Charity Commission Serious Incident Reports

A serious incident is something that has gone wrong in your charity badly enough that the Charity Commission expects to hear about it from you rather than from a journalist. The Commission defines it as "an adverse event, whether actual or alleged, which results in or risks significant: harm to your charity's beneficiaries, staff, volunteers or others who come into contact with your charity through its work... loss of your charity's money or assets... damage to your charity's property... harm to your charity's work or reputation". You report it using an online form, promptly, and the decision about whether an incident meets that bar is the trustees' to make.

That last part is where small charities get stuck. The definition is deliberately broad, and "significant" is doing all the work. The good news is that the Commission publishes its own worked examples with two numbers in them — and almost nobody quotes them, because they sit inside a downloadable document rather than on a web page.

The two lines that do most of the deciding

For money, the Commission's Examples table gives the two thresholds that separate a report from a note in the minutes.

Report a donation where "A significant amount over £25,000 is donated to the charity from an unknown or unverifiable source."

Do not report a loss where "Loss of charity funds where the value lost represents less than £25,000 of charity assets and is less than 20% of the charity's income. There is no significant impact on the charity's services."

Read the second one carefully, because it is three tests joined by and, not one. A £6,000 loss at a charity with £22,000 of income is over 20% of income, so it falls outside the do-not-report example even though it is nowhere near £25,000. The limb that bites first is whichever of £25,000 and 20% of income is the smaller, and the two cross at £125,000 of income: below that the 20% limb is the binding one, above it the £25,000 limb is. A charity with £300,000 of income that loses £30,000 is over the £25,000 line while comfortably under 20%.

On theft specifically, the table is blunt about the absence of a floor: "Remember, there is no minimum loss figure that should be reported. You need to decide whether incidents are serious enough to report, in the context of your charity and its income, taking account of the actual harm and potential risks posed."

What the Commission's examples actually say

The table runs to a dozen categories. These are the ones a small community charity, church, PTA or sports club is most likely to meet, quoted from the Commission's own wording.

Category	Report this	Do not report this
Safeguarding	"Allegation that a staff member has physically or sexually assaulted or neglected a beneficiary whilst under the charity's care"; "Charity failed to carry out DBS checks which would have identified that a member of staff or trustee was disqualified in law (under safeguarding legislation) from holding that position."	"Minor accidental injury to a charity service user e.g. slipping on a wet floor"; "Logged accident book reports where there was no significant harm to individuals"
Bullying and harassment	"An internal investigation has established that there is a widespread culture of bullying within the charity"	A non-senior staff member bullying a colleague where "There is no indication of a widespread culture of bullying or harassment within the charity and the incident is dealt with by minor disciplinary action (for example, the staff member responsible has not been suspended or dismissed)"
Theft	"Each month, between £100-£200 goes missing, suspected stolen, from the cash till in the charity shop. It has been going on for six months and has been reported to the police."	"Theft of a collection tin thought to contain small amount of cash"; "One-off random theft of items such as jewellery or a mobile phone at the charity's premises"
Fraud, cyber-crime and money laundering	The rule the Commission gives for the whole category: "Any actual/alleged fraud or money laundering should be reported. Any actual/alleged cyber-crime should be reported with the exception of the example in the right-hand column". Its examples: "Charity funds lost due to an online or telephone 'phishing scam', where trustees were conned into giving out bank account details"; "Attempted fraud by a member of charity staff but intercepted by internal financial controls"	"Attempted cyber-crimes that are blocked by the charity's computer network security systems, except where the attempted cyber-crime is unusual in nature and the charity wants to bring it to the attention of the Commission"
Data	"A charity laptop, containing personal details of beneficiaries or staff, has been stolen and there is no encryption or other security measures that would prevent the perpetrator from accessing this information"; "A Data Protection Act breach has occurred and been reported to the ICO"	"A charity laptop or mobile phone (not containing confidential data) has gone missing – it's been reported to the police"
Governance	"Mass resignation of trustees, leaving the charity unable to function"; "Evidence that trustees have routinely signed blank cheques"	"One or two trustees stepping down at year-end, due to other commitments"
Income and premises	"Sudden loss of 20% or more of charity's income (e.g. due to termination of major donor contract); charity has no reserves, meaning staff will be laid off and services stopped"; "The charity's main premises is severely damaged in a fire and the charity is unable to deliver services to its beneficiaries"	A charity vehicle badly damaged where "the damage is covered by insurance and the charity is still able to deliver services to its beneficiaries"
Fundraising	"Suspicions of unauthorised public collections in the name of the charity"; "Charity hasn't complied with law on requirements for solicitation statements or professional fundraising agreements"	"A missing collection tin thought to contain a small sum of money"
Other regulators	"Charity is subject to official investigation by another regulator e.g. Fundraising Regulator, Police, UK Visas & Immigration, Ofcom, Information Commissioner, Care Quality Commission or Care Inspectorate Wales"	"Routine inspections by a sector regulator e.g. Ofsted, CQC or CIW, do not need to be reported to the Commission unless there are adverse findings that place the future of the charity in doubt, relate to other categories of serious incidents or are likely to attract negative media attention"

