Value creation in the Non Profit sector

There is heightened public awareness about good governance, appropriate behaviour and culture, coupled with the need for transparency and accountability. It is apparent that the highest standards of governance and stewardship are expected from charities and this is right; but this should not lead to a stifling of important charity endeavour.

Today, problems arise quickly, often with devastating impact. Intangible assets such as the organisation’s reputation, brand, relationship with supporters, the quality and commitment of staff, credibility and trust in the organisation’s culture and behaviour are increasingly driving the creation of value. While such assets can be difficult to measure, boards and management can at least make certain that they understand the issues and risks that could compromise them, and that the organisation has in place the processes and controls to manage these risks.

At the same time, there is concern that in the desire to avoid controversy, censure boards may focus on avoiding risks. In fact, successful organisations do not avoid risk; they understand and manage risk, recognising that missing opportunities can be a big risk.

Successful organisations scrutinise all relevant opportunities and recognise the need to take risks. They are not risk-averse, nor do they necessarily have to take greater risks but they have a better understanding of what the risks are and how best to manage them. That means fewer control failures and an increased likelihood of achieving objectives and improved stakeholder value. Supporters and funders may be indifferent about specific risk management models or methods but they will enhance their support for an organisation if it is able to demonstrate it does a better job of managing its risks to create value.

Unprecedented events require a new awareness of the importance of remote events that can have a significant impact; this casts some question marks over the way organisations have traditionally identified risks and adopted procedures to manage them. Are the risks that have been identified the right ones? Are the responses and actions to manage them appropriate for the new times?

There is greater recognition that probability has less value for risks that occur outside the norm. This means that approaches will have to be incorporated to deal with a new climate and new challenges. Risk management needs an overhaul in turbulent times especially when:

• Events are rare or unprecedented;
• Where the rules are unknown or rapidly changing;
• Where causes are driven by external factors beyond the organisation’s control.

In such instances, the concept of vulnerability and risk interaction should assume prominence in both the risk assessment and risk management processes. If an organisation is vulnerable to a risk that is both relevant and has extremely high impact, it should be addressed, regardless of ‘remote’ likelihood.

However, ‘addressed,’ in this context, is not necessarily the same as ‘mitigated.’ A balance needs to be attained and vulnerability should be weighed alongside probability. Nonprofits are invariably resource constrained and risks and rewards will need to be considered.

Furthermore, the board will need to establish its risk appetite and the risk tolerance that it is ready to accept. In doing so, it is important to recognise that sometimes improbable events do occur with devastating effect, while other times probable events fail to materialise.

A focus on high impact risk is important, but one should not forget how a lower significance risk can escalate to very high impact risk because of risk interdependencies. An isolated concentration on value at risk can sometimes result in not spotting ‘risk contagion’ – where one low impact risk leads to another and another so that the cumulative impact is catastrophic.

Many studies have shown that most failures are the result of a series of small, linked events rather than a single large event. If organisations only look at the big risks they can often end up lethally ill-prepared to face the interaction of separate adverse events.

Recognising that probability has less value for risks that occur outside the norm and that the past is not the best indicator of the future and also that small risks can lead to larger ones can create tensions and stifle innovation.

Fear or even doubt of the uncertain can lead to missed opportunities and organisations need to consider the risks they need to take to create value, as well as the risks they need to take to protect assets. Understanding risk appetite and the risk resilience of the organisation in terms of reserves, competencies, and other resources is important. Management should be clear about the risks that can and should be taken and the ones that need to be avoided.

Traditional risk management considering what could go wrong is still relevant and these risks can’t be ignored, but the primary incentive for tackling them is value protection. Other risks are all about upside, for example, introducing new innovations in service delivery or expanding into new areas of income generation. The primary impetus for taking these rewarded risks is value creation.

Although they might have a significant downside, the potential upside is even greater. This distinction between rewarded and unrewarded risks seems simple, but it’s amazing how often organisations fail to recognise the difference. In my experience risk management often falls within the remit of the individuals who are usually naturally cautious and therefore in the past many charities have tended to focus on unrewarded value protection risks.

Value protection risks are important but the risk is that individuals focus the bulk of their attention on the threats and wind up missing out on the opportunities – the focus should shift to value creation. Focusing only on downside can lead to underinvestment in the kinds of opportunities that drive growth and create value for stakeholders. Risk intelligent organisations, understand the distinction between rewarded and unrewarded risks, and they respond accordingly.

There is widespread recognition of the need to ensure that there is an appropriate risk management environment and this includes the establishment of clear policies, codes of practice and clearly defined lines of responsibility and delegation of authority. At the same time the rules should not create unnecessary bureaucracies or stifle initiatives. Moreover polices and rules are not enough and without the right culture and behaviour they will do little more than provide false comfort.

There are many new paradigms and it has become self-evident that plans for future development will have to take into account not only all of these factors, but also a very different environment from that of the past. The coming years will be challenging, exciting ones for charities as they continues to respond to the changing external and internal environment.

Organisations that will flourish will be those that cope with the uncertainties and make good lasting decisions. There is progress but the job is a long way from being finished. The task of setting priorities will remain as difficult as ever, matching the demands to satisfy short-term needs against pressure for the resources required to achieve long term solutions.

This article first appeared in Charity Times in May 2018.