Consultancy – Consulting Risk Tool & Appetite Assignment

Find the all supporting documents in our PUBLIC TEMPLATES and the Terms of Reference and Request for Proposal: TD 2026 1386 Consultancy – Consulting Risk Tool & Appetite Assignment including the exact evaluation process and selection criteria.

Indicative Timeline:

Deadline for submission of proposals: 14 October 2026

Evaluation and selection of audit firm: 19 October 2026

Notification of award and contracting week of 19 October 2026

Assignment start and end date: As soon as possible after contracting

Deadline for submission of final deliverables: 20 December 2026

1.Introduction

The Netherlands Red Cross International Assistance Department (NLRC) seeks external expertise to

provide advice on the further development and operationalization of its risk management approach. The assignment focuses on strengthening decision-making related to partnership management and localization of assistance by defining and operationalising risk appetite and tolerance,

improving risk assessment methodologies, and translating these into practical guidance and minimum control frameworks for staff.

The assignment is structured into three separate groups of deliverables:

1. Deliverable A – Risk Assessment Tool Review and Improvement: assessment of the

existing NLRC and CRRA risk assessment tools and development of practical improvements to ensure the process scope, risk categories, questions, scoring methodology

and resulting financial control measures are clear, objective, proportionate and fit for

NLRC use (including guidelines on how to use the tool).

2. Deliverable B – Risk Appetite and Minimum Controls Advisory: advisory support regarding

the design of a future risk appetite, risk tolerance and minimum controls framework, including

governance, guidance and implementation recommendations.

3. Deliverable C – Process Facilitation and Framework Development: facilitation of NLRC management and staff in translating the recommendations from Deliverable B into draft frameworks and agreed outputs.

Service providers are requested to provide separate (financial) proposals for the different deliverables. NLRC reserves the right to award Deliverables A, B and C separately or in combination to one

or more service providers. Technical and financial proposals shall therefore clearly distinguish between Deliverables A, B and C.

2. Context and background

NLRC works closely with other (Movement) partners in both long-term and short-term partnership/ projects. Recent risk management experiences have identified recurring challenges regarding the consistent assessment of risk, determination of acceptable risk levels, and selection of proportionate mitigation measures. The absence of clearly defined risk appetite, risk tolerance guidance, and minimum controls has resulted in differing interpretations across teams, inconsistent risk assessments, prolonged discussions on mitigation measures, and uncertainty regarding risk acceptance and sharing decisions. These challenges are particularly evident in:

• Long-term partnerships periodic assessments, and engagement and continuation decisions.

• Short-term (technical assistance) project arrangements.

• Localization ambitions and risk-sharing efforts with partner National Societies.

NLRC aims to further align its risk management approach with relevant IFRC-network frameworks,

tools and Movement-wide developments including the Capacity Review and Risk Assessment

(CRRA), the Way of Working (WoW) initiative, and the General Terms and Conditions developments

while ensuring that risk management remains practical, adaptive and proportionate to context.

3. Purpose and Objectives

Purpose of the assignment: To provide independent advice on how NLRC can strengthen its partnership risk assessment approach and how it should organize the development of a risk appetite and tolerance framework, a minimum internal controls set, and practical tools and guidance for risk management related to long-term partnerships, short-term partnerships/projects and localization and risk sharing ambitions. Additionally, and depending on the offer, the assignment has the objective to focus on facilitation of the process to set up this risk appetite framework and minimum control framework, including supporting documentation.

Although this assignment is commissioned by and primarily focused on the International Assistance Department, NLRC seeks recommendations that are scalable and capable of supporting future organizational developments. In particular, the consultant is encouraged to consider how the proposed improvements to partnership risk assessments, risk appetite, risk tolerance, minimum controls and associated guidance could serve as building blocks for a future Netherlands Red Cross-wide approach. Where relevant, the consultant should therefore identify opportunities for

standardization, harmonization and governance arrangements that would enable future adoption beyond IA, while ensuring that recommendations remain practical and proportionate to the specific objectives and context of this assignment.

Key questions

The consultant shall answer the following questions during the assignment:

• Partnership risk assessments

• How can we improve our risk assessment tool?

