In October the Charity Commission published the report of its 'safeguarding taskforce', which was set up in February to conduct a 'deep dive' into safeguarding serious incident reports and review increased reporting of these incidents from charities.
This report is accompanied by an update to the Charity Commission's guidance on serious incident reports. This update focuses on safeguarding issues but also includes important changes to the Charity Commission's general approach to serious incident reports which all charities should take notice of.
Safeguarding
The Charity Commission has significantly expanded guidance on the issue and definition of 'safeguarding' and how it feeds into serious incident reporting, in particular:
- it now includes as a safeguarding issue and a serious incident both ' harm to your charity's beneficiaries' and also to 'staff, volunteers or others who come into contact with your charity through its work';
- it notes that an 'incident that involves actual or alleged criminal activity will usually be reportable to the Commission' and should be reported even before arrests, charges or convictions are made, noting 'what action you have taken or are planning to take at the time of reporting';
- the importance of reporting sexual harassment is stressed where 'the level of harm to the victims and/or the likely damage to the reputation or public trust in the charity is particularly high' or it 'indicates widespread or systematic issues connected to sexual harassment, abuse and/or other misconduct in a charity'; and
- it is confirmed that a charity might still need to report safeguarding incidents which occur 'outside of a charity' where 'it's found (or alleged) that the incident wasn't handled appropriately by your charity and this resulted in harm to the person or persons concerned'.
General
The Commission notes that where it 'later becomes involved' in a serious incident which isn't reported the charity in question 'will need to be able to explain why [you] decided not to report it at the time.'
The guidance has removed the old approach of 'if in doubt, report it' - previously summed up in the guidance as 'if, having read this guidance, you're unsure whether the incident should be reported, it's best to report it anyway - the Commission can then decide what to advise you and what action, if any, is appropriate.'
The Commission has also tempered its enthusiasm for periodic 'bulk reporting' by charities. It notes that charities may agree to multiple reporting or to forwarding on reports submitted to other regulators, but only where 'the Commission is satisfied that the charity has appropriate policies and procedures, and mechanisms for the application of those policies/procedures' to deal with serious incidents and where the information given on each incident includes 'the action taken to deal with it'.
It clarifies the kinds of serious incident which are so serious that they cannot be saved up for a bulk report but must be reported immediately including:
'incidents that attract significant media attention that results in or risks significant harm to the charity's reputation;
incidents involving a significant live and ongoing risk to the charity's operations, money, assets, property or the people who come into contact with it through its work; and
incidents that involve links to terrorism and extremism'.
The guidance specifies the email charities can report serious incidents to. It also repeats the need for the person reporting to have authority to submit, and clarifies it expects a trustee to have the board's backing where they are doing so as an individual.
Data Protection and Freedom of Information Act
The guidance now includes as typical serious incidents 'significant data breaches/losses' and clarifies the Commission's own approach to the data and sensitive information it receives through serious incident reports.
The Commission cautions charities that 'it is not necessary' to be overzealous and 'to provide the names of any individuals involved in the incident in your initial report - the Commission will come back to you if it needs this information'.
This is just as well, because the updated guidance also makes the Commission's position clear that 'even where the Commission decides not to take immediate action in response to a report, it may store the information and process it in the future'.
The Charity Commission cannot 'guarantee' confidentiality for information provided as part of a serious incident report, unless the charity can show information is so 'sensitive and confidential' that an exemption will apply to the Commission's reasons for disclosure at law.
Work with partners
The Charity Commission now includes as typical serious incidents 'incidents involving partners' either in the UK or internationally, which 'materially affects [your] charity, its staff, operations, finances and/or reputation, such that it is serious enough to be reported'.
In this context a partner will include:
- 'a delivery partner of the charity;
- a subsidiary trading company of the charity;
- an organisation that receives funding from the charity; and
- another charity or organisation that is linked to your charity, for example as part of a federated structure.'
