Risk, compliance, and privacyProtect whatyou hold.
Some nonprofits hold the deepest parts of people's lives, some joyful, some horribly traumatic. Those people deserve to be kept safe.
Confidentiality comes first.
- A trauma history.
- A relative's crimes.
- A past someone is ashamed of.
Confidentiality is step zero. It has to exist before anyone can begin to think about the work itself.
A family opens up with what hasn't been shared before because it trusts the record will stay closed. Confidentiality makes the rest of the work possible.
Where risk work fails
The usual failure is an assessment that gets done and then filed away.
- The risk assessment summary is read, but nothing changes.
- It never reaches the board.
- It reaches the board buried on page seventy three of a hundred-page packet, where no one finds it.
Assessing once and not fixing what was found is worse than never assessing at all.
Measure, fix, measure again.
Good risk work is a cycle, measured against a test no one inside the building wrote. For health privacy, that test includes the HHS Security Risk Assessment.
- Measureagainst an independent test.
- Fixwhat the measurement finds.
- Measure againuntil what remains is risk the board has looked at and chosen to accept.
Measuring risk belongs to an independent party, because no one grades their own work well. The assessment produces a report and sometimes recommendations. Acting on them is management's job, and oversight is the board's.
Where risk lives
Information and systems
More of the record lives online every year, and the surface open to attack grows with it. IT leadership belongs at the table from the first question, not called in afterward to patch what the assessment found.
Money
Without adequate capital, an organization cannot keep its promises through a bad year. Internal controls decide whether a mistake gets caught.
Fraud is rampant and getting bolder and more sophisticated: one email asking to change a vendor or employee's bank account can cause huge financial and reputational damage. Verifying every change to bank details, by phone, at a number already on file, and training everyone who handles payments and payroll are the cheapest protection an organization has.
Programs and practices
Risk prevention means asking, program by program, which practices carry risk, and making a calculated judgment about whether each is worth continuing. Some are. What matters is that someone decided.
Insurance
What cannot be prevented can be transferred, and insurance is a large part of risk management. Policies should be read against a recent assessment, not renewed on autopilot.
Other practice areas
Strategy and governance
Align the board and the plan
A plan with owners and measures, and a board built to hold it.
Outcomes and evaluation
Prove what changed
One measurement system, organized around what your funders need to see.
Finance and accounting
Make the numbers work
Board packets that answer questions. Reporting your board can act on.
Technology and AI
Put technology to work
Systems, data and AI where they pay for themselves, and custom software when nothing on the market fits.
The conversation costs nothing.
Thirty minutes. Bring whatever is hardest right now.