Risk Register Template for Charities

SOP: Risk Register Management for Charitable Organizations

Document ID: TR-RM-001
Effective Date: 2023-10-27
Version: 1.0
Review Cadence: Annual / Post-Incident

1. Executive Summary & Purpose

The purpose of this SOP is to standardize the identification, assessment, mitigation, and monitoring of risks within charitable organizations. Given the unique operational constraints of the non-profit sector (e.g., funding volatility, reputational sensitivity, and regulatory compliance), this document provides a formal framework to ensure fiduciary responsibility and long-term organizational viability.

2. Scope & Prerequisites

• Scope: Applies to all strategic, operational, financial, and compliance-related risks.
• Tools Required: Centralized Risk Register (Excel, Airtable, or GRC software).
• Prerequisites: Access to current strategic plan, audit reports, and organizational budget.
• PPE: N/A (Digital environment).

3. Roles & Responsibilities (RACI Matrix)

4. Step-by-Step Procedure

Phase I: Identification & Categorization

• Conduct stakeholder interviews to solicit internal and external risk inputs.
• Classify risks into four domains: Strategic, Operational, Financial, Compliance.
• Document the "Risk Event" using the format: "Because of [Cause], [Event] may occur, resulting in [Impact]."

Phase II: Assessment (The Scoring Matrix)

• Assign a Likelihood score (1-5, where 1 is Rare and 5 is Almost Certain).
• Assign an Impact score (1-5, where 1 is Negligible and 5 is Catastrophic).
• Calculate Risk Rating: (Likelihood × Impact).
• Categorize result: 1-5 (Low), 6-12 (Medium), 15-25 (High/Critical).

Phase III: Mitigation Strategy

• Define control mechanisms for each high-rated risk (Avoid, Transfer, Mitigate, or Accept).
• Assign an "Owner" to each mitigation task.
• Set a "Target Resolution Date" for implementation.

Phase IV: Review & Monitoring

• Update the register monthly for operational items and quarterly for strategic risks.
• Escalate any risk reaching a "Critical" status to the Board immediately.

5. Quality Assurance & Pro-Tips

• Avoid the "Static Trap": A risk register is a living document. If the register hasn't been updated in 90 days, it is functionally obsolete.
• Focus on Inherent vs. Residual Risk: Always track both. Inherent risk is the raw threat; residual risk is what remains after your controls are in place.
• The "So What?" Test: If a risk cannot be quantified by its impact on the mission or the bottom line, it is likely a distraction. Remove it.
• Metric Threshold: Any risk rated >12 requires a formal mitigation plan documented in the board minutes.

6. Frequently Asked Questions

Q: Should we include "Minor" risks in the register?
A: No. Focus resources on "High" and "Critical" risks. Minor risks should be managed via standard operating procedures, not elevated to the risk register.

Q: How do we handle reputational risk?
A: Reputational risk is subjective. Quantify it by proxy: estimate potential loss in donations (financial) or staff turnover (operational) resulting from a specific public-facing event.

Q: Can we outsource risk?
A: You can transfer the financial burden of risk (e.g., insurance), but you cannot outsource accountability. The Board remains ultimately responsible for the charity’s exposure.

Authorized by: Julian Vance, Chief Architect, Template Registry