Charity Risk Register Template UK

Standard Operating Procedure: UK Charity Risk Register Architecture & Management

1. Document Control Block

---

2. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the engineering specification and operational protocol for establishing, maintaining, and auditing an institutional-grade Risk Register for UK-registered charities.

The objective is to move risk management from a passive compliance exercise to a deterministic, quantitative risk architecture. Adherence to this SOP ensures compliance with Charity Commission Guidance CC26 (Charities and risk management), fulfills Trustee fiduciary duties under the Charities Act 2011, and secures institutional resilience across operational, financial, safeguarding, and reputational domains.

---

3. Scope & Prerequisites

3.1 Boundaries

• In-Scope: Strategic, operational, financial, legal/regulatory, safeguarding, cyber/IT, and reputational risks across all UK legal structures (CIO, Company Limited by Guarantee, Unincorporated Association, Trust).
• Out-of-Scope: Day-to-day dynamic project management risk logs (unless escalated to organizational threshold) and individual case-level clinical/safeguarding logs (handled via localized incident management software).

3.2 Prerequisites & Tooling

• Software: Enterprise Spreadsheet Software (Microsoft Excel 365 / Google Sheets) or dedicated Governance, Risk, and Compliance (GRC) software.
• Reference Material: Charity Commission CC26 framework, statutory Accounts Free Format Risk Statement requirements, organizational Risk Appetite Statement.
• Personnel Hardware/PPE: N/A (Digital Operational Standard). Security permissions require Role-Based Access Control (RBAC) enabled on storage repositories.

---

4. Roles & Responsibilities (RACI Matrix)

Legend: R = Responsible, A = Accountable, C = Consulted, I = Informed

---

5. Step-by-Step Procedure

                     ┌─────────────────────────────────────────┐
                     │ Phase 1: Architecture & Schema Setup    │
                     └────────────────────┬────────────────────┘
                                          │
                                          ▼
                     ┌─────────────────────────────────────────┐
                     │ Phase 2: Inherent Risk Identification   │
                     └────────────────────┬────────────────────┘
                                          │
                                          ▼
                     ┌─────────────────────────────────────────┐
                     │ Phase 3: Control Design & Residual Score│
                     └────────────────────┬────────────────────┘
                                          │
                                          ▼
                     ┌─────────────────────────────────────────┐
                     │ Phase 4: Target Score & Action Planning │
                     └────────────────────┬────────────────────┘
                                          │
                                          ▼
                     ┌─────────────────────────────────────────┐
                     │ Phase 5: Governance & Reporting Cycle   │
                     └─────────────────────────────────────────┘

Phase 1: Architecture & Schema Specification

• 1.1 Establish Data Schema: Configure the Risk Register repository with the following mandatory data fields:

  • Risk ID (Format: RSK-CAT-00X)
  • Risk Category (Governance, Operational, Financial, Safeguarding, Compliance, External)
  • Risk Description (Format: Cause $\rightarrow$ Event $\rightarrow$ Impact)
  • Inherent Likelihood (Scale 1–5)
  • Inherent Impact (Scale 1–5)
  • Inherent Risk Score (Calculated: $\text{Likelihood} \times \text{Impact}$)
  • Existing Controls (Itemized list of design/operating controls)
  • Control Adequacy Rating (1-Effective, 2-Partially Effective, 3-Ineffective)
  • Residual Likelihood (Scale 1–5)
  • Residual Impact (Scale 1–5)
  • Residual Risk Score (Calculated: $\text{Likelihood} \times \text{Impact}$)
  • Target Risk Score (Calculated target after future actions)
  • Mitigation Action Plan (Concrete steps to close score gap)
  • Risk Owner (Named individual, single point of accountability)
  • Review Frequency (Monthly, Quarterly, Bi-Annually)
  • Last Review Date (ISO Date Format: YYYY-MM-DD)

• 1.2 Standardize the 5x5 Matrix: Program the automated risk matrix calculations using the standard scale:

  • Likelihood: 1 (Rare), 2 (Unlikely), 3 (Possible), 4 (Likely), 5 (Almost Certain)
  • Impact: 1 (Negligible), 2 (Minor), 3 (Moderate), 4 (Major), 5 (Catastrophic)
  • Risk Tiers: 1–5 Low (Green), 6–10 Medium (Yellow), 12–15 High (Amber), 16–25 Critical (Red)

Phase 2: Inherent Risk Identification

• 2.1 Execute Categorized Risk Identification: Conduct structured risk-capture sessions across operational units using standard taxonomies:
  • Financial: Grant funder withdrawal, inflation-driven reserve depletion, payroll fraud, restricted fund misallocation.
  • Safeguarding: Beneficiary harm, DBS non-compliance, failure to report serious incidents (RSI) to Charity Commission.
  • Governance: Trustee vacancy/skills deficit, conflict of interest breaches, failure of strategic oversight.
  • Compliance/Legal: GDPR non-compliance, breach of Employment Law, failure to submit annual returns (CC/OSCR/CCNI).
  • Operational: Core IT system loss, key-person dependency, supply chain failure in service delivery.
• 2.2 Populate Root Cause Analysis: Ensure descriptions strictly adhere to cause/event/impact semantics.
  • Correct: "Due to insufficient key-person redundancy (Cause), key finance personnel absence (Event) leads to late SORP filing, regulatory fines, and funder breach (Impact)."
  • Incorrect: "Finance department is a risk."
• 2.3 Determine Inherent Risk Score: Score the risk without considering any internal controls or mitigations.

