Complaints procedure for a charity

Which rules require a complaints procedure

Every charity that fundraises. The Code of Fundraising Practice, which the Fundraising Regulator enforces and which applies to all charitable institutions fundraising in England, Wales and Northern Ireland, puts the duty on the governing body. Standard 2.3.1: “You must have a clear and publicly available fundraising complaints procedure which fundraisers can explain to existing or potential donors. If your fundraising partners do not have a suitable clear and publicly available complaints procedure of their own, they must agree to follow yours.” Standard 2.3.2 sets what happens when one arrives: “When you or a fundraising partner receives complaints about your fundraising, you must: investigate thoroughly and fairly; respond fairly and in a way that is appropriate to the complaint; avoid unnecessary delays; and regularly review complaints and use any relevant learning to make improvements to future fundraising.” Standard 2.3.3 adds a second, internal procedure: “a clear, published procedure explaining how staff and volunteers can report any concerns they have about your fundraising practice”, covering “the type of issues that can be raised and the process for doing so; how the person raising a concern will be protected from victimisation and harassment; what you will do when you receive a concern; and how to report concerns to us … if it is not possible to consider or deal with them appropriately within your charitable institution.”

A charity that provides regulated care. Regulation 16 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 applies to every provider registered with CQC, charitable or not. In full: “Any complaint received must be investigated and necessary and proportionate action must be taken in response to any failure identified by the complaint or investigation. The registered person must establish and operate effectively an accessible system for identifying, receiving, recording, handling and responding to complaints by service users and other persons in relation to the carrying on of the regulated activity. The registered person must provide to the Commission, when requested to do so and by no later than 28 days beginning on the day after receipt of the request, a summary of complaints made under such complaints system, responses made by the registered person to such complaints and any further correspondence with the complainants in relation to such complaints, and any other relevant information in relation to such complaints as the Commission may request.” CQC’s guidance notes that it “can prosecute providers for a breach of the part of this regulation that relates to the provision of information to CQC about a complaint within 28 days”, and “can move directly to prosecution without first serving a Warning Notice”.

A charity that runs an independent school. Paragraph 33 of the Education (Independent School Standards) Regulations 2014 is the most detailed complaints rule any charity is likely to meet, and many independent schools are charities. The standard “is met if the proprietor ensures that a complaints procedure is drawn up and effectively implemented which deals with the handling of complaints from parents of pupils”, and then lists eleven things the procedure must do, from being “in writing” and “made available to parents of pupils” to “a written record … of all complaints”. They are set out in the next two sections because they are the best published template of what a complete procedure looks like.

Every other charity. The Charity Commission’s public page Complain about a charity tells members of the public to “Complain to the charity directly unless you suspect illegal activity”, and only “If you are not happy with how the charity deals with your complaint” to “contact the relevant regulator”. That sentence assumes a procedure exists. The Commission takes “serious complaints” itself where a charity is “not doing what it claims to do”, “losing lots of money”, “harming people”, “being used for personal profit or gain” or “involved in illegal activity”; fundraising complaints go to the Fundraising Regulator and advertising complaints to the Advertising Standards Authority. A charity without a procedure has no first stage for the public to use, and no record when the regulator asks what it did.

What the procedure has to contain

A complaints policy and procedure starts by saying what a complaint is. None of the three regimes defines the word, and the working definition most published procedures use is an expression of dissatisfaction, spoken or written, about the standard of service, an action or a lack of action by the charity or the people acting for it, which the complainant wants investigated and, where it is justified, put right. It is worth writing that down, because it separates a complaint from a grievance (a member of staff about their own employment, which has its own procedure), from a concern raised under the whistleblowing or safeguarding policy, and from a request for information, each of which has a different route and a different record. It should also say who deals with complaints at each stage: in the first instance the person the complaint is made to or their manager, then a named senior person or the senior management team, then a trustee or panel, so that the board of trustees is not the first stage and not absent from the last.

