Serious Incident Reporting Policy

Al-Waris Foundation is committed to identifying, managing, recording and reporting serious incidents appropriately.

The Board of Trustees has ultimate responsibility for ensuring that significant incidents affecting the charity are:

The charity will follow applicable Charity Commission guidance when determining whether an incident should be reported.

Potential reputational consequences must not prevent appropriate reporting.

This policy establishes the charity's framework for:

This policy applies to incidents connected with:

It applies to incidents occurring in the United Kingdom, overseas or online.

A serious incident is an adverse event, whether actual or alleged, that results in or creates a significant risk of:

Whether an incident is sufficiently serious to require reporting depends on its circumstances.

Not every mistake, complaint, financial discrepancy or operational problem will constitute a reportable serious incident.

Potential serious incidents may include matters relating to:

This list is not exhaustive.

A safeguarding matter may constitute a serious incident where it significantly affects:

Safeguarding action must take priority over administrative reporting.

Where immediate safeguarding action is required, the charity should act first to protect the person concerned and then complete appropriate regulatory reporting.

See:

Significant actual or suspected financial loss may require serious incident consideration.

Examples may involve:

The significance of a loss should be assessed in the context of Al-Waris Foundation's:

A relatively small monetary loss may still be significant where it indicates serious dishonesty, systemic weakness or wider risk.

Suspected or confirmed significant fraud should be escalated promptly.

The charity should consider:

See the Anti-Fraud, Bribery and Corruption Policy.

Potential serious incidents may arise where charitable resources are deliberately used for purposes inconsistent with:

Particular attention should be given to suspected deliberate diversion of restricted funds.

Significant suspected:

must be escalated appropriately.

This applies equally to activities undertaken:

Potential money laundering concerns should be escalated promptly.

The charity must not knowingly permit its:

to be used to disguise or facilitate unlawful financial activity.

Professional or regulatory advice should be obtained where necessary.

Any credible concern that charitable resources may have been diverted to terrorist purposes must be treated seriously.

The charity should consider:

See the Sanctions and Terrorist Financing Policy.

A suspected material breach of applicable UK financial sanctions must be escalated.

Relevant transactions should not proceed where the charity has identified an unresolved sanctions concern.

The appropriate government or regulatory reporting requirements should be considered.

A significant governance failure may constitute a serious incident.

Examples may include:

Minor procedural errors will not automatically constitute serious incidents.

A conflict of interest may become a serious incident where it results in or creates significant risk of:

See the Conflict of Interest Policy.

Significant criminal allegations connected with the charity should be assessed for serious incident reporting.

An allegation does not automatically establish that an offence occurred.

The charity should distinguish appropriately between:

Police or another competent authority may need to be contacted independently of Charity Commission reporting.

A significant personal-data breach may also constitute a serious incident.

The charity should separately assess:

See the Data Protection and UK GDPR Policy.

A significant cybersecurity incident may require serious incident consideration where it materially affects:

Examples may include significant compromise of:

See the Information Security and Cybersecurity Policy.

Significant fundraising misconduct may require serious incident consideration.

This may include substantial concerns involving:

Ordinary fundraising complaints should normally be handled under the Complaints Policy unless their seriousness requires escalation.

Incidents involving overseas operations must be assessed under the same principles as UK incidents.

Relevant matters may involve:

Distance from the UK does not reduce the trustees' responsibility for appropriate oversight.

Where an incident occurs within a partner organisation, Al-Waris Foundation should determine whether the incident materially affects:

The fact that the incident occurred within a separate organisation does not automatically remove Al-Waris Foundation's reporting responsibilities.

Suspected deliberate falsification of significant project evidence should be escalated.

This may include false:

The seriousness should be assessed according to:

AI-generated or manipulated material must not be knowingly represented as genuine documentary evidence of completed charitable work.

A significant incident involving deliberate use of fabricated material to mislead:

should be considered under this policy.

Legitimate illustrative content that is clearly presented as illustrative is distinct from false project evidence.

Reputational damage alone does not automatically make something a serious incident.

However, a matter may require reporting where it significantly affects:

The underlying conduct should be assessed rather than relying solely on media attention.

A major operational event may require serious incident consideration where the charity becomes significantly unable to:

Minor or temporary technical problems would not normally meet this threshold.

Anyone involved with Al-Waris Foundation who becomes aware of a potential serious incident should report it promptly to an appropriate authorised person.

Depending on the matter, this may include:

A person should not wait until every fact has been established before raising a credible significant concern.

Where the potential serious incident concerns:

the matter should be escalated directly to another unconflicted trustee.

The Chair must not control the assessment of whether their own alleged conduct constitutes a reportable serious incident.

