Beyond the Bus Factor

Sector overlay

Bus factor for charities and NGOs

Trustees, funders, regulators and the roles somebody is legally required to hold.

The bus factor audit is written to work anywhere. This adds what it cannot know about your setting: the vocabulary, the rows specific to charities and NGOs, and the failure this sector most often turns out to have.

What things are called here

In the audit Here
Whoever decides The board of trustees, or the management committee
Direction and priorities Strategy, usually board approved
Whoever funds or pays you Funders, grant makers, major donors, commissioners
Regulators and officials Your charity regulator, and any sector inspectorate
Statutory filings The annual return, accounts, and trustee changes
Roles a regulator requires you to name Designated safeguarding lead, data protection lead, responsible person
The core work Service delivery, programmes, casework
Bringing new people in Recruitment, and volunteer onboarding, which are different problems

Rows to add to your audit

Governance

Area Who? Bus factor Risk level
The chair, and anybody able to chair in their absence      
Quorum, and how close you are to losing it      
Trustee recruitment and induction      
Knowing when each trustee's term ends      
The governing document, and who has read it recently      
Conflicts of interest register      
Board papers, and who assembles them      

Money and funders

Area Who? Bus factor Risk level
Each funder relationship, named individually      
Grant reporting, per grant      
Restricted fund tracking, and what each restriction actually says      
The bank mandate, and whether it names anyone who has left      
Reserves policy, and who monitors it      
Gift Aid or equivalent tax relief claims      
Commissioner or contract relationships      

Statutory and regulatory

Area Who? Bus factor Risk level
Designated safeguarding lead, and the deputy      
Safeguarding case records, and who can reach them      
Annual return and accounts, with dates      
Serious incident reporting      
Insurance, including trustee indemnity      
DBS or equivalent checks, and their renewal dates      
Data protection registration and records      

People and volunteers

Area Who? Bus factor Risk level
The volunteer rota, and the judgement behind it      
Who knows the volunteers as people      
Beneficiary relationships and case history      
Staff contracts, and where they are kept      
The founder, if there is one, and what they still hold      

The failure this sector usually has

Roles the law requires you to name, held by one person with no deputy.

Most charities have thought about their chief executive leaving. Very few have thought about their designated safeguarding lead leaving, and that one is worse, because the role is not optional. You cannot pause it while you recruit. Funders require it, insurers require it, and delivery partners will stop work without it.

The same shape applies to bank signatories, the responsible person on your regulator's record, and whoever holds the data protection duties. These are roles where being unfilled is a compliance problem on day one, not a capacity problem in month three.

The second failure, close behind, is income relationships held in one inbox. A fundraiser who leaves takes the knowledge of which programme officer prefers a phone call and which foundation is restructuring. The spreadsheet of deadlines survives. The relationship does not.

And the third is founder concentration. Where somebody founded the organisation and stayed, funders often believe they are funding that person. That is a governance problem the board has usually deferred for a decade.

A worked example

A composite, built from patterns rather than one organisation. Treat it as a shape to recognise, not a case study.

A small charity, eleven staff, four months of reserves.

Their audit came back with four reds. Three were the obvious ones: the finance officer was the only active bank signatory, the fundraiser held all four major grant relationships, and the chief executive was the only person any funder had met.

The fourth was the one they had not expected. Their designated safeguarding lead was named in the policy by job title, and that post had been vacant since a restructure eight months earlier. Nobody had noticed, because no case had come in. Their insurance and two delivery contracts both required a named lead. They had been out of compliance for two thirds of a year.

What they did in thirty days: added a second bank signatory, which took three weeks and needed a trustee meeting they had to bring forward. Named an interim safeguarding lead and booked training. Took the chair to two funder meetings.

What they did in ninety days: rewrote the safeguarding policy to name a lead and a deputy by role with a rule that the post cannot sit vacant, moved two funder relationships to the chief executive and one to a trustee, and put a bank mandate review on the agenda of every meeting where a trustee joins or leaves.

The reserves are still four months. That has not changed and probably will not. But four months is now enough time to recruit, which it was not before.

Scenarios worth running first

From the scenario cards:

Then