Join
AES
Join
AES
Contact
Us
Contact
Us
By Nick Koerbin, Executive Director, Association Executive Services
Risk management is one of those areas that every association and not-for-profit Board knows is important - but it can sometimes become little more than a risk register reviewed once or twice a year.
Insurance can be treated in much the same way.
The organisation receives its annual insurance renewal, the premium is approved, the policy is renewed and everyone assumes the organisation is covered.
But is it?
From a management and governance perspective, the more important question is:
Does the organisation understand its current risks, and has it satisfied itself that the controls and insurance arrangements it has in place are appropriate for those risks?
Association Executive Services does not provide financial, legal or insurance advice, and organisations should obtain appropriate professional advice from qualified insurance brokers, legal advisers and other specialists.
However, from our experience working with associations and not-for-profit organisations, insurance should form part of a much broader conversation about risk management and good governance.
Having an insurance policy does not mean an organisation has effectively managed its risks.
Insurance is one method of transferring or mitigating certain financial consequences when something goes wrong. It does not replace appropriate policies, procedures, Board oversight, legal compliance, financial controls, staff training or sound decision-making.
The first responsibility of the Board should therefore be to understand:
This is particularly important because associations change.
They introduce new services. They employ more people. They deliver conferences and events. They collect increasing amounts of member data. They provide training, accreditation or professional advice. They use volunteers. They enter partnerships. They operate online and may work across jurisdictions.
The risk profile of an association today may be very different from what it was three or five years ago.
There is no standard insurance package that is appropriate for every association or NFP.
The organisation's activities, structure, employees, volunteers, assets, events, services and risk profile all need to be considered by an appropriately qualified insurance adviser.
Depending on the organisation, areas that may need consideration include:
Management liability or Directors and Officers cover - protecting the organisation and its office bearers in relation to certain claims arising from their management and governance responsibilities.
Professional indemnity - particularly relevant where an organisation or its people provide professional advice, education, accreditation, consulting or other professional services.
Public liability - covering certain risks associated with injury or property damage involving members of the public.
Cyber insurance - increasingly important for organisations holding membership, financial and other personal information.
Employment practices liability - relating to certain employment-related claims.
Crime, fraud and theft cover - potentially relevant where the organisation handles money, membership payments or other financial assets.
Property and contents insurance - where the association owns equipment, stock or other assets.
Volunteer personal accident insurance - particularly important for organisations that rely heavily on volunteers.
Event-related insurance - associations running conferences, exhibitions, networking events and other activities should make sure they understand what is and is not covered under their existing policies.
The important point is not simply whether the organisation has these policies.
It is whether the type, level, exclusions, conditions and scope of the coverage remain appropriate for what the association is actually doing.
One of the important lessons we have seen through our work with associations is that the existence of an insurance policy does not automatically mean a claim will be accepted.
We are aware of cases where organisations believed they were insured when something went wrong and subsequently made a claim.
However, when the circumstances surrounding the incident were examined, significant governance and management issues became apparent.
In some instances, the Board or organisation had not properly managed the issue before the event occurred, appropriate procedures had not been followed, or required actions had not been taken.
The result was that the insurance claim was rejected.
The circumstances of every insurance claim and policy are different, and organisations need professional advice about their own coverage. But the management lesson is extremely important:
Insurance does not remove the obligation of the Board and management to act properly.
An organisation should not assume that an insurer will simply write a cheque because a policy exists.
This is why risk management needs to be considered as part of governance.
Boards should be asking whether the organisation is complying with:
For registered charities, the ACNC places considerable emphasis on governance, legal compliance and the responsibilities of the organisation's Responsible People. Good governance is therefore not simply an administrative exercise - it is part of protecting the organisation itself.
The ACNC has also identified poor governance as a significant factor in compliance matters, reinforcing why Boards need to take governance and risk oversight seriously.
Cyber risk is a good example of why insurance arrangements cannot remain static.
Associations now hold considerable amounts of information about members, employees, event delegates, suppliers and sometimes highly sensitive personal information.
A cyber incident can create financial, operational, privacy, reputational and governance consequences.
Cyber insurance may form part of the response, but again insurance is only one component.
Boards also need to understand whether the organisation has appropriate cyber controls, access management, backups, staff awareness, incident-response procedures and data governance arrangements.
Current regulatory guidance increasingly treats cyber security as a governance and organisational risk rather than simply an IT issue.
Many associations conduct conferences, workshops, exhibitions, networking functions and other events.
These activities can introduce a range of additional risks involving venues, contractors, delegates, speakers, volunteers, travel, equipment, cancellations and public liability.
Never simply assume that the venue's insurance covers the association.
Before significant events, management should understand:
If the nature of an event changes significantly, that may also warrant a conversation with the organisation's broker or insurer.
Risk management should not become a compliance exercise where the Board is presented with a large spreadsheet, notes that nothing has substantially changed and moves to the next agenda item.
Boards need to understand the organisation's major strategic, operational, financial, regulatory, people, technology and reputational risks.
Management should be able to explain what is being done about those risks.
And insurance coverage should periodically be reviewed against that risk profile.
A useful discussion might include:
The worst time to discover the limitations of an insurance policy is after an incident has occurred.
The better approach is to review risk before the problem arises.
At Association Executive Services, when we work with associations on governance and organisational performance, we encourage Boards to look at risk as part of the total management of the organisation - alongside governance, finance, technology, people, strategy and compliance.
Insurance is an important part of that framework.
But insurance cannot compensate for poor governance.
A Board that understands its risks, documents its decisions, complies with its obligations, maintains appropriate controls and regularly reviews its insurance arrangements is in a much stronger position than a Board that simply renews the same policy every year and hopes it will be sufficient.
The question for your next Board meeting should therefore not simply be:
“Do we have insurance?”
It should be:
“Do we understand our risks, are we managing them properly, and are we satisfied that our insurance coverage is appropriate for the organisation we are today?”
|
Association Executive Services does not provide financial, legal or insurance advice. This article is provided from an association
management and governance perspective only. Associations and not-for-profit organisations should obtain advice about their individual
circumstances and insurance requirements from suitably qualified professional advisers. |
A practical look at volunteer governance, operational decision-making and what the events industry needs to understand about associations.
Nick Koerbin has spent many years working with professional and industry associations, and he has developed a simple habit: whenever he
meets a professional, he often asks whether they belong to their association — and whether they believe the membership is worth it.
A recent conversation with a young allied health professional raised some important questions about membership value, relevance and the
expectations of the next generation.
In this article, Nick shares that conversation and challenges association leaders to consider a simple but confronting question:
Would the next generation of professionals in your sector believe your association is worth joining?
How we help membership based, not-for-profit associations now and into the future.
