Governance Toolkit: Safeguarding vulnerable people

The three important actions in this step are to:

• understand your charity’s risks
• understand your charity’s obligations
• determine the policies, procedures and systems your charity needs in order to manage those risks and obligations.

Risk assessment

A risk assessment will help your charity identify the risks that come with its work with people, prioritise each risk according to its likelihood and consequences, and identify the policies, procedures and systems that will deal with the risks.

You can conduct risk assessments for the whole organisation, for a department, or even for specific processes, programs or projects. Risk assessments do not have to be complex and bureaucratic. A simple and methodical approach is best.

When conducting a risk assessment, you should:

• think broadly about all the people your charity affects – what forms of abuse, exploitation or coercion could happen to them, and who might be responsible for them?
• consider all activities, including those in your charity’s supply chain or of partners and subcontractors – what could go on just beyond your charity’s view?
• think about the likelihood of your charity’s resources being affected by these risks – how common are incidents like these?
• consider the consequences of an incident – in particular, the effects on the victim, your charity’s beneficiaries, its reputation, financial position, partners, and the staff morale.
• seek out information to understand the risks – consult widely, for example through meetings, workshops and surveys, and identify information sources such as previous incidents, reports, events in other organisations, and media reports.

Remember that safeguarding can be confronting, and people may struggle to talk about it – particularly if they have had a traumatic experience. When consulting people about safeguarding, be sensitive to their experiences and approach the topic with care.

It is important that your charity knows its legal obligations. Keeping a register that lists the national, state and international legislation that affects your charity’s work can help.

This register should:

• identify the jurisdiction and source of the obligation
• provide a short summary of the obligation
• record what your charity does to ensure that it complies with the obligation.

Review the obligations regularly to ensure the register is up to date.

Your charity can also use the register to record and monitor other external obligations – such as government policies or professional standards or codes of practices – that may apply.

When your charity has considered its risks and its obligations, it can evaluate whether it has the right policies, procedures and systems to manage them.

Committing to protecting people from harm means:

• having a clear and accessible safeguarding policy
• allocating adequate resources, leadership and authority to manage the risks
• ensuring everyone in your charity shares the commitment.

A policy that outlines your charity’s approach to safeguarding is an important document. This document should:

• reference your charity’s legal obligations
• outline the risks that have been identified
• define key terms (for example, ‘safeguarding’ and ‘vulnerable person’)
• clearly state your charity’s expectations of staff, volunteers and partners
• outline your charity’s processes for managing risks
• identify who is responsible for managing safeguarding
• clearly define the roles and responsibilities of people involved in safeguarding
• extend obligations to your charity’s partners and contractors
• contain supporting resources, such as an incident response plan or an employee vetting document
• be endorsed by your charity’s board.

Your charity can use our template safeguarding policy as a starting point.

Everyone in your charity should have access to the policy. It is also a good idea to also make it publicly available.

It is important that safeguarding is given appropriate resources and is supported by your charity’s leaders.

Ensure those resources are proportionate to your charity’s work, its risks and its funding. It can be helpful to use the risk assessment, and the priorities that came out of it, to decide where to focus resources.

Ensure your charity's leaders support the safeguarding approach and take it seriously. Have a senior person take responsibility for safeguarding and make sure it features regularly in board meetings.

Internal controls are policies, procedures and systems that can reduce the likelihood and consequences of incidents. It is important that these internal controls are appropriate for your charity and address its specific risks.

Examples of procedures and systems include:

• due diligence – the research, background checks and preparation that your charity does to minimise the possibility of doing harm to people
• segregating duties and providing supervision – policies or procedures that ensure the responsibility for high-risk situations is shared by more than one person
• managing third parties – third parties are people or organisations that your charity works with, and managing them includes ensuring they are capable of, and committed to, protecting people in their work. Written agreements, contracts or memoranda of understanding are useful ways to do this.

Engaging everybody involved in your charity and its work means communicating the charity's expectations, raising awareness of the issue and building a positive culture of protecting people.

Your charity may communicate its expectations and raise awareness of the issue through formal channels such as policies, procedures and training resources, or less formal methods such as email updates, newsletters and staff meetings.

To help develop and maintain a culture that values safeguarding consider these questions:

• Are your charity’s values expressed in a code of conduct and do these values support safeguarding?
• Has your charity considered the kind of culture it wants?
• Does your charity's leadership embody the desired culture, and do their words and actions encourage others to be part of it?
• How do attitudes and events in your charity compare with the culture it wants to develop?

It is important to detect incidents of harm, but it is also important to detect moments of non-compliance with commitments and indicators that risks might be changing.

To detect an incident of harm effectively, ensure that:

• staff, volunteers and third parties report any concerns they have, including the option to do so confidentially
• there are ways for people to provide feedback, raise grievances and report suspected or actual incidents of harm
• people who report concerns or incidents of harm are protected
• there is guidance for managers and staff on detecting incidents – what kinds of situations have risks of abuse, neglect and exploitation?
• there is a supportive culture that encourages staff and volunteers to speak up – perhaps a whistleblower policy may be appropriate
• there is a clear and transparent system for investigating and responding to concerns.

Examples of ways your charity can do this include:

• training on safeguarding for new staff and volunteers
• having clearly defined reporting procedures in its policy
• providing staff and volunteers with simple guidance on 'red flags' that might indicate incidents of harm
• a communication campaign that shows volunteers, staff and beneficiaries that it is safe to make reports
• an e-mail address, contact number or other way through which people can make anonymous disclosures.

In the event of a suspected incident, your charity needs act promptly to understand what might have happened, the risks that might exist, and how to protect the people affected.

To effectively respond to a suspected incident, it is helpful to be able to follow a response plan. This plan will help your charity manage the suspected incident and the risks involved. A response plan should:

• clearly assign roles and responsibilities for responding to the incident (with major roles and responsibilities reserved for people with appropriate training, skills and experience)
• set out what is required at each stage of the response
• include an internal investigation to understand what may have happened
• provide guidance for when matters should be reported to an external party, for example, the police, the ACNC or a partner or donor agency
• include a step focused on development and learning lessons.

Your charity can use our template incident response plan as a starting point.

Carefully consider the risks before beginning an internal investigation into a matter. Some incidents may be beyond your charity’s ability to investigate effectively, meaning you may need external help.

Some incidents may be so serious that your charity will need to refer them to the police.

Your charity’s board needs to make sure that there are regular reviews of safeguarding policies, procedures and systems.

Review them at least annually and after any incident. Consider, for example, the following questions:

• Are they up to date, reflecting the current working environment and legislation or regulation?
• Do they reflect the current risks for your charity’s work?
• Do staff, volunteers and third parties follow the policies, procedures and systems properly?
• Do the policies and procedures work?
• What feedback has your charity received about its policies, procedures and systems?
• What improvements could be made?