The approach of charities to risk management has had to adapt during the Covid 19 pandemic. As society returns to a more normal existence with the lifting of government restrictions, it seems timely to re-evaluate risk management arrangements and consider what is really important in supporting organisational sustainability and the resumption or recalibration of service delivery to stakeholders.
As we prepare for the early summer schedule of board and audit committee meetings, we have identified four key things for charities to consider:
1. Understanding the robustness (or resilience) of your service delivery model. One of the key lessons over the last year is that good risk management includes understanding the impact of disruption on service delivery. As a charity, you may deliver some services yourself or you may work with external, third party organisations which deliver commissioned services on your behalf or in partnership with you. Thus, you may be exposed to both contractual and supply chain risks. Where this is the case, it is important to remember that in these circumstances, though you may work with a third party to deliver services, it does not mean that your risk is transferred.
Having good contracts in place is essential with a clear understanding where the fragilities lie in delivery arrangements, both within your organisation and the third party.A good contract is only half the story – critical elements of your service depend on robust, solvent suppliers. It is sensible to periodically obtain assurance on your supply chain by checking the solvency, disaster recovery and business continuity of key service providers (you should also adopt this approach for any third-party suppliers which provide services directly to you day to day, on which the efficiency of your work is contingent). This should be an ongoing activity, not just at the point of supplier selection.
2. Reappraise risk appetite and tolerance – the pandemic has demonstrated that we can take more risks than we once thought. Our risk appetite and tolerance has been higher during the pandemic in many areas – so we should not, by default, retreat to our pre-Covid levels. Many organisations have had to deliver services, sometimes enhanced or at much greater scale during the pandemic. In doing so, the risks associated were deemed realistic and feasible given the restrictions and resources available. Now is the time for senior management, boards and those charged with governance to consider if the ‘relaxing’ of risk appetite and tolerance should be retained as the last wave of Covid subsides, at least in some form.
Charities need to reflect deeply on the last year and evaluate whether the levels of risk tolerated should change permanently to a more open attitude to risk. What is key is that risk appetite and tolerance must track any changes to the organisations strategy and objectives. The full consequences of pandemic related risks will not necessarily be felt for some time. Whether it is the longer-term income of a charity or the delivery of outcomes against emergency funds from Government, the risk implications, direct or indirect, will be there for several years.This should form part of the board’s evaluation of its risk tolerance over the longer term.
3. Addressing the changing risk landscape. The relaxation of risk tolerances, changes in the delivery of services, greater use of digital technology as an enabler, all provide a platform for organisational change by taking advantage of new methods of working and delivering services. Organisations need to think about potential opportunities to do things differently and challenge their previous assumptions, business strategies and plans. Change which comes about through societal shifts like a pandemic tend to result in accelerated innovation and change. At the same time, the underlying risks that existed pre-pandemic are also likely to exist today and subsist into the future. They may change in prominence or may have a different cadence to them as a consequence of the pandemic. Changes made to ‘business as usual’ also brings with it threats and opportunities. Whilst re-assessing organisational priorities and risks, previous risks need to be considered and wrapped into the discussion on the risks and opportunities arising from a post-pandemic world.
There is now more societal awareness of ESG issues such as climate change, environmental and social responsibility which will continue to grow in significance in coming years so must be brought into discussions now.Organisational strategy and procurement risk will need to much more mindful of these trends.
4. Ensure risks and opportunities are fully integrated into everyday decision-making. Charities should remind their management teams that a core part of managing an organisation is ensuring risks are being properly understood and acted upon. Consideration of risk must figure more greatly in discussions relating to strategic and business planning, business cases and projects and in team meetings. However, risk should not be a laborious, form-filling exercise. With a more tolerant view of risk, proportionality is key. It is far better to have clarity and focus on the top five or so risks than 25 risks neatly documented in a risk register. We have observed that many organisations had to adapt quickly at the start of the pandemic and further empower staff to make the necessary changes. Staff now don’t want to lose that new level of empowerment - organisations would be negligent to ignore this.
In summary, the risk management world and the risks therein have moved on in the last year, but the landscape is not entirely different. Charities must embrace the changes made over the last year and exploit any opportunities by making potentially radical choices. The relaxation of risk tolerances needs to apply also to the risk management process itself – focussing on what is really important.
Subscribe to receive the latest BDO News and Insights
Please fill out the following form to access the download.