Embedding policies in charities part two: Could it happen to us?

Understanding risks

Trustees must understand the risks to which their charity is exposed and ensure these risks are properly managed. The inquiry into Oxfam acknowledged that trustees cannot be expected to have a detailed oversight or involvement in day-to-day work, but it reiterated the importance of effective monitoring, assurance and accountability structures within charities.

Trustees and management need to work together constructively and in a way that fosters good morale within the organisation. However, trustees must be able to challenge management and hold them to account in order to adhere to their responsibilities under charity law.

Questions to ask:

• Is the quality of reporting to trustees sufficient for them to assess the risks to which the charity is exposed and ensure that they are being managed?
• How does the risk management process interact with the assurance and accountability mechanisms?
• If we have an internal audit function, how is that work planned, directed and reported to the trustees?

Staffing and human resources

The Commission found that the allegations which publicly came to light in 2018 had been known by Oxfam in 2010 and 2011. A number of employees had raised concerns and though in some cases, steps had been taken to address the allegations, there was a lack of appropriate infrastructure to respond to such incidents. This contributed, at least in part, to a lack of morale amongst staff and low confidence in those in management and leadership posts to effectively respond to concerns. 

There were also particular issues identified in the allocation of resources to safeguarding, with the inquiry finding that “resources and capabilities did not adequately match the levels of risk faced by the charity”. Charities need to ensure that the risks inherent in the activities they undertake are properly managed through appropriate staffing and review.

In addition, the Commission found that some enquiries made by senior management and their subsequent discussions had not been documented, and was critical of the charity for failing to ensure that there was a sufficient audit trail to show how problems had been addressed.

Questions to ask yourself:

• How do we monitor morale of our staff?
• Do we have clear processes for staff to raise concerns and are we making staff aware of them?
• How do managers demonstrate that they are acting on concerns, while respecting confidentiality?
• How do trustees gain an understanding of the views of staff beyond the executive / senior management team?
• Is our staffing structure linked to our strategy and risk profile to ensure adequate risk management?
• How do we document discussions arising in relation to staffing and other matters, which occur outside of formal meetings?

Lessons learnt and regular reviews

The inquiry into Oxfam did find evidence of review of arrangements and procedures where things had gone wrong, but once matters were considered closed, there was limited follow up after this. It also identified that the frequency of reporting on safeguarding matters, in particular, had been reduced to bring it into line with other risk areas. 

In many of the areas in which charities work, the economic, political or environmental landscape can shift quickly, sometimes almost overnight. Charities need to remain nimble and responsive to these changes, ensuring that new risks are identified and managed. However, it is important not to lose sight of the more established practices and ensure they remain fit for purpose.

Questions to ask yourself:

• How regularly do we revisit and update our policies and procedures?
• What are our mechanisms for periodic testing of our policies and procedures?
• How do we consider lessons learnt from incidents and factor these lessons into future planning?

Responding to audit findings

A number of internal audits and reviews were carried out by various personnel within Oxfam and findings made available to the executive team and trustees. The Commission identified that, in some cases, it was not clear how these findings had been closed or superseded. It is risky when findings and recommendations are closed without sufficient scrutiny of how the recommendations have been implemented. Equally, findings may become superseded by later events and it is important to ensure that there is a clear audit trail of how changes have been embedded into the fabric and culture of the organisation.

Questions to ask yourself:

• Do we implement audit / review findings in isolation or do we consider their wider impact on our policies and processes?
• How do we ensure that there is an audit trail demonstrating how we have implemented recommendations?

Reporting serious incidents

Since the allegations surfaced in 2018, there has been greater focus on the meaning of ‘serious incident’ in relation to the Commission’s reporting regime. The inquiry found that Oxfam’s focus was on financial incidents which needed to be reported to the Commission and its donors. In addition, it also concluded that possible criminal matters had not been reported to local police.

Many charities are now finding that the Commission’s opinion when engaging with them is that there are other incidents which should have been reported in the past. Reports should also contain the material facts of what has taken place.

Questions to ask yourself:

• Do we have a mechanism for reviewing incidents reported internally to determine if external reporting to regulators, donors and/or other agencies is necessary?
• Does our reporting mechanism ensure that all of the material facts of an incident are captured in the reports we make to regulators, donors and others?

Conclusion

The specific circumstances of the matters which led to the Commission’s investigation into Oxfam are not thought to be rife across the charity sector, however, it demonstrates how many small issues and failings can eventually became cumulatively significant. By ensuring that policies, monitoring of compliance and follow up of findings are properly embedded, you can reduce the risk that it will happen to your organisation.