It depends on the size of the nonprofit. If it’s small a single person can be appointed to be responsible for risk management. Medium and large nonprofits can have a special department dedicated to risk management.