Read together, the three regimes then describe the same document. Using paragraph 33’s list as the spine, with the Code and Regulation 16 where they add something, a complaints procedure:

1. is in writing and is published. Paragraph 33(a) and (b): “in writing” and “made available to parents of pupils”. The Code: “clear and publicly available”. Regulation 16 guidance: “Information and guidance about how to complain must be available and accessible to everyone who uses the service … in appropriate languages and formats to meet the needs of the people using the service.”
2. can be started by anyone, in any form, with anyone. CQC: “People must be able to make a complaint to any member of staff, either verbally or in writing. All staff must know how to respond when they receive a complaint.” Paragraph 33(d) “allows for a complaint to be made and considered initially on an informal basis”.
3. has a formal written stage when the informal one fails: paragraph 33(e), “where the parent is not satisfied with the response … establishes a formal procedure for the complaint to be made in writing”.
4. sets clear time scales (paragraph 33(c): “clear time scales for the management of a complaint”; the Code: “avoid unnecessary delays”; CQC: “investigated without delay”).
5. acknowledges every complaint that is not anonymous (CQC: “all complaints should be acknowledged whether they are written or verbal”), and still follows the process “as far as possible” when the complainant will not give a name.
6. protects the complainant. CQC: “Complainants must not be discriminated against or victimised. In particular, people’s care and treatment must not be affected if they make a complaint, or if somebody complains on their behalf.” The Code’s staff-concerns procedure must say “how the person raising a concern will be protected from victimisation and harassment”.
7. has an independent review stage. Paragraph 33(f) and (g): a hearing “before a panel appointed by or on behalf of the proprietor and consisting of at least three people who were not directly involved in the matters detailed in the complaint”, of whom “one panel member is independent of the management and running of the school”; the complainant may “attend and be accompanied”. CQC: providers “that do not have independent review stages should regularly review their complaints resolution processes to ensure they are not disadvantaging complainants”.
8. tells the complainant where to go next. CQC: “Information must be available to a complainant about how to take action if they are not satisfied … and should explain when complaints should/will be escalated to other appropriate bodies.” The Code’s staff procedure must say “how to report concerns to us”.
9. records every complaint and what was done, which is the next section.
10. is reviewed for what it teaches. The Code: “regularly review complaints and use any relevant learning”. CQC: “Providers should monitor complaints over time, looking for trends and areas of risk that may be addressed. This includes considering whether the process needs to be revised, including adding an independent review stage if it is not part of the existing process.”

Two more things belong in the document because regulators ask about them. A promise of courtesy and respect both ways, with a separate, published policy for the rare complainant who behaves unreasonably or persistently, so that the charity can limit contact without being accused of refusing to deal with complaints. And a plain statement of what happens if the complainant remains dissatisfied at the end: who they can ask to review the decision, whether they wish to appeal to a panel, and which external body takes the complaint next. A charity that is neither a care provider nor a school is bound by none of the numbered detail and by all of its logic. The regulators that will read the procedure after something has gone wrong are testing the same things: could the person complain easily, was it looked into properly and promptly, was it recorded, did the trustees learn from it, and was it escalated when it should have been.

The record of a complaint

The record is where the three regimes are most alike, and it is the part most charities’ procedures leave to chance. Paragraph 33(j) requires the procedure to provide “for a written record to be kept of all complaints that are made in accordance with sub-paragraph (e)” (the formal stage) “and (i) whether they are resolved following a formal procedure, or proceed to a panel hearing; and (ii) action taken by the school as a result of those complaints (regardless of whether they are upheld)”. Paragraph 33(i) requires the panel’s “findings and recommendations” to be given to “the complainant and, where relevant, the person complained about”, and kept “available for inspection on the school premises by the proprietor and the head teacher”. Paragraph 33(k) settles confidentiality: “correspondence, statements and records relating to individual complaints are to be kept confidential except where the Secretary of State or a body conducting an inspection … requests access to them.”

Regulation 16 puts “recording” in the definition of the system itself, and then defines the record by what CQC can demand: within 28 days of a request, “a summary of complaints made under such complaints system, responses made by the registered person to such complaints and any further correspondence with the complainants”. A provider that cannot produce that summary is in breach of the one limb of the regulation CQC prosecutes directly. The Code does not prescribe a record, but a governing body cannot “regularly review complaints and use any relevant learning” without one, and the Fundraising Regulator’s investigations turn on what the charity can show it did.

What every complaint record therefore needs, whichever regime applies:

• the date the complaint was received, by whom, and in what form (in person, by phone, in writing, by message), with the complainant’s details unless anonymous;
• what was complained of, in the complainant’s own words where they were written;
• each stage it passed through, with dates: acknowledgement, informal resolution, formal written complaint, investigation, response, review or panel, and any external referral;
• the outcome at each stage, whether it was upheld, and the findings and recommendations of any panel;
• “action taken … as a result” of the complaint, recorded whether or not it was upheld, because the learning is the point;
• every piece of correspondence with the complainant, filed with the complaint, since the regulator can ask for it in terms;
• who has seen the file, given the confidentiality rule.

