Risk Management for NGO Projects: Identify, Assess and Respond Before Trouble Starts

Every NGO project runs on assumptions: that partners will deliver, that prices will stay roughly where they were, that the community will engage, that the security situation will hold. Risk management for NGO projects is simply the discipline of asking, early and often, “what could go wrong, and what will we do about it?” Done well, it is not paperwork for the donor; it is one of the most practical habits a project team can build.

This article sets out a five-step method you can apply to almost any project, from a small community initiative to a multi-country programme. We will use a fictional example throughout: a youth employment NGO running a twelve-month vocational training and job placement project in two cities, funded by an institutional donor and delivered with a local training partner.

Why risk management for NGO projects matters

NGO projects carry a distinctive mix of risks. Budgets are tight and often fixed, so there is little room to absorb shocks. Many projects operate in fragile or fast-changing contexts. Teams depend heavily on partners, volunteers and community goodwill. And the people the project serves can be harmed if something goes wrong, which is why safeguarding, data protection and do-no-harm principles sit alongside the more familiar time, cost and quality concerns.

Donors increasingly expect a clear risk analysis in proposals, regular updates in reports and evidence that risks are managed rather than merely listed. Frameworks such as the Core Humanitarian Standard also emphasise accountability to affected people, which includes anticipating harm. But the strongest argument is practical: problems that have been anticipated are cheaper, faster and less stressful to deal with.

Risks, issues and assumptions: get the vocabulary straight

• A risk is an uncertain event or condition that, if it occurs, would affect one or more project objectives. Risks can be negative (threats) or positive (opportunities).
• An issue is something that has already happened and must be dealt with now. Risks that materialise become issues.
• An assumption, in logframe terms, is an external condition you are relying on. Every assumption implies a risk: the risk that it does not hold.

Keeping these distinct prevents a common muddle in which the risk register fills up with current problems and nobody is looking ahead.

Step 1: Identify risks

Use more than one technique, because each surfaces different kinds of risk:

• Assumption review. Go through your logframe’s assumptions column and turn each one into a risk.
• Category prompts. Walk through a checklist of categories (see below) so that you do not focus only on the obvious operational risks.
• Pre-mortem. Ask the team to imagine it is the end of the project and it has failed. Each person writes down why. This often surfaces concerns that people hesitate to raise in a normal meeting.
• Lessons learned. Review evaluations and final reports from similar past projects, your own or others’.
• Stakeholder conversations. Partners, field staff and community representatives often see risks that headquarters does not.

Risk categories worth checking

• Operational and delivery (recruitment, logistics, procurement, partner capacity)
• Financial (exchange rates, inflation, cash flow, fraud and corruption)
• Safeguarding and protection of participants, staff and volunteers
• Safety and security
• Political, legal and regulatory (registration, permits, changes in law)
• Reputational
• Data protection and information security, including GDPR where it applies
• Environmental and climate-related
• Strategic and sustainability (what happens after funding ends)

Write risks as cause, event and effect

“Partner capacity” is a topic, not a risk. A well-written risk statement has three parts: because of a cause, there is a risk that an event occurs, which would lead to an effect on objectives. For example:

Because local employers have not yet signed placement agreements, there is a risk that fewer employers than planned offer internships, which would lead to the job placement target being missed and graduates losing motivation.

Written this way, the risk immediately suggests responses: work on the cause (secure agreements earlier), reduce the likelihood of the event, or prepare for the effect.

Step 2: Assess likelihood and impact

Score each risk on two dimensions using a simple scale, typically one to five. The important thing is that the team agrees what each score means, otherwise one person’s “3” is another’s “5”.

Score	Likelihood	Impact
1	Very unlikely in the project period	Minor inconvenience; absorbed within normal work
2	Unlikely, but possible	Small delay or cost; no effect on outputs
3	As likely as not	Noticeable delay or overspend; one output partly affected
4	Likely	Significant effect on an output or the outcome; donor must be informed
5	Almost certain	Project outcome at risk; serious harm to people or reputation

Multiply the two scores to obtain a rating from 1 to 25, then band the ratings: for example, 1 to 6 low, 8 to 12 medium, 15 to 25 high. Adjust the bands to your organisation’s risk appetite. One important exception: any risk involving serious harm to people, particularly safeguarding risks, should be treated as high priority regardless of its calculated score.

Step 3: Choose a response

For threats, there are four classic response strategies, used in most project management standards including PMI’s PMBOK Guide and PRINCE2:

• Avoid: change the plan so the risk cannot occur, for example by dropping a high-risk location or activity.
• Reduce (mitigate): lower the likelihood, the impact or both, for example by pre-qualifying suppliers or training staff.
• Transfer (share): pass part of the consequence to another party, for example through insurance or a fixed-price contract. Note that reputational and safeguarding responsibility can rarely be transferred.
• Accept: consciously decide to live with the risk, either passively or with a contingency plan ready to activate if it occurs.

