Reputational risk for charities

What reputational risk is, and whose rule it is

In England and Wales the duty behind a charity's reputational risk is the trustees' duty of prudence: the Charity Commission's guidance The essential trustee (CC3) says trustees must “avoid exposing the charity's assets, beneficiaries or reputation to undue risk”. It sits under the duty to manage the charity's resources responsibly (CC3 sections 2.4 and 7): “You must act responsibly, reasonably and honestly. This is sometimes called the duty of prudence. Prudence is about exercising sound judgement.” CC3 uses “must” for a legal or regulatory requirement or duty, and “should” for good practice the Commission expects trustees to follow.

No statute defines reputational risk, and no law requires a charity to have a reputational risk policy. The duty is to avoid undue risk, and CC3 is explicit that this is not a duty to avoid all risk: “You have a duty to avoid exposing your charity to undue risk. This doesn't mean being risk averse.” Risk management, it continues, “may involve an element of responsible risk taking, and is central to how trustees make decisions” (CC3 7.1). The Commission's guidance of 9 December 2025, How charities can respond to the current hostile environment, makes the same point from the other side: charities “should expect to be challenged and criticised when engaging in debate”, and “under charity law, what matters is that trustees make decisions in good faith, guided by their charity's best interests and act reasonably on the information available.”

The Commission's risk guidance, Charities and risk management (CC26), updated on 16 September 2026, gives an example classification of charity risks in five categories – governance, operational, financial, external, and compliance with law and regulation – and lists “poor public perception and reputation” as an example of an external risk. It offers the table as one helpful system, “such as the example below”, rather than a required taxonomy, and says there is no requirement or obligation for trustees to adopt any particular model of risk management. What it does expect is breadth: a rigorous process helps make sure all areas of risk are covered, and CC26 names financial, governance, operational and reputational risk as examples.

Reputation matters to the regulator for a statutory reason. The first of the Commission's objectives in section 14 of the Charities Act 2011 is the public confidence objective, “to increase public trust and confidence in charities”, and another is the accountability objective, “to enhance the accountability of charities to donors, beneficiaries and the general public.” A charity's reputation is its own asset, and also part of the trust the whole sector depends on. This guide covers charities in England and Wales; Northern Ireland and Scotland have their own regulators (section 08).

Where reputational risk comes from

Reputation is rarely a risk on its own. It is usually the consequence of another risk materialising, which is why CC26's Annex 2 shows a reputational impact in every category of risk. CC26 says Annex 2 “should not be used as a checklist”, but its examples show where to look:

• Governance. Conflicts of interest carry an “impact on reputation”. CC3 6.5 says that where conflicts “have not been identified or properly dealt with, it can have negative impacts on both the charity and individual trustees including financial cost and reputational damage.”
• Fundraising. Annex 2 lists the “reputational risks of campaign or methods used”, and CC3 7.3 asks trustees deciding how the charity will obtain funds to think about “any potential reputational issues”.
• Services and complaints. Service provision carries “reputational risks”, and the mitigation CC26 gives for adverse publicity starts with complaints: “implement complaints procedures (both internal and external)” and “agree proper review procedures for complaints”. A pattern of complaints is often the first sign of a problem that later becomes public.
• Finance. Non-charitable trading carries a “reputational risk if publicised”, a reserves policy carries “reputational risks if policy cannot be justified”, and fraud or error carries “reputational risk”.
• Compliance with law and regulation. Annex 2 lists “reputational risks” where a charity fails to meet its legal or regulatory obligations.
• Subsidiaries and partners. CC26 says “events in a subsidiary trading company may affect income streams to the charity, give rise to reputational risk or may even affect operational objectives directly”. The Commission's serious incident guidance treats an incident involving a partner in the UK or abroad as reportable where it “materially affects your charity, its staff, operations, finances and/or reputation”, and a partner can be a subsidiary trading company or an organisation the charity funds.

The serious incident guidance names other common sources. Fraud, theft and cyber-crime “may also bring adverse publicity to the charity and damage its good reputation with donors, beneficiaries and the public, as well as that of the charity sector more generally”. Safeguarding failures, significant data breaches and significant adverse findings by an inspectorate are each listed. CC3 7.8 warns that relying too much on one individual “can result in the charity falling victim to fraud or theft, or beneficiaries suffering abuse. These kinds of occurrences could cause the charity serious reputational and other damage.”

Social media turns a local problem into a public one quickly, and the Commission's guidance Charities and social media (updated 21 April 2026) singles out the conduct of senior people on their personal accounts: “there may be a greater risk if a Chief Executive of a charity posts or shares on a personal social media account which clearly states their role at the charity or where they blend personal and professional content.” The social media policy guide covers what a policy should say.

