Why One-Size-Fits-All Risk Management Doesn't Work for Not-for-Profits

---

There is no shortage of risk management frameworks, templates, registers, and policies available to not-for-profit organisations. 

However, there is a fundamental problem with adopting a “one size fits all” approach to risk management: 

Every organisation is different. 

Each organisation has its own purpose, strategy, objectives, operating environment, stakeholders, culture, resources, and risk profile. What represents a critical risk for one organisation may be relatively insignificant to another. 

Therefore, your risk management framework should be designed around your organisation's unique context. 

Start With Your Strategy 

Effective risk management should begin with a simple question: 

What are we trying to achieve, and what could prevent us from achieving it? 

Your strategic objectives should drive the identification of key risks and determine where your risk management focus needs to be. There isn’t a universal list of risks that applies equally to every organisation. 

Focus on the Risks That Matter 

A common weakness in risk management is the creation of an excessively large risk register. Some organisations maintain dozens or even hundreds of risks, each with ratings, controls, and treatment actions. While the register may appear comprehensive, it can obscure what really matters to the Board and executives. 

The important questions are: 

Which risks could materially affect our strategic objectives? 

Which risks require Board attention? 

Where are our greatest control weaknesses? 

What actions need to be taken? 

Who is accountable? 

Are we comfortable with the level of risk we are taking? 

The objective is not to identify every conceivable risk but to manage the unique risk strategies that matter most. 

Identify Your Core High Risks 

Every organisation should understand its core high risks—those that could significantly impact its ability to achieve its purpose and objectives. 

There may be similar risks across not-for-profit organisations, but your risks should be determined by your organisation's current circumstances, not copied from another. 

Risk Management Must Lead to Action 

Identifying a risk is only the beginning. For each significant risk, management and the Board should pinpoint: 

What could happen? 

Why could it happen? 

What controls are in place? 

Are those controls effective? 

Where are the gaps? 

What action is required? 

Who is accountable? 

This shifts risk management from merely maintaining a document to actively managing risk through unique strategies. The focus should be on practical solutions that reduce exposure, strengthen controls, and improve the organisation's ability to achieve its objectives. 

Risk Appetite Matters 

Not every risk needs to be eliminated. Organisations must understand the level of risk they are prepared to accept in pursuit of their objectives. An organisation may have a very low appetite for safeguarding failures or regulatory breaches while accepting a higher level of risk associated with innovation or strategic investment. 

The objective is not zero risk. 

Aiming for zero risk is impossible; if that is your goal, you might as well stop your business. Instead, your objective should be informed risk-taking. 

From Compliance to Confidence 

Effective risk management should ultimately help Boards and executives make better decisions. When considering a major investment, new service, transformation program, or strategic initiative, the Board needs to understand the risks involved and determine whether those risks are acceptable. 

A good risk management framework should therefore be: relevant, proportionate, practical, understood, and embedded. 

Your organisation is unique. 

Your risks are unique. 

Your risk management approach should be unique too. 

At AIRM Consulting, we help Boards and executives identify their core risks, understand their risk exposure, and develop unique risk strategies aligned with their objectives. 

Effective risk management isn't about managing every risk—it's about managing the risks that matter.