The compliance spreadsheet
A 400-person international development charity manages risk through a single Excel register owned by the finance director. It is updated once a year, three weeks before the audit committee, by emailing programme managers. Risks are almost all recorded as 'financial' or 'reputational'; there are no opportunities on the register. The risk appetite statement says 'the charity is risk averse'. Meanwhile the charity runs a £6m overseas programme in two fragile states and is about to pilot a new digital cash-transfer mechanism. A safeguarding near-miss at a partner school was reported to the country director, who decided not to raise it because 'the trustees have enough on their plate'. Programme staff say risk is 'what finance does'. A trustee has asked whether the charity is 'doing risk management properly'.
1. Assess the charity's practice against MoR principles. Identify at least four principles that are breached and give the evidence for each.
Read the worked answer
Achievement of objectives. The register is disconnected from strategy and delivery: the £6m fragile-state programme and the cash-transfer pilot barely feature. Risk management should be directed at whether the charity achieves its objectives, not at producing an annual document.
Balancing threat and opportunity. There are no opportunities recorded at all. The pilot is an opportunity as well as a risk, and a register that can only record bad news cannot support a decision to innovate.
Informed decision-making. The safeguarding near-miss was suppressed, so a decision was taken without the best available information. The country director's reasoning ('the trustees have enough on their plate') is a cultural signal, not a risk judgement.
Transparent and inclusive. Programme staff are excluded and describe risk as 'what finance does'; the register is built by annual email. People closest to the risk are not contributing, and bad news is not welcome.
Dynamic, iterative and responsive to change. An annual cycle cannot reflect a new pilot or a changing operating environment in two fragile states.
Human and cultural factors. The suppression of a safeguarding near-miss is the clearest evidence that the culture discourages escalation. Any process redesign that ignores this will fail.
Tailored. One spreadsheet for a multi-country charity with very different programmes is not tailored to the risks that matter.
2. What would a principles-based approach look like in practice over the next 12 months? Be specific about artefacts and behaviours.
Read the worked answer
Rewrite appetite by category. Replace 'risk averse' with statements for safeguarding, financial, programme delivery, reputation and innovation, each with qualitative and quantitative limits approved by trustees. Without this, no one can judge whether a risk is acceptable.
Change the cycle. Move to quarterly review with event-driven updates, and require a risk section in every programme business case and decision gate. Keep a short corporate summary plus a register per programme so that local ownership is real.
Add opportunity. Require every programme to record at least one opportunity and the response to it, so that risk management is visibly about achieving objectives and not only about avoiding harm.
Create a safe escalation route. A named safeguarding lead, a defined escalation threshold, a no-blame reporting route, and a trustee-level commitment to hear bad news. Behaviourally, trustees should ask 'what did we decide differently because of this risk?' rather than only 'is the register complete?'.
Clarify roles. Trustees set appetite and challenge; the finance director supports and assures; programme managers own their risks. Train both groups on what ownership means.
Check and review. Run a health check after six months, report findings to the audit committee, and track specific improvements rather than producing another spreadsheet.
3. Reconcile the 'risk averse' appetite statement with the decision to run the fragile-state programme and the cash-transfer pilot.
Read the worked answer
An undifferentiated 'risk averse' position is not an appetite. It gives no guidance when a real trade-off appears, so in practice people either ignore it or hide risk - which is what the suppressed near-miss suggests.
Appetite should be set per objective. The charity might have very low appetite for safeguarding harm and for loss of donor funds, while accepting higher uncertainty in innovation and in operating in fragile states, because those are core to its mission. The apparent contradiction disappears once appetite is differentiated.
Test the activities against the categories. For the fragile-state programme, set low tolerance for safeguarding and cash-handling risk and put additional controls and assurance in place; accept the mission-related and security risks that cannot be eliminated. For the pilot, define what would make it stop or scale back - for example a loss threshold, a control failure, or an evaluation gate - before it starts.
Record the decision. Trustees should record that they accepted the residual risk after controls, against a stated appetite. If they are not willing to accept the residual, they should change the activity rather than leave the statement unexamined.
Behavioural test. The point of appetite is to make hard conversations possible in advance. A statement that cannot be used in a real decision is not doing any work.