The Charity Commission for England and Wales released its Charity Sector Risk Assessment 2026. Rather than viewing regulatory reports as bureaucratic paperwork, forward-thinking trustees and leaders use this assessment as a ready-made, high-level toolkit to stress-test their operations.
The overall takeaway from the report is clear: risks facing non-profits are no longer isolated—they are overlapping and compounding. Financial pressures feed into internal governance friction, while rapid technological adoption opens up new vulnerabilities in data security and public trust.
Here is a breakdown of the primary threat vectors identified in the 2026 report and actionable steps your board can take today.
1. Financial Deficits & Internal Friction
- The Reality: Around 41% of charities spent more than their income over the past financial reporting period, with smaller charities operating on paper-thin margins. Furthermore, insolvency casework jumped by nearly 28%, and voluntary removals from the charity register rose by more than a third.
- The Overlooked Consequence: Financial strain is driving governance conflict. Internal disputes within charities rose by 57% (to over 900 recorded cases), frequently triggered by tough decisions on cost-cutting, asset management, and trustee succession.
What your charity should do:
- Establish multi-scenario forecasting: Move away from single annual budget assumptions. Run rolling forecasts that model a 10–15% drop in unrestricted income alongside sticky inflation.
- Review reserve policies: Ensure your reserve policy reflects real operational risks (e.g., contractual obligations or redundancy costs) rather than keeping an arbitrary number of months’ operating costs in mind.
- Proactive dispute resolution: Address trustee disagreements early before they paralyze operations. Clear terms of reference, trustee codes of conduct, and skills-matched recruitment plans prevent decision-making bottlenecks.
2. Cyber Threats and the AI Double-Edged Sword
- The Reality: Cyber risk is now firmly mainstream across non-profits. 30% of charities experienced a cyber attack in the last year, with phishing and ransomware remaining the top threats.
- The Emerging AI Dynamic: AI presents dual concerns:
- Bad actors are utilizing AI tools to submit sophisticated, fraudulent charity registration applications and grant claims.
- Charities are adopting AI internally without adequate oversight or risk frameworks, exposing sensitive beneficiary data to third-party tools.
What your charity should do:
- Implement Cyber Hygiene Basics: Ensure key accounts use multi-factor authentication (MFA) and enforce regular, out-of-band backups for donor databases and operational systems.
- Adopt an Acceptable AI Use Policy: If staff or volunteers use AI (e.g., ChatGPT or Copilot) for draft writing, bid preparation, or research, establish clear parameters. Mandate that no confidential, personal, or beneficiary data be inputted into public AI models.
- Maintain Board Accountability: Remember that while delegation to tech leads or vendors is necessary, ultimate risk management responsibility for AI rests with the board.
3. Protecting Charitable Status & Preventing Abuse
- The Reality: Cases involving the abuse of charitable status for private benefit have grown significantly. Concerns regarding related-party transactions, unmanaged conflicts of interest, and less-transparent payment structures (such as money service businesses or vouchers) are coming under intense regulatory scrutiny.
What your charity should do:
- Audit Related-Party Transactions: Regularly check transactions between the charity, trustees, founders, or their family members. Ensure every decision involving remuneration, property leases, or supplier contracts is made at arm’s length, formally documented, and declared.
- Strengthen Payment Verification: Limit cash and non-traditional payment systems. Implement dual-signatory controls for high-value transactions and due-diligence protocols for grant distribution.
4. Safeguarding Remains Top Priority
- The Reality: Safeguarding continues to account for roughly 25% of all concerns raised with the Charity Commission. Recent casework underscores vulnerabilities related to individuals in positions of high influence or trust (including spiritual, founder, or senior management roles) where traditional reporting mechanisms can break down.
What your charity should do:
- Break Down Hierarchy Barriers: Ensure your safeguarding policies apply equally to senior leadership, founders, and trustees. There should be a clear, direct path to report concerns to an independent trustee or external body if a leader is implicated.
- Test Policy Awareness: Having a document on your website is not enough. Routinely check whether staff, frontline volunteers, and beneficiaries actually know how to report a concern safely.
A 20-Minute Action Framework for Your Next Board Meeting
Rather than burying the Charity Commission’s update in your reading pack, spend 20 minutes running your board through this “Could That Be Us?” exercise:
- Financial Pressure Check: If our top income stream drops by 20%, how many weeks until our cash reserves are compromised?
- Cyber Security Check: When was our last phishing test or mandatory security refresher for staff and volunteers?
- Governance Check: When did we last update our conflicts of interest register, and is anyone serving beyond their term limit?
- Safeguarding Check: Can a volunteer confidentially report a concern about a senior figure without fear of reprisal?
Regulatory compliance is not just about avoiding penalties; it is about maintaining public trust so your charity can continue to deliver on its mission in an unpredictable landscape. Take time this month to review your risk register against the Commission’s recommendations.
Contact mikefarrell@charity-registration.com for a free 20-Minute Board Discussion Template based on the 2026 Charity Sector Risk Assessment
