Board service today demands more than traditional oversight; it requires a proactive approach to navigating complex and evolving challenges. From financial stewardship to strategic decision-making, board members play a pivotal role in shaping organizational resilience.

One area that often takes new or even seasoned members by surprise is risk management. While it may not carry the immediate allure of strategy or innovation, understanding and addressing risks is fundamental to ensuring long-term success. For new or even experienced board members, learning risk management is a crucial function of board service.

After all, as Patrick Downes, a managing partner with corporate governance firm Governance Ireland notes, “Risk management might not sound like the most thrilling topic for many boards, but in truth, it’s one of the most important conversations we should be having. And, done right, it can be surprisingly powerful.”

We asked experts in both voluntary and elected board service to share what board members should know about risk management and how they should be prepared to act.

Risk management is a core board responsibility

Dr. Chad Bledsoe, President, Montgomery Community College, NC:

 “Ultimately the board has the responsibility of ensuring that the institution is meeting its mission. And that can't be done without adequate oversight of financial resources, of the risk that we all take on, whenever we talk about providing services, equipment, training, employing teachers, all of that.”

Dr. Froswa' Booker-Drew, President, Soulstice Consultancy: 

“It’s more than just discussing great status reports and updates of what a board does; it is about making sure that the organization is not placing itself in a position of liability, that the organization is aware of all the risks that may exist and how they can put in protocols to ensure that the organization is able to continue its mission.”

Risk management is part of the fiduciary responsibility held by every board member — the legal and ethical duty to act in the best interest of the organization. A skilled approach to risk management protects the financial, reputational and legal status of the mission-driven organization or municipality.

The board and administrators should begin with a shared understanding of what risk management is and how the board should approach it. Keep information about your organization’s risk management efforts in an accessible, consistent location, like your board management solution.

Risk management education is crucial for boards

Gwen Dombroski, Manager of Legislative Services/Clerk, County of Renfrew, Ontario:

 “Legal and regulatory compliance is a critical component of risk management for public boards. Members must be well-versed in relevant laws, acts and regulations. This requires educating yourself on the board role and often relies on guidance from staff, other seasoned board members or legal experts. I feel the educational aspect is essential for informed decision-making and protecting both yourself and the board from legal repercussions and public scrutiny.”

Andrea Walsh, Senior Director, Mission Driven Organizations, Diligent: 

“A lot of risk comes down to ensuring that the fiduciary responsibility is exercised effectively. But risk comes in lots of forms as well, and having the capacity to understand and ensure that the board is well informed on all of the activities involved in the strategic direction is critical.”

A board can approach risk management effectively with the right training — both onboarding and in regular development throughout member service. Everboarding, which creates opportunities for learning throughout the board service lifecycle, is also an effective approach to keep members up to date on risk management and engaged with the topic.

Risk management should be reasonable and realistic

Maya Tussing, Partner and Co-Founder, Fairlight Advisors: 

“One risk boards face is simply not having realistic budgets, where they're not considering the financial impact of risks. Many nonprofits own real estate and don't calculate the costs of owning that real estate. Or they are leasing their property and haven't thought about what if their landlord is going to raise their rents and their options if that happens. Can they even move? Maybe their mission is focused on the community in that area, and, if zoning changes or rents rise, they can't leave and go virtual or move to another community. These are risks that they have to embed into their budgets and to their risk management platforms or programs.”

“Risk management can be a very tricky area to get right for their organizations. I have seen risk management systems that on paper look very sophisticated and comprehensive but are far too complicated and difficult to manage. As a result, they do not really help the board in their risk oversight responsibilities. I have also seen situations where boards do not systematically look at the risks their organizations face and agree how best to manage and mitigate those risks. The challenge is to develop a risk management system that is appropriate and manageable for your nonprofit.”

The leadership team’s shared understanding of risk is a core component in ensuring the organization’s risk management plan is comprehensive — but not overwhelming. Boards must understand the real risks their entities face and put their efforts into plans that avoid or minimize those risks. The goal is to achieve the right-sized risk management plan for your entity.

