You are responsible for organizations you do not run.

You have funded this before.

The capacity-building grant that paid for a strategic plan, which is now in a drawer. The governance webinar with two hundred registrants and no changed boards. The emergency grant to the same organization, for the same reason, for the third year running. You have a report on each of them. None of the reports says what changed.

Meanwhile the organizations you are responsible for are carrying more than they show you. Boards that do not know what they do not know. One person holding every password and every relationship. Cyber exposure nobody on staff can name. You will find out about most of it when it is already a crisis, and a crisis is the most expensive moment to find out.

Here is the part that is harder to say out loud. You suspect the money is not buying anything durable. You do not want to become the funder who makes resilience a grant condition and gets paperwork back. And you have a blind spot you can feel but cannot see around: your grantees show you what is safe to show a funder. None of that is a failing on your part. It is what happens when a capable person is handed a portfolio and given nothing but checks and reports to manage it with.

The problem is not the program. The problem is that you are the funder.

You think the problem is finding the right capacity-building program. It is not. The problem is that nobody in your network will tell you what is actually breaking, and they are right not to.

Ask an executive director what keeps her up at night and you will get the answer that protects next year's grant. That is not dishonesty. It is the rational response to a relationship where one side holds the money. So you cannot be the one in the room when an organization inventories its own risks, and neither can a consultant you hire to report back to you. The ED knows who is paying.

In 2021, seven Richmond foundations asked me to survey their grantees before a resilience series. Ninety organizations answered. Seventy percent had no risk management program of any kind. Eight percent had a written risk register. Eighty-two percent had spent nothing on risk training in their last three budgets. And ninety-eight percent said that if a funder supported it, they would want to improve.

Read those four numbers together. Your grantees know they are exposed. They will not spend their own money to fix it, because every dollar they have is spoken for. And they are waiting for you to make it possible; they just will not say so in a grant report. That is why the first step on this page is a conversation, not a pitch.

I don't work for you, and I don't work for them. That is the point.

I am Ted Bilich. I spent twenty years as a lawyer at an international law firm based in Washington, D.C., taught at Georgetown Law, and then started Risk Alternatives to work with nonprofits directly. I wrote Managing Your Nonprofit for Resilience (Wiley) after watching too many good organizations fail for reasons that were visible six months earlier. I have run the risk inventory in hundreds of nonprofits, and I have sat on the other side of the table with the funders who pay for it: nine community foundations, the Council of Michigan Foundations, Forefront, the Forbes Funds, and the state nonprofit associations of Idaho, Maryland, and Florida among them.

That combination is rare in this sector, and it is what makes the work possible. Your board will ask about liability, governance, and compliance; I can answer as a lawyer. Your grantees will tell me what they will not tell you; I can answer as the person who has heard it hundreds of times. And I can tell you what the network needs without telling you who said it.

Sometimes the problem is bigger than one community. A statewide association with four hundred members, or a group of foundations that fund the same field in six cities, needs capacity built at a scale no workshop series reaches. Building it takes three things at once: knowing what actually threatens nonprofits across the whole sector, knowing the law well enough to answer a foundation board before it asks, and knowing process improvement well enough to design something hundreds of small organizations will actually use, and to measure whether they did. Very few people in this sector hold all three. That is the work I most want to do next.

I still coach foundation CEOs and help with their own planning when asked. But most of what I do now is built for whole networks.

A year from now, across your whole portfolio

Every organization you fund can name its top five exposures and who owns each one. Your board report has numbers in it — registers built, exercises run, reserve targets set — and three network-wide risks with a dollar figure beside each. Emergency requests arrive earlier, as plans, instead of later, as crises. And your grantees call you before the problem, because for once somebody was in the room who was not you.

This is not a theory. In 2021 the Community Foundation of Broward put the twelve organizations it had just honored as Hidden Heroes through seven sessions and four rounds of coaching. Ninety-four Broward nonprofits came to the open session. Eleven of the twelve Hidden Heroes nonprofits finished, wrote a resiliency plan, and were funded to carry it out, at up to $25,000 each. More than eight in ten asked for deeper work afterward, so the foundation ran it twice more.

In Memphis the same year, 25 grantees of the Community Foundation of Greater Memphis — most under $1.5 million with fewer than ten staff — each built a risk inventory and a register, and the foundation learned that three problems ran through nearly all of them: no fundraising capacity, thin financial procedures, and a plan in a drawer. That is a funding agenda, and it came from the grantees.

Neither foundation ran the organizations it strengthened. Broward did not write the plans. Memphis did not fill in the registers. They built something the whole network could stand on, and stepped back. That is why networks are the sector's underused superpower.

What it costs to wait

Another emergency grant to the same organization, for the same reason, next year.

The grantee that closed, whose trouble was visible a year out — to everyone but you.

A board report whose only number is how many people attended.

Becoming the funder who made resilience a grant condition and got paperwork back.

You know these outcomes. Some of them are in your portfolio now. Every one of them started as something you could have seen, and most of them, seen early, were openings for something better.