Risk Management - Revision history

Adminwiki: /* Further resources and links */

2025-06-24T18:29:15Z

Further resources and links

← Older revision		Revision as of 18:29, 24 June 2025
Line 122:		Line 122:

	Scottish Fire and Rescue – [https://www.firescotland.gov.uk/businesses-and-landlords/fire-risk-assessment/ Fire Risk Assessment: what a Fire Safety Risk Assessment is and how to undertake one]		Scottish Fire and Rescue – [https://www.firescotland.gov.uk/businesses-and-landlords/fire-risk-assessment/ Fire Risk Assessment: what a Fire Safety Risk Assessment is and how to undertake one]

			The [https://tsi-learning.scot/ TSI learning portal] includes an online course - Risk management

Adminwiki at 12:56, 24 June 2025

2025-06-24T12:56:53Z

← Older revision		Revision as of 12:56, 24 June 2025
Line 15:		Line 15:
	* Risk monitoring – a non-stop process to ensure that your management of risk identified potential challenges and improvements		* Risk monitoring – a non-stop process to ensure that your management of risk identified potential challenges and improvements

	The process will be contained within a clear, formal, [[Risk Register\|risk register]] [link: risk register] which is owned by your board/Management Committee and is regularly reviewed to understand changes to any identified risks at any given time.		The process will be contained within a clear, formal, [[Risk Register\|risk register]] [link: risk register] which is owned by your [[What is a Management Committee or Board?\|board/Management Committee]] and is regularly reviewed to understand changes to any identified risks at any given time.

	It is important to recognise that the identification of risks can be limited by your board/management committee’s or the senior management team’s knowledge of a given risk scenario – i.e., the board/Management Committee may not know what it does not know. To improve on this, it may be necessary to explore the nature and potential impacts of a given risk with someone who has greater expertise in that area.		It is important to recognise that the identification of risks can be limited by your board/management committee’s or the senior management team’s knowledge of a given risk scenario – i.e., the board/Management Committee may not know what it does not know. To improve on this, it may be necessary to explore the nature and potential impacts of a given risk with someone who has greater expertise in that area.

Adminwiki: /* Definitions */

2025-06-24T11:40:57Z

Definitions

← Older revision		Revision as of 11:40, 24 June 2025
Line 26:		Line 26:

	==Definitions ==		==Definitions ==
	~~'''Risk'''~~

	A risk, in its broadest sense, is anything that might have a negative impact upon the way that your organisation operates and might include, for example, financial losses, damage to the organisation or officers’ reputations or those of a funder or the communities which your organisation seeks to work with.		A risk, in its broadest sense, is anything that might have a negative impact upon the way that your organisation operates and might include, for example, financial losses, damage to the organisation or officers’ reputations or those of a funder or the communities which your organisation seeks to work with.

Adminwiki at 11:40, 24 June 2025

2025-06-24T11:40:40Z

← Older revision		Revision as of 11:40, 24 June 2025
Line 15:		Line 15:
	* Risk monitoring – a non-stop process to ensure that your management of risk identified potential challenges and improvements		* Risk monitoring – a non-stop process to ensure that your management of risk identified potential challenges and improvements

	The process will be contained within a clear, formal, risk register [link: risk register] which is owned by your board/Management Committee and is regularly reviewed to understand changes to any identified risks at any given time.		The process will be contained within a clear, formal, [[Risk Register\|risk register]] [link: risk register] which is owned by your board/Management Committee and is regularly reviewed to understand changes to any identified risks at any given time.

	It is important to recognise that the identification of risks can be limited by your board/management committee’s or the senior management team’s knowledge of a given risk scenario – i.e., the board/Management Committee may not know what it does not know. To improve on this, it may be necessary to explore the nature and potential impacts of a given risk with someone who has greater expertise in that area.		It is important to recognise that the identification of risks can be limited by your board/management committee’s or the senior management team’s knowledge of a given risk scenario – i.e., the board/Management Committee may not know what it does not know. To improve on this, it may be necessary to explore the nature and potential impacts of a given risk with someone who has greater expertise in that area.

