Charity Risk Assessment Template UK: A Practical Guide for Community Groups

A charity risk assessment template UK community groups can actually use is not a forty-page corporate document; it is a single working spreadsheet a trustee board reads in ten minutes. Small organisations across Essex, from village hall committees to lunch clubs and youth football sides, need a charity risk assessment template UK regulators recognise, because the Charity Commission expects trustees to identify, evaluate and manage risk as a basic duty of care. The practical problem is that generic health and safety forms ignore the things that genuinely sink small organisations: an unbanked cash float, one unvetted volunteer, an expired insurance certificate, or a trustee who signs a five-year lease nobody else has read. This guide sets out the columns, the scoring method, realistic cost figures in pounds and the review rhythm that turn a blank grid into a document protecting both your beneficiaries and the people who give up their evenings to serve them.

What Goes Into a Charity Risk Assessment Template UK Trustees Can Defend

Every usable template begins with a risk register: a numbered list where each row names one specific hazard. Vague entries such as reputational damage help nobody. Write instead that a named volunteer drives beneficiaries in a private car with no business-use cover, or that the summer fair cash float sits overnight in the treasurer spare room.

Five columns carry the weight: risk description, likelihood, impact, existing controls, and further action with a named owner and a deadline. Add a sixth for the residual score once controls are applied. Boards that skip the owner column find the same red-rated risks unchanged three meetings later, and independent examiners notice that pattern immediately.

Group entries under four standard headings: governance, operational, financial and external. Governance covers trustee recruitment, conflicts of interest and quorum failures. Operational covers premises, events and safeguarding. Financial covers reserves, restricted funds and fraud. External covers grant withdrawal, local authority budget cuts and utility bills that can double within a single contract renewal.

Anyone researching how to set up a charity should build this register before the first funding application rather than afterwards. Grant assessors at bodies like the National Lottery Community Fund routinely ask for a current register, and an empty one signals inexperience far faster than a modest bank balance ever does.

The Six Columns That Do the Real Work

• Risk reference and description: one hazard per row, written as a specific scenario
• Likelihood: scored 1 to 5, based on how often the event has occurred locally
• Impact: scored 1 to 5, covering financial loss, harm to people and loss of trust
• Existing controls: what already reduces the risk, such as two-signature banking
• Further action, owner and target date: the column that drives actual change
• Residual score and review date: proof the board revisited the entry

Keep the whole register on one landscape page. A community charity with an income under fifty thousand pounds rarely needs more than eighteen to twenty-five live rows, and a shorter register that trustees genuinely read beats a comprehensive one that lives unopened in a shared drive folder.

Scoring Risk With a Five by Five Matrix Without Overcomplicating It

Multiply likelihood by impact and you get a score between one and twenty-five. That single number lets a board sort twenty rows in seconds and decide where the limited volunteer hours go. Colour the bands green, amber and red so the priorities are obvious even to a trustee joining their first meeting.

Be honest about impact in pounds. For a group with reserves of four thousand pounds, a stolen laptop worth eight hundred is a moderate hit; a successful mandate fraud draining the current account is existential. Anchoring impact scores to your actual reserves figure stops boards from rating everything a three.

Record the residual score after controls, not just the raw one. A gross score of twenty falling to eight because two signatories and a monthly bank reconciliation are in place is exactly the evidence a funder or insurer wants when they ask how your board manages financial exposure across the year.

Adapting the Template to Fetes, Halls, Gardens and Street Schemes

The same grid flexes across every activity a community organisation runs. Trustees planning how to run a village fete should open a separate event tab with rows for crowd numbers, gazebo anchoring in wind, hot food handling, generator cabling, cash handling and a lost child procedure agreed with stewards before the gates open.

Premises risks deserve their own cluster. The village hall hire cost uk committees charge typically ranges from eight to twenty-five pounds an hour, or roughly one hundred and twenty to three hundred pounds for a full day with a licensed bar. Every hire agreement should specify who holds public liability cover, usually five to ten million pounds, and who locks up.

Growing projects carry quieter hazards. Groups starting a community garden uk-wide face soil contamination on former industrial plots, tool storage theft, water butt hygiene and lone working on dark winter afternoons. A soil test costing sixty to one hundred and fifty pounds is cheaper than discovering lead levels after the first vegetable harvest reaches families.