Build organizational resilience and drive smarter decisions with our essential guide to governance, risk and compliance. Packed with actionable tips and best practices.

Safeguard your organization

Risk management is a tool for public engagement and building trust

Margaret Corbett, Deputy City Clerk, City of Niagara Falls, Ontario:

 “We think about what we are at risk of doing and what is the potential harm if we are not acting in a responsible manner. So, as council and staff, we work together to make sure that we're supporting each other appropriately, especially for the overall benefit of the citizenship.”

Steve Schroeder, Board Member, Sun Prairie Area School District: “Most boards delegate risk management, in the traditional business sense, to the administration. That said, I think the board needs to be concerned about risk from the perspective of the image of the board and the school district.”

 “Handling public funds requires oversight and accountability. It is important to engage with audits and pay attention to financial reports to ensure fiscal responsibility. Due to the public nature of these roles, members are subject to public engagement and questions, especially with public funds, which can impact personal lives and professional reputations.

“Public-facing boards, particularly within the public sector, must maintain a high level of transparency to uphold public trust. It is crucial to become well-informed in your position and seize every opportunity for training to stay knowledgeable in your role. Many board positions are voluntary or offer a nominal stipend, requiring you to balance these responsibilities with your professional roles. This can potentially lead to conflicts of interest or added pressure from your primary occupation, alongside increased scrutiny.”

Risk management very much falls under the umbrella of public accountability and representing the organization well. For public boards, this means managing relationships with the electorate, but for private organizations, the board is still accountable — to donors, volunteers, government oversight and more. Developing a risk management plan, and sharing it where appropriate, can build relationships with the very stakeholders your board relies on for support. Keep your risks plan in your board management software so it can be easily found by board members and key stakeholders.

Risk management is more than preventing harm

Scott Bridgen, Managing Director Audit and Risk, Diligent: 

“Ninety-nine percent of the world focuses on negative risk, and understandably so. But we could potentially do more. We could say, for example, reduce the time frame. We could take more risk because we will be able to make informed decisions because we understand how deep we need to go to make those decisions. Ultimately that's what we're trying to do, make better business decisions. And both sides of risk management give us the ability to do that.”

“In my experience when people hear ‘risk’, they often think of disaster planning or worst-case scenarios. But to my mind that’s only half the picture. Good risk management is about asking, What are we trying to do? And then being honest about what could get in the way — or what might happen if we don’t act.” - Patrick Downes, Managing Partner, Governance Ireland

Well-meaning boards can err by thinking of risk management as simply avoidance — avoiding the potential harms that come from, say, cybercrime or environmental disaster. But risk management also requires fully understanding where the organization wants to go and removing obstacles to getting there. Unsurprisingly, this is why risk management falls in line with the board’s strategic work.

Some organizations create risk management subcommittees, but whether or not your organization pursues that structure, teams must ensure risk-related work is not done in a vacuum but is fully integrated with the bigger-picture thinking of the board.

Dottie Schindlinger, co-founder of Board Effect and executive director of Diligent Institute:

 “Sometimes it's not fraud and abuse. Sometimes we've strayed a little bit from our mission to try to go get this one grant fund because look, that money's available and we really need that money. And that's called mission creep. Suddenly we start to add to our mission to go get those dollars. And it's really important that the board is there to help steer the organization and safeguard against those sorts of things.”

The ultimate purpose of risk management is to establish the best possible circumstances for your entity. While this means avoiding bad outcomes, it also includes setting up your organization or entity to succeed.

After all, what is a missed opportunity if not risk? This thinking reaches the heart of the strategic thinking the board undertakes, and the question “Where do we want to go?” should be a part of all discussions.

Be prepared to act on possible or imminent risk

Andrea Messina, CEO, Florida School Boards Association:

 “It is always the responsibility of board members to mitigate and manage risk. Sometimes, that comes in form or reporting to legal or HR something that may have been heard in passing or even deliberately shared with a board member. I like to remind board members that if they hear something and fail to report it and it happens again, they, too, now are culpable. Board members need to set the example for risk mitigation if they ever expect others to manage risk effectively.”

