The Charity Commission’s upcoming refresh of CC26, its risk management guidance for charities, is timely. Charities are dealing with higher costs, more complex regulation, greater digital and cyber exposure, more demanding funder requirements and, in many cases, increasing demand for services. And the global political and economic situation feels much more volatile. The recent research undertaken by Charity Finance Group and The Risk Collaborative, presented in this paper, was to inform the CC26 update. It looked at awareness of CC26, the usefulness of the framework, and how charities carry out risk management and embed it in decision-making. It found that charities take risk into account, but formal risk management processes are not always helping them make better decisions.
The central message from the research is that the charity sector does not lack risk awareness. Many charities, particularly smaller ones, manage risk through discussion, judgement, local knowledge and practical experience rather than through formal tools. The report found that among respondents who did not use either a risk register or a risk matrix, 83% still said they considered risk when making organisational decisions. This challenges the assumption that risk management only exists where there is formal documentation.
In fact, formal risk tools can easily become a substitute for proper judgement. The report highlights that, where risk registers do exist, they are often maintained for compliance reasons rather than because they support decisions. They may be updated for board meetings, funders or auditors, but then sit separately from the actual decisions being made. That is one of the most important findings in the report: a risk register that does not influence decision-making is not effective risk management. It may create the appearance of a formal control framework, but it does not necessarily help trustees understand uncertainty, challenge assumptions or respond to emerging problems.
The report recommends that a refreshed CC26 should move away from a document-heavy compliance-led approach and towards a decision-making approach. Good risk management should help a charity understand what it is trying to achieve, what might prevent it from achieving those objectives, what opportunities might arise, what assumptions are being made, and what would cause the charity to change course. Much more useful than simply asking whether the charity has completed the right template or reviewed the right register. The purpose of risk management should be to improve decisions, not to create paperwork.
Trustees are required to manage resources responsibly, act in the charity’s best interests and apply reasonable care and skill. These duties are met through the quality of the judgement trustees apply when making decisions under uncertainty, rather than having a risk register on file. A refreshed CC26 should make that connection clearer, emphasising that risk management is good governance.
The report also challenges the sector’s reliance on income as a proxy for risk complexity. Income is easy to measure, but, as with any single figure, it does not actually determine organisational profile. Risk is shaped by what the charity does, who it works with, how it is funded, how it is governed and how much change it is facing.
Rather than placing charities into categories based only on income, it suggests considering several dimensions, including scale and capacity, mission complexity, safeguarding exposure, income dependency, financial resilience, regulatory exposure, governance maturity and organisational change. This would allow charities to assess their actual risk position more proportionately. It would also help avoid two common mistakes: assuming that small charities are always low risk, and assuming that large charities automatically have strong risk management.
The report’s emphasis on culture is also important, with many respondents saying their organisations encouraged honest discussion, but fewer said their meetings explicitly explored bias, overconfidence or excessive caution. Poor risk decisions often arise not from a lack of information, although this is of course a factor, but from weak challenge. Boards may accept optimistic assumptions too readily, avoid difficult conversations, defer too much to dominant voices, or continue with historic practice because changing direction feels uncomfortable. A healthy risk culture invites challenge.
This has particular relevance for treasury management. Treasury decisions are often vulnerable to behavioural risk. We often find examples in the organisations and charities we advise. For example, a charity may keep too much money with one bank because it has always done so, hold excessive cash because trustees are uncomfortable with investment risk, or stretch for additional yield without fully understanding liquidity, credit or market risk. This could be due to strongly held preconceptions that may be changed through effective training. Boards may also focus on whether a treasury policy exists, rather than whether it is genuinely appropriate – again, paperwork and procedure giving the illusion of good decision-making. A good treasury framework should encourage trustees to ask whether cash is sufficiently diversified, whether liquidity is adequate, whether restricted funds are properly understood, whether investments match the charity’s time horizon, and whether the organisation could withstand adverse movements in interest rates, markets or income.
Treasury risk should be linked directly to charitable objectives. The starting point should not be a list of permitted investments, but a clear understanding of what the charity needs its funds to do. Some money may be needed for immediate service delivery, some may need to be held for known future commitments, and some may represent longer-term reserves or endowment funds. Each category may require a different approach to liquidity, security and return. A charity with volatile income and limited reserves may need a very cautious treasury strategy, while a charity with long-term funds may need to consider whether holding everything in instant access cash exposes it to inflation risk and missed opportunity.
The report’s findings on funder relationships also have treasury implications. Many grant-funded charities reported that funder risk requirements are increasing, but fewer had constructive conversations with funders about risk thresholds and responsibilities. This can create real financial pressure. Grant conditions can restrict how money is used, increase compliance costs, delay cash receipts or transfer delivery risk onto charities without sufficient flexibility or funding. From a treasury perspective, this affects cash flow, liquidity and resilience. A charity may look financially stable in headline terms while still facing cash strain because funding is restricted, reimbursement-based or dependent on milestones.
As the report suggests, a stronger approach would involve more explicit discussion of risk-sharing between charities and funders. Trustees should understand what risks the charity is accepting when entering into a funding agreement, whether the grant properly funds the associated costs, and what happens if assumptions change. Challenging funder terms should not be seen as being difficult. In some cases, it is part of acting in the charity’s best interests.
So, a change in perspective is necessary for risk management, away from seeing it as simply procedural documentation to making sure it is embedded in decision-making and monitored continually. From a treasury management perspective, risk management is an on-going decision-led process within an organisationally appropriate risk control framework approved by informed trustees. It needs a practical, proportionate approach that helps treasury managers make better decisions, identify early warning signs, challenge assumptions, and protect the charity’s ability to deliver its purpose. Where organisational or objective change is being considered, this becomes more important. Policies, reports and risk registers should not be judged by whether they exist, but by whether they improve financial resilience, now and in the future.
Arlingclose assists its clients with expert advice around appropriate treasury policy, trustee and senior officer training, on-going risk management guidance, mitigation and, above all, solutions. We often find that outside expertise is necessary part of challenging set ways of doing things. For more information about our services, please contact nkeeling@arlingclose.com.
