Institutions & FoundationsUnited StatesDownload app

Nonprofit risk design practice

What continuously produces risk — and how to redesign it

WhyteRock Risk models how risk is designed, transferred, incentivized, and unintentionally embedded across an organization and its supply chain, then rebuilds those structures toward economic parity.

Read the practice brief

Interactive · Basic risk model

Where is your organization manufacturing risk?

Set your organizational age and operating field, then move each gauge. The liability field re-forms as you go — the further a face pushes out, the more risk that structure is producing. Every reading is then resolved along the full range of volatile, uncertain, complex, and ambiguous risk, so you can see not only how much risk you are manufacturing but what kind it is — and what each kind actually responds to.

Filter · Company age

Filter · Operating field

Survey · Liability gauges

  • Present

    Wage bands are undocumented or vary by gender, race, class, or education.

    C · ComplexA · Ambiguous
    NoneEmergingPresentAcute
  • Emerging

    Decision rights and board oversight are informal or held by one person.

    C · ComplexA · Ambiguous
    NoneEmergingPresentAcute
  • Present

    A single vendor, funder, or partner would halt delivery if lost.

    V · VolatileU · UncertainC · Complex
    NoneEmergingPresentAcute
  • Emerging

    Leadership and staff work from different versions of the same numbers.

    U · UncertainC · Complex
    NoneEmergingPresentAcute
  • Emerging

    Rewards track output that nobody re-checks against mission outcomes.

    C · ComplexA · Ambiguous
    NoneEmergingPresentAcute
  • Present

    Critical processes live in one person's head or inbox.

    V · VolatileU · UncertainC · Complex
    NoneEmergingPresentAcute

Liability field

Weighted for start-up · 0–3 yrs

78

Manufactured risk is high

PayGovernanceSupplyInfo flowIncentivesKnowledge0100

Risk character · V-U-C-A range

Dominant: Uncertain

The same score behaves differently depending on what kind of risk produces it. This resolves your reading across the range and names the counter-move each kind responds to.

  • The condition is known but swings fast and without warning.

  • Cause is legible, outcome is not — the next state can't be forecast.

  • Too many interacting parts for any single owner to hold.

  • The rules themselves are contested — nobody agrees what counts.

Nudge to action

  1. 01 · Pay parity

    91%

    Publish internal wage bands and re-draft principal–agent agreements against a parity target.

  2. 02 · Knowledge concentration

    90%

    Document the three processes that would stall first, then cross-train a second owner.

  3. 03 · Supply chain

    79%

    Map your top five dependencies and hold a second option for every critical node.

  4. 04 · Governance design

    47%

    Write down who decides what, at what threshold, and ratify it at the next board cycle.

  5. 05 · Incentive alignment

    35%

    Attach one outcome measure to every incentive, and audit it twice a year.

  6. 06 · Information flow

    32%

    Create one shared source of record and a fixed reporting cadence around it.

Next step

Receive the Risk Design Journal by email

Quarterly findings, agreement templates, and the audit notes behind this model.

Or write directly to ask@whyterock.co with the word Journal.

Pay Prototyping

What principal–agent agreements reveal about wage design

Free $250K+ agreement templates drafted to close wage gaps across gender, race, class, and education.

Learn more ›

Supply chain

Risk does not stay in the department that made it

A full-spectrum reading of dependency, information flow, and incentive across the whole chain.

Learn more ›

Quarterly review — Q3

Two signals, one structure

Findings from the double-blind Internal Review Board audit on governance and decision rights.

Learn more ›

4

Organizational domains studied

4 yr

Longitudinal study period

Double-blind audits per year

$250K+

Agreement templates released free

Traditional practice asks how to control risk. We ask what continuously produces it.

01

Pay Prototyping

Principal–agent agreements drafted to eliminate wage gaps across gender, race, class, and education toward parity.

02

Supply Chain Systems

Organizational risk read through a full-spectrum supply chain lens rather than isolated departments.

03

Governance Design

Boards, oversight, and decision rights modeled as risk-producing structures, not administrative overhead.

04

Risk Research

Longitudinal study of how risk is designed, transferred, incentivized, or unintentionally embedded.

Network of nodes and directional arrows representing a supply chain

Full-spectrum supply chain

Risk travels across interconnected systems

Rather than treating departments or functions in isolation, the practice weighs the entire chain — where dependency, information, and incentive meet.

  • Internal operations
  • External partnerships
  • Stakeholder relationships
  • Information flows
  • Decision bottlenecks
  • Vendor dependencies
  • Institutional trust structures
  • Service delivery systems
  • Human capital systems
  • Financial processes
  • Public–private interactions

Our central question

“How is risk being designed, transferred, incentivized, or unintentionally embedded throughout the organization and its supply chain?”

Every city, institution, and chain of custody runs on the same thing: connections nobody drew on purpose. Risk design makes that structure visible.

Frequently asked

The question unasked is the only answer unborn