Someone has disclosed abuse. What do I do now?

England and Wales: This page sets out the position in full. Scotland: covered in part, and different in structure — the guidance gives a numbered referral benchmark for adults but only “without delay” for children, and the two instructions this page leads with were searched for in Scottish guidance and not found. Northern Ireland: covered in part — the instruction not to promise secrecy is confirmed; an instruction not to tell the person concerned, and any response-time benchmark, were not found in the part of the guidance that could be read.

The two things not to do

After a disclosure of abuse, the Charity Commission’s guidance for charities in England and Wales gives two instructions that cut against instinct. Do not promise confidentiality, and do not tell the person concerned until you have taken advice. This step is for whoever receives the disclosure — the safeguarding lead, a manager or any member of staff. If the charity has a safeguarding policy, follow its procedure alongside this page. Scotland and Northern Ireland differ, covered at the end.

Both of these feel wrong in the moment. A decent person wants to reassure someone who is frightened, and wants to be fair to someone who is accused. The guidance on reporting safeguarding concerns in a charity tells you to resist both, in these words.

Do not promise to keep it confidential.

“Don’t promise to keep information confidential between you and them. Refer to and follow your organisation’s policy and procedures to make sure information is only shared with people who need and have the right to know.”

You can promise to take it seriously, and to tell only the people who need to know. But you cannot promise secrecy, because you may have to pass it on. Breaking a promise later does more harm than not making it.

Do not tell the person the concern is about — not yet.

“You should not inform the person about whom there is a concern until you have taken advice.”

This one appears twice in the guidance. Telling them early can put the person who disclosed at risk, and it can damage what the police or the council later need to do. Fairness to the accused comes later, through the proper process. It does not come from a warning.

What to do after a disclosure of abuse, in order

1. Keep people safe. The guidance says: "In an emergency, call the Police. If someone is at immediate risk of harm call 999 and request the Police."
2. Listen. Let them tell you in their own words. Do not press for detail and do not investigate.
3. Do not promise confidentiality. You can promise to take it seriously.
4. Write it down the same day. What was said, in the words used, when, by whom, and what you did. Keep your opinions out of it.
5. Take protective action if the risk is immediate. The guidance says: "If there is an immediate risk then action should be taken to put safeguarding measures in place, for example the suspension of the individual that this concerns."
6. Refer it. The guidance says, verbatim: “You must make appropriate referrals and consultations to your local Safeguarding Adults Board or Safeguarding Children Partnership within 24 hours.”
7. Do not tell the person concerned until you have taken advice.
8. Decide about their role. The guidance says: "You must make a clear decision on the individual's suitability to continue their role in your charity."

Who in the charity receives that record is settled when you appoint a safeguarding lead.

One more instruction people often miss. Old information and anonymous information still count. In the guidance’s verbatim words: “Action must be taken no matter if the information you received is non-recent or from an anonymous source.”

The referral benchmark is guidance, not law

The referral benchmark is real, and you should work to it. But it is not a legal deadline. Know that before you worry about missing it by an hour.

The guidance states it as a must. It also states it twice, with a small difference. After the benchmark, one version ends “as you should take action promptly” and the other ends “as you must take action promptly”. The quotation in step 6 of the list uses neither ending.

No statute behind the benchmark has been found. The statutes most often assumed to contain it were read at source and ruled out:

• Safeguarding Vulnerable Groups Act 2006 ss.35–38: no 24-hour duty.
• Female Genital Mutilation Act 2003 s.5B: imposes a one-month duty on named professionals, not a 24-hour charity duty.
• Terrorism Act 2000 s.19: 'as soon as is reasonably practicable', not a fixed 24 hours.
• Protection of Vulnerable Groups (Scotland) Act 2007 s.9: a three-month duty, not 24 hours.

The Children Act 2004 and section 42 of the Care Act 2014 were also checked. No hook was found in either.

So treat the benchmark as what it is: the regulator’s clear expectation, and a sensible one. If you miss it, write down why. Never let it stop you referring late rather than not at all.

Don’t investigate: that is not your job

The instinct is to establish the facts before “escalating”. Do not. The Charity Commission is explicit about its own role:

“The Commission is not a safeguarding authority. We do not investigate individual allegations of abuse, decide whether any allegations are true or bring prosecutions. But we can refer concerns to relevant safeguarding agencies and other regulatory bodies to take further action.”

If the regulator does not investigate, a charity certainly should not. The local authority and the police investigate. The charity records, refers and protects. Reporting only to the Commission is not reporting to anyone who will investigate. Whether the concern is also a serious incident to report to the Commission is a separate question.

