Responsibilities of the Board of Directors for Risk Management

The board of directors is responsible for overseeing—not personally executing—risk identification, mitigation strategy, and ongoing monitoring across the organization. For a nonprofit, that means the board holds the fiduciary duty to make sure someone is watching the risks that could harm the mission, the money, or public trust, even when staff do the day-to-day work.

In its 2022 survey of about 1,500 corporate directors, McKinsey reported that only 7 percent believed their boards had been “most effective” at risk management and only 40 percent said their organizations were prepared for the next large crisis. This guide turns the duty into concrete tools: a risk category checklist, a sample risk register, D&O insurance basics, and the board portal features that support oversight.

What is the board’s role in risk management?

Boards define strategy, and every strategy involves risk. Practices differ, but the goal is the same. Risk has to be:

• Recognized: the board knows which risks exist and which could threaten the mission.
• Acknowledged: directors agree on which risks matter most and accept responsibility for oversight.
• Handled: someone owns each risk, a response is in place, and the board checks that it works.

The Nonprofit Risk Management Center describes one of the board’s roles as ensuring the systematic identification of the risks that threaten the mission and survival of a nonprofit. BoardSource adds that board members must meet the duties of care, loyalty, and obedience, and that the board is ultimately responsible for legal and ethical integrity.

The fiduciary duty of oversight in plain English

The best-known statement of the oversight duty comes from In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996). The case holds, in short, that directors should make a good-faith effort to ensure a reporting and monitoring system exists. The board is not liable for every bad outcome. It can face exposure for a sustained, systemic failure to have any risk-monitoring system at all.

Two cautions apply. Caremark involved a for-profit Delaware corporation, while nonprofit directors are governed mainly by state nonprofit law. And courts treat these claims as difficult to win, which is no reason to relax. A written process, regular reports, and clear minutes are the practical way to show good-faith oversight. This article is general information, not legal advice. Consult your organization’s counsel about how your state applies these standards.

Escalated cybersecurity and IT risk

Directors often ask where their responsibility for IT risk begins. Director responsibility for IT risk follows the same logic as any other risk: the board does not configure firewalls, but it must make sure the organization has people, budget, and controls to protect donor and client data. As work and record-keeping move online, remote governance saves time and money, yet the exposure to leaks and breaches grows with it.

The numbers show why this belongs on the board agenda. NetHope’s 2025 State of Humanitarian and Development Cybersecurity Report, based on 30 member nonprofits, found that 53 percent reported a security breach or other critical data incident in 2025 (down from 65 percent in 2024). It also found that credential-based attacks such as phishing affected 94 percent of respondents and that 70 percent reported a higher cyber risk profile than in 2024. The sample is global, so treat the figures as a signal, not a U.S. benchmark.

For virtual governance, the best board practices include:

• Using trustworthy board software for governance. A virtual boardroom rests on confidentiality and engagement. Look for encryption, role-based permissions, and audit logs, and compare options in our Ideals Board review or Diligent review.
• Restricting access to vital information. Assign access by role and need to know, and remove it promptly when a director’s term ends.
• Choosing reliable software and hardware. Board software works alongside operating systems and personal devices, so part of the board’s responsibility is evaluating the tools directors use to reach confidential material.

Ask management each year what resources IT needs and whether the board has funded them. McKinsey’s directors also suggest planning in advance for cyber events such as ransomware, so decisions are not improvised mid-crisis.

See how the top nonprofit board portals compare on security and compliance: compare nonprofit board portals.

A board’s risk management responsibilities

The most straightforward way to allocate the responsibilities of a board of directors for risk management is to take each threat through five stages. The cycle below is a simple risk oversight framework that works for a small volunteer board and scales up to a larger one. The six categories in the next section show what to run through it.

1. Assess

The board identifies risks in each area of operation. Use the risk categories table below to make “financial, legal, fiduciary, and so on” concrete.

• Review the six risk categories and add any that are specific to your mission.
• Ask management for the top risks in each category.
• Make sure IT and other overloaded teams receive the support and resources they need.

2. Respond

Next, the board delegates risk management to the right departments. The board remains responsible regardless of who handles the case. When directors serve on committees, their role is more than observational, and the board gains insight into how procedures are carried out.

3. Control

Whether or not directors sit on committees, it is the board’s job to oversee how risks are handled and to adjust strategy when needed. The board also sets an example for everyone else, so supervising managers and executives includes making sure the board itself is compliant and transparent.

