An Introduction to Social Enterprise Risk Management (guest post)
Social enterprises need to manage risk like any other business. And while the risks that social enterprises face may be similar to those of a traditional business, there might be differences due to the activities in-hand or the service users. Risk management is a key tool for protecting your social enterprise. Elaine Denny, CaSE Insurance‘s very own social enterprise expert, offers some invaluable advice.
There are many approaches to risk management, but most important is that your social enterprise approaches this subject with a clear head and an objective mind. The fundamental questions that you should be asking yourself are what you may lose or suffer (the event), how likely it is that the event could materialise (the frequency) and the extent to which you can afford that event occurring (the impact).
Insurance is only one stage in the risk management process and irrespective of insurance, risks still require careful and considered management.
The first stage in managing risk lies in identifying the risks that reside within your social enterprise. What situations might stop your social enterprise from operating? What losses might create one-off costs which would stretch your cash flow? What liabilities have the potential to damage your social enterprise? In which circumstances might the interjection and support of an insurer help your social enterprise? A good way to identify risks is to get your board or management team to carry out a brainstorming exercise.
Once you have reviewed the risks that your social enterprise faces, you should set up a simple spreadsheet to serve as a risk register, with a basic scoring or rating mechanism. This will be a fluid document that should be regularly reviewed, critiqued and added to. The register identifies key areas of risk in terms of their potential frequency and impact. This will help highlight issues that require attention in order of priority and identify factors which will help mitigate the risks.
Use the risk register to help create a Business Continuity Plan (BCP). This should look at the major risks your social enterprise could encounter and how you will react if any of them materialise (including internal and external communication). The aim of the BCP is to keep your social enterprise running smoothly if there’s a problem. The BCP will be specific to your organisation but should identify responsibility for the Business Continuity Plan and a crisis management hierarchy so it is clear who is in charge when the BCP is triggered.
Your BCP should consider the impact on income and cashflow, the impact on effectiveness, staff, customers and service users and the impact on reputation and stakeholders that may arise because of big risks. Don’t forget to consider the IT (both software and hardware) implications of big risks!
To remain up-to-date and relevant to your developing social enterprise, your risk register and BCP should be regularly reviewed at board and senior leadership level.
When your risk register and BCP has been created, your management team can consider and agree upon an insurance purchasing plan. This allows you to match the insurances you require to the risks you face and highlight any uninsured risks to ensure they are dealt with appropriately.