How to carry out a risk assessment

Every charity faces a unique range of risks that vary according to the activities they do, where and how they do them, who is involved, and what is at stake. Therefore, each organisation must monitor and manage their own specific risks in order to protect their people, property and public image from harm.

The best way to help keep harm at bay is through a thorough risk assessment, which involves identifying:

• what hazards your charity is exposed to;
• how likely it is that a harmful event could occur;
• what your charity could lose from such an event;
• how much you could afford to bear the risk; and
• what you can do to reduce the risk

This guide will take you through the key steps for conducting a risk assessment so you can take practical precautions to limit potentially irreparable damage to your charity’s finances and reputation. 

Firstly, it’s important to identify who is responsible for risk management within your organisation and what measures are required by law. 

• As a charity, your board members and trustees are in charge of ensuring things operate within your organisation’s policies, its budget, and the law. This includes ensuring all staff and volunteers are fully trained in every aspect of their work and made aware of the risks involved. 
• If you have five or more employees, it is a legal requirement to keep records of your risk assessments. These must include what risks were identified, details of any especially vulnerable people, the actions already being taken, and any further action required. Additionally, UK charities earning above £500,000 must include a risk management statement in their annual report.
   

Carrying out a risk assessment

It may be useful to download a risk assessment template to fill in or you can create your own table with steps one to five as column headings and then one row per risk.

Step One: Identify the hazards

Begin by identifying things that could harm your charity, your people, your property, or members of the public. This could be damage caused by natural disasters, machinery malfunctions, theft of valuable equipment, and everyday accidents like slips, trips, and falls. Remember that people can also suffer mental as well as physical harm. Think about:

• What situations would stop your organisation meeting its goals, cause serious financial loss, or damage your reputation?
• When and where could your organisation and employees be exposed to harm? 
• Do you work with any vulnerable people that need safeguarding?

You should conduct risk assessments for each activity and event as weather, equipment, location and people’s experience level will vary each time. At this stage, you may spot circumstances in which insurance could help recover the costs.

Step Two: Identify the impacts

When you have identified each risk, consider the potential consequences if they were to occur. This will help you decide what precautions to take. For each risk, think about:

• What injuries could occur and to whom?
• What property could be damaged or stolen?
• What is the potential severity of the harm or loss? 

Next, assess the likelihood of each risk occurring and weigh that up against its potential severity. A useful tool here is a risk matrix, whereby you assign each risk a low, medium or high severity and a low, medium, or high probability. This will help you prioritise protection against the most likely, most damaging risks, and consider whether it’s worth taking measures against unlikely, minor risks.

Step Three: Take appropriate precautions

After assessing the risks, think about how to reduce them to an acceptable level without limiting your charity’s potential. This could be through:

• extra training
• extra security
• building upgrades
• enlisting more adult supervisors at children’s events
• limiting the use of risky venues or equipment

Every charity should set strict but sensible work safety procedures and ensure all staff and volunteers both understand and follow them. There are lots of online resources on controlling risks at work, such as this Health and Safety Executive toolbox.

If there are risks you cannot reduce to an acceptable level, consider additional safety measures, taking out insurance, or, in extreme cases, cancelling the activity entirely. Of course, being too cautious could limit what your charity can achieve and you’ll need to weigh up what risks are worth taking. The UK Health and Safety Executive provides useful guidance on sensible risk management.

Step Four: Prepare for the worst

Even the most stringent safety measures cannot prevent every possible incident. Accidents do happen, and unprecedented natural disasters can catch everyone unawares. Part of your risk assessment should include writing a Business Continuity Plan, which lays out your emergency response and recovery procedure for if a disaster strikes. This is crucial for keeping operations running throughout the disruption. The next best defence is insurance, which can provide cover for medical and legal bills, loss of income, as well as property repair and replacements.

Step Five: Appoint your Health and Safety reps

It’s important to agree on key responsibilities within your organisation and, while everyone should of course play their part, each charity should have Health and Safety representatives in place to implement, monitor and report back on risk reduction measures.

A Health and Safety reps’ role is to control risks in order to prevent work-related accidents and illness. They should:

• Ensure employees are trained to do their job safely
• Uphold safe and healthy working conditions
• Update employees on health and safety conditions
• Provide advice and support on occupational health
• Implement emergency procedures in case of an incident

Step Six: Monitor, assess and review periodically

The risk assessment is not a one-off task to be ticked off the list and forgotten about. Risk management is a dynamic process that requires constant monitoring to ensure your safety methods are still appropriate. So, while much of the hard graft is done in creating the initial risk assessment, you will need to update it whenever your safety measures need improving or if new risks need adding, for example whenever you start a new activity.

To keep your risk assessment up-to-date, your charity should:

• Report and evaluate any new risks, and add them to the risk assessment
• Create separate risk assessments for any new projects or one-off activities
• Report and respond to any failures in current systems
• Make it clear who is responsible for monitoring and implementing these systems
• Identify any further actions required and who will see them through
• Provide your trustees with relevant and timely reports

Under stable conditions, an annual review of the risk assessment by your trustees should be sufficient for most charities. More frequent reviews may be required if your activities have a higher risk profile. And don’t forget, successful risk management requires excellent communication between staff at all levels, so nobody is caught unawares.

Step Seven: Consider your insurance options

There will nearly always be risks that you cannot feasibly (or affordably) eliminate entirely, but you can protect your charity against financial losses by taking out appropriate insurances. For example, Buildings and Contents insurance can provide cover for the rebuild and replacement costs if a flood or fire was to destroy your property. However, some risks cannot be insured against if they are too unusual, too frequent, or too extreme. 

We recommend keeping a risk register, a simple spreadsheet where you can record, prioritise and comment on each risk, as this will help you easily identify what insurances you might need, and our guide to getting the right level of cover can help you to assess the costs you may need to recover.
 

How can Unity Insurance Services help?

As a specialist insurance broker and part of a charity ourselves, we understand the range of risks faced by not-for-profits. If you’d like to talk through your risk assessment or find out more about charity risk management, call our friendly team of experts.