What must a safeguarding policy contain?

England and Wales: This page sets out the position in full, using the Charity Commission’s own must and should lists. Scotland: covered, from different sources — OSCR sets a short minimum for any policy and the Scottish adult protection code supplies a four-step model; the Commission’s lists do not apply. Northern Ireland: covered, from a different kind of source — CCNI points to Volunteer Now’s nine standards, a sector body’s checklist rather than the regulator’s own list.

Read the Commission’s key before you read its lists

A charity’s safeguarding policy in England and Wales is best built on the Charity Commission’s own lists; Scotland and Northern Ireland use different sources, covered at the end. This step is for the trustees and the safeguarding lead. It assumes the board has already established that safeguarding applies; whether a written policy is legally required at all is answered on adopt a safeguarding policy.

Almost every safeguarding checklist in the sector gives you the Commission’s list. Very few give you its key. The key is what makes the list usable, so start with it. In the Commission’s own words:

“‘must’ means something is a legal or regulatory requirement or duty that trustees must comply with; ‘should’ means something is good practice that the Commission expects trustees to follow.”

So the lists below are the Commission’s lists, sorted by the Commission’s key. A must in these lists is the regulator’s must. It is not a statute, and this page does not present it as one.

The law sits underneath. The Commission puts the core of it in one sentence. Trustees “must take reasonable steps to protect the people who come into contact with their charity through its work from harm”. That duty binds you whether or not you write a policy. The policy is how you show you are meeting it.

The six things the Commission says you must do

The Commission’s must column, as recorded from its safeguarding guidance:

1. Take reasonable steps to protect from harm people who come into contact with the charity, online or in person
2. Make sure trustees, staff and volunteers are suitable and legally able to act in their positions
3. Follow relevant legislation and guidance, and local safeguarding partnership or board policies
4. Have a policy on the recruitment of ex-offenders, if the charity uses DBS information
5. Be satisfied the charity identifies and manages risks, including when operating online
6. Know when to report issues to law enforcement, when working overseas

Look at the fourth item. It is the one place in the must column that names a written document.

No provision requires a safeguarding policy. But in England and Wales a charity that uses information from the DBS is told it must have a policy on recruiting ex-offenders.

That is a separate document with its own page: write a recruitment-of-ex-offenders policy. If your charity runs DBS checks, write that one too.

The eight things it says you should do

The Commission’s should column. The first five are about the policy itself:

• Put the policies and procedures into practice
• Make them responsive to change
• Review them as necessary — in the Commission’s verbatim words, “always following a serious incident and at least once a year”
• Make them available to the public
• Make them compliant with all relevant legislation

The other three are about what sits around it:

• Have a clear code of conduct if the charity has staff or volunteers
• Consider whether to use DBS checks as part of a wide range of checks
• Get a basic check if the risk assessment determines it is appropriate

A should is not optional in practice. The Commission expects it and will judge you against it. But it is good practice, not law, and the difference matters when you decide what to do first.

The review trigger most policies leave out

Nearly every policy says it will be reviewed once a year. Far fewer say it will be reviewed after a serious incident. The Commission’s wording puts the incident first: “always following a serious incident”, and only then “at least once a year”.

This sits in the should column, not the must column. It is still the part worth writing into your policy word for word. A serious incident is the moment your policy has just been tested. If it failed, the next annual review may be most of a year away.

Put both triggers in the policy. Then put the next annual review in the board’s diary now.

A policy in a drawer is the finding, not the defence

The clearest lesson in the Commission’s inquiry reports is that having a policy does not protect you. SPAC Nation had policies. The inquiry’s finding was about what the trustees did with them:

"The inquiry found the trustees['] implementation of the charity's safeguarding policies and procedures were inadequate, for example in relation to trustee oversight and reporting mechanisms, which placed its beneficiaries at risk. This was misconduct and/or mismanagement in the administration of the charity by the trustees."

Archive status: this report was published in August 2024. Under the Commission’s archiving policy it may now carry an archived banner. The quotation has not been re-checked against the report since the research record was made.

So write the policy as something people will use. Say who does what, and who they tell. Then plan how it will be put into practice: who is trained, when, and how the board will know. The Scottish regulator asks for exactly that, an implementation plan, as part of its minimum. It is good advice in England and Wales too.

The next page in this hub covers how the board keeps watch over the policy once it is adopted: appoint a safeguarding lead and set board oversight.

Scotland and Northern Ireland use different sources

Do not use the Commission’s wording in either nation. Each has its own expectations. They are built differently.

