Why does an NGO need a risk register?
Every NGO works with uncertainty: funding can end, staff can be unsafe, a supplier can fail, a rule can change. Most teams know these risks in their heads. The trouble is that each person knows a different part. A risk register puts them in one place, with one owner for each, so nothing waits for someone to remember it.
Donors and boards also ask for it. A register shows that you looked ahead and chose actions, which matters more than a long list.
What does a risk register contain?
Keep the columns few. Each extra column is one more thing to keep current.
| Column | What to write |
|---|---|
| Risk ID | A short code, such as R-07, so people can refer to it |
| Description | Cause, event and result in one sentence |
| Category | For example funding, safety, finance, legal, reputation, operations |
| Likelihood | A score from 1 (rare) to 5 (almost certain) |
| Impact | A score from 1 (minor) to 5 (severe) |
| Score | Likelihood multiplied by impact |
| Owner | One named role, not a team |
| Actions | What reduces the likelihood or the impact |
| Next review | A date |
How to build the register, step by step
- Gather the people who know. Include program, finance, HR, logistics and the country or regional lead. One person alone will miss risks.
- List risks in plain sentences. “Our largest grant ends in June and no renewal is signed, so we may lose four posts” is useful. “Funding” is not.
- Group duplicates. If three people describe the same risk differently, merge them into one entry.
- Agree the scoring scale. Write down what a 1 and a 5 mean for likelihood and for impact. Use words and, where you can, rough amounts or time. Without this, one person’s 3 is another’s 5.
- Score each risk. Score the risk as it stands today, with current controls in place.
- Name an owner. The owner is the person who can act, not necessarily the most senior person.
- Choose a response. For each risk decide whether to reduce it, avoid it, transfer it (for example through insurance) or accept it. Record why.
- Set the next review date. Put it in the register, not only in someone’s calendar.
How do you write a good risk description?
Use this pattern: because of [cause], [event] may happen, leading to [result].
For example: “Because the bank holds only one signatory for the country account, payments may stop when that person is away, leading to late salaries.” A sentence like this points to an action: add a second signatory. A word like “payment risk” does not.
Avoid describing risks that are really your own plans in disguise. “Not hiring a finance officer” is a decision, not a risk. The risk is what may follow from it.
What should you do with each risk?
Good actions are small, owned and dated. For each risk, write one next action, who does it and when. Then check two things at every review:
- Did the likelihood or impact change since last time?
- Is the action done, late or blocked?
When a risk score goes down because of an action, record that action as the reason. That record shows a board or donor that your controls work.
Pair your register with a visual view. Our guide to reading a risk heatmap shows how to turn the scores into one picture for a board meeting.
How often should you review it?
Set two rhythms. Owners update their own risks monthly, in a short check. The leadership team then reviews the top-scoring risks each quarter, and the board sees the top risks at least twice a year. Also review the register after any major event: a donor decision, a security incident, a move into a new country.
Retire a risk only when it has passed or been fully removed, and write down why. Keep closed risks for a time, since they show what you learned.
Where EMPOBase fits
EMPOBase has a Risk Register and a Risk Heatmap inside Governance & Compliance, so the list, the scores and the picture sit together with your other governance records. You can read how the platform is organized or ask for a walk-through. EMPOBase does not decide your scoring scale or tell you which risks matter. Your team still sets the scale and owns the judgment.