We know when it comes to your nonprofit’s work, the phrase “risk management” doesn’t necessarily make you feel like jumping up and down with excitement— but it’s as crucial as any other task your organization undertakes. Good risk management helps ensure your nonprofit will have enough assets to carry out its mission, and it also vastly increases the odds that your organization’s actions will not harm the population it serves, the general public, or your employees and volunteers.
Of course, even the best planning cannot assure that bad things will not happen to good nonprofits. However, without risk management plans, nonprofits leave themselves vulnerable to events that could cause harm to individuals served by their organization, or to the organization itself. These types of incidents can be costly financially, and can affect your organization’s reputation with funders and in the community. However, even a good risk management plan won’t save the day if you don’t have the culture to execute it.
In many ways, risk management is just one aspect of overall good management. Risk culture can be defined as the “soft” side of risk management. At a basic level, risk culture is the way everyone in an organization feels about risk, and recognizing that feelings, attitudes and perceptions about risk and safety will influence how they are managed. It sets the tone of an organization, influencing the risk-consciousness of its people as they conduct their daily activities and pursue their business objectives. The culture of the organization sets the tone, and research demonstrates that the level of safety performance an organization can achieve is dictated by its culture. It’s the fabric in which you wrap your organization, and the tighter knit the fabric, the more protection it’s able to provide!
Of course, culture isn’t something that can be changed overnight. It requires constant, consistent messages to your employees and volunteers that managing risk is a part of their daily responsibilities. Not only is it valued, but it’s critical to your organization’s success and survival. Keep in mind – you’re not working to make safety and risk management a priority for your nonprofit– you’re working to change how people value each other and your clients, and that translates into safety and risk management. Not everybody is going to value processes and procedures, but they will comply with them if they believe that doing so will help keep the people they care about safe.
In fact, almost all incidents can be traced back to individual human behavior. Sometimes we want to get a job done quickly and we think we know what we’re doing, or we think nothing bad will happen, so we skip steps. That’s why it’s important for people in the organization to watch out for one another, and for the group mentality to be about safety and risk aversion. And while having the courage to speak out when you see something unsafe can be uncomfortable or difficult, it matters. The support for giving all employees the safety to speak out when they believe they have spotted an unsafe condition must come from top management. Employees need both permission and the right communication channels to be able to report concerns.
At this point you’re probably wondering – how do you gauge current risk culture at your organization? Keep in mind that culture is revealed through behavior, and people adjust their behavior to match the behavior of those around them. Your organizational culture drives the behavior of your employees and volunteers.
Top leadership has to make sure that everyone knows that he or she supports a culture of transparency and values input from employees and volunteers. Having a strong risk culture means your staff and volunteers know what your organization stands for. They need to know that their behaviors and actions don’t put themselves or others at risk.
Building a risk aware culture is one of the most important things you can do for your organization. Although risk management is a process, not an all-or-nothing proposition, every journey begins with a first step. You may have binders full of risk management protocols and procedures and still not have a risk aware culture. Or, you might not even think you have a “risk management” plan, but still have a risk aware culture that provides safe outcomes for your staff, clients, and volunteers. Don’t get bogged down with the words “risk management.” Ask yourself whether you have a culture of caring for others and whether you have established practices and procedures that help reinforce and standardize those caring practices. That’s true risk management!