Embed Size (px)
Citation preview
Under the radar:risk management in small charities
Contents3 About the survey Who did what and why
4 Key takeaways Majorfindingsin10bite-sizepieces
6 External & internal risks Smallcharities’biggestworries
9 Spotting & managing risk Confidencelevelsinidentifyinganddealingwithrisk
12 Risk management strategies & obstacles Dosmallcharitiesmanagerisk–andhowwelldotheydoit?
15 Risk management & governance training Trainingincidenceandbarriers
19 Seeking advice on risk management & governance Wheredosmallcharitiesgoforhelp&advice?
25 Who took part & how? Thenutsandbolts
26 About our respondents Aportraitofthepeoplewesurveyed
Formediaenquiries,pleasecontact:
3
About thesurveyThesurvey’spurposeistoestablishattitudesandabilitytomanageoperationalandcompliancerisksamonggrassrootscharitiesandnot-for-profits.Also,wheretheygoforhelpandtraining.
330validresponsesfromorganisationsacrosstheUKwithanannualincomeoflessthan£500,000werereceivedandanalysed.
ThisisajointprojectbetweentheUniversityofSuffolk’sInstituteforSocialandEconomicResearchandindependentdigitalinsurancebrokerPolicyBee.
Theaimistohelpsmallcharitiesandnot-for-profitsrecogniseandreducetheirriskprofileagainstabackgroundofdwindlingfundingandresources,andincreasedscrutiny.Thefurtherintentionistopointthemtowardsusefulsourcesofhelpandsupport,sotheycanmoreeasilyfocusonpursuingtheircharitableobjectives.
Note:PolicyBeehascreatedanonlineHelp Hub,wherecharitiesandnot-for-profitscanfindusefulresourcesformanagingtheirorganisationandtheirrisksbetter.
4
Keytakeaways
Organisationsaremostworriedaboutmoney.Thebiggestexternalriskisidentifiedaslossoffunding(70%)andthebiggestinternalriskasreducedincomeorrevenuestreams(74%).
Respondentsdoubttheirorganisation’sabilitytoassessandmanagerisk.Almosthalf(47%) areonly‘somewhatconfident’orlesssointheircapacitytoidentifyandassessrisk.Andmorethanhalf(54%) feelonly‘somewhatconfident’orlesssowhenitcomestotheirabilitytomanagerisk.
Othermajorrisksinvolvepeople.Organisationsviewrecruitmentoftrusteesandvolunteers(62%)asthenextmostsignificantexternalrisk,andriskslinkedtostaffandvolunteers(44%)asnextinlineforinternalrisks.
Lackoftime(64%),lackoffunds(52%)andlackofexpertise(39%)areidentifiedasthemainreasonswhyriskmanagementpracticesaren’timplemented.
Oneinten‘doesn’thave’or‘isn’tsure’iftheyhaveanyriskmanagementmeasuresinplaceatall.Ofthosethatdo,thereisanaverageofonlyoneriskmanagementmeasureperorganisation,andnomorethanthreeperorganisationamongallrespondents.Onlyasmallnumber(8%)haveariskregister.
1 2 3
4 5
5
*Council for Voluntary Service
**This figure was obtained from a crosstabulation and a median test of the familiarity, attitudes to seeking help, and satisfaction scores among organisations divided by income bracket and presented as a familiarity subscale.More information available on request.
Relevanttrainingisinshortsupply,withnearlytwo-thirds(62%)havingreceivednoriskmanagementorgovernancetraining–mostcommonlyduetolackoffunds(57%),lackoftime(50%),andnotknowingwheretogofortraining(45%).
Informationprovidedbylocalvoluntarysupportorganisationssuchascommunityfoundationsand*CVSsisidentifiedasthemostreliable(59% ‘satisfied’or‘verysatisfied’) –althoughnearlya third (30%) saythey‘never’usethem.
Whenitcomestoseekingadviceonriskmanagementandgovernanceissues,mostrelyontheirboardoftrusteestoprovidetheexpertise(55%),ortheirpeersandcolleagues(46%).
