Charitable organizations have a responsibility to use their resources as effectively as possible and comply with complex regulations which is why effective management of governance, risk, and compliance is key. In this blog, we explore some of the key risk and compliance challenges facing the NGO and not-for-profit sector and explain how digitizing and streamlining processes can help them remain compliant, build trust with donors and investors, and implement worthwhile initiatives that help them to deliver on their key objectives.
With 2023 forecasted to be a year of economic uncertainty amidst the threat of a looming recession, charity and non-profit organizations are experiencing a period of unrelenting change driven by factors such as the growing demand for demonstrable impact of their activities, visibility into their spend and ethical standpoint, and calls for proof of compliance within an increasingly complex regulatory environment.
From humanitarian aid and international development, to healthcare, children, and youth membership groups, and charities supporting a range of disabilities, charitable organizations regardless of size and profile must contend with onerous challenges in inflation, rising costs, cyber threats, donor hesitancy, and reductions in government funding.
Given the current global events plus an increasingly stringent regulatory and operating landscape for the non-profit sector, charities now more than ever need to focus on implementing robust governance, risk, and compliance practices to provide visibility into their operations and built trust.
Many charities and NGOs are relying on spreadsheets and manual processes or outdated legacy systems to manage risk and compliance. Manual risk and compliance processes result in copious time spent on admin and reporting, preventing organizations from getting a consolidated view of risk and hampering effective decision-making and risk-mitigation.
Here we explore some of the key risk and compliance concerns for NGO’s and not-for-profit organizations and share some of the ways the right GRC software can help organizations in this sector cut back on the red tape to get the oversight they need.
Robust Risk Management
Risk is an everyday part of charitable activity, and managing risk effectively is key if charity trustees are to achieve their key objectives and safeguard their charity’s hard-earned funds and assets.
The structure of charitable organizations and their activities, funding bases, and reserves, open these organizations up to differing areas of risk and levels of exposure. Due to the nature of their work, they must consider risks relating to lack of funding, unethical management of funds, bribery and corruption, and conflicts of interest. There are also operational risks to the large-scale humanitarian projects and charitable events organized by these associations that must be carefully managed to ensure the most vulnerable are not impacted. These organizations must also consider the risk of non-compliance with various laws, regulations, and policies, and ESG risks relating to environmental impact and their ethical stance.
The risks that a charity faces depend on the nature, size, and complexity of the activities it embarks on and its finances. The charitable sector is by its nature diverse and faces differing exposures to risk arising from their various activities and projects and each organization will have different capacities to tolerate or absorb risk. For example, a non-profit with sound reserves could embark on a new project with a higher risk profile than a charity having to contend with financial difficulties. As a rule of thumb, the more complex, diverse, or larger charity activities are, the more risks they will face, making regular risk assessments and on-going monitoring a high priority.
A smart charitable organization will regularly review and assess the risks it faces across all areas. This is why the implementation of an effective risk management program is crucial to ensure that a charity is fit for purpose. They must maintain an up-to-date risk register to categorize and rate risk and monitor it on an ongoing basis. They must perform regular risk assessments, checks, questionnaires, and surveys to ensure risk is not reaching an intolerable level. Of course, like all organizations they will need to absorb a certain degree of risk to remain operational and achieve their strategic objectives, therefore mapping risk to clearly defined parameters and aligning it with strategic goals will be beneficial to any risk management program. Risks can be high when working in war torn countries and sufficient controls must be put in place to protect the staff and volunteers involved.
GRC software can help not-for-profit organizations implement best-practice risk management processes to get a consolidated view of risk. These tools enable organizations to:
- Set up an online risk register, to identify, track and monitor risk.
- Perform online risk assessments, questionnaires, and surveys with all data feeding directly into the tool.
- Define KRIs and set controls to detect potential risk indicators in transactional and operational data that feed into the tool via API integrations with other data sets and systems.
- Use automated workflows and alerts to send notifications when risk reaches an intolerable level.
- View built-in dashboards and reports to get complete oversight into your risk profile, allowing budget and resources to be spent in the most critical areas to reduce risk.
