What are the main challenges and opportunities for ERM in the social sector?

Even before a company develops or integrates a social sector risk consideration to their ERM framework, they need to determine how their culture and values are already (or should be) making statements about what they "stand for" and then, and only then, have their ERM framework promote, test, and ensure practices that are in alignment with those critical elements (i.e., culture and values) of the company. Otherwise, your ERM framework is at risk at becoming just another form of "white washing."

Risk management in private vs. public are not very different in my view. The specifics of financial and regulatory risk are slightly different but the response of senior management to the resulting risk of loss of reputation or highly paid positions is the same. For example, in my experience a public television station defrauded by a public sector union will be tempted to cover it up just as much if not more than a private television station or manufacturer. A pubic radio network diverting public funds to risky, speculative profit making endeavors will desperately try to avoid publicly admitting failure and loss just like an energy company in a similar situation.

The main challenge for Enterprise Risk Management (ERM) in the social sector lies in balancing financial constraints with the need to fulfill mission-driven objectives effectively. However, there's an opportunity for ERM to enhance organizational resilience, optimize resource allocation, and foster greater transparency and accountability in pursuit of social impact.

A unique challenge for the social sector is designing ERM frameworks that accommodate diverse stakeholder needs while addressing complex social problems. Unlike rigid frameworks used in the private sector, social sector ERM must remain flexible and participatory. By embedding a collaborative approach, social organisations can involve beneficiaries, donors, and staff in co-creating risk strategies. This fosters innovative solutions and ensures the framework evolves with changing social dynamics, creating more responsive risk management practices.

Challenges in social sector ERM include aligning frameworks with organizational values, balancing diverse stakeholder interests, and addressing complex social issues. Unlike the private sector, social sector ERM requires flexibility, adaptability, and customization to fit specific contexts and goals.

A Estrutura do ERM (Enterprise Risk Management) é crucial para o sucesso do MTC no setor social: Identificação de Riscos: Mapeie riscos internos e externos, como mudanças políticas e flutuações de financiamento. Avaliação de Riscos: Classifique os riscos por probabilidade e impacto, priorizando ações. Mitigação de Riscos: Desenvolva estratégias para reduzir riscos, como diversificação de financiamento e políticas de compliance. Monitoramento Contínuo: Estabeleça um sistema para revisar e atualizar a estrutura de ERM regularmente. Uma estrutura robusta de ERM ajuda o MTC a enfrentar desafios e aproveitar oportunidades no setor social.

Establishing a robust and continuous ERM process involving all levels and functions of the organization is a key challenge in the social sector. ERM is a cyclical and collaborative process requiring regular monitoring, evaluation, and learning, rather than a one-time or top-down effort. Resource constraints and uncertain environments in the social sector may limit data availability and quality for ERM. Resistance to change and risk-taking from stakeholders can also pose challenges. Therefore, building a strong risk culture and capacity that promotes trust, communication, and accountability among all stakeholders is crucial in the social sector.

A significant challenge is maintaining a continuous, organisation-wide ERM process amid resource constraints. In response, social organisations can adopt a decentralised approach, empowering departments to tailor risk strategies to their specific functions. Encouraging a strong learning culture where risks are regularly reviewed and adapted helps build resilience. This participatory risk culture, where even front-line workers contribute insights, ensures that ERM becomes a dynamic, ongoing process aligned with the organisation’s broader mission.

O Processo de ERM (Enterprise Risk Management) é vital para o MTC no setor social: Identificação de Riscos: Mapeie riscos internos e externos. Avaliação de Riscos: Analise a probabilidade e o impacto dos riscos. Resposta a Riscos: Desenvolva estratégias para mitigar, transferir, aceitar ou evitar riscos. Monitoramento: Revise continuamente as estratégias de risco. Comunicação: Garanta transparência e alinhamento com todas as partes interessadas. Este processo permite ao MTC enfrentar desafios e aproveitar oportunidades no setor social.

The benefits of updating ERM frameworks to include cyber risk mitigation in the social sector are immense. On top of signifying to customers and stakeholders that your organization is invested in their data privacy, which increases their trust and your overall reputation, it can also offer direct financial benefits. For instance, by quantifying your organization's financial exposure due to digital activities, your risk managers can discover the areas in which a mitigation investment would reduce the said financial exposure by an amount exceeding the investment. In other words, find cyber risk mitigation projects that produce a positive ROI. This is merely one capability (demonstrate ROI) of CRQ but still leads to a slew of other benefits.

One interesting discussion that should also be happening between a Management Team and a Board is how they want to handle the ERM report. Here, there are two polar opposites. First, you could try to have the entire ERM evaluation treated as an audit by the legal department and, as such, push for attorney-client privilege of all (doubtful) or part (potential). The other is to prepare everything with a view towards published accountability. The latter falls into the wake of the current social consciousness movement, but I propose would thwart a full review. Again, having these discussions is what's truly important and the determination should reflect the culture of the company and not a desire to appease the public.

