Safeguarding for Small Charities, Without the Binder

Safeguarding is the area of charity governance where small charities most often feel out of their depth. The literature is dense, the consequences are severe, and most of the published guidance is written for organisations large enough to afford a full-time safeguarding officer. The result is that small charities either do too little (because the documentation feels impossibly heavy) or too much (because they buy a 200-page off-the-shelf policy and never read it).

Neither is the right answer. The right answer is a minimum-credible setup - proportionate, written for the charity's actual size and risk, and maintained as a living document. Below is the working pattern I use with charities under £500k income. It is what good governance looks like at the small end. It is not exotic, and it does not cost much.

What "good" looks like at the small end

Five things, in place, working, evidenced:

1. A short, plain-English safeguarding policy (4–8 pages).
1. A named designated safeguarding lead and a deputy.
1. Annual safeguarding training for trustees and any staff or volunteers in scope.
1. A working incident process: how to report, who to, what happens next.
1. An annual review at trustee level, signed off and minuted.

Five things. None of them require a specialist or a £5,000 consultancy. They do require attention and discipline.

1. The safeguarding policy

A 4–8 page document that covers, in plain English:

• What safeguarding means at this charity, in scope.
• Who is responsible - the designated lead, the deputy, the chair.
• What everyone must do - staff, volunteers, trustees.
• How to recognise a concern (not exhaustive - pointing to the right resources is fine).
• How to report a concern, with names, contact details, and a 24-hour escalation route.
• What happens after a report - including statutory notifications.
• How the policy is reviewed and updated.

Plain English is not optional. A policy in legalese is a policy nobody reads, which is a policy that does not protect anyone. The test: a new volunteer should be able to read the policy in 15 minutes and know what to do.

2. Designated safeguarding lead

A named person with the responsibility, the authority, and the training to handle safeguarding concerns. For a small charity, this is often a trustee or the chief executive. The role can be combined with another, but it must be named.

A deputy is also named. Safeguarding concerns happen at evenings, weekends, and when the lead is on leave. Without a deputy, the system has a single point of failure that can collapse at the worst moment.

Both should have, at minimum, a half-day designated safeguarding lead training course every two years. NSPCC, NCVO, and most local CVS organisations run these affordably or for free.

3. Training

Annual safeguarding training for everyone in scope: trustees, staff, volunteers in beneficiary-facing or supervisory roles. Two hours minimum, covering:

• What safeguarding is, and what kinds of harm are in scope.
• How to recognise concerns in this charity's context.
• How to report - with names and routes.
• What confidentiality means (and does not mean) in safeguarding.
• The difference between observation, concern, and disclosure.

Recorded attendance, every year. The Charity Commission, in its supervisory work, asks for evidence of training. "We talk about it informally" is not a defence.

4. The incident process

A short, written process. One page. Steps in order:

1. Concern raised. Same day, written down (a simple form is fine).
1. Designated lead notified within 24 hours. If lead unavailable, deputy.
1. Initial assessment by lead within 48 hours: serious incident, statutory notification, both, neither?
1. Response actions logged. Communications managed (carefully - confidentiality is paramount).
1. Statutory notifications made if required (Charity Commission, Local Authority Designated Officer, police).
1. Outcome and learning logged. Trustee notification if material.

Three things that often go wrong here: people are unsure whether to report (resolved by training); reports are made informally and not documented (resolved by a one-page form); and notifications to statutory bodies are missed (resolved by the lead's training, plus a reference card with the statutory thresholds).

5. Annual trustee review

Once a year, the safeguarding lead presents to the full trustee board. The agenda:

• Concerns raised in the last year, in summary (not detail - confidentiality protects the people involved).
• Lessons learned and policy updates.
• Training compliance - who has done what.
• Risk register update for safeguarding-related risks.
• Resourcing - is the lead supported, do they need anything?

Minuted. Signed off. The minute is a key piece of evidence in any future Charity Commission engagement.

Three things that quietly raise the bar

1. A code of behaviour, not just a policy

Distinct from the safeguarding policy: a one-page code of behaviour that staff, volunteers, and trustees sign at induction and re-sign annually. Specific, practical: "I will not give my personal phone number to a service user." "I will not meet a service user one-to-one outside service hours." "I will report any concern, even a small one, to the designated lead." Specifics shift behaviour in a way that abstract policy does not.

2. A safeguarding entry on every meeting agenda

Senior team meetings, board meetings, programme review meetings. A standing agenda item, even if the answer is "nothing to report." That keeps it visible. The week the standing item is dropped is the week safeguarding starts to drift.

3. An external check, every two years

A trusted external - a sector colleague, a CVS adviser, a paid consultant - reviews the policy, the process, and the records every two years. Three hours of someone else's eyes catches things internal teams miss.

Three myths to put down

Myth 1: "We're too small to need this."

No charity is. The Charity Commission expects safeguarding governance proportional to the risk, but it always expects something. A single-volunteer charity working with under-18s has the same fundamental obligations as a 100-staff charity, scaled appropriately.

Myth 2: "Our beneficiaries aren't at risk."

Safeguarding extends beyond children and "vulnerable adults" - it covers any context where a power imbalance can be misused. Volunteer-on-volunteer concerns, staff-on-supplier concerns, donor-on-beneficiary contact: all are in scope. The breadth surprises people.

Myth 3: "We're covered by our parent body / network / funder."

You are not. Even if you are part of a federation, the trustees of your charity are individually responsible for safeguarding within your charity. Funding relationships do not transfer the duty.

Safeguarding is the place where the size of the charity matters least. The bar is the same. What changes is the depth, not the standard.

A 30-day rollout

1. Week 1: Adopt or adapt a 4-page policy. Get trustee sign-off.
1. Week 2: Name the lead and deputy. Book their training.
1. Week 3: Schedule annual training for all staff/volunteers in scope.
1. Week 4: Stand up the incident process. Add safeguarding to the standing agenda.

Thirty days. No specialist hire, no consultancy fee, no 200-page binder. A working safeguarding programme for a small charity. The discipline is what makes it count.

Further reading

Volunteer Governance Done Right | A Risk Register for the Modern Charity | The Board Pack Template That Actually Gets Read