Charity risk management policy: what it says and who does what

Does a charity need a risk management policy? The duty and CC26's model

No statute requires a charity in England and Wales to adopt a document called a risk management policy, but every trustee carries the duty the policy is there to meet. The Charity Commission's The essential trustee (CC3) tells trustees to “avoid exposing the charity’s assets, beneficiaries or reputation to undue risk”, and adds: “You have a duty to avoid exposing your charity to undue risk. This doesn’t mean being risk averse.”

CC26, updated on 16 September 2026, sets out how to meet that duty. It opens: “Charity trustees should regularly review and assess the risks faced by their charity in all areas of its work and plan for the management of those risks.” Its model has five stages: establishing a risk policy, identifying risks, assessing risks, evaluating what action needs to be taken on risks, and periodic monitoring and assessment. CC3 lists the same steps, and the first is “Establish a risk policy.”

CC26 uses “must” only “where there is a specific legal or regulatory requirement”, and “should” for “minimum good practice guidance you should follow unless there’s a good reason not to.” The policy itself is a should. CC26 says “there is no requirement or obligation for trustees to adopt any particular model”, but that “having a rigorous process and a clear risk management policy helps ensure that” risk is linked to the charity's objectives, that “all areas of risk are covered”, that the risk profile reflects the trustees' view of what is acceptable, and that the principal results are reviewed and considered.

Stage 1 of the model explains why the policy comes first: “The implementation of an effective risk management policy is a key part of ensuring that a charity is fit for purpose.” The policy is where the trustees decide the levels of risk they are willing to accept, and CC26 says “Trustees need to let their managers know the boundaries and limits set by their risk policies to make sure there is a clear understanding of the risks that can and cannot be accepted.” Elsewhere it suggests trustees “may wish to establish a risk framework to help them make decisions about the levels of risk that can be accepted on a day to day basis and what matters need to be referred to them for decision.” That framework, written down and approved, is the risk management policy.

The 2025 Charity Governance Code treats the policy and the register as two documents. Under Principle 6, Managing resources and risks, it lists “A risk management framework” and “A board-approved risk register” as separate items of suggested evidence, and says “The board ensures control and risk management frameworks are effective, and reviews them regularly.” The Code is voluntary: “Compliance with the Code is not a regulatory requirement.” Funders and auditors may still ask to see both.

CC26, CC3 and the 2008 accounts regulations apply to charities in England and Wales. Charities in Scotland and Northern Ireland answer to OSCR and the Charity Commission for Northern Ireland; the SORP described in section 05 is UK-wide.

What a charity risk management policy should include

CC26 gives no list of headings for the policy. The ten below are our suggestion, built from what CC26 and the Code ask a policy to do; a small charity with no staff can cover them in two pages, and a larger one will say more under each.

1. Purpose and scope. Why the charity manages risk, in its own words, and what the policy covers: every activity, every site, and any trading subsidiary, branch or joint venture, which CC26 says the risk identification process is “also likely to include”.
2. The board's responsibility. A plain statement that the trustees as a body are responsible for risk management and cannot hand that responsibility on, though they can delegate the work.
3. Roles and delegation. What the board keeps, what any audit, finance or risk committee does, the chair's role between meetings, the chief executive's or lead volunteer's, the named owners of individual risks, and what is expected of staff and volunteers (section 03).
4. The method, in brief. How risks are identified, assessed and recorded, with a pointer to the register, its scoring and its owner. Keep the detail in the register; the risk register guide covers the columns, likelihood and impact.
5. Risk appetite. Where the board's appetite is set out, who may accept a risk at each level, and what happens when a decision would go outside it. The wording of the appetite itself belongs in a separate statement: see the charity risk appetite statement.
6. Escalation. What must be reported upwards between meetings, to whom, how fast and how it is recorded.
7. Reporting to the board. What the board receives, how often, and who prepares it.
8. Related policies and plans. The reserves policy, the safeguarding policy, the business continuity plan, serious incident reporting, whistleblowing, financial controls and investment, each of which manages a set of risks the register names.
9. The annual report statement. Who drafts the risk statement or principal risks description, and when the board approves it (section 05).
10. Review and approval. The date the board approved this version, its version number, who owns the policy and when it is next reviewed.

Write the policy in the charity's own words. A policy copied from a much larger organisation will name committees and reports that do not exist, and the first time an auditor or funder asks how it works in practice the gap shows.

