1. for more information visit us at www.hempsons.co.uk Small Charities Coalition Risk management Catherine Rustomji Head of Third Sector North – Hempsons 12 June 2012

2. Agenda Catherine Rustomji - Hempsons Charity Commission Compliance Risk Detlev Anderson - Ryecroft Glenton Practical Example & CC26

3. The Regulator of Charities Increase effectiveness and public confidence Risk-based and proportionate approach Target help and resources:- charity’s beneficiaries services assets reputation

4. The Charity Commission and Regulation Ensure charities meet legal requirements and equipped to operate properly and within the law Check charities are run for public benefit Ensure independence and trustees take decisions free of control or undue influence Detect and remedy serious mismanagement or deliberate abuse by or within charities

5. Charity Commission’s Seven Principles Accountability Independence Proportionality Fairness Consistency Diversity and Equality Transparency

6. Charity Commission’s Objectives Increase public trust and confidence in charities Promote awareness and understanding of public benefit Promote trustees’ compliance with the law in control and management Promote effective use of charitable resources Enhance accountability to donors, beneficiaries and the general public

8. Risk – what do you need to know? Trustee responsibility Regular review and assessment Effective governance Risk appetite Risk tolerance

9. Risk Framework Identify major risks Decide how to respond Include statement in annual report Risk mapping/risk reporting But ….

10. “ However beautiful the strategy, you should occasionally look at the results.” Winston Churchill

11. Catherine Rustomji Head of Third Sector North 0191 230 6052 c.rustomji@hempsons.co.uk

12. Disclaimer This presentation and any accompanying notes are made available on the basis that no liability is accepted for any errors of fact or opinion they may contain. Professional advice should be obtained before applying the information in particular circumstances.

13. Small Charities Coalition Risk management – Practical Example & CC26 Detlev Anderson Charities Partner– Ryecroft Glenton 12 June 2012

14. www.charity-commission.gov.uk/publications/cc26.aspx Charities and Risk Management (CC26)

15. Effective risk management means … Trustees make informed decisions and take timely action Charity makes most of opportunities Forward and strategic planning are improved Charity’s aims are achieved more successfully

16. “An effective charity regularly reviews and assesses the risks it faces in all areas of its work and plans for the management of those risks. The implementation of an effective risk management policy is a key part of ensuring that a charity is fit for purpose.” Stage 1: Establishing a risk policy

17. “Although there are various tools and checklists available, the identification of risks is best done by involving those with a detailed knowledge of the way the charity operates.” Stage 2: Identifying risks

18. Types of Risk Governance Operational Financial External/environmental Compliance

19. “Identified risks need to be put into perspective in terms of the potential severity of their impact and likelihood of their occurrence. Assessing and categorising risks helps in prioritising and filtering them, and in establishing whether any further action is required.” Stage 3: Assessing risk

20. Previous CC guidance gave equal prominence to impact (y) and likelihood (x) so likelihood score times impact score (x * y) = risk score. Since June 2010 advice is that high impact but low likelihood should have a greater risk score than low impact but high likelihood so greater weight given to impact (y). This means likelihood score times impact score plus impact score (x * y) + y = risk score.

21. Likelihood Low High 3 3 1 2 2 1 1*3+3 =6 3*1+1 =4 2*3+3 =9 1*2+2 =4 2*2+2 =6 3*2+2 =8 3*3+3 =12 1*1+1 =2 2*1+1 =3 Example of a risk map

22. Example produced by Ryecroft Glenton

23. Risk Responses Tolerate Terminate Treat Transfer

24. Risk register template Potential or uncontrolled riskDisaster recovery and planning Potential impactcomputer system failures or loss of data destruction of property, equipment, records through fire, flood or similar damage Likelihood of occurrence (x score)Medium (2) Severity of impact (y score)High (3) Uncontrolled risk score (x * y) + yToo high (9) Control proceduresagree IT recovery plan implement data back up procedures and security measures review insurance cover create disaster recovery plan including alternative accommodation Likelihood of occurrence (x score)Medium (2) Severity of impact (y score)Low (1) Managed or controlled risk score (x * y) + yAcceptable (3) Monitoring processReviewed quarterly by trustees ResponsibilityTrustees and I.T. Manager Further action requiredQuarterly agenda item for trustee meetings Date of reviewQuarterly

25. Example produced by Ryecroft Glenton

27. Disaster Recovery Plan 1 First steps commit to planning across the charity develop a plan by a team representing all functional areas of the charity plan as a project if appropriate 2 Impact/risk assessment identify all major risks each risk to be given an impact and likelihood rating (see Part D) consider overall risk profile of charity 3 Drawing up the plan establish milestones to move charity from disaster to normal operations start with immediate aftermath outline what functions need to be resumed and in what order plan should identify key individuals and their roles and duties 4 Testing plan process of testing properly reproduce authentic conditions as far as possible plan tested by the key individuals identified in the plan document test procedures and record results consider amendments to plan 5 Training make all charity trustees, staff and volunteers aware of plan and their own duties and responsibilities stress the importance of planning even if the disaster appears to be a remote likelihood get feedback from all to ensure that duties and responsibilities are understood 6 Updating and maintaining plan should be updated to be applicable to current activities give someone responsibility for updating plan and communicating any changes all changes should be fully tested key staff informed of changes in duties and responsibilities

28. Questions?

29. Detlev Anderson Charities Partner Ryecroft Glenton 32 Portland Terrace Newcastle upon Tyne 0191 281 1292 detlevanderson@ryecroft-glenton.co.uk

30. This presentation and any accompanying notes are made available on the basis that no liability is accepted for any errors of fact or opinion they may contain. Professional advice should be obtained before applying the information in particular circumstances.. Disclaimer