Risk management for non-profit foundations and associations in Saudi Arabia has become an imperative necessity in light of the rapid developments in the Kingdom's non-profit sector, increased funding volume and responsibilities, diversified activities and programs, and rising expectations from regulators, funders, and beneficiaries. Risk management is not merely a preventive measure but a strategic tool that enables non-profit foundations to achieve their objectives efficiently, protect their reputation and assets, and ensure their continuity in delivering developmental services to the community. In this comprehensive guide, we examine in detail the legal framework and professional practices of risk management for non-profit foundations and associations in Saudi Arabia.
Non-profit foundations and associations in Saudi Arabia face a diverse range of risks that vary in nature, severity, and impact, from financial and operational risks to reputation, compliance, and strategic risks. In the absence of an effective risk management framework, these foundations may face significant financial losses, regulatory penalties, reputational damage, or may in some cases lead to suspension of activities, imposition of regulatory sanctions, or legal proceedings depending on the nature of the violation. Therefore, building an integrated risk management system aligned with best professional practices and regulatory requirements is a fundamental investment in the sustainability of the non-profit foundation.
This article covers: the concept of risk management and its importance in the non-profit sector, the legal framework in Saudi Arabia, types of risks in non-profit foundations, risk assessment methodologies, risk treatment strategies, risk management policy, the role of the board and executive management, and frequently asked questions.
Concept and Importance of Risk Management in Non-Profit Foundations
Risk management in non-profit foundations is a systematic and organized process for identifying, analyzing, evaluating, and treating risks that may face the foundation, aiming to reduce potential negative impacts and increase opportunities for achieving objectives. Risk management in the non-profit sector differs from the for-profit sector in that loss here is not limited to the financial aspect but extends to loss of community trust, interruption of vital services to beneficiaries, and damage to the sector's reputation as a whole.
The importance of risk management in non-profit foundations and associations in Saudi Arabia is multifaceted: protecting the foundation's financial, physical, and human assets; ensuring continuity of developmental services to beneficiaries without interruption; enhancing the trust of funders, regulators, and beneficiaries; reducing the likelihood of regulatory penalties and fines; improving the efficiency of strategic and operational decision-making; building an institutional culture aware of risks; and complying with regulatory requirements (National Center for Non-Profit Sector Development, ZATCA, and others). Foundations that effectively manage their risks are better able to attract funding, expand their programs, and achieve deeper developmental impact.
Legal Framework for Risk Management in the Saudi Non-Profit Sector
The legal framework for risk management in Saudi non-profit foundations and associations is based on a set of regulations, rules, and directives that require non-profit foundations to apply sound risk management practices. Key sources include: the Governance Rules for Associations and Non-Profit Foundations issued by the National Center for Non-Profit Sector Development, which require or recommend — as specified by applicable regulations and policies to the entity — written risk management and internal control policies and mandate the audit committee to oversee the risk management system and periodically evaluate its effectiveness. Disclosure requirements in periodic reports also include disclosure of key risks facing the foundation and measures taken to address them.
In addition to Governance Rules, other regulations impose specific requirements: the Associations and Non-Profit Foundations System and its implementing regulations define the foundation's obligations to preserve its assets and resources; zakat and tax regulations impose financial compliance and tax evasion risk management requirements; anti-money laundering and counter-terrorism financing regulations impose compliance risk identification and assessment obligations; and personal data protection rules impose privacy and information security risk management requirements. Compliance with these legal requirements not only protects the foundation from penalties but also enhances its reputation and credibility with funders and partners.
Types of Risks in Non-Profit Foundations and Saudi Associations
Types of risks in non-profit foundations and Saudi associations are diverse and include the following areas:
- Financial Risks: Include funding risks (insufficient donations and grants, intermittent cash flows, dependence on a single funding source), investment risks (fluctuating returns on investments, loss of invested capital), credit risks (delay or non-payment of loans by beneficiaries), fraud risks (embezzlement of foundation funds by employees or volunteers), and exchange rate fluctuations for investments or obligations in foreign currencies.
- Operational Risks: Include human resource risks (lack of qualified personnel, high employee turnover, excessive reliance on uncommitted volunteers), program and process risks (program failure to achieve objectives, poor quality of services), technology risks (system failure, data loss, cyber attacks), supply chain risks (supplier or contractor failure to meet obligations), and facility and maintenance risks (deterioration of buildings and equipment).
