Governance · Practical guide
How to build a useful charity risk register
Turn a list of concerns into a record of risks, controls, owners and review decisions.
A charity risk register is useful when it supports a conversation and an action. Start with the risks that could prevent your organisation doing its work, then make the response and responsibility clear.
Start with the decisions the register needs to support
Choose a manageable starting point: the risks trustees need to discuss before agreeing a budget, changing a service or committing to a project. Gather the people who understand the work. Ask what could disrupt it and what information would help the board decide.
Separate a risk from a problem that has already happened. An overdue repair may be a current issue; the risk is the effect a further failure could have on activities, people or costs. Record the issue and its action as well as the wider risk.
Write a risk people can recognise
Avoid broad labels such as “funding” or “volunteers”. Describe a possible event and its consequence. A fictional community group might record: “If the main room cannot be used for several weeks, activities may need to move and booking income may fall.” That wording gives the team something specific to discuss.
The Charity Commission’s CC26 guidance includes a risk-management model and an example register. It emphasises an approach tailored to the charity’s circumstances. The guidance applies to England and Wales; use the relevant regulator’s guidance for another jurisdiction.
Record controls and what still needs doing
Distinguish what is already in place from an intention. “The bookings coordinator checks the room weekly” describes a control. “Arrange a backup venue” describes an action. Give the action an owner and a date, then decide how the board will see whether it has happened.
- Risk: the event and its possible effect.
- Controls: the measures currently in use.
- Next action: the improvement or decision required.
- Owner: the person responsible for following up.
- Review: the date or trigger for reconsidering the risk.
Use scores to prompt a discussion
If you use likelihood and impact scores, agree what the scales mean. A number without a shared meaning creates false precision. Talk about the evidence behind the score, the possible consequences and the limits of current controls.
Review the register when circumstances change, as well as at agreed intervals. A new activity, loss of a key person or changed building arrangement can alter the position. Ask which actions have been completed and which risks need a decision.
Keep organisational and activity risks distinct
A board-level register helps trustees oversee organisational risks. An activity or premises assessment works through hazards and controls for a particular setting. Connect the records where useful, but do not assume that completing one replaces the other or provides specialist sign-off.
Bring a short list of decisions to the next meeting: what needs attention, who will act and when the board will return to it. The register should support judgement rather than become a document updated only for filing.
Sources and further reading
Take the next step
Explore the consultancy scope or prepare an enquiry. Availability, scope, timescale and fees would be agreed before any paid work begins.