Charity Risk Register: Template and Guide for Trustees

A risk register is how a charity's trustees document the risks they have identified, assessed, and decided how to manage. The Charity Commission does not require charities to use a specific format, but it does expect trustees to manage risk as part of their duty to manage the charity's resources responsibly.

For many small charities, risk management is informal — discussed at board meetings but never written down in a structured way. The problem with informal risk management is that it depends on institutional memory. When trustees change, unwritten risk awareness changes too. A risk register is the institutional record that survives trustee turnover.

What the Charity Commission expects

The Commission's guidance on risk management (CC26) sets out the expectation: the responsibility for managing and controlling a charity rests with the trustee body, and trustees are required to manage risk as part of their duty to manage the charity's resources responsibly. Identifying and managing risks is how trustees protect the charity's ability to achieve its aims.

The risk statement in the trustees' annual report is not triggered by an income figure on its own. CC26 says that "All charities that are under a legal requirement to have their accounts audited must make a risk management statement in their trustees' annual report" — so the trigger is the statutory audit requirement in section 144 of the Charities Act 2011, which, for a financial year ending before 30 September 2026, applies where gross income exceeds £1 million, or where gross income exceeds the accounts threshold (£250,000 for those years) and year-end gross assets exceed £3.26 million. Both limbs of that second test have to be met; income alone is only half of it. For financial years ending on or after 30 September 2026, SI 2026/427 — in force since that date — moves every figure in that test. Art.3(4) substitutes £1.5 million for £1 million in s.144(1)(a) and £5 million for £3.26 million in s.144(1)(b); and because s.144(1)(b) measures its income limb against "the accounts threshold" — defined as "the sum for the time being specified in section 133" — art.3(3)'s substitution of £500,000 for £250,000 in s.133 moves that limb too. So for those year ends the test is gross income over £1.5 million, or gross income over £500,000 and year-end gross assets over £5 million. A charity with £300,000 income and £6 million of assets at a 31 December 2026 year end needs no audit, and so needs no risk management statement.

Those figures come from the Act and the Order, not from CC26. The guidance itself — "Updated 16 September 2026" — states no audit-threshold figure anywhere in it; its only reference to the threshold is figure-free, and it is the one that matters for smaller charities: trustees of "smaller charities with gross income below the statutory audit threshold (who should still be concerned about the risks their charity faces) are encouraged to make a risk management statement as a matter of good practice". Encouraged is not required — CC26 reserves "must" for "a specific legal or regulatory requirement", and uses "should" for "minimum good practice guidance". A charity below the audit threshold that does not make a risk statement is not in breach. Separately, £500,000 does not set the report format directly. The Commission's guidance on the trustees' annual report keys the simple-report format to your accounting basis — "If your charity prepares receipts and payment accounts, you can prepare a simple report" — and the income figure behind that choice is the section 133 receipts-and-payments ceiling for non-company charities: £500,000 for a financial year ending on or after 30 September 2026, £250,000 for an earlier year. The guidance itself uses £500,000 only for how much detail the public benefit section needs. Neither rule says anything about principal risks; our trustees' annual report guide covers the report content itself.

What a risk register should include

A risk register typically captures for each risk:

• Risk description — what could happen and why
• Likelihood — how probable is the risk materialising (often scored 1-5)
• Impact — how severe the consequences would be (often scored 1-5)
• Risk score — likelihood × impact (gives a 1-25 score, or a RAG rating)
• Current controls — what the charity already does to reduce likelihood or impact
• Residual risk — the risk score after controls are applied
• Owner — which trustee or staff member is responsible for monitoring this risk
• Action — what additional action, if any, is needed

The risk score (likelihood × impact) helps prioritise. A common convention is: 15+ on a 25-point scale = high priority; 8-14 = medium; 1-7 = low. The Charity Commission does not prescribe a specific scoring system — the bands are a practical tool rather than a regulatory standard.

Common risks for small charities

The categories below cover the risks the Charity Commission most commonly identifies in small charity governance failures. Trustees should use these as a starting point and add risks specific to their charity's activities and circumstances.

Financial risks:

• Loss of a major funder (likelihood 3, impact 5 for many charities that depend on one source of income)
• Unexpectedly large expenditure (for example, emergency building repairs for charities with premises)
• Fraud or misappropriation by staff, volunteers, or trustees
• Cash flow gap between grant receipt and expenses

People risks:

• Key person dependency (sole paid staff member leaving; only one trustee with financial skills)
• Difficulty recruiting or retaining volunteers
• Trustee vacancy falling below quorum

Safeguarding risks:

• Failure to identify or respond to a safeguarding concern
• Inadequate DBS check processes for trustees or volunteers

Operational risks:

• Data breach or ICO notification requirement (UK GDPR)
• Loss of key relationships (referral partners, local authority contracts)
• Reputational damage from a public incident

External risks:

• Regulatory change affecting the charity's activities or funding
• Economic downturn reducing charitable giving
• Loss of premises

A practical risk register template

The template below covers the six columns most useful for small charities. Add rows for each risk you identify. Start with 5-10 risks and review annually.

---

Risk	Likelihood (1-5)	Impact (1-5)	Score	Current controls	Owner	Action needed
Loss of primary funder	3	5	15	Reserve policy targets 3 months; funder relationship managed by chair	Chair	Identify secondary funding stream before end of year
Safeguarding incident	2	5	10	Policy in place; DSL designated; DBS checks up to date	DSL	Annual safeguarding training for all volunteers
Key staff departure	3	4	12	Trustee oversight of operations; documented procedures	Chair	Complete procedures manual for key roles
Data breach	2	4	8	Data protection policy; restricted access to donor database	Data lead	Annual review of access rights
Trustee vacancy below quorum	2	3	6	3 trustees minimum; annual recruitment review	Chair	Add trustee recruitment to AGM agenda

---

How to use the risk register

At adoption: the board should work through the risk register together at a dedicated agenda item, not receive a draft for passive approval. Discussion surfaces risks that individuals have identified but not shared, and builds shared understanding of which risks the board considers material.

Annual review: the risk register should be reviewed at least once a year, typically at the same meeting as the annual accounts. Likelihood and impact scores can shift — a risk that was theoretical last year may be live this year. The review is also when to add new risks and close risks that have been resolved.

In the trustees' annual report: for charities required to make a risk management statement — those under a legal requirement to have their accounts audited under Charities Act 2011 s.144 — the risk register feeds directly into the annual report. For charities below that threshold, a brief statement that risks have been reviewed is good practice rather than a legal requirement.

When the risk landscape changes: a major funder withdrawal, a safeguarding incident, a sudden loss of premises — these trigger an out-of-cycle risk review. The register gives the board a baseline to work from.

Linking risk to your compliance obligations

Risk management connects to several other governance obligations. A well-run compliance programme reduces operational risks; a well-run safeguarding policy reduces safeguarding risks. Our charity compliance checklist covers the obligations that feed directly into the risk register, and our reserves policy guide covers how financial reserves are the primary financial risk control.

---

This guide applies to charities registered with the Charity Commission for England and Wales. CC26 provides detailed guidance on risk management for charities. This is general guidance, not legal advice.

Sources

• Charities and risk management (CC26) — GOV.UK
• Prepare a charity trustees' annual report — GOV.UK