Enterprise Risk Management for NGOs Operating in East Africa

Non-Governmental Organisations operating in East Africa face a complex and evolving risk environment. From donor compliance requirements to operational risks in fragile contexts, the need for a structured Enterprise Risk Management (ERM) framework has never been greater.

Why ERM Matters for NGOs

Donors — including USAID, EU, DFID, and UN agencies — increasingly require grant recipients to demonstrate robust risk management practices as a condition of funding. Beyond compliance, a well-implemented ERM framework:

Protects the organisation's assets and reputation
Enables proactive rather than reactive management
Strengthens governance and board oversight
Improves programme delivery outcomes

Key Risk Categories for NGOs

Financial Risks

Foreign exchange exposure on multi-currency grants
Donor fund misappropriation and fraud
Inadequate financial controls and segregation of duties
Over-reliance on a single donor

Operational Risks

Staff safety and security in field operations
Supply chain disruptions
IT systems failures and data breaches
Partner organisation capacity and compliance

Compliance and Regulatory Risks

NGO Board registration and reporting requirements
Tax obligations (VAT, PAYE, withholding tax on service fees)
Anti-money laundering and counter-terrorism financing requirements

Reputational Risks

Safeguarding failures
Programme quality and impact measurement
Community relations

Building Your ERM Framework

A practical ERM framework for an NGO typically includes:

Risk Appetite Statement — defining how much risk the organisation is willing to accept
Risk Register — a living document capturing all identified risks, likelihood, impact, and mitigation measures
Risk Owner Assignments — ensuring accountability at management level
Monitoring and Reporting — quarterly risk reviews reported to the board

Our Experience

Matengo & Associates has developed and reviewed ERM frameworks for organisations including IEBC, Mwalimu National DT Sacco, the Insurance Regulatory Authority, AERC, and KNBS. We bring practical, implementable frameworks — not just theoretical models.