	At the highest level, the board should carry a risk register which relates to the overall activities of the organisation. This should focus on the roles and responsibilities of the Board and Management in ensuring that the organisation is well-run, is financially stable and has the appropriate registrations, policies and procedures in place to carry out its activities and to remain compliant with the law. Your organisation will also carry out risk management processes against individual projects which might be presented in, for example, flash reports which detail the operational and governance aspects of a given project. This should include timescales for delivery, financial management, other areas for concern and/or potential for improvement.		At the highest level, the board should carry a [[Risk Register\|risk register]] which relates to the overall activities of the organisation. This should focus on the roles and responsibilities of the Board and Management in ensuring that the organisation is well-run, is financially stable and has the appropriate registrations, policies and procedures in place to carry out its activities and to remain compliant with the law. Your organisation will also carry out risk management processes against individual projects which might be presented in, for example, flash reports which detail the operational and governance aspects of a given project. This should include timescales for delivery, financial management, other areas for concern and/or potential for improvement.

	Core to risk management is the notion of mitigation. This is the process by which your organisation can objectively state that it has put measures in place to reduce exposure to particular events. When seeking to mitigate a given risk, you will need to take a dispassionate view of the potential outcomes, realistic mitigations and your organisation’s ability to implement those mitigations. Mitigations should be action focussed and deliverable within a clear and agreed timeframe.		Core to risk management is the notion of mitigation. This is the process by which your organisation can objectively state that it has put measures in place to reduce exposure to particular events. When seeking to mitigate a given risk, you will need to take a dispassionate view of the potential outcomes, realistic mitigations and your organisation’s ability to implement those mitigations. Mitigations should be action focussed and deliverable within a clear and agreed timeframe.

	Risk management should be an ongoing process which includes the widest range of board/Management Committee and staff members to produce a clear and informed register with realistic mitigations.		Risk management should be an ongoing process which includes the widest range of board/Management Committee and staff members to produce a clear and informed [[Risk Register\|register]] with realistic mitigations.

	==Definitions ==		==Definitions ==
Line 74:		Line 74:

	==Risk register==		==Risk register==
	~~[link to main risk register page]~~
	The use of a risk register allows organisations to fully understand the development and management of risks over time. It should be a living document which is updated regularly. The specific purpose of a risk register will dictate its design and there are any number of free documents available online for particular purposes (e.g., finance, projects, tax, HR).		The use of a [[Risk Register\|risk register]] allows organisations to fully understand the development and management of risks over time. It should be a living document which is updated regularly. The specific purpose of a [[Risk Register\|risk register]] will dictate its design and there are any number of free documents available online for particular purposes (e.g., finance, projects, tax, HR).

	In the event that at an unexpected event occurs or for which mitigations were unsuccessful, the process for identifying risks and mitigations should be reviewed. This might include the need to undertake training with current board members or recruitment for board members who have specific skills in this area.		In the event that at an unexpected event occurs or for which mitigations were unsuccessful, the process for identifying risks and mitigations should be reviewed. This might include the need to undertake training with current board members or recruitment for board members who have specific skills in this area.

Adminwiki: /* Further resources and links */

2025-06-24T11:18:12Z

Further resources and links

← Older revision		Revision as of 11:18, 24 June 2025
Line 102:		Line 102:

	Argyll and Bute Third Sector Interface - [https://www.argylltsi.org/managing-risk/ Managing Risk page]		Argyll and Bute Third Sector Interface - [https://www.argylltsi.org/managing-risk/ Managing Risk page]

			Engage Renfrewshire - [https://engagerenfrewshire.org/couch/uploads/file/risk-management-policy-template.pdf Risk Management Policy]

	IBM - [https://www.ibm.com/think/topics/risk-management Risk Management]		IBM - [https://www.ibm.com/think/topics/risk-management Risk Management]

Adminwiki: /* Further resources and links */

2025-06-24T11:13:51Z

Further resources and links

← Older revision		Revision as of 11:13, 24 June 2025
Line 99:		Line 99:

	==Further resources and links==		==Further resources and links==
	SCVO - [https://scvo.scot/support/running-your-organisation/governance/risks-and-problems/risk-management Risk Policy Template]		SCVO - [https://scvo.scot/support/running-your-organisation/governance/risks-and-problems Managing risks and problems] and [https://scvo.scot/support/running-your-organisation/governance/risks-and-problems/risk-management Risk Policy Template]

	Argyll and Bute Third Sector Interface - [https://www.argylltsi.org/managing-risk/ Managing Risk page]		Argyll and Bute Third Sector Interface - [https://www.argylltsi.org/managing-risk/ Managing Risk page]

Adminwiki at 11:06, 24 June 2025

2025-06-24T11:06:25Z

← Older revision		Revision as of 11:06, 24 June 2025
Line 7:		Line 7:
	Your organisation’s risk management processes should be detailed in a Risk Policy which ensures that the process can be approached dispassionately and documented in a manner which allows straightforward review both now and in the future where your learning might influence future decision-making.		Your organisation’s risk management processes should be detailed in a Risk Policy which ensures that the process can be approached dispassionately and documented in a manner which allows straightforward review both now and in the future where your learning might influence future decision-making.

	==Risk ~~Identification~~==		==Risk identification==
	[https://www.ibm.com/think/topics/risk-management IBM frames four risk management steps]:		[https://www.ibm.com/think/topics/risk-management IBM frames four risk management steps]:

Line 53:		Line 53:

	* Risk acceptance and retention: in this scenario, your organisation chooses to accept a given level of risk – usually following any mitigations – and will proceed with this activity in the knowledge that this might cause some difficulties in the future. A particular scenario here is in the need to balance competing risks. For example, during a redundancy process where financial risk is balanced against the level of expertise within a team.		* Risk acceptance and retention: in this scenario, your organisation chooses to accept a given level of risk – usually following any mitigations – and will proceed with this activity in the knowledge that this might cause some difficulties in the future. A particular scenario here is in the need to balance competing risks. For example, during a redundancy process where financial risk is balanced against the level of expertise within a team.


	==Risk appetite ==		==Risk appetite ==
Line 74:		Line 73:
	* Market conditions		* Market conditions

	==Risk ~~Register~~==		==Risk register==
	[link to main risk register page]		[link to main risk register page]
	The use of a risk register allows organisations to fully understand the development and management of risks over time. It should be a living document which is updated regularly. The specific purpose of a risk register will dictate its design and there are any number of free documents available online for particular purposes (e.g., finance, projects, tax, HR).		The use of a risk register allows organisations to fully understand the development and management of risks over time. It should be a living document which is updated regularly. The specific purpose of a risk register will dictate its design and there are any number of free documents available online for particular purposes (e.g., finance, projects, tax, HR).

Adminwiki: /* Definitions */

2025-06-24T11:05:29Z

Definitions

← Older revision		Revision as of 11:05, 24 June 2025
Line 26:		Line 26:

	==Definitions ==		==Definitions ==
	Risk		'''Risk'''

	A risk, in its broadest sense, is anything that might have a negative impact upon the way that your organisation operates and might include, for example, financial losses, damage to the organisation or officers’ reputations or those of a funder or the communities which your organisation seeks to work with.		A risk, in its broadest sense, is anything that might have a negative impact upon the way that your organisation operates and might include, for example, financial losses, damage to the organisation or officers’ reputations or those of a funder or the communities which your organisation seeks to work with.
Line 42:		Line 42:
	* Compliance risk: your organisation will be subject to legislation (e.g., Employment Law [# Employment], Data Protection [# Information Governance], charity regulation [# Charity Law] and the terms of any specific or professional registration body [# Care Inspectorate, SSSC]. Failure to keep up with evolving regulations and legislation will impact upon your delivery and can result in legal or financial problems.		* Compliance risk: your organisation will be subject to legislation (e.g., Employment Law [# Employment], Data Protection [# Information Governance], charity regulation [# Charity Law] and the terms of any specific or professional registration body [# Care Inspectorate, SSSC]. Failure to keep up with evolving regulations and legislation will impact upon your delivery and can result in legal or financial problems.

