--- title: "Risk Analysis for Sport: What Your Board Should Know" url: https://tidyhq.com/blog/risk-analysis-for-sport-boards date: 2026-08-03 updated: 2026-07-12 author: "Isaak Dury" categories: ["Governance", "Club Operations"] excerpt: "Most sport boards think about risk reactively - after the incident, after the complaint, after the audit finding. A risk analysis done properly changes that." --- # Risk Analysis for Sport: What Your Board Should Know > Most sport boards think about risk reactively - after the incident, after the complaint, after the audit finding. A risk analysis done properly changes that. ![Design for monument Leeuwarden by Theo van Doesburg, illustrating Risk Analysis for Sport: What Your Board Should Know](https://cdn.sanity.io/images/bp0k7h82/production/4b9196c02d5e7603566859cbe114f91b10428e94-326x398.jpg?w=1200&fm=webp) ## Key takeaways - Risk analysis in sport covers four categories: finance, integrity of decision-making, health and wellbeing, and integrity of competition - A risk matrix maps likelihood against consequence - the risks that are both likely and severe get addressed first - Prevention means avoiding the risk entirely; mitigation means reducing the damage when it occurs - most sport risks need both - Different sports carry fundamentally different risk profiles, so generic templates miss the risks that matter most - Governing bodies need visibility across their entire federation to understand aggregate risk, not just individual club compliance A junior football club in suburban Melbourne discovered last year that their treasurer had been paying personal expenses from the club account for eighteen months\. The total was just under $14,000\. Not enough to bankrupt the club, but enough to wipe out the season's operating surplus and destroy the committee's trust in each other\. When the committee reviewed what happened, the answer was obvious in hindsight\. One person had sole access to the bank account\. No second signatory\. Monthly financial reports were a single total \- "we have $X in the account" \- with no transaction detail\. There was simply no system in place to catch it\. That is what risk analysis prevents\. Not the fraud itself \- you cannot prevent every bad actor \- but the conditions that make fraud easy and detection slow\. ## What risk analysis actually is Risk analysis sounds like something that belongs in a corporate boardroom\. It is not\. In a sport context, it is simply the process of asking: what could go wrong, how likely is it, how bad would it be, and what can we do about it? The [Good Governance in Grassroots Sport](https://goodgovsport.eu/) project, a collaboration between [ISCA](https://www.isca-web.org/) and [Transparency International](https://www.transparency.org/) Germany, identifies risk analysis as step four in the systematic approach to governance \- after the ethics code, zero\-tolerance commitments, and tone from the top\. The framework is a matrix\. On one axis: likelihood\. How probable is this risk? On the other: consequence\. If it happens, how severe is the impact? A risk that is highly likely and has severe consequences goes at the top of the priority list\. A risk that is unlikely and has minor consequences goes at the bottom\. The Melbourne treasurer case? Moderate likelihood \- most volunteers are honest, but sole access to funds with no oversight is an invitation\. High consequence \- financial loss, reputational damage, volunteer burnout\. That risk should have been near the top of the list\. ## The four categories The ISCA guidelines break sport\-specific risks into four categories\. This is not the only way to structure a risk analysis, but it is a good one because it forces you to think beyond the obvious\. **Finance\.** Insufficient accounting practices\. Lack of financial oversight\. Single points of control over funds\. Inadequate insurance\. Revenue concentration \- relying on one sponsor or one grant for a disproportionate share of income\. The Melbourne example falls here\. But financial risk is broader than fraud\. A club that does not collect membership fees on time has a cash flow risk\. A governing body funded primarily through affiliation fees has a risk if clubs stop affiliating\. **Integrity of decision\-making\.** Conflicts of interest\. Committee members who use their position for personal benefit\. The "car park committee" problem where the real decisions happen before the meeting\. Board capture by a small group\. This category is the hardest to assess because the risks are invisible until they cause harm\. The ISCA research found that most grassroots sport organisations have no formal process for managing conflicts \- not because they do not care, but because they have never thought about it\. **Health, wellbeing, and security\.** Safeguarding\. Duty of care\. Physical safety at events and training\. Sexual harassment\. Bullying\. Discrimination\. A club without a trained welfare officer has a safeguarding risk\. A club that does not conduct background checks on coaches working with children has a safeguarding risk\. These risks carry the highest consequences \- harm to people, legal liability, existential reputational damage\. **Integrity of competition\.