Do not forget opportunities. If a local government scheme might start subsidising apprenticeships, the responses are to exploit it (make sure it happens), enhance it (increase its likelihood or benefit), share it with a partner better placed to capture it, or simply accept it.

Every response must be proportionate. A response that costs more than the expected damage is rarely justified, unless the risk involves harm to people or the survival of the organisation.

Step 4: Assign owners, actions and triggers

A risk without an owner is a risk nobody is managing. For each significant risk, record:

• Owner: the person best placed to monitor and act, who has agreed to take it on.
• Actions: specific steps, with deadlines, that implement the response. These should also appear in the work plan and, where they cost money, in the budget.
• Trigger: an early-warning sign that the risk is becoming more likely, such as “fewer than five employer agreements signed by month three”.
• Contingency plan: what you will do if the risk occurs anyway.

Step 5: Monitor and review

A risk register is only useful if it is alive. Make a five-minute risk review a standing agenda item in regular project meetings: check triggers, update scores, close risks that have passed and add new ones. Hold a deeper review each quarter, at major milestones and whenever something significant changes in the context. Report the top risks, and how they are being handled, in donor reports.

Worked example: an extract from a risk register

Here is how part of the youth employment project’s register might look after the first workshop. L is likelihood, I is impact and R is the rating.

Risk	L	I	R	Response	Owner	Trigger
Fewer employers than planned offer placements, leading to missed placement target	4	4	16	Reduce: start employer engagement in month one; recruit an employer liaison officer; widen sectors	Placement coordinator	Fewer than five agreements by month three
Training partner lacks financial controls, leading to ineligible costs	3	4	12	Reduce: pre-award capacity assessment; monthly financial reviews; staged payments	Finance manager	Late or incomplete monthly reports
A trainee is harmed or exploited during a placement	2	5	10 (treat as high)	Reduce: safeguarding clauses in employer agreements; trainee briefing; confidential reporting channel; site checks	Safeguarding focal point	Any concern raised by trainee or staff
Local currency weakens against the donor currency, changing the value of local costs	3	2	6	Accept with monitoring; agree with donor how gains and losses will be treated	Finance manager	Rate moves beyond agreed threshold
Trainee personal data is lost or disclosed	2	4	8	Reduce: access controls; data minimisation; staff training; data sharing agreement with partner	Project manager	Any security incident or near miss
Opportunity: municipality launches an apprenticeship subsidy	2	3	6	Exploit: keep regular contact with the municipal employment office; prepare employers to apply	Project manager	Public announcement of scheme

Notice that each response generates concrete actions. Recruiting an employer liaison officer has a budget implication; staged payments to the partner must be written into the partnership agreement; safeguarding clauses must be drafted before placements begin. That is how risk management stops being a separate document and becomes part of the plan.

Linking risk to the budget and schedule

Risk responses cost time and money, so they belong in your plan from the start. Some donors allow an explicit contingency line in the budget; others do not, in which case risk is usually managed through realistic unit costs and careful scheduling. On the schedule side, risks affecting activities on the critical path deserve particular attention, because any delay there delays the whole project. Estimating, scheduling and the use of contingency reserves are covered in detail in our Advanced Project Management Tools & Techniques workshop.

Common mistakes

• Listing generic risks. “Insecurity” or “inflation” tells nobody what to do. Be specific about cause, event and effect.
• Registering and forgetting. A register written for the proposal and never reopened provides false comfort.
• Everyone owns everything. If the owner column says “project team”, nobody owns it.
• Ignoring low-probability, high-impact risks. Serious safeguarding incidents, fraud or a data breach may be unlikely, but the consequences can be severe.
• Only looking at threats. Missing opportunities is also a risk to your results.
• Hiding risks from the donor. Early, honest communication usually earns more flexibility than a late surprise.
• Treating issues as risks. If it has already happened, it needs action now, not a likelihood score.

Quick-start checklist

1. Agree likelihood and impact scales and rating bands with your team.
2. Run a one-hour identification workshop using assumptions, categories and a pre-mortem.
3. Rewrite every risk in cause, event, effect format.
4. Score inherent risk, choose a response, then score residual risk.
5. Name an owner, actions, a trigger and a contingency plan for each significant risk.
6. Transfer response actions into the work plan and budget.
7. Add a short risk review to every regular project meeting.
8. Escalate high risks to management, and report key risks to the donor.

Proactive risk planning is a core module of our Project Management Fundamentals workshop, where you will build a risk register for a real NGO scenario. If you would prefer to work on your own projects with your whole team, explore our in-house training or contact us to discuss your needs.