Maya Tussing, Partner and Co-Founder, Fairlight Advisors:

 “What are some risks? Well, there are plenty. For example, you can have a key person risk. It can be a major hit to an organization if an executive director or a very successful fundraiser leaves. Many fundraisers rotate every four to five years because they have to refresh their donor base. Those are risks that are natural, and nonprofits should be prepared for them. However, a lot of organizations are not prepared for that.

“Other risks can be legal challenges or regulatory challenges, particularly for nonprofits that are supporting or servicing at-risk communities or communities that have high regulations like children, seniors, those in the healthcare area.”

Having a risk management plan in place is just the beginning. Board members should be ready to act on the plan when situations call for it. After all, a plan is no more than pieces of paper — or document in your board management system — if it doesn’t trigger immediate steps.

Boards should have regular conversations about risk management

Patrick Downes, Managing Partner, Governance Ireland:

 “For volunteer boards, many of whom are juggling roles, responsibilities, and real-world constraints, it’s easy to treat risk as something that sits in the finance or audit file or with the audit and risk committee. But actually, I think that risk should be part of everyday conversations – not a tick-box exercise once or twice a year.”

 “Developing a good and robust risk management system, using best practice templates relevant to your nonprofit is only the start of having an effective risk management system in place, it needs to be understood, owned and embedded into the governance systems. An effective risk management system is one where the board takes one of its key risks from its risk register at each meeting of the board and has a robust and informed assessment of the risk and its management. As in many key governance tasks, the quality and rigor of the assessment can be much improved by having a board sub-committee with specific responsibility for risk management and for preparing the analysis to assist the board in its assessment of the risk.”

Risk management is not a one-and-done board topic. Build risk discussions into every board meeting. This is easy to do with software that streamlines your meeting agendas, along with an accessible document library that all board members can access.

Experts share their thoughts on board engagement

Experts tell us why technology matters for community transparency

Experts share their thoughts on ethics for the publicly elected board

Experts share their thoughts on board development

Benefits of using your board management software to help support risk oversight for the board

A feature-rich board management solution like Diligent Community includes tools that help the board’s risk management efforts.

With a single dashboard for information and action items, the software interfaces ensure every member knows their current priorities and due dates. Easy-to-use templates allow administrators to create board books quickly and implement recurring discussion topics without unnecessary effort. A searchable document library can store training opportunities, with automated tasks prompting members to complete their training.

Additionally, with granular permissions and quick publishing, documents about your board’s risk management actions can be shared with important stakeholders or the public.

As a Diligent Community customer on the Diligent One Platform, your board will also be able to access Diligent AI Risk Essentials, helping to simplify risk oversight with AI-powered benchmarking to identify relevant risks quickly and help with guided onboarding and educational resources.

Risk management is a core duty of both elected and volunteer boards. With the board management features offered by Diligent, your organization can take a more effective, efficient and successful approach to avoiding and mitigating risk. 

 when we can introduce you to one of our board management solutions.

Experts share their thoughts on risk management for mission-driven boards

 Activism newswire. To register for a demonstration and trial of the product,

Earlier this year, White & Case expanded its team to become a tri-continental shareholder engagement practice. Below, DMI discusses the evolving global activism landscape in the U.S., Europe and Asia with New York-based partner Richard Brand, London-based partner Tom Matthews and Tokyo-based partner Nels Hansen, who lead the U.S., U.K./Europe and Asia practices, respectively.

What is the importance of having the first tri-continental shareholder activism practice?

: Governance practices have evolved differently in different jurisdictions, but our clients, regardless of where they sit, are investing globally. By having a coordinated, strategic approach to advising investors around the world, we can leverage our experience in different jurisdictions for the benefit of our clients, while providing seamless service that is calibrated to the unique goals and considerations of clients we regularly work with.



Do you see U.S. activists targeting U.K. and Japanese companies in even greater numbers?

