Adopting sound corporate governance practices not only helps these organisations operate more efficiently, but also makes them more effective in delivering the services for which they were established, mitigate risk and safeguard against mismanagement. This ensures that they remain attractive to potential donors and funders.
Risk management is an essential element of corporate governance and is key to ensuring a structured approach to decision making for strategic direction, operational processes and utilisation of capital. Without understanding the risks, and risk appetite, opportunities can be missed and unacceptable risks taken.
Organisations can manage their risk to an acceptable level by establishing a robust risk management plan that mitigates risks through an appropriate combination of preventative, monitoring and detective controls.
Organisations should start by considering the following:
- Their strategic objectives
- Their risk appetite
- The potential events and risks that may impact on them achieving these strategic objectives
- How to manage the risk to reduce the consequence and likelihood of the event
- Implement ongoing reporting, monitoring and evaluation process
- Enable and encourage all staff within the organisation to own the risk management process
Risks identified in this exercise could be categorised as strategic and operational. Absolute elimination of the identified risks is not possible as the costs would be prohibitively high, and it is not practical either. Identifying the organisation’s risk appetite is a useful tool to determine the extent to which the risks need to be mitigated. The risk appetite will vary from business to business and is influenced by individual cultures, strategies, operating environment and need.
Scenario analysis is one effective way to understand the level of risk an organisation is willing to take to meet its objectives.
Once the organisation has established its key strategic and operational risks and its risk appetite, an effective risk management plan and program can be designed and implemented. The outcome should be a sound risk management system that provides the tools and framework to meet objectives through managing risk and making the most of objectives.
In order to be effective, the risk management processes, including controls, monitoring and reporting, must be fully integrated into normal operating procedures, processes and systems to ensure that risk management becomes part of the culture and fabric of the organisation. Risk must be communicated and driven from the highest levels of management.
By setting in place an effective risk management program, which identifies and records key risks and appetite and implements a plan of mitigation, monitoring and reporting, grant recipients improve efficiencies and improve accountability through greater openness in decision making.
This ensures that stakeholders can have confidence in providing ongoing support and funding to support the strategic objectives of the organisation.