- Compliance and Regulatory Risks: Include risks of non-compliance with relevant regulations (penalties and fines from regulatory bodies), regulatory change risks (new legislation requiring significant operational adjustments), partnership contract risks (failure to meet contract terms with funders or partners), and tax and zakat risks (submitting incorrect or late returns to ZATCA).
- Reputation Risks: Include media risks (negative coverage due to program failure or unethical conduct), communication risks (misunderstanding or misinformation in stakeholder communication), employee and volunteer conduct risks (inappropriate behavior damaging the foundation's reputation), and partner risks (reputational damage due to an unsuitable partner's behavior). Reputation risks may be the most impactful in the non-profit sector, as community and funder trust is the foundation's most valuable asset.
- Strategic Risks: Include planning risks (weak or inappropriate strategic plan), governance risks (weak board oversight, ineffective committees), expansion risks (rapid expansion without adequate institutional capacity), sustainability risks (absence of a clear financial sustainability strategy), and direction risks (changes in the founding family or the family owning the foundation's orientations inconsistent with the foundation's vision).
The risk management process must consider the interaction between these risks, as reputation risks may result from operational or financial risks, and strategic risks may increase the severity of financial risks. An integrated approach to risk management takes these interactions into account.
Risk Assessment Methodologies for Non-Profit Foundations
Risk assessment in non-profit foundations and Saudi associations is the process of identifying, analyzing, and evaluating potential risks facing the foundation to determine treatment priorities and allocate appropriate resources. Key risk assessment methodologies include:
- Risk Register: A fundamental document recording all identified risks, with a brief description of each risk, the potential source, assessment of likelihood and impact and overall risk level, current control measures, proposed additional treatment measures, and the party responsible for monitoring each risk. The risk register is the backbone of any effective risk management system and should be updated periodically.
- Risk Matrix: A visual tool used to classify risks based on two dimensions: likelihood of occurrence (low, medium, high) and severity of impact (minor, moderate, major). The risk matrix helps determine risk treatment priorities, with priority given to high-likelihood, high-impact risks. Risks are typically divided into: red zone (high risks requiring immediate treatment), yellow zone (medium risks requiring monitoring and mitigation), and green zone (low risks that can be accepted with periodic monitoring).
- Scenario Analysis: A method used to analyze the impact of a set of potential scenarios on the foundation's performance, such as a 30% decline in donations scenario, loss of a key strategic partner scenario, or regulatory penalties scenario. Scenario analysis helps the foundation prepare for emergency conditions and develop appropriate contingency plans.
- SWOT Analysis: An analytical tool that can be used as part of the risk assessment process, helping identify internal (weaknesses) and external (threats) risks that may affect the foundation's ability to achieve its objectives. When SWOT analysis is integrated with the risk register, the foundation obtains a comprehensive picture of its current situation and the risks it faces.
- Workshops and Brainstorming: Interactive sessions bringing together key stakeholders (board, executive management, program team, funders, beneficiaries) to collectively identify and assess risks. Workshops help uncover risks that may not be apparent in individual analyses and enhance risk awareness culture among all stakeholders.
We recommend conducting a comprehensive risk assessment at least annually, and an updated assessment whenever material changes occur in the foundation's operating environment (such as major expansion, leadership change, new program launch, or legislative change). Periodic assessment ensures the risk register reflects the foundation's current situation and actual risks.
Risk Treatment Strategies
After identifying and assessing risks, the foundation moves to the risk treatment stage by selecting the appropriate strategy for each risk. The main risk treatment strategies are:
- Avoid: Taking actions to prevent the risk from occurring entirely, such as canceling a high-risk activity, not entering into a partnership with an untrusted party, or not investing in high-risk financial instruments. Avoidance is the most effective strategy but may be costly in terms of lost opportunities. It is used for high-impact, high-likelihood risks where mitigation strategies are insufficient.
- Mitigate: Taking actions to reduce the likelihood or impact of the risk to an acceptable level, such as diversifying funding sources to mitigate dependence on a single source, implementing strict internal controls on disbursement to mitigate fraud risk, training employees and volunteers on safety protocols, and purchasing appropriate insurance for assets and activities. Mitigation is the most common and balanced strategy in terms of cost and benefit.
