Risk Management

Risk and Insurance

The risk-management manual for Spiralism’s chapters, archive, media, digital systems, finance, events, volunteers, board, and public reputation. The institution should take risks deliberately, not accidentally.

Spiralism is a small institution attempting long work in a volatile era. It will hold testimony, host rooms, publish claims, manage money, use digital systems, work with volunteers, and invite vulnerable people into contact with a shared mission. Those activities create risk. Risk is not a reason to avoid the work. It is a reason to govern the work.

The Rule

Name the risk before the risk names the institution.

Every serious new activity should ask:

  1. What can go wrong?
  2. Who could be harmed?
  3. How likely is it?
  4. How severe would it be?
  5. What prevents it?
  6. What happens if it occurs?
  7. How would we pay for it?
  8. Who owns the decision?

BoardSource and the Nonprofit Risk Management Center frame risk management in similar terms: identify what can go wrong, decide what to do before and after harm occurs, and understand how the organization will pay when something happens.

Risk Owner

Every risk needs an owner. An owner is not a scapegoat. An owner is the person responsible for noticing, updating, and escalating.

Founding-period risk owners:

If no one owns a risk, the institution has accepted it blindly.

Risk Register

Maintain a living risk register:

Risk:
Domain:
Owner:
Description:
People affected:
Likelihood: Low / Medium / High
Severity: Low / Medium / High
Current controls:
Needed controls:
Insurance or reserve response:
Trigger for escalation:
Last reviewed:
Next action:

Review the register quarterly during the founding year and before any major new activity: a retreat, public testimony release, paid role, fiscal sponsorship, large gift, new chapter, youth-facing activity, or media partnership.

Risk Domains

Archive

Risks:

Controls:

Chapters and Events

Risks:

Controls:

Media

Risks:

Controls:

Finance

Risks:

Controls:

Digital

Risks:

Controls:

Safeguarding

Risks:

Controls:

Insurance Review

Insurance is not virtue. It is one way to fund response when prevention fails.

Review at each stage:

Founding Period

Consider:

Incorporated Nonprofit

Consider:

Media Arm

The media arm should carry its own review:

Nonprofits Insurance Alliance lists coverages such as commercial general liability, D&O, fiduciary, employment practices, and volunteer/participant accident coverage. The exact mix depends on actual operations, jurisdiction, scale, and counsel or broker review.

Insurance Questions

Before purchasing or renewing:

  1. What activities are actually covered?
  2. Are volunteers covered?
  3. Are chapter events covered?
  4. Are rented venues covered?
  5. Are online gatherings covered?
  6. Are abuse or molestation claims excluded?
  7. Are media claims excluded?
  8. Are cyber incidents excluded or sublimited?
  9. Are directors, officers, Stewards, and committee members covered?
  10. Are contractors covered or required to carry their own coverage?
  11. Are additional insured certificates available for venues?
  12. What are the deductibles?
  13. What events require notice to insurer?
  14. What documentation must be preserved after an incident?

Do not assume that general liability covers governance decisions, employment claims, media claims, cyber breaches, or abuse claims.

Event Risk Checklist

Before a public gathering:

After the event:

Program design, run sheets, access notes, media notices, and follow-up are governed in Public Programs and Events; this checklist governs the risk controls that must be satisfied before the event happens.

Contracts, Waivers, and Releases

Do not let forms substitute for care.

Use written agreements when:

Counsel should review templates as scale grows. A waiver is not a permission slip to create avoidable danger.

Business Continuity

The institution should be able to survive:

Minimum continuity controls:

Reputation Risk

Reputation risk should not mean “avoid embarrassment.” It should mean “avoid betraying the public promise.”

High-risk public moves:

The institution should prefer a slower public posture over a fast, ambiguous one.

Risk Review Cadence

Quarterly:

Annually:

Public Risk Promise

Use this plain public language:

Risk:
Spiralism hosts gatherings, records testimony, publishes media, handles donor
records, and operates digital systems. These activities create risk. The
institution keeps a risk register, assigns owners to major risks, reviews
insurance needs, documents incidents, and changes policy when experience shows
that a control is missing. The Archive is important; people are more important.

Anti-Patterns

Avoid:

First-Year Risk Targets

By the end of Year One:

Insurance renewal dates and proof of coverage should also be tracked in Compliance Calendar.

Sources Checked