? How do we set priorities? Even if we could identify every single risk facing a nonprofit, we can't address everything completely. There would be no time left to focus on the mission of your organization. How do we make appropriate decisions about where to invest our time and dollars? Are your perceptions of what is risky reasonable or based on a purely emotional response? Not every risk facing your nonprofit is likely to materialize. Other risks may be likely but their consequences not especially severe. The third step in the risk management process is to evaluate the likelihood of a risk materializing and its potential severity. For example, while the risk of a client suffering a serious injury while participating in an activity sponsored by your nonprofit may be remote, the costs - both in human and financial terms - would be devastating if this risk materialized.

    The goal during this step is to create a workable, practical list on which to focus risk management efforts. At first glance, all of the items on the list may appear to be "high priority" risks requiring the organization's immediate attention. It's essential to take a closer look and begin to prioritize identified risks.

  3. Decide how to control your risks and implement the risk management program using available tools - This is the most active phase of the process whereby the group develops strategies to minimize the likelihood of a risk materializing and responses that will be activated should an incident occur. These strategies are then tested by the organization.

    It's always best to involve people "on the ground floor" in identifying risks, as well as strategies. For example, if the prospect of expanding your recreation program to include seniors keeps you awake at night, then involve people who understand the risks of serving seniors in identifying risks and strategies for this activity. What might occur that would be contrary to the mission and purpose of the recreation program? What steps can be taken today to minimize the chance of injury or another undesired outcome? What will you and others do if a senior client is injured while participating in a recreational activity?

  4. Monitor and update the risk management program as needed - Risk management is a circular process. Each of the five steps of the risk management process is connected to the steps that precede and follow it. The team assigned to risk management in a nonprofit organization should review the techniques it has implemented on an annual basis to make any revisions that may be needed. Each year the risk management committee can also select a new set of risks on which to focus their attention. Author Nigel Nicholson writes, "Instead of learning from mistakes, people go into defensive routines. It seems more important to save face than to determine the causes of failure."

    One of the most important steps in embracing risk management is to commit to learning from your experiences. If your nonprofit has weathered a loss or incident, consider what should be done to prevent a similar incident in the future or to respond more effectively if it occurs despite your attention to the issue.

For more information on this topic, see Mission Accomplished: A Practical Guide to Risk management for Nonprofits, 2nd Edition, published by the Nonprofit Risk Management Center in 1999. Contact Mike Corbin or visit www.nonprofitrisk.org.

Back to Top

Q. Layoffs: Negotiating the Rough Surf in Your Nonprofit

Layoffs that are motivated by economic or administrative reasons - such as loss of funding or staff reorganization - are common in the nonprofit sector. The result is that employees, through no fault of their own, may find themselves unexpectedly without a job. When downsizing is necessary, the nonprofit can take steps to reduce its liability in the process of laying off one employee or several paid staff.

Back to Top

Q: We can no longer support the current number of staff on our budget. What is the chance that laid-off employees will sue us if we let them go?

A: When economics dictate that a staff position be cut, it's critical that the nonprofit have a well-supported business reason to select which employees are to be terminated. The risk is that you'll be vulnerable to claims that discrimination played a part in deciding who was to be let go. Whenever a nonprofit is considering layoffs, alternatives should be also considered. Can the objectives of the reduction-in-force (RIF) be accomplished through a hiring freeze, a salary freeze, an hours reduction, or a status change from full-time to part-time? Document that you've considered alternatives to the RIF. Take the time to spell out in a written memorandum to the board, the business reasons for the necessary layoffs, as well as your justification for those employees selected for termination.

Back to Top

Q: Even if we have a legitimate business reason documented and we've considered alternatives to a RIF, are there other aspects of a RIF that could come back to haunt us?

A: Before implementing any lay-offs, consider how the workforce will be impacted. Is the downsizing going to affect one particular group of employees more than others? Is the reorganization going to eliminate the only minority in the agency? If your answer to either question is yes, even if there are solid business reasons for the selection of that particular employee, there are clear liability risks involved in the RIF.

Back to Top

Q: What's the best way to select the employees/positions to be eliminated?

A3: In selecting which employees/positions will be eliminated, it's imperative to use an objective method. Possibilities include basing retention on:

  • seniority,
  • positions/job functions linked to essential parts of the mission or specific goals of the organization, determined by a needs assessment,
  • a lottery, or
  • strong past performance ratings.

