WIXLIB

Risk Management Essentials January/February 2009 using a flashlight to illuminate theground ahead on an evening walk.While a beam of light—or a beamof thought or focus—may be helpfulin identifying the risks that lay directlyahead, it is probably less effective inspotting events, circumstances andconditions in the environment thatmay have the potential to dramaticallyto affect the organization’s abilityto deliver services, meet clientsneeds and pursue its mission. Asleaders of organizations with vitalmissions, we must train ourselves tolook beyond the beam of light. Wemust learn how to examine, withappropriate care, all of the elementsof the environment in which weoperate—from funding opportunities,to the work of competitors andcollaborators, to Mother Nature. Themanagement team at your nonprofitshould consider how the currentenvironment—and changes in theenvironment—could disrupt or derailyour mission. What could go wrong?What will you do now, knowingthat an event or condition in your“environment” could spell disruptionor disaster for your mission? Whatwill you do if that event—from loss offunding to the extraordinary success ofa competitor—materializes?When we teach the RiskManagement Process, we encourageleaders to begin with “appreciating thecontext.” Our instructions for doingso include examining the nonprofit’shistory, circumstances, opportunities,cultural issues and organizationalstructure in relation to the risks thenonprofit faces. How do these keyenvironmental issues affect risk-takingand risk management in the nonprofit?A nonprofit that has faced a slew ofemployment-related claims is likely tobe tuned into the risks of employmentlitigation, but may be inattentive torisks associated with the loss of a majorfunding source. A nonprofit whoseleaders are decidedly risk-averse mayforego the opportunity to expand thereach and success of the organizationby serving clients in neighboringjurisdictions or seeking other meansof diversifying the ways in which theorganization delivers its mission.Examining the context—theenvironment in which theorganization exists—is a key firststep to integrating sound riskcontinued on page 6“There are a lot of things Idon’t worry about becauseI have a plan in place if”they happen.– Randy Pausch, The Last Lecture

Risk Management Essentials January/February 2009Managing Riskcontinued from page 5“When we teach theRisk Management Process,we encourage leaders tobegin with “appreciating”the context.”management thinking and strategiesinto the life of your nonprofit. Doingso effectively requires that you employ360 degree, radar-like thinking asyou examine the history, mission,culture and opportunities facing yourorganization. Instead of focusing yourrisk management beam only on theobvious dangers that lie in the pathahead, remember to look behind you,to the far left and right, and even upabove, for changes, circumstancesand information that will guide yourrisk-taking and risk managementpractices in the year ahead. We needto transport our passion for missioninto the commitment to look broadlyat the risks that stand in the way ofmission fulfillment. And rememberthat an optimistic outlook and theresolve to make your nonprofit bettereach and every day will fortify yourgoal of spotting and addressing therisks that stand in the way of realizingthe mission that means everything tothose who serve, and receive servicesfrom, your organization. nMelanie Lockwood Herman is ExecutiveDirector of the Nonprofit Risk ManagementCenter. She welcomes your questions,comments and feedback on this article.Melanie can be reached at Melanie@nonprofitrisk.org or (202) 785-3891.

Risk Management Essentials January/February 2009 Looking Backcontinued from page 2 Several states also areconsidering or have expandedthe requirements for familyleave for workers. BothCalifornia and New Jerseyenacted laws that require paidfamily leave. (WashingtonState previously passedlegislation mandating paidfamily leave, but the effectivedate of enactment has beensuspended.)If your nonprofit employs 15 ormore employees (including parttime and temporary staff) oroffers facilities such as swimmingpools, playgrounds and otherareas accessible to the public,the new ADA amendments,effective January 1, 2009,should be on your radar screen.The amendments expand thedefinition of “disability” andunderscore that persons “regardedas disabled” are entitled to thesame protections whether or notthey actually have a disability.Resources for compliance withthe ADA’s public accommodationrequirements are available froma special Department of Justiceweb site: www.ada.gov. A shortsummary of the employmentrelated changes imposed by thenew ADA Amendments Act of2008 is available from the EEOCweb site: www.eeoc.gov/ada/amendments notice.html. definition of disability willincrease the already highnumber of discriminationclaims filed by workers.The EEOC reported that in2007 on average over 200federal employment claimswere filed daily. That’s inaddition to the number of statelaw claims that are filed. Thereis no doubt that the expanded The new definitions arealso likely to increase thenumber of requests foraccommodation. Is yournonprofit ready to respond?Remember that a give-andtake with employees to find areasonable accommodation isnot only required, it’s soundrisk management.When was the last time your staffwas trained in harassment? In one poll, 45% of workersreported that they were thesubject of abusive treatmentat work, such as supervisorsyelling at them. Such conductcan have a disparate impacton women because of theirresponse to violence—whichcan lead to allegations of ahostile work environmentand gender discrimination.Tip: Include information onbullying in your harassmenttraining program.In a workplace poll, 76% ofworkers responded that theythink that office romances aremore common now than theywere 10 years ago. To addressthe risk that favoritism at theworkplace would rise to the levelof a harassment claim, considerrequiring the disclosure ofoffice romances and trainingon favoritism. The Universityof California’s web site provideslinks to training resourcescontinued on page 8“Looking ahead, is yourorganization preparedfor the impact ofthese changes?”“In one poll, 45% ofworkers reported that theywere the subject of abusivetreatment at work ”

Risk Management Essentials January/February 2009Looking Backcontinued from page 7 that are good examples of riskmanagement in sment/resources.html. Are staff responsible for hiringnew employees aware that anew I-9 Form is required as ofFebruary 9, 2009? The revised Form I-9 will soonbe posted at the web site of U.S.Citizenship and ImmigrationServices: www.uscis.gov. Theagency will also update TheHandbook for Employers,Instructions for Completing theForm I-9 (M-274) to reflect therevisions to Form I-9.If your nonprofit has contractswith the government, are youprepared to use E-Verify, anelectronic process for checkingthe eligibility of worker status? Use of E-Verify willbe required of allfederal contractors andsubcontractors as of January15th however only somecontracts are affected.Contracts with the federalgovernment for goods orservices for more than 100,000 (with limitedexceptions), and subcontractsfor services or constructionfor more than 3,000 (withlimited exceptions), willcontain a clause mandatingthe use of E-Verify.Information concerningE-Verify may be found atwww.uscis.gov/E-Verify.If your nonprofit offers workersa 403b Plan, are the written plandocuments in compliance withnew regulations? The IRS has extended thecompliance deadline untilDecember 31, 2009, andwill soon be issuing written

Risk Management Essentials January/February 2009 guidance including sampleplan language that complieswith the new regulations.Stay tuned to the Center’se-News for updates, or checkthe IRS web site. Does your organization have apolicy on blogging by employees?Is it time to consider how socialnetworking may impact yourhiring/firing policies? One poll revealed that 55%of employees say they have apersonal blog but fewer than5% of employers have policieson blogging. In a widely publicized casethat demonstrates howemployers are starting tomonitor social networkingsights, an employer inCalifornia concerned aboutconduct that would beoffensive to co-workers, fired27 employees for postingmessages on My Spacethat remarked on weightand sexual orientation. Inanother case, an employer,Continental Airlines, was heldresponsible for harassment,because an employee postedoffensive material on anemployer-sponsored internetbulletin board.There has never been a bettertime to adopt the mantra “beprepared” as your strategy formanaging employment risks.The conventional wisdom is thatemployment law claims increaseduring a stressed economy.Additionally, the average damageaward is likely to be higher in tougheconomic times because of the lengthof time it may take for a plaintiffto find a new job. To minimize therisk that your nonprofit’s personnelpractices will be challenged as unfair,discriminatory or simply out-ofdate, be prepared with up-to-dateresources on risk management in theemployment arena.The Center is here to help yournonprofit be prepared. The Center’sstaff is available by email atinfo@nonprofitrisk.org or phone(202) 785-3891 to answer yourquestions. Our bi-weekly e-Newsregularly features new employmentrelated issues. Sign up at www.nonprofitrisk.org. Our publication,Taking the High Road: A Guide toEffective and Legal EmploymentPractices for Nonprofits: http://nonprofitrisk.org/store/high-road.shtml, is popular with nonprofitleaders as a virtual desk-reference.The on-line version has updated linksto new laws and regulations passedthrough 2008. nJennifer Chandler Hauge is Senior Counseland Director of Special Projects at theNonprofit Risk Management Center.Jenny welcomes your questions, feedbackand comments on this article or anyemployment risk issue. Jenny can bereached at Jennifer@nonprofitrisk.org or(202) 785-3891.“There has never been abetter time to adopt the”mantra “be prepared”

