A donor demanding 'ISO 31000 certification' from a humanitarian charity
Refuge Aid is a 60-person humanitarian charity running programmes in three countries. Its largest institutional donor has told it that continued funding is conditional on 'ISO 31000 certification' within the next funding cycle. The charity has a 200-page security manual written after a serious field incident, a whistleblowing hotline and an annual external financial audit. The board equates risk management with fraud and staff safety compliance. Field managers report that risk decisions are taken in the capital by people who have never visited the programmes, and that local partner organisations are never consulted. The donor requires a written response within 30 days.
1. How should Refuge Aid respond to the donor's requirement within 30 days?
Read the worked answer
First, get the fact right: ISO 31000 is guidance and is explicitly not intended for certification. No accredited certificate exists, and a body offering one should be treated as a red flag - buying a certificate would be a misrepresentation to the donor, and for a charity that is a serious reputational and potentially fraudulent exposure.
The 30-day response should contain three things:
- A short factual clarification that the standard is not certifiable, phrased without correcting the donor in a way that corners them - procurement and grants staff frequently copy this wording from templates.
- A question: what assurance outcome does the donor actually need? It may accept an independent gap assessment against ISO 31000, a maturity assessment, or a donor questionnaire completed with evidence.
- A dated plan showing what will exist and when: agreed risk criteria and appetite, a risk profile with named owners, treatment plans, monitoring arrangements, and an independent assessment by a third party at a stated date.
Substance matters more than the wording. The charity should offer evidence of a functioning framework - decisions visibly changed by risk analysis - rather than a document pack. Offering the plan alongside the clarification converts a compliance demand into a useful programme, which is the best available outcome for a 30-day window.
2. Diagnose the principles problems in Refuge Aid's current approach and propose inclusion measures that can start within 30 days and continue beyond.
Read the worked answer
The scenario shows three linked breaches:
- Inclusive: partners and field staff, who hold the most relevant information, are excluded from the process. Consultation that never happens is not communication and consultation.
- Human and cultural factors: decisions taken at distance by people who have never visited programmes will misread the operating context and will not be owned locally, whatever the register says.
- Customised: three country programmes with different legal, security and community contexts cannot share one undifferentiated approach, and the security manual is incident-specific rather than objective-based.
Within 30 days:
- Hold structured risk conversations in each country with field staff and partner organisations, in the working language, capturing context, uncertainties and existing coping strategies. Record who said what.
- Nominate a country risk focal point in each programme with standing to escalate between formal reporting cycles, and a low-tech channel (a fixed weekly call) that does not depend on new systems.
- Close the feedback loop promptly - tell the field what changed as a result. Consultation that is visibly extracted and then ignored will not be repeated in good faith.
Beyond 30 days: give country directors defined authority to accept risk within thresholds; add partner organisations to the interested-party analysis; and measure whether field-originated risks actually reach the board. If they never do, the inclusion is cosmetic.
3. The board wants to declare the security manual and the annual financial audit as the charity's risk management. How should this be handled?
Read the worked answer
Both artefacts are real assets and should be reused, but neither is a risk management framework. The security manual is incident-driven and focused on staff safety; the financial audit is point-in-time assurance over controls. Neither addresses programmatic risk - aid diversion, access denial, partner capacity, funding concentration, safeguarding - and neither addresses opportunity at all.
Handle it by building a bridge rather than an argument:
- State four or five objectives for the charity (programme delivery, duty of care, funding resilience, reputation and compliance).
- Map the existing manual and audit onto those objectives to show what is already covered, which demonstrates integration and avoids duplicating effort.
- Identify the gaps explicitly, so the board sees that the current artefacts are partial coverage rather than a framework.
Then address the board's role directly, because that is the root issue. Under the principles, the board's job is not to manage risks - it is to articulate commitment and appetite, allocate authority and resources, and scrutinise whether the framework works. A short, concrete board session using one live decision (for example, programme expansion into a new region) will do more than a written briefing.
Use the donor deadline as the lever. A board that has just discussed appetite and authority is in a far better position to answer the donor credibly than one that has outsourced the whole question to a 200-page manual.