Street-level schemes need the register too. Anyone weighing a neighbourhood watch scheme how to start question should log data protection risks around resident contact lists, the danger of members confronting suspects directly, and the reputational exposure of a WhatsApp group where unverified allegations about neighbours circulate unchallenged and unmoderated.

Events, Stalls and Public Liability

Insurers usually want your event risk assessment at least fourteen days ahead. Small charity policies commonly run between one hundred and fifty and four hundred pounds a year, rising sharply once bouncy castles, fairground rides or fireworks appear. Attach stall holder certificates to the register so evidence sits in one folder rather than four inboxes.

Safeguarding, Volunteers and Food Projects in the Register

People risks outrank property risks in almost every community charity. Anyone asking how to volunteer at food bank sessions should expect a written role description, two references, an induction covering confidentiality, and supervision arrangements. Your register should show which roles are eligible for enhanced DBS checks and who tracks their renewal dates.

Food projects add regulated hazards. Understanding the uk food bank referral process matters because vouchers issued by schools, health visitors and support workers carry sensitive personal data, and a mislaid referral form is a reportable breach. Log allergen labelling, cold chain temperatures and stock rotation as separate operational rows with named owners.

Surplus food schemes need the same discipline. Explaining community fridge how it works to new volunteers means covering the two-hour rule for chilled items, daily temperature logs, refusal of cooked leftovers and clear signage. Trustees exploring how to become a school governor often import that structured approach to safeguarding straight into their charity board work.

Reviewing, Recording and Reporting Your Risk Register

Put the register on the agenda at least quarterly and minute the decisions. Boards that borrow the discipline behind parish council meeting rules uk residents rely on, such as published agendas, declared interests and recorded votes, produce minutes that stand up years later when a funder or examiner asks who approved a particular control.

Trading activity deserves a dedicated section. Groups studying the best charity shops in london for ideas on retail margins should also copy their controls: till reconciliation twice daily, manual handling training, PAT testing on donated electricals, and a written policy on donating clothes to charity uk supporters leave outside the shutters overnight.

Finally, tie the register to your annual report. A well-kept charity risk assessment template uk boards maintain year-round makes the required risk statement in the trustees annual report a fifteen-minute job rather than a scramble, and it gives new trustees an instant map of where the organisation is genuinely exposed.

How Often Should Trustees Review the Charity Risk Register?

Quarterly review works for most community charities, with a fuller annual rewrite before the accounts are signed off. Between those points, three triggers should force an immediate update: any new activity such as a first public event, any change of premises or lease, and any incident or near miss, however minor it seemed at the time. A group running weekly sessions might also add a light monthly check of the red-rated rows only, which takes five minutes at the start of a committee meeting. Record the review date in the register itself so an examiner can see the document has been actively maintained rather than written once and quietly forgotten.

Is a Written Risk Assessment a Legal Requirement for Small UK Charities?

Two separate obligations apply. Under health and safety law, any organisation with five or more employees must record its significant findings in writing, and the assessment itself is required regardless of headcount. Separately, charities above the audit threshold must include a risk statement in their trustees annual report confirming that major risks have been reviewed and systems established to manage them. Below that threshold the statement is not compulsory, but the underlying trustee duty to act with reasonable care and skill still applies, and volunteer-run groups without employees remain exposed to claims. In practice, insurers, local authorities and grant funders all request a written register, so the document becomes a functional requirement well before it becomes a statutory one.

What Risks Do Small Community Charities Most Often Miss?

Four gaps appear repeatedly. First, single-person financial control, where one volunteer holds the card, the passwords and the paperwork with no second signatory or independent check. Second, lapsed insurance and expired safety certificates, particularly gas, electrical and PAT records on inherited hall equipment. Third, data protection: membership spreadsheets, referral forms and photograph consents stored on personal devices with no retention schedule. Fourth, key person dependency, where one long-serving organiser knows every supplier, password and funder contact, leaving the charity paralysed if they step down suddenly. Add all four to the register as named rows with owners and deadlines, and most small organisations remove their largest exposures within a single funding year.