Enterprise Risk Management for Nonprofits: From Oversight to Strategic Insight

During AAFCPAs’ recent Nonprofit Seminar (April 2026), John Buckley, CPA, CGMA, Partner and Lisa Whittemore, CFE, CRMA, MBA, Partner shared practical guidance with more than 530 nonprofit leaders on how enterprise risk management can evolve from a static exercise into a living, organization‑wide discipline. The session explored how nonprofit organizations can better identify and prioritize risk, strengthen governance and board oversight, reduce fraud exposure, and support more informed, forward‑looking decision-making in an increasingly complex operating environment.

Risk touches nearly every decision nonprofit leaders make—how programs scale, where resources are directed, and how organizations respond when conditions change. Yet many risk conversations still happen after the fact, once pressure has already mounted. Enterprise risk management offers a different posture. When approached as an ongoing discipline rather than a periodic exercise, ERM provides leaders and boards with a much clearer view of what could shape outcomes ahead, helping leaders act with foresight, alignment, and confidence as complexity grows.

Enterprise Risk Management Across Nonprofit Operations

Enterprise risk management is often misunderstood as highly technical or abstract, reserved for large companies. In reality, it speaks directly to the everyday decisions nonprofit leaders already make—how funding is structured, which programs grow, where systems investment is needed, and how governance responsibilities are fulfilled. Each of these decisions carries risk, sometimes in ways that only become clear over time.

At its core, enterprise risk management gives leadership and boards a way to understand what could materially affect the organization’s ability to deliver on its mission. By looking across finance, operations, compliance, programs, technology, and reputation, ERM helps illuminate how risks intersect—and where pressure points may form across the enterprise.

That perspective is important because nonprofit risk rarely stays contained. A single issue can quickly ripple outward. A technology failure can interrupt service delivery, require unplanned spending, trigger reporting obligations, and weaken trust with donors and the community. When risks are viewed only within departmental boundaries, those connections are easy to miss.

ERM provides leadership with a broader line of sight. It helps nonprofit decision-makers understand where risk is concentrated and which exposures deserve closer monitoring, supporting more proactive conversations before issues escalate.

Risk-Based Decision-Making for Nonprofit Leaders

For nonprofit executives and finance leaders, the value of enterprise risk management is most evident at decision points. Choices are often made with limited resources, incomplete information, and real accountability to boards, funders, and regulators. ERM works to bring structure to those moments by clarifying where leadership attention will have the greatest impact.

A key benefit of ERM is prioritization. Not every risk carries the same weight, yet organizations often struggle to distinguish between what is urgent and what is truly significant. By examining risk across the enterprise, leadership can better assess potential impact—not only financially, but operationally, reputationally, and from a compliance perspective—directing resources accordingly.

This clarity is particularly valuable for boards. When risk is discussed within a consistent framework, boards are better positioned to fulfill their fiduciary responsibilities without being drawn into operational detail. ERM supports more productive oversight by giving boards a shared language for understanding tradeoffs, asking informed questions, and monitoring exposure over time.

ERM also strengthens resource planning. Whether evaluating new programs, investing in systems, or responding to emerging pressures, leaders benefit from understanding how risk aligns with strategy and capacity. Decisions become easier to explain, easier to govern, and more closely aligned with long‑term sustainability.

Implementing Enterprise Risk Management in Nonprofits

Enterprise risk management is most effective when it is embedded in how an organization operates rather than treated as a periodic review. This begins with leadership, who set the tone and make it clear that risk awareness is a core part of responsible management and governance.

Boards and executive teams play a central role by encouraging open, constructive discussion about risk and clarifying expectations around risk tolerance. The goal is not to avoid risk entirely, but to understand it well enough to make deliberate choices in service of mission.

Ownership matters as well. ERM functions best when responsibility is shared across the organization rather than concentrated in a single role or department. Finance, operations, compliance, technology, and program teams each see different risks first. Creating structure for those perspectives to surface helps reduce blind spots and ensures concerns are addressed before they become more difficult to manage.

Just as important is how risk conversations happen. A healthy ERM culture makes it safe for team members to raise concerns early, without fear doing so will be punitive. When risks are surfaced in real time, leadership can assess implications across the organization, respond thoughtfully, and adjust controls or priorities as needed.

Because risk evolves, ERM must evolve with it. Funding models shift, programs expand, regulations change, and technology becomes more embedded in daily operations. Revisiting risk on a regular basis helps keep leadership aligned and governance focused as conditions change.

Putting This Into Practice: Risk Management for Nonprofits

AAFCPAs helps nonprofit organizations design and strengthen enterprise risk management programs that support better decisions, stronger governance, and long‑term mission resilience. Drawing on experience working with nonprofit boards, executives, and finance teams, we help clients move beyond viewing risk as a periodic exercise and toward integrating it into how leadership operates. Our approach begins with understanding your mission and governance structure, then identifying where risk is most concentrated across financial, operational, regulatory, and technology areas. We work with leadership to clarify ownership, establish effective oversight structures, and create shared language that supports productive engagement between boards and management. In all cases, our focus is practical—helping teams prioritize what matters most, surface issues early, and allocate resources with intention, while building the internal capability to sustain risk management over time.

These insights were contributed by Lisa Whittemore, CFE, CRMA, MBA, Partner, Risk Advisory and John Buckley, CPA, CGMA, Partner.

Questions? Reach out to our authors directly or your AAFCPAs partner.

AAFCPAs offers a wealth of resources on risk‑informed leadership. Subscribe to get alerts and insights in your inbox.