Thelargertheorganisation,themorelikelytheyaretobe‘veryfamiliar’withthemajorregulatorybodiesandumbrellaorganisations,especiallyintheannualincomeover£100,000bracket(43%)**.
Thereisn’twidespreadtake-upofthesupportandadviceonofferfromsomeofthesector’smainregulatorybodiesandumbrellaorganisations.Twothirds(66%)saytheyaren’tfamiliarwiththeorganisationslisted.
6 7 8
9 10
6
External &internal risksWhat we learnedRisktofundingistheoutrightbiggestworryfororganisations,whetherthatbeexternalfundinge.g.grants(70%)orinternalfundinge.g.theircapacitytogenerateincomestreams(74%).Thiscomesonthebackofanongoingsqueezeoncentralgovernmentfundingtolocalcouncilssince2010. Theabilitytorecruittrusteesandstaffisseenasthenextlargestexternalriskfororganisations(62%),whilemanagingtherisksassociatedwiththemcomesnextonthelistofinternalconcerns(44%).
DatahandlingandGDPRisaconcernfor28%andcyberrisksworry25%.
Respondentswereaskedtofreetypeanyadditionalexternalandinternalrisksthatalsoworrythem.Thisgeneratedthreenewcausesforconcern,althoughnumbersforeacharesmall:regulatorycompliance(2%)andlossofmembers(2%)asexternalrisks,andchildsafetyprotection(1%)asaninternalrisk.
7
What we asked
Whichoftheseexternalrisksareyouconcernedaboutinthenext12months?
(275responses–respondentscouldtickasmanyastheywanted.)
Q.
8
What we asked
Whichoftheseinternalrisksareyouconcernedaboutinthenext12months?
(275responses–respondentscouldtickasmanyastheywanted.)
Q.
9
Spotting and managing risk
What we learnedAconsiderablechunk,47%ofrespondents,feeltheirorganisationisonly‘somewhatconfident’oratalevelbelowthatinidentifyingrisk,while54%feelthesameabouttheircapabilitytomanagerisk.Thatsuggestsarealconcernamongrespondentsabouttheirorganisation’sabilitytospotandheadoffrisksbeforetheyturnintoproblems.
10
What we asked
Howwouldyourateyourorganisation’sconfidencetoidentifyandassessrisk?
(274responses)
Q.
11
What we asked
Howwouldyourateyourorganisation’sconfidencetomanagerisk?(274responses)
Q.
12
Risk management strategies &obstacles
What we learnedRespondentswereaskedtofreetypetheirorganisation’sriskmanagementmeasures,ratherthanchoosefromalist.Individualresponseswerethenallocatedtooneofsevenwiderriskmanagementcategoriesandinformationwasextractedtoestablishnumbersofriskmanagementmeasuresinplaceperorganisation.
Thelargestgroup(42%)saytheyhave‘Assessment,evaluation,monitoring’measuresinplace,whereasfortheothereightriskmeasurementcategories,numbersfallbelowaquarterforallbut‘riskmanagementpolicies&procedures’.Only8%saytheirorganisationhasariskregister.
Themaximumnumberofriskmanagementmeasuresinplaceforanyorganisationisthree,andtheaverageisone.Oneinten‘doesn’thave’or‘aren’tsure’iftheyhaveanyriskmanagementmeasuresinplaceatall.
Themajorbarriertoorganisationsputtingriskmanagementmeasuresinplaceisreportedaslackoftime(64%),followedbylackoffunds(52%)andlackofexpertise(39%).Thispaintsapictureofhard-pressedcharitymanagersshortonthetimetheyneedtoproperly
audittheirrisksordoanythingaboutthem–compoundedbyalackoffundsforappropriatetrainingandalackofexpertknowledgeandreadilyavailableinformation.
