Risk management is often viewed as management’s responsibility and, in many ways, it is. Leaders and staff are responsible for creating safe environments, complying with regulations, protecting financial resources, responding to incidents, securing data, and managing the many risks that arise every day.
But there is another important question for boards: How does the board think about risk?
A board does not need to manage every risk. It does, however, have a responsibility to make sure the organization is thinking about the right risks, at the right level, with the right perspective. In that sense, the board’s role is less about managing risk and more about creating a culture of thoughtful risk awareness.
This is particularly important in health and human services, where organizations serve vulnerable people and where the consequences of risk can be significant. A medication error, an allegation of abuse, a cybersecurity breach, a leadership vacancy, financial instability, or a regulatory failure can affect far more than the organization itself. Each can affect the people and communities entrusted to its care.
Yet risk is broader than preventing bad things from happening.
Boards should also be asking about strategic risks: What happens if we do not change? Where are technology and AI creating new opportunities and new vulnerabilities? Are workforce challenges threatening our ability to fulfill our mission? Are changing demographics, reimbursement models, regulations, or community needs altering the sustainability of our programs? What risks are we taking by pursuing a new opportunity and what risks are we taking by not pursuing it?
This is where thoughtful governance becomes important.
A good question for a board is: Are we spending more board time reviewing yesterday’s incidents than anticipating tomorrow’s risks?
A healthy risk culture does not mean becoming risk averse. In fact, excessive caution can become a risk of its own. An organization that avoids every uncertain decision may eventually lose its ability to innovate, adapt, attract talent, or respond to changing community needs.
For faith-based organizations, this conversation also has a stewardship dimension. We have been entrusted with people, resources, relationships, and missions that extend beyond any single generation of leaders. Stewardship means protecting what has been entrusted to us, and it also means having the courage to use those resources wisely in service of the mission.
That raises an important distinction: Are we protecting the organization, or are we protecting its mission?
Sometimes those are the same thing. Sometimes they are not. A board may need to accept a reasonable amount of uncertainty to expand services, invest in technology, enter a new partnership, develop a new leader, or respond to an emerging community need. The goal is not to eliminate risk. It is to understand it, weigh it thoughtfully, and make conscious choices consistent with the mission.
Boards can help establish this culture by asking good questions rather than simply requesting more reports. Instead of asking only, what went wrong? They can ask, what are we learning? Instead of asking only, are we compliant? They can ask, where are we vulnerable? And rather than asking only what is management doing about this? They can ask, what does this mean for our strategy and our mission?
Perhaps one of the most useful questions is also the simplest: Do we know what keeps our CEO awake at night and do we know why?
A board that understands the CEO’s concerns, challenges assumptions respectfully, encourages transparency, and creates space for difficult conversations is already strengthening the organization’s risk culture.
A Board Self-Check – consider using these questions as a board discussion:
- Are we focused primarily on known and historical risks, or are we anticipating emerging ones?
- Do we understand the organization’s most significant strategic, financial, operational, people, technology, and reputational risks?
- Are there risks we avoid discussing because they are uncomfortable, uncertain, or politically difficult?
- Have we created an environment where management can raise concerns early without fear of blame?
- Do we distinguish between thoughtful risk-taking and unnecessary risk?
- Are we sufficiently aware of the risks created by doing nothing or maintaining the status quo?
- Are our risk conversations ultimately helping us protect and advance the mission entrusted to us?
The strongest boards do not eliminate uncertainty. They become better at seeing it, discussing it, and making wise decisions in the midst of it. That may be one of the most important forms of stewardship a board can offer.
By Karen Lehman, President & CEO
Share This: