NFP Board Technology Risk Register

A board technology risk register does not need to be large to be useful. In many smaller not-for-profits, the most practical version is a short, current list of the few technology risks that genuinely matter to leadership.

The difficulty is not usually creating a spreadsheet. It is deciding what belongs on the register, how risks should be described, and who owns the next action. That is why risk-register clarity is part of the NFP Technology Health Check NSW.

Why a board-level register helps

Without a clear risk register, technology concerns tend to show up in fragmented ways: a cyber issue here, a Microsoft 365 concern there, supplier frustration somewhere else, reporting pain somewhere else again. The board sees noise but not a coherent picture.

A good risk register helps leadership answer:

• what are the main technology risks
• why do they matter
• what controls exist today
• what gaps remain
• what needs to happen next

Risks that commonly belong on an NFP board register

Typical examples include:

• weak Microsoft 365 governance or admin control
• client-data sprawl across email, spreadsheets, and shared drives
• unclear AI acceptable-use boundaries
• dependence on one MSP or provider without enough oversight
• manual reporting processes that create fragile evidence
• weak offboarding and access removal
• limited incident-response readiness
• backup and recovery assumptions that have not been tested

Not every organisation needs every item, but these are common starting points.

How to write a useful risk statement

A risk statement should be plain English. For example:

• Sensitive client information is stored across multiple uncontrolled locations, increasing privacy and incident risk.
• Microsoft 365 permissions and admin practices may not provide sufficient control over sensitive information and business-critical accounts.
• Staff AI use is occurring without a clear policy, creating risk around confidential and client information.

These are far more useful than vague labels such as "IT risk" or "cyber risk" on their own.

What each register entry should include

A practical board-level register can be simple:

1. risk statement
2. business impact
3. current controls
4. gaps or concerns
5. owner
6. next action
7. review date

This is enough to support decision-making without turning the document into bureaucracy.

What good board discussion sounds like

When a register is working well, the conversation shifts from broad concern to specific oversight. Instead of asking "Are we okay on technology?" the board can ask:

• why is this risk still open
• what evidence supports the current rating
• what action is next
• does management need additional support or funding

That is a much more useful discussion.

Common mistakes

• listing too many risks
• using highly technical language
• failing to show next actions
• treating supplier statements as sufficient evidence
• not naming an owner
• leaving the register unchanged for long periods

A short, current register is usually better than a large stale one.

How this connects to board reporting

The risk register should not sit in isolation. It should connect with:

• cyber updates
• Microsoft 365 evidence
• supplier accountability
• incident readiness
• compliance and accreditation preparation

That is why this topic aligns naturally with Cyber Security Questions Every NSW Not-for-Profit Board Should Ask.

First steps for a smaller NFP

1. identify the top five technology risks
2. rewrite them in plain English
3. note current controls and missing evidence
4. assign an owner for each item
5. define the next action and review date

Next step

If your board needs a clearer technology risk picture, book the NFP Technology Health Check NSW. It is designed to help leadership turn scattered technology concerns into a usable risk view, evidence gaps, and priority actions.