In general, how is project risk actually measured within not-for-profit businesses? How is project risk incorporated into the decision process?

Sandra McCloud, a finance major in her last term of college, is currently scheduling her placement interviews through the university's career resource center. Her list of companies is typical of most finance majors: several commercial banks, a few industrial firms, and one brokerage house. However, she noticed that a representative of a not-for-profit hospital is scheduling interviews next week, and the position--that of financial analyst--appears to be exactly what Sandra has in mind. Sandra wants to sign up for an interview, but she is concerned that she knows nothing about not-for-profit organizations and how they differ from the investor-owned firms that she has learned about in her finance classes. In spite of her worries, Sandra scheduled an appointment with the hospital representative, and she now wants to learn more about not-for-profit businesses before the interview.
To begin the learning process, Sandra drew up the following set of questions. See if you can help her answer them.
First, consider some basic background information concerning the differences between not-for-profit organizations and investor-owned firms.

In most instances, it is very difficult to develop accurate assessments of a project's corporate risk. Thus, not-for-profit firms often use the project's stand-alone risk, along with a subjective notion of how the project fits into the firm's other operations, as an estimate of corporate risk. This practice is not inappropriate. Corporate risk and stand-alone risk tend to be highly correlated, since most projects under consideration tend to be in the same line of business as the firm's other operations. Thus, incorporation of risk into investment decisions is a somewhat subjective process but nonetheless is one that should be conducted.