Risk Management Legal Framework for Charities Explained | LegalDocuments.co.uk

Overview

The legal framework for risk management in charities is the set of statutory duties, regulatory guidance and governance expectations that require trustees to identify, assess and manage the risks facing their organisation. It is not contained in a single statute.

Instead, it sits across the Charities Act 2011, trustees' fiduciary and common law duties, the Charity Commission's published guidance (including CC3 and CC26), the Statement of Recommended Practice (Charities SORP) for financial reporting, and the Charity Governance Code as a voluntary but widely adopted standard. Larger charities preparing accruals accounts are expected to include a statement in their trustees' annual report describing the principal risks and how these are being managed.

Smaller charities are held to a proportionate version of the same expectation. Taken together, these elements create a framework that treats risk management as an ongoing trustee responsibility rather than a one-off paperwork exercise, something that feeds into strategy, reserves policy, safeguarding, financial controls and decision-making at board level.

Key steps

1. Map the risks that actually matter to your charity. Start with an honest conversation at board level about what could stop the charity delivering its purposes. Cover strategic, operational, financial, safeguarding, reputational, compliance and external risks. A risk register that reflects your real activities is far more useful than a generic template copied from another organisation.
2. Assess likelihood and impact proportionately. For each risk, trustees should form a view on how likely it is to happen and how damaging it would be if it did. A simple scoring approach often works well for smaller charities, while larger organisations may need more detailed analysis. The aim is to prioritise attention, not to produce a spreadsheet for its own sake.
3. Decide how each risk will be treated. Trustees typically choose between tolerating, treating, transferring or terminating a risk. That might mean tightening financial controls, buying insurance, strengthening safeguarding policies, changing suppliers, or stepping away from an activity altogether. The rationale for each decision should be recorded so the board can show it has thought the issue through.
4. Embed risk management into governance and reporting. Risk should be a standing item at board meetings, linked to strategy, reserves and operational plans. Where the charity is required to prepare a risk statement in its trustees' annual report, that statement should genuinely reflect the board's discussions rather than being drafted as an afterthought at year-end.
5. Review regularly and update when circumstances change. Risks shift as the charity grows, funding changes, new activities launch or the external environment moves. Trustees should schedule formal reviews at least annually, and revisit the register whenever something significant happens, a major grant, a new service, a safeguarding concern, or a change in the law.

Common questions