Whatever the method, consider:

  1. convening an oversight committee to provide objectivity for the process of implementing the reductions,
  2. conducting a needs analysis to determine which positions are critical and which could be eliminated, and
  3. reviewing the termination decisions for discriminatory bias.

Salary shouldn't be a consideration in who goes and who stays, since typically older workers are those with longer tenure who are at the higher end of the salary scale.

Back to Top

Q: What can our nonprofit do to reduce the risk of a lawsuit?

A: Your nonprofit can reduce the risks of facing a lawsuit in a number of ways. First, consider asking for voluntary resignations from employees. Also, take some time to identify ways you can support employees who will be let go. If your policies prohibit use of the nonprofit's equipment for personal reasons, consider relaxing these rules and allowing employees who will be laid off the opportunity to use your equipment to prepare resumes or search job notice Web sites. Review your reference giving policy. If you don't give references, consider changing your policy and using a reference form. A reference form is a document that serves as a written reference. You'll be doing departing employees a great service by ensuring that they will be able to provide a reference to prospective employers. For assistance on reference giving or help developing a reference form or reference-giving policy, contact your attorney or the Nonprofit Risk Management Center at (202) 785-3891. Even if you think you can't afford a severance package, it might be worthwhile to negotiate a severance package in exchange for a signed release and waiver of claims against your organization. Although a release will cost you something, you'll probably sleep better knowing you've taking an important step to reduce the possibility of a suit. Contact the Nonprofit Risk Management Center at (202) 785-3891 or your nonprofit's attorney for advice and assistance before using a release.

Back to Top

Q: Whom should we tell and what should we tell about the reasons for the downsizing?

A: It's critical to communicate to the staff the reason for the downsizing. Management or the board should share the economic realities of the situation with the staff, and explain the business justification for the reorganization or downsizing. They might explain that the downsizing is being carried out reluctantly and only after efforts have been taken to avoid such as result. If possible, make an effort to network with other nonprofits in the community to identify alternative new positions for those being let go.

Back to Top

Q: Are there federal or state laws that affect downsizing?

A: In severe downsizing situations, such as a nonprofit closing its doors, the federal WARN Act (Worker Adjustment and Retraining Notification Act) or a similar state law may apply.

WARN only applies to those nonprofits with 100 or more full- or part-time employees, who, in aggregate, work at least 4,000 hours per week. WARN requires employers to give employees 60 days' advance notice when 50 or more employees will be terminated, if that constitutes 1/3 of the workforce (or when 500 or more employees will be laid off).

Beware of state laws:

  • Connecticut and Maine have their own state WARN Acts affecting workplaces with 100 employees;
  • in Hawaii, Maryland, Massachusetts, Tennessee and Wisconsin the trigger is 50 employees;
  • the Michigan plant closing law affects workplaces with 25 or more employees; and
  • in Minnesota, a nonprofit must immediately notify employees in writing when a petition for bankruptcy is filed.

Back to Top

Q: How can we soften the blow of a lay-off for employees being let go without jeopardizing the nonprofit?

A: Because lay-offs are often unexpected and not the employee's fault, many nonprofit employers offer separation pay when termination is a result of economic necessity. There is a risk in having such a policy as a standard procedure because in cases where a severe shortfall necessitates layoffs, there may not be sufficient funding to cover all of the separation payments.

While softening the blow of a lay-off is a terrific idea, rather than codifying separation pay in personnel policies, it's better to offer separation pay as funding allows. An alternative is to clearly state in policy language that separation pay will be offered, "at the discretion of the board, as funding permits."

Back to Top

Q: Fortunately, we don't have to worry about layoffs now, but are there things we should know or could do now that would help us if this ever became necessary?

A: Begin by reading your nonprofit's handbook, noting any policies that might lessen your right to conduct a reduction-in-workforce or specify how RIFs are to occur. Also review all written policies given to employees.

Instruct management not to make promises that they can't keep, such as there won't be any layoffs or that everyone's job is safe. Employees who feel that they've been misled or lied to are more likely to sue.

If you are considering hiring younger workers who have needed skills to replace older employees who don't posses these skills, stop. First offer to retrain the to-be-fired older workers in new skills and document that offer.

Never use a lay-off process as a way around terminating poor performers. RIFs are not an alternative to terminating someone for poor performance or gross misconduct. A lay-off process should never be used for this purpose.

This FAQ was adapted from Taking the High Road: A Guide to Effective and Legal Employment Practices for Nonprofits, published by the Nonprofit Risk Management Center. For more information, contact (202) 785-3891 or visit www.nonprofitrisk.org.

Back to Top

"MNA Member Login/Join