Do charities have to have a risk register, and what goes in it?

England and Wales: This page sets out the position in full. Scotland: partly covered — OSCR’s rule on when to escalate a problem is established, and it differs sharply from England’s; the annual-report risk statement is settled: it reaches Scottish charities through the SORP, for charities in SORP Tier 2 or above, so do not read the England and Wales requirement across. Northern Ireland: partly covered — CCNI’s own good-practice position is established; the annual-report risk statement is settled: it reaches Northern Ireland charities through the SORP, for charities in SORP Tier 2 or above.

Is the Charity Commission’s risk guidance current?

No. The Charity Commission’s own guidance, CC26, dates from June 2010. Its audit figure is out of date. This page covers charity risk management for trustees in England and Wales, Scotland and Northern Ireland.

The register comes after the rest of this hub’s set-up work, because it records what each piece controls. That work is the liability position, the decision and delegation framework, and the policies on safeguarding, financial controls, reserves and data protection.

CC26, Charities and risk management, is Tier A guidance. It still states the audit threshold as it stood in 2009. It also refers to the company-law “business review”, a term replaced in 2013.

We say so on the page, not just in our notes. Anyone working from CC26 deserves to know its date. An official source is not always a current one. Check the last-updated date on every guide you rely on, including ours.

Use CC26 for the method. That is how a board finds, rates, owns and reviews a risk. Do not take the trigger figure from it.

The current audit threshold in England and Wales is £1,000,000 for financial years ending before 30 September 2026; £1,500,000 for financial years ending on or after 30 September 2026. Your own financial year decides which of those two figures applies to you. Today’s date does not. Determine your external scrutiny requirement works the full test, including the asset limb.

Who must include a risk statement in the annual report?

The trustees’ annual report must contain a risk statement only where the charity is an auditable charity. The Charities (Accounts and Reports) Regulations 2008, reg 40(2)(b)(ii), verbatim:

“in the case of a charity which is an auditable charity, be a review of the significant activities undertaken by the charity during the relevant financial year … including — … (ee) a statement as to whether the charity trustees have given consideration to the major risks to which the charity is exposed and satisfied themselves that systems or procedures are established in order to manage those risks”.

For everyone else, reg 40(2)(b)(i) asks for something much shorter. It reads: “a brief summary setting out— (aa) the main activities undertaken by the charity to further its charitable purposes for the public benefit; and (bb) the main achievements of the charity during the year.” No risk statement.

Read those two limbs together. The exclusion is often described wrongly. Smaller charities are outside the risk statement because of where the requirement sits in reg 40(2)(b). It appears only in limb (ii). It is not reg 40(7) that lets them off.

Reg 40(7) lists only sub-paragraphs (j), (k), (m), (n), (o) and (q) of paragraph (3). The risk statement is in none of them. Published summaries often get this wrong. Check any source that cites reg 40(7) for this point.

Smaller charities are often told they are “encouraged”, not required. That is CC26’s word, not the Regulations’.

None of that touches the underlying duty. One of the trustee duties CC3 sets out is to manage the charity’s resources responsibly. Not exposing the charity to undue risk is part of it. That duty carries no income threshold.

A trustee who breaches it can be personally liable to the charity for the loss. The six trustee duties explainer shows where each duty comes from. It also shows what each duty exposes you to.

So a charity below the audit threshold is right that the statutory statement does not apply to it. It is wrong if it thinks that risk does not.

What goes in a charity risk register?

No statute sets a list of contents, in any of the three nations. Nothing sets a format, a scoring scale or a number of rows. At the reporting end, the Regulations ask for two narrow things:

• whether the trustees considered the major risks
• whether they satisfied themselves that systems are in place to manage them

Those two points shape the register better than any template. To answer them honestly at the year end, a board needs four things for each significant risk:

• a plain account of what could go wrong
• who owns it
• what is already in place
• what the board has decided to do, or to accept

A risk register is the board’s record of those four things for each significant risk, kept up to date between meetings. Keeping it current through the year is covered in build and maintain your risk register.

Two working points follow from the Regulations’ wording, not from convention:

• The statement is about the major risks, not all of them. Say a register lists forty risks with no sense of which are the principal risks. That makes the year-end statement harder to write, not easier.
• “Satisfied themselves that systems or procedures are established” is a test about controls, not about worry. A risk with no named control and no owner has not been managed. It has been noticed.

The Charity Governance Code goes further than the Regulations, in its principle on managing resources and risks. It says the board should make sure that control and risk frameworks “are effective, and review them regularly”. That is a should. The Code is not a regulatory requirement, as assess yourself against the Charity Governance Code explains.

But it gets the failure mode right. A register built once and never opened again is the most common way this goes wrong.

Must you tell the regulator when a risk becomes a real problem?

Not in the same way across the UK. England and Wales expects serious incidents to be reported. Scotland asks only about issues left unresolved.