Andwhilestatutoryriskmanagementisanecessityonlyforlargercharitieswithannualincomeabove£1millioninEnglandandWales,orabove£500,000inScotlandandNorthernIreland(pluscharitieswithincomesabove£250,000andassetsworthmorethan£3.26millionforthewholeUK),TheCharityCommissionstronglyemphasisestheneedforsmallcharitiesalsotomonitorrisk:
“Trustees of smaller charities with gross income below the statutory audit threshold (who should still be concerned about the risks their charity faces) are encouraged to make a risk management statement as a matter of good practice.”
13
What we asked
Whatriskmanagementmeasuresdoyouhaveinplacetodealwithrisk?
(247free-typeresponses–respondentscouldaddasmanyastheywanted.)
Q.
14
What we asked
Whatbarriersdoyoufaceinimplementingriskmanagementmeasuresatyourorganisation?
(450free-typeresponses–respondentscouldaddasmanyastheywanted.)
Q.
15
Risk management and governance training
Nearlytwo-thirdsofrespondents(62%)havehadnoriskmanagementorgovernancetraining.Thosewhohavereportanoverwhelminglypositiveoutcome(89%)andawidevarietyofsourcesfortheirtraining–themostcommonbeingcurrentorpreviousemployers(23%),localcommunity&voluntaryorganisations(22%)andlocalgovernment(14%)(see appendix 1).
Lackoffunds(57%)comestopofthereasonswhyrespondentsareunabletoaccesstraining,followedbylackoftime(50%)–againsuggestingcharityandcommunityworkerslackboththecashandthesparehoursrequiredtoimprovetheirriskmanagementandgovernanceskills.
Asignificantproportion(45%)alsoreportthattheywouldn’tknowwheretolookfortraining,implyingalackofclearsignpostingforthesector.
What we learned
16
What we asked
Haveyoueverreceivedriskmanagement/governancetraining?
(243responses)
Q.
17
What we asked
Didthetrainingimproveyourorganisation’sknowledgeandabilitytodealwithrisk?
(91responses)
Q.
18
What we asked
Whatwerethebarriersinaccessingriskmanagementorgovernancetraining?
(281responses–respondentscouldtickasmanyastheywanted.)
Q.
19*Council for Voluntary Service
Seeking advice on risk management & governancePeoplemostlyrelyonthepeoplearoundthemwhenseekingadviceonriskmanagementandgovernance.55%looktotheirboardoftrusteestosupplytheexpertise-whereasmanysmallcharitieswon’thavethatluxury.
Peersandcolleagues(46%)arethesecondmostpopularsourceofadviceandinformation.Butthisagainraisesquestionsforthoseworkingalone,inisolationorsolelywithvolunteers.
Meanwhile,largenumbers(66%)saytheyareunfamiliarwithseveralofthekeyregulatoryandumbrellabodieswithinthesector–whichinthemselvesareimportantprovidersofinformation.
21%saytheyarenotfamiliarwithTheCharityCommission,withnumbersrisingto59%fortheInformationCommissioner’sOffice(ICO-theregulatorfordataprotectionandGDPR)and49%fortheFundraisingRegulator.
45%reportalackoffamiliaritywiththeirlocalnetworks,includingcommunityfoundationsandCVSs*.Yettheadviceandinformationprovidedbylocalvoluntaryandmembershiporganisationstopsthetableforreliability,witha59%satisfactionrate.
Themostwidelyconsultedresourceforinformationandadviceisthegov.ukwebsite,with60%ofrespondentsreportingusingitinthepast12months.Justoverhalfsaytheymadeuseoftheirlocalnetworksinthattimeframe,butnearlyathirdreport‘never’usingthem.
32%alsosaythey‘never’makeuseofTheCharityCommission,andlessthanathirdhadconsultedtheICOintheyearGDPRcameintoforce.Only8%hadusedtheFundraisingRegulator.
20
What we asked
Fromwhereisinformationondealingwithriskmostlysought?
Q.