: U.S. activists have been responsible for some of the highest profile campaigns in the U.K. market in recent years and we anticipate this trend continuing in the coming years.



: We have seen some U.S. activists approaching Japanese companies, but there is a learning curve and only a handful have been repeat players here to date.



How about the reverse - foreign activists targeting U.S. companies?



TM: European and other foreign activists have historically conducted relatively few campaigns in the U.S. market. Our experience allows us to guide investors through the complex U.S. regulatory landscape, but there remain practical obstacles for investors seeking to enter the U.S. market (not least the cost of acquiring and holding a meaningful stake in listed U.S. companies, many of which have much larger market capitalizations than companies in other markets).



With the recent SEC guidance on 13D reporting, is the bar now even higher for institutional investors to back activists?



RB: The large passive funds have become more supportive of management in recent years, and there has been a divergence in voting behavior between the actively managed and the passive funds in contested situations, which cannot be explained solely by different interests or investment time horizons. The recent SEC guidance puts a spotlight on the important role that passive investors play in determining the outcomes of proxy contests and complicates efforts for both sides to engage with them.



Could that mean activists are more likely to aim for settlements?



TM: It is possible that reduced certainty as to where other investors stand may in some situations add to the desirability of a settlement, depending on how market participants ultimately react to the new guidance. In any event, we have been seeing a trend across the globe over the past few years towards increased private engagement and settlement between activists and companies, and we anticipate this trend continuing.



Are "white knight" transactions always a defensive move or an endorsement of the need for activists?



RB: “White knight” transactions are still few and far between and can be extremely risky for a company to attempt, because, if viewed as primarily a defensive measure, they can generate support for an activist across the rest of the investor base and lead to the very outcome that the transaction was designed to help avoid – the loss of a proxy contest.



While more U.S funds are said to be broadening their horizons to look for new opportunities in Europe, how are they adapting their engagement style?



TM: U.S. funds pursuing activism campaigns in the U.K. and Europe encounter a significantly less litigious environment, where campaigns are largely conducted through private and public engagement and in some cases proxy contests, with court involvement being much rarer. With a relatively low share ownership threshold for requisitioning ad hoc shareholder meetings in the U.K. and Europe, there is also significantly less emphasis on an annual proxy season.



What challenges do they face in certain European jurisdictions?



TM: Each European jurisdiction has its own legal, regulatory and cultural framework that impacts how best to conduct an activist campaign to maximize chances of success. In this context, some of the major markets in continental Europe are notably less straightforward to implement activism campaigns compared with the U.K. For example, the dual tier governance structure in Germany (with separate supervisory and management boards), as well as the division between the respective competences of shareholders and the board, can make it more difficult for an activist to bring about desired changes without a negotiated settlement.



In the Asia market, regulators have become more accepting of activism. Could that possibly change as we see more activists operating in the region?



NH: Regulators have a diverse array of stakeholders and opinions. In each market there is always a lobby of companies who oppose shareholders telling management what to do, and Asia is no exception. This lobby’s ability to hamstring shareholder activism and engagement varies based on a number of factors, but more activism can mean more companies who have a score to settle. It can also mean more success stories of companies that have been positively transformed with attendant benefits for the economy. We will see whether asset owners – including pension funds responsible for the livelihood of a growing portion of the population across aging Asia – are able to prevent such actions by aggrieved corporates in the years to come.



Board independence and qualifications are seen as key challenges in the Asia region. What are investors pushing for in this regard and what roadblocks are they facing?



NH: Investors have a concern that board members are serving the CEOs to receive a cash salary, and not the shareholders. Some investors ask to compensate board members in stock. Some investors ask for board members to be found by executive search firms rather than friends of the CEO, or to have real executive experience rather than being a professor, accountant or lawyer. Roadblocks vary but a big one in many boards is that CEOs are happy with boards they and their friends chose.

Diligent

Blog

Experts share their thoughts on risk management for mission-driven boards

IN-DEPTH: White & Case on its expansion to a tri-continental shareholder engagement practice

Your Data Matters