Risk responses

Risk is defined as an uncertain future event or condition that could affect your organization, either negatively or positively. As part of a successful risk management plan, organizations need to be ready with appropriate risk responses that reflect their organizational culture.

Negative risk

When a risk is identified, the organization has the option to do its best to eliminate this type of risk from occurring. This may mean changing the way it does business.

In the case of negative risk, organizations have four options:

1. Avoid

When a risk is identified, the organization has the option to do its best to eliminate this type of risk from occurring. This may mean changing the way it does business. Examples include:

• Only accepting volunteers over the age of 18 years.
• Refusing to schedule dance performances out of doors.

2. Mitigate

When risks cannot be totally eliminated, steps or internal controls can be taken to mitigate or lessen the chance of risk. Examples of controls might be:

• Mandatory criminal record checks
• Mandatory waivers for participation
• Photo releases prior to the use of photos in publications
• Identity or address verification
• Ensure cyber security
  • Cybersecurity for Nonprofits: Best practices and how to prepare
  • Small Charity Cyber Security Guide
• Steps to prevent fraud
  • Fraud Risk in Nonprofit Organizations
  • Five Internal Controls to Prevent Fraud in Nonprofits

3. Transfer

It is difficult to provide programs and services to the public without taking some form of risk, so organizations often transfer some of the risk to a third party by purchasing insurance or hiring security services. It is important that board and staff understand the extent of their coverage in all areas of risk. Types of insurance include:

• Commercial General Liability Insurance
• Directors and Officers Liability Insurance
• Property Insurance
• Accident Insurance (member/volunteer)
• Bonding

Contact your insurer, or check out this Insurance Toolkit for the Voluntary Sector: A Guide for Nonprofits and Charities, prepared by the Alberta Voluntary Sector Insurance Council.

4. Accept

If the risk has only a slight chance of happening or the impact is minimal, the organization may choose to accept the risk and handle it as it happens. These organizations are encouraged to establish contingency plans so they are prepared, such as:

• Emergency Planning
  • Prepare Your Business for the Unexpected - Table Top Exercise, provided by Henderson Insurance
• Crisis Communication Plans
• Disaster Recovery Plan or Business Continuity Plans 

Positive risk

On the flip side, to be ready for positive risks, organizations have more options.

1. Exploit

This involves removing uncertainty, opening the door to opportunities as they occur. An organization ready to exploit positive risk will:

• Establish a risk-ready culture
• Executive Directors, pre-approved by their Boards, will have the authority to respond to opportunities up to a certain level or degree.
• Extra funding is available in the budget for unexpected opportunities 

2. Enhance

In this case, an organization will go a step further to ensure the likelihood of a particular risk or opportunity happening. Some organizations:

• Request new ideas to support
• Take on a new business activity or organizational responsibility. 

3. Share

Organizations can share the risk of new opportunities by inviting the participation of other partners. 

4. Accept

Or, an organization, which may be limited in time and resources, may choose to handle positive risk and potential opportunities as they occur. In these cases, some existing service or program may have to end, or be put on hold, to accommodate a new opportunity.