	* Reputational risk: anything that might negatively affect your organisation’s reputation such as negative publicity, ethical issues, regulatory issues, financial mismanagement, etc. should be assessed objectively to put in place mitigations. This should include assessing the skills within the board/Management Committee [# board/Management Committee Skills Audit] to oversee the management of the organisation [#Trustee’s Roles and Responsibilities] and putting in place mitigations where the board/Management Committee might have gaps.		* Reputational risk: anything that might negatively affect your organisation’s reputation such as negative publicity, ethical issues, regulatory issues, financial mismanagement, etc. should be assessed objectively to put in place mitigations. This should include assessing the skills within the board/Management Committee [# board/Management Committee Skills Audit] to oversee the management of the organisation [#Trustee’s Roles and Responsibilities] and putting in place mitigations where the board/Management Committee might have gaps.


	==Mitigation ==		==Mitigation ==

Adminwiki: /* Risk Identification */

2025-06-24T11:05:14Z

Risk Identification

← Older revision		Revision as of 11:05, 24 June 2025
Line 19:		Line 19:
	It is important to recognise that the identification of risks can be limited by your board/management committee’s or the senior management team’s knowledge of a given risk scenario – i.e., the board/Management Committee may not know what it does not know. To improve on this, it may be necessary to explore the nature and potential impacts of a given risk with someone who has greater expertise in that area.		It is important to recognise that the identification of risks can be limited by your board/management committee’s or the senior management team’s knowledge of a given risk scenario – i.e., the board/Management Committee may not know what it does not know. To improve on this, it may be necessary to explore the nature and potential impacts of a given risk with someone who has greater expertise in that area.

	At the highest level, the board should carry a risk register which relates to the overall activities of the organisation. This should focus on the roles and responsibilities of the Board and Management in ensuring that the organisation is well-run, is financially stable and has the appropriate registrations, policies and procedures in place to carry out its activities and to remain compliant with the law.		At the highest level, the board should carry a risk register which relates to the overall activities of the organisation. This should focus on the roles and responsibilities of the Board and Management in ensuring that the organisation is well-run, is financially stable and has the appropriate registrations, policies and procedures in place to carry out its activities and to remain compliant with the law. Your organisation will also carry out risk management processes against individual projects which might be presented in, for example, flash reports which detail the operational and governance aspects of a given project. This should include timescales for delivery, financial management, other areas for concern and/or potential for improvement.

	Your organisation will also carry out risk management processes against individual projects which might be presented in, for example, flash reports which detail the operational and governance aspects of a given project. This should include timescales for delivery, financial management, other areas for concern and/or potential for improvement.

	Core to risk management is the notion of mitigation. This is the process by which your organisation can objectively state that it has put measures in place to reduce exposure to particular events. When seeking to mitigate a given risk, you will need to take a dispassionate view of the potential outcomes, realistic mitigations and your organisation’s ability to implement those mitigations. Mitigations should be action focussed and deliverable within a clear and agreed timeframe.		Core to risk management is the notion of mitigation. This is the process by which your organisation can objectively state that it has put measures in place to reduce exposure to particular events. When seeking to mitigate a given risk, you will need to take a dispassionate view of the potential outcomes, realistic mitigations and your organisation’s ability to implement those mitigations. Mitigations should be action focussed and deliverable within a clear and agreed timeframe.

	Risk management should be an ongoing process which includes the widest range of board/Management Committee and staff members to produce a clear and informed register with realistic mitigations.		Risk management should be an ongoing process which includes the widest range of board/Management Committee and staff members to produce a clear and informed register with realistic mitigations.

	==Definitions ==		==Definitions ==

Adminwiki: Created page with "Risk management is the process through which your organisation will objectively evaluate and manage the risk of activities you carry out. This is not limited to ‘risky’ activities and risk management processes should run throughout your operations – including finance, governance, data protection and cyber security, training and staff management. The aim of risk management is to understand and evaluate the potential for any negative outcomes from your activities (..."

2025-06-24T11:04:56Z

Created page with "Risk management is the process through which your organisation will objectively evaluate and manage the risk of activities you carry out. This is not limited to ‘risky’ activities and risk management processes should run throughout your operations – including finance, governance, data protection and cyber security, training and staff management. The aim of risk management is to understand and evaluate the potential for any negative outcomes from your activities (..."

