Over the past tumultuous year, the charity sector has realised how a single volatile and unexpected event can suddenly appear, and severely disrupt its plans and strategy. We asked the Institute of Risk Management, who spoke at our first CFLF event back in February 2020, how can charities identify and assess the potential impact of emerging risks and be better prepared when the next disruptive event comes along?
Identifying and Tackling Emerging Risks
by Alyson Pepperell Co-Chair of the Institute of Risk Management (IRM) Charities Special Interest Group (SIG)
Co-author Paula Karlsson-Brown, Co-Chair on the Charity Risk SIG, Institute of Risk Management, and lecturer at Glasgow University
The world does not stand still for any organisation – even those in the charity sector. Those that have processes ready to respond to change are generally more resilient than those that do not.
There seems to be a general atmosphere of fear and mystique around an emerging risk that remains just over the horizon, which makes us feel uncomfortable. There is often little data on which to base the risk response, making emerging risks appear more challenging to identify, assess and manage. So, we thought, let’s tackle this in our next Charity Special Interest Group publication series.
The past twelve months have underlined why charities need to identify and assess emerging risk differently than ‘business as usual’ risks.
The world of risk management is continuously evolving and adapting to change. Our aim at the IRM with the emerging risk publication series is to support and enable the charity sector to survive and thrive, enabling charities to innovate and react with agility to change rather than to stagnate and rely on the ‘same old, same old’.
This article summarises our first publication in our emerging risk series, focusing on how charities can go about identifying and tackling emerging risk. The remaining publications in the series will focus on the latter stages of the risk management cycle and how to embed emerging risk thinking into charities and the role of the board of trustees in all of this. These will be published by the IRM over the next few months.
First, what do we mean by an Emerging Risk?
Emerging risks have characteristics that differentiate them from ‘business as usual’ risks. The below example may help understand what we mean and uses the Covid-19 pandemic as an example.
Emerging risks may arise and evolve quickly, unexpectedly, or both. The emerging risk may never happen at all. Emerging risks may have a massive economic loss potential at a macro level for society and subsequently may impact charities directly or indirectly.
There are generally three categories of emerging risks:
1. A new risk in a known context: Risks that emerge in the external environment and impact the organisation’s existing activities. For example, you were aware that regulations relating to your activities will change next year.
2. A known risk in a new context: The management of a risk may need to change if you venture into a new activity. For example, your charity already works with vulnerable adults and decides to start running a crèche for the children of employees and volunteers by the end of their current strategy.
3. 3. A new risk in a new context: Risks not previously considered because the risk is new to the organisation.
Emerging risks may be difficult to manage, as the assignment of risk ownership can be complex and unclear.
What organisations can do is translate the vagueness of an emerging risk into an organisational risk that they are more familiar with, e.g. regulatory, strategic and operational risks. This makes it easier to take action to tackle the risk, as it means that responsibility for the emerging risk can be redistributed to appropriate levels and people within an organisation.
What techniques could you use?
Identifying emerging risks can be difficult, but techniques exist to help, such as PESTLE, SWOT and horizon-scanning. A charity can adopt one or more of these techniques as well as looking at external sources. For example, the World Economic Forum (WEF), the IRM, the Institute of Chartered Accountants of England and Wales (ICAEW), Deloitte, and other accountancy/consulting firms may have useful information available.
Let’s explore each technique in turn noting that in reality you may not need to use all three but if you do some can be undertaken simultaneously as they are complementary, whereas others are most useful as stand-alone exercises.
We recommend you select one or more that works best within the context of your organisation and work with a range of stakeholders and subject matter experts who can provide a broad range of insights and inputs.
PESTLE Analysis helps you to identify external factors in the following categories:
· P - Political
· E - Economic
· S - Social
· T - Technological
· L - Legal
· E – Environmental
It can also provide structure for horizon scanning. The technique enables an organisation to think about potential emerging risks within categories and often helps people to think more broadly. The following table shows how the technique is used.
SWOT analysis is a technique that can help an organisation understand its strengths, weaknesses, opportunities and threats. SWOT analysis is a simple and recognisable approach that can be a useful framework for thinking about the PESTLE factors. SWOT supports the identification of risks providing a broader perspective on factors that could affect strategy or operations and assists you to develop a good understanding of impact as a gateway to consider what can be done to minimise negative effects and maximise potential opportunities.
When using this technique, simply bring together relevant stakeholders and capture their insights, in a straightforward table. For example, if you focus on the strengths, weaknesses, opportunities and threats in relation to a particular PESTLE factor, such as Legal, you will want to involve stakeholders with legal expertise.
Example scenario: We know of an emerging risk because the government has announced a key regulation that applies to our charity is going to significantly change in a year’s time. This announcement was made following some high-profile cases of non-compliance with existing regulation and harm to beneficiaries. However, we don’t know any of the detail when we undertake our PESTLE/SWOT analysis. The SWOT summarised below identifies one of our key weaknesses, i.e. we are not good at complying with the existing regulations and don’t have systems in place to monitor our compliance.
Horizon scanning is a technique used across a wide range of sectors to help identify a range of potential issues and risks that could impact the organisation in the future as a result of the complex and connected world in which the organisation operates.
We define horizon scanning as. A systematic examination of information to identify potential threats, risks, emerging issues, and opportunities.
Horizon scanning can help a charity foresee and examine risks immediately ahead of the organisation, within timeframes, e.g., where is the emerging risk in the short, medium, and longer term? Horizon scanning can also help an organisation:
· Deepen their understanding of the driving forces affecting their charity’s future policy and strategy development.
· Identify gaps in understanding and risk areas for research to better understand the driving forces.
· Build consensus among a range of charity stakeholders about the issues and how to tackle them as well as mobilising stakeholders to take action.
· Identify and clarify some of the difficult policy/strategy choices and trade-offs that may be needed in the future.
· Create a new strategic approach for your charity that is resilient because it is adaptable to changing external conditions.
The IRM Innovation SIG’s Horizon Planning publication provides useful in-depth workings for how to use this technique. Our emerging risk publication also includes a Horizon Scanning example specific for charities, within Appendix One, with Appendix Two providing a list of emerging risks identified by others along with considerations that a charity might wish to make.
The recent pandemic brought emerging risks firmly into everyone’s focus with many pundits confirming that those who survive and thrive demonstrate certain qualities consistently. These include:
· Being prepared
· Taking decisions carefully but quickly – acting nimbly
· Enabling change
What better way to do this than having an emerging risk management process in place within the organisation. We hope this introductory article helps readers to start to think about emerging risk (if you are not doing so already) and that you will look out for our initial and future publications on the topic.
1 Hopkin, P. (2018) Fundamentals of Risk Management: Understanding, evaluating, and implementing effective risk management. 5th edition. IRM. Kogan Page: New York.
2 Hardy, C. & Maguire, S. (2020) Organizations, risk translation, and the ecology of risks: the discursive construction of a novel risk. Academy of Management, Vol. 63(3), 685-716.