Embedding policies in charities part two: Could it happen to us?

This article examines some of the issues raised from the charity commission’s investigation into Oxfam and what lessons can be learnt for other charities when looking at their own internal structures and policies.  

About the author

+44 (0)207 710 0954

Following our article in October 2018, Embedding policies in Charities: What’s the ‘tone at the top’?, we consider the findings from the recent Charity Commission investigation report into Oxfam. The report identifies that while Oxfam did have whistleblowing structures in place, carried out investigations into some of the allegations and trustees were receiving regular reports, there were a number of failings in the implementation of these measures, which ultimately resulted in things going very wrong.

All charities can learn lessons from this, and below we’ve put together some key points for trustees and managers to think about when critically assessing whether similar issues could arise within their organisations.

Understanding risks

Trustees must understand the risks to which their charity is exposed and ensure these risks are properly managed. The inquiry into Oxfam acknowledged that trustees cannot be expected to have a detailed oversight or involvement in day-to-day work, but it reiterated the importance of effective monitoring, assurance and accountability structures within charities.

Trustees and management need to work together constructively and in a way that fosters good morale within the organisation. However, trustees must be able to challenge management and hold them to account in order to adhere to their responsibilities under charity law.

Questions to ask:

  • Is the quality of reporting to trustees sufficient for them to assess the risks to which the charity is exposed and ensure that they are being managed?
  • How does the risk management process interact with the assurance and accountability mechanisms?
  • If we have an internal audit function, how is that work planned, directed and reported to the trustees?

Staffing and human resources

The Commission found that the allegations which publicly came to light in 2018 had been known by Oxfam in 2010 and 2011. A number of employees had raised concerns and though in some cases, steps had been taken to address the allegations, there was a lack of appropriate infrastructure to respond to such incidents. This contributed, at least in part, to a lack of morale amongst staff and low confidence in those in management and leadership posts to effectively respond to concerns. 

There were also particular issues identified in the allocation of resources to safeguarding, with the inquiry finding that “resources and capabilities did not adequately match the levels of risk faced by the charity”. Charities need to ensure that the risks inherent in the activities they undertake are properly managed through appropriate staffing and review.

In addition, the Commission found that some enquiries made by senior management and their subsequent discussions had not been documented, and was critical of the charity for failing to ensure that there was a sufficient audit trail to show how problems had been addressed.

Questions to ask yourself:

  • How do we monitor morale of our staff?
  • Do we have clear processes for staff to raise concerns and are we making staff aware of them?
  • How do managers demonstrate that they are acting on concerns, while respecting confidentiality?
  • How do trustees gain an understanding of the views of staff beyond the executive / senior management team?
  • Is our staffing structure linked to our strategy and risk profile to ensure adequate risk management?
  • How do we document discussions arising in relation to staffing and other matters, which occur outside of formal meetings?

Lessons learnt and regular reviews

The inquiry into Oxfam did find evidence of review of arrangements and procedures where things had gone wrong, but once matters were considered closed, there was limited follow up after this. It also identified that the frequency of reporting on safeguarding matters, in particular, had been reduced to bring it into line with other risk areas. 

In many of the areas in which charities work, the economic, political or environmental landscape can shift quickly, sometimes almost overnight. Charities need to remain nimble and responsive to these changes, ensuring that new risks are identified and managed. However, it is important not to lose sight of the more established practices and ensure they remain fit for purpose.

Questions to ask yourself:

  • How regularly do we revisit and update our policies and procedures?
  • What are our mechanisms for periodic testing of our policies and procedures?
  • How do we consider lessons learnt from incidents and factor these lessons into future planning?

Responding to audit findings

A number of internal audits and reviews were carried out by various personnel within Oxfam and findings made available to the executive team and trustees. The Commission identified that, in some cases, it was not clear how these findings had been closed or superseded. It is risky when findings and recommendations are closed without sufficient scrutiny of how the recommendations have been implemented. Equally, findings may become superseded by later events and it is important to ensure that there is a clear audit trail of how changes have been embedded into the fabric and culture of the organisation.

Questions to ask yourself:

  • Do we implement audit / review findings in isolation or do we consider their wider impact on our policies and processes?
  • How do we ensure that there is an audit trail demonstrating how we have implemented recommendations?

Reporting serious incidents

Since the allegations surfaced in 2018, there has been greater focus on the meaning of ‘serious incident’ in relation to the Commission’s reporting regime. The inquiry found that Oxfam’s focus was on financial incidents which needed to be reported to the Commission and its donors. In addition, it also concluded that possible criminal matters had not been reported to local police.

Many charities are now finding that the Commission’s opinion when engaging with them is that there are other incidents which should have been reported in the past. Reports should also contain the material facts of what has taken place.

Questions to ask yourself:

  • Do we have a mechanism for reviewing incidents reported internally to determine if external reporting to regulators, donors and/or other agencies is necessary?
  • Does our reporting mechanism ensure that all of the material facts of an incident are captured in the reports we make to regulators, donors and others?


The specific circumstances of the matters which led to the Commission’s investigation into Oxfam are not thought to be rife across the charity sector, however, it demonstrates how many small issues and failings can eventually became cumulatively significant. By ensuring that policies, monitoring of compliance and follow up of findings are properly embedded, you can reduce the risk that it will happen to your organisation.


Want to speak to one of our charity experts?

If you have any questions about any of the points raised in this article, please complete the form below and one of our charity experts will be in touch. 

Please verify yourself above.
Please complete all required fields above.
You might also be interested in… Audit and assurance for charities.

Work 1-to-1 with our charity sector experts and talk to someone who understands how to approach an audit, right down to the smallest details.

You want a streamlined audit process that doesn’t get in the way of your day-to-day. With us, you get crystal clear communication and realistic timetables, so you know when milestones are due and how to meet them. And because our service focuses on the key areas of your organisation, we won’t take up more of your time than strictly necessary.

During our audits we offer detailed feedback on your systems and controls – feedback you can act on because it’s designed to suit and add lasting value to your organisation.

As well as external/statutory audit, our assurance services include:

  • Independent examinations
  • Funder audits
  • Assurance and internal compliance
  • Due diligence assignments
  • HR audits
  • Grant audits

You’re our speciality

We audit charities like yours across the UK and globally, so we bring plenty of relevant experience to help everything run smoothly. And our people tend to stay with us, so you’ll often see familiar faces whose understanding of your situation grows every year.

Download these useful resources

Fundraising events: VAT and Direct Tax
The data security Issues facing charitable organisations
Grant Audits
Pros and cons of using a trading subsidiary
Hospital charities and reflections on the revised SORPGood governance - From principles to practice