Charity risk appetite statement

What a risk appetite statement is, and where the idea comes from

A risk appetite statement is a short board document that says, area by area, how much risk the charity is willing to take to achieve its purposes, and who may accept what. No statute and no Charity Commission guidance requires a charity to have one, and CC26 never uses the words “risk appetite”. What CC26 does ask for is the substance. At the first stage of its risk management process it says charities “will have differing exposures to risk arising from their activities and will have different capacities to tolerate or absorb risk”, and that these considerations “will inform the trustees in their decision as to the levels of risk they are willing to accept”. It then says trustees “need to let their managers know the boundaries and limits set by their risk policies to make sure there is a clear understanding of the risks that can and cannot be accepted”.

CC26 gives two examples that show what an appetite decision looks like. A charity with sound reserves “could embark on a new project with a higher risk profile than, say, a charity facing financial difficulties”. And a relief charity operating in a war zone “may need to tolerate a higher level of risk to staff than might be acceptable in its UK-based activities in order to achieve its objectives”. CC26 uses “must” only where there is a legal or regulatory requirement and “should” for minimum good practice; in these passages it uses neither, which is why the honest summary is that the Commission expects trustees to set their appetite rather than requiring a document.

The term is borrowed from wider risk management practice. In UK central government, HM Treasury's Orange Book says the board should determine “the nature and extent of the principal risks … that the organisation is exposed to and is willing to take to achieve its objectives – its risk appetite – and ensure that planning and decision-making reflects this assessment”. Appetite therefore belongs in strategic planning as much as in the risk register. The Orange Book is written for government departments and arm's length public bodies, not for charities generally (the Academy Trust Handbook does point academy trusts to it), but its definition is the one many charity templates borrow.

The charity sector's own route is the Charity Governance Code (2025). Under Principle 5, “Decisions are made with regard to the charity's existing policies, financial resources and the board's appetite for risk”; under Principle 6, “Trustees have agreed tolerances of risk, including the use of reserves (where these exist) in line with the board's reserves policy”. The Code is voluntary: its publishers say “Compliance with the Code is not a regulatory requirement”, so it recommends a risk appetite rather than requiring one. Principle 6 also says “The board seeks assurance that risks are properly managed”, and lists a risk management framework and a board-approved risk register among its suggested evidence.

Do not confuse the appetite statement with the risk management statement in the trustees' annual report. That is a public sentence in the annual report, required by law only of charities whose accounts must be audited (section 05). The appetite statement is an internal board document, and no law says what it must contain.

What a charity risk appetite statement contains

Most useful statements fit on one or two pages and have four parts:

1. An overall position. One or two sentences on the charity's general attitude to risk in pursuit of its purposes: cautious with money and people, more open to trying new ways of reaching beneficiaries, or whatever the board actually believes.
2. A line for each risk category the board uses. CC26 groups charity risks into five: governance, operational, financial, external, and compliance with law and regulation. Many boards add safeguarding and reputation as lines of their own, because those are where their appetite is lowest and the consequences most public.
3. A measure where one exists. A sentence such as “low appetite for financial risk” tells a manager little. A reserves floor, a maximum loss the charity will accept on a new activity, a limit on income from any one funder or a band for investment volatility turns the sentence into something a decision can be tested against.
4. Who may accept what. CC26 says trustees may wish to establish a risk framework to help them decide “the levels of risk that can be accepted on a day to day basis and what matters need to be referred to them for decision”. The statement should say what staff may accept within the limits, what goes to the chair or a committee, and what only the full board decides.

Keep the statement separate from the risk register. The register lists individual risks, scores them and records the controls; the appetite statement is the yardstick the board holds those scores against.

How the board sets its risk appetite

Start from the factors CC26 points to – the charity's activities, its reserves and the balance between its higher and lower risk activities – add the others below, and write down the board's answers before writing any category lines:

• The purposes and the beneficiaries. A charity working with children or adults at risk will have a lower appetite in that area than one restoring a building; a relief charity, as CC26 says, may need to accept more risk to staff abroad than at home.
• The reserves position. CC26's own example: sound reserves allow a riskier project than financial difficulty does.
• Dependence on a few sources of funding, and how quickly the charity could recover from losing one.
• The governing document and any restrictions on funds, investments or activities, which may set limits the statement cannot widen.
• The charity's strategy. If the plan is to grow or try new services, the statement has to allow some risk in those areas or it will block the plan it is meant to serve.

Who drafts and who decides. The chief executive and senior team, the finance lead or an audit and risk committee usually drafts. The decision is the board's: CC26 says the management and control of a charity “rests with the trustee body” and that trustees' involvement is essential, “particularly in setting the parameters of the process and reviewing and considering the results”. A statement written by staff and noted without discussion is not the trustees' appetite.

Scales are optional. Many templates grade appetite on five levels: averse, minimal, cautious, open and eager. That scale was set out in the Government Finance Function's Risk Appetite Guidance Note (2021), which was deleted from the Orange Book collection on GOV.UK on 29 July 2026; the Orange Book collection page records that it and three other documents “were deleted as they were out of date”. The Orange Book's own text still lists the note among its supporting guides, so a board checking the Orange Book alone could think it is current. No charity regulator prescribes levels. A charity can use any scale its trustees understand, or plain sentences per category, which are often clearer.

