Small charities tend to arrive at one of two places. Either three policies and some gaps, or thirty downloaded templates nobody has read since the day they were adopted. Both look like a policy problem. Neither is.
The useful question is not which policies exist in the sector. It is which ones your charity is required to have, which ones are triggered by what you actually do, and which ones are good practice at your size. Those are three different lists, and conflating them is how a charity with two part-time staff ends up with a lone worker policy and no safeguarding lead.
If your policies were written years ago and nobody is sure which still apply, that is a governance review rather than a writing job.
Start by separating the three groups
Very little is required in writing simply because you are a charity. The Charity Governance Code, which is where most policy checklists come from, states plainly that compliance with it is not a regulatory requirement – it is the Charity Commission and statute that tell charities what they must do.
What is genuinely required tends to attach to a threshold or an activity rather than to charitable status itself. A few examples of the pattern:
- An employer with five or more employees must have a written health and safety policy.
- A charity required by law to have its accounts audited must include a risk management statement in the trustees’ annual report.
- Every charity preparing accruals accounts must explain any reserves policy it has, state the amount held and why – or, if the trustees have decided reserves are unnecessary, disclose that and give their reasons.
- A charity holding material financial investments has to explain the policies behind selecting, retaining and realising them.
Notice what the reserves requirement actually says. You are not obliged to have a reserves policy. You are obliged to explain the position you have taken. That distinction is worth holding onto, because a great deal of policy anxiety comes from mistaking a reporting duty for a drafting duty.
Then work out what your activities trigger
This is the list that matters, and it is different for every charity.
Employ anyone and you need the HR set: contracts, disciplinary and grievance, and the health and safety policy once you pass five employees. Work with children or adults at risk and safeguarding becomes the policy you cannot afford to get wrong, with a named lead and a route for reporting concerns. Handle personal data and you need a data protection position you could defend to the ICO.
Fundraise and the Code of Fundraising Practice puts specific weight on decision-making: refusing or returning a donation has to be decided by the governing body or in line with a policy the governing body has set. That is a live requirement for a charity that has ever felt uneasy about where money came from.
Involve volunteers and the arrangements underneath need setting out, particularly expenses, conduct and safeguarding. Take gifts of goods or services and someone has to decide what you accept. Reimburse trustees and there should be a written basis for it.
Work through your own activities and the list writes itself. Work through someone else’s template and you get their charity’s list.
Thirty policies and no idea which are live?
The usual finding is not that policies are missing. It is that nobody can say which ones the board has approved, when they were last reviewed, or which describe what the charity does now. A free Charity Consultation will tell you where you actually stand.
What the Governance Code says, and what it doesn’t
The Code was refreshed in November 2025 and now sets out eight universal principles with 41 outcomes between them, replacing the earlier seven. It works on an apply-or-explain basis: meet the principles, or explain what you do instead.
For each principle it suggests policies, processes and evidence – and it is precise about them. Policies are most helpful when tailored to the charity, and the suggested processes will not apply to every charity, particularly smaller ones with few or no staff. Some items are marked for large charities only, including an investment policy and framework, a governance handbook and a property maintenance plan.
There is one line worth quoting to any trustee who thinks the Code demands a filing cabinet. Charities adopting the Code are encouraged to publish a short statement in their annual report about how they use it, and the Code says explicitly that this does not need to be a long list of policies or procedures.
Among its suggested evidence is something more useful than any individual policy: an up-to-date document summarising the charity’s policies for board review, with review dates. For a small charity, that single page does more work than most of what it lists.
Telling a live policy from a dead one
A policy is doing its job if it can survive five questions.
Who is responsible for it, by name or role? When was it last reviewed, and is that date in the past? Has anyone referred to it while making a decision in the last year? Does it describe what the charity actually does, or what it did when the template was downloaded? Would a new trustee or volunteer find it without asking?
A policy that fails all five is not protecting you. In an incident, it does the opposite, because the gap between the written procedure and the actual practice is the first thing anyone examines.
Writing and approving them
Keep them short. Purpose, who it applies to, who is responsible, what happens in practice, when it gets reviewed, and the date the board approved it. Anything longer than two pages in a small charity is usually a template that hasn’t been cut down.
Trustees approve policies and the minutes should record it, along with any decision to keep a policy under review rather than adopt it as drafted. Adopting a template unchanged is worse than having no policy, because it creates a written standard the charity has never actually met.
Set review dates that suit the risk rather than the calendar. Safeguarding and financial controls warrant an annual look. A social media policy can go longer. A policy triggered by an activity you have stopped doing should be retired rather than reviewed forever.
Where the detail sits
This page is a starting point. The individual questions have their own answers:
Conflicts of interest, including how to handle a trustee with a personal connection to a decision, are covered in conflicts of interest in practice. What has to be reported to the Commission, and when, is in serious incident reporting. The reserves explanation, the risk management statement and everything else the report has to carry are in the trustees’ annual report. Fundraising standards, including the decisions that need a policy behind them, are in the Code of Fundraising Practice. Money given for a stated purpose is covered by restricted and unrestricted funds. And the policies underneath your volunteers – expenses, conduct, checks – are in volunteer management.
This article is general information for UK charities, not legal advice on your obligations. Requirements vary with your structure, income, staffing and activities, and employment, safeguarding and data protection duties in particular should be checked with someone qualified rather than settled from a checklist.
If the honest answer is that nobody knows which policies you have, which are current, or which the board has ever approved, that is a defined piece of work with an end point – and a one-off governance project will close it.
