Help centre / Risks, policies & compliance / Start your risk register
Start your risk register
Go to Governance, then Risk register, and choose New risk. Name the risk, score how likely and how serious it is, and give it an owner and a review date. The register sorts your risks so the biggest sit at the top.
A risk register is a short list of the things that could go wrong for your charity, with a note of who is watching each one. The Charity Commission expects trustees to review risks regularly. Five to ten well-chosen risks are far more useful than fifty vague ones.
Add a risk
- Go to Governance, then Risk register.
- Choose New risk.
- Under Identify, pick a Category (financial, operational, governance, compliance, safeguarding, reputational, cyber or environmental) and give the risk a short, specific Title. For Meadowbank Community Trust that might be "Loss of our main grant funder".
- Use Description to say what could go wrong and why it matters. A sentence or two is enough.
- Under Assess, set Likelihood and Impact, each from 1 to 5. Your best judgement is fine. See how risk scores are worked out.
- Under Manage, record your Mitigation (what you plan to do) and any Existing controls (what you already do).
- Pick an Owner from your people register and set a Next review date.
- Choose Create risk.
What happens next
The register sorts risks by score, highest first, so the board's attention goes where it matters. Open any risk to see its full history, a trend chart of its score over time, and any decisions raised about it.
You can't break anything by looking. Every change is saved to the risk's history, and nothing is deleted outright. If a risk no longer applies, archive it. You can restore an archived risk at any time.
Common questions
Who should own a risk? One named person, usually a trustee or senior volunteer. The owner keeps an eye on it and reports back. It doesn't mean they caused it or must fix it alone.
How often should we review risks? Set a review date on each risk, and put the register on a board agenda at least once a year. Score changes are recorded, so you can show the Commission a living register rather than a document written once and forgotten.
The governance behind this: our free guide on charitycontrol.org explains the why in plain English.