Nonprofits should be considering “good risks”. Managing these risks can save a lot of money and mean a lot more for achieving their mission goals. Similarly, nonprofit auditors, as risk subject matter experts are well positioned to lead the charge and begin to change the under appreciation of good (positive) risk management.
When most auditors, or even managers think of risk management, their focus is mostly trained on negative risks and their mitigation. Often this is the mandate that their board audit committees focus on and the direction auditors are steered to. However it is important to begin to realize that nonprofits can ill-afford this. In my view, this is particularly costly for nonprofits in the humanitarian relief sector where in addition to costs, under appreciation of positive risks limits the capacity to bring more relief to populations in need and to make important investment decisions.
Ironically, many people’s eyes glaze over when positive risk management is mentioned. They think positive risk is some “rich” problem to have. They think of positive risks as competing for attention/airtime with the more scary negative risks. Others just disregard the idea as an academic novelty. But if you consider that business objective/outcome variability is a function of both positive and negative risks effects, then it is easy to see that this gives more options for mitigating a “net risk” exposure .
Net Risk = Positive Risks (Outcome of Opportunities) + Negative Risks (Outcome of Threats)
Think of it the same way you think of the simple economic equation we use in business and even in our personal lives.
Profit/Loss = Revenue – Costs
In the same way you must jointly consider and manage revenue and costs to get a favorable profit picture, or to balance your household “books”, you must do the same for negative risks and positive risks to minimize net risks to your nonprofit’s business objectives. Fortunately the same concepts and tools used to manage negative risks can be applied to positive risk management. Therefore consider this to be something your nonprofit already does with negative risks and not a new thing.
I strongly believe that there is nothing new under the sun. Let me be clear. Positive risks are being managed today. They are just being managed based on the gut feelings of individuals and other ad hoc systems. They do not benefit from the visibility, systematic approaches, processes and toolsets that the negative risks have come to be managed by today. One way we observe this is when managers ignore warning signs and proceed, in the face of the “red” indicators we derived from only focusing on negative risks. Many times the managers are intuitively factoring positive risks in their calculations. They may not be as cavalier as they appear, once we factor the positive risks.
Does your nonprofit consider good risks? Are there any good risks on your risk registers?
Check out this great video on “how risks can be good”
Nonprofit Auditor 