The record is personal data, and the complaint file is the place where data protection and complaints handling meet. The details of the complaint, the details of the person complained about and the result of the complaint are all personal data under UK GDPR; the complainant can ask for their file through a subject access request and so can the person complained about, which is one reason the record should contain findings and not opinions. The retention period should be stated in the procedure and applied, with the file kept for as long as the complaint could still be reopened, escalated or relied on and no longer, and the confidentiality rule in paragraph 33(k) is the model for every regime: the file is closed to everyone except those handling the complaint, the complainant and the regulator or inspector who asks.

Two records sit alongside it. The complaints log, one line per complaint with the date received and the result, is what the trustees review at least annually and what a regulator asks for first, and it should exist for the informal complaints too, even where the rule only requires the formal ones to be recorded, because the pattern is in the informal ones. And the complaint that turns out to be a safeguarding concern or a serious incident generates a second record under a different procedure, cross-referenced from the first.

When a complaint is a serious incident

Some complaints are not complaints. The Charity Commission’s guidance How to report a serious incident in your charity defines a serious incident as “an adverse event, whether actual or alleged, which results in or risks significant: harm to your charity’s beneficiaries, staff, volunteers or others who come into contact with your charity through its work; loss of your charity’s money or assets; damage to your charity’s property; harm to your charity’s work or reputation”, where “significant” means “significant in the context of your charity, taking account of its staff, operations, finances and/or reputation”. The examples the guidance lists include “safeguarding incidents – incidents that have resulted in or risk significant harm to beneficiaries and other people who come into contact with the charity through its work”, “financial crimes – fraud, theft, cyber-crime and money laundering”, “other significant financial loss”, and “significant data breaches/losses”. A complaint that a volunteer behaved inappropriately towards a beneficiary, that a fundraiser took cash that never arrived, or that a mailing exposed donors’ details, is a serious incident wearing a complaint form.

The duty is the trustees’: “The responsibility for reporting serious incidents rests with the charity’s trustees. In practice, this may be delegated to someone else within the charity … However, all trustees bear ultimate responsibility for ensuring their charity makes a report, and does so in a timely manner.” The report goes “as soon as is reasonably possible after it happens, or immediately after your charity becomes aware of it”, which for a complaint means the day it is recognised for what it is, not the end of the investigation. And the decision not to report is itself a decision that must be defensible: “If you decide not to make a report about something serious that has happened in your charity and the Commission later becomes involved, you will need to be able to explain why you decided not to report it at the time.”

The procedure therefore needs a trigger, and the record needs to show it fired. At the point a complaint is logged, someone with authority asks whether it alleges significant harm, loss or damage; if it does, the safeguarding or incident procedure starts in parallel, the trustees are told, the serious incident report is made and its reference is recorded on the complaint. The guidance draws one more line the procedure should respect: staff who suspect wrongdoing are whistleblowers, not complainants, and “should usually raise this with your employers first, following the charity’s whistleblowing policy if it has one”, with a route to the Commission if the charity fails to act. A complaints procedure that funnels staff concerns through the customer complaints route loses both the protection and the record the whistleblowing route provides.

Timescales, escalation and the regulators

None of the three regimes sets a number of days for a charity’s own procedure; each sets a standard the number has to meet. Paragraph 33(c) requires “clear time scales”, the Code requires the charity to “avoid unnecessary delays”, and CQC requires “effective systems to make sure that all complaints are investigated without delay”, including “undertaking a review to establish the level of investigation and immediate action required, including referral to appropriate authorities for investigation”, and, where the complainant is identified, “investigating and responding to them and where relevant their family and carers without delay”. A published procedure that names its own periods for acknowledgement, for a response at the informal stage, for a formal response and for a review, and then keeps to them, satisfies all three; one that says “as soon as possible” satisfies none. Published procedures state their periods in working days, typically an acknowledgement within a few working days of receipt and a full written response within a stated number of working days, with a rule for what happens when the investigation of the complaint needs longer: the complainant is told why, and given a new date. Whatever the number, it should be one the charity can meet with the people it actually has; a missed timescale in a published procedure is itself something to complain about.

