What should be on our risk register?

England and Wales: This page sets out the position in full. Scotland: covered — the same annual-report statement reaches Scottish charities by a different route: through the SORP, for charities in SORP Tier 2 or above; see below. Northern Ireland: covered — the same SORP route; CCNI sets no categories or format of its own; see below.

The law asks for a sentence, not a register

In England and Wales no law requires a charity risk register as a document, at any level of income. The sector sells templates as if it did.

A risk register is the trustees’ working record of the charity’s risks. What it is for, and the duty behind it, are covered where you build your risk register. The Charity Commission’s guidance expects one.

What the law does require is a statement in the trustees’ annual report. The statement confirms whether the trustees have given consideration to the major risks to which the charity is exposed and satisfied themselves that systems or procedures are established to manage those risks.

That statement is a legal requirement only for an auditable charity: one whose accounts for the year must be audited by law.

In England and Wales an audit is required on gross income above £1,000,000 for financial years ending before 30 September 2026; £1,500,000 for financial years ending on or after 30 September 2026.

It is also required where the aggregate value of assets is above £3,260,000 for financial years ending before 30 September 2026; £5,000,000 for financial years ending on or after 30 September 2026. That asset test applies only where gross income is also above £250,000 for financial years ending before 30 September 2026; £500,000 for financial years ending on or after 30 September 2026.

The SORP adds a second limb (the tiers are explained in SORP 2026 and the three tiers). It requires every charity in its Tier 2 or Tier 3 to describe its principal risks and how it plans to manage them. Those tiers are for charities that prepare accruals accounts with gross income above £500,000. In England and Wales that is the SORP’s rule, not the law’s, for a charity whose accounts do not have to be audited.

New in the 2026 edition, that description names cyber among the risks it covers, alongside risks arising from environmental issues.

If your accounts are not audited (and you are in SORP Tier 1), the statement is good practice rather than law.

That governance step covers the board’s side of this — the trustee duty behind it, the Governance Code and the annual return question. This page is the working document itself: the rows, the owners, the mitigations, the review date, and the statement you draft from it.

Not audited and in SORP Tier 1: the Commission still expects one

“No legal requirement” is not the same as “nobody expects anything”. Two sources say otherwise.

First, the annual return. Its governance section asks which of a list of named policies the charity has. One of them is an internal risk management policy. The same list includes a campaigns and political activity policy and a social media policy.

The list does not include a cyber security policy. Nothing in the return asks about AI. A claim that it does is circulating. The claim is false: the question guide was read end to end.

Second, the Commission’s safeguarding guidance expects risks to be “set out … in a risk register which is regularly reviewed”.

So the expectation has a source. What goes in the register is a separate question. The next three sections answer it from the Commission’s own risk guidance.

What goes in a charity risk register: five categories

The Commission’s guidance on this is Charities and risk management (CC26). It dates from June 2010. It has not been renumbered or withdrawn. The Commission still links to it from guidance it put out in 2026. It applies to England and Wales.

CC26 sorts risk into five categories. CC26 is guidance. So these are what the Commission suggests, not a list you must follow.

Category	The kind of thing CC26 puts in it
Governance	The wrong structure for the charity; trustees without the skills or commitment needed; conflicts of interest.
Operational	Beneficiary welfare and safety; poor contract pricing; weak recruitment or training; security of assets.
Financial	Poor financial information; low reserves or cash flow; dependence on a few income sources; too little insurance.
External	Public reputation; demographic change; economic or political turbulence; changes in government policy.
Compliance	Breaking the law or regulation — breach of trust, or not knowing your duties as an employer.

Two points are easy to miss. Safeguarding has no category of its own: CC26 puts it under operational risk. And damage to reputation is not a category either. It is one of the things you weigh when you score a risk.

Two kinds of risk have their own pages. This page does not repeat them. Financial and reserves risk sit with calculating your free reserves and writing your reserves policy. Safeguarding risk sits with writing a safeguarding policy. Put a row for each on the register. Point the row at the policy that manages it.

The columns: an example format, not a required one

CC26’s Annex 1 sets out an example register. It says so itself: “This template has been created to illustrate a practical way of recording… how this reduction in level might be achieved.”

Its columns are:

1. the risk area, and the risk identified
2. how likely it is to happen, as a score
3. how bad the impact would be, as a score
4. the overall, or “gross”, risk
5. the control in place
6. the risk that remains after the control — the “net” risk
7. how it is monitored
8. who is responsible
9. further action needed
10. the date of review

The useful idea here is the gap between gross and net risk. Gross is the risk before you do anything. Net is what is left once your controls work. A row where the two are the same is a row where nothing is being done.

Use as many or as few columns as helps. What matters is that every row has an owner, a mitigation and a date.

Who owns it, and how often you look at it

The board does. CC26 says: “The responsibility for the management and control of a charity rests with the trustee body.”

