Risk on a Historic, Youth-Serving Arts Campus

Shake Rag is not only a classroom nonprofit. Its public materials describe a 2.5-acre historic campus, programs for adults and children, studios and workshops, lodging, rentals, and events ¹. Each adds mission value and a different exposure.

The board’s goal is not “no risk.” It is informed risk in service of mission, with prevention, response, financing, and learning.

Build a risk register

For each risk record:

scenario · causes · affected people/assets · existing controls · likelihood · impact · velocity · owner · indicators · treatment · deadline · residual risk · board threshold

“Cybersecurity: high” is not a scenario. Use:

A compromised staff account changes donor payment instructions, exposes participant data, and interrupts registration during peak enrollment.

Now controls and response can be tested.

Score impact across:

• safety/safeguarding;
• mission/program continuity;
• cash/financial loss;
• property/historic fabric;
• legal/regulatory/grant;
• privacy;
• reputation/relationships;
• staff capacity.

Youth protection

The CDC frames prevention in six components: screening/selecting employees and volunteers, interaction guidelines, monitoring behavior, safe environments, responding to inappropriate behavior/breaches/allegations, and training ².

Board assurance questions:

• Which roles require applications, references, checks, interviews, and rescreening?
• Are interaction rules explicit for one-on-one contact, digital communication, transportation, bathrooms/changing, overnight situations, photography, gifts, and physical assistance?
• How are minors signed in/out and released?
• Can participants report concerns through more than one safe channel?
• Do staff/volunteers know Wisconsin mandatory-reporting duties applicable to their roles?
• Who contacts authorities? Who must not investigate?
• Are lower-level boundary violations documented and corrected before escalation?
• Are facilities arranged for visibility without destroying privacy?
• Are contractors, instructors, renters, and partner programs covered by agreements?
• Is retaliation prohibited?
• What anonymized board indicators show implementation?

A background check is one control, not a youth-safety system.

Studios, tools, and materials

Map each activity:

• tool/material hazards;
• required age/skill and instructor ratio;
• guarding, ventilation, PPE, housekeeping;
• chemical labeling, storage, disposal;
• allergy/exposure information;
• emergency stops, first aid, eyewash, fire control;
• equipment inspection/maintenance;
• accessibility and alternate participation;
• waiver/consent language reviewed by counsel/insurer;
• incident and near-miss reporting.

The board should receive trends and serious exceptions, not conduct daily inspections.

Historic buildings and grounds

Deferred maintenance can compound silently. Maintain:

• condition assessment by building/system;
• life-safety and code priorities;
• preservation significance and acceptable intervention;
• roof/water/drainage envelope;
• electrical, fire, egress, accessibility, HVAC/air quality;
• trees, paths, ice, lighting, retaining/terrain;
• project cost bands, contingencies, inflation, dependencies;
• restricted versus unrestricted funding;
• insurance valuation and business-interruption assumptions;
• preventive schedule and completed evidence.

Use priority:

1. imminent people safety;
2. active water/fire/structural deterioration;
3. mission interruption/access;
4. cost escalation;
5. enhancement.

Never let the capital plan be only a donor wish list. Unphotogenic systems preserve the campus too.

Lodging, rentals, events, and alcohol

Clarify:

• occupancy, fire/egress, emergency contacts;
• cleaning, food, pests, keys/access, security;
• accessibility and accommodation;
• renter use restrictions, supervision, insurance, indemnity;
• cancellations, deposits, damage, weather;
• vendor certificates and contract review;
• alcohol service/licensing and intoxication response;
• cash/auction/raffle controls;
• incident jurisdiction between renter and Shake Rag;
• on-call authority after hours.

Risk transfer in a contract is only useful if valid, understood, insured, and followed.

Data and cyber

Inventory data: children, participants, donors, payment, employees, artists, health/accommodation, photos, credentials. Minimize collection and retention.

Baseline controls:

• multifactor authentication;
• password manager and no shared personal logins;
• least privilege and prompt offboarding;
• patched devices and protected backups;
• payment processing through compliant providers;
• phishing/wire-change verification;
• vendor review and breach terms;
• incident plan with insurer/counsel/communications contacts;
• annual tabletop exercise.

Board indicators: MFA coverage, overdue access removals, backup restore test, critical patches, phishing trend, incidents and corrective actions.

Crisis command

Preassign:

• incident lead;
• safety/authority contact;
• executive and board notification thresholds;
• insurer/counsel/safeguarding/technical contacts;
• spokesperson and holding statement;
• family/participant/staff communications;
• operational continuity;
• documentation and after-action owner.

First principles:

protect life · report as required · preserve facts · care for affected people · communicate only verified information · avoid speculation/retaliation · restore mission safely · learn

Risk appetite

Write statements:

• very low appetite: child harm, fraud, retaliation, deliberate legal breach;
• low appetite: unmanaged life-safety or historic-asset deterioration;
• moderate appetite: piloting a bounded new program with stop/go evidence;
• considered appetite: mission-aligned artistic experimentation where consent and controls are strong.

Then attach thresholds. Without thresholds, “low appetite” is decoration.

Quarterly board risk report

• top five changing exposures;
• severe incidents and corrective status;
• leading indicators;
• overdue high-priority treatments;
• insurance/claims changes;
• new programs/properties/contracts/grants affecting exposure;
• decisions requested.

Board exercise: select one plausible scenario—child boundary concern, fire, tool injury, burst pipe, data breach, sudden executive absence—and run a 45-minute tabletop. Ask who acts in the first 10 minutes, two hours, day, week, and month. Every uncertain answer becomes an assigned improvement.