Scotland. OSCR does not publish a must and should list. It does set a minimum for any policy:

"OSCR can't advise charities on what specific information to include in a policy, but we would expect, as a minimum, policies are: agreed by the charity trustees; regularly updated; reflect statutory guidance and national and local practice; supported by an implementation plan."

For responding to concerns about adults, the Scottish Government’s adult protection code of practice gives a four-step model, known as the Four Referral Rs. It is good practice, not a numbered duty, and it works well as the skeleton of a procedure:

• Recognise — "be aware of adult protection issues"
• Report — "where you have an internal adviser for adult protection report the matter to them... but ensure this does not adversely delay referring"
• Refer — "Refer the individual and their circumstances through your local adult protection referral process"
• Record — "use the individual's record to note the issues that arose, the circumstances, the decisions made/actions you took, and the rationale for your actions"

Northern Ireland. CCNI frames its core duty as a must, which under its own key means a specific legal requirement. Note what it attaches to: arrangements, not one named document.

"If your charity works with children, young people or adults at risk of harm, you must put in place appropriate safeguarding arrangements. Safeguarding means protecting their health, wellbeing and human rights; enabling them to live free from harm, abuse and neglect. Safeguarding arrangements include: staff and volunteer checks; policies and procedures; training for all staff and volunteers on what to do if they have concerns about the safety or welfare of a child, young person or adult at risk of harm."

For what a policy should contain, CCNI does not publish its own list. It points to Volunteer Now’s nine minimum standards:

• 1. The organisation has a safeguarding child and adults at risk policy supported by robust procedures and guidelines.
• 2. The organisation consistently applies a thorough and clearly defined method of recruiting staff and volunteers in line with legislative requirement and best practice.
• 3. There are procedures in place for the effective management, support, supervision and training of staff and volunteers.
• 4. The organisation has clearly defined procedures for raising awareness of, responding to, recording and reporting concerns about actual or suspected incidents of abuse.
• 5. The organisation operates an effective procedure for assessing and managing risk with regard to safeguarding children and adults.
• 6. There are clear procedures for receiving comments and suggestions and for dealing with concerns and complaints about the organisation.
• 7. The organisation has a clear policy on the management of records, confidentiality, and the sharing of information.
• 8. There is a written code of behaviour that outlines the behaviour expected of all those involved with the organisation.
• 9. The organisation has written guidelines to ensure the general safety and effective management of activities.

Know what kind of source this is. Volunteer Now is a sector body, not a regulator. The only official backing for its standards found by this guide is CCNI’s own cross-reference to them.

That is a good reason to use them. It is not the same as a regulator’s list. The Northern Ireland Safeguarding Board’s own regional guidance was located but not read, and it may add to this.

Write it, adopt it, publish it

1. Start from the Commission’s lists in England and Wales, or from OSCR’s minimum or Volunteer Now’s standards in Scotland or Northern Ireland. Tick off each item against a clause in your draft.
2. Write both review triggers in: after any serious incident, and at least yearly.
3. Add an implementation plan: who is trained, when, and how the board hears about it.
4. If you use DBS checks in England and Wales, or AccessNI checks in Northern Ireland, write the separate ex-offenders policy as well.
5. Adopt it at a minuted board meeting, publish it, and put the review date in the diary.

Template: Safeguarding policy (planned).

The other policies a new charity needs alongside this one are listed on put your first policies in place. Once the policy is adopted, two questions follow: who oversees it, and what to do when a concern arrives. The second is on respond to a disclosure or a concern.

Common mistake: thinking Scotland and Northern Ireland have no expectations

OSCR and CCNI do not publish a list shaped like the Charity Commission’s, so it is easy to conclude they expect nothing. They do.

OSCR sets a minimum: agreed by the trustees, regularly updated, in line with statutory guidance, and backed by an implementation plan. CCNI points to Volunteer Now’s nine standards and treats them as the sector’s source. The expectations are structured differently and come from different places. They are not missing.

Worked example

Tollgate Youth CIO’s trustees download a safeguarding policy from a sector body and want to adopt it at their next meeting.

Before they do, the chair puts the Commission’s key at the top of the draft. Then she maps each clause to the six musts and the eight shoulds.

Two gaps show up. The download says “reviewed annually” and nothing about serious incidents, so the post-incident trigger goes in. And it says nothing about ex-offenders. Tollgate uses DBS checks for its session leaders. So the trustees add a line saying the charity will have a separate ex-offenders policy. They put that policy on the next agenda.

The trustees adopt the policy with both changes, publish it, and diary the review. They also minute a short plan: who is trained, by when, and a standing report to the board. The finding in the SPAC Nation inquiry was inadequate implementation, not a missing document. The plan is their answer to that.