Risk Management Policy

Our approach

The trustees are collectively responsible for managing risk. Risks are identified across the charity’s governance, finances, activities, safeguarding and information, and recorded in a risk register. Each risk is scored for likelihood and impact, given an owner, and assigned proportionate controls.

The trustees review the risk register at least once a year, and whenever a significant new activity, partnership or incident arises.

1. Governance and financial controls

• Trustee decisions are taken at quorate meetings and recorded in minutes.
• Trustees declare any conflict of interest and take no part in related decisions.
• Charity funds are held in a bank account in the charity’s name. Payments require authorisation by two trustees, and no trustee approves a payment to themselves.
• All income and expenditure is recorded with supporting receipts, and accounts are reviewed by the trustees.
• Annual returns and any required accounts are filed with the Charity Commission on time.

2. Activity risk assessment and insurance

• A written risk assessment is completed before each charity-led event or activity, covering the venue, accessibility, travel, food and allergies, weather, first aid and supervision.
• Venues are checked for suitability and for their own insurance and safety arrangements before booking.
• The trustees ensure appropriate insurance, including public liability cover, is in place for the charity’s activities.
• Accidents, incidents and near misses are recorded and reviewed by the trustees so that lessons are learned.

3. Safeguarding

Safeguarding is treated as a standing, high-impact risk for the charity and is managed through our Safeguarding Policy:

• A named Designated Safeguarding Lead (Steven Honnor, Chair) is responsible for safeguarding concerns.
• Appropriate DBS checks and safeguarding induction are completed for relevant roles.
• Concerns are referred promptly to the correct statutory service, and allegations about trustees or volunteers to the Dudley LADO.
• Serious incidents are reported to the Charity Commission where required.

4. Data protection and information security (UK GDPR)

• We collect only the personal information we need, and use it only for the purpose it was given, as set out in our Privacy Notice.
• Charity email and documents are protected by strong passwords and, where available, two-factor authentication. Access is limited to trustees who need it.
• Information that could identify a child in care is not collected through the website or sent by ordinary email.
• Personal data is kept only for as long as necessary, then securely deleted.
• Any personal data breach is assessed straight away and, where required, reported to the Information Commissioner’s Office (ICO) within 72 hours.