Consultancy – Consulting Risk Tool & Appetite Assignment

Country: Netherlands Organization: Netherlands Red Cross Closing date: 14 Oct 2026 Find the all supporting documents in our PUBLIC TEMPLATES and the Terms of Reference and Request for Proposal: TD 2026 1386 Consultancy – Consulting Risk Tool & Appetite Assignment including the exact evaluation process and selection criteria. Indicative Timeline: Deadline for submission of proposals: 14 October 2026 Evaluation and selection of audit firm: 19 October 2026 Notification of award and contracting week of 19 October 2026 Assignment start and end date: As soon as possible after contracting Deadline for submission of final deliverables: 20 December 2026 1.Introduction The Netherlands Red Cross International Assistance Department (NLRC) seeks external expertise to provide advice on the further development and operationalization of its risk management approach. The assignment focuses on strengthening decision-making related to partnership management and localization of assistance by defining and operationalising risk appetite and tolerance, improving risk assessment methodologies, and translating these into practical guidance and minimum control frameworks for staff. The assignment is structured into three separate groups of deliverables: 1. Deliverable A – Risk Assessment Tool Review and Improvement: assessment of the existing NLRC and CRRA risk assessment tools and development of practical improvements to ensure the process scope, risk categories, questions, scoring methodology and resulting financial control measures are clear, objective, proportionate and fit for NLRC use (including guidelines on how to use the tool). 2. Deliverable B – Risk Appetite and Minimum Controls Advisory: advisory support regarding the design of a future risk appetite, risk tolerance and minimum controls framework, including governance, guidance and implementation recommendations. 3. Deliverable C – Process Facilitation and Framework Development: facilitation of NLRC management and staff in translating the recommendations from Deliverable B into draft frameworks and agreed outputs. Service providers are requested to provide separate (financial) proposals for the different deliverables. NLRC reserves the right to award Deliverables A, B and C separately or in combination to one or more service providers. Technical and financial proposals shall therefore clearly distinguish between Deliverables A, B and C. 2. Context and background NLRC works closely with other (Movement) partners in both long-term and short-term partnership/ projects. Recent risk management experiences have identified recurring challenges regarding the consistent assessment of risk, determination of acceptable risk levels, and selection of proportionate mitigation measures. The absence of clearly defined risk appetite, risk tolerance guidance, and minimum controls has resulted in differing interpretations across teams, inconsistent risk assessments, prolonged discussions on mitigation measures, and uncertainty regarding risk acceptance and sharing decisions. These challenges are particularly evident in: • Long-term partnerships periodic assessments, and engagement and continuation decisions. • Short-term (technical assistance) project arrangements. • Localization ambitions and risk-sharing efforts with partner National Societies. NLRC aims to further align its risk management approach with relevant IFRC-network frameworks, tools and Movement-wide developments including the Capacity Review and Risk Assessment (CRRA), the Way of Working (WoW) initiative, and the General Terms and Conditions developments while ensuring that risk management remains practical, adaptive and proportionate to context. 3. Purpose and Objectives Purpose of the assignment: To provide independent advice on how NLRC can strengthen its partnership risk assessment approach and how it should organize the development of a risk appetite and tolerance framework, a minimum internal controls set, and practical tools and guidance for risk management related to long-term partnerships, short-term partnerships/projects and localization and risk sharing ambitions. Additionally, and depending on the offer, the assignment has the objective to focus on facilitation of the process to set up this risk appetite framework and minimum control framework, including supporting documentation. Although this assignment is commissioned by and primarily focused on the International Assistance Department, NLRC seeks recommendations that are scalable and capable of supporting future organizational developments. In particular, the consultant is encouraged to consider how the proposed improvements to partnership risk assessments, risk appetite, risk tolerance, minimum controls and associated guidance could serve as building blocks for a future Netherlands Red Cross-wide approach. Where relevant, the consultant should therefore identify opportunities for standardization, harmonization and governance arrangements that would enable future adoption beyond IA, while ensuring that recommendations remain practical and proportionate to the specific objectives and context of this assignment. Key questions The consultant shall answer the following questions during the