To achieve our purpose and fulfil our statutory functions, we are risk-led in our regulation, which means:

• being proactive in identifying risks and intervening, where possible, to prevent harm before it occurs
• addressing harm effectively where it occurs
• focusing our resources effectively on the highest risks

How we identify risks

We identify risks from a wide range of sources including, but not limited to:

• information charities include in their annual return and accounts
• serious incident reports from trustees
• reporting by auditors and independent examiners
• reports of serious wrongdoing in charities from employees and volunteers, including whistleblowing
• complaints from the public or public sources
• our engagement with charities
• our work with other bodies, departments and agencies
• concerns raised in the media and by members of parliament

We place an emphasis on being proactive and identifying risks as soon as possible. To achieve this we:

• identify trends to get a better understanding of the evolving threats and risks to the ability of charity to thrive and inspire trust and confidence
• analyse the data, information and knowledge that we gather from the sources mentioned above
• use our awareness of changes to the environment in which charities are operating and the main challenges facing the charity sector

How we respond to risks

Our approach is underlined by our general functions as set out above, which include:

• determining whether institutions are charities
• encouraging and facilitating the better administration of charities
• identifying and investigating apparent misconduct or mismanagement in the administration of charities and taking corresponding remedial or protective action

We will prioritise our casework resources towards addressing the highest risks, those which have the potential to cause the highest level of harm to public trust and confidence, or which may affect trustees’ ability to comply with their duties.

The level and nature of some risks will be such that it would not be proportionate to use our resources to undertake direct regulatory action or engagement with the charity. However, this does not mean that we do not want to be notified of these risks. Whilst we may not take regulatory action, we may still contact a charity’s trustees to alert them to the concerns raised with us. We may keep such information in our records and reassess our response if further information comes to light. We will also use the information to inform our wider understanding of risks. This may result in actions that deal with risk in a thematic way, for example publishing a report of our overall findings or issuing a regulatory alert to all or a relevant category of charities.

There will be some limited cases where the level and nature of risk identified means that another regulator or agency is better placed to respond, for example serious criminal matters. In such cases, we will work with the other regulator or agency to ensure the appropriate response.

An increased level of Commission involvement with a charity or on an issue does not necessarily mean that something has already gone wrong. It may simply mean that a risk requires a greater regulatory involvement or scrutiny.

Since the nature and level of a risk may change during the course of a particular case, we may need to periodically review our response.

You can read more here