Who does what, and how a new risk reaches the board

CC26 is clear about where responsibility sits: “The responsibility for the management and control of a charity rests with the trustee body and therefore their involvement in the key aspects of the risk management process is essential, particularly in setting the parameters of the process and reviewing and considering the results.” It is equally clear that the trustees do not do every part themselves: “In all but the smallest charities, the trustees are likely to delegate elements of the risk management process to staff or professional advisers. The trustees should review and consider the key aspects of the process and results.” The test it gives is practical: trustees should be involved enough to make the annual report statement “with reasonable confidence”.

The policy then sets out the roles that fit the charity:

• The board approves the policy, the appetite and the register, reviews the results, takes the decisions that go beyond what it has delegated and approves the annual report statement. The Code puts it as “The board identifies the risks to achieving the charity's aims and agrees how to navigate them. The board seeks assurance that risks are properly managed.”
• A committee, where the charity has one, looks at the register in more detail than the full board can and reports to it. The policy says what the committee may decide and what it only recommends; the board stays responsible.
• The chair is usually the first trustee to hear of a risk between meetings. The policy says what the chair may decide alone, what needs other trustees and what needs a meeting, within whatever the governing document allows; trustee decisions between meetings covers the routes.
• The chief executive, or in a charity with no staff the trustee who leads on risk, runs the process day to day, keeps the register and prepares what the board sees.
• Risk owners are the named people who run the controls on each risk and report on them.
• Staff and volunteers are where most risks are first seen. CC26 says “All staff and volunteers will need to understand the part they should play in risk management”, and that “Staff will need to take responsibility for implementation.”

Identification works from the ground up. CC26 says “the identification of risks is best done by involving those with a detailed knowledge of the way the charity operates”, and that trustees “will need to consult widely with key managers and staff, as ideas are likely to come from all levels of the organisation.” A policy that only lets risks onto the register at a board meeting misses most of them.

Escalation is the part of the policy most often left vague. The Code's Principle 5 asks for “clear expectations on when and how matters should be escalated if a threshold for board involvement is met”, and CC26's monitoring stage asks that “new risks are properly reported and evaluated” and that “any significant failures of control systems are properly reported and actioned”. So the policy names the triggers (a new risk above a set rating, a risk moving outside appetite, a control failure, a possible serious incident), the person each goes to, the time allowed and where the report is recorded. Some of those events have their own rules: a serious incident may need reporting to the Charity Commission, and a member of staff who cannot raise a concern through their manager needs the route in the whistleblowing policy.

The review cycle: how often, and what the board sees

CC26 calls risk management “a dynamic process ensuring that new risks are addressed as they arise”, and says it “should also be cyclical to establish how previously identified risks may have changed.” On frequency it says: “Annual monitoring by trustees supplemented by interim reports is likely to be sufficient for most charities where operating conditions are stable. Depending on a charity’s risk profile, more frequent monitoring might be advisable.” The Code asks that “Major and emerging risks are reviewed regularly, and there is a robust control framework”.

CC26's list of what a successful process ensures is a good checklist for the policy's monitoring section:

• “new risks are properly reported and evaluated”
• “risk aspects of significant new projects are considered as part of project appraisals”
• “any significant failures of control systems are properly reported and actioned”
• “there is an adequate level of understanding of individual responsibilities for both implementation and monitoring of the control systems”
• “any further actions required are identified”
• “trustees consider and review the annual process”
• “trustees are provided with relevant and timely interim reports”

A workable board year, for a charity whose board meets four to six times, looks like this (our suggestion, not a rule):

• Every board meeting: risk as a standing item, with the few highest risks, what has changed since the last meeting, anything escalated in between and any decision taken outside appetite.
• Every new project or contract of any size: the paper that asks for approval includes its risks, so the board decides with them in front of it.
• Once a year: a full review of the register, the appetite statement and the policy, timed before the board approves the trustees' annual report, so the statement describes a review that actually happened.
• After a trigger: a serious incident, the loss of a major funder, a fall in reserves, a new strategy, a merger or a change in the law or in a funder's terms prompts a review of the risks affected and, if needed, of the policy. The business continuity plan covers what happens if the worst of them arrives.

Minute each review: which risks changed and why, which were added or closed, what the board decided and who will act. The minutes are the evidence that the policy was followed; a later auditor, insurer or the Commission can only see the review the minutes record. Keep each approved version of the policy with its date, so the charity can show which version applied when a decision was taken.

