Risk Assessment That Strengthens Governance

A grant reimbursement is delayed because supporting documentation cannot be located. A school district discovers that one employee can initiate, approve, and reconcile vendor payments. A housing entity learns that a reporting deadline was missed after the fact. These are not merely isolated operational errors. They are signals that risk assessment has not been connected closely enough to the organization’s controls, oversight, and regulatory obligations.

For boards, executive leadership, and finance teams, a well-executed risk assessment is a disciplined way to identify what could prevent the organization from meeting its financial, programmatic, and compliance responsibilities. Done properly, it does more than produce a spreadsheet for the audit file. It gives leadership a clearer basis for allocating resources, testing internal controls, setting priorities, and protecting public trust.

Risk Assessment Is a Governance Process

Risk assessment is sometimes treated as an annual compliance exercise completed shortly before an audit. That approach may satisfy a procedural expectation, but it rarely produces useful management insight. Risks change as funding sources change, systems are replaced, personnel turn over, programs expand, and regulations evolve.

The more useful view is that risk assessment is a continuing governance process. It asks leadership to identify the organization’s objectives, consider what could interfere with those objectives, evaluate the likelihood and potential impact of each exposure, and determine whether existing controls reduce the exposure to an acceptable level.

For an institutionally accountable organization, the objectives are usually concrete. They may include preparing reliable financial statements, safeguarding restricted funds, meeting Uniform Guidance requirements, complying with HUD program rules, submitting Medicaid or HHS reports accurately, maintaining eligibility for grants, and providing the board with timely financial information. The risks should be assessed against those specific obligations rather than described in broad, generic terms.

A risk register that says “fraud,” “cybersecurity,” or “staff turnover” without identifying the affected process, funding stream, control owner, and consequence is not yet a management tool. It is only a starting point.

Start With the Obligations That Matter Most

An effective assessment begins with the organization’s regulatory and operational reality. A nonprofit receiving significant federal assistance has a different risk profile from a closely held business with lender reporting requirements. A municipal entity has different accountability pressures from a charter school or an affordable-housing developer. The process should reflect those distinctions.

Leadership should begin by mapping its major responsibilities: financial reporting, cash management, payroll, procurement, grant administration, subrecipient monitoring, revenue recognition, information technology, program delivery, and board reporting. Each area should then be considered in light of applicable requirements and the organization’s actual workflow.

For example, an organization subject to a Single Audit should look beyond whether federal expenditures exceed the audit threshold. It should consider whether staff can identify federal awards correctly, maintain complete grant files, apply allowable-cost rules consistently, document time and effort where required, monitor subrecipients, and submit reports on time. A control may exist on paper while failing in practice because responsibilities are unclear or evidence of review is not retained.

Similarly, a housing organization may identify tenant-file completeness, calculation of tenant income, reserve compliance, procurement documentation, physical inspection findings, and HUD reporting as areas requiring separate attention. Combining all of these exposures into a single category labeled “HUD compliance” makes prioritization difficult and accountability vague.

Evaluate Inherent Risk Before Giving Credit to Controls

One of the most useful distinctions in risk assessment is between inherent risk and residual risk. Inherent risk is the exposure that exists before considering controls. Residual risk is what remains after controls are considered.

This distinction prevents a common mistake: assuming a process is low risk simply because a policy exists. Payroll, for example, can carry substantial inherent risk because it involves employee data, recurring disbursements, tax reporting, and the possibility of unauthorized changes. A well-designed approval process, access restrictions, payroll reconciliations, and independent review may reduce the residual risk. But leadership should confirm that those controls are actually operating, not merely described in a procedure manual.

A practical evaluation considers both likelihood and impact. Likelihood addresses how probable an error, omission, or noncompliance event may be based on the process, staff capacity, system limitations, prior findings, and changes in operations. Impact considers the consequences: questioned costs, repayment obligations, audit findings, loss of funding, inaccurate financial statements, reputational harm, or disruption to services.

