Charity donation tax deduction reduces the amount of your taxes. The effective management of risk is an essential part of the responsibilities for trustees of charities and is often overlooked by those responsible for managing the smaller charity.
Risk is an
event or action that may adversely affect an organisation’s ability to
survive or compete in its market or to maintain its financial stability
or its positive public image and the overall quality of its people and
services. Risk can also arise from a failure to exploit opportunities or
from a breakdown in operational controls and procedures.
The requirement to manage risk
For
registered charities the Charities SORP (Statement of Recommended
Practice) sets out the reporting requirements for trustees on the:
-
identification of major risks
-
the review of risks
-
the systems or procedures established to manage risk
It is therefore essential for all charities that they have a sound risk management policy
The role of the trustees
The
responsibility for the management and control of a charity rests with
the board of trustees. The board’s involvement in the key aspects of the
risk management process is essential. Trustees do not have to undertake
each aspect of the process themselves. Their level of involvement
should be such that the trustees can make the required statement on risk
management in the statutory annual report with reasonable confidence.
Sector Group
The management of risk will involve the following key steps:
-
establishing the risk policy
-
identifying risk
-
assessing risk
-
evaluating and implementing what action needs to be taken
-
reviewing and establishing a system of periodic monitoring and assessment
Although these elements can be used as ‘steps’ or
‘stages’, it is likely that trustees will need to revisit each stage as
their knowledge of the charity’s risk profile increases.
Any risk management policy will need to be:
-
comprehensive
-
continuous
-
integrated
-
suitable and proportional
Establish risk policy
Risk is an
inherent feature of all activity and may arise from inaction as well as
new initiatives. Charities will have differing exposures to risk arising
from their activities and will have different capacities to tolerate or
absorb risk. A charity with sound reserves could perhaps embark on a
new project with a higher risk profile than, say, a charity facing
solvency difficulties.
The risk policy process will include a consideration of the following:
-
the charity’s objectives, philosophy and strategy;
-
the nature and scale of the charity’s activities;the success factors that need to be achieved;
-
external factors that might affect the charity such as legislation and
regulation, and the charity’s reputation with its major funders and
supporters;
-
past mistakes and problems that the charity has faced;
-
the operating structure – e.g. use of branches, subsidiary companies or joint ventures;
-
comparison with other charities working in the same area or of similar size; and
-
checklists of risk factors prepared by other charities or other organisations.
It is essential that for this process to work, trustees
and executive management need to be committed to it. Trustees will need
to consult widely with key managers and staff, and may even involve
supporters and beneficiaries where reputational risk or provision of
service to beneficiaries is being considered.
Identify risks
The identification of risk should be integral to the strategic planning and budget setting process. Key questions will include:
-
What external and operational risks may prevent our charity from achieving its core objectives?
-
What might happen and what would the consequences be for us?
-
What are the steps we can take to mitigate or reduce those risks?
External risks generally fall into one or more of the following categories:
-
Political
-
Economic
-
Social
-
Environmental
-
Technological
-
Legal
and tend to be outside the control of the charity.
Internal
risks arise from the day to day operation of the charity and the
identification of these will require consideration of all aspects of the
charity’s operational activities.
This is not the only way of categorising risks and the following alternative classification could for example be used:
-
Governance risks – e.g. inappropriate organisational structure,
difficulties recruiting trustees with relevant skills, conflict of
interest;
-
Operational risks – e.g. service quality and development, contract
pricing, employment issues; health and safety issues; fraud and
misappropriation; loss of key staff;
-
Financial risks – e.g. accuracy and timeliness of financial
information, adequacy of reserves and cash flow, diversity of income
sources, investment management;
-
External risks – e.g. public perception and adverse publicity, demographic changes, government policy;
-
Compliance with law and regulation – e.g. breach of trust law,
employment law, and regulative requirements of particular activities
such as fund-raising or the running of care facilities. Although the
process of risk identification should be undertaken with care, the
analysis will inherently contain some subjective judgements and no
process is likely to be capable of identifying all possible risks that
may arise. The process can only provide reasonable (not absolute)
assurance to trustees that all relevant risks have been identified.
