This month, the Charity Commission published its findings on the emerging risks facing charities alongside guidance to help charities act before these risks take full control.
The findings come from the financial information and also cases the Commission has been presented with during the 2024-2025 period; however, it is still incredibly relevant and appropriate as we move toward the end of 2026 and look at what a New Year holds for the sector.
Key themes in the report highlight the ongoing pressure charities face with increasing operating costs, demand for services, and the increase in donations categorised within restricted funds.
Providing insights and areas for trustees to consider, this report encourages all those working in the sector to use the details and insights to build on your own risk register, putting in place plans and mitigations – which are all part of good governance.
What should be included on your risk register in 2027?
Financial sustainability and funding pressures
Achieving financial sustainability is becoming more challenging than ever before, with funding pressures increasing, and what we know is declining donor pools becoming the norm.
Matched with fewer people donating larger volumes, and reports from Charity Digital stating that there are, in fact, 6 million fewer donors than there were ten years ago, charities are now looking at how they can best diversify income streams as well as work in partnership with other organisations.
Alongside this, as operating costs continue to rise, expenditure for some charities (2 in 5 charities reported) has exceeded income, with the remainder operating at extremely narrow margins.
Where does your charity income come from? Are you too reliant on one source? What would happen if funding was pulled or stopped?
Cybersecurity and digital
This is (or should be) a large part of a charity’s risk register moving into the New Year, especially when we see reports that in the last 12 months, around 30% of charities have reported some form of cyber-attack, (the most common relating to Phishing).
AI can offer many benefits to charities, supporting workloads and improving efficiency, but it is vital that you have adequate safeguards, oversight, and risk management procedures in place in order to work with AI effectively and safely.
Think about staff training, the risk to the charity’s reputation if data and personal information is stolen, the financial risk and consequences of a digital attack – how prepared are you?
Workforce and volunteer challenges
We understand that charity managers and teams are under increasing pressure due to increases in demand for services, and we know that there is a particular increase in complex caseloads with more reports around safeguarding than ever before.
These high workloads, declining volunteer numbers, and increase in demand for services must all be registered as risks, with trustees reviewing these and putting plans in place to support these changes while still achieving the charity’s purpose.
In addition, employee wellbeing is a major concern, and trustees must be aware of and monitor this as a risk. What happens if your charity manager takes a sudden leave of absence due to work-related stress? How are volunteers communicating with others about how they are treated within the charity?
Looking after your workforce, as well as your own wellbeing, is a significant element of effective governance. For additional guidance and support in this area, you can find out more here.
Misusing Charity Status
Within the report, the Charity Commission also highlights an increase in individuals misusing charity status for private financial gain. This is an important reminder that it is vital for all charities to carry out their due diligence on their workforce and their trustees.
This begins at recruitment through to onboarding and ongoing monitoring and management of teams, trustees, and decision making within the charity.
Regulatory and governance considerations
Two significant areas of governance relate to the updated Charity Governance Code and Conflict of Interest.
The updated Charity Governance Code, while not a legal requirement, does set out clear guidance and information which is endorsed by the Charity Commission. Outlining trustees’ legal duties, the Code also delves into AI, cybersecurity, employee wellbeing, and environmental responsibility. Within your risk register, these areas should be highlighted to see where your board currently sits within these practices and how these are managed and communicated within the charity.
The Conflicts of Interest guidance (CC29) was recently updated this year to provide additional guidance relating to the rise of conflict cases within charities and how these must be managed going forward. Conflicts of interest, whether financial or loyalty, must be declared, managed, and formally recorded within your risk register (make sure to check out our post on “Conflicts of Interest in Charities – What Are They and Why Are They Important.”
Other governance considerations to take into account relate to:
- Your charity’s risk register, how it is managed, updated, and used across the charity.
- Trustee decision-making, i.e., are decisions being made in the best interests of the charity, supporting the charity’s primary purpose.
- Financial transparency- are all board members aware of the financial position of the charity? Does everyone have clear financial oversight and understanding?
To provide effective governance, risks relating to managing trustee disputes, safeguarding, and social tensions should also be built into your risk register moving into 2027, as well as the fact that charities across the UK can no longer effectively recruit sufficient numbers of trustees, which will, and does, impact the ability to provide effective governance.
In terms of regulatory risks, we are aware of increased compliance and audit costs, as well as regulatory expenses, driven by increased compliance procedures relating to changes to the Charity Accounting Framework (SORP), Charity Governance Code (including the Cyber Governance Code) and financial reporting procedures – are your processes up to date? Is everyone aware of the changes?
How can trustees prepare for uncertainty?
Trustees are responsible for ensuring the charity’s needs are continually met. This means having a clear picture of the financial position of the charity and risks that could affect this position.
Your risk register is the most beneficial way of mitigating, preparing, and planning for what the future has in store.
Planning, regularly updating, and acting early is key.
All trustees, regardless of official position on the board, should be aware of and understand the risks the charity faces and how to manage and plan for them. It is part of a trustee’s duty to be able to identify risks and potential risks to the charity, with these all being recorded within the risk register and regularly reviewed and discussed.
To help support some of the emerging risks, trustees should:
- Ensure all reporting is fit for purpose (have robust financial controls/processes in place and ensure everyone has financial oversight at board level). Outsourcing financial reporting can also be an option and provide peace of mind that your data is meeting all compliance regulations.
- Regularly review cash flow forecasts and strategy forecasting (monitor actual performance against budgets).
- Look at and review all opportunities available, i.e., opportunities for collaboration, government grants, working with like-minded businesses, etc.
- Mitigate financial risk by looking at diversifying income streams.
- Invest in cyber security and digital training and understanding for ALL staff and volunteers.
Remember, a charity’s risk register is not a document that is completed and ticked off a board’s agenda once a year. It is a live, working document that should be regularly reviewed and discussed as a standing agenda item at every board meeting and when new information, guidance, and shifts to market and funding occur.
For the full report from the Charity Commission relating to emerging risks, as well as guidance and tools to support charities, click here.
