Archive for February, 2012

Small Charities And Risk Management

February 23rd, 2012

The effective management of risk is an essential part of the responsibilities for trustees of charities and is often overlooked by those responsible for managing the smaller charity.

Risk is an event or action that may adversely affect an organisation’s ability to survive or compete in its market or to maintain its financial stability or its positive public image and the overall quality of its people and services. Risk can also arise from a failure to exploit opportunities or from a breakdown in operational controls and procedures.

The requirement to manage risk

For registered charities the Charities SORP (Statement of Recommended Practice) sets out the reporting requirements for trustees on the

1. identification of major risks
2. the review of risks
3. the systems or procedures established to manage risk

It is therefore essential for all charities that they have a sound risk management policy

The role of the trustees

The responsibility for the management and control of a charity rests with the board of trustees. The board’s involvement in the key aspects of the risk management process is essential. Trustees do not have to undertake each aspect of the process themselves. Their level of involvement should be such that the trustees can make the required statement on risk management in the statutory annual report with reasonable confidence.

» Read more: Small Charities And Risk Management

Security Risk Management – 10 Million Years of Evolution and Still We Fear the Wrong Things

February 11th, 2012

So just what is this thing called security risk management (SRM)

The Security Risk Management Body of Knowledge defines security risk management as the culture, processes and structures that are directed towards maximising benefits and minimising adverse effects associated with the intentional and unwarranted actions of others against organisational assets.

While technically true, this definition still does not tell us what that means to the average person. In his article, ‘The Psychology of Security’ , Bruce Schneier observes that Security is both a feeling and a reality. And they’re not the same. Getting closer to the truth of the matter now – or at least to a useful definition.

Security is arguably the form of risk management with which we as humans should in theory have the most experience. Well before the ISO31000 Risk Management Standard or even concepts of occupational health and safety risk management, financial risk management, health risk management, and so on, our cave dwelling ancestors had to learn to manage life and death risks from predators, rivals and other clans.

After a million years of evolution we are now the proud possessors of a finely tuned reptilian brain which can generate fight or flight decisions in an instant. Ideal for facing (or fleeing) the sabre-tooth tiger, evaluating the threat of strangers walking into your encampment and a host of immediate ‘in your face’ risks, the amygdala has served us well.

» Read more: Security Risk Management – 10 Million Years of Evolution and Still We Fear the Wrong Things