10 Risk Management Essentials January/February 2009XxxxxxxxxxxxxxxHallmarkscontinuedcontinued fromfrom pagepage 51The Hallmarks is an online tooldesigned to:“These tools are there for Inspire thoughtful risk-taking bynonprofit leaders, Illuminate the “hallmarks”that are shared by risk-awarenonprofits, and Provide a forum for nonprofitleaders to share specific tools andpractical guidance to strengthenthe risk management practices intheir organizations.you to customize for your”own organization Each of the 12 Hallmarks isdescribed, along with suggestions forhow organizations can embody thatthe Hallmarks in their operationsand activities. For each Hallmark theCenter has identified numerous tools,including sample policies and tipsto help you achieve some of the starpower demonstrated by risk-savvynonprofits. These tools are therefor you to customize for your ownorganization, and also to serve assuggestions for practices and policiesto share with others through a simple“Submit a Tool” button on the site.By sharing your inspiring practicesyou will be partnering with otherrisk-savvy nonprofits in taking riskmanagement to the next level in yourorganization.Each of the Hallmarks tml) is followed by practicalsuggestions and links to specificresources. For example, Hallmark#2 suggests that it is essential to havea leader in your organization whoboth believes in the importance ofrisk management and is effective inmotivating others. What if you like thatidea, but your organization isn’t ‘thereyet?’ Click on the Tools for Hallmark#2 for suggestions on cultivating a riskmanagement champion.Hallmark #4, “Is Bold But Smart,”reflects the Center’s view that effectivenonprofits take bold risks and thatrisk-taking should be an informed andthoughtful process. Tools for Hallmark#4 include a sample charter for a riskmanagement committee, a checklistfor possible risks to consider whenprograms are expanding or growing,and links to free resources such as

Risk Management Essentials January/February 2009 11articles that support the Hallmark’sgoal of making informed choices andbeing aware of the risks involved.Hallmark #8, “Tells It Like It Is”focuses on transparency and candor.The tools for Hallmark #8 include asample media spokesperson policy,resources and suggestions for draftingpress releases and a link to a samplecrisis communication plan.Many of the Hallmarks offersample risk management policies, aswell as resources for developing orrevising specific policies, including: Sample Gift Acceptance ls/1gift-acceptance%20policies.doc (Hallmark #1)Sample Whistleblower ls/5whistleblowerresources.doc(Hallmark #5)Sample Open Door ls/2whistlebloweropen-door-policy.doc (Hallmarks#2 and #5) Sample Record Retentionand Destruction ools/7recordsretention.doc (Hallmark #7) Sample Media Spokesperson ls/8media.doc(Hallmark #8) Sample Executive CompensationReview ls/11compensationreview-policy.pdf (Hallmark #11)“The Hallmarks weredeveloped with generousgrant funding from the Sample Joint Venture/PartnershipAgreement Review ls/11joint-boardreview-policy.pdf (Hallmark #11)Sample Conflict of Interest ls/11conflicts-ofinterest-policies.pdf (Hallmark #11)Be inspired! We invite you to takea look at the Hallmarks—especiallythe tools—whenever you needinspiration, and to share ideas andpractices that have been successfulfor your organization. Keep in mindthat you will never be alone in yourjourney to become a risk-awareorganization. We look forward toyour feedback on the Hallmarksand will be eager to post the toolsand resources you are willing toshare with others. As always, do nothesitate to reach out to the Center’sstaff for assistance in your journeyto more effective risk managementand mission fulfillment. Submit yourtechnical question via the “Ask aQuestion” page on our web site foundat: http://nonprofitrisk.org/contact/question.html, or contact us bytelephone at (202) 785-3891. nTravelers Foundation.Support from Travelersenabled the Center toconvene experiencednonprofit and publicentity thought-leadersto learn from each otherwhat can be consideredcommon characteristics ofrisk-aware and risk-savvy”nonprofits.

