risk management: an organizational “flu shot” · • slide 16: risk matrix – modified from...

© 2011 Community Action Program Legal Services, Inc.

A Joint Project of CAPLAW and Meliora Partners

Risk Management: An Organizational “Flu Shot”

Part of the Beyond Basics Webinar Series

2

Risk Management – An Organizational “Flu Shot”

A positive management practice contributing to

organizational good health

3© 2011 Community Action Program Legal Services, Inc.

Session Overview & Learning Objectives

• Explore definitions of “risk”

• Understand risk management as an organizational internal controls component

• Learn the elements of a Risk Management Plan, as part of a RMP template

• Work through the elements of a Risk Management Plan

• Obtain a list of risk management planning resources

4

Who is Participating?

• 1/3 executive directors, operations managers

• 1/3 finance, human relations, program directors

• 1/3 fiscal and state CSBG staff

• ½ participated in a Risk Management Plan


5

What is risk?


6

Management of the Unknowns

Donald Rumsfeld, February 12, 2002,on Iraqi weapons of mass destruction



RM – An Essential Internal Control

8

More Emphasis on Accountability


Goals of CSBG Reform (Seth Hassett, February, 2011)1. Maintain an emphasis on place-based services2. Increase performance accountability3. Direct resources to the most efficient organizations in

high need communities4. Maximize amount of funding that goes to services5. Promote evidence-based practice6. Maintain a high level of program integrity

9

Importance of Risk Management

“Agency managers and staff should be

encouraged to identify control deficiencies, as

this reflects positively on the agency's commitment to recognizing and addressing management

problems….Agencies should carefully consider

whether systemic weaknesses exist that

adversely affect internal control across organizational or program lines.”

A-123, IV, B


10

IM 112 – CAA specific

� Audit and monitoring findings

� Internal control systems testing

� Compliance: laws and regulations

� Equipment, property purchase waivers


“The process of assessing entity

vulnerabilities and risks should be

ongoing and

integrated within management and board oversight

efforts.“

11

A-123, II GAO/AIMD-00-21.3.1 (11/99)

Internal Control Objectives


Effectiveness and efficiency of operationsEffectiveness and efficiency of operations

Reliability of financial reportingReliability of financial reporting

Compliance with applicable

laws and regulations

Compliance with applicable

laws and regulations

12

Internal Control Framework


13

Who Manages Risk?


14

Risk Management Process


15

Assess – Identify Risks


Complaints ClaimsLawsuits

Accident reportsWorkers Comp

claims

Accident reportsInsurance claims

Internal monitoringFunder monitoring

Bank reconciliations Verification of assets and liabilities External audit Eligibility verification

16

Assess – Anticipate Vulnerability


17

Respond – Mitigation Measures


Turn down program

Remove hazardous equipment

Anti-virus software

Monitor program filesNight security

Subcontract CPAOutsourced payroll

Insurance

Policies and procedures

Self insuranceMajor medical policy

18

Respond - Implementation


19

Monitoring – Determining Effectiveness


20

Risk: Ineligible applicants approved

Respond – Tracking Mitigation Strategies


21

Monitoring Plan – Ineligible Applicants


22

Monitor – Tracking Report


Example of a worksheet for recording ineligible applications submitted

for approval, with coding key

Identifier SS# Income Utility Shutoff Worker

1-2345 1, 3 1 2 2 ABC

1-6789 2 4,7 1 ABC

2-1234 3 1 LMN

2-9876 4,5 LMN

Total Errors 3 6 2 2 = 13

Key Social Security # Income Verified Utility Service Docs Shut-off Notice Intake Worker

1 Some adults Less than 90 days No bill No document Initials2 Some children Over 6 months ago Not in applicant name Overdue bill

3 None for children No self-declaration Over 60 days old Award not yet credited

4 Applications for Unsigned self-declaration

5 Miscalculated6 Unsigned Inc. Wks7 No income wks8 Docs viewed not listed

9 Docs copies not in file

23

Monitor - Corrective Action

Risk – Approval of ineligible applicants

Report analysis: 37 applications monitored- 6 instances of poor income verification

(out of 14 errors, or 43%)

- Types of errors

- Less than 90 days of income documented 1

- Unsigned self-declaration of income 1

- Income miscalculated on worksheet 2

- Income worksheet not signed by workers 1

- Income documents not copied and in file 1


24

Monitor – Corrective Action


STRATEGY:Intake Worker Income Documentation Training

25

Respond: Tracking Mitigation Strategies

Risk: Insufficient cash flow


26

Monitoring Plan – Negative P & L


27

Monitor – Tracking Report

Tracking worksheet to analyze negative P&L

� Identify funds in negative balance

�Accumulate list of causes in column A

�Add more detail in each fund’s column


Negative Funds By Date

List Funds >> ABC DEF GHI JKL

Claim rejected Not signed

Tardy Filing +12 days

Unfunded expenses Unallowed Overspent

28

Monitor – Corrective Action

Risk: Over spending

Strategy: Enforce Purchase Order approval


29

Your Risk Management Plan


RiskAssessment

30



Responses to Risk

31



Monitoring the Plan


The Presenters

Meliora Partners, Inc.www.meliorapartners.org

Owen [email protected]

641-751-1022

Dan [email protected]

641-691-0033This publication was created by Meliora Partners, Inc., in the performance of the U.S. Department of Health and Human Services, Administration for Children and

Families, Office of Community Services Grant Number 90ET0430. Any opinion, findings, conclusions, or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the U.S. Department of Health and Human Services, Administration for Children and Families.


Resources & Tools

• COSO Internal Control Frameworkhttp://www.coso.org/IC-IntegratedFramework-summary.htm

• OMB Circular A-123 – Management’s Responsibility for Internal Controlhttp://www.whitehouse.gov/omb/circulars_a123_rev

• “Inside ISO 31000:2009”http://www.deloitte.com/assets/Dcom-Canada/Local%20Assets/Documents/ERS/ca_en_ers_inside_ISO31000_handout_040310.pdf

34

Resources & Tools – 2

• “Risk Management for Nonprofits”http://www.virtualcap.org/viewprogram.cfm?pid=296

• “Risk Management Overview”

http://www.niqca.org/documents/Risk_management_Overview.pdf

• http://en.wikipedia.org/wiki/Risk_management

• Hallmarks of a Risk-Aware Nonprofithttp://www.nonprofitrisk.org/tools/hallmarks/intro.shtml


35

Resources and Tools - 3

• “How to Develop A Risk Management Plan”http://www.wikihow.com/Develop-a-Risk-Management-Plan

• “How to Write a Risk Assessment”

http://www.wikihow.com/Write-a-Risk-Assessment

• “State of Minnesota Risk Management Plan” (Search on this title)


36

Tools developed for this webinar

• Slide 16: Risk Matrix – Modified from example in Wikipedia article

• Slide 18: Implementation matrix

• Slide 21: Monitoring plan matrix

• Slide 22: Tracking Report format

• Slides 29, 30, 31: Risk Management Plan Outline

• Risk Management Plan template: separate Word document containing all of the worksheets demonstrated


37

Don’t Forget Your Evaluation!


Next Webinar:

Budget Builders: Who Does

What? Why is it Important?

Wednesday, May 18, 2011

2 p.m. – 3:30p.m. EST

Presented by Kay Sohl

Kay Sohl Consulting

38