Grant Risk Assessment: Best Practices for Nonprofits

Every grant carries some risk. A risk assessment helps you find likely problems early, while you can still fix them. This guide explains how to identify, rate, and respond to grant risks.

Why risk assessment matters

Grant problems can lead to repaid funds, audit findings, closer funder oversight, and damage to your reputation and funder relationships. They can also create legal and compliance issues.

A regular risk assessment helps you find issues while they are fixable and decide where to focus staff time and money. It also gives your board evidence of good oversight, and it reduces surprise audit findings.

Types of grant risk

Compliance risk

Compliance risk is the risk that you fail to meet the grant's requirements. Examples include missed reporting deadlines, spending on unallowable costs, poor documentation, unmet match requirements, and procurement violations.

Financial risk

Financial risk is the risk of money problems tied to grants. Examples include cash gaps from slow reimbursement, reliance on a single funder, budget overruns, programs you can't sustain after the grant, and disallowed costs.

Operational risk

Operational risk is the risk that you can't deliver the grant's objectives. Examples include turnover in key positions, weak infrastructure, technology failures, problems with subrecipient performance, and limited capacity.

Reputational risk

Reputational risk is the risk of damage to your organization's reputation. Examples include public audit findings, reported program failures, negative news coverage, strained funder relationships, and lost community trust.

How to assess risk

Step 1: Identify the risks

For each grant, ask questions in three areas.

Compliance:

• Do we understand all the requirements?
• Can we meet all the deadlines?
• Can our systems track what the award requires?
• Do we have capacity for oversight?

Financial:

• Is the budget realistic?
• Can we manage cash flow?
• Do we have enough match?
• What happens if costs go up?

Operational:

• Do we have the right staff?
• Is our infrastructure adequate?
• Can our partners deliver?
• What else could go wrong?

Step 2: Rate likelihood and impact

You can rate each risk on a simple internal scale. The scores below are example judgments, not measured probabilities or industry benchmarks.

Risk	Likelihood (1 to 5)	Impact (1 to 5)	Risk score
Missed quarterly report	2	3	6
Staff turnover	3	4	12
Cash flow shortage	2	5	10
Budget overrun	3	3	9
Audit finding	2	4	8

In this optional model, the risk score is likelihood times impact. Neither GAAP nor 2 CFR 200 requires this formula or the bands below.

Step 3: Set priorities

If you use this model, define and approve your own response bands. The bands below are one example:

Priority	Risk score	Response
High	15 to 25	Escalate through your approved process
Medium	8 to 14	Monitor and consider mitigation
Low	1 to 7	Monitor on your normal schedule

Step 4: Plan the response

For each high and medium risk, decide how to make it less likely and how to reduce its impact. Then name the person responsible and the resources they need.

Risk assessment at each grant stage

Before the award

Before you accept a grant, check whether you can meet all the compliance requirements, whether the budget and timeline are realistic, and whether you have enough staff. Estimate the full cost of running the grant.

Watch for these warning signs:

• Requirements you have never managed before
• Unrealistic timelines
• Budgets that don't cover the full cost
• Tight limits on indirect costs

During the grant

While the grant is active, monitor budget versus actual spending, progress toward outcomes, staff capacity and turnover, subrecipient performance, and new compliance issues.

Watch for these warning signs:

• Spending that is well behind schedule
• Key staff leaving
• Problems with partners
• Gaps in documentation
• Work that grows beyond the approved scope

At closeout

As the grant ends, confirm that all funds will be spent properly and that you can complete the final reports. Also confirm that documentation is complete, that no compliance issues are open, and that you have a plan to sustain the work.

Sample risk register

The entries and scores below are fictional. Build your register with risks, owners, and ratings your organization approves.

ID	Grant	Risk	Category	Likelihood	Impact	Score	Response	Owner	Status
1	Grant A	Quarterly report missed	Compliance	2	3	6	Calendar reminders, early preparation	J. Smith	Monitored
2	Grant A	Program manager leaves	Operational	3	4	12	Cross-train staff, document procedures	Director	Active
3	Grant B	Cash flow gap	Financial	2	5	10	Line of credit, prompt invoicing	Finance	Active
4	Grant B	Match shortfall	Compliance	2	4	8	Monthly tracking, new match sources	Finance	Monitored

Common grant risks and responses

Risk	Responses
Missed deadlines	A master calendar with all due dates, reminders early enough for the work and review, a named owner for each report, and extra time in the schedule
Unallowable costs	Approval in advance for unusual expenses, staff training on allowability, review before payment, and regular expense reviews
Documentation gaps	Documenting as you go, regular file reviews, checklists of required documents, and audit readiness checks
Staff turnover	Cross-training, written procedures, documented knowledge, and succession plans
Budget overruns	Monthly budget reviews, early warning thresholds, a budget change procedure, and reserve funds
Match shortfall	Monthly match tracking, several match sources, a system to document in-kind contributions, and early review for gaps

The role of the board and leadership

Board oversight

Fit board reporting to the size of the risks and the board's responsibilities. The board may receive a summary of high-risk grants, progress reports on risk responses, notice of significant issues, and a yearly risk assessment summary.

Management's role

Management should assess risks on a regular schedule, assign resources to the responses, and report significant risks to the board. Leaders should also encourage staff to raise risks early.

Connecting risk assessment to other work

Use risk ratings in grant acceptance decisions, staffing, budget development, performance monitoring, and board reporting.

Also connect grant risks to your organization's overall risk management, internal audit priorities, insurance decisions, and strategic planning.

Federal risk assessments depend on your role

Your internal grant risk register is different from the risk assessments that federal rules require. Under 2 CFR 200.206, federal agencies assess the risk of applicants before they make an award.

If you pass federal funds to subrecipients, 2 CFR 200.332(c) requires you to evaluate each subrecipient's fraud risk and risk of noncompliance. You use that evaluation to decide how much monitoring the subrecipient needs. You should consider the subrecipient's experience with similar subawards, its prior audits, whether it has new personnel or new systems, and the results of any federal monitoring. The regulation doesn't prescribe the 1 to 5 scoring model above.

Tools and templates

Checklist before you accept a grant

Compliance:

• We understand all requirements.
• We can meet all deadlines.
• Our systems are adequate.
• We have the expertise the award requires.

Financial:

• The budget is realistic.
• The indirect cost rate covers our real costs.
• We can manage cash flow.
• We can meet the match.

Operational:

• We have enough staff.
• Our infrastructure is sufficient.
• Our partners are capable.
• The timeline is realistic.

Monthly risk review

During the grant, ask four questions each month:

• Have any new risks appeared?
• Have any risk ratings changed?
• Are the responses working?
• Does any issue need escalation?

How GrantLink supports this today

GrantLink keeps grant records next to your QuickBooks data. Each grant has a Budget section, a Transactions section with Allocations, Invoices & receipts, and Funding shares, a Reporting section, and an Activity history. Documents and notes are in the grant's Details section. These records can help you monitor grants and prepare for an audit, but they don't replace the award terms, your accounting policies, or professional review.