Does safeguarding really apply to a charity like mine?

England and Wales: This page sets out the position in full. Scotland: covered, and the answer is the same — OSCR grounds the expectation in the general trustee duties, in its own words — but the registration timing point below does not apply, because OSCR’s application carries no safeguarding declaration. Northern Ireland: covered — CCNI puts it more firmly, saying a charity working with children, young people or adults at risk of harm “must” have safeguarding arrangements; whether CCNI’s registration form carries a safeguarding declaration is not known.

Safeguarding applies to every charity: the Commission’s own words

The Charity Commission has answered this in its own words. The answer covers every charity: safeguarding should be a key governance priority, regardless of size, type or income. This step is for the trustees and the chair. It opens the safeguarding part of this hub: the checking, policy and reporting pages that follow all start from it.

The Commission’s words govern England and Wales. OSCR in Scotland and CCNI in Northern Ireland take the same line, covered below. The sentence comes from the Commission’s guidance on reporting serious incidents. Verbatim:

“Protecting people and safeguarding responsibilities should be a key governance priority for all charities, regardless of size, type or income, not just those working with children or groups traditionally considered at risk. A charity should be a safe and trusted environment and trustees must take reasonable steps to protect the people who come into contact with their charity through its work from harm.”

Before you register. If your charity will work with vulnerable people, including children, the checks the law requires must be done before any trustee signs the declaration. That declaration is in the Commission’s registration guidance (CC21b). Planned is not enough. The declaration is written in the past tense: that the trustees “have carried out all necessary checks required by law”.

Signing it knowingly or recklessly before that is true is an offence under Charities Act 2011 s.60(1). The registration page sets out that offence and what it carries: put your first policies in place. This timing rule is England and Wales only. OSCR’s registration has no equivalent declaration, and the Northern Ireland position is open.

Two parts of that sentence close off the usual excuse. It is not only about children or “groups traditionally considered at risk”. And it is not only about the people you exist to help.

The Commission’s core safeguarding guidance says who the duty covers, verbatim: “people who benefit from your charity’s work; staff; volunteers; other people who come into contact with your charity through its work.” Your own volunteers are on that list. So are your staff. So are your beneficiaries.

Note where the sentence lives. It is in the guidance on serious incidents, not the main safeguarding guidance. If you quote it to your board, cite the right one.

The sentence uses both of the Commission’s words, and they mean different things. The Commission publishes its own key: “‘must’ means something is a legal or regulatory requirement or duty that trustees must comply with; ‘should’ means something is good practice that the Commission expects trustees to follow.” So on the Commission’s own terms, putting safeguarding near the top of the board’s list is good practice it expects. Taking reasonable steps to keep people from harm is a duty.

Whether you need a written policy is a different question, with a different answer: Is a written safeguarding policy legally required for a charity?

What the regulator looked for, and did not find

The Commission’s inquiry into SPAC Nation shows what the regulator looks for: safeguarding as a regular item in the trustees’ minutes. The Commission investigated Salvation Proclaimers Ministries Limited, known as SPAC Nation. Its report says, verbatim:

“The inquiry was concerned about the trustees’ oversight of safeguarding, which was not an agenda item on the trustee board minutes provided to the inquiry apart from once where a policy review was listed. It is difficult to see how the trustees could be assured those coming into contact with the charity were adequately protected if safeguarding oversight was not discussed regularly at trustee meetings.”

Read what the regulator did there. It asked for the minutes. It looked for safeguarding as an agenda item. The regulator found it once, as a policy review.

The inquiry found the trustees had not put their own safeguarding policies into practice. It called that misconduct and/or mismanagement. Trustees were disqualified, and the High Court wound the charity up.

That tells you exactly what evidence a trustee needs. Not a longer policy — a board that discusses safeguarding regularly, and minutes that show it. That costs nothing, and you can check it tonight.

Two other inquiries show the same pattern. At Ampleforth Abbey Trust, trustees had not reported serious abuse allegations to the Commission at the time. The inquiry found that was mismanagement.

One person was disqualified as a trustee by a Commission order under Charities Act 2011 s.181A. That report has since been archived under the Commission’s archiving policy.

At Oxfam GB, the Commission’s own publication page says the charity “failed to meet promises on safeguarding”. The Commission issued an Official Warning under s.84.

The Commission is not a safeguarding authority

The Charity Commission does not investigate abuse allegations. Most people assume the charity regulator does. Its guidance says so in terms, verbatim: “The Commission is not a safeguarding authority. We do not investigate individual allegations of abuse, decide whether any allegations are true or bring prosecutions.”

