1. Jonathan Orchard and Kate Sayer 15 September 2016
Beyond risk registers
Jonathan Orchard and Kate Sayer
15 September 2016

3. Is this risk management?

4. Is this risk management?

5. Risk management in your charity?
In small groups consider the strengths and weaknesses of your existing risk management practice. Be ready to feedback

6. Expectations on risk Charity Commission: SORP 2015
‘trustees should regularly review and assess risks…and plan for the management of those risks’
SORP 2015
‘description of the principal risks and uncertainties facing the charity ….together with plans and strategies for managing those risks.

7. Traditional approaches
Identify all the risks you can think of
Rank them for impact and likelihood
Multiply the factors
to prioritise risks
Present in a risk
register
Variations on this?

8. What are the drawbacks? Focus on assessing not managing
Numbers are misleading/subjective
Different levels need different formats – operational versus high level strategic
Need to pinpoint a risk event (risk/cause)
Static while risk is dynamic
Creates illusion that you are managing risks by this process
Numbers-based ranking – problems
interval between a 1 and a 5 is different
People mean different things by the numbers they attribute
Pretends to be objective when it is not
Absolute numbers rather than relative – it would be better to get people to think about pair-based choices – I would rather have this situation than that – it would rank them more accurately, but probably a waste of effort
Risk events:
In order to make a risk register work properly, you need to pinpoint the risk so that you can rank it – think about disaster recovery. But in fact, you need to think about a continuum of risk events - a range of possibilities

9. Categories of risk Trustees Audit committee Middle managers
Senior managers
Strategic risks
External
Outside your control
Possibly high impact
Operational risks
Internal
Within your control
Possibly high probability
Mitigation
Response plans
Reduce likelihood
Framework of controls
Management assurance on control
Active, regular monitoring

10. Change attitudes to embrace risk
Where will you be risk-taking?
Where will you be risk averse?

11. Strategic risks – the Big 5
Impact
Are you making the desired impact in support of your beneficiaries and can you evidence it?
Financial sustainability
Are you managing the finances to ensure you continue to make an impact in the medium to long term?
Compliance
Are you meeting your regulatory, legal and donor compliance requirements and expectations?
Reputation
Are you able to respond effectively to any incident that could result in damage to your reputation?
Specific to your charity
Specific to the nature of the charity and may be a risk that is at the heart of what the charity stands for. For example, for a children’s charity it might be child protection.

12. Risk registers Positive aspects Drawbacks Structure Defining the risk
Accountability
Co-ordination of operational risks
Prioritisation
Familiar
Drawbacks
Defining the risk
Subjective scoring
Limited consideration of controls
Static
Not integrated

13. Better risk registers Factor in financial & reputational impact
Consider risk policy
Consolidate similar risks
Identify responsibilities
Regular review
Deep dive

14. Assurance map Strategic risk/key business process Source of assurance
Outline of assurance process
Assessment of quality of assurance
Adequate assurance received?
Actions
Capacity to deliver new strategy
CEO/SMT
Quarterly progress reports
[need to review example reports]
Y/N
Income generation
Managing change

15. Practical assurance processes
Internal review of internal controls (eg CC8)
Regular internal review of high risk areas
Extend scope of external audit
Develop tools for in-house internal audit
Commission internal audits on one-off basis
Recruit an internal auditor
Outsource internal function
Cost

16. Independent assurance
Second line of defence
First line
Second line
Third line
Operations
Oversight
Independent assurance
Frontline staff
Line managers
Support and compliance functions
Senior management
Internal and external audit
Regulatory assessment
Assurance

17. Reputational risk Ethical standards
Does the organisation monitor/respond to specific social and ethical issues which would be of concern to its stakeholders or at odds with its vision?
Corporate governance and leadership
Does the board set an appropriate tone for the organisation?
Does it have a realistic and compelling vision for the future?
Does it actively demonstrate good governance?
Regulatory compliance
Is the organisation complying with all relevant laws and regulations?
Does it anticipate and keep up with regulatory developments?
Does it become involved in legal disputes?
Financial performance
Does the organisation have sustainable income sources?
Does its funding base suggest it will be able to continue in the longer term?

18. Reputational risk Delivering to beneficiaries
Is it consistently meeting the needs of its beneficiary group?
Does it actively identify the changing needs of its beneficiary group and seek to address these?
How good are the services offered?
How are complaints handled?
Delivering to funders and donors
Is it consistently meeting the needs of this group?
How accountable is it to them?
Workplace talent and culture
How well are employees and volunteers treated?
Is it able to recruit, develop and retain quality employees and volunteers?
What is the charity like to work or volunteer for?
Communications
Does the organisation provide meaningful and transparent information to all stakeholders, allowing them to understand its values, goals, performance and future prospects?

19. Change attitudes to embrace risk
Innovation
Portfolio of innovation

20. What ‘controls’ do we need?
Flexible business models
Project management tools
Pilots
Feedback mechanisms
Multi-disciplinary teams
Finance team engagement

21. Culture Values Transparency Open to ideas Desire to learn
Reward right behaviours
Evidence base

22. Risk management in your charity
From today’s discussion, what can you do to smarten your risk management practices? Again, be ready to share

23. Conclusion “Discipline makes daring possible”
Dr Atul Gawande – 2014 Reith Lectures – “The Century of the System”
Effective risk management should enable organisations to take risk
Having basics of strong risk management – communicated thru the organisation breeds confidence in taking risks
How to develop strong basics – see our previous presentation

24. Contact details jonathan.orchard@sayervincent.co.uk @orchardj
@katesayer1
@sayervincent