Charities Governance Code – Principle 4: Exercising Control

CalQRisk Analysis – Inside the Charities Governance Code

Charities Governance Code – Principle 4: Exercising Control … what’s that all about?

Just like any other organisation, charities are expected to comply with all relevant legal and regulatory obligations. And while the buck ultimately stops with the trustees of the charity, as it does with the board of directors in other organisations, a charity’s staff and volunteers also have key roles to play in ensuring compliance.

While many organisations tend to view compliance as a tick-box exercise, there are many benefits to establishing and maintaining compliance with your legal and regulatory obligations:

  • Regulators will have more confidence in your organisation,
  • The public will be more likely to donate, and
  • The recruitment of trustees and volunteers may be easier too.

Below, we explain Principle 4 of the Governance Code in a little more detail and suggest what “good governance” might look like.

Where to Start?

One of the core standards under this principle is finding out the laws and regulatory requirements that apply to your charity…and complying with them! But how would you do that in practice?

Our suggested approach, outlined in the diagram below, starts out with identifying all the relevant legal and regulatory obligations. When doing this, you may need to think broader than just the Charities Regulator. For example, the General Data Protection Regulation (GDPR) is probably a concern, and some charities may have requirements from the provision of certain of their services that might make the likes of HIQA or Tusla regulations relevant. If you raise funds from the public, you will also need to review the Charities Regulator’s guidelines on this and consider how you comply with it. too.

Next, comes the gap analysis. You will need to read through each piece of regulation / legislation and identify the relevant obligations that your charity must or should comply with. And, for each obligation, you must also decide whether you comply with it or not.

And finally (and this is the part that many organisations struggle with), you will need evidence. You need to be able to demonstrate that you have done your gap analysis, identified the potential compliance issues, and put action plans in place to fix them. All of this should be backed up by periodic reporting to your senior management team (depending on the size of the organisation) and your board of directors / trustees.

Identify your Risks

Another of the core standard in Principle 4 focuses on identifying the risks your charity is exposed to and how you manage them. Again, we have suggested an approach to this in the diagram below.

Begin with a simple identification exercise – when thinking about the risks your charity is exposed to, consider the context in which you are operating:

  • What services do you provide?
  • What data do you use / collect?
  • What risks are unique to your organisation versus those that may be applicable to almost all charities?

Once you have identified all your risks, you need to identify the controls you have in place to mitigate each risk (this should help solve the “how to manage” the risks part of the core standard). When thinking about your controls, consider whether the compliance obligations you have already satisfied may also be controls that mitigate a risk. It is also worth considering your financial controls here, which satisfies yet another core standard.

Maintain a Risk Register

To finish, we suggest you maintain a risk register with all this information in it. While the maintenance of a risk register is seen as an “Additional Standard” in the Code, you may find it difficult to demonstrate your compliance with this core standard without having a risk register in place… how can you demonstrate that you have identified all of your risks and how they are being managed without one?

Conclusion

While we understand that Principle 4 contains other core standards, our suggestions above may help you and your charity to satisfy the main ones. Remember, evidence is key when trying to demonstrate compliance with any code, whether regulation or legislation.

 

To learn more about how the CalQRisk solution can assist your charity in satisfying the requirements of the Charities Governance Code (and many other relevant obligations), click here.

Recent News

6 things you need to know about the Individual Accountability Framework (IAF)

The Central Bank of Ireland has recently released regulations and guidance on the Individual Accountability Framework (IAF). Here ...
Read More

Paysend chooses CalQRisk as their Risk Management Solution

Paysend, a next generation integrated global payment ecosystem, has recently implemented the CalQRisk solution in order to enhance ...
Read More

ESG and Sustainability Reporting

The practice of businesses promoting sustainability and social responsibility in their operations can be traced back to the ...
Read More

CalQRisk Wins Best RegTech Solution at National Fintech Awards

CalQRisk, a leading provider of Governance, Risk & Compliance solutions has won the ‘Best Regtech Solution Award’ at ...
Read More

CalQRisk shortlisted in National Fintech Awards

The CalQRisk solution is shortlisted for ‘Best Regtech Solution Award’ at the inaugural National Fintech Awards. The National ...
Read More

CalQRisk shortlisted in 2023 CIR Risk Awards

Having won ‘Risk Management Product of the Year’ at the 2022 CIR Risk Management Awards, CalQRisk is now ...
Read More

From Risk Capacity to Risk Appetite

Risk Capacity is the maximum amount of risk that an organisation is technically able to assume before breaching ...
Read More

SMT automates their approach to Risk Management with CalQRisk

SuMi TRUST Global Asset Services (“SMT”), a subsidiary of Sumitomo Mitsui Trust Bank Limited, one of the largest ...
Read More

Digital Operational Resilience for the Financial Sector Act (DORA)

The Digital Operational Resilience Act (DORA) entered into force on 16th  January 2023. It outlines EU regulations for information ...
Read More
Database

8 Things to Consider in a Data Breach Response

A data breach can lead to reputational damage, financial losses and much more. By effectively preventing and investigating ...
Read More