Reporting: which charities must describe their risks in 2026

By law, a charity whose accounts must be audited has to include a risk statement in its trustees' annual report. Regulation 40 of the Charities (Accounts and Reports) Regulations 2008 requires “a statement as to whether the charity trustees have given consideration to the major risks to which the charity is exposed and satisfied themselves that systems or procedures are established in order to manage those risks”; a parent charity preparing group accounts has a parallel provision. The duty applies to an “auditable charity”, defined in regulation 2 as one whose accounts “are required to be audited in pursuance of any statutory requirement”.

Fewer charities are now auditable. For financial years ending on or after 30 September 2026, section 144 of the Charities Act 2011, as amended by S.I. 2026/427, requires an audit where gross income exceeds £1.5 million, or exceeds the accounts threshold (£500,000) with assets over £5 million; the Commission's threshold changes at a glance sets the old and new figures side by side, and our charity audit threshold guide explains which year each applies to. A charity with income between £1 million and £1.5 million and assets of £5 million or less is therefore no longer required by statute to be audited, and the regulation 40 duty falls away. The same happens to some smaller charities with large assets, because the asset test has moved from £3.26 million to £5 million. On regulation 2's wording, an audit the charity chooses, or one its governing document or a funder asks for, is not one required “in pursuance of any statutory requirement”, and CC26 ties the statement to charities “under a legal requirement to have their accounts audited”.

It does not drop out of risk reporting. Charities SORP 2026 (FRS 102), which applies to reporting periods beginning on or after 1 January 2026, sorts charities into tiers: tier 1 is accruals accounts with gross income “of not more than £500,000”, tier 2 is above that up to £15 million, and tier 3 is above £15 million. Paragraph 1.43 requires tier 2 and tier 3 charities to give “a description of the principal risks, including any risks arising from environmental issues, cyber and uncertainties facing the charity and its subsidiary undertakings, as identified by the charity trustees, together with a summary of their plans and strategies for managing those risks”. The Commission's threshold table says that, for financial years ending on or after 30 September 2026, charities with income over £500,000 must prepare accruals accounts, so in a year reported under SORP 2026 a charity with income of £1.2 million that no longer needs an audit still has to describe its principal risks and how it manages them.

Below £500,000 the statement is encouraged rather than required. CC26 says trustees of smaller charities “are encouraged to make a risk management statement as a matter of good practice”, and paragraph 1.13 of the SORP says “tier 1 charities are encouraged to include some or all of the additional information required of tier 2 and tier 3 charities”. A year that began before 1 January 2026 is still reported under the previous SORP, though early adoption of SORP 2026 is permitted; for such a year, check that SORP's requirements with your independent examiner or auditor.

Charitable companies have one more rule. A company not entitled to the small companies exemption must prepare a strategic report (section 414A of the Companies Act 2006), and section 414C says it must contain “a description of the principal risks and uncertainties facing the company”. For financial years beginning on or after 6 April 2025, section 382 treats a company as small if it meets two or more of: turnover not more than £15 million, balance sheet total not more than £7.5 million, and not more than 50 employees. A change of size counts only if it happens in two consecutive financial years, and some companies are excluded from the small companies regime whatever their size. CC26's footnote on small companies still gives older, superseded limits, so take the figures from the Act, not from CC26.

On what the statement says, CC26 is not seeking “‘template’ reporting”, and a narrative that addresses the key aspects is acceptable. Its four points are:

• “an acknowledgement of the trustees’ responsibility”
• “an overview of the risk identification process”
• “an indication that major risks identified have been reviewed or assessed”
• “confirmation that control systems have been established to manage those risks”

The policy, the register and the minutes of the annual review are what let trustees sign those four points honestly. CC26 adds that “there is no requirement for the statement to be audited unless other requirements outside the Charities Act 2011 or the Companies Act 2006 apply”, though an auditor who becomes aware of an apparent misstatement or inconsistency in the annual report will seek to resolve it. The rest of the report is in the trustees' annual report guide.

In Scotland, charities report under OSCR's annual reporting rules, and in Northern Ireland under the Charity Commission for Northern Ireland's annual reporting requirements; regulation 40 and the section 144 thresholds are the law of England and Wales.

Where ComplyChat fits, and where it does not

Start with what it is not. ComplyChat is not risk management software: it keeps no risk register, does not score risks, set an appetite or write the policy, and it is not an incident log or a way of reporting a serious incident to the Charity Commission. ComplyChat is working towards Cyber Essentials and ISO 27001 certification and holds neither yet; our Why us page says so. If new risks in your charity already reach the right person through a route everyone uses and that leaves a record, you do not need it for this.

