Most nonprofits have a risk register. Far fewer have one that changes a decision. The difference is rarely the template. It is whether the register names the risks that could actually stop the mission, whether someone owns each one, and whether the Board looks at it often enough to act.
This guide is for Boards, CEOs and finance leads of NGOs, charities and foundations anywhere. It sets out what a working register contains, how to score risks without false precision, and the mistakes that turn a register into paperwork.
General guidance for governance and education. Adapt it to your organisation's size, funding and regulatory setting.
What each line of the register should hold
| Column | What to write | Why it matters |
|---|---|---|
| Risk | An event and its consequence: "Our largest donor (38% of income) does not renew, forcing programme cuts" | A vague label such as "funding risk" can't be owned or acted on |
| Owner | One named person, not a department | Shared ownership means no ownership |
| Likelihood (1 to 5) | How likely in the next 12 months | Keeps attention on the coming year |
| Impact (1 to 5) | Effect on mission, money, people, reputation or legal standing | Impact on mission comes first, not only on money |
| Score | Likelihood × impact (1 to 25) | Ranks risks so the Board sees the top few first |
| Controls in place | What already reduces the risk, and whether it works | Untested controls give false comfort |
| Next action and date | The one step that would lower the score, with a date | Turns the register into a plan |
| Trend | Up, down or steady since the last review | Shows the Board where things are moving |
The eight areas to cover
- Funding: donor concentration, grant renewals, restricted funds, reserves below policy.
- People and leadership: dependence on a founder or key leader, succession, burnout, key-person knowledge.
- Governance: Board skills gaps, conflicts of interest, weak oversight of management.
- Financial control: fraud, misuse of restricted funds, weak segregation of duties.
- Compliance and legal: registrations, tax status, foreign-funding rules, data protection, employment law.
- Programme delivery: partner failure, beneficiary harm, safeguarding.
- Reputation: media or social-media incidents, association with a controversial donor or partner.
- Operations and technology: cyber attack, data loss, systems held by one person or vendor.
Not every area needs equal space. A small community organisation may have two lines on technology; a grant-maker may have five on partner failure. What matters is that no area is missing by accident.
Scoring without false precision
Use a simple 5-point scale for both likelihood and impact, and agree what each point means once, in writing. For example, impact 5 might mean "a programme closes or registration is at risk", and impact 3 "a delay or cost that the budget can absorb with difficulty".
| Score (likelihood × impact) | Rating | Who looks at it |
|---|---|---|
| 15 to 25 | High | Board, at every meeting, with an action and date |
| 8 to 14 | Medium | Board twice a year; management monthly |
| 1 to 7 | Low | Management; reviewed yearly |
The numbers are a way to rank, not a measurement. If two people score the same risk 6 and 16, the conversation about why is worth more than the average.
A worked example
| Risk | Owner | L | I | Score | Next action |
|---|---|---|---|---|---|
| Largest donor (38% of income) does not renew in March, forcing cuts to two programmes | CEO | 3 | 5 | 15 | Board to approve a diversification target (no donor above 25% within 3 years) by the next meeting |
| Finance head leaves; only they know the grant-reporting process | Board Chair | 2 | 4 | 8 | Document the process and train a second person by June |
| Beneficiary data exposed through a shared spreadsheet | Programme Director | 3 | 4 | 12 | Move records to an access-controlled system; remove shared links this month |
Five mistakes that make a register useless
- Too long. Sixty lines means the Board reads none. Keep the Board view to the top 5 to 8.
- Written once a year for the auditor. A register that changes only at year-end is a compliance document, not a management tool.
- Risks described as categories. "Reputational risk" tells nobody what to do. Describe the event.
- Controls nobody tests. "We have a finance policy" is not a control unless someone checks it is followed.
- No link to decisions. If the register never changes a budget, a hire or a Board agenda, it is not working.
From a register to enterprise risk management
A register is the start. Enterprise risk management adds three habits: the Board states its risk appetite (what it will and won't accept in pursuit of the mission), each top risk has an owner who reports on it, and decisions visibly change because of what the register shows. For a deeper look at risk culture, see The Resilient Institution, free to read.
Questions people ask
What is a risk register for a nonprofit?
A risk register is a short, living list of the events that could stop the organisation delivering its mission, with an owner, a score for likelihood and impact, the controls in place and the next action for each. The Board reviews it, not only the finance team.
How many risks should a nonprofit risk register have?
Usually 12 to 25. Fewer than 10 tends to miss whole areas; more than 30 means the Board stops reading. Group small operational risks under one heading and keep the top 5 to 8 for Board discussion.
How often should the Board review the risk register?
At least twice a year in full, with the top risks at every Board meeting. Review it straight away after a major event such as the loss of a large donor, a key leader leaving or a regulatory change.
What is the difference between a risk register and enterprise risk management?
The register is the tool; enterprise risk management is the habit around it: a stated risk appetite, clear owners, regular Board review and decisions that change because of what the register shows.