Report

by the Comptroller
and Auditor General

Charity Commission: Progress report

HC 607 Session 2017–2019 29 November 2017

Our vision is to help the nation spend wisely.

Our public audit perspective helps Parliament hold government to account and improve public services.

The National Audit Office scrutinises public spending for Parliament and is independent of government. The Comptroller and Auditor General (C&AG), Sir Amyas Morse KCB, is an Officer of the House of Commons and leads the NAO. The C&AG certifies the accounts of all government departments and many other public sector bodies. He has statutory authority to examine and report to Parliament on whether departments and the bodies they fund have used their resources efficiently, effectively, and with economy. Our studies evaluate the value for money of public spending, nationally and locally. Our recommendations and reports on good practice help government improve public services, and our work led to audited savings of £734 million in 2016.

Report by the Comptroller and Auditor General

Ordered by the House of Commons
to be printed on 27 November 2017

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Sir Amyas Morse KCB
Comptroller and Auditor General
National Audit Office

23 November 2017

This short overview follows up on our previous reports on the Charity Commision (the Commission): The regulatory effectiveness of the Charity Commission (2013) and Follow-up on the Charity Commission (2015). It focuses on the progress that the Commission has made since our last report; areas that could be improved; and suggestions for the Commission to consider next.

© National Audit Office 2017

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.gsi.gov.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

11643 11/17 NAO

The National Audit Office study team consisted of:
Damian Angelis, George Crockford, Shelagh Dale, Eleanor Fairbairn, Benoit Guerin, Lauren Hughes and Emma Taylor, under the direction of Paul Oliffe.

This report can be found on the
National Audit Office website at
www.nao.org.uk

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

Tel: 020 7798 7400

Enquiries: www.nao.org.uk/contact-us

Website: www.nao.org.uk

Twitter: @NAOorguk

Introduction

Approach and scope

This progress report follows up on our previous reports on the Charity Commission (the Commission): The regulatory effectiveness of the Charity Commission (2013) and Follow-up on the Charity Commission (2015).

It focuses on:

the progress that the Commission has made since our last report;

areas that could be improved; and

suggestions for the Commission to consider next.

This is not a comprehensive audit of the Commission’s effectiveness and it does not conclude on the outcomes that the Commission is trying to achieve.

The structure of this report aligns with the areas in which we made recommendations in our previous reports: strategy, regulation of charities and sustainability and funding.

Context

The Commission began a transformation programme in response to concerns raised by the National
Audit Office (NAO) and the Committee of Public Accounts (the Committee) about its ability to act as an effective regulator. This transformation involved a number of programmes aimed at improving its operational capability, its engagement with the charity sector and the sustainability of its funding model.

Methods

We:

reviewed Committee of Public Accounts reports, Treasury minutes, Commission publications and related NAO studies;

completed semi-structured interviews with individuals from across the Commission and representative organisations from the charity sector;

completed in-depth reviews of documents provided by the Commission, including reviewing board minutes and audit and risk committee minutes; and

reviewed the use and quality of operational and financial data by the Commission.

Summary

The Commission has improved significantly since our initial 2013 report

Our 2013 report The regulatory effectiveness of the Charity Commission concluded that the Commission was not an effective regulator. Both we and the Committee of Public Accounts raised significant concerns about the Commission’s strategy, the way it measured its performance, its leadership and its regulatory approach (not taking a proactive approach, using its powers or making decisions based on risk).

Since then, the Commission has carried out a transformation programme and has taken action in response to our and the Committee’s recommendations (Appendix One on page 48).

Our 2015 report Follow-up on the Charity Commission found that the Commission was making progress with its transformation but it had more work to do. We concluded that: “The Commission has made good, early progress in addressing all of the recent recommendations made by the Committee of Public Acounts (PAC) and the NAO. However, much hard work and significant challenges lie ahead”. The report considered challenges for the Commission, including digital transformation, understanding the costs of being an effective regulator and managing stakeholders’ expectations.

This work follows up on these areas of challenge and progress more generally. We have found that the Commission has continued to improve significantly from its baseline position in 2013. It has made improvements through the transformation programme, embedding a culture of continuous improvement and the use of a more risk-based approach. These gains have been achieved through the commitment of the Commission’s workforce.

The Commission has more to do in planning for an uncertain and dynamic future. The focus on improving internal structures and processes, although important in moving on from the 2013 position, will need to be complemented by further collaboration and external engagement. This will support future discussions on funding and will give the Commission more influence over its own agenda. It will need the support of the Department for Digital, Culture, Media & Sport (that provides, where necessary, ministerial support), the sector and other stakeholders to achieve this. Overall, the Commission has almost completed its Transform programme and it is now vital that it keeps up the momentum of change and embeds a culture of continuous improvement.

Summary

Key findings

Strategy, business objectives, performance measurement, board and leadership

The Commission made progress by setting a strategy that provides more clarity about how it will achieve its objectives. The Commission’s strategic plan for 2015–2018 sets out the aims of the Commission and how it will achieve them. The plan now aligns clearly with the Commission’s statutory objectives.

The link between key performance indicators (KPIs) and statutory objectives has improved, but reporting could be better. The Commission has made progress in aligning its KPIs with its statutory objectives and strategic priorities. However, the Commission could improve its reporting of KPIs, for example by including a narrative for each indicator in its annual report.

The KPIs perform well against good practice criteria but the Commission needs to look to stabilising measures. The Commission scored well across the three areas of our maturity model for measuring performance: developing a framework; reporting performance information; and using the framework. One area of weakness was the level of change to its top 20 KPIs (only 10 of the 2014-15 KPIs still exist in some form in May 2017).

