CC26 risk guidance refresh: what has changed for charities?

The Charity Commission’s refreshed Charities and Risk Management (CC26) guidance marks a noticeable shift in tone. For charity finance leaders, trustees and audit committees, the update is less about introducing entirely new obligations and more about changing how risk management is understood. That shift matters.

From compliance exercise to strategic oversight

For many charities, risk management has historically been a box-ticking exercise. It has often centred on maintaining extensive risk registers, updating board papers and demonstrating compliance.

The refreshed guidance places greater emphasis on governance, decision-making and organisational resilience. In doing so, it reflects much of the direction advocated earlier this year by Charity Finance Group (CFG) and The Risk Collaborative in their report Rethinking Risk: Recommendations for a CC26 refresh calling for CC26 to be modernised.

One of the most important developments is the renewed emphasis on proportionality. The guidance recognises that risk management should reflect a charity’s activities, complexity and operating environment, rather than simply its size.

This distinction is important when charities are navigating funding pressures, rising demand, cyber security risks, safeguarding expectations and continuing economic uncertainty.

What the CC26 refresh means for finance teams

For finance teams, the guidance creates an opportunity to move away from viewing risk management primarily as a process and towards using it as a tool for strategic oversight. In practice, this means focusing less on whether every conceivable risk has been documented and more on whether trustees receive the information they need to make informed decisions.

This aligns closely with the direction of travel in the new Charities SORP 2026. The new SORP framework introduces tiered reporting expectations. Larger charities are expected to provide more sophisticated disclosures about governance, financial resilience and principal risks. While the SORP uses income thresholds to determine reporting tiers, the refreshed CC26 guidance takes a more subtle view. It recognises that risk exposure is not determined by income alone.

A charity with relatively modest income may still face significant safeguarding, reputational or cyber security risks. Equally, a larger but operationally stable charity may not need a highly complex enterprise risk system. The Charity Commission’s updated guidance acknowledges this reality.

Better discussion, not more documentation

For charity professionals, the implication is clear: the quality of risk discussions is becoming more important than the volume of risk documentation.

Boards will increasingly need to demonstrate how risk management supports strategic objectives, financial sustainability and operational resilience. This is particularly relevant for Tier 2 and Tier 3 charities under the new SORP. Regulators will expect meaningful narrative reporting rather than generic descriptions of controls and processes.

By the same logic, the CC26 refresh appears to validate simpler and more proportionate approaches for smaller charities. This should be welcome news for organisations concerned about governance burdens and limited capacity.

Effective risk management does not necessarily require sophisticated software, extensive frameworks or highly technical methodologies. In many cases, strong trustee challenge, clear escalation routes and regular discussions about emerging issues will be more valuable.

Where the refreshed guidance could go further

There are areas where the refresh is more cautious than some in the sector had hoped.

The CFG and The Risk Collaborative report called for more ambitious reforms, including a formal risk-profiling framework and clearer discussion of risks arising from funder compliance requirements. These proposals do not appear materially in the refreshed guidance.

Even so, the direction of travel is clear. Risk management is increasingly being positioned not as a standalone compliance exercise but as part of effective governance and strategic leadership.

For charity leaders, that may be the most significant change of all.

How Moore Kingston Smith can help

Charities should consider whether their current approach supports meaningful trustee discussion, reflects their actual risk exposure and provides a sound basis for future reporting.

Moore Kingston Smith’s nonprofit advisory team helps charities take a proportionate and practical approach to risk. We can help you define your risk appetite, strengthen your governance framework and develop the supporting tools and documentation your organisation needs.

If you would like to discuss what the refreshed CC26 guidance means for your charity, please contact us.