12 Risk Management Essentials January/February 2009XxxxxxxxxxxxxxxCulture Shockcontinued from page 53of adopting a culture of riskmanagement extends to all sectors.A survey Risk Wise conductedearlier this year revealed that manygovernment departments have notyet fully embedded risk managementinto their business practices. Thisis true despite having put in placeframeworks and processes forintegrated risk management.”Diana offers what she terms“catalysts” to help leaders embed arisk management culture in theirorganizations.“Catalyst #1Leaders “need to beexplicit about what needs”to be accomplished, how,by when, and who isresponsible for what.”Establish Clear RiskManagement Objectives,Strategies, Roles andResponsibilitiesDiana explains that leaders “need tobe explicit about what needs to beaccomplished, how, by when, andwho is responsible for what.” Riskmanagement is a discipline wherejargon and technical lingo abound. Topersuade busy staff in your nonprofitorganization that risk management isworth their time and effort, it must bearticulated in terms that relate closelyto the organization’s mission and totheir role in delivering the mission.According to Diana, “In many publicand private sector organizations,strategic objectives are more like a listof hopes and dreams than they aremeaningful and measurable targetsthat both inspire and hold people toaccount.”ASK YOURSELF: Doesmy nonprofit have explicitrisk management objectivesand strategies? Are roles andresponsibilities for identifying andmanaging risk known throughoutthe organization? If key personnel areunaware of their role in identifyingand managing risk, risk managementcannot come to life in your nonprofit.Catalyst #2Articulate Risk Appetite &ToleranceAs we consult with nonprofit leadersacross the country, few are ableto articulate the risk appetite andtolerance of their organizations.Countless leaders have asked theCenter to provide benchmarks orstudies demonstrating the averageinsurance limits and deductiblesselected by comparable organizations.We explain that selecting limits anddeductibles begins with determiningthe risk appetite and tolerance of theorganization—versus examiningwhat others have decided to do.These questions remind me of theresponse given by countless mothersin response to the whining child whocomplains, “But Jimmy is doing it!”It is difficult, if not impossible, toimplement effective risk managementstrategies in an organization thathas yet to consider and articulate itsappetite for risk taking.ASK YOURSELF: Has myorganization articulated its riskappetite and tolerance? If peopledon’t know what the criteria are fordecisions, risk management cannotcome to life in your organization.Catalyst #3Use Risk Intelligence to DriveExcellent PerformanceAccording to Diana, “If we define riskas events or conditions that createuncertainty around the achievement

Risk Management Essentials January/February 2009 13of objectives, then clearly, risk andperformance are linked.”She explains the concept with thefollowing example:Imagine ‘knowledgeable staff ’ is akey performance driver for providingtop-notch tutors in an after-schoolprogram and the associated riskfactors are the ability to hire andtrain staff to the required level ofknowledge. If we notice a downwardtrend in the knowledge level of newrecruits or that people are completingour training programs withoutachieving the level of knowledgerequired, we can intervene in a timelymanner. But if we don’t know aboutor own up to the facts or reality,performance will inevitably suffer.ASK YOURSELF: Has myorganization linked its risk andperformance indicators? If youdon’t understand how risk can affectyour objectives and don’t establishand track risk indicators, riskmanagement cannot come to life inyour organization.Catalyst #4the organization to achieve itsperformance objectives in a way thatoptimizes resources and balancesrisk better than all other plausiblealternatives.”A culture of candor is essential ina nonprofit organization that seeksto balance the drive for missionfulfillment with the need to operatewith transparency and accountability.Whether it’s a board-level discussionabout strategic programmingopportunities, or the downsiderisks associated with a proposedcollaboration, your nonprofit’s leadersshould embrace the expression ofdivergent views. According to Diana,“For a risk assessment process tobe effective, it must bring to thesurface all critical information forthe decision at hand. This can’t beachieved if the

request and track family and medical leave. The new forms include: Certification of Healthcare Provider for Employee's Serious Health Condition (Form WH-380-E). Certification of Healthcare Provider for Family Member Health Condition (Form WH-380-F). Notice of Eligibility and Rights and Responsibilities (Form WH-381). Designation Notice (Form .