Assessing risks
The first stage of
the assessment process is to prioritise risks using impact analysis so
that the significance of a risk is measured against the likelihood of
that risk actually arising. Significance should be considered in both
financial and reputational terms. Risks can be prioritised so that those
with high significance and high probability receive primary attention.
Risks with high significance and low probability scores give rise to the
need for contingency planning whereas risks with low significance but
high probability scoring can often be addressed by improvements to
internal control procedures.
All risks have to be considered in
the light of the charities ‘risk threshold’ the setting of which will be
influenced by the level of reserves, the projected surpluses etc.
Evaluating and implementing the action required
Where
major risks are identified the trustees will need to ensure that
appropriate action is taken to ensure that these are mitigated. This
review should include establishing the adequacy of controls already in
place. For each of the major risks identified, trustees will need to
consider any additional action that needs to be taken to mitigate the
risk, either by lessening the likelihood of the event occurring, or
lessening its impact if it does.
There are four basic strategies that can be applied to an identified risk:
-
transferring the financial consequences to third parties or sharing it (e.g. insurance, outsourcing);
-
avoiding the activity giving rise to the risk completely (e.g. a potential grant or contract not taken up);
-
management or mitigation of risk; or
-
accepting it (e.g. assessing it as an inherent risk that cannot be avoided if the activity is to continue).
Risk mitigation is aimed at reducing the ‘gross level’ of
risk identified to a ‘net level’ of risk that remains after appropriate
action is taken. This identification of ‘gross risk’, the control
procedures put in place to mitigate the risk, and the identification of
the residual or ‘net risk’ can be recorded in a risk register (see pro
forma below). Trustees need to form a view as to the acceptability of
the residual or ‘net risk’ that remains after mitigation. It is possible
that the process may also identify areas where the current control
processes are disproportionately costly or onerous to the risks they
seek to address.
Risk Review
It can be
helpful to use a scoring system to assess which risks need further work.
Severity of impact could be scored from 1 (least serious) to 5 (most
serious) and similarly the likelihood of occurrence could be scored from
1 (remote) to 5 (very likely). The impact score is usually multiplied
by the score for likelihood and the product of the scores used to rank
those risks that the trustees regard as most serious.
Risks other
than high likelihood/high impact should not be ignored. Those with high
potential severity of impact but low likelihood of occurrence need to be
kept under review, possibly annually, and will need arrangements in
place to ensure that they can be addressed should they arise. Similarly,
events with low severity but with a high likelihood of occurrence may
become gradual drains on a charity’s finances or reputation. Those risks
with both low severity and low likelihood of occurrence are unlikely to
merit significant attention and effort might be better focused
elsewhere.
Risk management extends beyond simply setting out
systems and procedures. The process needs to be dynamic to ensure new
risks are addressed as they arise and also cyclical to establish how
previously identified risks may have changed. For all but the larger and
more complex charities, annual monitoring is likely to be sufficient
when supplemented by update reports and assessment of new activities or
proposed projects.
Conclusion
A charity that has identified the major risks it faces, and established systems to mitigate such risks, will be able to make a positive statement on risk in its trustees’ Annual Report. This will help to demonstrate the charity’s accountability to its stakeholders (beneficiaries, donors and other funders, employees, and the general public). An effective risk management strategy can help ensure the charity’s aims are achieved more effectively and significant risks are known and monitored, enabling trustees to improve forward planning.
Nigel SG Harper Chartered Accountant
Management Consultancy
Services Limited are experienced providers of advice and support for
the smaller business. A full range of accounting and management
consultancy services are available together with a without obligation,
free initial consultation.
Further details can be found at http://www.mcserv.co.uk/
Article Source: https://EzineArticles.com/expert/Nigel_Harper/767294
Article Source: http://EzineArticles.com/5018837
