What the Charity Commission’s 2026 Sector Risk Assessment means for charity trustees
- vhmcharityconsultancy
- 20 hours ago
- 5 min read
The Charity Commission has published its 2026 Charity Sector Risk Assessment, providing a useful overview of some of the most significant challenges currently facing charities across England and Wales.
It covers a wide range of areas, including financial resilience, governance, safeguarding, fraud, cyber security and the risks involved in some service-delivery arrangements.
Some of the headline figures are unsettling. But I don’t think the most useful response is to view the assessment simply as a list of things going wrong across the sector.
Instead, it provides trustees with a valuable opportunity to step back and ask whether their charity’s governance and risk management arrangements still reflect the environment in which they are operating now.
The Commission is clear that not every risk will apply to every charity. It is, however, actively encouraging trustees to consider the issues raised when reviewing their own risk registers.
For me, that is the most important message to take from the report.
Risk cannot be eliminated entirely, and good governance is not about trying to anticipate every possible problem. It is about understanding the risks that could prevent the charity from achieving its purposes, putting proportionate controls in place and recognising warning signs early enough to take action.
Used properly, a risk register should help trustees have those conversations and make better, more informed decisions. It should not be a document that is reviewed once a year simply because it appears on the governance calendar.
Making the risk register useful
I know that for many new or small charities, creating a risk register can feel like yet another document to add to an already long list.
But a useful risk register should make the trustees’ job easier. It should focus attention on the risks that matter most and make clear what the charity is doing about them.
For each significant risk, trustees should be able to see:
what might happen and why;
the potential impact on the charity and its beneficiaries;
the controls already in place;
any further action required;
who is responsible for that action; and
when it will be reviewed.
The board should then return to it when circumstances change — for example, when taking on a large contract, employing the charity’s first member of staff, entering a partnership, moving premises, losing a significant funder or beginning to work with a new group of beneficiaries.
A template can provide a helpful starting point, but it should not result in a generic list that could belong to any charity. The real value comes from the conversation trustees have while creating and reviewing it.
Financial resilience needs to be a regular board conversation
The Commission’s analysis found that 41% of charities had expenditure exceeding income. It also reported a 27.7% rise in casework relating to insolvency and financial difficulties, although it rightly notes that the number of cases remains very small in the context of the sector as a whole.
A planned deficit is not automatically a sign that a charity is in difficulty. Trustees may make a perfectly reasonable decision to use reserves for a particular purpose or during an agreed period.
The important questions are whether the decision is informed, whether it is sustainable and whether the trustees understand what will happen if income or expenditure does not follow the plan.
Boards should be asking:
Do we have an up-to-date and realistic financial forecast?
Are we receiving information that helps us make decisions, rather than simply being shown historic figures?
What are our early warning signs?
How dependent are we on one funder, contract or source of income?
Are we recovering the true cost of delivering our work?
At what point would we need to change course?
Financial information needs to be presented in a way that all trustees can understand. Financial oversight may be led by a treasurer or finance committee, but responsibility for the charity’s finances sits with the whole board.
A rise in disputes is also a governance warning
The number of cases involving a dispute within a charity rose from 579 to 909 — an increase of 57%.
Some disagreements are inevitable. Trustees are there to bring different skills and perspectives, and a healthy board should be able to challenge ideas and have difficult conversations.
Problems are more likely to escalate when roles are unclear, decisions are not recorded properly or people do not understand where authority sits.
This is why apparently straightforward governance tools matter. A clear scheme of delegation, well-run meetings, accurate minutes, a conflicts-of-interest process and clarity about the respective roles of trustees and senior staff can prevent a disagreement from becoming a damaging dispute.
Trustees should also know what their governing document says about meetings, voting, trustee appointments and removals. Those provisions can feel rather remote when everything is going well, but they become extremely important when it is not.
Cyber risk is not only an IT issue
Thirty per cent of charities reported experiencing a cyberattack, with phishing identified as the most common and disruptive type.
This is not something that can simply be delegated to whoever understands the technology. A cyber incident can affect a charity’s finances, personal data, ability to deliver services and reputation. It is therefore a governance and operational risk as well as a technical one.
Even a small charity should think about:
who can access its bank accounts, email accounts and cloud-based files;
whether multi-factor authentication is being used;
how access is removed when a trustee, employee or volunteer leaves;
whether important information is backed up;
how suspicious emails and attempted fraud are reported internally; and
what the charity would do if its systems or data were compromised.
The answer does not have to be a complicated cyber-security strategy. It does need to be proportionate, understood and put into practice.
Conflicts and private benefit need careful thought
The Commission reported a further 29% increase in cases involving concerns that charitable status was being abused for private benefit.
Most charities are established and run by people acting in good faith. But trustees still need to be able to demonstrate that the charity exists for the public benefit and that decisions are being made in its best interests.
This is particularly important where there are paid founders, trustee payments, family relationships, connected businesses or arrangements between a charity and another organisation.
The existence of a connection does not necessarily make an arrangement inappropriate. The issue is whether any benefit is authorised, conflicts are managed correctly, the arrangement is in the charity’s best interests and the decision-making process is properly recorded.
These questions need to be addressed honestly at the outset. They should not be left until the Charity Commission, a funder or another trustee raises a concern.
A practical prompt for every trustee board
The Commission’s assessment should not cause charities to panic or attempt to add every issue in the report to their own risk registers.
It should prompt boards to step back and ask whether their understanding of risk reflects the reality in which the charity is operating now.
When did your board last have a proper discussion about its most significant risks? Are the controls on the register genuinely in place? Is someone responsible for each action? And would trustees recognise the early signs that a risk was beginning to materialise?
Those conversations are an important part of good governance — and having them early gives trustees far more opportunity to act.
I support new and established charities with governance reviews, risk management, trustee development and practical governance documents. If your board would benefit from some support in reviewing its risk register or strengthening its wider governance arrangements, please get in touch.
Comments