How to develop a Risk Register and Risk Management Policy

As part of pre-contracting phase and Special Conditions raised by AmplifyChange, we had to develop a Risk Management Policy as well as a Risk Register.

The AmplifyChange Financial Team specifically supported us through this exercise via zoom calls or email. They advised us on the format to use and what essential information was supposed to be included in both documents.

In order to develop our own Risk Register, we had to gather as a team and think about relevant and adequate factors that needed to be considered in order to identify risks. We had to consider the context in which our project was implemented to identify what could go wrong and negatively impact the success of the project.

We identified different categories such as

• Financial (refers to risk of increase of costs or loss of income)
• Contextual (refers to events, factors or dynamics occurring in the broader environment which affect programming or operations yet are beyond the control of organizations or individuals).
• Safeguarding (refers to the risk of harm, abuse or neglect towards vulnerable groups including children).
• Reputational (refers to the potential for negative public perception or some negative circumstance that might impact on an organisation’s reputation and image)
• Operational (refers to the risk a company faces in the course of conducting its daily activities, procedures, and systems).

Developing the two documents enabled us to not only think through and identify potential issues/risks that the team could face, but also to define preventive measures as well as mitigating actions for these identified risks.

This process made us more vigilant during the implementation of the Risk Management Policy and Risk Register, and by using these documents we have been able to anticipate potential risks linked to the environment of the project and in turn be more adaptable and responsive.

We identified risks such as risk of fraud, reputational risk and safeguarding linked to the work we do in the community and with vulnerable adults, adolescents, and children.

We also included operational risks linked to the lack of donor fundings to sustain our projects and lack of staff resources but also risks linked directly to the themes we work on as FGM/C and child marriage are still sensitive and taboo topics within the community.

Thanks to this new approach of risk management, we have been able, as an organisation to be more prepared and adaptable to face potential issues/risks.

It has also helped us to reinforce and even create new partnerships with other donors, as a robust Risk Management Policy was part of their requirements too. Indeed, they all have mentioned that a good Risk Management Policy is a good practice which provides assurance on the quality of the organisation’s governance.

The Risk Register has also been a good tool to efficiently reallocate financial resources by taking into consideration the risks identified in each area of the project.

We advise all grantees to develop such tools and include as many preventive/mitigating actions to tackle potential issues/risks on the ground.

We also recommend sharing your Risk Register with the implementing team, to help them identify risks and to be aware of all the risks and be ready to face them efficiently.

Good communication between the different parties involved in the project (Project Lead, implementing team, donors) is absolutely key in order to ensure that the whole risk-management approach is relevant to the organisation.

We have learnt how to strengthen our team’s technical and managerial skills so that they are flexible to the project environment and remain adaptable to face and tackle any emerging threats/issues.

The Risk Management Policy and Risk Register have been constantly updated through the different implementation phases of the project, under the supervision of the Project Lead.

The participation of the members of the organisation in the decision-making process is also a really important element in the anticipation and potential resolution of issues. This risk-management approach is appropriate to the environment in which the project has been evolving.