- Transfer: Shifting part of the risk to another party, such as purchasing insurance policies (property insurance, liability insurance, employee life insurance), entering into contracts with specialized contractors who assume part of the responsibility for implementing high-risk activities, or engaging specialized investment management firms to transfer investment risk. Transfer does not eliminate the risk entirely but reduces the financial impact on the foundation.
- Accept: Accepting the risk as is without taking additional treatment actions, when the cost of treatment is higher than the potential loss, or when the risk likelihood and impact are low. In this case, the decision to accept the risk must be documented and periodically monitored to ensure the risk level has not risen above the acceptable threshold. Some risks, such as minor fluctuations in donations, can be accepted as part of the foundation's normal operations.
Selecting the appropriate strategy depends on the risk level, treatment cost, the foundation's risk tolerance, and available resources. In many cases, more than one strategy is combined to treat a single risk, such as mitigating the risk through internal control measures and transferring the remaining portion through insurance.
Risk Management Policy and Governance Structure
The risk management policy in non-profit foundations and Saudi associations is the foundational document defining the risk management framework in the foundation, outlining roles, responsibilities, methodologies, and procedures. The policy should include: introduction and objectives of the risk management policy and its scope of application; definition of risk and its types; risk management principles adopted by the foundation; governance structure for risk management (roles and responsibilities); risk assessment methodology (evaluation criteria and acceptable risk levels); risk treatment procedures (permitted strategies and approval authorities); monitoring and reporting mechanisms (reporting frequency to the board); and policy review and update. The policy must be approved by the board and made available to all staff and volunteers.
The governance structure for risk management in non-profit foundations distributes responsibilities as follows: the board bears ultimate responsibility for the risk management system and its effectiveness; the audit committee oversees the risk management system and evaluates its effectiveness; executive management implements the risk management policy and identifies and assesses risks on a daily basis; and all staff and volunteers are responsible for reporting risks they encounter in their daily work. Successful risk management requires commitment from all levels, from the board to field staff, and an institutional culture that encourages reporting risks without fear of blame or punishment.
Frequently Asked Questions About Risk Management in Non-Profit Foundations
Below are answers to the most common questions about risk management in non-profit foundations and associations in Saudi Arabia:
Is risk management mandatory for non-profit foundations in Saudi Arabia?
Yes, the Governance Rules for Associations and Non-Profit Foundations require or recommend — as specified by applicable regulations and policies to the entity — written risk management and internal control policies and mandate the audit committee to oversee the risk management system.
What are the most important types of risks facing Saudi non-profit foundations?
Financial risks (funding and investment), operational risks (HR, programs, technology), compliance risks, reputation risks, and strategic risks.
What are the basic tools for risk assessment in non-profit foundations?
Risk register, risk matrix, scenario analysis, SWOT analysis, and group workshops for identifying and assessing risks.
Who is responsible for risk management in a non-profit foundation?
The board bears ultimate responsibility, the audit committee oversees, executive management implements, and all staff report risks.
How often should the risk register be updated?
At least annually, and whenever material changes occur in the foundation's operating environment such as major expansion or legislative change.
Conclusion: Toward a Risk-Aware Institutional Culture in the Saudi Non-Profit Sector
Risk management for non-profit foundations and associations in Saudi Arabia is not merely a regulatory requirement or a formal procedure but a strategic investment in the foundation's sustainability, effectiveness, and ability to achieve genuine developmental impact. Foundations that adopt a risk-aware institutional culture are better prepared to face challenges, more capable of seizing opportunities, and more worthy of the trust of funders, beneficiaries, and regulators. Building an effective risk management system requires leadership commitment, deep understanding of the nature of risks in the non-profit sector, and investment in building appropriate capacities and tools.
We invite all non-profit foundations and associations in the Kingdom to begin building a risk management system appropriate to their size and activity nature, engage specialized expertise in designing and developing risk management systems for the non-profit sector, and invest in training boards and executive teams on risk management principles and tools. At Nova Legal for Law and Legal Consulting, we offer specialized services in developing risk management systems for non-profit foundations, including designing risk management policies and procedures, preparing risk registers, training boards and teams, and reviewing and evaluating the effectiveness of existing risk management systems. We look forward to accompanying your foundation on the journey of building a risk-aware institutional culture toward sustainability and deeper developmental impact.