Risk management is any activity undertaken to identify and control organisational risk. It should be central to the Board’s and Trustees’ strategic management plan.
Assessing risk impact and likelihood is part of an organisation’s daily activities. Managing operational risk is essential for achieving its key objectives and safeguarding the future.
From the Chief Executive Officer and Chief Financial Officer to the Board and Trustees, senior management should set a risk framework that allows the organisation to:
- identify the risks (threats and opportunities)
- make decisions about how to mitigate and control the significant risks
- decide if a contingency plan is appropriate and
- monitor, review and implement actions to support the management of risk
Key Takeaways
- Governance Mandate: Risk management is an ongoing, statutory governance duty, not a bureaucratic checkbox or a once-a-year review exercise
- Core Framework: A resilient strategy requires boards to systematically identify (internal/external), prioritise (via impact and likelihood matrices), and mitigate threats before they disrupt strategic goals
- Risk Ownership: Every identified risk must have a designated, accountable owner. Unowned risks are left unmanaged, exposing the organisation to operational and financial liability
- The Balancing Act: Effective governance does not mean eliminating all risk. Trustees must define the organisation’s risk tolerance to pursue innovation, compliance, and long-term financial health safely
- The Critical Challenge: The single greatest pitfall for most boards is failing to review their active risk register regularly during standard board meetings
Why Is Risk Management Critical for a Board of Trustees?
A key responsibility of Boards and Trustees is to review the risks they face and decide how best to manage them.
The Board or Trustees may have undertaken this as an annual exercise. However, experience suggests organisations must now invest more time in thinking about risks and managing them.
Managing risk is an everyday part of any organisation’s activity, but senior management, Board members, or Trustees need to achieve the organisation’s key objectives. To solve complex issues and meet the organisation’s changing needs, organisations must have an appetite for a certain level of managed risk. Guidance is not intended to eliminate all risks; instead, organisations must manage and monitor risks to ensure they remain within the tolerance accepted by the Board or the Trustees.
What Is Board-Level Risk Management and Why Does It Matter?
Identifying, understanding, and managing risk is crucial for effective governance for organisations of all sizes and complexity.
By managing risk effectively, the Board or the Trustees ensure:
- risks are known and monitored, enabling informed decisions and timely actions
- the organisation engages with opportunities and develops them with the confidence that risks will be managed
- strategic planning is improved
- the organisation’s key goals are achieved
The types of risks an organisation faces depend largely on the size, nature, and complexity of the activities undertaken, although there are inevitably common themes. As a general rule, the more extensive and more complex or diverse an organisation’s activities, the more difficult it will be for the Board or the Trustees to identify the risks and engage the correct systems to manage the risks, meaning the effectiveness of the risk management process will always need to be tailored to fit the circumstances of the organisation.
How Do Board Trustees Identify Internal and External Organisational Risks?
Identifying risk should be integral to the strategic direction, business planning and budget setting. The organisation’s Board members or Trustees should ask:
- What external and internal threats and opportunities might prevent achieving key goals?
- What would be the Impact?
- Are there any steps that can be taken to control and mitigate the threats and opportunities?
Many organisations find it helpful to think about the risks in the areas of:
- Financial risk – the loss or gain of revenue, such as grants for charities or contracts for businesses
- Operational risk – loss of key personnel, loss of office or activities due to fire, lack of supplies
- Corporate Governance – the inability to recruit sufficiently competent and suitably skilled leadership roles such as Board member, individual Trustee, or senior executive with extensive experience
- External risk – examples may fall into the six areas of PESTLE – Political, Economic, Social, Technological, Legal and Environmental factors
- Reputational risk – arising from data security losses, health and safety issues, legal proceedings, etc.
- Compliance risk – arising from non-compliance with legislation, including GDPR, employment and other laws
How Should a Board Prioritise and Rate Organisational Risks?
Having identified the strategic risk areas, Board members and Trustees must prioritise individual risks and the actions needed for effective risk management.
Various models are used, although a traditional “scoring” of Likelihood and Impact remains the most common, particularly on a Risk Matrix. The Impact is considered in the context of both the financial impact and the impact on the organisation’s reputation. The result indicates which risks require the most focus and which risk management approach to adopt.
Often, these Inherent Risks are colour-coded red (High), amber (Medium) and green (Low). The traditional approach is the Red, Amber, Green (RAG) rating. The problem is that Boards and Trustees may see red risks as bad and green risks as acceptable. Not understanding the organisational risk appetite and risk culture can lead to the wrong response.
What Are the Best Practices for Managing and Mitigating Board Risks?
After identifying, assessing, and prioritising emerging risks, the next step is to decide whether to accept the risk, take action to control or mitigate it, transfer it to a third party, for example, through insurance, or stop certain activities to avoid it. Once the actions are identified, a score can be attributed to the Residual Risk.
A Risk Owner must be assigned and held accountable for maintaining oversight once actions are identified. This step is often overlooked. An adverse movement in the risk (due to changes in the Impact or Likelihood) can be missed, resulting in late or no action. Without a Risk Owner, for example, a Trustee, Board member, or senior management figure in the organisation, it is challenging to monitor the risk actively.
What Is the Ultimate Takeaway for Effective Trustee Risk Governance?
Risk management must be a continual process to remain effective with the pace of change in the 21st century.
Day-to-day activities will result in new risks, and existing risks will become more or less significant – often over relatively short periods.
Therefore, for an effective business strategy, the Board or Trustees must regularly consider, review, monitor, report, and communicate risks to ensure they can respond effectively and remain focused on delivering strategic objectives within a well-established risk management framework.
Frequently Asked Questions
What is the main role of a board trustee in risk management?
The board trustee’s primary role is to provide strategic oversight and governance, ensuring the organisation has a robust framework to identify, assess, and mitigate threats. It is a continuous statutory duty to safeguard the organisation’s assets, reputation, and long-term viability, rather than a passive annual review.
How should a board identify potential organisational risks?
Boards should identify risks by systematically analysing both internal and external factors. This includes reviewing operational vulnerabilities, financial health, compliance demands, and external threats (such as economic shifts or cybersecurity risks). Engaging key stakeholders and utilising a structured risk register are best practices for comprehensive identification.
What is the most effective way for trustees to prioritise risks?
Trustees should prioritise risks by evaluating two primary metrics: Likelihood (the probability of the event occurring) and Impact (the severity of the consequences if it does occur). Mapping these risks onto a matrix allows the board to focus its immediate attention and resources on high-likelihood, high-impact threats.
Who owns the risk within an organisation?
While the board maintains ultimate accountability for risk governance, individual risks must be assigned to specific Risk Owners, typically executive leaders, senior managers, or specific committee chairs. A risk owner is responsible for monitoring the threat daily and executing agreed-upon mitigation strategies.
How often should a board review its risk register?
A risk register should be a standing agenda item at every regular board meeting, not a once-a-year checkbox exercise. While the entire framework can undergo a deep-dive review annually, active and high-priority risks must be continuously monitored to adapt to changing organisational environments.
