Risk Register Example for Charity

Standard Operating Procedure: Institutional Risk Register Management for Charitable Organizations

1. Document Control Block

• Document ID: SOP-TR-GOV-042
• Effective Date: October 24, 2023
• Version: 2.1.0
• Review Cadence: Annual / Post-Critical Incident
• Owner: Julian Vance, Chief Architect, Template Registry

---

2. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the institutional framework for identifying, evaluating, mitigating, and monitoring operational, financial, reputational, and compliance risks within a charitable organization. The purpose of this document is to establish a rigorous, repeatable methodology for maintaining a dynamic Risk Register, ensuring fiduciary accountability, protecting beneficiary welfare, and preserving donor trust in alignment with regulatory standards (e.g., Charity Commission, IRS 501(c)(3) guidelines).

---

3. Scope & Prerequisites

• Scope: Applies to all operational units, program delivery teams, fiduciary boards, and third-party contractors associated with the charity.
• Required Tools & Software:
  • Enterprise Risk Management (ERM) software or standardized institutional spreadsheet template (Template ID: TR-RSK-99).
  • Version-controlled document repository (e.g., SharePoint, Confluence).
  • Secure communication channel for high-severity risk escalations.
• Prerequisites: Completion of annual organizational risk orientation; access credentials to the central governance repository.

---

4. Roles & Responsibilities (RACI Matrix)

(Legend: R = Responsible, A = Accountable, C = Consulted, I = Informed)

---

5. Step-by-Step Procedure

Phase 1: Risk Identification & Categorization

• 1.1 Convene quarterly risk identification workshops with department leads to surface emerging vulnerabilities across five core domains: Governance, Operational, Financial, External/Reputational, and Compliance.
• 1.2 Document each identified risk using the standard format: Condition (the current state) and Consequence (the potential impact if triggered).
• 1.3 Assign a unique alphanumeric identifier to the risk entry (e.g., FIN-001 for Financial Risk 01).

Phase 2: Risk Assessment & Scoring

• 2.1 Evaluate the Likelihood ($L$) of the risk occurring on a standardized 1-to-5 scale (1 = Rare, 5 = Almost Certain).
• 2.2 Evaluate the Impact ($I$) of the risk on organizational objectives, finances, and mission delivery on a 1-to-5 scale (1 = Negligible, 5 = Catastrophic).
• 2.3 Calculate the Inherent Risk Score using the formula: $\text{Inherent Risk Score} = L \times I$.
• 2.4 Map the resulting score to the institutional heat map (Low: 1-6, Medium: 8-12, High: 15-25).

Phase 3: Mitigation Strategy & Action Planning

• 3.1 Determine the risk treatment strategy: Mitigate (reduce likelihood/impact), Transfer (insure/contract out), Avoid (cease activity), or Accept (monitor low-impact risks).
• 3.2 Define explicit, measurable mitigation actions and countermeasures for all Medium and High-priority risks.
• 3.3 Assign a single-point-of-contact "Risk Owner" accountable for executing the mitigation plan.
• 3.4 Establish a target completion date for all mitigation controls.

Phase 4: Implementation, Monitoring, and Review

• 4.1 Update the centralized Risk Register with mitigation details and calculate the Residual Risk Score (post-mitigation $L \times I$).
• 4.2 Review the complete Risk Register during monthly executive leadership meetings.
• 4.3 Escalate any risk whose residual score exceeds institutional risk tolerance directly to the Board of Trustees within 48 hours.

---

6. Quality Assurance & Pro-Tips

Best Practices

• Dynamic Living Document: Treat the risk register as an active operational dashboard, not a static compliance artifact. Update status fields continuously rather than waiting for quarterly audits.
• Root-Cause Focus: Avoid documenting symptoms. Ensure risk statements describe the underlying structural vulnerability.
• Clear Ownership: Never assign a department or committee as a Risk Owner; always assign a specific named individual to ensure personal accountability.

Common Pitfalls

• Risk Stagnation: Failing to update Likelihood and Impact scores after mitigation controls are deployed, leading to inflated risk profiles.
• Ignoring Positive Risks (Opportunities): Focusing exclusively on threats while failing to capture strategic opportunities that carry managed risk profiles.

Metric Thresholds

• High-Risk SLA: All High-priority risks (Score $\ge 15$) must have an active mitigation plan deployed within 14 calendar days of identification.
• Review Compliance: 100% of register entries must undergo review and validation by their designated Risk Owner every 90 days.

---

7. Frequently Asked Questions (FAQ)

Q1: How do we distinguish between an operational issue and a strategic risk?
A: An operational issue is an immediate, active disruption (e.g., payroll system failure today). A strategic or operational risk is a potential future event with uncertain timing that could impact objectives if it materializes (e.g., potential donor churn due to macroeconomic shifts). The risk register tracks the latter, though resolved operational issues should feed into risk identification sessions as lessons learned.

Q2: What is the required protocol if a "Low" risk suddenly escalates to "High"?
A: The Risk Owner must immediately notify the Chief Risk Officer/Chief Architect, update the scoring metrics in the register within 24 hours, and draft an interim mitigation holding action while a permanent control strategy is engineered.

Q3: How long must historical risk register versions be retained?
A: In alignment with institutional governance and audit requirements, all historical iterations of the Risk Register must be archived in read-only format for a minimum of seven (7) years.