When a reputational risk goes on the register, write it as cause, event and consequence rather than as the word “reputation”. For example: because concerns about a volunteer are not passed on (cause), an allegation becomes public through a family's post (event), leading to loss of donor and beneficiary confidence and a serious incident report (consequence). CC26 lists the potential impact of adverse publicity as “loss of donor confidence or funding”, “loss of influence”, “impact on morale of staff” and “loss of beneficiary confidence”. The risk register guide covers the columns, scoring and review.

Assessing and managing reputational risk

CC26 scores impact on a scale of 1 to 5, and its example descriptors for impact on service and reputation are specific about publicity:

• 2, minor: “slight impact on service”, “slight impact on reputation”.
• 3, moderate: “some service disruption”, “potential for adverse publicity - avoidable with careful handling”.
• 4, major: “service disrupted”, “adverse publicity not avoidable (local media)”.
• 5, extreme or catastrophic: “service interrupted for significant time”, “major adverse publicity not avoidable (national media)”, “major litigation expected”, “resignation of senior management and board”, “loss of beneficiary confidence”.

Combine that impact score with a likelihood score in the same way as any other risk; the risk register guide shows CC26's matrix. The descriptors are examples, and a charity can adapt them to its size: a small local charity might treat a critical story in the local paper as the top of its scale.

Ask whose trust is at stake. CC26 asks trustees identifying risks to consider “the charity's reputation with its major funders and supporters”, and notes that “some workshops can involve supporters and beneficiaries where reputational risk or provision of service to beneficiaries is being considered.” The Commission's donations guidance names a wider circle: supporters and beneficiaries, and also “other funders, stakeholders, employees, and volunteers.” For context rather than as a rule, the Commission's research Public trust in charities 2026 found 57% of adults in England and Wales with high trust in charities (7 to 10 on a 0 to 10 scale) and 11% with low trust (0 to 3), up from 9% in 2024.

CC26 also says trustees “need to let their managers know the boundaries and limits set by their risk policies to make sure there is a clear understanding of the risks that can and cannot be accepted.” For reputation, that means saying in advance which decisions a manager can take and which come to the board: accepting a large gift from a new source, a public statement on a contested issue, a partnership with an organisation that has been in the news.

Some charities must report on risk. A charity whose accounts must be audited must say in its trustees' annual report whether the trustees “have given consideration to the major risks to which the charity is exposed and satisfied themselves that systems or procedures are established in order to manage those risks” (regulation 40 of the Charities (Accounts and Reports) Regulations 2008). For financial years ending on or after 30 September 2026, a non-company charity needs an audit if its gross income exceeds £1.5 million, or exceeds £500,000 with assets over £5 million (Charities Act 2011, section 144, as amended); see the charity audit threshold guide. Separately, Charities SORP 2026 asks charities with gross income over £500,000 to give “a description of the principal risks” facing the charity, “together with a summary of their plans and strategies for managing those risks”, and charitable companies other than small companies describe their principal risks and uncertainties in a strategic report. CC26 encourages charities below the audit threshold to make a risk management statement as good practice. The trustees' annual report guide covers the rest of the report.

Decisions with a reputational edge, and the record of them

Most reputational risk is managed in ordinary decisions taken before anything goes wrong. The Commission has written guidance for the commonest of them.

Accepting, refusing or returning a donation. The Commission's guidance Accepting, refusing and returning donations to your charity (March 2024) starts from the other direction: “Your starting point is to accept or keep donations”. Trustees “must have a legal power to refuse or return a donation and be satisfied that using the power is in the best interests of your charity.” Among the factors to weigh, it lists “the risk of reduced support for your charity or harm to its reputation, particularly amongst its supporters or beneficiaries”, whether criticism “is likely to be short-lived or longer lasting”, and whether the charity can accept the donation while managing the risk, for example by negotiating terms with the donor or developing “a public explanation of your decision to keep the donation and your plans for it”. Those factors are balanced against the financial loss of refusing. The decision “must be rational and reasonable, and supported by clear evidence”, trustees must not let personal motives, opinions or interests affect it, and a donation from an illegal source is a different matter: it must be refused, and if one is suspected the guidance says “you should not return it or contact the donor”.

Speaking on an emotive issue. The social media guidance asks trustees planning to engage on emotive topics to consider “the risks to the charity, including its reputation, and actions you can take to mitigate these”, such as “informing key stakeholders of your plans”, and the effect on staff of “receiving a significant number of complaints or negative attention”, including “how you will support staff in case they have to deal with complaints and online abuse”. Where a charity's lawful work draws threats, abuse or intimidation, the hostile environment guidance says some charities will already have a plan for such incidents, and others “may now feel the need to develop such a plan and should make that decision based on a risk assessment.”