What it looks at is how the trustees behaved. The local council and the police are the bodies that look into allegations. So telling the Commission about an incident is not the same as telling anyone who will look into it. The pages later in this hub set out who is told and when: make the reports, and know which are legal duties.

Scotland and Northern Ireland

Scotland. OSCR takes the same line, in its own words. It rests on the general trustee duties in the Charities and Trustee Investment (Scotland) Act 2005, not on a safeguarding law. Its guidance says, verbatim: “Any failure by charity trustees to manage safeguarding risks adequately can be a failure in charity trustee duties and would be of serious regulatory concern to OSCR.”

OSCR is not a safeguarding authority either. In its words, it “is not responsible for dealing with incidents of actual abuse and does not oversee safeguarding legislation.”

The one hard legal rule in Scotland is PVG scheme membership for regulated roles. It is often put as a duty on individuals alone. It is not.

Scotland has four membership offences. The organisation itself commits one of them.

Under s.45D of the Protection of Vulnerable Groups (Scotland) Act 2007, it is an offence to offer a regulated role without first receiving a disclosure confirming the person is a scheme member. The Scottish checks page covers all four: run the check in Scotland or Northern Ireland.

Northern Ireland. CCNI’s Guide 5 is firmer than either of the other regulators. Its words:

"If your charity works with children, young people or adults at risk of harm, you must put in place appropriate safeguarding arrangements. Safeguarding means protecting their health, wellbeing and human rights; enabling them to live free from harm, abuse and neglect. Safeguarding arrangements include: staff and volunteer checks; policies and procedures; training for all staff and volunteers on what to do if they have concerns about the safety or welfare of a child, young person or adult at risk of harm."

CCNI’s own key says it uses “must” “where a charity has to comply with a specific law or regulation”. So in Northern Ireland the regulator’s words are stronger. It also names what the arrangements include: checks, policies and procedures, and training.

Put it on the agenda and on the risk register

The deliverable is small on purpose. Two entries, both free.

1. A standing item on every trustee agenda. Not “when needed”. Every meeting, minuted, even if the minute says there is nothing to report. That is the thing the SPAC Nation inquiry looked for. Setting a standing agenda is covered in Set your meeting rhythm, quorum and standing agenda. A template is on the way: Standing agenda (planned).
2. An entry on the risk register, with a named owner. Who should hold safeguarding for the board is covered on appointing a safeguarding lead. The risk is to people, not only to the charity’s reputation, so describe it that way. Building the register is covered in Build your risk register. A template is on the way: Risk register (planned).

Once that is done, the next question is which of your roles need a criminal record check. In England and Wales and in Northern Ireland, that starts with Is this role in regulated activity? In Scotland it starts with running the check in Scotland or Northern Ireland. The policy itself comes after that, on write a safeguarding policy.

Common mistake: “We don’t work with vulnerable people, so safeguarding isn’t really our issue”

Safeguarding is associated with children’s charities and care providers. So everyone else assumes it is someone else’s subject. The Commission has closed this off in terms: “regardless of size, type or income, not just those working with children or groups traditionally considered at risk”. And the people it protects include your own staff and volunteers.

Common mistake: having a policy but never discussing safeguarding at board level

The policy gets treated as the deliverable. In SPAC Nation the inquiry’s stated concern was that safeguarding oversight “was not an agenda item on the trustee board minutes”. Inadequate implementation was found to be misconduct and/or mismanagement, and trustees were disqualified.

Common mistake: believing the Charity Commission investigates abuse allegations

The Commission is the charity regulator. So people assume it is the safeguarding authority too. Its own words: “The Commission is not a safeguarding authority.” The local authority and the police investigate. The Commission looks at what the trustees did. Reporting to the Commission is not reporting to an investigating authority.

Worked example

Wrenfield Village Hall’s committee runs a weekly lunch club for older people and lets the hall to a toddler group on weekday mornings. Safeguarding has never appeared on its agenda. The committee’s view has always been that it is a hall, not a care provider.

Every part of that view runs into the Commission’s sentence. The duty applies regardless of size or type. It covers the committee’s own volunteers, who serve the lunches, as well as the people who come to the club.

And the SPAC Nation report shows what a regulator would look for in Wrenfield’s minutes if something went wrong: safeguarding as a regular item. It would find nothing.

The fix took one meeting. The committee added safeguarding as a standing item on every agenda. It entered it on the risk register, with the chair as the named owner. Neither step cost anything, and both are now visible in the minutes.