assignment: • Partnership risk assessments • How can we improve our risk assessment tool? • Which risk categories and related assessment questions are most relevant for NLRC, particularly from a financial control perspective, and how can these be balanced so the assessment remains complete but not unnecessarily extensive? • What objective and transparent rating or scoring methodology would be most appropriate for the NLRC context, including clear criteria, weighting and escalation thresholds? • How can the NLRC risk assessment tool remain efficient, user-friendly and adaptable to different contexts, including regular partnerships, short-term projects and exceptional or rapidly changing situations? • Following the rating outcome, what clear set of financial and operational control measures should be implemented, monitored and reviewed, including guidance on residual risk and cases where the standard template may not be sufficient? 2. Risk appetite, risk tolerance and minimum controls • How should NLRC define and articulate risk appetite and risk tolerance in relation to engaging and continuing with both long-term and short-term partners, and to localization objectives? • Which stakeholders should be involved, what decisions are required, and at which management level should these decisions be made? • How should NLRC distinguish between risk appetite, risk tolerance, thresholds, minimum controls and escalation criteria? • What scope, structure and content should a appetite and threshold framework contain? • What types of minimum controls should be considered mandatory across all contexts, and which controls could be adapted based on risk profile, partner capacity or context? • How can the controls framework remain proportionate while ensuring adequate assurance, accountability and safeguarding of NLRC standards? 3. Governance and operationalization • How should risk appetite, tolerance and minimum controls be translated into practical staff guidance? • What tools, templates, decision aids, training or examples would be required to support consistent application by staff? • How should the future framework and guidance be embedded in existing risk management, partnership management and localization-related processes and documents? 4. Process facilitation and framework development • What facilitation approach is most suitable to support management and staff in defining risk appetite and tolerance parameters? • How can differing stakeholder perspectives be effectively reconciled during the framework-development process? • What workshop formats, decision-making tools and facilitation techniques are most suitable for reaching agreement on risk appetite and minimum controls? • How should draft frameworks be validated, tested and refined before formal approval? • What level of management engagement is required throughout the facilitation process? • What practical outputs should be produced during the facilitated sessions to ensure ownership and readiness for implementation? • How can the facilitated process support long-term adoption and consistent application of the future frameworks? 5. Methodology The consultant is expected to design and present a methodology for the different deliverables that is based on a participatory approach and at least including the following: • Review and analysis of the existing NLRC and CRRA risk assessment methodologies, processes, questions, scoring approach and related tools. • Assessment of whether the current tools produce sufficiently clear, objective and actionable ratings and whether the rating outcomes are linked to proportionate financial control measures. • Review of relevant donor protocols (e.g. from the Ministry of Foreign Affairs and DG ECHO). • Desk research into relevant Movement-wide and other National Society risk assessment processes and case studies, approaches and tools to identify opportunities for adoption, adaptation and harmonization. • Alignment with Red Cross/Red Crescent good practices, frameworks and initiatives, including IFRC-WoW. • Interviews and workshops with key stakeholders. • Development of recommended improvements to the risk assessment tool, including process scope, risk categories, assessment questions, scoring methodology, escalation thresholds and links to minimum financial controls. • Development of draft threshold and appetite frameworks with consolidated information from stakeholder input sessions. • Validation workshops to discuss preliminary findings and recommendations, and proposed frameworks and guidance. • (Practical testing of proposed approaches against real partnership and emergency-response scenarios.). Deliverables Deliverables – Part A. Risk management process review 1. Assessment report and improved risk assessment tool, including: a review of the existing NLRC and CRRA risk assessment approaches, processes, questions and related documents; a gap analysis; recommended risk categories and proportionate assessment questions; an objective rating/scoring methodology with clear criteria and escalation thresholds; and a practical set of financial and operational control measures linked to the rating outcome, including guidance on monitoring, review, residual risk and exceptional cases. Deliverables – Part B. Risk appetite and minimum control advisory 2. Advisory process design for developing a risk appetite and tolerance framework for partnership engagement and the localization trajectory, including: a. Recommended steps, decision points and governance route for defining, discussing and approving risk appetite and tolerance. b. Suggested structure and key components of a future risk appetite and tolerance framework. c. Advice on stakeholder involvement, management facilitation and validation of the future framework. 