When a trustee is part of the story. If a damaging post or a breach of the social media policy involves a trustee, the guidance says “you must manage any conflict of interest”, for example by asking that trustee to leave the meeting while the response is decided. The register of interests guide covers how conflicts are declared and recorded.

The record. Every one of those decisions should leave a trace. The donations guidance says: “You should keep a record of your decisions and how you reached them.” CC3 1.1 adds that “the Commission expects you to be able to explain and justify your approach, particularly if you decide not to follow good practice in this guidance.” A minute that says only “the board agreed to return the gift” records the outcome; the record the Commission asks for shows the risks considered, the options weighed and why the trustees chose as they did. Where the decision is taken between meetings, the guide to trustee decisions between meetings covers how to make it valid and minute it.

The voluntary Charity Governance Code (2025 edition) recommends, under Principle 6, Managing resources and risks: “There are procedures for escalating to the board reputationally sensitive communications (including via social media)”. The Code says compliance with it “is not a regulatory requirement”, but the practice is a sensible answer to CC26's question about boundaries.

When it goes wrong: respond, report and be open

The Commission's guidance How to report a serious incident in your charity (last updated 16 January 2026) sets out what to do if something goes wrong: take immediate action to “prevent or minimise any further harm, loss or damage”, “report it to the Commission as a serious incident”, report it to the police or other regulators where that applies, “plan what to say to your staff, volunteers, members, the public, the media and other stakeholders, such as funders”, and “review what happened and prevent it from happening again”. For crisis communication, CC26's mitigation for adverse publicity is a crisis management strategy for handling it, including consistency of key messages and a nominated spokesperson; its mitigation for public perception includes communicating with supporters and beneficiaries and good quality reporting of the charity's activities and finances. The communication policy guide covers who speaks and who signs off.

Reputational damage can itself make an incident reportable. The Commission defines a serious incident as “an adverse event, whether actual or alleged, which results in or risks significant” harm to people who come into contact with the charity through its work, loss of money or assets, damage to property, or “harm to your charity's work or reputation”. “Significant” means “significant in the context of your charity, taking account of its staff, operations, finances and/or reputation”, and “it is the responsibility of the charity trustees to decide whether an incident is significant and should be reported.” CC3 8.3 and the serious incident guidance both say “the Commission requires charities to report serious incidents”, and the guidance puts the report itself in its “should” language: “as a matter of good practice, all charities, regardless of size or income, should report serious incidents to the Commission promptly”, meaning “as soon as is reasonably possible”. It sets no hour count. The “must” falls on the annual return declaration, below.

The guidance gives several reputational tests. Routine inspections by Ofsted, the Care Quality Commission or Care Inspectorate Wales need not be reported unless they produce significant adverse findings, including findings that “are likely to damage the charity's reputation or public confidence in the charity”. On workplace incidents, it does not expect every internal staffing incident to be reported, but says “a report should always be made where the level of harm to the victims and/or the likely damage to the reputation of or public trust in the charity is particularly high”, giving as an example sexual misconduct by the chief executive or another person in a senior position, such as the head of safeguarding. If a report is made and the person alleged to be responsible is later exonerated, the Commission wants to be told that too.

The Commission's position is that transparency protects reputation and concealment damages it. It asks for “prompt, full and frank disclosure”, and says: “An incident is less likely to damage a charity's reputation if trustees can show that they handled it well. If the media contact the Commission about an incident and it has been properly reported, we will be able to say that the trustees handled the situation responsibly and this will help protect the charity's reputation.” The other side is in CC3 8.3: “If trustees fail to report a serious incident that subsequently comes to light, the Commission may consider this to be mismanagement and take regulatory action”. If the trustees decide not to report and the Commission later becomes involved, “you will need to be able to explain why you decided not to report it at the time.” A charity with income over £25,000 must sign a declaration in its annual return that there were no serious incidents in the previous financial year that should have been reported but were not, and knowingly or recklessly giving the Commission information that is false or misleading in a material particular is an offence under section 60 of the Charities Act 2011. The serious incident reporting guide covers the categories, the form and the declaration in full.

The Commission's safeguarding guidance for charities and trustees (updated 8 October 2026) puts the same principle in one line: when handling an incident or allegation, “be as open and transparent as possible, so that you build the charity's reputation for acting with integrity while protecting confidentiality appropriately”.

A data breach can mean two reports to two regulators. A significant data breach or loss is listed as a serious incident for the Charity Commission, and under Article 33 of the UK GDPR a personal data breach must be notified to the Information Commission “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, unless it is unlikely to result in a risk to people's rights and freedoms. The 72-hour clock belongs to the data protection duty, not to the Charity Commission's guidance.

