In a time of global uncertainty effective risk management has become a critical strategic issue in the commercial sector, and policy makers continue to focus on mechanisms to improve corporate governance and managing organizational risks. Despite these developments there is little research on risk management in the nonprofit sector and factors associated with the implementation of an institutionalized risk management framework. Research is needed to identify key drivers and provide insight as to why some nonprofit organizations are responding to a changing environment by embracing a systematic approach to managing risks and others are not.

This exploratory study examines internal as well as external factors associated with the stage of risk management implementation using a unique setting in which large nonprofit organizations in Germany and the United Kingdom are confronted with very different regulatory requirements. Building on an integrated framework of resource dependence and institutional theory the effects of coercive, normative and mimetic isomorphism are documented.

Drawing on a qualitative field study of 30 organizations, it can be shown that the stage of risk management implementation is positively related to the presence of regulatory requirements. In absence of specific regulatory requirements, German nonprofit organizations appear to have less developed and more heterogeneous risk management systems than organizations in the United Kingdom. Additionally, findings suggest that in both countries, the degree of professionalism and the type of funding directly affects the approach to risk management. Based on this analysis, some new directions for more advanced theoretical and empirical research about risk management in nonprofit organizations are briefly mapped out.