Risk register

A risk register is how trustees get a grip on what could go wrong. Rather than carrying worries around informally, you write down the significant risks, judge how likely and how damaging each would be, and record what you are doing to manage them.

Charities that are required to have an audit must include a risk management statement in their Trustees’ Annual Report, confirming that the major risks have been reviewed and are being managed. (Source: Charities SORP; GOV.UK, Charity Commission risk guidance (CC26), accessed 9 July 2026.) Smaller charities are not obliged to keep a formal register, but trustees’ duty to manage resources responsibly makes one the sensible tool.

Keep it short, score each risk, assign an owner, and review it at least yearly. Pair it with the Charity Governance Code and see the Trustee & Governance Handbook for a ready-to-use template.