** Match\-fixing\. Doping\. Gambling\-related corruption\. Age fraud\. This category matters most at competitive levels, but it is not limited to elite sport\. Regional competitions have been affected by match\-fixing\. Junior sport has seen age fraud\. ## Different sports, different risks Here is where generic risk templates fail\. The ISCA guidelines use a cycling example that illustrates the point well\. A cycling federation's risk profile includes doping \(high likelihood in some disciplines, severe consequences for the sport's credibility\), road safety \(high consequence \- riders share roads with motor vehicles\), and mechanical failure at events\. A cycling club's risk register looks fundamentally different from a swimming club's\. A swimming club worries about pool safety, supervision ratios, and safeguarding risks specific to coaching young athletes individually\. An equestrian club adds animal welfare to every risk category\. Combat sports add concussion protocols that are literally different from non\-contact sports\. Prof\. Antonio Borgogni and colleagues at the University of Cassino and Southern Lazio found in their ISCA research that the most effective risk analyses were sport\-specific\. A cricket club that uses a corporate risk template will have a thorough section on data protection and nothing about ball\-to\-head injuries\. Start with the four categories\. Then fill them with the risks that actually apply to your sport, your facilities, your people\. ## Prevention versus mitigation There are two ways to address a risk\. You can try to prevent it \- stop it from happening at all\. Or you can mitigate it \- reduce the damage when it does happen\. Prevention for financial fraud: dual signatories on all bank accounts, transaction\-level financial reporting, regular independent review of the accounts\. Mitigation for financial fraud: insurance, legal advice on standby, a documented disciplinary process, a communication plan for members\. Most sport risks need both\. You cannot prevent every safeguarding incident \- but you can make them far less likely with proper vetting, training, and supervision\. And when an incident does occur, you can respond quickly because you have a process ready\. Henrik Brandt from the Institute for Sport Studies in Denmark observed that many grassroots sport organisations default to what he called "hopeful prevention" \- they put a policy in place and hope it works, without building the detection or response infrastructure that mitigation requires\. The policy exists\. The question is whether anyone would know if it was breached\. ## The federation challenge For individual clubs, risk analysis is relatively straightforward\. You know your people, your facilities, your finances\. You can assess risks with reasonable accuracy because you can see the whole picture\. For governing bodies \- state sporting bodies, national federations, regional associations \- the challenge is fundamentally different\. Your risk is not just your own organisation\. It is the aggregate risk across every club in your network\. If one club in your federation has a safeguarding failure, it reflects on the entire sport\. If clubs are not implementing the policies you have distributed, your compliance framework is theoretical rather than real\. And most governing bodies cannot see the risk profile of their affiliated clubs\. They know what policies they have sent\. They do not know which clubs have implemented them\. This is why [TidyConnect](/connect) includes compliance dashboards at the federation level\. When a governing body sets a requirement \- every club must have a current safeguarding policy and a trained welfare officer \- TidyConnect tracks compliance across the network in real time\. The board does not have to wait for an annual audit to discover that 40% of clubs have gaps\. ## Running your first risk analysis If your board has not done a formal risk analysis, here is a practical starting point\. Block out 90 minutes at a committee meeting\. Not at the end of a long agenda \- at the start, when people can think clearly\. Write the four categories on a whiteboard\. Under each one, brainstorm the risks that apply to your organisation\. Be specific\. "Financial risk" is a category, not a risk\. "Club treasurer has sole access to the bank account with no oversight" is a risk\. For each risk, assess likelihood \(low, medium, high\) and consequence \(minor, moderate, severe\)\. Plot them on a grid\. For the risks in the top\-right quadrant \- high likelihood, severe consequence \- assign an owner and a deadline\. For the bottom\-left, note them and move on\. Review the register every six months\. Risks change\. And document everything\. Not because anyone enjoys paperwork \- because when something goes wrong, the question will be: did the board identify this risk, and what did they do about it? ## The board's responsibility Boards of sport organisations often treat risk as an operational matter \- something the staff or the secretary handles\. It is not\. The ISCA guidelines, the [EU White Paper on Sport](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52007DC0391), and every governance code I have read agree: risk oversight is not delegable\. The board owns it\. That does not mean the board needs to become risk experts\. It means the board needs to ask the right questions\. What are our biggest risks? How do we know? What are we doing about them? Is it working? How would we know if it was not? Those five questions, asked regularly and honestly, are more valuable than any risk management framework\. ## References - ISCA & Transparency International Germany\. [Guidelines for Good Governance in Grassroots Sport](https://www.isca-web.org/files/GGGS_Web/Guidelines_for_Good_Governance_in_Grassroots_Sport.pdf) \(PDF\)\. Chapter 6: Risk Analysis\. - ISO\. [ISO 31000 \- Risk Management](https://www.iso.org/iso-31000-risk-management.html)\. International risk management standard\. - Sport England & UK Sport\. [A Code for Sports Governance](https://www.sportengland.org/funding-and-campaigns/code-sports-governance)\. - Sport & Recreation Alliance\. [Sport and Recreation Alliance](https://www.sportandrecreation.org.uk/)\. UK industry body with risk guidance\. - Sport Integrity Australia\. [Sport Integrity Australia](https://www.sportintegrity.gov.au/)\. Australian sport integrity and risk frameworks\. - Transparency International\. [Global Corruption Report: Sport](https://www.transparency.org/en/publications/global-corruption-report-sport)\. 2016\. --- Header image: *Design for monument Leeuwarden* by Theo van Doesburg, via [WikiArt](https://www.wikiart.org/en/theo-van-doesburg) --- Canonical: https://tidyhq.com/blog/risk-analysis-for-sport-boards | Retrieved from: https://tidyhq.com/blog/risk-analysis-for-sport-boards.md | Published by TidyHQ (https://tidyhq.com)