Not every high-impact risk warrants the same response. A low-probability event may require contingency planning rather than extensive daily controls. Conversely, a recurring moderate-dollar error in a high-volume process may warrant immediate remediation because it can accumulate quickly. The right response depends on the organization’s risk tolerance, available resources, and regulatory exposure.

Connect Each Significant Risk to a Control Owner

Risk assessment becomes actionable when each significant exposure has a defined control response and a responsible owner. The owner should not simply be the person who performs the transaction. In many cases, the control owner is the finance director, controller, program director, chief information officer, or executive responsible for ensuring the control is designed and functioning as intended.

Consider procurement. A meaningful assessment may identify risks involving conflicts of interest, inadequate competition, unsupported vendor selection, purchase splitting, or payments made without evidence that goods or services were received. The controls may include documented thresholds, conflict disclosures, competitive-bid procedures, approval requirements, vendor-master-file restrictions, and review of supporting documentation. Each control should be tied to a person who can explain how it operates and produce evidence that it occurred.

The same principle applies to board oversight. Boards do not need to approve every transaction, but they do need information that enables meaningful oversight. Timely financial statements, budget-to-actual reporting, cash-flow forecasts, compliance updates, audit-status reports, and reports on significant control deficiencies help the board focus on its stewardship responsibilities.

A board treasurer or audit committee should be able to ask direct questions: Which risks changed this quarter? What controls are being tested? What findings remain unresolved? Are there funding conditions that could affect operations? If management cannot answer clearly, the risk assessment process may not be sufficiently integrated into governance.

Pay Close Attention to Change

The highest-risk period is often not the ordinary course of operations. It is the period of transition. New grants, new leadership, acquisitions, major system implementations, staff reductions, revised reporting rules, and rapid growth can all weaken established control patterns.

A new accounting system, for instance, may improve reporting in the long term while introducing short-term risks around data conversion, user access, chart-of-accounts mapping, and report accuracy. A new program director may have deep subject-matter expertise but limited familiarity with procurement or documentation requirements. A risk assessment should identify these transition points early and establish targeted monitoring.

Prior audit findings and management-letter comments deserve particular attention. A repeated finding is rarely just a technical reporting issue. It often indicates that the corrective action plan was not specific enough, lacked ownership, or was not monitored through completion. Management should distinguish between a correction made after an issue was discovered and a sustainable change that prevents recurrence.

Make the Assessment Useful for the Audit and Beyond

An independent audit is not a substitute for management’s risk assessment. Auditors evaluate risks relevant to the financial statements and, where applicable, compliance requirements. Management remains responsible for identifying operational and compliance risks, designing controls, and providing oversight.

Still, a thoughtful assessment improves audit readiness. It helps management organize documentation, identify policies that need revision, clarify process narratives, and address control gaps before they become audit findings. For organizations subject to Single Audit or Yellow Book requirements, it can also support a more focused discussion of major programs, compliance requirements, and prior findings.

The strongest process is proportional. Smaller organizations may not have separate departments for finance, compliance, information technology, and internal audit. Segregation of duties may be limited by staffing. In that circumstance, compensating controls matter: greater board review, independent bank-reconciliation review, restricted system access, documented approval of journal entries, and regular review of financial and compliance reports.

More controls are not automatically better. Controls that are too burdensome may be bypassed, inconsistently performed, or poorly documented. The objective is not to eliminate every risk. It is to understand material exposures and establish controls that are realistic, demonstrable, and appropriate for the organization.

Give the Board a Clear View of What Requires Attention

A risk assessment should culminate in a report that leadership and the board can use. The most effective reporting avoids technical clutter while preserving enough detail for accountability. It identifies the significant risks, explains why they matter, describes the current controls, notes any gaps, assigns ownership, and sets dates for corrective action.

For many organizations, quarterly review is appropriate for high-priority risks, while the full assessment may be refreshed annually or whenever a major change occurs. Audit committees should expect management to report not only on completed actions but also on delayed remediation, emerging risks, and controls that have not been tested.

That discipline gives boards something more valuable than a clean checklist. It gives them the clearest picture of whether the organization is prepared to meet its obligations, protect the resources entrusted to it, and respond before a manageable issue becomes a reportable problem.