Some GRC software platforms enable non-profit organizations to link risk management processes to their strategic objectives. This essential mapping enables them to take a certain degree of risk in pursuit of their strategic goals and objectives, whilst mitigating critical risks that could have a detrimental impact on their strategy.
By having clear visibility of their visions, goals, and objectives and understanding how it relates to risk, NGO’s can align their planning and reporting frameworks, achieve real-time savings, maximize buy-in for the risk management process, support trustees in making data backed decisions, and support leaders to deliver on the strategy.
Cyber and IT Risk
Charities hold a huge amount of personal data on beneficiaries, donors, and employees and volunteers. Each of these groups has its own set of privacy concerns which must be addressed with stringent data handling procedures and security measures.
Charities and NGOs must ensure compliance with data privacy policies and regulations like GDPR, NIST, and PCI DSS. Non-compliance may result in reputational damage, and regulatory scrutiny.
As technology becomes increasingly pervasive in charity operating models, the need to focus on the cybersecurity of IT systems and infrastructure which are relied upon to safeguard information and to maintain continuity is growing. The need for ongoing monitoring of IT risk, threats, and vulnerabilities is critical, as is the need to ensure that staff and relevant third parties adhere to key IT policies.
An integrated approach using GRC software can simplify the IT risk and compliance process enabling organizations to easily monitor IT risk, perform data checks and control tests, and quickly identify and address any gaps in data processing activities. Adopting purpose-driven software establishes a central structure of the overall IT and cyber hierarchy simplifying monitoring and providing a framework for various IT related risk management and compliance activities.
Compliance
Compliance is a key concern for charitable organizations. Not only do they have to comply with a whole host of regulations to keep their charitable status, but they must have robust policies in place to address key issues around bribery and corruption, money laundering, and conflicts of interest, while ensuring they have a comprehensive code of conduct for staff to follow.
Charities are built on having good ethics, this is the way these organizations demonstrate their commitment to accountability and transparency and show the public they are worthy of its trust and confidence. Without it, the public simply wouldn’t give to charities and the sector’s programs and services could never be provided. Accountability and transparency are important factors in establishing non-profit governance. Conflicts of interest and financial mismanagement in charities can cause real problems if not addressed.
GRC software can support NGOs to address their compliance concerns in several ways:
- Compliance obligations library: Using the latest GRC technology, charitable organizations can set up an online obligations library of applicable regulations, policies, and procedures, enabling them to monitor compliance.
- Policy management: With so many policies and regulations in place, keeping track of policy owners, changes, approvals, and expiry dates can be a challenge. The policy management capabilities available with GRC software will ensure policies remain up to date, automate approval processes, and enable on-line policy attestations.
- Regulatory change management: NGOs and charities are subject to many regulations. Implementing a regulatory change program that maps relevant regulations to processes and procedures can help organizations keep up with regulatory change through automated approvals and alerts providing a complete audit trail of when changes were implemented.
- Anonymous reporting and whistleblowing: Many GRC tools offer online portals where staff can report incidents and compliance problems discreetly and facilitate anonymous whistleblowing to ensure problems are highlighted and addressed.
ESG Reporting
Up until quite recently, environmental, social, and governance (ESG) reporting has largely been the domain and focus of publicly listed corporate entities. Today however there is an increasing pressure from investors and donors for non-profits, and charity organizations to embrace the practice.
A recent report by RSM, titled, “What does ESG mean for the charity sector” analyzed over 114 charities annual accounts and found that non-profits have a head start when it comes to ESG, as the purpose of charity is to provide for public benefit and cause no harm to the environment making it quite clear that the purpose of ESG aligns seamlessly with the objectives of charitable organizations.
ESG reporting should be approached as an opportunity to integrate key environmental and social sustainability principles into a charitable organizations lifecycle to ensure programmatic success and donor retention for years to come. But how can charitable organizations prove their ESG credentials?
GRC technology with ESG capabilities can help organizations monitor progress against their ESG initiatives. The tools offer best-practice frameworks to help organizations:
- Define an ESG strategy with a series of goals and objectives.
- Set key performance indicators (KPI’s) to visualize progress.
- Monitor compliance with ESG related obligations.