Enterprise Risk Management (ERM) in the social sector offers opportunities to improve organizational effectiveness and efficiency. ERM enables identification and prioritization of key risks, implementing suitable responses to mitigate negative impacts and leverage positive opportunities. Additionally, ERM facilitates measuring and communicating the value and impact of social sector activities, enhancing accountability and transparency to stakeholders. It also promotes a culture of learning and innovation through encouraging experimentation, feedback, and adaptation within the organization.

Integrate ERM with strategic and operational processes in the social sector to enhance the organization's mission and vision. This holistic approach can be integrated with governance, planning, budgeting, reporting, auditing, fundraising, program design, delivery, and evaluation, creating synergies and alignment while avoiding duplication and fragmentation.

Integração com ERM é essencial para maximizar a eficácia do MTC no setor social: Alinhamento Estratégico: Assegure que o ERM esteja alinhado com os objetivos estratégicos do MTC, promovendo uma abordagem coesa para a gestão de riscos. Processos Integrados: Incorpore práticas de ERM em todos os processos operacionais, garantindo que a gestão de riscos seja uma parte fundamental das operações diárias. Cultura de Risco: Fomente uma cultura organizacional que valorize e compreenda a importância da gestão de riscos em todos os níveis da organização. Tecnologia e Ferramentas: Utilize tecnologias e ferramentas que facilitem a integração e monitoramento contínuo dos riscos.

One challenge that must be addressed on the front-end of the ERM process is whether or not the company is truly prepared to respond to the recommendations that may result. Engaging in an ERM evaluation without full commitment to appropriately respond to the risks identified is worse than never engaging at all - just think about the comprehensive and beautifully drafted Code of Ethics for Enron!

One barrier is the lack of ERM understanding and commitment, especially among leadership in the social sector. To overcome this, organisations should invest in risk champions within leadership teams who advocate for ERM's benefits, linking risk management directly to the organisation’s mission. Building internal capacity through training and emphasising cross-departmental collaboration also strengthens alignment. Regularly showcasing ERM success stories can shift the narrative from resistance to active engagement.

No sector is immune from cyber risk, and with cyber attackers increasingly targeting critical infrastructure (seeking to cause maximum societal damage), incorporating cybersecurity risk management into the social sector's ERM framework is paramount. However, due to its more technical nature, it can be challenging. Board members and other executives are more accustomed to managing other forms of risk, such as financial, reputational, and political, which are discussed in a broader business language. The solution to this challenge is simple: adopt a cyber risk quantification platform that can translate technical cyber risk terms into this more commonly used language, including event likelihood and financial exposure.

Challenges in ERM adoption and implementation for the social sector include lack of awareness and understanding among stakeholders, absence of leadership commitment, insufficient resources and expertise, lack of alignment among departments, and inadequate incentives for ERM practices.

The ERM process is a wonderful opportunity to align the organization around risk/response, opportunity/outcomes, and action/accountability. That being said, it is not a process to begin without full commitment from the Board and the Executive Team. There is no doubt that learning will come from the excercise and the response to that learning by a lukewarm leadership group will be as damaging as any failed initiative by the company, with the added impact of making employees feel that there work and effort were superfluous.

A practical solution for ERM in the social sector is starting with small, tangible ERM pilots that demonstrate value to the organisation. By showing early wins, it becomes easier to secure leadership buy-in and allocate more resources. Regularly updating risk frameworks to reflect ongoing learning, while promoting a culture that views risk-taking as an opportunity for innovation, will ensure ERM is embraced. Rewarding departments for proactive risk management creates an incentive structure that encourages continuous participation.

Possible solutions for leveraging ERM in the social sector include raising awareness among stakeholders, developing a clear ERM vision and strategy, allocating sufficient resources, establishing roles and accountabilities, fostering coordination, and creating a positive risk culture that encourages learning and innovation.

Soluções ERM para o MTC no setor social: Plataformas de Software: Utilize softwares dedicados de ERM que ofereçam funcionalidades para identificar, avaliar, monitorar e reportar riscos. Consultoria Especializada: Contrate consultorias de ERM para obter insights especializados e soluções personalizadas para a gestão de riscos. Treinamento e Capacitação: Invista em programas de treinamento para educar a equipe sobre as melhores práticas de ERM. Automatização de Processos: Implemente soluções automatizadas para monitoramento contínuo e resposta rápida a riscos emergentes. Essas soluções ajudam o MTC a gerenciar riscos de forma proativa e eficaz, promovendo resiliência no setor social.

I feel that when it comes to the social sector, ERM needs to adopt a broader canvas. The traditional financial risk considerations are not enough and quality aspects need to be addressed as well. Another overriding concern is educating the donors and gaining their support for sustainable ERM initiatives. Furthermore, the social sector might not be able to attract high-quality talent and hence needs to focus on strengthening its brand and talent acquisition in the first place.