The changes were to provide better alignment with the Commission’s changed business priorities and activities in the short term.

The board’s governance and effectiveness has improved. The board has strengthened its governance by bringing in more skills, for example in change management and digital. We found that the board is becoming more strategic, but it is important that it continues on this trajectory.

Transformation

The scope of the Commission’s transformation has widened to become more ambitious and proactive. The Commission widened the scope of its transformation programme with a greater focus on digital and more non-digital transformation, for example staff training and development. In September 2015, the Commission reviewed and revised the programme to identify interdependencies, reprioritise projects and strengthen governance.

As the Transform programme’s scope has expanded and the delivery timetable has matured, this has resulted in a budget increase. The budget for the programme has increased from £8 million (over three financial years to March 2017) to a forecast £12 million (over four financial years to January 2018). The Commission is funding the increase from its existing core budget.

Progress with digital transformation has been good and greater opportunities exist going forward. The Commission has made a significant investment in digital transformation, which aims to make its regulatory activities more effective and efficient. Its focus on getting its information in a format it can use rather than just updating the software that the staff interact with is the right one. The Commission is making up for prior underinvestment in digital that has left it with challenging legacy systems and information in a format that is hard to use. Plans to deliver the improvements needed are in place and are crucial in taking the Commission forward as an effective regulator.

The Commission’s approach to managing change has improved. Going forward, a focus on continuous improvement (particularly in digital transformation) is crucial. The revised programme, agreed in January 2016, reprioritised projects and uses a more business-led approach. It has delivered several important ‘quick wins’, such as the Risk Engine (v1) and automated registration. But the Commission has yet to deliver some critical elements of the programme, such as view/amend and name change services and the new case management system (CRM).

Approach to regulation

The Commission is embracing a risk-based approach but legacy systems and lack of usable data are barriers to improvement. Since December 2016, the Commission has set up the Risk Assessment Unit to break down silos that prevent information-sharing across the Commission and to refresh its risk framework. In particular, we found that checking trustees’ assurances is more risk-based. There are signs of a more forward-looking and proactive approach, such as a more joined-up use of intelligence to identify issues. Legacy systems and associated data architecture are barriers to bringing together information to improve the way the Commission assesses risk and uses all available intelligence in delivering its regulatory activities.

The Commission made some progress with developing its software for assessing the risk of registered charities, which remains critical to achieving its transformation. The Compliance Risk Assessment Tool is being developed. This will secure more efficient end-to-end case management and better management information.

The Commission is making use of its new powers but it needs to manage the risk that its powers will not be sufficient in the future. The Commission used its new powers 50 times since May 2016 without challenge. After initial slow progress, the Commission is now seeing a reduction in the length and number of old inquiry cases. However, the Commission does not have tested, systematic ways of identifying what powers it needs and whether its current powers continue to be sufficient as the risks of abuse by charities and non-compliance with charity regulations change.

As the risk-based approach develops further, the Commission needs to consider the impact on stakeholders’ expectations. Many stakeholders and key partners do, and may continue to, have differing expectations of the level of detail/oversight that the Commission exercises. They may also have different views on what constitutes a risky charity. The Commission will need to ensure that the charity sector and its main government partners understand the approach it is taking and its appetite for risk.

Registrations

The Commission has taken a series of actions to speed up registrations, including improving processes to risk-assess applications. Over the past two years, it has improved its systems and staff training, including the number of staff trained in the assessment process. The average time to register cases has recently fallen from a peak in 2016-17.

Working with others

The Commission is now providing and receiving more information and knowledge with other organisations. The Commission has increased the number of memorandums of understanding (MoU) and amount of information shared, which creates more opportunities for joint working and knowledge-sharing. The Commission has created or reviewed 11 MoUs since 2015. This includes with local authorities and with other regulators.

The impact of increased information-sharing on the Commission’s effectiveness and the bodies it shares information with is unclear. The Commission does not measure the costs and benefits of opportunities to exchange information. It needs to be able to present a clear case to its partners on how the information shared with it helps it to become more effective and efficient. Currently, it is not clear what opportunities are being missed and what impact this has on the risks to the sector and the Commission’s effectiveness.

Sustainable funding model

Securing the optimal level of long-term funding within a sustainable funding model is crucial to the Commission’s continuing transformation and its ability to react to developments in the sector. The demands on the Commission have increased over recent years because of policy and legislative changes. Against this background, the Commission’s funding has decreased from £32.4 million in 2005-06 to £25.9 million by 2016-17 or a real-terms reduction of £11 million (34%).

It is not clear what level of funding is needed in the medium- and long-term for the Commission to be an effective regulator. Its future requirements are uncertain because of the changing make-up of the sector, higher demand for the Commission’s work and increased risks in the sector. The funding model needs to be able to respond to a range of scenarios and highlight the impact of shortfalls in funding levels and the benefits flowing from various funding options.

The proposed funding models for the Commission have changed significantly over time. There is not yet an agreed position between the Commission, the sector and government stakeholders as to the required level, and source, of longer-term funding. This exposes the Commission to risks in developing its forward strategy and plans. A public consultation may be required before an option can be selected.

Shaping its own agenda

Policy changes have had an impact on the Commission. So far, the Commission has reacted to these changes; it now needs to become more proactive to begin shaping its own agenda.

Summary

Recommendations

Further develop the approach to measuring and reporting on performance:

The Commission needs to strike a balance between keeping its KPIs up to date and ensuring that it can provide consistent performance data over time.

Understanding its cost base and the benefits of change:

The Commission should continue to develop its understanding of its cost base through its unit cost model.

