Biggest Risks Facing NFPs

---

For most not-for-profit Boards, the greatest risk is not financial failure.
It is unrecognised exposure created by weak governance, unclear risk ownership, and risk frameworks that exist on paper but not in practice.

Across Australia, regulators are increasingly clear:
Boards are accountable for risk oversight even when management executes.

Below are the seven biggest risks currently facing NFPs and charities, based on real governance failures, regulatory action and Board reviews.

The most common root cause of serious NFP failures.

This includes:

• Unclear delegation between Board and management
• Boards receiving assurance without challenge
• “Rubber-stamp” reporting that hides material risk

Impact:
Loss of regulatory confidence, reputational damage, and personal liability for Directors.

For organisations delivering services to children, young people or vulnerable adults, safeguarding is never a secondary risk.

Common issues:

• Safeguarding treated as a policy rather than a system
• Poor incident escalation and learning
• Risk registers that downplay harm exposure

Impact:
Serious harm, regulatory intervention, funding withdrawal, and irreversible reputational damage.

 Many NFPs have risk appetite statements and registers that are:

• Static
• Overly operational
• Disconnected from strategy and performance

If risk appetite does not guide decisions, it is functionally meaningless.

Impact:
Boards cannot tell whether the organisation is operating within acceptable risk boundaries. 

Compliance obligations evolve faster than many charities realise.

Risk areas include:

• ACNC governance standards
• Funding contract compliance
• State-based safeguarding and reporting requirements

Impact:
Non-compliance is often identified after damage has occurred.

Founder risk, executive concentration risk, and volunteer dependency are frequently underestimated.

When capability lives in people rather than systems, continuity is fragile.

Impact:
Operational disruption, governance instability, and loss of organisational memory.

Culture is a risk driver, not a “soft issue”.

Warning signs include:

• Fear of speaking up
• Normalised workarounds
• Incident fatigue

Impact:
Small issues become systemic failures.

Boards often receive activity reports, not assurance.

Good assurance answers:

• Are controls working?
• Where are we exposed?
• What is outside appetite?

Impact:
Boards believe risks are managed when they are not.

Traditional risk registers:

• Focus on operational issues
• Understate governance and safeguarding exposure
• Fail to show interdependencies

Effective risk management starts with:
✔ Clear risk ownership
✔ Board-approved risk appetite
✔ Meaningful escalation triggers
✔ Independent assurance

High-performing NFPs have:

• A risk appetite that shapes decisions
• Clear Board management accountability
• Safeguarding embedded as a core risk
• Assurance mapped to material risks
• A culture that supports escalation

Risk is not reduced by documentation.
It is reduced by clarity, discipline and courage.

AIRM Consulting specialises in governance led risk management for not-for-profit organisations and charities.

We help Boards and executives:

• Identify their true risk exposure
• Strengthen risk appetite and oversight
• Embed safeguarding and duty of care
• Build assurance that Boards can rely on

Talk to a specialist NFP risk consultant