Two patterns run through the whole table, and they are more useful than memorising any single line.

Scale and pattern beat the individual event. A one-off medication error with no significant harm is not reportable; "Repeated medication errors to beneficiaries in a care home indicating a systemic problem" is. A single instance of low-level bullying is not; an established culture of it is. The Commission is interested in whether the charity is safe to run, not in cataloguing bad days.

Consequence beats cause. Damaged premises are reportable when the charity cannot deliver services, and not when insurance covers it and services continue. The same event lands on different sides of the line depending on what it does to the charity.

There is also a banking category worth knowing about if your charity has ever had an account closed: the guidance treats it as reportable where "your charity's operations are threatened because your main or only bank has withdrawn banking services, and you can't find another bank that will accept you".

Who reports, and how quickly

Responsibility sits with the board, not with whoever happened to find out. The Commission's guidance is explicit: "The responsibility for reporting serious incidents rests with the charity's trustees." Delegation is permitted but does not transfer that responsibility — "In practice, this may be delegated to someone else within the charity, such as an employee or the charity's professional advisers. However, all trustees bear ultimate responsibility for ensuring their charity makes a report, and does so in a timely manner."

On timing: "You should report an actual or alleged incident promptly. This means as soon as is reasonably possible after it happens, or immediately after your charity becomes aware of it."

You do not wait until you know what happened. A report can be filed on the basis of an allegation and updated later, and the definition itself covers events "whether actual or alleged". Trustees who hold a report back until an internal investigation concludes are usually the ones who end up explaining a delay.

Practically, for a board that meets quarterly, that means the chair or another named trustee needs standing authority to file between meetings. Waiting eleven weeks for the next agenda is not prompt, and "we were going to raise it at the November meeting" is not a defence anyone wants to offer.

Where the legal duty actually bites

This is the part that is routinely stated too strongly in one direction and too weakly in the other.

The guidance opens its reporting section with "The Charity Commission requires charities to report serious incidents", and frames the individual act as something you should do. What it does not do is make staying silent a standalone criminal offence. But the consequences are real and they arrive by two routes.

The first is regulatory. "If trustees fail to report a serious incident that subsequently comes to light, the Commission may consider this to be mismanagement, for example where the trustees have failed to manage the risks properly and breached their legal duties." And if you consciously decide not to report, the decision has to stand up later: "If you decide not to make a report about something serious that has happened in your charity and the Commission later becomes involved, you will need to be able to explain why you decided not to report it at the time." That is a strong argument for minuting the decision not to report, with reasons, at the time you take it.

