Implementing Practical Risk Management: A Guide for 501(c)(3) Nonprofits, 0414 RIBJ, 62 RI Bar J., No. 5, Pg. 5

• Author: Andrew C. Spacone, Esq., Adler Pollock & Sheehan PC. Providence. Robert I. Stolzman, Esq., Adler Pollock & Sheehan PC. Providence.

Implementing Practical Risk Management: A Guide for 501(c)(3) Nonprofits ^[1]

Vol. 62 No. 5 Pg. 5

Rhode Island Bar Journal

April, 2014

\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0 March, 2014

\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0 Andrew C. Spacone, Esq., Adler Pollock & Sheehan PC. Providence.

\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0 Robert I. Stolzman, Esq., Adler Pollock & Sheehan PC. Providence.

\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0Nonprofits are proliferating at a significant rate across the country. Rhode Island is no exception^[2] Unfortunately, nonprofit organizations, like their for-profit counterparts, are exposed to a multitude of risks. While nonprofits do not measure their success in terms of shareholder value, as most for-profits do, their ability to accomplish their mission and purpose is heavily dependent on their financial and organizational health. Thus, they can ill-afford to suffer losses or liabilities (e.g., loss of tax-exempt status³ ) occasioned by adverse legal and related events, especially because many nonprofits already are operating with limited resources. Indeed, recent statistics reveal that nearly one-fifth of Rhode Island nonprofits have annual budgets and assets exceeding $1M.⁴

\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0This article provides guidance to nonprofit organizations and their boards on how to manage legal and related risks more efficiently and cost effectively to reduce their liability exposure by practicing sound risk-management strategies. As one notable treatise succinctly states, "...risk management is one of the board's primary oversight functions'.'⁵ A nonprofit's anticipation of risk coupled with a prudent risk-management strategy to eliminate or, at least, mitigate risk can directly support its ability to accomplish its mission.

\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0The proposed risk-management strategy consists of a three step review process designed to quickly identify potential problems fairly quickly and focused on practical, cost-effective solutions. For high-risk organizations in particular, an outside lawyer under privilege is recommended to conduct the review. The review process is also designed for use by non-lawyers as well, subject to certain important considerations.

\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0Step one entails a review of the organization's activities and board to determine material areas of potential risk. This assessment's objective is to identify the critical risks the organization and its board face. This assessment can be accomplished fairly quickly using a simple, yet robust, checklist listing the major areas most nonprofits encounter, such as: the nature and recipients of provided services; the number of employees; the size of the organization's budgets and financial holdings; and its sources of income.^[6]The results of the initial risk assessment may require a more detailed review of those identified areas, leading to step two. If high-risk areas are identified, a more detailed review to determine if potential problems exist may be warranted.

\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0Step two focuses in detail on the identified major risks. In this phase, once the reviewer identifies the organization's general exposure, the reviewer uses a highly-detailed and developed checklist laying out a function-by-function review process for those areas and situations requiring remediation or improvement. At this point, the reviewer is moving from a macro-level analysis to a more detailed or granular analysis.

\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0In step three, the reviewer communicates the results of the review process to the board of directors. This may consist of simply identifying the high-risk areas or suggesting potential actions for addressing the risks. Either option allows the board to conduct an informed cost benefit analysis to determine its overall risk exposure to implement or refine its risk-management strategy. If policies and procedures are part of the solution, there are sample protocols available that can be tailored to the organization's business and needs, which, in itself, will save the organization money.

\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0We do not intend to unduly alarm nonprofit organizations. Nor is it our intention to denigrate the highly laudable work Rhode Island's nonprofits do for our communities. Nonprofits are an important part of the Rhode Island community, and those involved in these honorable enterprises are motivated by the purest intentions. We are aware of the imperative of maintaining the unique cultural aspects of nonprofits, particularly charitable organizations. The individual culture of nonprofits, their mission, constituents and scope of services, represent the lifeblood of these organizations and the very essence of their strength and commitment. Care must be taken by lawyers to avoid, or at least minimize, harm to that important culture. That said, it is the authors' intention to raise awareness that Rhode Island nonprofits face unforeseen legal risks, which they may not be e quipped to handle given their limited budgets and staffs.

\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0Many nonprofits operate for many years without any major legal setbacks or related losses. While this may be true, this mindset can lead to cognitive dissonance, (i.e., the belief that, because nothing bad has happened before, bad things will never happen.) Often accompanying this mindset is the belief that charitable organizations are immune from the civil justice system. Often, many nonprofits are simply unaware of looming legal problems due to a general lack of understanding and expertise regarding legal requirements^[7]and related risks. Further, without the internal expertise or budgets to sustain resulting losses, many nonprofits are ill-prepared and vulnerable when legal problems arise. Even if the organization is sufficiently equipped to deal with legal problems on a case-by-case basis, constantly being on the defensive is not a productive strategy. At a minimum, legal problems can disrupt a nonprofit's operations, which, in turn, can lead to unnecessary losses in productivity, further undermining the organization's ability to pursue its mission. At worst, the organization becomes unable to carry on.

\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0\xA0In the authors' experience, most legal problems afflicting nonprofits are foreseeable and avoidable, provided the board employs reasonable risk-management strategies. Good risk-management starts and ends with the board's oversight and responsible governance. Unfortunately, because nonprofits rely on volunteer boards, volunteer members, and even volunteer professionals, many boards, including sophisticated ones, inadvertently overlook the legal and operating risks they face and, as a result, cannot prudently manage those risks. By engaging in preventative action to identify and promptly correct potential risks before they mature into liabilities, boards can protect their organizations from avoidable losses. Responsible governance ensures that the organization obviates unnecessary risk. Risky behavior can adversely impact the organization's reputation...