Note:respondentswereaskedto‘stronglydisagree’,‘disagree’‘neitheragreenordisagree’,‘agree’or‘stronglyagree’withaseriesofstatementsaboutwheretheyseekinformation.Noresponseandanswersof‘notapplicable’werediscounted,givingavaryingnumberoftotalresponsesforeachsource.Thechartaboveshowsnumberswhoanswered‘stronglyagree’or‘agree’toseekinginformationfromeachsource.Seeappendix 2forafullbreakdown.
21
What we asked
Howsatisfiedwereyouwiththeadviceandinformationyoureceivedfrom:
Q.
Note:respondentswereaskedwhethertheywere‘verydissatisfied,‘satisfied’‘neithersatisfiednordissatisfied’,‘dissatisfied’or‘verydissatisfied’withtheadviceandinformationtheyreceivedfromvarioussources.Noresponseandanswersof‘notapplicable’werediscounted,givingavaryingnumberoftotalresponsesforeachsource.Thechartaboveshowsnumberswhosaidtheywere‘satisfied’or‘verysatisfied’.Seeappendix 3forafullbreakdown.
22
What we asked
Whichoftheseregulatorybodiesandumbrellaorganisationsareyou‘notsofamiliar’or‘notatall
familiar’with?(251responses)
Q.
Note:respondentswereaskedwhethertheywere‘notatallfamiliar’,‘notsofamiliar’,or‘veryfamiliar’withalistofregulatorybodiesandumbrellaorganisations.Thechartaboveshowsnumberswhoanswered‘notsofamiliar’or‘notatallfamiliar’foreachone.Seeappendix 4forafullbreakdown.
*CouncilforVoluntaryService
23
Note:thistableisderivedbycombiningresponsesfromthepreviousquestion.
What we asked
Howfamiliarareyouwiththemainregulatorybodiesandumbrellaorganisations?
Q.
24
What we asked
Haveyouusedanyoftheseregulatorybodiesandumbrellaorganisationsinthelast12months?
(245responses–respondentscouldtickasmanyasapplied)
Q.
Note:respondentswereaskedwhethertheyhadusedthevariousregulatoryorumbrellaorganisations‘inthelast12months’,‘beforethelast12months’,or‘never’.Therewere245responses.Thechartaboveshowsnumberswhoanswered‘inthelast12months’foreachone.Seeappendix 5forafullbreakdown.
*CouncilforVoluntaryService
25
Who took part and how?
ThesurveyisacollaborationbetweenPolicyBee,anindependentinsurancebroker,andtheUniversityofSuffolk.TheUniversity’sleadontheprojectisDrOlumideAdisa,principalinvestigatorwithinitsSuffolkInstituteforSocialandEconomicResearch.DrAdisaprovidedthestatisticalanalysis.
ThesurveywasavailableonSurveyMonkeyfrom2Julyto9September2018.AlinktoitwasdistributedwidelybothbyPolicyBeeandTheUniversityofSuffolk,andalsosharedbyvariousothercharityorganisationsamongtheirmemberships.A£200incentivewasofferedintheshape
ofaprizedraw,withachequepaidtotherandomly-chosenwinningcharity.
394peopleacrosstheUKtookpartinthesurvey.However,64(16%)wereabovetheincomecut-offlevelof£500,000andweredisqualifiedfromtheoutset.Thatleft330validresponses,althoughnotallrespondentsansweredallquestions.
PolicyBeewasestablishedin2010asanindependentdigitalinsurancebroker.
TheUniversityofSuffolkishometotheSuffolkInstituteforSocialandEconomicResearch(SISER).
26
About ourrespondents
Ofthe330validresponsestothesurvey,thereisgoodrepresentationfromacrossthecountry,andfromorganisationsworkinginmanydifferentareasacrossthesector.
ThelargestnumberofresponsesarefromtheEastofEngland(38%).Thiswasasexpected,asbothPolicyBeeandtheUniversityofSuffolkareIpswich-based,whileCommunityActionSuffolkwasveryactiveinsharingthesurvey.
27
What we asked
Whatisyourorganisation’sannualincome?(394responses)
Q.
28
What we asked
Whereisyourorganisationbased?(307responses)
Q.
29
What we asked
Wheredoesyourorganisationoperate?(451responses–respondentscouldtickasmanyasapplied.)
Q.
30
What we asked
Whatisyourorganisation’smainarea(s)ofactivity?(638responses–respondentscouldtickasmanyasapplied.)
Q.
31
What we asked
Whatisyourpositionintheorganisation?(294responses)
Q.
32
Appendices
Current or previous employment 23%
Local community & voluntary organisations 22%
Local government 14%
In-house 11%
Other charity bodies 7%
Others 6%
Private training companies 5%
Professional institutes & associations 4%
Online 4%
Legal 4%
Appendix 1
Wheredidyoureceiveriskmanagementandgovernancetrainingfrom?
(Answersfromthe93respondentswhoanswered‘yes’toreceivingtrainingweregroupedintogeneralcategoriesduetotheirbroadvariety.)
Q.
33
AppendicesAppendix 2
Thinking of your role within your organisation, which of the following statements apply?
Q.
Informationondealingwithriskismostlysoughtfromboardoftrustees
Strongly disagree 3%
Disagree 10%
Neither agree nor disagree 21%
Agree 31%
Strongly agree 11%
No response 16%
Not applicable 8%
34
AppendicesAppendix 2
Thinking of your role within your organisation, which of the following statements apply?
Q.
Informationondealingwithriskismostlysoughtfrompeers&colleagues
Strongly disagree 3%
Disagree 8%
Neither agree nor disagree 32%
Agree 31%
Strongly agree 7%
No response 16%
Not applicable 4%
35
AppendicesAppendix 2
Thinking of your role within your organisation, which of the following statements apply?
Q.
Informationondealingwithriskismostlysoughtfromlocalvoluntarysupportorganisations
Strongly disagree 4%
Disagree 17%
Neither agree nor disagree 69%
Agree 25%
Strongly agree 6%
No response 16%
Not applicable 3%
36
AppendicesAppendix 2
Thinking of your role within your organisation, which of the following statements apply?
Q.
Informationondealingwithriskismostlysoughtfrommembershiporganisations
Strongly disagree 7%
Disagree 18%
Neither agree nor disagree 23%
Agree 19%
Strongly agree 8%
No response 16%
Not applicable 9%
37
AppendicesAppendix 2
Thinking of your role within your organisation, which of the following statements apply?
Q.
Informationondealingwithriskissoughtfromaninsurancecompany
Strongly disagree 11%
Disagree 18%
Neither agree nor disagree 25%
Agree 19%
Strongly agree 4%
No response 16%
Not applicable 7%
38
AppendicesAppendix 2
Thinking of your role within your organisation, which of the following statements apply?
Q.
Informationondealingwithriskismostlysoughtfromonlinesupportgroups
Strongly disagree 31%
Disagree 29%
Neither agree nor disagree 26%
Agree 11%
Strongly agree 3%
No response 16%
Not applicable 23%
39
AppendicesAppendix 2
Thinking of your role within your organisation, which of the following statements apply?
Q.
Informationondealingwithriskissoughtfromapaidconsultant
Strongly disagree 20%
Disagree 24%
Neither agree nor disagree 15%
Agree 8%
Strongly agree 2%
No response 16%
Not applicable 15%
AppendicesAppendix 3
How satisfied were you with the advice and information received from the following sources?
Q.
40
Boardoftrustees/directorsorequivalent
Very dissatisfied 1%
Dissatisfied 3%
Neither satisfied nor dissatisfied 17%
Satisfied 36%
Very satisfied 14%
No response 18%
Not applicable 11%
AppendicesAppendix 3
How satisfied were you with the advice and information received from the following sources?
Q.
41
Onlinegroupsincludingsocialmedia
Very dissatisfied 1%
Dissatisfied 2%
Neither satisfied nor dissatisfied 30%
Satisfied 16%
Very satisfied 3%
No response 18%
Not applicable 30%
AppendicesAppendix 3
How satisfied were you with the advice and information received from the following sources?