4. Communicate

Clear, active communication at every step is part of the job, and decisions must be documented. Use a short checklist:

• What to document: the risks discussed, decisions made, questions raised, and assigned owners.
• Who receives it: the responsible staff or committee, and all directors through the approved minutes.
• How often: at every regular meeting for high-priority risks, and at least quarterly for the full register.

Templates and resolution formats can help; see our guide to nonprofit board resolutions. Keeping records organized is easier with document management for nonprofits.

5. Analyze

At least once a year, look back at the risk-handling practices in place, gather input from directors and delegates, and update the strategy. The concrete output of this review is the board risk register described below. The analysis also works as an evaluation of the board’s own effectiveness.

Risk categories every nonprofit board should track

This table gives your board an actual checklist for nonprofit board risk management. Add rows for risks specific to your programs.

Risk category	What it covers	Example for a nonprofit board
Financial	Budget, reserves, investment policy, revenue concentration	Over-reliance on a single major donor or grant
Legal & compliance	Tax-exempt status, employment law, contracts, state filings	Missed Form 990 deadline or lapsed charitable-solicitation registration
Fiduciary / governance	Conflicts of interest, duty of care, duty of loyalty	A board member voting on a contract with their own company
Reputational	Public trust, donor confidence, media exposure	A data breach or a leadership scandal reaching local press
Cyber & IT	Data security, donor/client records, system access controls	Unauthorized access to donor payment or client records
Operational	Staffing, program delivery, key-person dependency, facilities	Loss of the sole staff member who runs a core program

Categories overlap: a breach of donor records is a cyber risk, but it also becomes a legal, financial, and reputational problem. McKinsey’s directors make the same point: boards should consider scenarios where several risks hit together, not only individual risks.

Building a simple board risk register

A risk register is a running list of the risks the board has identified, with a score, an owner, and a plan for each. You can build one in a spreadsheet in an afternoon.

Start with these columns: risk, category, likelihood, impact, owner, mitigation, and review date. The two rows below show the format. They are illustrative examples, not a diagnosis of your organization.

Risk	Category	Likelihood	Impact	Owner	Mitigation	Review date
Loss of largest funding source	Financial	Medium	High	Treasurer / ED	Diversify funding; build 6-month reserve	Quarterly
Unauthorized access to donor data	Cyber & IT	Medium	High	Board chair / IT lead	Role-based access controls; MFA; audit-trail review	Quarterly

Keep the register short enough to read, give each row one accountable owner, and review high-impact items every quarter. Record in the minutes that the board reviewed it.

The Nonprofit Risk Management Center, a specialist in nonprofit risk, publishes risk assessment resources through its site; some materials require a paid membership or purchase, so check what is available for your budget.

D&O insurance basics for nonprofit boards

Directors and officers (D&O) liability insurance protects the organization and its leaders when someone alleges a wrongful act in the way the nonprofit is governed or managed. For many boards it is the most practical safeguard against the personal financial risk of serving. The National Council of Nonprofits notes that a director’s duty of care supports making sure the organization carries adequate insurance.

What D&O insurance covers, and what it does not

Policies typically cover defense costs and certain settlements or judgments from covered claims, such as alleged mismanagement, conflicts of interest, or employment-related disputes. Coverage often extends to staff as well as directors. Policies usually exclude fraud, intentional misconduct, and criminal acts, and they do not replace general liability, property, or cyber coverage.

Why “we’re a volunteer board” is not a liability shield

Many volunteers assume their unpaid status protects them. Some federal and state laws offer limited protection to volunteers, but they have exceptions, and they do not stop someone from filing a claim or covering your legal defense. Directors can also face personal exposure in narrow cases, such as unpaid payroll withholding taxes. Ask counsel what protections apply in your state; this article cannot say.

Questions to ask before you buy or renew

1. Limits: are the coverage limits appropriate for our budget, programs, and employee count, and do defense costs erode the limit?
2. Exclusions: which claims are excluded, and are there carve-outs for employment practices or regulatory actions?
3. Who is covered: does the policy include current and former directors, officers, staff, and volunteers on committees?
4. Related coverage: do we also need employment practices, fiduciary, or cyber liability policies, and are they bundled or separate?

Give new directors a plain-language summary of your policy during onboarding.

