Identifying Your Vulnerabilities: How to Conduct a Risk Assessment

Unless your congregation is doing nothing to advance its mission, it is vulnerable to having bad things happen. For example, only after you hire staff to shepherd God’s people is your church vulnerable to being sued by new employees. Not until you decide to minister to youth is there a risk that a teenager may be abused by one of your volunteers. And it is only after you purchase a church building (in order to foster a community of believers) that you face the potential of fire, theft, loss of property and human life. The question is not whether the Church has vulnerabilities, but whether church leaders recognize these risks and are prepared to address them.

Conducting your own risk assessment requires no expensive consultant, can be done in a few hours, and will provide you with a roadmap to address your congregation’s key risks and vulnerabilities.

What Is a Risk Assessment?

A risk assessment, also known as a risk audit, can focus on a narrow topic (such as your youth ministry program), or it may be broad, examining multiple operational/ministry areas, including your governance and financial management. During risk assessments, churches step back and ask the key question: What could go wrong here? You are trying to get on paper a list of risks that pose a threat to your congregation’s people, property, finances and reputation.

There are many ways to conduct a risk assessment. The most sophisticated is to hire an attorney or consultant. This person will typically interview certain staff and volunteers, review your written policies and current practices, and provide you with a report that summarizes your key risks and an action plan to address them.

More do-it-yourself approaches exist. There are several outstanding online programs that will ask you questions about your operations, help you identify key vulnerabilities and even provide you with a written report. (See My Risk Management Plan at www.nonprofitrisk.org.)

The Value of a Risk Assessment

There are many benefits to conducting a risk assessment. First, it is quite liberating for church leaders (especially business administrators) to get all their fears and concerns on paper – and out of their heads. In a recent risk-assessment session, I met with five youth ministry leaders. Within 35 minutes, this group identified an exhaustive list of risks that included adult-on-child abuse, teen-on-teen abuse, suicide, embezzlement, medical risks, auto accidents, drowning, abduction and violent crime. While the group was able to list these risks, they had never voiced them all at one time and seen the list on paper. I saw obvious relief in simply expressing these concerns. It was also a wake-up call for them as their ministry lacked policies and training to address many of these risks.

A second benefit of the risk assessment is the ability to step back and prioritize risks. For each risk, you should think about the severity and likelihood. For example, the likelihood of a tornado hitting a church camp is low, but the severity is extremely high if the tornado does, in fact, strike. On the other hand, someone slipping on a wet floor is more likely to happen, but the severity is much lower. When you review the severity and likelihood of your various risks, and begin comparing them with each other, you will start to discern which risks are most important and should be addressed first.

Most churches have limited resources of time and money. By prioritizing your key risks, you can begin tackling the most important, one at a time. This will produce momentum, a sense of progress and confidence that you are actively and thoughtfully engaged in good risk management.

How to Conduct a Self-Assessment

Conducting your own risk assessment is relatively simple. You need a large paper easel with large colored markers. You are going to have a big brainstorming session. You should invite at least one person from each of your teams: board of directors, ecclesiastical leadership and church administration. You also need volunteers who serve in the ministry at the grassroots level. This is crucial, as you want people that are in the thick of it, who understand and experience the day-to-day ministry or operations area being addressed.

With this group, you simply ask the question: What could go wrong? As you facilitate this session, help the group be thorough. During my youth-ministry risk assessment (described above), I made sure the group covered the various aspects of youth ministry: What could go wrong during youth ministry activities, summer camp, driving, counseling, etc. List every response and run the exercise until you have exhausted your group’s ideas.

Once you have your list, go back through and group common or related issues, creating some order in your list. Then, discuss severity and likelihood (as described above) for each risk. Next, have each person prioritize the risks, with no discussion. Finally, compare priority lists, discuss the results and build consensus on the risk areas that deserve your attention first.

Off to a Great Start

This self-assessment will create significant momentum and unity as to where to focus resources to address your key risks. However, as described above, it has some limitations. You may not have the expertise in your organization to identify all the key risks, including ones common to many churches. Still, even when you lack certain expertise, most churches have staff and volunteers whose gut will tell them if there are areas that need further investigation. For example, you may know that employment policies are outdated and that this could pose problems. You recognize that you should have someone review these policies.

Given its ease and low cost, a self-conducted risk assessment can be a powerful starting point to begin tackling your congregation’s key risks.

Common Risk Areas

While every church has unique risks, the following are common risk areas to address in your risk assessment:

• Employment practices
• Youth ministry
• Children’s ministry
• Governance
• Facilities
• Financial practices
• Technology

David Adams is an attorney and president of RMnet Solutions Inc. (www.mychurchpolicies.com), creators of RMnet, a Web-based policy and training management system designed for church staff and volunteers. For more information about risk assessments, contact Adams at david@rmgmt.net.

Related Articles:

Risk Management: What It Is, Why It’s Important, Where To Begin

Manage Risk to Protect Church Finances

Protecting Kids is a Priority