New page

Risk management is the process through which your organisation will objectively evaluate and manage the risk of activities you carry out. This is not limited to ‘risky’ activities and risk management processes should run throughout your operations – including finance, governance, data protection and cyber security, training and staff management.

The aim of risk management is to understand and evaluate the potential for any negative outcomes from your activities (e.g., data breach, financial mismanagement) to frame and understand the potential for external risks to impact your organisation (e.g., pandemic, cyber-attack, changes to grants programmes) or to take an objective view of the potential for underperformance in a given area (e.g., organisational ability, slippage). Once identified, strategies should be agreed to reduce or mitigate the organisation’s exposure to any given risk. This might include not undertaking the risk activity at all.

While risk management discussions are often carried out informally, through discussions or throughout the development of projects and policies, this page focuses on formal risk management approaches.

Your organisation’s risk management processes should be detailed in a Risk Policy which ensures that the process can be approached dispassionately and documented in a manner which allows straightforward review both now and in the future where your learning might influence future decision-making.

==Risk Identification==
[https://www.ibm.com/think/topics/risk-management IBM frames four risk management steps]:

* Risk identification – recognising the risk
* Risk assessment – understanding the probability that a given risk might occur
* Risk mitigation – what strategies can you put in place to reduce or eliminate a risk?
* Risk monitoring – a non-stop process to ensure that your management of risk identified potential challenges and improvements

The process will be contained within a clear, formal, risk register [link: risk register] which is owned by your board/Management Committee and is regularly reviewed to understand changes to any identified risks at any given time.

It is important to recognise that the identification of risks can be limited by your board/management committee’s or the senior management team’s knowledge of a given risk scenario – i.e., the board/Management Committee may not know what it does not know. To improve on this, it may be necessary to explore the nature and potential impacts of a given risk with someone who has greater expertise in that area.

At the highest level, the board should carry a risk register which relates to the overall activities of the organisation. This should focus on the roles and responsibilities of the Board and Management in ensuring that the organisation is well-run, is financially stable and has the appropriate registrations, policies and procedures in place to carry out its activities and to remain compliant with the law.

Your organisation will also carry out risk management processes against individual projects which might be presented in, for example, flash reports which detail the operational and governance aspects of a given project. This should include timescales for delivery, financial management, other areas for concern and/or potential for improvement.

Core to risk management is the notion of mitigation. This is the process by which your organisation can objectively state that it has put measures in place to reduce exposure to particular events. When seeking to mitigate a given risk, you will need to take a dispassionate view of the potential outcomes, realistic mitigations and your organisation’s ability to implement those mitigations. Mitigations should be action focussed and deliverable within a clear and agreed timeframe.

Risk management should be an ongoing process which includes the widest range of board/Management Committee and staff members to produce a clear and informed register with realistic mitigations.

==Definitions ==
Risk

A risk, in its broadest sense, is anything that might have a negative impact upon the way that your organisation operates and might include, for example, financial losses, damage to the organisation or officers’ reputations or those of a funder or the communities which your organisation seeks to work with.

IBM lists six primary risk areas:

* Financial risk: in terms of third sector organisations this might include poor internal management or a lack of financial controls [# Finance] (e.g., overspending, cash-flow and liquidity issues) and the potential for unanticipated changes to funders’ terms and conditions [# Fundraising]. For example, a grant programme may reduce or eliminate a given investment. Financial risk might also be presented by a lack of skills or knowledge. For example, a failure in financial procedures might result in a failure to file appropriate records with Companies House or HMRC.

* Operational risk: this includes both internal and external risks which prevent your organisation from carrying out its activities. This might include internal challenges such as human error, poor recruitment decisions, technology or system failures, or external issues such as natural disasters or geopolitical instability. At core this reflects problems in following through on what you said you would do.

* Cybersecurity risk: this would include data breaches [#, information governance], cyber-attacks, phishing attempts and any issues related to unauthorised access. At this time, the risks from AI are not fully understood but should be included within your assessment and analysed with the Data Controller/Data Protection Officer [# - external, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/] and IT Manager for your organisation.