3. Advisory process design for developing a minimum internal controls set regarding partnership engagement and the localization trajectory, including: a. Recommended approach for identifying mandatory and context-adaptable controls. b. Advice on linking controls to risk profiles, partner capacity, context and localization ambitions. c. Advice on governance, monitoring and review of the future controls set. 4. Advisory guidance approach for staff, including: a. Recommended tools, templates, decision aids, examples and training needs to support consistent application. b. Advice on embedding the future guidance in existing risk management, partnership and localization-related processes and documents. 5. Final advisory report and presentation to the Management Team, summarizing findings, recommendations, proposed process designs, key decisions required and suggested next steps. Deliverables – Part C. Process facilitation Deliverable C focusses on putting the advices from deliverable B in practice, and facilitating the NLRC in implementing those advices. 6. Facilitation sessions to guide NLRC relevant staff and management in setting-up the risk appetite and minimum controls framework for partnership engagement and its localization ambitions. 7. Draft risk appetite and tolerance framework, consolidated from the facilitated sessions with relevant staff and management. 8. Draft framework for internal controls, consolidated from the facilitated sessions with relevant staff and management. 7. Profile of the desired Service Provider/Company a) Experience with and knowledge of o Enterprise risk management and governance, with a focus on risk appetite, thresholds and minimum controls; o The Red Cross Red Crescent Movement and the broader humanitarian and development sector, and preferable of the Netherlands Red Cross; o Partnership and project risk assessment processes, including risk categories, assessment questions, rating/scoring methodologies and links to financial control measures; o The concept of localization and locally led action within the humanitarian and development sector. o Familiarity with donor compliance requirements (e.g. DG ECHO, Ministry of Foreign Affairs) b) Skillsets: o Process analysis o Facilitation and presentation; o Planning and time management; o Report writing; c) Language: o Professional level of written and spoken English 8. Planning • The full assignment should be completed before December 31st • If it is not deemed possible to complete all deliverables before December 31st, the focus should primarily be on Deliverable A, including the improved risk assessment tool, and then Deliverable B. • Specific timelines can be discussed between the providing party and the NLRC. 9. Responsibilities and lines of communication The assignment as described in the ToR will be coordinated by the Netherlands Red Cross and for any questions or issues about the conditions of the assignment the consultant should refer to the Risk Management Officer of the Netherlands Red Cross. For anything related to the assignment's execution, the consultant will liaise mainly with the Risk Management Officer and the Financial Control department, particularly for Deliverable A and the translation of risk ratings into financial control measures. 10. Relevant documentation The contracted party will be receiving a comprehensive documentation package including relevant information about ongoing IFRC practices and developments such as the IFRC CRRA and General Terms and Conditions process, relevant NLRC processes and documents, case studies of risk assessment processes, and others. 11. Budget The available budget for this assignment is estimated at EUR 40,000 (excluding VAT). Consultants are requested to submit a detailed financial proposal demonstrating value for money. NLRC reserves the right not to award the contract if submitted proposals exceed the available budget or do not meet the required quality standards. Payments will be made against approved deliverables and receipt of a valid invoice. No advance payments will be made unless explicitly agreed in writing. Key Assessment Criteria • Experience, skills, and capacity of the service provider Proven experience conducting audits for donor-funded projects (references); qualifications (short CVs) and language skills of the proposed team members (fluency in English is mandatory); capacity of the bidder to meet the requirements of the Netherlands Red Cross (NLRC). • Technical approach and implementation plan Clear and structured audit methodology; risk management approach; proposed tools and procedures to deliver the assignment in line with the ToR. • Work plan and project management A realistic and detailed timeline; allocation of resources; identification