Zero appetite is honest only for a few things. “No appetite” fits deliberate or avoidable harm to beneficiaries and knowingly breaking the law. Applied to every compliance risk it is not true, and CC26 itself accepts residual risk: it gives the public use of a village hall as a risk that has to be accepted “if the activity is to continue”. A statement that claims zero tolerance everywhere tells managers nothing about the risks they will in fact have to take.

Appetite and risk tolerance. The words are used loosely. A practical distinction many boards adopt is that appetite is the amount of risk the charity is willing to seek or accept in general, and tolerance is the measured limit beyond which a matter must be escalated: the reserves floor, the maximum loss, the funder share. The Code speaks of “agreed tolerances of risk”, and CC26 of a charity's capacity to “tolerate or absorb” it. Whichever words you use, define them once in the statement.

Using it: decisions, the risk register, reserves and investments

Testing a decision. The statement earns its place when a proposal arrives: a new contract, a property lease, a fundraising campaign, a partnership. CC26 lists “considering the risks attached to significant new activities or opportunities” among the ways trustees monitor risk, and asks that “risk aspects of significant new projects are considered as part of project appraisals”. A board paper can set out the potential impact of the proposal and carry one line for each relevant category: within appetite, outside appetite, or within it only on conditions. One of CC26's model register entries sets the escalation rule plainly: “new initiatives to be approved by trustees unless included in current business plan”.

The risk register. CC26 says trustees “need to form a view as to the acceptability of the net risk that remains after management”. Compare each net risk score on the register with the appetite for its category. Where the register scores likelihood and impact on five-point scales, some boards express each category's appetite as the highest net score they will accept, so that a comparison is a matter of reading two numbers. A net risk inside appetite is accepted and kept under review; one outside it needs more controls, a change of plan, or an explicit board decision to accept it for a stated reason and period. The scoring itself is covered in the risk register guide.

Reserves. The Code ties tolerances of risk to “the use of reserves (where these exist) in line with the board's reserves policy”, and CC26's financial risk annex says to “link reserves policy to business plans, activities and identified financial and operating risk”. The reserves target in the reserves policy and the financial lines of the appetite statement should give the same answer.

Investments. The Charity Commission's Investing charity money (CC14) asks trustees to “decide what level of risk you are willing to accept to achieve a particular level of return for your charity” and lists the charity's attitude to risk among the things trustees should think about, and which the investment policy may include. That attitude to risk is the investment line of the appetite statement; write it once and refer to it in both documents.

Academy trusts. The Academy Trust Handbook 2026, effective from 1 October 2026, says “the trust must maintain a risk register”, keeps overall responsibility for risk management with the board of trustees, and says the board must conduct a full review of the register at least annually. It does not mention risk appetite and does not require a statement. Its investment rules set one appetite for the trust in advance: exposure to investment products must be tightly controlled “so security of funds takes precedence over revenue maximisation”. An academy trust board that adopts an appetite statement has to keep it within the Handbook's requirements.

Adopting, recording and reviewing the statement

Adoption. Minute the board's decision to adopt the statement, with the main reasons for the levels chosen: the reserves position, the strategy, any category where trustees disagreed and how that was settled. Give the statement a version number and a date, and keep earlier versions; a later reviewer, auditor or the Commission may want to know what the appetite was when a decision was taken.

Review. CC26 says annual monitoring by trustees, supplemented by interim reports, “is likely to be sufficient for most charities where operating conditions are stable”, and that more frequent monitoring might be advisable depending on the charity's risk profile. It also calls risk management “a dynamic process ensuring that new risks are addressed as they arise”. The statement should be reviewed at least annually, and again after anything that changes the inputs: a serious incident, the loss of a major funder, a fall in reserves, a new strategy or a merger.

Decisions outside appetite. When the board, or the chair under delegated authority, accepts a risk outside the statement, record what was accepted, why, for how long and what will bring it back within appetite. CC26 asks that “any significant failures of control systems are properly reported and actioned”; a decision to go outside appetite deserves the same trail.

The annual report. A charity whose accounts must be audited has to include in its trustees' annual report, under regulation 40 of the Charities (Accounts and Reports) Regulations 2008 (regulation 41 for a parent charity that prepares group accounts), “a statement as to whether the charity trustees have given consideration to the major risks to which the charity is exposed and satisfied themselves that systems or procedures are established in order to manage those risks”. Under the Charity Commission's threshold changes at a glance, for financial years ending on or after 30 September 2026 an audit is required where income is over £1.5 million, or over £500,000 with assets over £5 million. The wording of regulation 40 has not changed, but its reach has: a charity that no longer needs an audit loses the legal duty and keeps the statement only as good practice, which CC26 encourages for smaller charities.

Charitable companies that are not small must also describe “the principal risks and uncertainties facing the company” in a strategic report, under section 414C of the Companies Act 2006. Neither report has to publish the appetite statement itself, but a board that has one can describe its approach to risk with more confidence.