Further use of the cost model may highlight opportunities to improve the way it prioritises and allocates resources or to present a clearer case for future changes, or both.

Sustainable funding model:

The government needs to commit to a timetable for exploring future options for the Commission’s future funding, including public consultation if required.

The Commission should develop a range of evidence-based funding scenarios to identify the optimal level of funding required to deliver its strategy and plans.

Maintaining momentum of transformation:

The Commission needs to maintain a focus on continuous improvement (both digital and non-digital).

The Commission needs to maintain the momentum of transformation, in particular in improving its data architecture, IT and risk model. This will mean continuing to invest in its infrastructure.

The Commission needs to be ambitious about the information it requires from others to feed its Risk Engine with the right data. It will have to make clear to its key partners the information it needs, and the lost benefit or risk to the sector if it does not receive this information.

The Commission should continue its plans to improve its Application to Register a Charity system including, for example, developing more tailored questions to help guide charities through the process, depending on the category of charity identified.

Shaping its own agenda:

The Commission should continue to monitor the use and influence of information shared to ensure it is using its resources to achieve the maximum benefit.

The Commission should improve its engagement with other government entities to ensure it has more influence over policy changes that will affect it.

Manage expectations:

The Commission needs to develop a better understanding of the expectations of the sector and its key partner organisations.

The Commission should, based on this improved understanding, consider how it responds. This could be through providing more options on what it can do, setting out where it needs others’ help to meet expectations or being clearer about where and why it cannot meet expectations.

Summary

Level of progress made against previous recommendations

Detailed analysis

Strategy and objectives

The Commission has made progress in setting out a clear strategy that is aligned with its statutory
objectives and business plan

Previous areas of concern:

The first National Audit Office (NAO) and Committee of Public Accounts (the Committee) reports recommended that the Charity Commission (the Commission) should consider its strategy for delivering its responsibilities effectively and how it would achieve its objectives with constrained resources.

The Committee further recommended introducing new leadership to transform the Commission.

The Committee chair’s letter to Paula Sussex (the Commission’s former chief executive) also recommended clarifying what the Commission’s new regulatory approach would mean for staff and for the sector.

What has been done?

The Commission has made some progress in setting out a strategy, which has provided clarity about how it will achieve its objectives.

The Commission’s strategic plan for 2015-18 sets out its aims and how it will achieve them. The plan aligns with the Commission’s statutory objectives.

The Commission revised its Statement of Regulatory Approach in January 2017 to focus on improving transparency and doing more enablement and compliance work.

This is in line with the Commission’s 2015 Strategic Plan. The Commission aims to improve compliance by supporting trustees and enabling them to comply with their duties.

The statement also explains how the Commission’s new regulatory approach will operate.

What more could have been done?

The Commission has made some initial speeches on what its new regulatory approach means for the sector. There is scope to reinforce the message by other means to manage expectations and to raise awareness.

What next?

Ensuring that the benefits of strategic internal transformation are monitored, as highlighted by the Commission’s internal audit team in April 2017.

Future challenges

Developing a strategy that responds to the context in which the sector operates, while adapting to the Commission’s new business model.

Examples of the challenges facing the sector include:

funding pressures;

increasing demand for charities’ services;

struggling to attract the right skills to the sector; and

public confidence in charities has dropped for the first time in more than 10 years.

Detailed analysis

Performance measurement

The link between KPIs and statutory objectives has improved, but reporting could be better

Previous areas of concern:

Both our first report and the follow-up report recommended developing measures to report on the effectiveness of the Commission’s regulatory activity, including aligning key performance indicators (KPIs) with statutory objectives and measuring public trust and confidence in the Commission.

Other recommendations focused on evaluating the impact of the Commission’s new regulatory approach and aligning KPIs to its new business model.

The Committee recommended that the board should get a better grip of the Commission’s performance to hold the chief executive to account.

What has been done?

The Commission has made progress in aligning its KPIs with its statutory objectives and strategic priorities (page 50).

Data quality has improved:

The Commission has brought in dedicated resources to focus on measuring performance and improving data quality.

Internal audit found that regular validation of performance dashboard data and a move to using SQL (Structure Query Language) to access performance data helped improve data quality.

Overall, the May 2017 performance measures perform well against good practice criteria (see page 52)

The KPIs tend to be timely as they are produced frequently and use up-to-date data.

Some of the KPIs can be directly attributed to the Commission’s performance (notably internal efficiency indicators).

What more could have been done?

The reporting on the Commission’s performance against its KPIs could have been better

The Commission could include a narrative for each indicator in its annual report (the Pensions Regulator’s annual report clearly sets out targets under each objective and performance, along with explanations).

The Commission could have followed good practice guidance more closely when developing its indicators (see page 14).

The KPIs could have included more lead indicators to provide early warning of problems.

Some of the KPIs are well placed to identify potential backlogs of work (for example, time to process certain applications).

Other KPIs are less likely to identify clear changes in the Commission’s performance as they appear to be more ‘reactive’.

What next?

Settle on a defined set of KPIs and generate data consistently to benchmark and monitor performance over time.

Only ten of the Commission’s 20 2014-15 KPIs still exist in some form in May 2017 as the Commission sought to better align indicators with changes to the business.

Clearly link indicators to objectives, intended outcomes, and performance in external reports. (The Pensions Regulator and the Financial Conduct Authority are good examples of this.)1

Ensure that external reporting against KPIs and targets is clearer (for an example, see the Competition and Markets Authority).2

Future challenges

Developing a balanced set of KPIs that cover all of the Commission’s activities.

Consistently monitoring KPIs to help improve performance.

