1 Purpose and responsibility
Risk management covers objectives, programmes, funding, contracts, data, people and reputation. The Board approves risk-acceptance limits and treatment plans for material risks. Each activity manager owns its risks and cannot transfer responsibility to the register custodian. A legal breach cannot be accepted because detection is considered unlikely.(1)
2 Identification and assessment
Events, causes, impacts, affected parties and existing controls are recorded. An internal 1–5 scale measures likelihood and impact: scores 1–4 are low, 5–9 medium, 10–16 high and 17–25 critical. Ratings require reasons and evidence rather than unexplained numbers. Financial, health, operational, privacy and reputational impacts are assessed using the highest relevant impact.
3 Acceptance and escalation limits
An activity with uncontrolled critical risk is stopped or changed, and the Chair and Director informed immediately. High risks go to the Board with a plan and interim mitigation. The Director follows medium risks; the process owner follows low risks. A numerical score never authorises continuation of an unlicensed activity or imminent danger to a person.
4 Treatment and resources
The owner chooses avoidance, reduction, lawful sharing or acceptance within authority. Each treatment has an owner, resources, deadline, completion evidence and warning indicator, followed by reassessment of residual risk. Insurance does not transfer legal responsibility or replace prevention and reporting duties.
5 Review and change
The register is reviewed quarterly as an internal control and after incidents, legislation or new partners, systems or programmes. Reviews cover concentration in one donor, supplier, employee or platform, interruption, fraud and funding restrictions. Control effectiveness requires testing or operating evidence, not merely a written policy.
6 Reporting and learning
The Board receives a summary of high, critical and overdue risks, exceptions, incidents and lessons, anonymised where identity is unnecessary. Acceptance decisions record the decision-maker, reasons and expiry and cannot be automatically extended. Findings inform budgets, audits, continuity and training plans.
References in the approved document
- The Association’s approved 2026 Articles of Association, Article 20 on risk and oversight policies; the financial regulations and compliance, safety and data policies. This document establishes internal implementation controls without changing higher legal powers or requirements.