of a project manager; logistical feasibility. • References At least two relevant and contactable references for clients served within the past twenty-four months. Knowledge The proposal must clearly state whether the bidder has the knowledge needed to meet the ToR requirements and demonstrate any relevant presence or familiarity with the context. All reports, tools, frameworks, templates, methodologies and other outputs developed under this assignment shall become the property of the Netherlands Red Cross. The consultant may not disclose or reuse project materials without prior written consent from NLRC How to apply • Submission deadline: 14 October 2026 – 18:00 (UTC+1 – Amsterdam time) • Submission email: logistics@redcross.nl • Email subject line: Consultant Risk Tool - 2026 1386 - Bid Submission – [Your Company Name] • Submission method: Bidders are strongly encouraged to include a cloud storage link (Google Drive, Dropbox, etc.) in their email, granting view and download access to the Netherlands Red Cross. This ensures secure transmission and helps avoid email attachment size limitations. • Any questions, comments, or requests for clarification must be sent to: logistics@redcross.nl, with a copy to lclausing@redcross.nl. The Netherlands Red Cross (NLRC) reserves the right to accept or reject any proposal, in whole or in part, without obligation to provide justification to the bidder. NLRC may cancel, suspend, or amend this procurement process at any stage prior to contract award without incurring any liability to participating bidders. NLRC further reserves the right to: • Request additional information or clarification from bidders; • Negotiate technical and/or financial aspects of the proposal with one or more bidders; • Award the contract in full, in part, or not at all; • Award different components of the assignment to different service providers, where deemed in the best interest of NLRC; • Reject proposals that are incomplete, non-compliant, or do not represent adequate value for money. Participation in this procurement process does not guarantee the award of a contract, nor does it create any obligation on the part of NLRC to award a contract. Important: Bidders must not send proposals to any other Red Cross email address. Failure to comply with this requirement will result in immediate disqualification. Submission Guidelines A package of supporting documents will be shared at the start of the assignment. Interested firms are invited to submit both a technical and a financial proposal that meets the requirements outlined in these Terms of Reference (ToR). Proposals must be submitted in English. These proposals will be evaluated separately, and the contract will be awarded to the candidate with the highest overall score. Proposals will be assessed based on compliance, quality, and price. In principle, the contract will be awarded to the organization submitting the most economically advantageous offer. This means that not only the price but all award criteria will be taken into account. Administrative Compliance In order to be shortlisted and evaluated according to the selection criteria (see Section C), your bid must include the following items — failure to provide any of these will render your application ineligible: • Proof of registration with the relevant Chamber of Commerce and/or documentation proving registration as a self-employed entity (depending on status: receipt of declaration filing with the CFE, RSEIRL extract, K or K-bis extract), as well as a VAT registration or tax identification number. • CVs of the staff proposed for this assignment, demonstrating relevant experience (make sure they are available after contracting). • A technical proposal/methodological note, including a provisional timeline in line with these ToR. • A financial proposal indicating a total price, with a detailed breakdown of costs by days or hours worked, professional fees, any applicable overheads, the VAT component, and a proposed payment schedule. • Two (2) references or examples of comparable assignments carried out by the bidder, in terms of scope, duration, and budget. Supplier Registration The Netherlands Red Cross is currently implementing a selection and registration process for all service providers and suppliers with whom it enters into contractual agreements. The selected bidder may be subject to supplier due diligence and sanction screening procedures prior to contract award. As part of this process: • Bidders are required to complete the NLRC Vendor Registration Form and submit all supporting documents requested in the form. • If the engagement under these ToR requires travel outside the supplier’s country of residence, the selected bidder must sign a Non-NLRC Staff Commitment Note before departure. A template of this note will be provided during the tender process for review. • The selected service provider must agree with the Vendor Code of Conduct. • Bidders must disclose any actual, potential or perceived conflict of interest that could affect the impartiality or independence of the assignment. NLRC reserves the right to exclude proposals where conflicts of interest cannot be adequately managed. Supplier registration is a prerequisite for the final award of the contract