Notes:

1 The NAO reported in 2016, (available at: www.nao.org.uk/wp-content/uploads/2016/11/Performance-measurement-by-regulators.pdf) on the importance of making the link between indicators and objectives. The Pensions Regulator and the Financial Conduct Authority both do this in their Annual Reports (although the figures for each indicator are not reported).

2 The Competition and Markets Authority Annual Report and Accounts 2016-17, 12 July 2017.

Detailed analysis

Performance measurement

There is scope to improve the performance framework and how information is reported and used

Detailed analysis

Board and leadership

Board governance and effectiveness has improved

Previous areas of concern:

The Commission’s board should keep its level of involvement in executive decision-making under review to maintain its independence and hold the executive to account effectively.

Discuss how to bring IT expertise to the board and consider co-opting or buying in IT expertise to monitor and challenge IT improvements effectively as part of transforming the Commission.

Following bedding in of the current governance arrangements, review the governance framework and assess the board’s effectiveness. Act on the review’s findings to strengthen governance arrangements and effective oversight of the executive.

What has been done?

The Commission’s board has been strengthened

Since October 2015, the board has been supported by an independent Transform programme review and an assurance expert.

Three new board members joined in November 2016, bringing expertise in change management and business transformation,
digital/technology and cyber-security.

A deputy chair role was created to support the chair of the board.

There has been greater challenge and more diversity of opinion.

Strengthened governance arrangements

The Commission has responded positively to the review of the governance framework and board effectiveness (December 2015), for example:

The Commission updated the governance framework to be clear about the role of the Commission’s board and the relationship between the board and the chief executive and staff.

Board effectiveness improved: the review found a capable and committed board with a wide range of skills and experience. A need for board-level IT experience has been met by appointing Laurie Benson to the board. The Commission introduced staggered board appointments and an induction programme for new members; a board secretary was recruited in May 2016 to provide day-to-day support.

Audit and Risk Committee: more emphasis on strategic assurance, discipline and oversight on the update of the risk framework.

What more could have been done?

The board is becoming more strategic but there is scope to do more.

Until mid-2015, Public Interest Litigation and High-Risk Cases Committee (PILHRCC) members continued to attend a small number of meetings with the trustees of high-risk cases.

There is still too much focus on high-risk cases and there could be more focus on strategy.

The Commission is seeking to reduce the time PILHRCC spends on each case – for example, it reduced the high-risk case report from 108 pages (January 2017) to 74 (May 2017). This will offer additional benefits, as providing papers for PILHRCC is resource-intensive.

Detailed analysis

Board and leadership

The board could be more strategic in its focus and approach

What more could have been done?

Board members commit significant time to the Commission

The minister for the Cabinet Office recognised the need for flexibility in board members’ time commitment as the Transform programme continued. In 2016-17, three board members plus a deputy chair could exceed the 24-day limit. Board members are within the terms of the increased time commitment.

However, the minister stated that over time the board will need to step back into a more traditional non-executive role (with the exception of the legal board member).

There does not appear to be a plan, as requested by the minister, for managing board members’ time commitment to reduce it to 12 to 18 days per year.

Board members told us that the allowed time commitment of 24 days per year is not currently realistic. More allowance for recruitment and induction would help.

What next?

Establish and embed more strategic, risk-focused oversight by the board.

Need a more strategic, higher-level board now that the Transform programme is drawing to a close.

PILHRCC’s focus has been on reputational risk driven by media coverage. Discussion should be more closely aligned with the Commission’s priority risk areas (safeguarding; fraud and financial irregularity; and public trust and confidence) and the Commission’s risk approach.

Improve staff engagement and transparency

Board to identify how to improve transparency and engage more with staff below the Commission’s executive.

There is a gap between staff and the board more generally. There is a need for more engagement through internal communications, and board members should have a clear purpose for engaging with the staff.

Detailed analysis

Change management

The Transform programme has become more ambitious

The programme is organised into six work streams: 

Business process redesign and rules.

Data management and technical solution implementation.

Risk and business intelligence.

Digital services design, build and test.

Business change and implementation.

Programme management office (PMO).

The changes sit alongside other changes being made by the Commission.

Detailed analysis

Change management

Progress has taken longer but the Commission’s approach has improved

Previous areas of concern:

The NAO and Committee recommended that the Commission should finalise and implement robust and detailed change management plans (including organisational and IT requirements).

Our follow-up report also highlighted the need to secure the necessary skills and capacity to ensure effective transformation.

What has been done?

The Commission has improved its approach to managing its transformation (see next page)

Addressed recommendations in 2015 assurance review of the Transform programme.

Revised the programme, agreed January 2016, to reprioritise projects, revise the operating model and strengthen governance for a more business-led approach to the Transform programme.

Delivery of several important ‘quick wins’, for example, the Risk Engine (v1) and improvements to the online registration application system; but some critical elements are yet to be delivered, for example, view/amend and name change services and the new case management system (CRM).

What more could have been done?

The Commission has been slow to address shortcomings in programme and project skills and expertise.

The 2017 assurance review found a lack of project management skills and experience in the programme management office. The Commission struggled to fill project manager roles and has relied on contractors for expertise.

The Commission is now investing in staff with digital and testing skills. But two project manager roles and a data architect role remain vacant (mid-May 2017).

The Commission was slow to fully appreciate the required scale of transformation impacting Transform programme timescales and costs.

Programme scope expanded, for example, expansion of digital services in plan (the Commission estimates an increased net present value: £7.9 million to £15.5 million over seven years and increased expected savings, 30 to 42 FTE), resulting in a budget increase (forecast cost increased 50% to £12 million), which the Commission is self-funding.

Some projects de-scoped, for example, authentication is proving significantly more complex than expected.

