A policy is not proof that anything is happening
If you find this useful, I share practical tools and insights by email Sign up to the newsletter
There is a moment in most trustee meetings when a difficult subject becomes comfortably manageable. Someone raises safeguarding, or conflicts of interest, or complaints, and someone else says, "We have a policy for that." The room relaxes, the agenda moves on, and nobody quite notices that a question has been answered with a document rather than with evidence.
A policy matters. It sets expectations, allocates responsibility and gives people something against which behaviour can be judged. But approving one is the start of the governance task, not the end of it.
The policy describes what should happen, and that is all it does
The Charity Commission's safeguarding guidance is clear on this. Trustees are expected to have appropriate policies and procedures, and also to make sure they are followed, put into practice and reviewed. Those are different obligations, and only the first can be completed in a single meeting.
The distance between the document and the daily reality is usually wider than any board would guess. The safeguarding policy says concerns go to the safeguarding lead; do the volunteers know who that is? The complaints policy says complaints will be escalated; are they? The financial controls say two people authorise every payment; does that still happen when one of them is on holiday?
None of this means the policy is wrong. It means nobody has checked.
Assurance is not the same as doing management's job
This is where trustees, quite reasonably, become nervous. If the board starts inspecting safeguarding files or supervising staff, it has wandered into management, and that helps nobody.
But that's not what assurance means. Staff and volunteers make the processes work. The board's job is to hold enough evidence to know that they do, and for a small charity that is far less daunting than it sounds. It might be asking the safeguarding lead to talk you through what actually happens when someone raises a concern. It might be checking that required training is genuinely up to date, or asking how many complaints and near misses there have been and what anyone learned from them. It might be choosing one important process and following it from beginning to end.
Not every policy needs that attention. The amount of assurance should match the seriousness of the risk.
Trustees aren't expected to know everything. They are expected to know enough.
The gap between paper and practice is where the harm happens
It would be comforting to think this is a problem for other people, and the Charity Commission's recent casework says otherwise.
This month's official warning to Save the Children International followed its investigation into the detention and death of a staff member in Yemen, and identified shortcomings in oversight, staff protection, escalation and compliance with policies and procedures. The charity has accepted the findings and says it has made changes since. The lesson for a small charity isn't that it should build the systems of an international organisation. It is simpler and harder than that: the more serious and fast-moving the risk, the less reasonable it is to treat the existence of a policy as evidence that the risk is managed.
There are quieter examples. In its 2024 inquiry into Mermaids, the Commission found an HR supervision policy that required regular, documented sessions and had not been consistently implemented. The document existed. The practice did not always match it.
And in the St Giles Trust case, the charity had a DBS process, but it did not reliably catch and act on a change in someone's status, so that person carried on working with children for almost two years. The Commission regarded it primarily as an operational failure, and still found that the trustees had breached their duties.
Trustees don't have to run the process. They do have to know whether it works.
Sometimes the policy hasn't changed, but the world around it has
There is a timely reason to think about this now. On 1 September, the supervision exemption for regulated activity with children was removed in England and Wales. People who teach, train, instruct, care for or supervise children, on more than three days in a thirty-day period or overnight, may now fall within regulated activity even though someone else supervises them.
It's not what many people fear. The Disclosure and Barring Service has been explicit that this does not mean everyone who has contact with children suddenly needs a check, and it has already had to correct some widespread misunderstandings.
What it does mean is that charities need to look again at the roles people actually perform. Rewriting a paragraph in the safeguarding policy would miss the point entirely. The real questions concern people and practice: who is doing what, how often, which roles now fall within regulated activity, and whether your recruitment and checking arrangements reflect that.
A policy that hasn't kept pace with the organisation is quietly describing a charity that no longer exists.
Ask one more question
There is a simple habit any board can develop. The next time someone reassures the trustees that there is a policy for something important, ask:
How do we know this is what actually happens?
It isn't a challenge to the person answering, and it isn't an invitation to start inspecting everything yourselves. Sometimes the answer will be training records, a small sample of files, feedback from volunteers or evidence that the actions from the last concern were completed. And sometimes it will reveal that the organisation has quietly developed a different way of working from the one the board thought it had approved.
That isn't a failure. It's useful information, and far better found in a meeting than in an investigation.
Trustees don't need proof that nothing will ever go wrong. They need reasonable confidence that the charity works broadly as they believe it does, and that when it doesn't, they will hear about it.
Want more like this? I send practical tools, funding ideas, and honest insights straight to your inbox for small and medium charities. Sign up to the newsletter