• Which risk categories and related assessment questions are most relevant for NLRC, particularly from a financial control perspective, and how can these be balanced so the assessment remains complete but not unnecessarily extensive?

• What objective and transparent rating or scoring methodology would be most appropriate for the NLRC context, including clear criteria, weighting and escalation thresholds?

• How can the NLRC risk assessment tool remain efficient, user-friendly and adaptable to different contexts, including regular partnerships, short-term projects and exceptional or rapidly changing situations?

• Following the rating outcome, what clear set of financial and operational control measures should be implemented, monitored and reviewed, including guidance on residual risk and cases where the standard template may not be sufficient?

2. Risk appetite, risk tolerance and minimum controls

• How should NLRC define and articulate risk appetite and risk tolerance in relation to engaging

and continuing with both long-term and short-term partners, and to localization objectives?

• Which stakeholders should be involved, what decisions are required, and at which management level should these decisions be made?

• How should NLRC distinguish between risk appetite, risk tolerance, thresholds, minimum controls and escalation criteria?

• What scope, structure and content should a appetite and threshold framework contain?

• What types of minimum controls should be considered mandatory across all contexts, and which controls could be adapted based on risk profile, partner capacity or context?

• How can the controls framework remain proportionate while ensuring adequate assurance, accountability and safeguarding of NLRC standards?

3. Governance and operationalization

• How should risk appetite, tolerance and minimum controls be translated into practical staff guidance?

• What tools, templates, decision aids, training or examples would be required to support consistent application by staff?

• How should the future framework and guidance be embedded in existing risk management, partnership management and localization-related processes and documents?

4. Process facilitation and framework development

• What facilitation approach is most suitable to support management and staff in defining risk

appetite and tolerance parameters?

• How can differing stakeholder perspectives be effectively reconciled during the framework-development process?

• What workshop formats, decision-making tools and facilitation techniques are most suitable

for reaching agreement on risk appetite and minimum controls?

• How should draft frameworks be validated, tested and refined before formal approval?

• What level of management engagement is required throughout the facilitation process?

• What practical outputs should be produced during the facilitated sessions to ensure ownership

and readiness for implementation?

• How can the facilitated process support long-term adoption and consistent application of the

future frameworks?

5. Methodology

The consultant is expected to design and present a methodology for the different deliverables that

is based on a participatory approach and at least including the following:

• Review and analysis of the existing NLRC and CRRA risk assessment methodologies, processes, questions, scoring approach and related tools.

• Assessment of whether the current tools produce sufficiently clear, objective and actionable ratings and whether the rating outcomes are linked to proportionate financial control measures.

• Review of relevant donor protocols (e.g. from the Ministry of Foreign Affairs and DG ECHO).

• Desk research into relevant Movement-wide and other National Society risk assessment processes and case studies, approaches and tools to identify opportunities for adoption, adaptation and harmonization.

• Alignment with Red Cross/Red Crescent good practices, frameworks and initiatives, including IFRC-WoW.

• Interviews and workshops with key stakeholders.

• Development of recommended improvements to the risk assessment tool, including process scope, risk categories, assessment questions, scoring methodology, escalation thresholds and links to minimum financial controls.

• Development of draft threshold and appetite frameworks with consolidated information from stakeholder input sessions.

• Validation workshops to discuss preliminary findings and recommendations, and proposed frameworks and guidance.

• (Practical testing of proposed approaches against real partnership and emergency-response scenarios.).

Deliverables

Deliverables – Part A. Risk management process review

1. Assessment report and improved risk assessment tool, including: a review of the existing NLRC and CRRA risk assessment approaches, processes, questions and related documents; a gap analysis; recommended risk categories and proportionate assessment questions; an objective rating/scoring methodology with clear criteria and escalation

thresholds; and a practical set of financial and operational control measures linked to the rating outcome, including guidance on monitoring, review, residual risk and exceptional cases.

Deliverables – Part B. Risk appetite and minimum control advisory

2. Advisory process design for developing a risk appetite and tolerance framework for partnership engagement and the localization trajectory, including:

a. Recommended steps, decision points and governance route for defining, discussing and approving risk appetite and tolerance.

b. Suggested structure and key components of a future risk appetite and tolerance framework.

c. Advice on stakeholder involvement, management facilitation and validation of the future framework.