Complexity of delivering ‘end-to-end’ digital services and creating business rules where no legal framework exists for automated decision-making.

The 2017 assurance review highlights that the ‘Agile’ project delivery approach, used by the Commission, is associated with more delays in delivery, unless managed by experienced practitioners.

What next?

Successfully implement the remaining elements of the Transform programme, in particular CRM, to secure more efficient end-to-end case management and improved management information.

Fully embed the new risk-led approach and appreciate the importance of data as a strategic asset (see also page 22).

Address the risk of transformation losing momentum, in particular continuing investment in IT infrastructure; risks include:

loss of the outgoing CEO’s digital programme expertise;

failure to secure (or a delay in securing) sector/additional funding; and

disbandment of the Transform programme oversight committee (TPOC) by 30 September 2017, with IT oversight transferring to the audit and risk committee (ARC); the programme management office (PMO) disbanded end June 2017.

Continue upskilling and empowering staff to enable more flexible working and ensure skills transfer from contractors.

Detailed analysis

Change management

The Commission has improved its approach to managing its transformation

What has been done?

Detailed analysis

Risk-based assessment

Risk-based assessment is used more to assess charities and events

Previous areas of concern:

More proactive assessment of risk required, assessing risk of individual charities in general rather than focusing on specific events, and update risk framework to explicitly include tax avoidance.

Greater support from the Cabinet Office to remove or reduce Commission activities that add little regulatory value and to assist the Commission in securing legislative changes that address gaps and deficiencies in its powers.

The Committee further recommended that the Commission should introduce monitoring of its regulatory activity to check there is no institutional bias, either on the basis of a charity’s religious affiliation or on any other grounds.

What has been done?

Progress has been made in becoming a more risk-based regulator:

Risk Assessment Unit (RAU) was set up in December 2016 to coordinate risk-related activities, including triaging work.

Charity Risk Strategy and Management Group (CRSMG) was set up in January 2017, comprising senior leaders from across the Commission, to coordinate and raise awareness of the risk framework and to break down silos within the organisation. The board delegated authority to the CRSMG, for it to decide operational priorities.

Refreshed risk framework outlines how the Commission operates and oversees risk-led regulation through the use of risk assessment and management.

Cultural change to break down silos within the organisation and increase staff awareness of risk-based approach.

The aim was to build the confidence of staff through the support of tools to enable staff to make risk-based decisions, leading to better use of resources, including specialist staff like legal.

There are signs of a more forward-looking and proactive approach, such as a more joined-up use of intelligence via tactical risk assessments to identify issues for more proactive working.

Amendment of KPIs to create more stretching targets.

The Commission monitors regulatory activity to check there is no institutional bias and publishes this transparency data every six months on its website.

Detailed analysis

Risk-based assessment

Issues remain, particularly with legacy systems and data sufficiency

What more could have been done?

Still some way to go on data and legacy systems

There is a lag in the time and issues with the quality of the data received from the annual review. This remains a significant part of the digital services work stream, which is dealing with bespoke legacy systems.

An iXBRL product was trialled to extract data from accounts to help identify high-risk cases like Kids Company; however, this has been discontinued because of the cost. As an alternative, a PDF account reader is being developed as part of the current IT development programme.

The Commission is doing more proactive monitoring but there is scope to do more

The monitoring and enforcement team, set up in 2014, does themed reviews across its priority risk areas: safeguarding; fraud and financial irregularity; and public trust and confidence. Reviews on terrorism and extremism are carried out by the compliance visits and inspections team.

The Commission is doing more external reporting of its thematic work; for example, in September 2016 it published a report on charities at risk of financial distress.

What next?

Upgrade legacy database management systems and improve data sufficiency – It is difficult to systematically analyse data and release its potential. The Commission should prioritise systems and data with the most dependencies and those that support systemic changes to improve statutory objectives.

Continue embedding risk-based regulation so that risk-led processes become part of the normal course of business (Appendix Four sets out our framework and examples from other regulators).

The Commission has identified the relationship between the ‘the State rolling back’ and the importance of oversight – joint working between the Commission, the Department for Digital, Culture, Media & Sport (that provides, where necessary, ministerial support) and HM Treasury needs to improve to identify potential risks and the costs of sufficient regulation.

Developing a Compliance Risk Assessment Tool that will codify and provide an audit trail for the risk assessment of events. It aims to allow more consistent and efficient risk assessment of events, and make savings.

Develop more effective qualitative techniques to enable the Commission to capture measurable quantitative information more easily.

Developing iShare and work with the RAU to support decisions about deploying staff and prioritising work.

Detailed analysis

Checking trustees’ assurances

Checking of trustees’ assurances is more risk-based

Previous areas of concern:

Our first report recommended that the Commission should introduce sample checks of the information and assurances that trustees provide and use the results to inform its related strategy.

Our follow-up report recommended that the Commission should continue to strengthen its work to check trustees’ assurances, including conducting a review across all divisions of the criteria used to identify cases for follow-up to ensure that cases requiring further attention receive it.

What has been done?

Checking of trustees’ assurances is now more risk-based

In late 2015, the Commission developed policies and guidance, and trained staff, on verifying trustees’ assurances and following up trustees’ actions. Each casework team developed an action plan to embed verification, which included:

verifying information in high- and medium-risk cases when the information supplied is incomplete, inconsistent, misleading, evasive, suspicious or forged; and

following up all cases where specific action is required and reviewing a sample of medium-risk cases where general regulatory advice and guidance are given to trustees.

Case-related monitoring work, including verification, has moved from the monitoring team to casework teams, where case knowledge sits and can be handled more efficiently.