Trustees can hand the work of spotting and scoring risks to staff or a committee. They cannot hand over the judgement. They need enough oversight to make the annual report statement with what CC26 calls “reasonable confidence”.

The law does not say how often to review. CC26’s own suggestion: “Annual monitoring by trustees supplemented by interim reports is likely to be sufficient for most charities where operating conditions are stable. Depending on a charity’s risk profile, more frequent monitoring might be advisable.”

Minute each review. The minute is the evidence the statement rests on.

Scotland: the same statement, reached a different way

The Commission’s annual return and CC26 do not apply to a Scottish charity. The rule still reaches Scotland, by another route.

The Charities Accounts (Scotland) Regulations 2006 have no risk-statement clause of their own. Instead, regulation 8(3) sends a charity that prepares fully accrued accounts to Schedule 1. Paragraph 1 of that Schedule requires the accounts to follow the SORP.

Regulation 8(1)(e) makes the annual report part of the statement of account. So the SORP governs the report too. The SORP is a single UK-wide document. It carries the risk statement. So the Scottish rule arrives through the SORP.

That route is still current. The Charities Accounts (Scotland) Amendment Regulations 2025 came into force on 1 January 2026. They updated which SORP the Scottish Regulations point to. They did not change the route.

Fully accrued accounts are the precondition. In Scotland they start at an income of £250,000. OSCR’s own guidance, updated 5 February 2026, says:

“Charitable companies and charities with income of £250,000 or more will always be required to prepare fully accrued accounts.”

The 2010 amending regulations, read directly, give the same figure. OSCR has not followed the 2026 rise in England and Wales.

Accruals accounts alone do not bring in the risk statement. The statement applies only to a charity in SORP Tier 2 or above. That means gross income above £500,000. A Scottish charity with income between the two figures prepares fully accrued accounts in Tier 1. It has no risk-statement requirement.

One caveat, said once. The 2006 Regulations have no consolidated text. Not every amending instrument since 2011 was re-read for a later change to this figure. OSCR’s current guidance makes a later change unlikely.

Northern Ireland: no categories or format of CCNI’s own

CCNI’s “Risk management guide” page does not set out risk categories or a register format. It points to a third-party document: Risk management for charities – getting started, from the Institute of Risk Management’s charity group, dated 2018.

That is a finding from reading the page, not a gap in the reading. CCNI’s wider governance guidance does cover risk. The step to build your risk register covers what it says. The Northern Ireland accounts regulations do carry the statement, through the SORP.

Regulation 33(2)(b) of the Charities (Accounts and Reports) Regulations (Northern Ireland) 2015 applies to a charity that prepares a statement of accounts. It requires the annual report to follow the SORP. The SORP requires the principal-risks description in Tier 2 or above.

A charity that prepares receipts and payments accounts reports under regulation 32. That regulation has no risk item.

Northern Ireland charities can use CC26’s categories and format as a working model. Nothing in the Northern Ireland sources read requires them.

The pages after this one apply by situation, not in order:

• if you work with another organisation, set up a partnership or collaboration agreement
• if money leaves the UK, screen partners and payments against sanctions
• if the charity publicises its work, the rules on using beneficiary stories and images and on campaigning and political activity

Common mistake: believing the law requires a risk register

The sector sells register templates as if the law required them. In England and Wales the register as a document is not required at any income level.

The law requires a statement in the trustees’ annual report, but only if your accounts must be audited. It is a statement that the major risks have been identified and reviewed, and that systems are in place to reduce them.

If your accounts are not audited (and you are in SORP Tier 1), the statement is good practice. Check the basis of the 2026 threshold change for your own financial year before you rely on it.

Common mistake: concluding that if your accounts are not audited (and you are in SORP Tier 1) nobody expects anything

The legal duty gets read as the whole of what is expected. The annual return asks whether the charity has an internal risk management policy. The Commission’s safeguarding guidance expects risks to be set out in a register that is regularly reviewed. The expectation has a source even where the law is silent.

Worked example

Saltmarsh Trust’s board has two questions. The first is whether its risk register is a legal document. The second is what has to be in it.

The answer to the first is no. The register is not a prescribed form. It is the evidence behind the statement.

Whether its trustees’ annual report must carry the statement depends on two things. So the board should check whether its accounts must be audited this year, and which SORP tier it is in. Either way, the annual return will ask whether it has an internal risk management policy.

On the second, the board works through CC26’s five categories. Governance: a trustee body short on commercial skills now that it owns a trading subsidiary. Operational: the subsidiary’s contracts. External: a policy change that affects its main service.

Each row gets a gross score, a control, a net score and a named owner. Financial and safeguarding rows point to the reserves and safeguarding policies instead of repeating them.

The outcome is a register with an owner and a mitigation against every entry. The board has minuted how often it will review the register. Where the accounts are audited, or the charity is in SORP Tier 2 or above, the trustees’ report statement is drafted from the register.