← University
Building an Enterprise Risk Framework
Faculty of Risk ManagementEnterprise Risk
0 of 6
123456

A regional non-profit organization in southern Alberta that provides employment training and supportive housing services has operated for 22 years, growing from a small charitable initiative into an organization with an annual operating budget of $4.8 million, 47 full-time staff, and 3 service locations across 2 municipalities. The organization holds service contracts with 2 provincial ministries, receives funding from 4 corporate donors and a community foundation, and maintains a portfolio of 6 residential properties that house program participants. Its board of directors consists of 9 volunteer members drawn from the local business, legal, and social services communities.

During a board governance review conducted in response to concerns raised by the organization's external auditor, directors discovered that risk management across the organization existed in disconnected pockets with no coordinating structure. The finance team maintained a spreadsheet tracking accounts receivable aging and cash flow projections. The housing program manager kept an informal log of building maintenance issues and tenant complaints. The human resources coordinator had developed a checklist for workplace safety incidents. The information technology contractor who visited twice monthly had flagged cybersecurity vulnerabilities in 3 separate reports over 18 months without receiving a formal response from management. None of these activities connected to one another, to the organization's strategic plan, or to regular board deliberations.

The governance review also revealed that 2 of the organization's ministry contracts contained new provisions requiring funded agencies to demonstrate formalized risk management practices by the next contract renewal period, now 14 months away. The board chair, a retired manufacturing executive, recalled that the company where she had spent her career had implemented an enterprise risk management framework after a supply chain crisis, but she was uncertain how such an approach would translate to a non-profit context with different stakeholders, funding structures, and accountability relationships.

The executive director, who had led the organization for 8 years, acknowledged that risk conversations tended to arise only after problems materialized rather than through any systematic anticipation. A recent incident illustrated the point: a data breach affecting 340 client records had prompted a reactive scramble rather than an execution of pre-established protocols, because no such protocols existed. Staff members in different departments had responded based on their own judgment, with inconsistent messaging to affected clients and no clear escalation path to the board.

The board directed the executive director to develop a proposal for implementing an enterprise-wide approach to risk management, with attention to available frameworks, governance structures, resource requirements, and the cultural changes necessary to embed risk awareness throughout the organization.

Connecting Risk Management to Strategic Planning and Board Oversight

Risk management exists not as an isolated technical discipline but as a fundamental component of how organizations create, protect, and sustain value over time. When Canadian organizations treat risk management as a compliance checkbox or delegate it entirely to insurance brokers and safety committees, they miss the profound connection between understanding risk and making sound strategic decisions. The integration of risk management into strategic planning and board oversight represents a maturation in organizational thinking, one that recognizes uncertainty as both a threat to be managed and an opportunity to be captured. This lesson examines how Canadian small and medium-sized businesses, non-profit organizations, and professional service firms can build meaningful connections between their risk management activities and their highest levels of strategic decision-making, creating governance structures that enable rather than merely protect.

The conceptual foundation for connecting risk management to strategic planning rests on a straightforward premise: every strategic decision involves assumptions about the future, and every assumption carries uncertainty. When a manufacturing company in Hamilton decides to expand into Western Canadian markets, that decision embeds assumptions about transportation costs, regional demand patterns, competitive dynamics, and regulatory requirements. When a non-profit organization in Montreal chooses to launch a new program serving vulnerable populations, that decision embeds assumptions about funding sustainability, volunteer capacity, community reception, and legal exposure. Risk management, properly understood, is the systematic discipline of identifying these embedded assumptions, evaluating the consequences if those assumptions prove wrong, and developing responses that keep the organization resilient regardless of how the future unfolds. Strategic planning without risk integration is essentially optimism documented in a formal format, while risk management without strategic connection becomes an exercise in cataloguing fears without understanding which fears actually matter to organizational success.

That’s the free preview

You’ve reached the end of what’s open to read. The rest of this lesson is part of a $149 course — purchasing unlocks it, or sign in if you already have access.

Unlock this course — $149
Join Binder UniversityTry Binder

More in this program

Key Risk Indicators: What to Measure and How to Set Thresholds
Risk Monitoring, Reporting, and Escalation
Risk Appetite vs. Risk Tolerance vs. Risk Capacity: The Distinctions That Matter
Risk Appetite and Tolerance: Setting the Parameters
The ERM Landscape in Canada: Standards, Expectations, and the Regulatory Environment
Enterprise Risk Management: Comprehensive Program