Most organisations know the drill with volunteer risk management. Identify the risk. Design a control. Train people, write the procedure and review it on schedule.
Then the same risk turns up in the next report. And the one after that.
When a risk persists after you've done the obvious things, adding more of the same rarely shifts it. The persistence itself is telling you something.
If the same volunteer risk has sat on your register for several reporting cycles, that is a governance question as much as a coordinator's task. The decision in front of you is whether it needs another control or is showing you something about how the organisation operates.
Three questions, not two
Stripped back, risk management is planning. I work through three questions.
- What could go wrong?
- What could cause it?
- Why does that cause keep occurring?
Most risk processes I see stop at the second. The first names the risk. The second names the mechanics. The third looks at the conditions, behaviours and human factors that let it continue.
Take volunteer retention . The risk is that retention falls. The cause is ongoing disagreement between volunteers and staff. The organisation responds with clearer communication, more training, closer supervision or a revised process. All reasonable.
If the disagreement continues, ask why. Expectations might still be open to interpretation. Decision-making authority might be unclear. Volunteers and staff might hold different pictures of each other's roles. Difficult conversations might be happening too late. The way the volunteer program runs might create the same friction points every week.
The job at this stage is to investigate before settling on an explanation.
Recurring risk is information
A risk that keeps appearing after an intervention tells you your understanding of the problem is incomplete. The original control may not have been wrong. It may have dealt with one part of the risk and left another untouched.
Human behaviour matters here. People interpret situations, prioritise, forget, adapt and take shortcuts. They respond to the environment they're working in and they find their own ways of getting things done. Some of those ways are better than the procedure.
None of that is surprising. Read it as information about the risk.
Treat the workaround as evidence
Say a volunteer onboarding process has several steps that need following every time. On paper it's sound. In practice, coordinators at most sites skip one particular step.
The usual response is to reinforce the procedure with another reminder or another training session. The workaround is better treated as diagnostic information.
- Is the step hard to complete?
- Does it duplicate something done elsewhere?
- Does it make sense in the circumstances people face?
- Is responsibility for it unclear?
- Has the operating environment changed since someone designed it?
The behaviour shows you where to look.
What has the organisation assumed?
Human factors sit underneath most persistent risks. A volunteer makes a decision beyond their authority. The immediate issue is the decision. The apparent cause is not following process.
Underneath, they might have misunderstood their authority, believed they were acting in the organisation's interest, felt pressure to fix something quickly, worked in a role whose boundaries were never as clear as the organisation thought or found that the way the work is set up encouraged the behaviour. Each of those calls for a different response. The response has to follow the diagnosis.
For leaders reviewing a recurring risk, one question opens this up: what have we assumed people will do?
Have we assumed they will:
- recognise the risk
- follow the process
- know when to escalate
- make the decision we expect
- report what they see
Have we assumed the system will hold when circumstances change?
These questions are about the conditions the organisation asks people to work in. They keep the conversation on design, where leaders have the most influence.
The view from the ground
Volunteer managers and coordinators see these patterns first. They see the recurring questions, the workarounds, the points of confusion and the steps that get bypassed. They see where one person keeps stepping in to interpret, resolve or fix something, which is a risk in its own right.
That knowledge rarely reaches the risk register . When it does, the conversation moves from "people aren't following the process" to "what keeps producing this behaviour?" The second question leads somewhere you can act on.
Before you add another control
When a risk persists, the instinct is to strengthen the existing response. More training, more supervision, another form, another approval, another policy. Sometimes that's right.
Often the more useful step is working out what the existing response hasn't touched. That might be unclear responsibility, decision-making friction, capability gaps, competing priorities, a process designed for different circumstances or assumptions that no longer hold.
Jumping from risk identified straight to control required skips the thinking that changes things. Planning prepares you for what might happen. A persistent risk shows you what is already happening.
The most valuable information in your risk register often isn't the risk itself. It's the fact that you haven't managed to shift it.
2 Comments