# Overview of Risks & Internal Controls for NGOs

<p class="callout info">You can read the information below in over 15 languages! Simply use the translation tool in the top-left corner of the screen to select your preferred language, including অসমীয়া, বাংলা, ગુજરાતી, हिन्दी, ಕನ್ನಡ, മലയാളം, मराठी, মৈতৈলোন্, नेपाली, ଓଡ଼ିଆ, ਪੰਜਾਬੀ, संस्कृतम्, தமிழ், తెలుగు, and اُردُو.</p>

<iframe allowfullscreen="allowfullscreen" height="456" src="https://www.youtube.com/embed/8IHyBhvoSYI?si=Mm95hjHqxBOtNjIq" width="100%"></iframe>

#### Why understand risk management

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-risks-is-a-must-disc">- Risks is a must discussion now in NGO-funder relationship, idea is how to understand, capture and manage risks by NGOS.
- Good risk management is (a) basic to an effective organisation and (b) ensures better delivery of services to community.
- Fundamental concepts in organisation risk management- risk appetite (willingness to take risk to achieve objectives) and risk tolerance (ability or boundary to take risk/acceptable deviation from risk appetite). Risk appetite is about "taking risk" and risk tolerance is about "controlling risk".
- Risk appetite denoted risk profile at aggregate level while risk tolerance is at activity level i.e. on case by case basis.
- Risk management is how to bridge the gap between risk appetite and tolerance.
- Understand the need for internal controls commensurate with risks.

</div>#### Why risk management is important for NGOs

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-financial-stability-">1. Financial stability
2. Operational Efficiency
3. Compliance Management
4. Disciplined Planning
5. Informed decision making
6. Reputation Management
7. Building Trust
8. Improved communication
9. Long term Impact and Sustainability

</div>#### Key concepts

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-threat%3A-a-danger-in-">- **Threat**: A danger in the environment, a potential cause of harm. e.g. legislative changes, technology, competition, inflation, globalisation etc.
- **Risk**: The probability and potential impact on achievement of objectives while encountering a threat.
- **Internal risks**: personnel issues, technology issues etc within the organization.
- **External risks**: economic, political, legal, act of God etc. in external environment.
- **Residual risk**: The risk which inevitably remains after all reasonable mitigation measures have been taken.
- No organization is completely free from risks. The environment will always contain risks.
- **Risk management/mitigation**: Organizational practices, procedures and policies (P&amp;Ps) that reduce the probability of risks being realized and limit harmful consequences.
- **Enterprise/Integrated risk Management (ERM)**: An organizational management that considers, combines, and prioritizes assessed risks in all risk areas (security, fiduciary, operational, informational, and reputational) in order to strategize and implement mitigation measures.
- Risk mitigation is risk reduction, it cannot be made zero.

</div>#### Types of risks facing Organisations

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-ethical-risk%3A-due-to">- Ethical risk: due to unethical behaviour
- Operational risk: inability to achieve objectives, capacity/competence gaps, financial/funding constraints, access constraints
- Safety risk: accident/illness
- Financial risk: improper financial planning and management
- Reputational risk: damage to image and reputation
- Security risk: violence/crime
- Fiduciary risk: breach of trust like corruption/fraud/theft/diversion
- Legal/compliance risk: violating laws or regulations
- Information risk: data breach/loss, digital risk, systems breach
- Competition risk: competitor take your market for goods/services

</div>##### Risk Management Policy- Need

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-donor-audits%2Fdue-dil">- Donor audits/due diligence by prospective donors
- Need to instil a sense of identifying, understanding and addressing risks in the organisation as it grows
- Create awareness about risk mitigation strategies when faced with risks in our respective areas of work.
- Staff embrace and own risk management process
- Act as a tool for governance and control

</div>##### Risk Management Process

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-risk-universe-analys">1. Risk universe analysis
2. Risk identification
3. Risk assessment-risk assessment matrix based on likelihood and impact of identified risks

</div>##### Risk Management Process

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-prioritise-risks-to-">- Prioritise risks to be taken up for mitigation
- Risk Response-Risk Registers with Roles and responsibilities of staff
- Monitoring
- Reporting

</div>### Internal Controls

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-business-practices-t">- Business practices that serve as "checks and balances" on internal stakeholders (staff/key functionaries) and/or external stakeholders (vendors) in order to reduce the risk.
- Internal controls are mechanisms or procedures or rules to mitigate or reduce the risks and loss to an acceptable level.
- Internal Controls are of 3 types-
    
    a. preventive controls: in place to prevent adverse events
    
    b. detective controls: detect error/problem after it has occurred-internal audits, Reconciliations, physical inventorying
    
    c. Corrective controls-based on error detected

</div>##### Benefits and Limitations of Internal Controls

**Benefits**

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-early-warning-system">- Early warning system
- Prevents fraud
- Avoids external audit findings
- Avoids statutory and regulatory penalties and actions
    