Q.
42
Localvoluntaryorganisations/membershiporganisations
Very dissatisfied 1%
Dissatisfied 3%
Neither satisfied nor dissatisfied 14%
Satisfied 38%
Very satisfied 12%
No response 18%
Not applicable 14%
AppendicesAppendix 3
How satisfied were you with the advice and information received from the following sources?
Q.
43
Peersandcolleagues
Very dissatisfied 1%
Dissatisfied 3%
Neither satisfied nor dissatisfied 19%
Satisfied 41%
Very satisfied 9%
No response 18%
Not applicable 9%
AppendicesAppendix 3
How satisfied were you with the advice and information received from the following sources?
Q.
44
Insurancecompanyorbroker
Very dissatisfied 1%
Dissatisfied 2%
Neither satisfied nor dissatisfied 20%
Satisfied 21%
Very satisfied 6%
No response 18%
Not applicable 32%
AppendicesAppendix 3
How satisfied were you with the advice and information received from the following sources?
Q.
45
Consultant
Very dissatisfied 2%
Dissatisfied 1%
Neither satisfied nor dissatisfied 17%
Satisfied 8%
Very satisfied 3%
No response 18%
Not applicable 51%
46
AppendicesAppendix 4
Howfamiliarareyouwiththeseregulatorybodiesandumbrellaorganisations?
Q.
Not at all familiar 5%
Not so familiar 15%
Very familiar 80%
Not at all familiar 27%
Not so familiar 49%
Very familiar 24%
CharityCommission
FundraisingRegulator
AppendicesAppendix 4
How familiar are you with these regulatory bodies and umbrella organisations?
Q.
47
InformationCommissioner’sOffice(ICO)
NationalCouncilforVoluntaryAction(NCVO)
Not at all familiar 26%
Not so familiar 33%
Very familiar 41%
Not at all familiar 19%
Not so familiar 34%
Very familiar 47%
AppendicesAppendix 4
How familiar are you with these regulatory bodies and umbrella organisations?
Q.
48
Gov.uk
UKCommunityFoundations
Not at all familiar 8%
Not so familiar 28%
Very familiar 64%
Not at all familiar 39%
Not so familiar 35%
Very familiar 26%
AppendicesAppendix 4
How familiar are you with these regulatory bodies and umbrella organisations?
Q.
49
Localnetworks(*CVS,Communityfoundationetc)
Not at all familiar 13%
Not so familiar 32%
Very familiar 55%
*CouncilforVoluntaryService
AppendicesAppendix 5
Have you used these regulatory bodies and umbrella organisations in the last 12 months, before the last 12
months, or never?
Q.
50
Never 25%
Before the last 12 months 15%
Last 12 months 60%
Never 30%
Before the last 12 months 15%
Last 12 months 55%
Gov.uk
Localnetworks(CVS*,Communityfoundation,etc)
*CouncilforVoluntaryService
AppendicesAppendix 5
Have you used these regulatory bodies and umbrella organisations in the last 12 months, before the last 12
months, or never?
Q.
51
Never 32%
Before the last 12 months 15%
Last 12 months 53%
Never 62%
Before the last 12 months 9%
Last 12 months 29%
CharityCommission
InformationCommissioner’sOffice(ICO)
AppendicesAppendix 5
Have you used these regulatory bodies and umbrella organisations in the last 12 months, before the last 12
months, or never?
Q.
52
Never 53%
Before the last 12 months 20%
Last 12 months 27%
Never 67%
Before the last 12 months 13%
Last 12 months 20%
NationalCouncilforVoluntaryOrganisations(NCVO)
UKCommunityFoundations
AppendicesAppendix 5
Have you used these regulatory bodies and umbrella organisations in the last 12 months, before the last 12
months, or never?
Q.
53
Never 81%
Before the last 12 months 11%
Last 12 months 8%
FundraisingRegulator