Where appetite is really tested: between meetings

The statement is agreed in a meeting. It is tested between meetings, usually by message. The treasurer agrees in the trustees' group chat that the summer event can go ahead although the costs have doubled. The chief executive messages the chair late on a Thursday: the new contract has a penalty clause, can she sign tomorrow? After a safeguarding incident at the youth project, three trustees agree by text to carry on with the evening sessions while the review runs.

Each of those is a decision about risk, and some are decisions outside appetite. They are exactly what an auditor, an insurer or the Charity Commission asks about later: who agreed, on what information, and whether the board knew. If they sit on trustees' personal phones, in a group whose membership nobody has checked since the last AGM, the charity cannot demonstrate that its appetite statement was applied, and the next board meeting cannot record the decision properly because nobody has the exchange in front of them.

ComplyChat is designed to keep those conversations on the charity's own record. Trustees, staff and volunteers talk in channels the charity controls; a mobile number verified by SMS is an identity, so a trustee with no charity email can take part from their own phone; everyone added is told the channel is on the record and can object or leave; and messages are recorded on the server as they are sent. On paid plans, once the charity's Microsoft 365 tenant is connected, conversations are kept under the retention schedules within its own Microsoft 365 subscription. ComplyChat is not a risk management system: it does not hold the register, score risks or write the appetite statement, and urgent decisions still need the route your governing document allows.

A question for the next trustees' meeting: of the decisions taken since the last meeting that went near the limits in your statement, where is the record of each one, and would the board be able to find it?

Questions people ask

What is risk appetite in simple words?

Risk appetite is the amount and kind of risk an organisation is willing to take to achieve its objectives. HM Treasury's Orange Book defines it as the nature and extent of the principal risks an organisation “is willing to take to achieve its objectives”; for a charity, CC26 puts the same idea as the “levels of risk they are willing to accept”, decided by the trustees.

Does a charity need a risk appetite statement?

No law requires a charity in England and Wales to have a written risk appetite statement. CC26 expects trustees to decide the levels of risk they are willing to accept and to tell managers the boundaries and limits set by their risk policies, and the 2025 Charity Governance Code expects decisions to be made with regard to “the board's appetite for risk”. The Code is voluntary, so a written statement is good practice rather than a requirement.

What are some examples of risk appetite statements?

Illustrative lines read: “We have no appetite for avoidable risk of harm to children or adults at risk” or “A new activity may put at risk up to £10,000 of designated funds without a further board decision.” CC26 gives the reasoning such lines record: a charity with sound reserves could take on a riskier project than one in financial difficulty. The illustrative statement in section 02 shows a complete set for a small charity.

What is an example of a risk statement?

In a charity's annual report, the risk statement is the trustees' confirmation that they “have given consideration to the major risks to which the charity is exposed and satisfied themselves that systems or procedures are established in order to manage those risks”. Regulation 40 of the Charities (Accounts and Reports) Regulations 2008 (regulation 41 for a parent charity that prepares group accounts) requires it of charities whose accounts must be audited, which for years ending on or after 30 September 2026 means income over £1.5 million, or over £500,000 with assets over £5 million. It is a different document from the internal risk appetite statement.

What are the 5 levels of risk appetite?

No charity regulator prescribes levels. A common five-point scale – averse, minimal, cautious, open and eager – was set out in the Government Finance Function's Risk Appetite Guidance Note (2021), which was deleted from the Orange Book collection on GOV.UK on 29 July 2026 as out of date. A charity can use any scale its board understands, or plain sentences for each category.

What are the 7 risk categories?

There is no fixed list of seven. The Charity Commission's CC26 groups charity risks into five categories: governance, operational, financial, external, and compliance with law and regulation. Longer lists, such as the 13 example categories in Annex 4 of HM Treasury's Orange Book, split some of these out, and many charity boards give safeguarding and reputation lines of their own. A risk appetite statement sets an appetite for each category the board actually uses.

Official guidance and your next step

The Charity Commission's Charities and risk management (CC26) is the main source: Stage 1 of its risk management process for the levels of risk trustees accept, Stages 4 and 5 for net risk and monitoring, and Part 3 for the risk management statement. Read it with Charity reserves: building resilience (CC19), Investing charity money (CC14) and the Charity Governance Code (2025), Principles 5 and 6. The definition of risk appetite is in HM Treasury's Orange Book, and the deletion of the Risk Appetite Guidance Note is recorded on the Orange Book collection page. Academy trusts should read Part 2 (paragraphs 2.23 and 2.43 to 2.44) of the Academy Trust Handbook 2026. Quotations are from those pages as published on 29 and 30 October 2026.

This guide covers charities in England and Wales and is not legal advice. CC26 is the Charity Commission's guidance; charities registered in Scotland or Northern Ireland should read their own regulator's guidance.

Then do one thing: take the last three decisions your board made about something new – a project, a contract, an event – and ask whether anyone could say, from the papers, which level of risk the board was accepting. If nobody could, that is where your statement starts.