Incident Reporting Protocols for Charities: A Practical Guide | LegalDocuments.co.uk

Overview

An incident reporting protocol is the internal framework a charity uses to capture, escalate, investigate and learn from events that affect its people, its work, or its standing. In the charity sector, 'incident' is a broad term. It covers safeguarding concerns, financial irregularities, data breaches, health and safety events, fraud, criminal activity, and situations that could damage public trust in the organisation.

The Charity Commission operates a separate regime called serious incident reporting, which sits on top of whatever internal process you run. Trustees have a duty to report serious incidents to the Commission promptly, and that duty doesn't go away just because the charity is small or volunteer-led.

A good protocol does three things at once: it tells staff and volunteers what to do when something happens, it gives trustees the information they need to make decisions, and it creates a documented trail if regulators, funders or insurers come asking questions later. Without it, charities tend to rely on individual judgment in the moment, which rarely ends well.

Key steps

1. Map the incidents that are realistic for your charity. Start by listing the kinds of events that could plausibly occur given your activities, beneficiaries and operating environment. A homelessness charity will have a different risk profile to a heritage society or a grant-making foundation. Think about safeguarding, finance, data, reputation, staff and volunteer welfare, and operational disruption. This mapping exercise shapes everything that follows.
2. Agree clear thresholds and definitions with your trustees. Vague definitions are the enemy of consistent reporting. Decide, as a board, what counts as a minor incident, a significant internal matter, and a serious incident that meets the Charity Commission's reporting threshold. Document those definitions with examples so that staff and volunteers aren't left guessing. The Commission publishes guidance on what it considers a serious incident, use that as your anchor point.
3. Design a reporting route that people will actually use. If reporting an incident is awkward, slow or embarrassing, it won't happen. Create a simple form or online submission route, nominate a first point of contact (often the CEO or a designated trustee), and make sure there's a backup route for incidents involving that person. Confidentiality matters here, particularly for safeguarding and whistleblowing concerns.
4. Set out who does what once a report comes in. Allocate responsibility for triage, investigation, communication with regulators, and communication with anyone affected. Trustees remain ultimately accountable, but day-to-day handling is often delegated. Make sure your protocol says when a matter must be escalated to the full board, and when it needs to be reported externally to the Charity Commission, the ICO, the police, the Fundraising Regulator, or a safeguarding authority.
5. Record, review and learn from every incident. Keep a log of all reported incidents, the actions taken and the outcomes. Review the log at trustee meetings at an appropriate cadence, quarterly works for many charities. Look for patterns, near-misses and weaknesses in controls. A protocol that captures incidents but never learns from them is just paperwork; the point is to improve how the charity operates over time.

Common questions