    Limitations

1. Collision
2. Human error
3. Unforeseen circumstances

</div>##### Key Areas of Internal Controls in NGOs

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-the-below-internal-c">- The below Internal Controls can be grouped into one of the following buckets:
    
    (a) Financial Controls
    
    (b) Operational Controls
    
    (c) Compliance Controls
- The below are illustrative but not exhaustive and discussed in following slides:
    
    
    - Legal compliance
    - Governance
    - Budget
    - Income
    - Expenditure
    - Purchase/Procurement
    - Human Resource Management
    - Assets/Inventory Management
    - Accounting
    - Cash and Bank
    - Donor Reporting
    - Program Implementation

</div>##### 1. Internal Controls around Legal compliance

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-statutory-and-regula">- Statutory and regulatory compliance-difference
- All applicable statutory registrations are in order and valid (entity registration, 12AB, 80G, PAN, TAN, FCRA, NGO Darpan, MCA, EPF, ESIC, PT, Shops &amp; Establishments Act etc).
- All annual/periodic regulatory filings upto date (ITR, TDS, EPF, ESI, PT ROS/ROC etc).
- Proactively check adverse proceedings/pending matters under various laws.
- Aware that a statute or rule applies to NPOS.
- Continued education/awareness/knowledge for changes happening in statutory and regulatory landscape.

</div>##### 2. Internal Controls around Governance

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-board-has-fiduciary-">- Board has fiduciary (manage assets/resources for someone) duties/responsibilities.
- Governance structure as per bye laws/rules.
- Meetings as per bye laws, proceedings documented as minutes of meeting.
- Changes notified &amp; approvals obtained from statutory bodies.
- Board to put in place risk management/mitigation system.
- All statutory and other business as per timeline after proper scrutiny and review.
- Legal action against/violations by board members.
- Section 13 disallowances for transactions with board members.
- Approval of P&amp;Ps and sub committees.

</div>##### 3. Internal controls around Budgeting &amp; Budgetary Controls

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-what-is-a-budget%3F-ho">- What is a budget?
- How budget helps organisation in planning and execution of grant projects.
- What is Budgetary Controls-process, periodicity, ownership of program and finance teams.
- Course correction/Budget revision to address deviation/variance (favorable or adverse).

</div>##### 4. Internal controls around Grants and other Incomes

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-grant-funds-credited">- Grant funds credited in designated Bank account.
- Grant-proper safety and record keeping.
- Treatment of interest.
- Periodic grant Reconciliation.
- Segregation of duties in Finance.
- issuance of money Receipt and donation certificate to donor.
- Timely reporting.
- Proper receipt and recording of income other than grants which include rent, interest, incidental business activity etc.

</div>##### 5. Expenditure

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-programme-expenditur">- Programme Expenditure or Administrative Expenditure
- Revenue or Capital Expenditure
- Head Office Expenditure or Field Level Expenditure

</div>**Internal Controls around Expenditure**

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-expenditure-plan-ali">- Expenditure plan aligned with field requirement and project plan.
- Monitoring to prevent misappropriation/excessive spend/fraud.
- Qualified Finance Staff to avoid inaccurate/delay in payments.
- Proper recording of transactions, report and invoices.
- Tracking over-utilisation and under-utilisation of expenses under budget head for donor budgets for reallocation/realignment.
- Proper filing/documentation (bills, vouchers, invoices).

</div>##### 6. Internal Controls around Purchase/Procurement

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-procurement-is-act-o">- Procurement is act of buying or obtaining goods/services. It includes preparation and processing of a demand until the end receipt is obtained and payment is approved and released.
- Procurement process cycle.

</div>**Internal Controls around Purchase/Procurement**

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-initiate-procurement">- Initiate procurement after checking budget provision.
- Identify vendors after proper assessment.
- Vendor database.
- Obtaining appropriate bids/tenders.
- Competitive bids for price discovery.
- Proper scrutiny of bids by the PC.
- Terms and conditions in PO/contract.
- Issue of Purchase Orders (PO) by authorized staff only.
- Accurate and complete information in the PO.
- Procurement tracker.

</div>##### 7. Human Resource (HR) Management

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-management-of-people">- Management of people who work in an organization is HR Management.
- Need to manage HR:
    
    
    - For better management of an organization.
    - For better performance and results.
    - For better resource mobilization and funding for the organization.

</div>**Controls around HR Management**

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-hr-planning-recruitm">- HR Planning
- Recruitment of staff as per JD
- Proper orientation for new recruits
- Avoid Nepotism
- Identification of capacity building needs and training of HR
- Objective performance appraisal
- Proper handing over for exiting employee
- Discontinue access to database for resigned employee
- Maintaining Employee personal information
- Salary structure
- Grievance and complaints redressal mechanism
- Compliance with social security laws for employees

</div>##### 8. Fixed Assets &amp; Inventory Management

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-fa-is-item-of-econom">- FA is item of economic value which has a life of more than 1 year.
- Inventory refers to items such as consumables, durables that are normally consumed within a year.