The external routes the procedure has to name depend on what the charity does:

• fundraising complaints go to the Fundraising Regulator, which the Commission’s page directs the public to for “the way you’ve been asked for donations” and “how fundraisers have behaved”, and which can also hear complaints made “on behalf of someone else”;
• advertising complaints, including “the amount of emails or mail you get from a charity”, go to the Advertising Standards Authority, and the public can change their contact preferences through the Fundraising Preference Service;
• complaints about regulated care can be escalated externally when the complainant is “dissatisfied with the local outcome”, and CQC expects the provider to “cooperate with any independent review or process”;
• complaints about an independent school that the panel stage has not resolved can go to the Department for Education, which is why paragraph 33(k) reserves access to the confidential file for “the Secretary of State or a body conducting an inspection”;
• the Charity Commission itself takes the serious cases listed in the first section, and receives serious incident reports from the trustees about the same events from the other side.

The procedure should say which of these apply to the charity, in plain words, at the point where the internal stages end. Regulators notice a procedure that stops at “the decision of the trustees is final”.

One route the procedure should not offer is the Commission as an appeal body for ordinary service complaints. The Commission’s own complaints procedure, which governs complaints about the Commission itself, says so in terms: “The Commission is not a complaints service. It is not our role to resolve complaints about a charity’s standard of service in an individual case.” That document is also a useful model of the shape regulators expect of everyone else. It defines a complaint as “Any spoken or written dissatisfaction about the standard of service received during engagement with the Commission or our wider regulatory work that has not been resolved by staff when an issue has been highlighted”, asks for complaints “no later than three months after the date of the incident”, takes them through an online form, commits to “acknowledge your complaint and aim to reply in full, within 30 working days but if the problem is complex and we need more time we will let you know”, promises to “put things right as quickly as we can”, offers a review by a named manager “within one month”, and ends with an external route: “If you remain unhappy after this, you can ask your MP to take up your complaint with the Parliamentary and Health Service Ombudsman (PHSO).” A charity’s procedure needs the same five parts, with its own names and numbers.

The complaint that arrives as a message

Every rule above describes a complaint that enters a procedure. Most complaints do not start there. The first raising of a concern is a parent at the shop counter, a resident’s daughter catching a care worker in the corridor, a donor replying to a fundraiser’s text, a volunteer telling the coordinator in a group chat that a service user was upset by something a colleague said. CQC’s guidance is explicit that a complaint “to any member of staff, either verbally or in writing” is a complaint; the Code’s staff-concerns procedure exists because concerns arrive sideways; paragraph 33 begins with the informal stage because that is where complaints begin. The record is supposed to start at that moment, with the date and the words.

Almost none of it is anywhere the charity controls. The text to the fundraiser is on the fundraiser’s phone. The volunteer’s message is in a group the charity does not run, under retention the volunteer has set, and it leaves when they do. When the complaint reaches the formal stage, or the regulator, or the panel, the file begins with the form that was filled in afterwards, and the question that decides most complaints, what was said first and how quickly anyone acted, is answered from memory and a search of a personal handset for a conversation that may already be gone. Regulation 16’s 28-day summary and paragraph 33’s written record are only as complete as the day the complaint was first received.

The fix is not to tell staff and volunteers to stop being the person a complaint is made to; that is the informal stage working as designed, and a policy that forbids it moves the conversation, not the complaint. It is to give those first conversations a channel the charity owns, so that the message in which the concern was raised is in the record with its time, the reply that acknowledged it is next to it, and the complaint form can point at both. Two limits, stated plainly and including for products like ours: nothing lawful can read a member of staff’s personal phone or recover conversations that have already happened, and no messaging channel is a complaints procedure; the complaint still has to be logged, investigated, answered and reviewed by the people responsible for it.

A question for the next trustees’ meeting: take the last complaint the charity closed. Can the charity show the first hour of it, from a record the charity holds?

Official guidance and your next step

The primary sources are the Fundraising Regulator’s Code of Fundraising Practice, in particular standard 2.3, Complaints and concerns about fundraising, and its complaints service; CQC’s guidance on Regulation 16: Receiving and acting on complaints, which sets out the regulation in full and the guidance providers “must have regard to”; paragraph 33 of the Schedule to the Education (Independent School Standards) Regulations 2014; and the Charity Commission’s Complain about a charity and How to report a serious incident in your charity. Maintained schools and academies have a separate statutory complaints regime under the Education Act 2002 and Department for Education guidance, which this guide does not cover.

This guide is a summary of published regulation and guidance for England and Wales, not a substitute for them and not legal advice. Scotland and Northern Ireland have their own charity regulators and fundraising arrangements. Where a complaint concerns a specific person or an allegation of harm, follow your safeguarding procedure first and take advice.

Then do one thing: open the complaints log and the last three closed complaints. For each, write down the date the concern was first raised, by what route, and where the record of that first contact is.