Charities and education

PRACTICAL GUIDANCE

The starting point

Use proportionate assurance to support the organisation’s purpose. Start with the people, services and information that need protection, then choose a management-system scope that the team can operate and maintain.

Priorities to examine

• Funders, partners or commissioning bodies ask for specified assurance about service delivery.
• Staff, volunteers and contractors need clear responsibilities and consistent induction.
• Personal information about beneficiaries, learners, donors or staff requires careful governance.
• Growth, distributed sites or changing programmes expose gaps between policy and everyday practice.

Standards to investigate

Evidence to consider

• Service or programme objectives, eligibility decisions and feedback mechanisms.
• Staff and volunteer role descriptions, induction and relevant competence records.
• Governance decisions, risk reviews and follow-up of incidents or complaints.
• Information-flow maps, privacy notices and access or retention arrangements.
• Partner, technology and outsourced-service oversight records.
• Evidence of controls for the physical and safeguarding interfaces included in scope, with specialist matters clearly separated.

Questions for your scope

• Which service or programme would benefit most from a defined and manageable scope?
• Is certification explicitly required by a funder or is another form of assurance acceptable?
• How will the audit protect information about children or vulnerable people?
• Who can implement and sustain actions when staff or volunteer availability changes?
• Which safeguarding, educational or sector-specific assessments need specialist input beyond this audit?

Related guidance and practical next steps