Charity Risk Register: Free Template & Guide for Trustees

A risk register is a governance essential — it shows your board is actively identifying and managing threats to your charity. Here's a free template and practical guide.

What is a Risk Register?

A risk register is a document that lists the key risks facing your charity, assesses their likelihood and impact, and records what you're doing to manage them. It's a living document reviewed at every board meeting.

Why You Need One

• The Charity Governance Code (Principle 4) requires effective risk management
• Funders and grant-makers expect to see a risk register
• It protects trustees — documented risk management shows you're exercising reasonable care
• It prevents surprises — you've already thought about what could go wrong

Template

Risk Categories

• Financial — loss of income, fraud, cash flow problems
• Operational — staff departure, IT failure, premises issues
• Compliance — GDPR breach, regulatory failure, health & safety
• Safeguarding — harm to beneficiaries or staff
• Reputational — negative press, social media crisis, scandal
• Strategic — mission drift, relevance decline, competition
• External — economic downturn, policy changes, pandemic

How to Score Risks

Multiply Likelihood (1-5) by Impact (1-5):

• 1-6 (Green) — Low risk. Monitor annually.
• 7-14 (Amber) — Medium risk. Active mitigation. Review quarterly.
• 15-25 (Red) — High risk. Urgent action required. Review monthly.

Board Review Process

1. Review the risk register at every board meeting (or at minimum quarterly)
2. Each risk owner reports on their mitigation actions
3. Add new risks as they emerge
4. Remove or downgrade risks that have been effectively managed
5. Record the review date