There cannot be many charity trustees who are unaware, at least in a general sense, that they are responsible for managing risk in their organisation. But perhaps there is an element of vagueness about the issue. What type of risks should they be aware of? And how, precisely, are they to be managed?

The Charity SORP 20OO (the Statement of Recommended Practise) leaves no room for uncertainty. It declares that the annual report of the trustees must include 'a statement confirming that the major risks to which the charity is exposed, as identified by the trustees, have been reviewed and systems have been established to mitigate those risks'.

Easy to say, of course, but how many charities could make such a declaration with any degree of confidence? How many have established an ongoing reporting system to ensure that risks are drawn to the trustees' attention, that serious risks are identified and that steps have been taken to reduce their impact?

It is perhaps understandable if some charities feel they have more pressing matters to attend to. But risk management means more than simply fulfilling a duty. It is an important opportunity to improve the way a charity operates. It also shows that trustees take their responsibilities seriously - something that could count in their favour if, for whatever reason, their actins are questioned. In short, it is a fundamental aspect of good governance.

Certainly, the Charity Commission sees the matter in this light. During their review visits, they will carefully assess standards of trusteeship and governance, and risk management will be on the agenda. They will expect to see that a charity is 'run by a clearly identifiable body of people who take responsibility and are accountable for controlling the charity so that it is economically and effectively run'.

Where to Begin?
The starting point for any process of identifying risks should be a clear understanding of the charity's objectives and what it is legally allowed to do. The aim should be to identify potential hazards that are real and significant - those which, if not dealt with, could compromise the charity's ability to fulfil its mission.

Ask most trustees to think about risks and they will generally point to financial matters. But finance is just one of a number of areas that should be assessed. The Charity Commission has produced a sample of risks that provides a starting point for charities who are unsure how to proceed. The list is useful, but it can never be comprehensive. Every charity has is points of difference, and risks that are individual to it.

Even within an organisation there are likely to be differences of opinion. Risk is a personal matter and what strikes one individual as highly important may seem of less significance to another. It is therefore important that trustees address the subject collectively, and agree upon their level of risk tolerance. This will be very important when they subsequently address specific risks, and decide which deserve remedial treatment.

Once risks are identified they should be graded. In may instances a simple 'high' or 'low' could be significant. But some charities may wish to be more precise, perhaps using a scale from 1 to 5. Using the 1 to 5 scale for both seriousness of a risk and the probability that it might happen could further refine the system. Risks with the highest rating in both categories require immediate action.

Some risks, such as a fire at the charity's premises or a theft of valuable equipment, may be high impact but low probability. But these possibilities should not be ignored. It may be appropriate to obtain more comprehensive insurance, improve security systems or arrange for offsite retention of computer records.

Risks that are both low impact and low probability may not need attention, but they should be noted and reviewed from time to time. These, and all the results, should be documented in a risk register, which not only confirms that the charity has taken appropriate action but allows the trustee to make risk management part of their normal governance.

This last point is perhaps the most important of all. A risk management exercise is not a once-only review. The register should be regularly appraised and updated, and this should form part of the agenda of formal trustee meetings.

© Copyright H.W. Fisher & Company. All rights reserved.
Used with permission.