The next step covers who else you may have to tell: make the reports, and know which are legal duties.

The first week: what the sources say, and what they do not

The guidance says little about what happens after the referral. What it does say:

• Write a clear statement of what happened.
• The local safeguarding board or partnership decides whether the threshold for its involvement is met.
• If you hear nothing back, chase.
• Make a clear decision on the person’s suitability to continue in their role, and record it.

That is all. No source gives a day-by-day plan for the first week, and this page does not invent one.

Scotland: a different structure

Scotland’s guidance is not the English guidance with different names. It is built differently.

Timing depends on who is at risk. For an adult, the adult protection code of practice gives a benchmark. Its verbatim words: “an Adult Support and Protection referral should be made to the council within 24 hours – any delay should be recorded with reasons.” That is a should, like the English one.

For a child, there is no number. The national child protection guidance says to share the concern “Without delay, following consultation with line manager/child protection lead where this applies.” Do not carry the adults’ figure across to a concern about a child.

The two “do nots” were not found. Both instructions were searched for in two documents. One is the adult protection code of practice. The other is the child protection guidance’s part on responding to concerns. Neither was found, in those words or in substance.

Scottish guidance offers a checklist for deciding whether to share instead. It asks, verbatim: “Is the sharing justified at this time? Does the duty to protect the individual outweigh the duty of confidentiality?”

That is a case-by-case judgement, not a blanket rule. The search covered two documents, not every chapter of every Scottish source, so a fuller search could still find an equivalent instruction.

The steps. For adults, the code’s Four Referral Rs give the shape:

• recognise
• report internally without delaying the referral
• refer through the local adult protection process
• record

In an emergency, contact the police, fire or ambulance service first.

No general duty to report. Scotland has no law requiring a charity to report suspected abuse of an adult or a child. Referring is good practice, and it is how the statutory system hears about a concern, but it is not a numbered legal duty. The separate PVG referral duty is covered on the reporting page.

Northern Ireland

CCNI points to Volunteer Now’s standards, and the fourth standard sets the frame:

4. The organisation has clearly defined procedures for raising awareness of, responding to, recording and reporting concerns about actual or suspected incidents of abuse.

Volunteer Now’s adult safeguarding guidance confirms the first “do not”. It says staff and volunteers should be trained “to know never to make promises to keep secrets” and “to understand that their role is not to investigate”.

The second “do not” — do not tell the person concerned until you have taken advice — was not found. Nor was any response-time benchmark. The section of the guidance where they would sit could not be read in full, so this is an unread section, not a confirmed absence. Do not carry the English wording across.

Northern Ireland also has a general criminal duty, binding everyone, to report certain offences to the police. It has no equivalent in England, Wales or Scotland, and it is covered on the reporting page.

Every report and its clock, nation by nation, is on make the reports, and know which are legal duties.

Common mistake: promising confidentiality

It is what a decent person says to someone who is frightened. Do not. The guidance says, verbatim, “Don’t promise to keep information confidential between you and them.” Information goes to the people who need and have the right to know, under your own procedures.

Common mistake: telling the person the concern is about before taking advice

The fairness instinct says they have a right to know. They do, later. The guidance says, twice: “You should not inform the person about whom there is a concern until you have taken advice.”

Common mistake: dismissing information because it is old or anonymous

It feels as though there is nothing to act on. The guidance says action “must be taken no matter if the information you received is non-recent or from an anonymous source.”

Common mistake: investigating in-house, or reporting only to the Charity Commission

The charity wants to be sure before it “escalates”. But the Commission “is not a safeguarding authority” and does not “investigate individual allegations of abuse”. The local authority and the police investigate. The charity records, refers and protects.

Worked example

After a Friday session, a parent tells Tollgate Youth CIO’s session helper something her child said about one of the volunteers. She asks the helper to keep it between them.

The helper does not promise that. She says she will take it seriously and will only tell the people who need to know. Nobody is in immediate danger, so there is no emergency call.

She writes down what the parent said, in the parent’s words, that evening. She passes it to Tollgate’s safeguarding lead, who refers it to the local safeguarding children partnership the next morning.

Nobody tells the volunteer. The lead takes advice first.

The concern is about someone working directly with children. So the board decides the volunteer should not run sessions while the referral is looked at. It minutes that as a decision on suitability. Tollgate does not interview the child or the volunteer. That is for the council and, if it comes to it, the police.