Verification guidance is followed in most cases, but there is scope for following up cases more promptly.

Internal audit found in 2015-16 that eight of 24 monitoring and enforcement team’s (MET) follow-up cases were inactive for more than a month and could have been progressed more promptly.

An internal review of a sample of registrations, and MET and permissions and compliance team (PCT) cases in September 2016, found that most cases were in line with policy but two of 90 cases should have had additional verification undertaken.

In May 2017, the registration team reviewed the use of trustee assurance and verification strategies – 96% (27 of 28 cases) were appropriate. PCT is currently undertaking a further review as it handles a high volume of cases.

What more could have been done?

Internal reviews do not consider the rate of progress of verification and follow-up work.

More work on preventing issues by helping trustees to fulfil the Commission’s regulatory requirements.

What next?

Ensure that quality checks are part of the normal course of business

Findings should be fed back not only to case teams but shared more widely across the business.

Detailed analysis

Use of powers

The Commission is making use of its powers

Previous areas of concern:

Our first report recommended that the Commission should make greater use of its statutory powers, and where powers are difficult to exercise or inadequate, it should set out the regulatory impact of these barriers.

The Committee recommended that the Commission should use its statutory powers to regulate charities more effectively, through better intelligence, timeliness and prioritisation of resources and should focus on core regulatory functions that address any areas for improvement in the Commission’s powers.

What has been done?

The Commission has secured and is starting to use its new powers

The Charities (Protection and Social Investment) Act 2016 received Royal Assent on 16 March 2016. It introduces a range of powers over time, including: from July 2016, a power to remove disqualified trustees and to direct specific action not to be taken; from October 2016, a discretionary power to disqualify individuals who are unfit; and from November 2016, a power to issue official warnings.

The Commission has used its new powers 50 times since May 2016 without challenge. It is taking the opportunity to share learning where teams have used the new powers, such as running workshops.

After initial slow progress, the Commission is now seeing a reduction in the length and number of old inquiry cases.

The average length of an inquiry rose from 215 days (2013-14) to 239 days (2015-16) due to high staff turnover (24% in 2015), difficulties in recruiting and a lack of staff training/induction.

During 2016-17, the Commission increased its focus on closing older inquiries; identifying and focusing on cases that needed more robust handling, with third-party bottlenecks; streamlining processes; and setting up training.

The backlog of older cases is now reducing – at 31 March 2016, of 135 live inquiries, 24 were more than three years old and 31 were two to three years old. By 31 December 2016, these had reduced to 21 and 14 respectively.

Detailed analysis

Use of powers

The Commission is making more effective use of its existing powers

What has been done?

The Commission is making more effective use of its existing powers

Since 2012-13, the Commission has significantly increased its use of enforcement and information-gathering powers (see two bar charts).

It is starting to take a more outcome-focused approach to case work by agreeing a desired regulatory outcome at the start of each case.

It is delegating authority to senior managers to build a sense of ownership for use of its powers. This is complemented by a leadership development programme to empower staff to use powers.

Detailed analysis

Use of powers

The Commission is monitoring more proactively but could do more

What has been done?

Cases in the First-tier Tribunal (Charity).

The number of First-tier Tribunal (Charity) cases brought against the Commission has decreased since 2014-15, which suggests better use of its powers.

The Tribunal has not upheld any cases against the Commission since 2014-15, which may reflect a more effective use of powers.

What more could have been done?

The Commission could have joined-up systematic arrangements in place for identifying and feeding back any apparent shortcomings in its powers.

What next?

As risks to the sector change, the Commission needs to assess its range of powers to ensure it is sufficient.

The Commission could establish agile, joined-up monitoring and feedback arrangements to determine whether its powers are sufficient and where they are having a measurable impact.

The Commission could engage with the government concerning its response to the draft Bill on technical changes to charity law, published by the Law Commission in autumn 2017.

Continue to progress work in the following areas:

Embedding understanding and use of the new powers as part of business as usual by the end of 2017-18, including testing the threshold for how far it can go to use its new powers effectively, and share good practice across the business.

Reducing the number and length of long-running inquiries.

Detailed analysis

Registrations

Demand has increased while more accurate assessment of risk means more cases are identified as lower-risk

Previous areas of concern:

The NAO’s follow-up report recommended that the Commission should continue to tackle the delays in registering charities, especially medium- and high-risk cases and that it should analyse current registration processes to identify blockages and process improvements.

What has been done?

The total number of applications for registration has increased since 2014-15. To address the impact of this rise on existing processes, the Commission developed a revised system for submitting applications (ARC). This provides more detailed information to enable registration caseworkers to risk-assess applications more accurately. A higher number of applications can now be identified as lower-risk. Further development of the ARC system is planned.

Since 2014-15, annual registrations have increased by 1,176 (16%). This is partly due to an increase in charitable incorporated organisations (CIOs), which made up 58% of all applications in 2016-17.

To improve the management of the registration process, the Commission reviewed its systems, training and deployment. It has:

helped staff to be more decisive by clarifying guidance and the purpose of the Commission’s role of registering charities;

allowed staff to do more thorough searches to inform their assessment of risk and feel more empowered; and

identified more cases that are low-risk, ready to register and rejected.

Detailed analysis

Registrations

The average time to register cases has fallen from a peak in 2016-17

What has been done?

The registration process is now measured in terms of the average time to register a charity. Performance is improving.

Target of 55 working days to register an application was introduced in April 2015. This KPI is reported and analysed each month.

High-risk cases have shown the largest fall in the average time taken to successfully process since 2016-17, from 117 days to 89 in 2017-18 Q1.

