Taking the risk out of the ‘risk analysis’

The most important communication product of the Charities Directorate of the CRA is arguably the ‘guidance’. But it is not necessarily a guidance to practical operation, rather it is a window into the CRA’s use of its discretion in audits – of course, that leads to decisions about practical operations. So it is with the new guidance registered charities making grants to non-qualified donees^[1] from which practical steps must be distilled from the CRA’s audit position. This is our second article in a series (here is the first article in the series Echoes of the UK in Canada's new granting regime) intended to drill down on the practical use of the guidance.

By law, a Canadian registered charity must ‘ensure’ that the grant is being used to fulfill the Canadian charity’s purposes. It must also retain documentation as evidence, and it cannot act as a conduit of funds. There is no mention of a ‘risk analysis’, but the CRA’s position is that the charity must undertake a fairly extensive one that is probably beyond the capacity of most charities. Given the difficult technical and practical elements, a charity might need additional incentive to do the assessment – especially in circumstances where time is pressing, and the charity is fairly certain that the funds will be used properly.

The best reason is that the CRA is looking for it. While we cannot imagine the CRA seeking to punish a charity where the grant was in fact properly used even though no risk analysis was conducted, we cannot guarantee it. A fight with the CRA can be an enormous burden, and discretion being the better part of valour, it’s better to just do it. The second reason is that no matter how trusted the grantee one cannot know before the money is spent that it will be spent properly. Things happen. Natural disasters, fires, floods, illness, untimely death and theft are all unpredictable as is the impact on the charity’s money. As the legal test does not include a reasonability clause one would need to rely on the CRA’s indulgence not to pursue sanctions in these circumstances. Typically, the CRA is more understanding where the CRA’s own directives have been followed in advance of the problem arising.

While conducting the risk analysis is necessary, explicitly requiring it likely was not. Besides the fact that the assessment is part of a director’s responsibility anyways (see again our first article), one imagines that an unspoken risk assessment is done by any experienced party to a transaction – especially an international one.

Implicitly, in most transactions the buyer will gauge whether or not the other party to the transaction can deliver on what they promised. They will look at things like the trustworthiness of the partner, size of the vendor, quality of the product, the safety of delivery, reputation of the other party, and the likelihood that their funds will be stolen by the vendor, local government, or bandits. Just imagine buying felt for your hat business for the first time, from an unknown vendor in (for example) Romania – how sure would you be of the product and its delivery? As a small business you would investigate and consider all the angles before sending your money.

Indeed, the analysis may go deeper. There may be a review as to the reputational risk of association with a particular partner or in a particular geography, there may be ESG concerns, or other reputational risks that could arise by engaging in this transaction. Moreover, even if things were going well over several years any important change within your partner’s structure may cause you to rethink your analysis before continuing the relationship.

The guidance states that the factors to consider is open ended and is vague on the ranking of the various risk factors. Given the breadth and size of the charity sector this might be the right approach for the CRA, but it makes it difficult for charities to know that they have a risk analysis that will protect them from a demanding CRA auditor. Any given risk assessment charity may be substantially different from the one required by the CRA, and that should be okay if the CRA’s considerations are met and the intent is to protect the charity’s resources.

To illustrate our point, below is a table taken from the guidance which lists certain factors – although again the list is non-exhaustive – and provides no way of ranking the concerns.

To meet the CRA requirements, and the director responsibilities for good stewardship, the analysis should be reasonably robust and practical for the considerations of the charity. Rather than consider the CRA document as a formula, charities should consider all the circumstances of the particular grant. And the report itself should reasonably consider the various factors.

The next article in our series will discuss assembling a compelling risk analysis.