Humanitarian and development
Your funding shrank. Did your obligations?
Budgets have been cut; donor requirements have not. Risk is moving onto national partners, sanctions rules keep tightening, and tolerance for fraud or diversion has never been lower. Frameworks borrowed from the corporate world, or written at headquarters, were not built for this.
Why frameworks fail in the field
Most of the risk discipline used in the humanitarian sector was designed for corporate business — standards, registers and assessment methods built for stable operations, reliable banking and clear lines of accountability. Organisations then customise them, often until the result fits neither the original standard nor the work it is meant to govern.
The same gap opens inside the organisation. What is designed at headquarters assumes conditions the field office does not have. The control environment has to work where banking channels are unreliable, the partner is the only route to a population, and the context changes faster than the document describing it.
The pressure makes the gap costlier. Audits now reach further into partner operations, and a single unresolved finding can hold up the tranche a field programme depends on.
Underneath it sits a cultural problem. Risk management is still widely treated as administration — completed for the donor rather than used by the operation. That is rarely a question of commitment. More often, nobody has shown what the work is for.
Counted in budgets, paid in people
Risk measured in money, not in people
The matrix scores financial loss, delivery delay, reputation and compliance. It rarely scores what a decision means for the people the programme exists to serve. The risk that matters most to the mission is the one the register was never built to see.
Impact described, never measured
The register says significant impact on programme delivery. So does the next entry, and the one after it. When every impact is described in the same words, nothing can be ranked — and the risks that most need attention compete on equal terms with the ones that don’t.
Partners carry risk you answer for
Where access is limited, the partner often is the delivery — the organisation’s reach and results depend on it entirely. Its failures and its successes are yours to answer for, yet it is usually managed as a contractor rather than as the critical dependency it is. Assessed at selection, rarely again, and almost never for whether it could keep operating if something went wrong.
Crisis decisions made without the assessment
Access closes, a partner fails, security deteriorates. Management has hours to decide whether to suspend, relocate or change how aid reaches people — and the register cannot help, because it lists risks rather than options. What is needed is assessment that runs through the whole event: scenarios and trade-offs prepared before, current information as the situation moves, and an honest review afterwards of what the decisions cost and what they protected.
Compliance protects the grant. Risk management protects the mission.
What we do for humanitarian organisations
The work stays close to operations and programmes. It aims to give management what it needs to understand the risk environment, weigh the trade-offs and take informed decisions. Most engagements start with an assessment; what follows depends on the priorities and impact of what it finds.
Enterprise and operational risk
Risk assessed where the work happens — by project and activity, across programmes and the support functions that keep them running. Alongside financial, operational, legal and reputational impact, every assessment scores humanitarian impact as a dimension in its own right: what a disruption would mean for the people the activity serves. A life-saving activity and an important-but-not-vital one are never weighed as equals.
Impact is quantified wherever the data allows — funds at risk, weeks of stock or fuel cover, the share of operational need an alternative can actually meet — rather than described in words that cannot be ranked.
The same method serves management before, during and after a disruption: a rapid assessment when a shock is coming, clear options while it unfolds, and a review afterwards of what held and what it cost. Risks that can be mitigated are separated from those that must be consciously accepted, and the new risks created by the mitigations themselves are named rather than hidden.
Donor compliance
Every funding agreement carries its own conditions — eligibility, procurement thresholds, documentation, reporting, and requirements that must flow down to partners. The work starts by reading the agreement properly and translating it into the controls the programme actually needs, before the first expenditure rather than after the first finding.
Experience across multilateral, institutional and appeal-based funding — UN agencies including UNICEF, WFP, WHO and OCHA; institutional donors such as ECHO, GIZ, BMZ, Irish Aid and Australia’s DFAT; and appeal funds including the UK Disasters Emergency Committee and Aktion Deutschland Hilft.
Where a programme is already running, a gap assessment against those requirements, with a corrective action plan ahead of the audit rather than in response to it.
Partner and third-party risk
Where the partner delivers, the partner is the risk — and its failures and successes are yours to answer for. The work treats each partner as the critical dependency it is: due diligence at selection, risk assessment proportionate to what the partner handles, and monitoring as its role grows.
