How can charities confidently manage compliance requirements?

Whether staff, contractors or volunteers, if there are individuals and teams delivering activities that require knowledge of compliance risks, you need to know they have the skills and expertise to ensure they are managing compliance risk when performing these day-to-day activities.

Individuals should be responsible for keeping themselves updated on relevant requirements (typically through an approved training plan that includes mandatory training and CPD).

Individuals should also understand that they are responsible for working to the policies, procedures and guidance that have been agreed.

The first step for charity governance bodies is to agree an oversight structure that will enable effective monitoring of compliance risk. There should be a free flow of information within this structure to enable both timely challenge and assurance.

Management should feel confident there is sufficient supervision of activities that support compliance. For example, assuring themselves they are confident that procedures and training reflect current compliance requirements, and that there are mechanisms for updating these, as soon as requirements change (or even in advance).

Charities also benefit from their managers being able to verify that training and current procedures have been understood. There should be supervision to quickly identify whether processes are being followed in practice.

Typically, a proportionate approach is taken to ensure the best use is made of the charity’s available resources. Good use can be made of a charity’s risk experts to support this process design.

Governing bodies may decide that specialist skills are required within the management tier to provide confidence that legal and regulatory risks are being managed. The structure shouldn’t disrupt the charity’s ability to be agile and respond to changes in the compliance risk environment through excessive oversight and there is a balance to be struck.

Perhaps most valuable, are compliance reporting mechanisms that directly relay how a charity is performing in managing its compliance risk. Reporting enables management and governance bodies to monitor and challenge performance.

We often see a disparate approach to reporting compliance activities in various parts of the organisation. We find management and trustees welcome a consolidated view on how a charity is managing its compliance risk. Consolidated reporting has the added benefit of supporting charities to spot themes that can be addressed more efficiently through an organisation-wide approach, rather than in silos.

Aligning risk and performance reporting is also helpful in providing a consolidated view. The two should be interdependent so that where performance reporting indicates there is a potential compliance risk, this informs the risk register and mitigations can be closely monitored.

The quality of compliance performance and risk data is key. Having risk expertise within a charity helps there to be robust challenge of the accuracy of information reported in relation to how well compliance risks are being managed. This is essential to support decision making.

To be able to manage its response to compliance risks, charities also need to be alert to the likelihood and impact of any compliance breach so that they can make appropriate decisions around the level of investment required.

Accepting an increased risk is typically more acceptable in some areas and functions than others, and mapping this can release funds for the organisation to divert elsewhere.

We typically see charities agree their risk appetite for compliance risk. This is then embedded into their risk management approach through assigning a target risk score on their risk register. Well performing charities then document and monitor key risk indicators to provide an early warning mechanism that the risk score may be increasing to an unacceptable level so that management and governance bodies are aware that attention is required.

Similarly, in high volume data-driven charities, a specialist performance reporting team may be required to provide assurance on the data being produced.

Importantly, governing bodies also need to ensure there is external assurance that will provide independent and objective challenge to the organisation about its key compliance risks.

Obtaining external assurance provides you with an independent and objective view, giving you confidence that your compliance risk is being well managed.

Depending on the nature of the compliance risk, you may particularly value a specialist opinion from experts that have a robust compliance methodology and insight into other charities’ approaches.

One of the many benefits of an internal audit service is that it can work with you in an advisory capacity to support you in designing your compliance framework to ensure you are set up for success.

You can then expect your internal auditors to give you confidence, through their assurance work, that your compliance picture is being reported accurately.

What kinds of questions can an internal audit help you to answer?

• How do you know that your methodology is compliant with regulatory requirements?
• How do you know the policies and procedures you have agreed, are actually being followed in practice?
• How do you know the performance and risk metrics being reported to you are accurate? Are they based on a full set of data and is the information verified for factual accuracy before being sent to you?

All of the above will support your commitment to continually improve how your charity is managing your compliance risk.