Charity risk register example (scored)

A risk register is how trustees get a grip on what could go wrong. Rather than carrying worries around informally, you write down the significant risks, judge how likely and how damaging each would be, and record what you are doing about them. The best way to understand one is to see it filled in, so this page shows a scored example register for a medium-sized charity, a simpler one for a small charity, and notes on how to score and use it. Both charities and all the scores are illustrative and fictional.

Charities that are required to have an audit must include a risk management statement in their Trustees’ Annual Report, confirming that the major risks have been reviewed and that systems are in place to manage them. (Source: Charities SORP; GOV.UK, Charities and risk management (CC26).) Even where that duty does not apply, keeping a register is the simplest way for trustees to show they are meeting their duty to manage risk.

How to read a risk register

A register has a row for each significant risk and a few columns: a description of the risk, its likelihood and its impact (each scored, here from 1 to 5), a combined score, who owns it, and what is being done to reduce it. The score shows where to focus — a risk that is both likely and serious scores highest. Some registers add the “residual” risk left after mitigation, so trustees can see whether their actions have brought the risk down far enough. Read down the score column first to see the charity’s biggest exposures.

It is worth distinguishing the risk before and after your mitigations. The “inherent” risk is how bad things would be if you did nothing; the “residual” risk is what remains once your controls are in place. A register that shows both makes clear whether your mitigations have actually brought a risk down to a level the trustees can accept, or whether more needs doing. For a small charity a single score is fine; larger charities often record both.

A worked, scored risk register (medium charity)

Brightway Futures is a fictional medium-sized charity that employs staff, relies on a few large funders, and works with young people. Its register covers the areas most likely to cause a charity serious harm — finance, safeguarding, governance, data and reputation. Likelihood and impact are each scored 1 (low) to 5 (high); the score is the two multiplied. (All scores are illustrative.)

Risk	Likelihood (1–5)	Impact (1–5)	Score	Owner	Main mitigations
Loss of a major funder (funding concentration)	3	5	15	Treasurer / CEO	Diversify income; maintain 3 months’ reserves; build a funding pipeline; early renewal talks.
Safeguarding incident involving a young person	2	5	10	Safeguarding lead / board	Safeguarding policy; DBS checks; training; named lead; clear reporting route; serious-incident process.
Data breach of beneficiary records (incl. cyber)	3	4	12	Operations manager	Access controls; staff training; backups; minimal data held; incident plan; ICO 72-hour reporting.
Cash-flow shortfall (grants paid in arrears)	3	4	12	Treasurer	Cash-flow forecast; reserves buffer; negotiate advance payments; monitor monthly.
Loss of key staff or over-reliance on one person	3	3	9	CEO / board	Document key processes; cross-train; succession planning; fair pay and support.
Reputational damage (e.g. poor outcomes or complaint)	2	4	8	CEO / board	Quality monitoring; complaints procedure; honest reporting; media protocol.
Non-compliance with charity/company filing deadlines	2	3	6	Treasurer / secretary	Compliance calendar; two people with filing access; early preparation of accounts.

This register would also feed Brightway’s Trustees’ Annual Report. As a charity preparing accruals accounts, it must state that its major risks have been reviewed and are being managed, and a register like this is the evidence behind that statement — see the Trustees’ Annual Report worked examples.

How to score risk

Score each risk twice: how likely it is to happen (1 = very unlikely, 5 = very likely) and how serious the impact would be if it did (1 = minor, 5 = severe). Multiply the two for a combined score out of 25. The score is a guide to priority, not a precise measurement — its value is in making trustees compare risks and agree which matter most, so do not agonise over whether something is a 3 or a 4.

Many charities colour the scores to see priorities at a glance: red for high, amber for medium, green for low. For the highest-scoring risks, the key question is not just “how bad could this be?” but “what are we actually doing about it, and is that enough?” — reducing the likelihood, limiting the impact, or consciously accepting the risk. Recording the residual risk after your mitigations shows whether your actions have done the job.

A simpler version for a small charity

A very small charity does not need all this. Oakvale Befriending, our fictional befriending charity, could keep a five-row register covering the handful of risks that could genuinely stop it operating — and review it once a year at a trustee meeting. It might look like this. (Illustrative scores.)

Risk	Likelihood	Impact	Score	Main mitigations
Loss of the main local grant	3	5	15	Hold 3–6 months’ reserves; apply to two new funders each year.
Safeguarding concern about a vulnerable older person	2	5	10	Safeguarding policy; volunteer DBS checks and training; named lead.
Loss of the part-time coordinator	2	4	8	Document key tasks; a trustee able to cover; recruit early.
Not enough volunteers to meet demand	3	3	9	Ongoing recruitment; partnership with the local volunteer centre.
Personal data of beneficiaries mishandled	2	3	6	Keep records secure and minimal; simple data protection policy.

What makes a risk register useful

The difference between a register that protects a charity and one that just sits in a folder comes down to a few things: it names the risks that could genuinely cause serious harm, it is honestly scored, every risk has an owner and specific mitigations, and — above all — the trustees actually look at it. A register written once to satisfy a funder and never reopened is worse than useless, because it creates a false sense that risk is being managed.

The commonest failings are the opposite of those strengths: a register of trivial operational risks that misses the big ones such as funder loss, safeguarding and data; vague mitigations like “monitor the situation” that no one can be held to; scores that are all low because no one wanted to admit a real exposure; and no evidence the board ever discussed it. Avoid these and even a simple five-row register earns its place.

How to build and use yours

Build your register by listing the risks that could genuinely damage the charity — across finance, safeguarding, governance, operations, data and reputation — then score each for likelihood and impact, assign an owner, and note what you are doing about it. Keep it to the risks that matter, and be honest: a register full of low scores usually means no one has thought about it properly.

Draw the risks from the people who would see them first. Ask staff and volunteers what worries them, look back at near misses and complaints, and think through “what would stop us operating?”. Trustees bring the governance and financial risks; frontline staff and volunteers often spot the safeguarding and operational ones. Between them you will name the risks that matter far better than one person filling in a template alone.

The register only works if it is used. Make it a standing item at board meetings, review it at least yearly and whenever something significant changes, and update it after any near miss or serious incident. See the underlying ideas in the risk register glossary entry, the wider approach in the Trustee & Governance Handbook, and use the risk register template to start your own. Serious incidents that do occur may need reporting to the Charity Commission — see serious incident reporting.

Last reviewed: July 2026 · Reviewed by Ivan Siyanko. Both examples and all scores are illustrative and fictional; do not reuse the scores as benchmarks.