The reputational decision is usually made by message

The decisions this guide describes are rarely taken around the board table. A journalist emails the chief executive at six in the evening asking for comment by nine. The chair, the chief executive and two trustees work out a reply in a group chat. Someone suggests returning a donation now that the donor is in the news; someone else asks whether it is serious enough to report to the Commission; by eleven they have agreed a holding statement and agreed not to report. Each of those messages is part of how the trustees reached their decision, and it is that reasoning the Commission asks trustees to record for a donation decision and, if they decide not to report and the Commission later becomes involved, to be able to explain.

Months later, the trustees make the annual return declaration, or a funder asks how the board handled the story. If the reasoning sits in a group chat on four personal phones, two of them belonging to trustees who have since stood down, the board can show what it decided but not how. The minute records the outcome; the record of how the charity weighed its reputation is somewhere it does not control.

ComplyChat is designed to keep those conversations on the charity's record. Trustees, staff and volunteers talk in a channel the charity holds, everyone added is told it is on the record and can object or leave, and a mobile number verified by SMS is an identity, so a trustee or volunteer with no work account can take part. On paid plans, once the charity's Microsoft 365 tenant is connected, conversations are kept within the charity's own Microsoft 365 subscription, under the retention schedules it already runs. ComplyChat does not prevent reputational damage, decide what is significant or write the charity's statement, and it is no substitute for the trustees' judgement or the minutes.

A question for the next trustees' meeting: if the Commission asked tomorrow how the board reached its last decision with a reputational edge, where is the record?

Questions people ask

What is reputational risk for a charity?

Reputational risk for a charity is the chance that something the charity does, or something done in its name, damages the trust its supporters, funders, beneficiaries and the public place in it. The Charity Commission gives “poor public perception and reputation” as an example of an external risk in CC26, and CC3 says trustees must “avoid exposing the charity's assets, beneficiaries or reputation to undue risk”.

What types of risk do charities face?

The Charity Commission's CC26 offers an example classification of charity risks in five categories: governance, operational, financial, external, and compliance with law and regulation. Reputation appears under external risks, but CC26's Annex 2 shows a reputational impact arising in every category, from conflicts of interest and fundraising methods to reserves policy and regulatory compliance. CC26 says the classification is one helpful system and that Annex 2 “should not be used as a checklist”; each charity's risks are its own.

Is reputational damage a serious incident?

Yes, when it is significant: the Charity Commission defines a serious incident as an adverse event, actual or alleged, which results in or risks significant harm to people, loss of money or assets, damage to property, or “harm to your charity's work or reputation”. “Significant” is judged in the context of the charity, and the trustees decide whether to report.

Do charity trustees have a duty to protect the charity's reputation?

Yes. CC3 says trustees must “avoid exposing the charity's assets, beneficiaries or reputation to undue risk” as part of the duty of prudence, and adds that this “doesn't mean being risk averse”. The serious incident guidance calls protecting the charity's “assets, reputation and people who come into contact with it through its work” essential trustee responsibilities.

Can a charity refuse a donation because of reputational risk?

Yes, if the trustees have a legal power to refuse it and are satisfied that refusing is in the charity's best interests, but the Commission's starting point is to accept or keep donations. Trustees weigh “the risk of reduced support for your charity or harm to its reputation” against the financial loss, consider whether criticism is “likely to be short-lived or longer lasting” and whether the risk can be managed while keeping the gift, and “should keep a record of your decisions and how you reached them”.

Should a charity stay quiet about an incident to protect its reputation?

No. The Charity Commission says “an incident is less likely to damage a charity's reputation if trustees can show that they handled it well”, and that failing to report a serious incident that later comes to light may be treated as mismanagement. Its safeguarding guidance asks charities to “be as open and transparent as possible, so that you build the charity's reputation for acting with integrity while protecting confidentiality appropriately”.

Official guidance and your next step

The trustee duty is in the Charity Commission's The essential trustee (CC3), and the risk framework in Charities and risk management (CC26), whose Annex 2 lists reputational impacts and mitigations by category. For specific decisions, read How to report a serious incident in your charity, Accepting, refusing and returning donations to your charity, Charities and social media and How charities can respond to the current hostile environment. Quotations are from those pages as published on 21 October 2026.

This guide covers charities in England and Wales and is not legal advice. In Northern Ireland, the Charity Commission for Northern Ireland's serious incident reporting guidance says that if a serious incident happens, “the trustees must deal with it and report it to the proper authorities, including the Commission”. Charities in Scotland are regulated by OSCR; check its current guidance directly.

Then do one thing: find the last decision your board took that had a reputational edge – a gift, a statement, a partner, a complaint – and check that the record shows not only what was decided but what the trustees weighed. If it does not, agree at the next meeting where that reasoning will be kept in future.