A serious incident is an adverse event, actual or alleged, that results in or risks significant harm to people who come into contact with your charity through its work, significant loss of money or assets, damage to property, or harm to your charity’s work or reputation. Trustees are responsible for reporting these to the Charity Commission quickly.
Two things are worth knowing before anything else. An allegation counts; it does not have to be proven, and you do not need to finish investigating before you report. And reporting is not an admission that the board failed. The Commission expects serious incidents to happen in charities. It would rather hear about one from the trustees than from a journalist.
If this has surfaced questions about how your charity is run, you can book a free clarity call.
What counts as a serious incident
The Commission groups reportable incidents into six categories: safeguarding and the protection of people; financial crime, meaning fraud, theft, cyber-crime and money laundering; large donations from unverifiable sources or otherwise suspicious financial activity; other significant financial loss; links to terrorism or extremism; and a final category of other significant incidents.
That last one is the category small charities miss, because the label gives nothing away. It covers:
- discovering that a trustee or senior manager is disqualified in law from holding the position
- insolvency, or anything forcing the charity to wind up
- your bank withdrawing services when you cannot find a replacement
- a police investigation, or a significant investigation by another regulator
- major governance failure, such as trustees or staff resigning en masse and leaving the charity unable to operate
- trustees or employees facing criminal proceedings connected to the charity or their role in it
- a significant data breach or loss
- an incident at a delivery partner, trading subsidiary or funded organisation that materially affects your charity
Routine inspections by bodies like Ofsted or the Care Quality Commission are not reportable in themselves. They become reportable if the findings are serious enough to put the charity’s future in doubt or damage public confidence in it.
Judging “significant” when your charity is small
Significant means significant in the context of your charity, taking account of its staff, operations, finances and reputation. The same event produces different answers at different sizes, and that is deliberate.
For financial loss, the Commission gives two figures. Report a loss of £25,000 or more. Also report a loss below £25,000 where it exceeds 20% of the charity’s income.
The second one is what matters at the small end, and it is the figure most trustees have never seen. A charity with £30,000 of income should be reporting a £6,000 loss. The same loss at a charity with £500,000 of income falls well below the line. Unverified or suspicious donations follow a similar guide at £25,000, with judgement applied below that.
For fraud and theft, there is no minimum figure at all. Low value does not mean low seriousness, and repeated small losses can be a sign that somebody is working below the threshold at which they expect anyone to look. Where low-value incidents have happened repeatedly, the Commission expects a report.
Several factors push an incident towards reporting: the person accused is involved in the charity, particularly in a senior or financial role; they are involved with other charities too; the incidents look connected, or one has been repeated over a long period; several have occurred in a short space of time; the money came from a public appeal, a collection or grant funding; there are signs of media interest; or the charity has already suspended somebody or begun disciplinary action.
Some financial events do not need reporting at all. A fall in investment values, impairments, asset write-downs, pension deficits and bad debts fall outside this unless they threaten the charity’s solvency.
Deciding not to report, and why that has to be written down
Most incidents at a small charity sit near the line rather than over it. Trustees make the call, and the guidance is direct about what follows: if you decide not to report, and the Commission later becomes involved, you have to be able to explain why you decided that at the time.
Which makes the decision not to report a board decision in its own right, and one that belongs in the minutes. Record what happened, what the board considered, why it concluded the incident was not significant for a charity of your size, and what you did instead – usually tightening a control or revising a policy.
If the judgement has been delegated to a member of staff, borderline cases have to come back to the board. A decision taken by a manager that the trustees never heard about is the worst position to be in if the matter resurfaces.
Where you are genuinely unsure, report. It costs an hour. The alternative is explaining a silence.
The Commission’s form asks what you have changed to stop the same thing happening again, and that question is usually harder than describing the incident. If the honest answer is that the controls or the policy were never really there, a free 30-minute clarity call is a reasonable place to start.
What to do first, and who else to tell
Act to stop further harm or loss before anything else. Then report to the Commission, report to the police or other agencies if a crime may have been committed, decide what you will say to staff, volunteers, funders and the public, and review what happened so you can change whatever allowed it.
Who else needs telling depends on the incident. Safeguarding matters go to the police on 101, where you should obtain a crime reference number, and to the local authority. Fraud and cyber-crime go to Report Fraud, again with a crime reference number, making clear you represent a charity. Theft goes to the police. Links to terrorism or extremism go to the police immediately, and delay there can itself be a criminal offence under section 19 of the Terrorism Act 2000. Where you have notified the ICO of a data breach, the Commission should hear about it as well.
Do not wait for an arrest, a charge or a conviction. Report to the Commission alongside the others and say what action you have taken or plan to take.
Charities regulated by another body as well, in care or education for instance, need to meet that regulator’s requirements too, and should tell the Commission which agencies have been contacted.
One point catches boards out in the other direction. A safeguarding incident that happened outside your charity, unconnected to its activities and not involving anyone connected to it, is not normally reportable. It becomes reportable if your charity handled it badly and harm followed.
Reporting, and what happens afterwards
Reports go through the Commission’s online form. You will need your contact details, the charity’s name and registration number, and any reference numbers from other agencies. Then the incident itself: when it happened, what happened, when and how the charity found out, the impact on beneficiaries, finances, staff, operations or reputation, and whether the trustees know about it.
The last section is the one being assessed. Which of your policies or procedures apply, whether they were followed, what you have done about the incident, and what you have changed to prevent a repeat. A charity that answers those three well has largely dealt with the regulatory question.
If you are not a trustee, say who you are and confirm you have the trustees’ authority to report on their behalf.
Keep personal data to a minimum. The Commission does not need names or personal details in an initial report and will ask if it needs them. Worth knowing too that it does not routinely guarantee confidentiality and may share what you tell it. Where something is particularly sensitive, say so and explain why.
You will receive a reference number. If the facts change materially afterwards, go back and update the report using the same form – including where an allegation turns out to be groundless, or somebody is exonerated.
The annual return declaration
Above £25,000 of income, filing your annual return requires you to declare that no serious incidents from the previous financial year went unreported.
That has a practical edge. Any unreported incidents have to be submitted before you can make the declaration, and without the declaration you cannot complete the return, which is a statutory requirement. Providing false or misleading information to the Commission is a criminal offence.
So an unreported incident does not quietly recede. It arrives back at filing time, and the choice then is to report it late or to sign something untrue.
Failure to report an incident that later comes to light may be treated as mismanagement, and can prompt regulatory action, particularly where further harm followed the original incident.
This article is general information for UK charities and not advice on any specific situation. If people have been harmed, or a crime may have been committed, contact the police and your local authority safeguarding team first. Where an incident involves significant money, property or possible criminal conduct, take legal advice before you report.
If an incident has exposed gaps in how your charity is governed, our charity governance support covers the controls and policies that keep them closed.