Agreements are reviewed on both sides — the operational terms that govern how the work is done, and the contractual terms that govern what happens when it goes wrong: commitments, liabilities, penalties and termination.
Assessment also asks whether the partner could keep operating through a disruption. Where the answer is no, capacity building works with the partner’s own team to close the gap — so the relationship gets stronger, not only more closely watched.
Sanctions and cash transfer controls
Working in sanctions-affected contexts means some exposure cannot be avoided — payments to authorities that control essential services, banks under pressure to de-risk, suppliers with links to listed parties. The work maps that exposure across partners, vendors, financial channels and delivery routes, and designs controls proportionate to the operating reality.
When a designation or sanctions change shifts the operating environment, a rapid assessment of what it means for payments, supply chains and contracts — and of the options that keep the operation running within the rules.
Cash and voucher assistance gets controls that hold at the distribution point as well as in the audit file, with particular attention to the new risks that contingency measures create — cash held in reserve, alternative transfer routes, stock built up ahead of disruption.
Assurance, audit and fraud
A finding from outside the organisation carries a different weight — with a donor, and with management. Independent review of country and regional control environments, built on regional internal audit across four countries and experience as audit focal point for institutional and donor reviews.
Testing looks at whether controls work, not whether they exist, and follows findings through to whether they were fixed rather than only closed. Repeat findings are what donors tolerate least.
Fraud risk is assessed across the programme cycle, with controls placed where value moves — cash, stock, fuel, partner payments. Where something has gone wrong, support to the investigation and to the lessons it should produce, including the reporting and escalation channels donors expect to see working.
Training
Risk management is treated as administration when nobody has shown what it is for. Training changes that — working sessions built around the organisation’s own programmes and contexts rather than generic examples.
Management teams leave able to use risk information to decide: what to accept, what to escalate, where the trade-offs sit. Field and programme staff leave knowing what to notice and when to raise it. Partner teams get the grounding they need to meet the requirements that flow down to them.
Where these claims come from
This is not banking experience repackaged for the sector. It was built inside humanitarian operations, in some of the hardest contexts they work in.
ICRC
Risk and assurance for the Afghanistan delegation from a base in Uzbekistan, and before that regionally across the Near and Middle East — Iraq, Syria, Egypt, Iran, Yemen, Lebanon, the GCC countries and ILOT. Risk frameworks and assessments across both operations and the support functions that sustain them — finance, logistics and ICT — with findings taken to senior management and turned into action plans. Rapid assessments when external shocks threatened operations, post-incident reviews of resilience options, sanctions exposure, cash controls and partner due diligence, and primary point of contact for internal, external and donor audits.
World Vision International
Risk and compliance across the Jordan, Syria and Türkiye response, supervising a team of risk and compliance staff. Compliance for UN-funded and institutional donor grants from project opening through review to closure — applying each donor’s financial, procurement and reporting rules, and building the controls to meet them. Enterprise risk assessment across multi-country operations, partner selection and agreement review, and standard operating procedures for high-risk activities.
ACTED
Regional internal audit across Iraq, Syria, Lebanon and Yemen — managing country audit teams and missions, testing donor compliance and management-cycle procedures, and building controls to donor requirements and local regulation.
Funding agreements
Agreements reviewed and compliance controls built for projects funded by UNICEF, WFP, WHO, UN OCHA, ECHO, the German Federal Foreign Office, BMZ, GIZ, Irish Aid, Australia’s DFAT, USAID, Japan Platform, the UK Disasters Emergency Committee and Aktion Deutschland Hilft.
Banking and law
Seven years at Standard Chartered, a risk function built from nothing at one bank and operational risk across the branches and subsidiaries of another. LLB, and LLM in International Commercial Law and Technology. ISO 31000 Senior Lead Risk Manager. The rigour of banking risk practice, applied without importing its assumptions.
Services for financial institutions.
Financial sectorStart with a conversation
Most first conversations start with one of these. A donor audit coming. A partner the operation depends on and nobody has looked at since selection. A shock on the horizon and no assessment of what it would mean. A risk register completed for the donor and used by no one. Starting that conversation carries no obligation.