* Strategic risk: This relates to poor business decision-making, ineffective strategic planning or inadequate responses to external policy changes and technology. For example, your organisation might pursue a course of action which does not entirely fit with your objects or purposes, brings you into competition with colleague organisations or which alienates part of your beneficiary group. This might include mission creep [link to mission creep] or a failure to learn from the past.

* Compliance risk: your organisation will be subject to legislation (e.g., Employment Law [# Employment], Data Protection [# Information Governance], charity regulation [# Charity Law] and the terms of any specific or professional registration body [# Care Inspectorate, SSSC]. Failure to keep up with evolving regulations and legislation will impact upon your delivery and can result in legal or financial problems.

* Reputational risk: anything that might negatively affect your organisation’s reputation such as negative publicity, ethical issues, regulatory issues, financial mismanagement, etc. should be assessed objectively to put in place mitigations. This should include assessing the skills within the board/Management Committee [# board/Management Committee Skills Audit] to oversee the management of the organisation [#Trustee’s Roles and Responsibilities] and putting in place mitigations where the board/Management Committee might have gaps.

==Mitigation ==
Mitigation is a process to identify actions that could reduce the potential of any given risk outcome happening. This might include:

* Risk avoidance: [see Risk appetite below] risk avoidance means not participating in a given activity that might carry a level of risk with which the board/Management Committee is uncomfortable. For example, your organisation might be invited to participate in a collaborative/partnership bid for a contract with a public body [# Fundraising – procurement]. In this situation your organisation might employ a ‘Bid/Not Bid’ assessment to understand the benefits and risks to your organisation. Avoidance of this risk would involve not taking part in the collaboration.
* Risk reduction: short of not taking on an activity, your organisation might undertake to reduce the risk of a given activity. This would require that you have carried out a clear, objective risk assessment and have understood that there are areas of the activity which might be less risky under certain circumstances. For example, you might elect to take on a trading activity if, and only if, you can identify a keystone customer with whom you can establish a good trading relationship.
* Risk sharing: in this scenario, you would identify a partner to share the risk of a given activity with. For example, you might seek to bid on a given contract or propose an activity through a grants programme but might identify recruitment or staffing generally as a risk. Through an agreement with another organisation which has existing skills or workforce, you might share the risk and reduce the potential for reputational, operational, strategic or financial risk.
* Risk transfer: involves using a third-party to absorb the risk of a given activity. For example, you might have desks to rent at your premises but do not necessarily have the resources in-house to advertise and build a platform for a desk-rental enterprise. In this scenario, you might sub-contract this activity to an established provider who could pay you a regular income regardless of their performance and who would carry the risk of managing the trading activity.

* Risk acceptance and retention: in this scenario, your organisation chooses to accept a given level of risk – usually following any mitigations – and will proceed with this activity in the knowledge that this might cause some difficulties in the future. A particular scenario here is in the need to balance competing risks. For example, during a redundancy process where financial risk is balanced against the level of expertise within a team.

==Risk appetite ==
Your organisation’s risk appetite describes the types and levels of risk that your organisation is willing to take on in the pursuit of its objectives. It broadly defines the boundaries within which risk can be taken and helps to guide decision-making.

Organisations will tend to have different appetites in different contexts – so it might be, for example, more willing to take on risk at the small project level than an organisational level.

The key aspects of Risk Appetite are:

1. Strategic Alignment: Risk appetite must align with an organisation’s goals, values, and capacity to bear risk.

2. Scope: It applies across various categories of risk, including financial, operational, reputational, and strategic.

3. Variability: It can vary by department, project, or situation. For example, a tech startup might have a higher risk appetite for innovation, while a bank may have a lower risk appetite for regulatory compliance risks.

4. Influencing Factors:
* Financial strength
* Stakeholder expectations
* Regulatory requirements
* Market conditions

==Risk Register==
[link to main risk register page]
The use of a risk register allows organisations to fully understand the development and management of risks over time. It should be a living document which is updated regularly. The specific purpose of a risk register will dictate its design and there are any number of free documents available online for particular purposes (e.g., finance, projects, tax, HR).

