I remember August 23rd vividly: I was walking down the hallway when suddenly I felt the entire building shudder. The tremble shook monitors on our desks and wobbled pictures on the walls. The quake took us by surprise on the east coast, measuring 5.8 on the Richter scale. Just four days later, Hurricane Irene slammed into the region with lashing rains and wind gusts reaching 60 miles per hour. We were fortunate: none of our staff were injured and our building was not damaged. Others weren’t as lucky. Mother Nature’s one-two punch toppled trees, flooded homes, and left many people without power for days.

Severe weather is pummeling other regions in the country as well. Extended drought in Texas has left the land cracked and barren. Acres of crops have withered and millions of animals have perished. In contrast, tropical storms and heavy rains have caused major flooding from Louisiana to New York. Many of you have, no doubt, experienced extreme weather too.

In the wake of a natural disaster, many of us focus on whether we should have been better prepared. Did we respond properly? Do we have adequate insurance? The staff and I asked questions like these after the earthquake and hurricane. Fortunately, we have been working for months on a much larger risk assessment that sweeps beyond natural disasters into every facet of our operations. We have been at it for a year with the pro bono help of Deloitte.

The structured process and focused effort has allowed us to think about risks related to information retention and destruction, finances, donor relations, technological assets, possible theft, reputational risk, and human resources to name a few. The Deloitte team encouraged us to think about all aspects of our work and rate the areas we considered to be high risk, which vary for every organization. They taught us that all organizations operate with risk -- effective ones have strategies to manage or mitigate them.

The earthquake presented an immediate and (what felt like) urgent risk. Yet in the past 40 years, there have only been a dozen or so earthquakes of magnitude 2.0 in our region. Does it make sense for us to plow substantial resources into safeguarding the IS building from another quake if some other risk is more probable? And in the bigger picture, should we be thinking about broader risks that affect us all, such as climate change?

The challenge for each of us is to identify which areas present the greatest risks for our organizations and implement mitigation strategies to contain them. Doing so in a systematic way involves three broad steps:

• Identifying all risks in a comprehensive analysis that affect your organization;
• Prioritizing them based on the potential for loss or diminished opportunity for gain; and
• Developing action plans, decision points, and timelines to mitigate risks.

There is one risk that every member of the charitable community may have no choice but to consider: Risk by association. If a single organization in our community has an ethics violation or breaks the law, we have learned that the public may presume they are seeing the tip of the iceberg and others are not practicing ethical conduct or good governance. They just have not been exposed. The result:

• People might hesitate to donate;
• Funders could shy away from investing; and
• Prospective employees could take their talents to another sector.

Some of you may recall a number of illegal and wrongful practices uncovered around 2002, which triggered Congressional hearings and intense scrutiny of the entire sector. In 2004, bipartisan leadership in the Senate Finance Committee invited IS to offer recommendations to prevent such improprieties. In October, Independent Sector formed the Panel on the Nonprofit Sector to address these concerns. We consulted broadly with thousands in the sector and came together as a community to offer more than100 recommendations for improving government oversight -- many enacted into law through the Pension Protection Act of 2006. Later the Panel released the Principles for Good Governance and Ethical Practice: A Guide for Charities and Foundations, 33 recommendations that encouraged boards and staff to meet high standards of ethical conduct, accountability, and transparency. At the time, lawmakers were heartened by our sector’s own efforts to set rigorous standards for governance and ethical practice. Since then, the nonprofit community has requested 153,500 copies of the Principles and 15,000 copies of the online Workbook -- an important indication of the keen interest organizations have in conducting their work in a responsible way.

Of course risk management cannot prevent people who are careless about their practices or even willing to break the law for their own gain, but it can be an effective tool for board members and CEOs to think through the rationale for the policies and practices they embrace. It also allows us to think through – with cool, clear heads before a crisis hits – how we want to manage risky situations. 

In sum, risk is inescapable and, some might argue, a necessary condition for progress. In the final equation, the benefits managing risk outweigh the costs – especially if doing so prevents disaster from befalling your organization. An in-depth assessment enables organizations to better cope with whatever challenges lie ahead and encourages people to pursue the highest standards of ethical conduct and good governance. Whether you’ve faced earthquakes, hurricanes, or any other kind of risk, we welcome your stories about how you handled it and we look forward to learning from your insights.