In 2018, 56% of non-profit organisations (NPOs) surveyed by Trialogue reported having risk management plans in place, while 53% of companies said that it was a prerequisite for NPOs to access funding. These are relatively low rates, despite the vast number of risks that can hinder effective delivery of social impact in the development sector – including logistical challenges, fraud, reputational risk, corruption, arson, war, political obstacles, procurement issues, natural disasters and more. Nozuko Nkumanda of Social Impact Partners shares how social impact organisations and donors can navigate these risks.
The catastrophic results of not having a risk management plan in place were demonstrated in 2015 when a fire broke out at the central medical warehouse of an NPO operating in an African country, destroying tens of millions of dollars’ worth of supplies that were due to be distributed to medical facilities throughout the country. The supplies were paid for, in part, from bilateral and international funding. Not only did the fire delay the deployment of these crucial supplies but, because the facility and stock were not insured, the delivery of vital health services to vulnerable communities was drastically compromised on a national scale.
Risks that cannot be mitigated may be transferred, shifting the financial burden of a risk that has been realised to another party. Transfer of risk, often through insurance, typically comes at a recurring fee. While the concept of risk management does not change between corporate and development contexts, there are considerable differences in the application of principles. In a corporate environment, in which risk management is an inherent part of day-to-day activities, practices and products have been developed to enable and support risk management processes. These processes are, however, less formalised in the development sector.
The application of risk management practices can also vary quite broadly within the development sector – from developing a risk management plan for an organisation, or specific programmes or projects that the organisation is running, to a plan applicable to the broad social challenges that the organisation is working to address (e.g. climate risk).
Risk management programmes designed for development organisations support and enable a high degree of accountability but, more importantly, protect the ability of such organisations to secure future investments, and allow them to measure the social impact of their operations. As a result, the practice is important for a broad range of social impact organisations; from non-profit to social impact organisations.
The state of risk management in local and global development contexts
Social Impact Partners (SIP) is a partnership between Germany- based Munich Re, one of the largest reinsurance companies in the world, and Hollard, South Africa’s largest privately owned insurance group SIP has found little evidence of understanding or application of risk management within the development sector in South Africa. While some larger entities have secured building and car insurance for their assets, that is often the extent of their risk management. There appears to be little or no consideration extended to the rest of the value chain.
The recent trend among larger NPOs, to appoint risk officers and divisions tasked with implementing internal audit- type functions, is however encouraging. Local organisations affiliated with global bodies have also started to leverage the risk management frameworks and topics that have been developed at a head office level.
The international development sector, while slightly more advanced, is still in a learning phase. As donors are becoming more aware of the need to manage risk in development, large organisations are reconsidering how they view and manage risk, to ensure that they continue to attract funding.
Guidelines for NPOs to implement risk management
Since an organisation cannot prepare for what it does not anticipate, NPOs that want to implement risk management strategies should start by understanding all the risks involved in their work, as well as the financial consequences thereof. Common risks to NPOs include safety, security, fiduciary (e.g. fraud or theft) and reputational issues (e.g. staff behaving inappropriately or the organisation receiving negative media exposure).
NPOs could start the process by factoring into their project planning phase the time and resources required to understand their risks. From there, NPOs could form think tanks or use rapid problem-solving methods to workshop options to mitigate the identified risks.
Once in place, risk management plans should be reviewed regularly, depending on the size and complexity of the organisation. If a risk management plan includes risk transfer through insurance, the related policies – which are often annually renewable – could guide the regularity of the review.
Donors want to see their implementing partners succeed and increasingly want to be informed about their risk management plans. Prevention is better than cure and demonstrating proactivity when it comes to risk can strengthen an NPO’s credibility.
CASE STUDY: Risk management planning for an implementing partner focused on distribution of aid goods to vulnerable communities
The value chain of the organisation and its operations needed to be clearly understood.
The value chain was then narrowed down to identify the most immediate risks to the organisation, which included:
The location: The warehouse was in a non-industrial area in the middle of an open field that was prone to natural fires.
- Temperature control: Supplies, including food, medicine and building material, can be temperature sensitive. Since supplies were not stored according to their temperature requirements, they were deemed unusable.
- Fire hazards: Exposed wiring around cardboard boxes, as well as a lack of fire extinguishers, made the warehouse vulnerable to fire.
- Incorrect storage: Supplies were stacked too high – making it hazardous to reach – and too tightly – making some supplies difficult to find when needed.
- No disposal process: Due to inadequate storage, some supplies expired before they could be distributed. Once expired, there was no clear disposal process in place. This meant that expired supplies were taking up paid-for storage space and could incur an insurance premium, even though they were no longer assets.
If this were a commercial operation, the warehouse would not be allowed to operate in this manner. Guidelines were needed on location and building structure requirements, occupational health and safety standards, and an effective supply chain management process; all underpinned by a commercial insurance policy.
In this case the NPO may have considered itself as an aid organisation only, as opposed to acknowledging the needs of its core operating model as a warehousing and distribution organisation. Total losses could be calculated monetarily, as well as in social impact terms, since fewer people were served due to operational inefficiencies.
Once the organisation had reviewed its value chain and conducted a detailed risk assessment, it needed to interrogate how it could do things differently. The organisation also needed to be clear on the extent to which it would be able to absorb the potential fallout from the risks, if they occurred, and needed to engage the financial services sector to find the most appropriate vehicle for risk transfer.