Where it can fit is the escalation route the policy describes. The policy says a new risk goes to the chief executive and, above a threshold, to the chair. In practice the first report is usually a phone call or a message: the youth worker who texts her manager after a near miss on a minibus trip, the finance officer who tells the chief executive the grant letter has not arrived, the manager who messages the chair on a Sunday that a funder is pulling out. CC26 asks that “new risks are properly reported and evaluated”. When the report sits on two personal phones, the charity cannot later show when it knew, or whom it told.

ComplyChat is designed to keep those conversations in channels the charity runs. A mobile number verified by SMS is an identity, so volunteers and trustees with no charity email account can take part from their own phones. Everyone added to a channel is told it is on the record and can object or leave, and messages are recorded on the server as they are sent, not gathered from handsets afterwards. On paid plans, once the charity's Microsoft 365 tenant is connected, conversations are kept under the retention schedules within its own Microsoft 365 subscription. Free is for personal conversations, with three calendar months of recent history and no Microsoft 365 archive, so it is not a way to keep the charity's record.

Whatever you use, take one question to the next board meeting: of the risks escalated between meetings this year, which can you show were reported, to whom, and when?

Questions people ask

Does a charity need a risk management policy?

No law requires a document with that name, but trustees have a duty to avoid exposing the charity to undue risk (CC3), and the Charity Commission's risk management model in CC26 starts with establishing a risk policy. CC26 says a rigorous process and a clear risk management policy help make sure risk is linked to the charity's objectives and all areas of risk are covered.

What should a charity risk management policy include?

CC26 says the trustees decide the levels of risk they are willing to accept and that managers need to know “the boundaries and limits set by their risk policies”. CC26 gives no list of headings; our suggestion is purpose and scope, the board's responsibility, roles and delegation, the method, risk appetite, escalation, reporting to the board, related policies, the annual report statement, and review and approval.

Who is responsible for risk management in a charity?

The trustee body. CC26 says responsibility for the management and control of a charity “rests with the trustee body”; in all but the smallest charities trustees are likely to delegate parts of the process to staff or professional advisers, but they should review and consider the key aspects and the results.

Which charities must include a risk management statement in their annual report?

By law, charities whose accounts must be audited must say in the trustees' annual report whether the trustees have considered the major risks and are satisfied that systems or procedures are in place to manage them (regulation 40 of the 2008 Regulations). From 30 September 2026 that means gross income over £1.5 million, or over £500,000 with assets over £5 million. Under Charities SORP 2026, for reporting periods beginning on or after 1 January 2026, tier 2 and 3 charities (accruals accounts, gross income over £500,000) must also describe their principal risks and their plans for managing them (paragraph 1.43). Smaller charities are encouraged to make a statement (CC26).

How often should a charity review its risks?

CC26 says annual monitoring by trustees supplemented by interim reports “is likely to be sufficient for most charities where operating conditions are stable”, with more frequent monitoring depending on the charity's risk profile. The Charity Governance Code expects major and emerging risks to be reviewed regularly, and most boards keep risk as a standing item at every meeting.

What are the main types of risk a charity faces?

CC26 classifies risks as governance, operational, financial, external, and compliance with law and regulation, with examples of each, from conflicts of interest and beneficiary safety to inadequate reserves and poor public perception. The risk register guide shows how to record them, and the charity reputational risk guide covers one of the most common in more depth.

Official guidance and your next step

The Charity Commission's guidance is Charities and risk management (CC26), with its model, risk register template and annex of common risks, and The essential trustee (CC3), section 7; both were updated on 16 September 2026. The reporting rules are in regulation 40 of the Charities (Accounts and Reports) Regulations 2008, the audit threshold in section 144 of the Charities Act 2011, and the principal risks description in paragraph 1.43 of Charities SORP 2026; charitable companies also follow section 414C of the Companies Act 2006. The voluntary Charity Governance Code (2025) sets out good practice in Principles 5 and 6. Quotations are from the pages named as published on 2 and 3 November 2026.

This guide covers charities in England and Wales, with pointers for Scotland and Northern Ireland, and is not legal or accounting advice; your independent examiner or auditor can confirm which reporting rules apply to your year.

Then do one thing: find your current risk management policy and check three lines in it – the date the board last approved it, who a new risk goes to between meetings, and whether its reporting section still matches the 2026 thresholds. If any of the three is missing, that is where the next draft starts.