Board portal features that support risk oversight and compliance

So far, “trustworthy board software” has been a phrase. In practice, trust comes from specific features: how documents are stored and who can open them, whether every action leaves an audit trail, and whether committees and action items can be tracked. The table below summarizes what BoardroomMind’s own review pages list for four portals. Board portal risk management features vary widely, so confirm details with each vendor before relying on them for compliance. If budget is a factor, see our board portal pricing comparison.

Board portal	Document security	Audit trail / compliance certifications	Committee & risk tracking
Ideals Board	Encrypted central repository with role-based permissions	Expanded audit-log events for deeper compliance	Committee and action-item tracking
BoardEffect	End-to-end encryption; unlimited secure storage	ISO 27001/27017/27018, SOC 1 & SOC 2, HIPAA/HITECH; full audit trail of board actions	Dedicated committee workspaces; analytics dashboards
Diligent	Secure data storage, SSL, authentication	Digital signature supported; Archiving & Retention and Role-Based Permissions are listed as unsupported on the vendor’s feature list, so confirm before relying on it for compliance archiving	Survey and role management; no listed action-item tracking
OnBoard	Confidential handling of minutes and signed documents	HIPAA compliance for healthcare clients; e-signature with signer notifications	Voting and agenda tools; no compliance certifications listed on the vendor’s own page

Read the table as a starting point for your own questions: Does the portal log who viewed or changed a document? Can you limit access by role and remove it quickly? Can the board assign and track action items from the risk register?

Ready to shortlist? Compare nonprofit board portals and see how the top options stack up on security and compliance.

Сonclusion

A nonprofit board cannot eliminate risk, but it can show that it saw the risks coming and acted in good faith. Before your next meeting, take these steps:

• Know the standard. The board oversees risk and is not expected to prevent every loss, but a sustained failure to monitor can create exposure under the Caremark line of cases. Confirm how your state applies it with counsel.
• Run the five-stage cycle. Assess, respond, control, communicate, and analyze every year, and document each step.
• Use the risk categories table. Walk the six categories at least annually and add mission-specific risks.
• Start a risk register. Two rows today are better than a perfect template next year; assign owners and review dates.
• Review D&O insurance. Check limits, exclusions, and covered persons at every renewal, and brief new directors.
• Close gaps with the right tools. A board portal with role-based permissions, audit logs, and action-item tracking can support all of the above. Compare nonprofit board portals to find one that fits.

FAQ

What is the role of the board of directors in risk management?

The board oversees risk management rather than performing it. It sets expectations and risk policy, makes sure management identifies and assesses risks, monitors how those risks are handled, and reviews the whole process at least once a year. Day-to-day execution belongs to staff and management, but accountability for oversight stays with the board.

What types of risks should board directors be aware of?

Nonprofit boards should track six categories: financial, legal and compliance, fiduciary and governance, reputational, cyber and IT, and operational risk. Each category, with a nonprofit example, appears in the risk categories table above. Strategic risk, such as a mission that no longer matches community need, is usually reviewed alongside these.

How can board directors ensure that risk management is effective?

Work through the five-stage cycle every year: assess, respond, control, communicate, analyze. Keep a written risk register with an owner and review date for each item, require regular reports from management, document decisions in the minutes, and test the process by asking what would have to fail for a serious loss to go unnoticed.

What is a nonprofit board’s fiduciary duty in risk oversight?

Nonprofit directors owe duties of care, loyalty, and obedience under state law. For oversight, the Delaware Caremark standard is a common reference point: a board is generally not liable for every bad outcome, but it can face exposure when it makes no good-faith effort to put a monitoring and reporting system in place or consciously ignores warning signs. State rules differ, and this is not legal advice, so ask your counsel how your state applies it.

What should a nonprofit board risk register include?

At minimum: the risk, its category, likelihood, impact, an owner, the planned mitigation, and a review date. The worked example in the risk register section above shows two completed rows that you can copy into a spreadsheet and expand.

Do nonprofit boards need D&O insurance?

No law requires it in every state, but most boards should seriously consider it. Volunteer status does not guarantee protection from claims, and D&O insurance can cover defense costs and certain settlements. Review limits, exclusions, and who is insured with your broker and counsel before buying or renewing. See the D&O insurance basics section for the questions to ask.

Can better risk management practices reduce a board’s liability exposure?

They can help. A documented process, such as a risk policy, a register, regular management reports, and minutes that show the board asked questions, is evidence of good-faith oversight. It cannot eliminate liability or replace insurance, so treat it as one layer alongside D&O coverage and legal advice.