Managing all the organisation's risks: register, appetite, compliance and reputation

1From security risks to organisational risks

Organisational risk management (often called ERM, enterprise risk management) extends the logic of security to all the risks that threaten the mission:

• Security: violence, accidents, staff health.
• Fiduciary: fraud, corruption, diversion, misuse of funds.
• Operational: supply disruption, partner failure, loss of access.
• Legal and compliance: sanctions, counter-terrorism, labour law, taxation, data protection.
• Ethical and safeguarding: sexual exploitation and abuse, harassment, breaches of principles.
• Reputational: loss of trust among communities, donors and the public.
• Financial and strategic: dependence on one donor, cash-flow crisis, loss of relevance.

These risks are linked: diversion of aid by an armed group is at once fiduciary, legal (sanctions), operational (suspension), reputational and a security issue (reprisals if the organisation denounces it). That is why an integrated approach is needed.

2The risk register

The risk register lists the main risks, with for each one: description (cause, event, consequence), category, owner, likelihood, impact, inherent score, existing measures, residual score, additional planned measures, deadline.

The register is reviewed every quarter by senior management and every year by the board or its audit and risk committee. The top ten risks receive particular monitoring.

3Risk appetite

Risk appetite is the level of risk the organisation is willing to take to achieve its mission. It is set by the board, by category:

• Security: moderate appetite, high only for life-saving activities (see programme criticality).
• Fiduciary: low appetite for fraud, but acceptance of a residual risk in difficult contexts, provided it is detected and reported.
• Sexual exploitation and abuse: zero tolerance for the behaviour, which does not prevent recognising that the risk exists and must be actively managed.
• Programmatic: higher appetite for innovation and for access to difficult areas.

Risk appetite is not a slogan: it is translated into thresholds (maximum residual score by category), delegations (who can accept what level of risk) and documented decisions. An appetite that is too low prevents work where needs are greatest; an undefined appetite leaves each manager to decide alone.

4Expected loss

For some financial risks, the matrix can be supplemented by the expected loss: annual probability × cost if it occurs. This helps to compare the cost of a measure with the loss it avoids.

Example. Risk of theft of a field office's petty cash: estimated annual probability 20%, average loss USD 15,000 (cash and costs). Expected loss: 0.2 × 15,000 = USD 3,000 a year. Switching to mobile money payments costs USD 1,800 a year and reduces the probability to 5% and the average loss to USD 4,000: expected loss USD 200. Net gain: 3,000 − 200 − 1,800 = USD 1,000 a year, not counting the reduced security risk for the cashier.

Limits: expected loss is not suitable for risks that affect lives or whose impact is catastrophic. Nobody decides to accept a kidnapping because its "expected loss" would be low. For these risks, the reasoning is in terms of acceptable threshold and contingency plans.

5Compliance: sanctions, counter-terrorism, fraud

Compliance obligations are imposed by national laws, sanctions regimes and donor contracts:

• Sanctions and counter-terrorism: a prohibition on making funds or resources available to listed persons or entities. Measures: screening of suppliers, partners and staff according to risk; contractual clauses; vigilance over payments in areas controlled by listed groups; use of existing humanitarian exemptions, documenting how they are applied.
• Anti-fraud and anti-corruption: policy, whistleblowing line, investigations, reporting to donors within deadlines (see finance).
• Screening of end beneficiaries: in general, donors do not require each aid recipient to be checked against the lists, and humanitarian principles are opposed to it; checks cover partners, suppliers and staff.

Dialogue with donors and banks is essential: de-risking by banks, which refuse to deal with organisations working in sanctioned areas, can block entire operations. Documenting one's due diligence helps to keep accounts open.

6Protection from sexual exploitation and abuse

Protection from sexual exploitation and abuse (PSEA) of the people assisted is a fundamental obligation. The six core principles of the Inter-Agency Standing Committee (IASC) notably prohibit any sexual activity with children (under 18) and any exchange of money, employment, goods or services for sexual favours, and require any concern to be reported.

The system:

• code of conduct and training for all staff and partners;
• reference checks at recruitment (inter-agency schemes);
• community-based complaints mechanisms that are accessible, safe and adapted to women and children;
• assistance to victims (medical, psychosocial, legal) according to their choices;
• rapid and independent investigations, sanctions, reporting to donors;
• PSEA clauses in agreements with partners.

A misleading indicator: zero complaints does not mean zero abuse. In most contexts, the absence of complaints rather indicates that the mechanisms are neither known nor considered safe by communities.