Phase 3: Control Verification & Residual Scoring

• 3.1 Map Existing Controls: Document active, verifiable controls against each risk item (e.g., "Dual-authorization payments on accounts > £5,000", "Bi-monthly safeguarding audits").
• 3.2 Test Control Efficacy: Audit control execution. If controls are documented but unverified, set Control Adequacy Rating to 3 (Ineffective).
• 3.3 Calculate Residual Risk: Score the risk assuming current controls operate at declared efficacy levels.

$$\text{Residual Risk Score} = \text{Residual Likelihood} \times \text{Residual Impact}$$

Phase 4: Action Planning & Target Scoring

• 4.1 Compare Against Risk Appetite: If Residual Risk Score $>$ Risk Appetite Threshold (e.g., Any Critical $\ge 16$ or High $\ge 12$), mitigation planning is mandatory.
• 4.2 Assign Mitigation Actions: Formulate targeted actions using the 4Ts framework:
  • Tolerate: Accept residual risk (must be formally recorded in Board minutes).
  • Treat: Implement additional controls to lower likelihood/impact.
  • Transfer: Shift liability (e.g., insurance policies, outsourced specialized providers).
  • Terminate: Cease the activity causing the risk.
• 4.3 Assign Ownership: Allocate each mitigation action to a single named owner with an explicit deadline date.

Phase 5: Governance Integration & Review Cycle

• 5.1 SMT Monthly Review: Filter register for Residual Score >= 12 and review progress on mitigation action items.
• 5.2 Audit & Risk Committee Quarterly Oversight: Review complete register schema, evaluate control testing reports, and approve changes to inherent scores.
• 5.3 Board of Trustees Sign-Off: Escalate top strategic risks (Top 5-10 Red/Amber items) quarterly. Require explicit minuted sign-off on risk exposure.
• 5.4 Serious Incident Reporting Trigger: Automatically initiate Charity Commission Serious Incident Reporting protocol if any Safeguarding or Financial Fraud risk manifests.
• 5.5 Annual Accounts Integration: Extract top residual strategic risks for inclusion in the Trustees' Annual Report (SORP compliance statement).

---

6. Quality Assurance & Pro-Tips

Metric Thresholds & Performance Indicators

          [REGISTER HEALTH MEASUREMENTS]
  ┌───────────────────────────────┬──────────────┐
  │ KPI Metric                    │ Target Standard │
  ├───────────────────────────────┼──────────────┤
  │ Unassigned Risk Owners        │ ZERO (0%)    │
  │ Overdue Mitigation Actions    │ < 5% Total   │
  │ High/Critical Unmitigated     │ 0%           │
  │ Review Staleness (>90 days)   │ ZERO (0%)    │
  └───────────────────────────────┴──────────────┘

Pro-Tips & Architecture Rules

• Rule of Single Accountability: Never assign a group or department as a risk owner. Assign a job title / individual (e.g., Head of Finance, not Finance Team).
• Avoid "Phantom Controls": A control is only valid if it produces an auditable artifact (e.g., a signed log, automated system export, or approved policy document).
• Safeguarding Precedence: Safeguarding impact scores must automatically default to an Impact rating of 4 (Major) or 5 (Catastrophic). Never score systemic safeguarding failures as minor or negligible, regardless of current financial impact.
• Dynamic Formatting: Utilize conditional formatting in the spreadsheet tool to dynamically highlight Target Score vs Residual Score variances to spot stagnant risks instantly.

---

7. Frequently Asked Questions (FAQ)

Q1: How does this template integrate with Charity Commission CC26 and SORP reporting?

Answer: The Charity Commission requires Trustees to confirm in the Annual Report that major risks have been identified, assessed, and controls established. This register provides direct trace-matrix evidence. The top strategic risks listed in your register's Residual Score >= 16 band form the exact narrative used in the "Principal Risks and Uncertainties" section of your Trustees' Annual Report under FRS 102 SORP.

Q2: Should operational and strategic risks be kept on the same register?

Answer: Architecturally, yes, but view-filtered by persona. The underlying database schema should hold all risks to maintain a single source of truth. However, dynamic views must be implemented: operational teams review localized operational risks (Scores 1-10), while the Board of Trustees views an executive summary filtered for high-tier strategic risks (Scores 12-25) and key systemic compliance items (e.g., Safeguarding).

Q3: How do we prevent "Risk Register Fatigue" where the document becomes static?

Answer: Treat the register as an active operational workflow rather than a static document. Integrate risk review directly into operational line management and department meetings. Enforce a rule that no capital expenditure, new project, or policy change is approved without referencing or adding an entry to the Risk Register. Tie mitigation action performance directly to Senior Leadership KPIs.