- Log ESG related incidents.
- Track and monitor ESG related risk.
When all of this is managed within one platform, it creates a single source of truth for all ESG related activity.
Leveraging an integrated GRC tool with strong ESG capabilities can support charitable organizations to demonstrate their values, culture, and ethics. By developing an ESG strategy and framework, they can track progress and report on key initiatives, centralize all ESG data via API integrations, manage ESG risk and third-party ESG compliance, and meet ESG regulations.
The charity sector makes a marked difference in the social sphere which is why ESG credentials can not only help these organizations guard against possible unethical and unsustainable practices but also highlight the numerous contributions the sector makes to the broader society to optimise future donor investments.
Project Management and Project Risk
Charitable organizations constantly run the risk of not receiving donations and must contend with a wide variety of ‘project risk’ as they seek to implement large capital projects, galas, and functions to get funds and help the vulnerable people they are working to support.
When it comes to implementing some of their larger global projects, GRC software with project management capabilities can equip them with the tools they need to deliver projects on time and build stakeholder trust making it easy to plan projects like fundraising events, deliveries of aid packages and food, and even large-scale humanitarian projects like building infrastructure in underdeveloped areas.
By opting to adopt a GRC platform with strong project management capabilities, projects of all sizes can be mapped out with key timelines, deliverables, and budgets. Automated workflows enable collaborative working, and any project risks can be added to the risk register and monitored. Progress can easily be viewed, and controls can be set to flag problems like missed deadlines and overspends. Projects can easily be prioritized to ensure budget and resources can be allocated to the most critical initiatives. Project management tools make collaborating on large projects easy and provide leaders with critical insights into project status, cutting back on lengthy progress meetings and updates.
To ensure the successful delivery of large-scale humanitarian projects and fundraising events, charities and NGOs must carefully manage the associated risks. Organizations should identify potential ‘project risk’ and establish key risk indicators (KRIs), they should also create a risk register and framework to categorize and prioritize risk. They should carry out regular risk assessments and checks to monitor risk levels and implement workflows to ensure problems are addressed and resolved quickly. Manging project risk using a GRC platform allows organizations to automate the risk management process using control monitoring and automated workflows and alerts, it also enables organizations to integrate project risk into their wider risk management program.
By anticipating potential project risks and having a plan in place to mitigate or avoid them, project managers can make informed decisions, allocate resources effectively, and ensure that the project is completed on time, within budget, and to the desired quality standards.
Embarking on GRC Automation
Because charitable organizations enjoy advantageous financial privileges such as tax exemptions and access to public funding, non-profits are routinely held to a high standard by both the public and regulatory watch dogs to ensure these privileges are not abused and are put to good use.
Today, the three pillars of governance, risk and compliance are critical for the long-term success of non-profit and charitable organizations. Strong governance depends on robust risk management capabilities to maintain stability as it charts a course into an uncertain future while good compliance helps to maintain its advantageous financial positions.
Leveraging GRC technology is essential for non-profit organizations to develop an efficient, agile, and collaborative reporting framework. By centralising GRC processes into a single unified platform, NGOs can greatly benefit from the resulting visibility and mapping of various risk and compliance processes, highlighting the relationships between them, reducing manual effort, and providing enhanced overall risk awareness.
A charity that consolidates its GRC processes into an integrated platform creates a single source of truth, full traceability and audit tracking for all GRC processes, improved information and analytics to drive better decision-making, and a massive reduction in time spent on administrative activities.
This integrated and flexible approach produces heightened visibility into risk relationships through a series of insightful dashboards and reports, supporting risk-based decision-making.
Implementing a GRC platform like Riskonnect will support NGOs and charities to implement best-practice processes across, risk management, compliance, incident reporting, ESG, project management, and strategic planning.
The technology can support charities to reduce manual effort and save the time spent on administrative activities. This, along with the centralized risk repository, can improve data integrity, empowering teams to leverage analytical tools to derive actionable intelligence and make informed business decisions.
Riskonnect are committed to helping organizations to advance on the GRC maturity journey with standardized processes and frameworks, automated workflows, and improved information sharing. To discover more reach out for a demo today.