In the event that at an unexpected event occurs or for which mitigations were unsuccessful, the process for identifying risks and mitigations should be reviewed. This might include the need to undertake training with current board members or recruitment for board members who have specific skills in this area.

Conversely, past risk registers should provide insights that can inform future governance and risk assessments – for example, your organisation may have chosen not to participate in a given programme of work based on the level of risk identified at the time. In the event that the programme was successful, it would be valuable to review how and why the decision was taken and whether there are learning points for the future – the converse might be true.

==Specific third sector governance risks==
'''Mission Creep'''

Mission creep refers to the gradual shift in objectives when organisations expand their objectives beyond their original mission. In Scotland, a country with a rich tradition of community-led initiatives and social innovation, mission creep presents unique governance challenges and opportunities.

While expansion is generally a healthy activity, within the mission creep scenario, the expansion sees organisations moving away from their original mission, aims or priorities by expanding their offer toward tenuously related activities or those which might actually create a conflict of interest for the organisation or its beneficiaries.

The phenomenon typically arises from well-intentioned efforts to respond to emerging needs, secure additional funding or to capitalise upon new opportunities. For the Scottish third sector, where many organisations operate with limited funding and rely heavily on volunteers, the risks and rewards of mission creep demand careful governance oversight.

'''Founders’ Syndrome'''

[[Founder's Syndrome|Founder's syndrome]], also known as founderitis, is a phenomenon that occurs when the founder of an organisation becomes a bottleneck to its growth, adaptability, or sustainability. The [https://www.cranfieldtrust.org/articles/founder-syndrome-undermines-the-legacy-of-strong-leaders Cranfield Trust’s Marcus Coetzee] says this “occurs when a founder struggles or refuses to ‘change gear’ and adopt a new mindset, approach or skill set as the organisation grows and as its strategic context changes.”

While this issue can arise in many types of organisations, it is particularly risk in the third sector, where founders are often deeply passionate and personally invested in their cause.

The syndrome manifests itself in ways that hinder the organisation’s development, especially as it transitions from a start-up phase to a more mature institution.

==Further resources and links==
SCVO - [https://scvo.scot/support/running-your-organisation/governance/risks-and-problems/risk-management Risk Policy Template]

Argyll and Bute Third Sector Interface - [https://www.argylltsi.org/managing-risk/ Managing Risk page]

IBM - [https://www.ibm.com/think/topics/risk-management Risk Management]

Health and Safety Executive (HSE) – [https://www.hse.gov.uk/simple-health-safety/risk/index.htm Managing risks and risk assessment at work]

[https://www.theirm.org/ The Institute of Risk Management]

The Local Government Association – [https://www.local.gov.uk/publications/must-know-guide-risk-management Must know guide: risk management]

Audit Sample - [https://audit.scot/uploads/docs/um/risk%20management%20framework%2024-26.pdf Risk Management Framework]

Food Standards Scotland - [https://www.foodstandards.gov.scot/downloads/05b%20-%20Board%20Meeting%20-%202022%20March%2016%20-%20FSS%20Risk%20Management%20Policy%20and%20Guidance%20Draft%202022%20-%20220305b.pdf Sample Risk Management Policy]

Scottish Government – Framework for risk assessment management and evaluation (FRAME) – for local authorities and partners – for people under 18 https://www.gov.scot/binaries/content/documents/govscot/publications/advice-and-guidance/2014/12/framework-risk-assessment-management-evaluation-frame-local-authorities-partners-incorporating/documents/00466882-pdf/00466882-pdf/govscot%3Adocument/00466882.pdf

Children’s Hearings Scotland – [https://www.chscotland.gov.uk/media/e1qhtumj/risk-management-policy-4-2-updated-approved-20231605.pdf Risk Management Policy]

Visit Scotland – [https://www.visitscotland.org/what-we-do/policies/risk-management Our Risk Management Policy]

Scottish Fire and Rescue – [https://www.firescotland.gov.uk/businesses-and-landlords/fire-risk-assessment/ Fire Risk Assessment: what a Fire Safety Risk Assessment is and how to undertake one]