Where an incident involves another trustee, the matter should be considered by unconflicted trustees.

The trustee concerned should not determine:

where this would create an inappropriate conflict.

Where the incident concerns most or all trustees, independent advice should be considered.

Direct regulatory reporting may be appropriate where effective internal escalation is not possible.

When an incident occurs, the first priorities should be proportionate to the circumstances.

These may include:

Regulatory reporting should follow without unnecessary delay where required.

Potential serious incidents should be appropriately documented.

The record may include:

Al-Waris Foundation should maintain a restricted serious incident register.

The register may record:

Access should be restricted appropriately.

A potential incident should be assessed promptly.

The assessment should consider:

The charity should not automatically wait until an internal investigation is complete before considering regulatory reporting.

Where a report is required, it may be appropriate to:

Where an incident meets the relevant reporting threshold, Al-Waris Foundation should make a serious incident report to the Charity Commission.

The charity should use the Commission's current reporting process and guidance.

The report should be:

Responsibility for submitting a report may be delegated to an appropriate person.

However, the trustees remain responsible for ensuring the report is made.

Where appropriate, the report should make clear that the trustees are aware of the incident and are managing it.

Depending on the incident, a report may explain:

Only information necessary for the regulatory purpose should be included.

Reports must distinguish between:

Al-Waris Foundation must not knowingly provide misleading information to a regulator.

Where a material development occurs after the original report, the charity should consider whether the Charity Commission should receive an update.

This may include:

A Charity Commission report does not replace reports that may need to be made to another authority.

Depending on the incident, relevant bodies may include:

Where appropriate, suspected criminal activity should be reported to the police or another appropriate law-enforcement route.

Immediate emergencies should be handled through the appropriate emergency services.

Fraud and cybercrime matters may require reporting through the appropriate UK fraud-reporting arrangements.

Current official reporting routes should be checked at the time of the incident.

Where an incident constitutes a reportable personal-data breach, the charity should follow the applicable ICO reporting requirements.

The decision should be documented.

Where appropriate, safeguarding incidents may need to be referred to:

Charity Commission reporting does not replace safeguarding referrals.

The charity should seek professional advice where reasonably necessary.

This may include:

Seeking advice must not create unnecessary delay where immediate protective action is required.

Serious incident information must be handled confidentially.

Access should be limited according to legitimate need.

The charity should avoid unnecessary disclosure of:

Personal information processed during serious incident management must be handled in accordance with:

Regulatory reporting does not justify unnecessary disclosure of personal information.

Where an incident may become public, communications should be:

The charity should not:

Where an incident materially affects a particular appeal or restricted fund, the charity should consider whether donors require appropriate information.

Any communication should distinguish between:

Following an incident, corrective action may include:

Where charitable funds have been improperly lost or diverted, the trustees should consider reasonable recovery action.

Factors may include:

Where a serious incident concerns a delivery partner or contractor, Al-Waris Foundation may:

Decisions should be proportionate to the identified risk.

After a significant incident has been stabilised, the charity should consider:

Lessons should lead to practical improvements where appropriate.

A formal post-incident review should be considered for significant incidents.

The review may examine:

The Board should receive sufficient information to oversee significant incidents.

Where confidentiality requires it, information may be:

The Board should monitor significant corrective actions until appropriately completed.

Where applicable, trustees should ensure statutory reporting accurately reflects relevant matters and regulatory disclosures.

The charity should not knowingly make statements inconsistent with serious incident information already reported to regulators.

A serious incident may first become known through whistleblowing.

Whistleblowers should be protected in accordance with the Whistleblowing Policy.

A whistleblowing concern must not be ignored merely because the person reporting it wishes to remain anonymous.

A complaint may reveal a serious incident.

Where this occurs:

The existence of a complaints process must not delay necessary regulatory action.

Serious incident records should be retained in accordance with the Records Retention and Disposal Policy.

Retention should reflect:

Records should be securely destroyed when their justified retention period expires.

Trustees and relevant operational personnel should understand:

A person must not be subjected to inappropriate retaliation for genuinely reporting a potential serious incident.

Concerns about retaliation should be handled under the Whistleblowing Policy where appropriate.

Deliberately concealing a significant incident may result in appropriate:

This does not apply to a person who reasonably uses an appropriate external whistleblowing or regulatory route instead.

The Board of Trustees owns this policy.

Operational responsibilities may be delegated, but the Board remains responsible for ensuring that appropriate serious incident arrangements are maintained.

This policy should be read alongside:

This policy will be reviewed:

Version: 2.0 Status: Approved Approved by: Board of Trustees Approval date: 25/08/2026 Next scheduled review: 24/08/2027