To reduce the delays in the time taken to register, the Commission made a number of changes.

Increased the number of staff trained in the assessment process in 2017 to 10, compared with five in March 2016. This has supported earlier decision-making on a greater number of cases.

A reduction in sickness levels resulted from improving the morale of staff through reducing the targets the team faced and through more empowerment of the team, including the use of a ‘self-serve’ work allocation process from the centralised queues in CRM.

Significant re-design of a complex digital application system, resulting in the re-design of the registration form. This provided additional functionality to make applications easier and improved the information that registration caseworkers use to make their decisions. 

Detailed analysis

Registrations

Continue implementing efficient channel management, capturing MI and being more proactive to avoid high volumes

What more could have been done?

Action could have been taken sooner to prevent the average length of high- and medium-risk registrations rising so significantly since 2014-15.

To tackle the increase in higher-risk cases up to 2016-17, the Commission could have responded more quickly to manage high-risk cases and provided additional training at an earlier stage.

The Commission could have identified potential unsuccessful applications before they apply to allow more time to deal with registrations identified as higher-risk.

What next?

Simplification and automation of registration

Continue progress through the digital work stream in the Transform programme, including a pre-eligibility checker. The Commission should continue to develop the registration system. For example, additional questions to help guide charities through the process, depending on the category of charity identified (go live in 2017).

As the high level of demand for registration is likely to continue or increase with policy changes, the Commission should ensure it is able to identify its unit costs in order to identify its resource requirements.

Following a peak in 2016-17 for the time taken to register, the speed of each risk category has started to improve.

The Commission should continue to be proactive in engaging with the sector. For example, it should continue its work on removing legal jargon and reviewing complex rules to enable trustees to apply directly without the need for professional advisers.

Detailed analysis

Working with others

The Commission is providing and receiving more information and knowledge with other organisations

Previous areas of concern:

The Commission needs to work more with other bodies and government departments, such as HMRC to develop a mutual understanding of information and requirements, including collaboration on risk profiling of charities.

In 2015, the NAO recommended that the Commission develop a strategy to persuade a greater number of public authorities to share relevant information with the Commission, and introduce sample checks of information and assurance provided by trustees, using this to refine its strategy on the reliance of assurances.

What has been done?

The Commission has increased the number of memorandums of understanding (MoUs) and the amount of information shared with other organisations. This has created more opportunities for joint working and increased sharing of knowledge.

The disparity between information disclosures made and information received by the Commission has reduced. Disclosures now account for 56% of the total exchange of information in 2016-17 compared to receipts at 44%.

The Commission has created or reviewed 11 MoUs since 2015. This includes MoUs with local authorities and with other regulators. The Commission set a target for three new or refreshed MoUs each year.

The Commission has increased its external engagement. Activities include:

holding frequent workshops and collaborative events to promote engagement (twice-yearly compliance event);

closer working with, as well as secondments between, HMRC and law enforcement agencies to help with charity-related investigations and to promote understanding of the Commission and the sector;

communicating its wider impact through the use of thematic reports and a blog; and

making available the public register of charities to others, including government departments, for download at no charge.

The Commission has worked with members of the charity sector on a new governance code for charities.

It will help move some of the responsibility for governance from the Commission to the sector, which is seen as a positive move. This is an example of the Commission working effectively with the sector.

Detailed analysis

Working with others

The Commission should continue to monitor the use and influence of information shared to ensure it is using its resources to achieve the maximum benefit

What more could have been done?

The Commission could have made further progress in giving external organisations access to the information it holds, by:

improving the accessibility of the Commission’s data, including by providing tools and additional guidance or caveats on use of the data;

seeking feedback from others on whether the data provided is in a format that allows people to use it with ease and on whether it is providing critical value to key stakeholders;

continuing to put in place mechanisms for providing feedback on others’ data and starting to roll this out;

incorporating any areas for improvement into strategic planning; and

exploring how information and intelligence are combined and used by other regulators.

What next?

Continue its push to increase the number of organisations with which it shares data through MoUs and consider more frequent reviews of their effectiveness.

The Commission should continue to develop MoUs with regulators it wants to work with. The Commission’s MoU tracker shows that eight MoUs are currently being drafted and two are under review.

Be clear about how the Commission is measuring the data and information provided to others.

Track and review which information is of critical value to others in order to assess the impact on resources and whether this service is affordable.

Helping to quantify the outcome and resources required to feed into strategic workforce planning.

Building influence and helping to protect charities from abuse and mismanagement.

Further collaboration through sharing of data and intelligence with key partners.

Understanding what role greater collaboration can play in responding to the 10% drop in public trust and confidence in the sector.

Detailed analysis

Sustainable funding model

The Commission secured additional funding for the Transform programme but its overall funding is set to continue to fall

Detailed analysis

Sustainable funding model

The Commission is seeking sector funding to sustain and grow current services

Previous areas of concern:

The Commission should provide an update to the Committee on the outcome of its consultations and its future plans in relation to charging.

Context

Currently, HM Treasury is funding 100% of the Commission’s activities.

The Commission is exploring other funding options for 2018 onwards to fund existing and additional services. Although any additional services will need to be subject to business case approval.

To implement sector funding, primary or secondary legislation is required. Therefore ministerial approval is required for the consultation to begin. This approval has been delayed for various reasons, including the recent referendum and General Election.

There are a range of funding options (see diagram right).

What has been done?

The Commission has been working on detailed proposals on a range of options for future funding. This includes exploring a case for additional resources to extend its enablement activities and relieve pressure from increasing regulatory workloads.

While there are currently no firm proposals for introducing a charging scheme to raise a proportion of income from charities, the Commission has said that it would seek ministerial approval for a consultation setting out options early in 2018.

