Does Your NFP Really Need a Full Time Risk Officer?

---

For CEOs and Boards of charities and not-for-profit organisations, effective risk management is no longer something that can sit on the sidelines.

Safeguarding, cyber security, financial sustainability, regulatory obligations, governance, reputation, workforce risks and operational resilience all require active attention.

But there is an important question that many NFPs should consider:

Does managing these risks necessarily require a full time Risk Officer?

For some organisations, a dedicated internal risk role may be entirely appropriate.

For many smaller and medium sized NFPs, however, the organisation may not need another permanent position. 

What it may need is something different:

Ongoing access to experienced risk and governance expertise.

It's not about whether risk is important

The question isn't whether your organisation needs risk capability.

It does.

The question is what level of capability your organisation actually needs, and how best to access it.

A full time risk officer can provide valuable internal capability. But a permanent position also brings a significant ongoing commitment including salary, superannuation, leave, recruitment, professional development, technology, employment overheads and the management time associated with another permanent role.

For an organisation that does not require a full time workload, there can be a mismatch between the capability it needs and the employment model it uses to obtain it.

A different approach is to establish an ongoing relationship with an experienced external risk and governance adviser.

What does ongoing external support look like?

This isn't simply engaging a consultant to conduct an annual risk review, update the risk register and produce a report.

The real value comes from continuity.

An external risk adviser can become familiar with the organisation, its strategy, its operating environment and its critical risks and then provide ongoing support throughout the year.

That might include:

• Regular review and oversight of the organisation's critical risks
• Practical advice to the CEO and management team
• Independent challenge and assurance for the Board
• Risk reporting that focuses on what the Board actually needs to know
• Support with safeguarding and emerging risks
• Development and review of risk frameworks and policies
• Assistance with risk assessments and major projects
• Support when a significant incident or emerging issue arises
• Preparation for Board and committee discussions
• Independent advice when management or the Board needs an external perspective

The level of support can be structured around the organisation's actual requirements rather than around the hours of a permanent position.

The value is more than cost

Cost is obviously an important consideration for charities and NFPs.

Every dollar committed to an internal corporate function is a dollar that cannot be directed elsewhere.

But the case for external support should not simply be:

“A consultant costs less than an employee.”

The more important consideration is access to capability.

An NFP may be able to access a senior and experienced risk professional without needing to employ that person full time.

It can also provide access to broader experience gained across different organisations, sectors and risk environments.

That can be particularly valuable when an organisation encounters an issue outside its usual experience.

Independence matters too

There is another consideration for Boards.

Risk management is ultimately a management responsibility, but Boards need sufficient independence and challenge to provide effective oversight.

An external adviser can provide an additional perspective one that is not part of the organisation's management hierarchy.

That doesn't mean an external adviser replaces management.

The Board governs.
The CEO leads.
Management manages.

The risk adviser provides expertise, challenge and support.

Clear accountability remains essential.

The benefit is having someone with the experience and independence to ask the difficult questions, identify emerging issues and help ensure that critical risks are receiving appropriate attention.

Risk should be part of the organisational rhythm

One of the weaknesses of many risk frameworks is that risk becomes an annual exercise.

The risk register is reviewed.

The Board receives a report.

Policies are updated.

The process is completed.

Then everyone moves on.

But risk doesn't operate on an annual cycle.

New risks emerge. Existing risks change. Controls become less effective. The external environment changes. Strategic decisions create new exposures.

Effective risk management therefore needs to be part of the organisation's ongoing management and governance rhythm.

Regular external support can help maintain that focus without requiring a full time internal risk function.

When might a full time Risk Officer make sense?

A permanent internal role can absolutely be appropriate.

For a large or complex NFP, an internal risk team may be necessary because of the scale of operations, regulatory requirements, geographic footprint, number of employees, complexity of programs or volume of risk activity.

The point isn't that external support is always better.

The point is that the risk function should be designed around the organisation's needs.

For some organisations, that means a dedicated internal position.

For others, it may mean a combination of internal ownership and external specialist support.

And for smaller and medium-sized organisations, ongoing external support may provide an effective way to access experienced capability without creating another permanent executive position.

A question for NFP Boards and CEOs

Instead of starting with:

“Do we need a Risk Officer?”

It may be worth starting with:

“What risk capability does our organisation actually need?”

Then consider:

• What are our most critical risks?
• How complex is our risk environment?
• What level of independent challenge does our Board require?
• How often do we need specialist risk expertise?
• Do we need a full time role, or ongoing access to expertise?
• Who supports the CEO when a significant risk or incident emerges?
• Who provides independent challenge to management?
• Is our current risk reporting helping the Board make better decisions?
• Are we managing risk continuously, or mainly reviewing it periodically?

These questions can help an organisation determine the right model for its circumstances.

A different way to access risk capability

For many charities and NFPs, the answer may not be another permanent position.

It may be an experienced risk and governance adviser who works alongside the organisation on an ongoing basis.

Someone who understands the organisation.

Someone the CEO can call when a difficult issue arises.

Someone who can provide independent challenge to management.

Someone who can help the Board understand whether the organisation's most important risks are being appropriately identified, managed and monitored.

And someone who can scale their involvement according to what the organisation actually needs.

The objective isn't to outsource responsibility for risk.

It is to ensure that the organisation has the right level of risk capability, expertise and independent support to meet its responsibilities.

For NFPs, that distinction can make a significant difference.

AIRM Enterprises

AIRM Enterprises provides practical risk and governance support to charities and not for profits.

The focus is on helping Boards and CEOs identify, understand and govern their critical risks with practical support across:

Board Risk | Governance | Safeguarding | Assurance

If your organisation is considering how best to structure its risk capability, the starting point doesn't have to be a decision about whether to employ a Risk Officer.

It can start with a conversation about what your organisation actually needs.