A small charity does not have a risk appetite. It has a capacity, and capacity is a financial fact rather than a board preference. Five trustees, one grant covering seventy per cent of income and three months’ reserves is not a board that can decide to be bold. It is a board that has already spent what it had to spend, and the decision it thinks it is about to make was made for it some time ago.
That distinction is the useful part of this subject, and it usually gets skipped. Work out what the charity could absorb, and the question of what it should take on answers itself more often than not.
If the board is weighing something specific and wants a second view before it decides, governance support is where that conversation happens. What follows is how to work out the limit.
Where the language came from
Risk appetite is corporate vocabulary, and it carries assumptions with it. It assumes an organisation with reserves, several income streams, and enough slack that a failed project is a bad quarter rather than the end of the charity.
Set against that, a board of five with one funder and a part-time coordinator. An appetite workshop produces a statement saying the charity is moderately risk-tolerant on programme delivery and cautious on finance. Everyone nods. Nothing changes, because the statement described a mood and the constraint was never a mood.
The Commission’s own guidance says it more plainly than most consultants do. Charities have different capacities to tolerate or absorb risk. A charity with good reserves can take on a project with a higher risk profile than a charity facing financial difficulty. Capacity first. Preference second, and only within what capacity allows.
The three facts that set the limit
None of these needs a workshop. They need an hour with the management accounts and an honest conversation.
Reserves. Not the figure in the policy – the figure in the bank, and how long it would keep the work going with no new income. The gap between those two numbers is common, and it is where boards deceive themselves, because the policy figure gets quoted in meetings long after it stopped being true. If your reserves policy has not been tested against current running costs, the capacity conversation cannot start.
Income concentration. What proportion comes from the single largest source, and how long it would take to replace. A charity where one funder provides most of the income has already committed its capacity to keeping that relationship intact. It can still take risks. It cannot take risks that put the relationship in question, which rules out more than boards expect.
Slack. Whether losing one person for a month would stop the work. In most small charities it would, and that is a limit on every decision about taking anything new on. A board that says yes to a new project without asking who does it has not made a decision; it has made a hope.
Those three facts set the limit. A discussion about how the trustees feel about risk does not move any of them.
The risks no board has capacity for
Some things are not capacity questions and never were, and an appetite statement that implies otherwise is describing a power the trustees do not have.
Harm to a child or an adult at risk. Acting outside the charity’s objects. Anything carrying criminal exposure – a barred person in a regulated role, false or misleading information given to the Commission on an annual return. Regulatory breaches serious enough to bring an official warning, which is public and which funders read. The safeguarding side of that is a separate subject, but the principle here is short: these are boundaries, not preferences, and the board cannot vote to relax them.
Naming them matters because it clears the ground. Once those are out of the conversation, what remains is genuinely for the board to decide, and the decision gets easier.
Capacity tells you what you can absorb. The register tells you what is coming. The Charity Risk Register Template is an Excel workbook built around CC26, with a five-by-five scoring guide, a board summary that pulls the top risks automatically, and thirteen worked example risks. The guidance notes cover how to score, how to set review cycles, and how to turn a capacity judgement into boundaries staff can work inside.
What to set instead of a statement
Boundaries. The limits inside which staff can act without coming back to the board, and the point at which something has to be referred up.
A spending threshold above which a decision needs trustee approval. A contract length beyond which the board wants to see the terms. A rule on accepting restricted funding that carries obligations continuing after the money stops. A position on entering a partnership where the other organisation holds the relationship with beneficiaries.
The difference is practical rather than semantic. An appetite statement describes how the board feels. A boundary tells the coordinator what to do on a Tuesday afternoon when a decision is needed, no trustee is available, and the next meeting is three weeks away. One of those is useful at the moment it is needed. Recording why each boundary sits where it does is the same discipline that applies to any trustee decision that might be examined later.
The Commission expects this in so many words. Trustees are asked to let their managers know the boundaries and limits set by their risk policies, so that everyone understands which risks can and cannot be accepted.
Where this shows up in the accounts
Above £500,000 of income, SORP 2026 requires the trustees’ annual report to describe the principal risks facing the charity and its subsidiaries, including environmental and cyber risks, with a summary of the plans for managing them. Below that threshold, the disclosure does not apply.
It still matters below the line, for a reason that has nothing to do with disclosure. A board that has never established its capacity is writing its reserves policy on instinct, and reserves and capacity are the same question asked from two directions. Going concern is the third.
Charities required by law to have their accounts audited also make a risk management statement in the annual report, confirming the trustees have considered the major risks and are satisfied systems exist to manage them. The audit thresholds have been under revision, so check the position that applies to your accounting period rather than assuming last year’s figures still hold.
Capacity moves
A grant ends. A new funder arrives. The coordinator leaves. The charity takes on premises and acquires a fixed cost it did not have in March.
Each of those changes what the charity can absorb, which means the boundaries set against the old position are now wrong. Usually wrong in the dangerous direction, because boards set boundaries in a good year and keep operating to them through a bad one. Nobody revisits a threshold that has not caused a problem yet.
Attaching the review to something that already happens is what makes it survive – the reserves review, the budget, the point in the year when the largest grant is renegotiated. Once the boundaries are set, the risks that sit inside them belong on the register, and what the Commission expects on a risk register covers what goes there.
The question to put to your board
Not how much risk the trustees are comfortable with. How much the charity could survive, and whether anyone has checked recently.
A board that can answer the second question will find the first one mostly answers itself. Book a call if you want to work through what your charity can absorb before the next decision arrives.
