Does a charity have to have a written financial controls policy?

England and Wales: This page sets out the position in full. Scotland: the same position, with no difference in principle — OSCR files financial controls under good practice and keeps its legal-duty list for accounting records, accounts, scrutiny and submission. Northern Ireland: partly covered — CCNI’s good-practice framing and the underlying accounting-records duty are established; whether CCNI would treat a named financial controls document as required was neither found nor ruled out. Do not read the England and Wales position across as settled there.

Is a financial controls policy required by law?

No provision requires a charity to hold a written financial controls policy. This page is for trustees and treasurers in England and Wales, Scotland and Northern Ireland. In England and Wales, the Charity Commission’s CC8 applies. It assumes the board has already set up its decision and delegation framework and its authorisation limits and bank mandate: the policy writes those down.

What exists underneath is different and real:

• the duty to keep proper accounting records, under Charities Act 2011 s.130
• the general duty to manage the charity’s resources responsibly

Neither of those is a duty to hold a named document.

The safeguarding policy page sets out the general shape of this distinction. The shape is the same here, so this page does not repeat it. What is specific to financial controls is the gap between three things. Sector checklists run them together:

• CC8 is the Commission’s guidance on internal financial controls. It is written throughout in the language of what trustees should do. Guidance, not law.
• The annual return asks whether each of 13 named policies and procedures was in place at the period end. Internal financial controls is one of them. The Commission separately says it expects most charities to have 6 of those. Internal financial controls is in the shorter list too, which is not true of every item on the form.
• Funders attach it as a condition of the money. That is the one that compels, and only for the funder that says so.

So the honest classification is: not law, regulator expectation, common grant condition. Most charities have one, and there is a good reason to. But the reason is not that a provision demands it.

Do funders require a financial controls policy?

Some do, as a grant condition, but there is no single list of the policies funders require. The National Lottery Community Fund requires, in its standard terms for larger grants, that no single individual has sole responsibility for any single transaction. That is a real contractual requirement. If you hold that funding, it binds you whatever charity law says.

This project read one large funder’s terms directly. They are unusually prescriptive. Generalising from them would misdescribe funders as a class. Check the specific funder's own published grant terms and conditions directly — each funder's own site is Tier A for its own requirements. This hub's own policy-content facts (list.policy.legal-status and its Scotland/NI variants) describe what regulators and general good practice expect; funder-specific extras sit on top of that baseline and vary funder to funder.

How to write a policy your board can operate

Here is the failure that matters, and it is not a failure to have the document.

Template policies assume a segregation of duties that a small charity does not have the people for. Adopt one anyway and every payment breaches it. That is worse than having no written policy at all. The charity now has a document it is visibly not following, and the trustees adopted it.

The controls themselves are designed in set up your financial controls; this section is about the document. Apply one test before adopting anything. Read the draft, and for each control ask whether the charity has enough separate people to do it.

Where it does not, write down the control it can operate, and the reason the fuller one does not apply. Do not adopt a standard that will be breached on the first payment. A proportionate policy the charity follows is better evidence of responsible management than an ambitious one it ignores.

Scotland and Northern Ireland

OSCR and CCNI both treat financial controls as good practice. Neither names a required document.

Scotland. OSCR reaches the same answer and does the classification for you on its own page.

Segregation of duties, written procedures, and banking and cash controls all sit under a “Good Practice” heading. Its separate “Legal duty” list holds four things:

• accounting records
• the statement of accounts
• external scrutiny
• submission to OSCR

None of them is a policy document. The underlying duties are s.44(1)(a) of the 2005 Act for the records, and the s.66(1)(b) duty of care. So trustees should have the controls. Neither OSCR nor the Charity Commission requires a document called a financial controls policy; the Northern Ireland position is below.

Northern Ireland. Two things are established. CCNI’s Guide 5 says trustees should maintain and regularly review a system of internal controls. It frames that as good practice rather than a requirement. The underlying legal duty is the accounting-records duty at s.63 of the 2008 Act.

One thing is not. Whether CCNI would treat a named financial controls document as required was not settled. No guide read in this project’s research names one. But none rules it out as specifically as the England and Wales record does. So this is an open question, not a confirmed negative.

Common mistake: adopting a policy a board of three cannot actually operate

Templates assume a separation of roles that small charities do not have. The National Lottery Community Fund’s own condition requires that no single individual has sole responsibility for any single transaction. A small board reading that will often reach for a template built for a much larger organisation. A policy the charity visibly does not follow is worse evidence than a smaller one it does.

Worked example

Wrenfield Village Hall is applying for a grant. The committee downloads a financial controls policy template and adopts it at the next meeting. The template requires three authorisers for any payment above a threshold. It also says no one may authorise a payment they raised themselves.

Wrenfield has three trustees. One of them is the treasurer, and the treasurer raises every payment. So two authorisers are available, never three.

Every payment above the line now breaches the hall’s own adopted policy. The policy itself is the evidence. Nothing improved; something got worse.

The version that would have worked is shorter. Two authorisers on every payment.

No one authorises a payment they raised. Bank statements are reviewed by the trustee who does not hold the card. A charity this size can keep that control. Keeping it is what the funder and the regulator are both looking for.

With the controls written down, the next step is to adopt a reserves policy.