3. Advisory process design for developing a minimum internal controls set regarding partnership engagement and the localization trajectory, including:

a. Recommended approach for identifying mandatory and context-adaptable controls.

b. Advice on linking controls to risk profiles, partner capacity, context and localization ambitions.

c. Advice on governance, monitoring and review of the future controls set.

4. Advisory guidance approach for staff, including:

a. Recommended tools, templates, decision aids, examples and training needs to support consistent application.

b. Advice on embedding the future guidance in existing risk management, partnership and localization-related processes and documents.

5. Final advisory report and presentation to the Management Team, summarizing findings, recommendations, proposed process designs, key decisions required and suggested next steps.

Deliverables – Part C. Process facilitation

Deliverable C focusses on putting the advices from deliverable B in practice, and facilitating the NLRC in implementing those advices.

6. Facilitation sessions to guide NLRC relevant staff and management in setting-up the risk appetite and minimum controls framework for partnership engagement and its localization ambitions.

7. Draft risk appetite and tolerance framework, consolidated from the facilitated sessions with relevant staff and management.

8. Draft framework for internal controls, consolidated from the facilitated sessions with relevant staff and management.

7. Profile of the desired Service Provider/Company

a) Experience with and knowledge of

o Enterprise risk management and governance, with a focus on risk appetite, thresholds and minimum controls;

o The Red Cross Red Crescent Movement and the broader humanitarian and development sector, and preferable of the Netherlands Red Cross;

o Partnership and project risk assessment processes, including risk categories, assessment questions, rating/scoring methodologies and links to financial control measures;

o The concept of localization and locally led action within the humanitarian and development sector.

o Familiarity with donor compliance requirements (e.g. DG ECHO, Ministry of Foreign

Affairs)

b) Skillsets:

o Process analysis

o Facilitation and presentation;

o Planning and time management;

o Report writing;

c) Language:

o Professional level of written and spoken English

8. Planning

• The full assignment should be completed before December 31st

• If it is not deemed possible to complete all deliverables before December 31st, the focus should primarily be on Deliverable A, including the improved risk assessment tool, and then Deliverable B.

• Specific timelines can be discussed between the providing party and the NLRC.

9. Responsibilities and lines of communication

The assignment as described in the ToR will be coordinated by the Netherlands Red Cross and for any questions or issues about the conditions of the assignment the consultant should refer to the Risk Management Officer of the Netherlands Red Cross.

For anything related to the assignment's execution, the consultant will liaise mainly with the Risk Management Officer and the Financial Control department, particularly for Deliverable A and the translation of risk ratings into financial control measures.

10. Relevant documentation

The contracted party will be receiving a comprehensive documentation package including relevant information about ongoing IFRC practices and developments such as the IFRC CRRA and General Terms and Conditions process, relevant NLRC processes and documents, case studies of risk assessment processes, and others.

11. Budget

The available budget for this assignment is estimated at EUR 40,000 (excluding VAT). Consultants are requested to submit a detailed financial proposal demonstrating value for money. NLRC reserves the right not

to award the contract if submitted proposals exceed the available budget or do not meet the required quality

standards.

Payments will be made against approved deliverables and receipt of a valid invoice. No advance payments

will be made unless explicitly agreed in writing.

Key Assessment Criteria

• Experience, skills, and capacity of the service provider

Proven experience conducting audits for donor-funded projects (references); qualifications (short CVs) and language skills of the proposed team members (fluency in

English is mandatory); capacity of the bidder to meet the requirements of the Netherlands Red Cross (NLRC).

• Technical approach and implementation plan

Clear and structured audit methodology; risk management approach; proposed

tools and procedures to deliver the assignment in line with the ToR.

• Work plan and project management

A realistic and detailed timeline; allocation of resources; identification of a project

manager; logistical feasibility.

• References

At least two relevant and contactable references for clients served within the past

twenty-four months.

Knowledge

The proposal must clearly state whether the bidder has the knowledge needed to meet the ToR requirements and demonstrate any relevant presence or familiarity with the context.

All reports, tools, frameworks, templates, methodologies and other outputs developed under this assignment shall become the property of the Netherlands Red Cross. The consultant may not disclose or reuse project materials without prior written consent from NLRC