This is the sharpest cross-border difference anywhere in this hub. A charity working on both sides of the border can get it exactly backwards.

In England and Wales, there is no freestanding offence of failing to report a serious incident. Reporting is good practice. In the Commission’s own words: “As a matter of good practice, all charities, regardless of size or income, should report serious incidents promptly.” The statutory teeth sit somewhere else. They bite at a different time.

The annual return carries a declaration that nothing reportable went unreported. That return is statutory under Charities Act 2011 s.169. Giving the Commission false or misleading information is an offence under s.60. The method is covered in recognise a serious incident and make a serious incident report. This page only flags where it sits.

In Scotland, OSCR abolished its Notifiable Events regime on 1 April 2024. Its current position, verbatim:

“If an issue has been dealt with effectively and the problem has been resolved, there’s no need to notify OSCR. If, however, it is not possible to address any serious issues, or if these issues have not been dealt with in a satisfactory way, charities and trustees should report this to us through our raise a concern form.”

That is the opposite of the England and Wales position. Say a Scottish charity met a serious problem and resolved it well. It has nothing to tell OSCR. The same charity in England and Wales must still be able to answer the annual return question honestly. That is so whether or not it handled the incident well.

Take a risk register with a UK-wide “when to tell the regulator” column. It is wrong in at least one jurisdiction.

In Northern Ireland, the escalation position was not established for this step. Do not read the England and Wales or the Scotland position across.

Scotland: the statement arrives through the SORP

The Charities Accounts (Scotland) Regulations 2006 have no risk-statement clause of their own. They reach the statement another way.

A charity preparing fully accrued accounts produces a statement of account, and regulation 8(1)(e) makes the annual report part of it. Regulation 8(3) sends that statement of account to Schedule 1. Paragraph 1 of Schedule 1 then requires it to follow the SORP.

The SORP carries the statement (see SORP 2026 and the three tiers). Paragraph 1.43 of SORP 2026 requires each charity in Tier 2 or above to describe its principal risks and its plans for managing them. New in the 2026 edition, that paragraph names cyber among the risks the description covers, alongside risks arising from environmental issues. So a Scottish charity needs the statement only if it prepares fully accrued accounts and is in SORP Tier 2 or above.

One caveat. The 2006 Regulations exist on legislation.gov.uk only in their original form. Not every amending instrument since was traced one by one.

Northern Ireland: good practice, and no size trigger found

CCNI’s position is a recommendation rather than a requirement. Guide 5 tells trustees they should develop a risk-management policy. It treats a central risk register as optional: “you might also have” one. No income-based or size-based trigger for either appears anywhere in the guidance read.

That is a weaker obligation than England and Wales imposes on audited charities, and stronger than nothing. The Northern Ireland accounts regulations do carry a risk statement, through the SORP rather than a clause of their own. The route is regulation 33(2)(b) of the Charities (Accounts and Reports) Regulations (Northern Ireland) 2015.

A charity preparing a statement of accounts must follow the SORP in its annual report, so the SORP’s Tier 2 risk description applies. A charity preparing receipts and payments accounts reports under regulation 32, which has no risk item. In Northern Ireland the audit threshold and the SORP Tier 1 ceiling are the same figure, so an audited non-company charity is usually in Tier 2 as well. The trigger is still the SORP tier, not the audit.

Common mistake: taking the audit threshold figure from CC26

CC26 is the Commission’s own risk guidance. So it looks reliable on the trigger as well as the method. It is not. CC26 is dated June 2010 and states the threshold as it stood in 2009. The guidance also refers to the company-law “business review”, a term replaced in 2013.

Use CC26 for the method. Take the threshold from determine your external scrutiny requirement. That step has the current figures and the asset limb.

Common mistake: building a register and never reviewing it

The register gets treated as a document to produce, not a process to run. Usually that is because it was made for a funder or an examiner and then filed.

The Charity Governance Code has a principle on managing resources and risks. It expects the board to make sure that control and risk frameworks are effective, and to review them regularly. Take a register nobody has opened since it was written. It cannot support a year-end statement that the trustees have satisfied themselves anything is in place.

Worked example

Tollgate Youth CIO has one employee. Its income is in the small band, well below the audit threshold. Its treasurer reads that a risk statement is required only for audited charities. The treasurer decides that Tollgate does not need a risk register.

Half right. Tollgate’s annual report does not need the statement. Reg 40(2)(b)(ii) does not reach it. Its report falls under limb (i) instead.

But Tollgate still has the duty to manage the charity’s resources responsibly. That duty includes not exposing the charity to undue risk. It applies to Tollgate exactly as it applies to a charity ten times its size.

Tollgate has three concentrated risks:

• it has an employee
• it works with young people
• it depends on a handful of grants

Not having to make the statement makes none of them smaller.

The register Tollgate builds is short. That is the right outcome: proportionate, not absent.

With the register in place, the next step is to assess yourself against the Charity Governance Code.