The second route is the one with teeth, and it runs through your annual return. Per the guidance: "If your charity's income is over £25,000, you must, as part of the annual return, sign a declaration confirming there were no serious incidents during the previous financial year that should have been reported to the Commission but were not. If incidents did occur, but weren't reported at the time, you should submit these before you file your charity's Annual Return, so you can make the declaration." Read that carefully: what you declare is that nothing reportable went unreported — not that nothing reportable happened. A charity that had a serious incident and reported it at the time signs the declaration truthfully. A charity that did not report one files late and then signs. Signing it when you know it is wrong is not a governance lapse — it is an offence. Section 60 of the Charities Act 2011 provides that "It is an offence for a person knowingly or recklessly to provide the Commission with information which is false or misleading in a material particular if the information is provided— (a) in purported compliance with a requirement imposed by or under this Act ..." — and an annual return is provided in purported compliance with a requirement under the Act. Section 60(3) sets the penalty: "on summary conviction, to a fine not exceeding the statutory maximum; on conviction on indictment, to imprisonment for a term not exceeding 2 years or to a fine, or both." The guidance draws the link itself: "It's an offence under section 60 of the Charities Act 2011 to provide false or misleading information to the Commission, which includes through the annual return."

So the honest summary is: the Commission requires reporting and expects it promptly, but it is the annual-return declaration that carries a criminal sanction. An unreported incident that a trustee knows about becomes a much more serious problem the moment somebody signs the return.

Note that this £25,000 is the Charities Act 2011 section 163 filing band, and it is not one of the figures the Charities Acts 1992 and 2011 (Substitution of Sums) Order 2026 moves. That Order raises the accounts, examination, audit and group-accounts thresholds (arts.3(3)-(5) and 4), the Commission's concurrent-jurisdiction figure in section 70 from £500 to £1,000 (art.3(2)), and several Charities Act 1992 fundraising sums (art.2) — but it leaves section 163 and the annual return declaration alone. Our annual return guide sets out which figure does what.

How to file one

Reports go through the Commission's Report a serious incident service. Have to hand: your charity number, what happened and when, what harm or loss resulted, what the trustees have done in response, and whether you have told anyone else — police, the ICO, a funder, another regulator.

The response section carries more weight than most trustees expect. A report saying "£4,000 taken by a volunteer treasurer over two years; reported to police; second signatory now required on all payments; bank mandate changed; monthly reconciliation added to trustee meeting agenda" reads completely differently from the same loss with no remedial action. The Commission is assessing whether the board has a grip on it.

You can update a report as more becomes known, which removes the last excuse for waiting.

A decision routine that works for a small board

1. Name who can file. One trustee, usually the chair, with authority to report between meetings without waiting for a resolution. Write it into your scheme of delegation or minute it once.
2. Ask the three questions in order. Did anyone come to harm? Did the charity lose money or assets — and is the loss over £25,000, or over 20% of income? Would this damage trust in the charity if it were reported publicly? A yes to any of them puts you on the report side of the line.
3. Check the pattern, not just the event. Third time this year is a different answer from first time ever, even for the same small amount.
4. Minute the decision either way. Reported, with date and reference; or not reported, with the reason. The second minute is the one that protects you.
5. Keep a running list for the return. A one-line log of incidents and outcomes through the year means the annual return declaration takes a minute instead of a memory test. Our free compliance checklist generator covers the annual return alongside your other obligations, and a risk register is where the recurring near-misses belong.

Most of the incidents that go unreported at small charities are not concealed. They are simply never recognised as reportable by a board that has no routine for asking the question. The routine is the fix.

Related obligations sit close to this one: the safeguarding policy and DBS checks that prevent the most serious category, the whistleblowing policy that is often how a board first hears of a problem, and the wider set of policies charities need.

---

This guide covers charities registered in England and Wales and regulated by the Charity Commission; the Charity Commission for Northern Ireland and the Office of the Scottish Charity Regulator operate their own serious incident regimes. It is general guidance based on the Commission's published guidance and the Charities Act 2011. Where an incident involves a crime, a safeguarding concern, or a data breach, report it to the police, your local authority safeguarding team or the Information Commissioner's Office as well — a report to the Commission does not replace those. If you are unsure whether a specific incident crosses the line, the Commission would rather receive a report it did not need than not receive one it did.

Sources

• How to report a serious incident in your charity — GOV.UK
• Examples table: deciding what to report — Charity Commission
• Prepare a charity annual return — GOV.UK
• Charities Act 2011, section 60 — supply of false or misleading information
• Report a serious incident — Charity Commission service