Risk Management and Insurance for Charities: A Guide | LegalDocuments.co.uk

Overview

Risk management, in a charity context, is the ongoing process by which trustees and senior staff identify what could go wrong, decide how serious each threat is, and put proportionate measures in place to reduce the likelihood or the impact. It is not about eliminating risk entirely, which would make most charitable work impossible, but about taking considered risks with eyes open.

The Charity Commission expects trustees of larger charities to include a risk management statement in their annual report, confirming that the major risks have been reviewed and that systems are in place to manage them. Smaller charities are encouraged to follow the same approach proportionately.

Insurance sits alongside this work as a way of transferring certain financial consequences to an insurer when a risk cannot be avoided or fully controlled. Done well, risk management protects beneficiaries, safeguards trustees from personal exposure, reassures funders, and keeps the charity's reputation intact. Done poorly, or not at all, it tends to surface only when a crisis hits and options have narrowed.

Key steps

1. Map your charity's risks honestly. Start with a structured conversation at trustee level about what could genuinely harm the charity or the people it serves. Cover governance, operations, finances, safeguarding, data, premises, reputation and the external environment. Write everything down, even the uncomfortable items, because unrecorded risks rarely get managed.
2. Assess likelihood and impact. For each risk identified, consider how likely it is to occur and how damaging it would be if it did. A simple scoring matrix works well here, allowing trustees to rank risks and focus attention on those that combine real probability with serious consequences rather than dispersing energy across every possible scenario.
3. Decide how to respond to each risk. For every significant risk, choose whether to avoid the activity altogether, reduce the likelihood through controls, transfer the financial consequences through insurance, or consciously accept the risk because the mission justifies it. Record the reasoning, because that trail matters if something later goes wrong.
4. Put controls and insurance in place. Controls might include staff training, safeguarding policies, financial delegation limits, cyber security measures or reserves targets. Where residual risk remains, review insurance cover such as trustee indemnity, public liability, employer's liability, property, professional indemnity and cyber policies, matching each policy to the risks it is meant to address.
5. Review regularly and learn from incidents. Risk registers lose their value quickly if they sit untouched between audits. Build a rhythm of review, at least annually and whenever something significant changes, and treat near misses and complaints as useful data. Update policies, training and insurance cover as the charity evolves.

Common questions