</div>**Controls around Fixed Assets &amp; Inventory**

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-asset-%26-inventory-ma">- Asset &amp; Inventory management section in finance policy.
- Indent for assets and consumables based on need and budget.
- Purchase approved by PC and as per grant budgets.
- Specification of assets/inventory captured in PO.
- Annual verification of fixed assets and consumables.
- FA Register, Asset Identification No. marking on assets.
- Assets which are disposed off are removed from FA Register.
- Stock Register of consumables.
- Sale of FC assets.
- Disposal of building, land or higher value assets after Board approval and treatment of CG.

</div>##### 9. Internal Controls around Accounting

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-accounting-is-the-pr">- Accounting is the process of recording, summarizing, analyzing and reporting financial transactions.
- Area of internal control in accounting-
    
    
    - Compliance with new Rule regarding maintenance of books of accounts.
    - Compliance with new Rule regarding maintenance of Other documents.
    - Accounting Software Controls in accounting:
        
        
        - Accuracy
        - Standard formats for recording
        - Evidence and supportings
        - Complete and transparent
        - Audit

</div>##### 10. Controls around Cash and Bank transactions

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-cash-is-kept-in-cash">- Cash is kept in cash box (fixed to wall).
- Reduce cash transaction and practice online options/universal banking.
- Cash vouchers numbered and Receipts duly signed by receiver and approved.
- Dual signatory.
- Monthly bank reconciliation.
- Control on cash withdrawal transactions.
- Signatories per delegation.
- Update KYC of signatories.
- Promote online banking.

</div>### 11. Controls around Donor compliances

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-timely-and-accurate-">- Timely and accurate preparation of reports.
- Activities are in line with activity schedule.
- Data properly collected with reference to objectives of program.
- Donor reporting guideline and formats are adhered to.

</div>### 12. Controls around Program Implementation

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-project-implementati">- Project Implementation plan carried out as per proposal.
- No/ minimal mismatch between LFA and budget.
- Impact of adverse events are effectively monitored.
- Program implementation is effectively monitored in audit.
- Appropriate tools of assessment are used.
- Data presentation is properly done.
- Outcome of program is properly reported.

</div>## Concept of Efficiency &amp; Effectiveness

<div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk-in-non-profits%2C-effi">- In non profits, efficiency refers to maximizing impact with available resources, while effectiveness assesses whether the NGO achieves its stated goals and outcomes.
- Efficiency focuses on how resources are used while effectiveness focuses on the results achieved.
- Efficiency measures the degree to which an organization can convert inputs (funds, time, manpower) into intended outputs (programs, services, people served).
- It emphasizes minimizing waste and maximizing value for each unit of resource invested.
- Effectiveness assesses whether an NGO is achieving its stated goals and objectives, and whether it's making a significant difference in its area of operation.
- It assesses outcomes and impact, including whether lives are being improved and problems are being solved.
- Examples: Tracking progress toward goals, measuring outcomes, and evaluating long-term impacts are ways to assess effectiveness.

<table style="width: 100%;"><thead><tr><td style="width: 11.673698%;"> </td><td style="width: 46.839251%;">**Efficiency**</td><td style="width: 41.590671%;">**Effectiveness**</td></tr></thead><tbody><tr><td style="width: 11.673698%;">**Definition**</td><td style="width: 46.839251%;">Efficiency refers to the act of performing activities with minimum wastage of time and optimum usage of resources timely and without error.</td><td style="width: 41.590671%;">Effectiveness is the extent to which someone or something is successful towards meeting the desired outcome.</td></tr><tr><td style="width: 11.673698%;">**Focuses on**</td><td style="width: 46.839251%;">Doing the assigned task in a correct way</td><td style="width: 41.590671%;">Doing the assigned task accurately</td></tr><tr><td style="width: 11.673698%;">**Focuses on**</td><td style="width: 46.839251%;">Efficiency is focused on the inputs and outputs</td><td style="width: 41.590671%;">Effectiveness is focused on the extent to which work is done and the end result achieved</td></tr><tr><td style="width: 11.673698%;">**Effort oriented**</td><td style="width: 46.839251%;">Efficiency is effort oriented on operations</td><td style="width: 41.590671%;">Effectiveness is effort oriented on strategy</td></tr><tr><td style="width: 11.673698%;">**Time oriented**</td><td style="width: 46.839251%;">Efficiency is time oriented</td><td style="width: 41.590671%;">Effectiveness is not time oriented</td></tr></tbody></table>

</div><div _ngcontent-ng-c418090706="" class="markdown markdown-main-panel stronger enable-updated-hr-color" dir="ltr" id="bkmrk--1"></div>