The Commission’s current thinking is that only the largest 2,000 charities (2% of the total) would have to pay any levy. This could raise £7 million to £8 million by either a flat fee or on a sliding scale.1

The Commission’s vision is that if additional funding were to be sourced from the sector, it would be used to make it easier for charities to work with the Commission, including additional services such as a trustee advice line, faster processing of schemes and orders, mergers and consolidation, and expanded guidance and support for trustees.

Since January 2015, there have been various proposed approaches to the Commission’s funding after 2018.

These have varied from the current situation of being fully funded by HM Treasury to being fully funded by the charity sector.

Currently, the favoured option by HM Treasury and the Commission is to receive additional funding from the charity sector, but this has yet to be decided.

Note

1 Greg Hurst, ‘Charities are urged to pay for regulator’, The Times, 3 November 2017, available at: www.thetimes.co.uk

Detailed analysis

Sustainable funding model

Potential consultation on sector funding has yet to begin

What more could have been done?

Provide more clarity on the Commission’s funding proposals.

Representatives of the sector are unclear about:

how much money the Commission needs to be a regulator;

how much it wants to receive from the sector;

what the funding will be used for; and

whether sector funding will replace HM Treasury funding.

Consult with charities in a more timely manner.

In the past few years, the Commission has made public statements about funding options, and specifically sector charging, and has spoken to a few of the larger charities and stakeholders beyond the sector. However, a public consultation has yet to be launched.

Although substantial preparatory work has been undertaken in discussion with HM Treasury and the Department for Digital, Culture, Media & Sport, a formal launch has not yet been agreed by ministers.

The absence of a clear timetable to achieve an agreed position about the required level, and source, of longer-term funding means the Commission is exposed to risks. For example, restricting its ability to plan for the future.

Apply the Cabinet Office’s guidance on consultations more clearly (available at: www.gov.uk/government/uploads/system/uploads/attachment_data/file/492132/20160111_Consultation_principles_final.pdf). Areas for improvement are:

Consultations are only part of a process of engagement – “Consultation is not just about formal documents and responses. It is an on-going process.”

Consultations should take account of the groups being consulted – “Consult stakeholders in a way that suits them. Charities may need more time to respond than businesses, for example.”

Detail more precisely how extra funding would be used

The Commission has continued to seek additional funding. The amount requested is based on estimates supported by the unit cost model. The Commission could have calculated the total cost of being an effective regulator to make a more persuasive argument for additional funding. The Commission needs to set out why it needs additional funding.

What next?

The Commission needs to continue to work closely with HM Treasury to begin consultation with the sector.

Formal consultation needs to begin so that the Commission can receive the planned funding in time to achieve its business plan.

Clarity on whether funding from the sector replaces HM Treasury funding.

Following the Spending Review 2015, the Commission’s preference was to pursue a fully funded sector model, resulting in no further HM Treasury funding by 2022-23.

More recently, sector funding is being considered to fill the funding gap between the Commission’s proposed vision and funding allocations from HM Treasury.

The sector’s queries need to be addressed in the sector funding consultation in order to maintain a good relationship with the sector.

Detailed analysis

Sustainable funding model

The Commission has not communicated how much it believes it would cost to be an effective regulator

Previous areas of concern:

The Commission should identify what budget and resources it would need to regulate effectively, following a real-terms cut of 40% in 2013-14 compared with 2007-08.

Following a strategic review in 2011, the Commission restructured without assessing costs, benefits and risks of different models for regulating charities and meeting its statutory objectives.

What has been done?

The Commission has created a unit cost model to better understand its current costs. It has used this to inform funding negotiations with HM Treasury and estimates of the additional funding it requires for its sector funding consultation.

In September 2015, the Commission produced analysis for discussions with HM Treasury that shows high-level unit costs by activity and the risks of not receiving additional funding.

Since then, it has worked to prioritise and allocate resources to areas identified as highest risk (IT and digital, risk-profiling and operations/IME).

The Commission developed its unit cost model in 2016. It has used this in a limited fashion as part of financial planning, with the intention of using it for business planning, including developing sustainable funding options.

What more could have been done?

The Commission has not set out clearly what it needs in the medium- and long-term to be an effective regulator. Future funding requirements are uncertain because of the changing make-up of the sector, higher demand for the Commission’s work and increased risks in the sector. The funding model needs to be responsive to a range of scenarios and highlight the impact of shortfalls in funding levels covering the best case and worst case scenarios.

What next?

The Commission should continue its work in understanding the cost of effective regulation.

The Commission should refine its budget forecasting model to better understand the medium- and long-term funding situation and risks.

Using this model, it should develop a range of scenarios for discussion with stakeholders. The clarity about the range of scenarios should allow the Commission to make a more persuasive and informed argument for its funding proposals.

Detailed analysis

Shaping its own agenda

Continue to work on building the influence of the Commission to control demand

What next?

Improve engagement with other government entities to ensure it has more influence over policy changes that will impact it.

As the high level of demand is likely to continue or increase with policy changes, the Commission should use its unit cost model to identify future resource requirements.

Continue to monitor the use and influence of information shared to ensure it is using its resources to achieve the maximum benefit.

Appendix One

The Commission’s actions against prior NAO/Committee of Public Accounts recommendations

Appendix Two

Performance measures

The KPIs broadly cover the breadth of the Commission’s statutory objectives

Appendix Three

Performance measures

The KPIs (May 2017) perform well against good practice criteria overall

Appendix Four

Risk-based regulation

Risk-based approach framework

Design and Production by NAO External Relations
DP Ref: 11643-001