Preparing for adverse events

Third Sector magazine from the UK reported recently that only 25% of charities have experienced an adverse event in the past two years yet only 44% have in place plans for dealing with threats to the credibility and viability. http://bit.ly/aWZaT0

Recently while working with a nfp that had weathered a period of bad publicity about internal events I became aware that in this instance, while the organisation had weathered the storm, and while the storm had been predictable, there appeared to have been little in place in the form of prior risk assessment or any form of positive publicity to counter the negative publicity. This is a short sighted practice.

It is my experience the not for profit organisations are good at telling each other how well they do but not very good at telling the whole world about the good the do. We tend to assume the term 'charitable organisation' will protect us from the evils of the world. Once upon a time when charities were entirely volunteer operated organisations there might have been a certain level of forgive and forget. In today's world where charities are managed by professional mangement teams, are responsible for the daily income and lives of corps of employees, compete for funding and for service delivery and market aggressively for donations, they are viewed in much the same way as any profit making organisation might be.

The traditional approach to risk management in a charity has been to (a) keep costs so low that it cannot spend more than it earns and (b) dont engage in activities that stray from the core mission. The traditional risk management activities have been for auditors to audit accounts, the CEO/EO to present financials to the Board or Committee, who then oversee to ensure money is not spend in a 'frivoulous' manner.

There is nothing wrong with that approach, however it is only the beginning of the process of risk management. How would your organisation cope with a major fraud incident, or if the premises burnt down, or if you were taken to court over an employment issue, or if the media exposed some form of dubious practice? The list of possible risk events is almost endless.

True, risk assessment is a bit like life insurance. You dont want to have to have it but you dont want to not have it in the event of your death. How many of you forgo having appropriate insurances in place? Not many, I suspect. We have insurance in place in case some thing goes wrong. It is to late to put insurance in place after an event. Risk assessment is a governance activity. Board members should have in place a process and a timetable for assessing risk and deciding upon appropriate risk management activities.

There are four stages to the risk management process. The first is identifying what potential risks exist and assessing the likelihood of any specific risk occuring and of it having a negative impact. The assessment should cover all areas of an organisation including governance, financial, operational, human resource and service delivery. The second stage is to implement risk management strategies, or in some instances, harm minimisation strategies. The further ahead a potential risk is identified and strategies implemented the less harmful the impact will be. The third stage is to have in place a process for coping with the fallout should a risk event occur. The fourth stage is to evaluate the lessons learned and repeat the risk assessment process.

Health care providers, due to the nature of their environment have in place very specific risk assessment and risk management processes. When your organisation deals daily with keeping people alive then the environment calls for such an approach. Outside of the health sector, where the fall out will most likely not result in death, we have a tendency to take risks for granted. At our peril.

Imagine if a client was to take their life while engaged in an activity at your premises and imagine if the media were to try to make a story of it. Would you have the processes in place to cope with the media attention, would staff know who had responsibility for speaking to the media, would you have in place a set of guidelines for staff using online media sources? How would your organisation cope with a loss of funding, or a service or a competing nfp? Do you have a relationship with the media, can you get your message into newspapers and onto radio or television? Do you have a relationship with a publicist or a media consultant? How well developed are your managers in transitioning people through change or a crisis?

Recently in Christchurch a significant earthquake caused a lot of damage to infrastructure. Another notch up the Richter scale and much of the City would have ceased to exist. Fortunately deaths and injuries were minimal however the disruption to commercial activities has been significant. If some form of natural disaster were to take place in your area, how would protect confidential records, maintain computer systems and gather together people to be able to get back into operation at the earliest moment?

Does your Board choose to plan for the possibility of such events or does your Board and Management simply assume they will be able to make do on the day?