This article is part of a suite of charity law updates on the Autumn 2026 Charity Commission guidance. 

The Charity Commission updated its risk management guidance (CC26) in September 2026, introducing a refined methodology that gives greater weight to high-impact, low-likelihood events and an updated heat map scoring approach. This section explains what has changed, who must include a risk statement, and the key actions trustees should take now.

What's changed?

CC26 was updated on 16 September 2026. The guidance now includes current thinking on risk assessment models and draws attention to the distinction between financial risks and non-financial risks (even where non-financial risks ultimately have a financial impact). There is no change to the regulatory requirements for charities.

The key practical changes are in the risk assessment methodology itself, specifically, the move towards giving greater weight to high-impact, low-likelihood events and the introduction of an updated heat map scoring approach.

Who must include a risk statement?

Charities required by law to have their accounts audited must include a risk management statement in their trustees' annual report confirming that the trustees have considered the major risks to which the charity is exposed and are satisfied that systems or procedures are in place to manage those risks.  

Trustees of smaller charities below the audit threshold are encouraged to include a risk management statement as good practice.

What the statement must cover

The risk management statement should give readers an insight into how the charity handles risk and an understanding of the major risks the charity faces. 

A narrative style addressing the key aspects is acceptable: an acknowledgement of the trustees' responsibility; an overview of the risk identification process; an indication that major risks identified have been reviewed or assessed; and confirmation that control systems have been established to manage those risks. 

New emphasis: High-impact, low-likelihood risks

Previous guidance gave equal weight to impact and likelihood. Many organisations now account for events that are rare or unprecedented, where the rules are unknown or rapidly changing, or where risks are driven by external factors beyond their control. 

These very high-impact, very low-likelihood risks are now widely accepted as having greater importance than those with high likelihood but insignificant impact.

This is a notable change. Boards should no longer focus exclusively on events that are likely to happen; they should also specifically consider scenarios (however improbable) that would be catastrophic if they did occur.

New emphasis: Linked and cumulative risks

A focus on high-impact risk is important, but trustees should not forget that a lower-impact risk can change to a very high-impact risk because of the possible connection between it happening and triggering the occurrence of other risks. 

Updated scoring: The heat map

The guidance introduces an updated heat map using the scoring formula xy+y, where x is likelihood and y is impact. This multiplies impact with likelihood and then adds a further weighting for impact, so that impact carries more weight than likelihood. Risk scoring involves a degree of judgement; where data on past events or patterns is available, it will help enable more evidence-based assessments.

Under this model: red risks (major or extreme/catastrophic) score 15 or more; yellow risks (moderate or major) score between eight and 14; blue or green risks (minor or insignificant) score seven or less.

Risk categories to consider

The guidance identifies key risk categories: 

• Governance risks (such as inappropriate organisational structure, trustee body lacking relevant skills, conflicts of interest).
• Operational risks (including beneficiary welfare and safety, poor contract pricing, staff recruitment and training) 
• Financial risks (including inadequate reserves, dependency on limited income sources, insufficient insurance).
• External risks (including reputational damage, demographic changes, turbulent economic or political environment, changing government policy).
• Compliance risks (including acting in breach of trust, poor knowledge of legal and regulatory responsibilities).

Risk is a dynamic process

Risk management is not a one-off event and should be seen as a process that will require monitoring and assessment. Annual monitoring by trustees supplemented by interim reports is likely to be sufficient for most charities where operating conditions are stable; depending on the charity's risk profile, more frequent monitoring might be advisable. 

Key action points

• Review your risk register and risk assessment methodology in light of the Commission's updated guidance. In particular, ensure that your methodology gives appropriate weight to high-impact, low-likelihood events, not just likely risks.
• Review whether any risks in your register could act as triggers for other, linked risks and captures these connections accordingly.
• If your charity is subject to a statutory audit, ensure your trustees' annual report contains a risk management statement with a meaningful narrative.
• Smaller charities not subject to audit are encouraged (though not required) to include a risk statement as a matter of good practice and to demonstrate accountability.
• Consider whether AI use and cyber threats, together with environmental or supply chain disruption, have been captured in your risk register as external risk categories.