BULLETIN No. 169: November 2017

My monthly attempt to keep my contacts, friends, friends of friends, etc. in touch with what's going on in the world of charities. A distillation of the many briefings that arrive on my desk, plus whatever I've gleaned from charities I'm currently working with. Always glad to get your comments and suggestions;

Daryl Martin

d.martin@afvs.org.uk

What do we have this month?

1. Data Protection and GDPR Compliance
2. Subject Access Requests (SAR)
3. Serious Incident Reporting
4. Budget 2017 - Charities and VAT
5. Trustee Stats
6. Trustee Training
7. Business Continuity and Disaster Recovery
8. On-line Learning
9. Fundraising
10. Manage Cyber and Data Risks by putting in place Insurances
11. How can we help you?
12. And Finally...

1. Data Protection and GDPR Compliance
We have been inundated with requests for help to achieve GDPR compliance, so please accept our apologies if we haven’t got back to you yet. Here’s the plan: Jo is putting the finishing touches on the self-assessment part of the Compliance Audit Toolkit, which will be available to AFVS members from November 24th. To encourage those non-members who would like our help, we are currently offering half-price membership. Please contact Becky if you are interested.

When you have completed and returned the self-assessment to us, we will evaluate and grade your charity as either low, medium or high risk. We will then propose an action plan, and supply all relevant procedures, policies forms and so forth to help you achieve compliance. There’ll be a fee to cover the cost of this, depending on your risk level. (I estimate that 80% of our members are low risk.)

The action plan will assess your current compliance level, management and staff awareness, and any particular risks. It will include categories of personal data maintained, systems and processes for managing the data, as well as looking at the legal basis for each category of data, how long it should be kept, and what privacy notices are needed.

Subject Access Requests (SAR) readiness will be reviewed to ensure compliance with new requirements. Procedures put in place to notify any data breach to the regulator. Help to compile a Privacy Impact Assessment (PIA) for any high-risk activities.

Your GDPR, compliance action plan, will include agreeing on staff awareness training needs, and an appropriate ongoing review process to ensure compliance is achieved and maintained.

This is just an overview, there’s much else covered. I’ll update you in my December briefing.

2. Subject Access Requests (SAR)
I mention this yet again as I’ve been involved in 2 more this month and I don’t think charities have generally caught up on the dangers of this issue. Remember that any individual is legally entitled to see any information you are holding on them. This information must be produced within 40 days, (reducing to 30 under GDPR).

3. Serious Incident Reporting
I’ve suddenly been involved in a spate of serious incident reports to the Charity Commission. In all cases, I wish I’d been involved sooner rather than later. I can often save some serious headaches. In one case the charity was being pressured to write to the Commission when there clearly was no need to. In two cases the reports the trustees prepared left out vital information and cast them in a bad light. If you don’t report an incident, you could be in serious trouble. Get advice from your professional adviser.

4. Budget 2017 - Charities and VAT
This item comes from our good friend, Les Howard, charity VAT specialist.
As seems likely in the imminent Budget, the VAT registration threshold will be reduced, perhaps considerably. The press has largely concentrated on the perceived burden upon small businesses.

But charities are likely to have a greater burden!
There are two questions to ask, post-Budget:

• What will the registration threshold be, and
• From what date will the new threshold apply?

Don’t panic! There are various options open to you, although generally we do NOT recommend you use the Flat Rate Scheme.

If you do have taxable business income, and you think the changes will mean you need to be registered, do contact us, and we’ll help you through the process. les@vatadvice.org

5. Trustee Stats
The Charity Commission’s just put out a report on trusteeship. Interesting reading; here are some of the choicer bits:

80 per cent of charities have no other staff or volunteers. Trustees are both governance and executive.

There are roughly 134,000 charities with incomes under £100,000, the report finds, with only 35,000 employees and 116,000 volunteers between them. These charities are village halls, PTAs, church centres, choirs, scout and guide groups, sports clubs, women’s institutes and the like.

The average trustee contributes just under 5 hours a week. I know plenty of trustees who do more than this, much more.

Only 5 per cent of trustees are recruited openly. 71 per cent of trustees were recruited through informal networks, and only 5 per cent answered a public advert. How the rest were recruited is not made clear.

Formal recruitment is not a panacea, however. Diversity is generally worse on boards with a higher level of formal recruitment. Board diversity is generally poor.

More than 2,000 charities pay trustees. This seems low to me; I simply don’t believe it. Paying trustees becomes much more commonplace as charities get bigger. The survey found that 7.4 per cent of charities with annual incomes over £5m paid their trustees.

There are roughly 700,000 trustees in England and Wales, not 850,000, as the Commission had thought.

The average length of service for a trustee is around five years, about right, with trustee tenure longest in the smaller organisations. In the largest charities, median tenure is between three and four years.

Only 9 per cent of trustees think training is very important. That is bad! This leads nicely to:

6. Trustee Training
I’ve finished my training for the year. During the last few months, I’ve added to my material to include a session on the new Code of Conduct issued by the Commission (CC20), with reference where necessary to the Trustees Code of Conduct for Fundraising. These two publications are extensive, far too long; does the Commission really expect trustees to have the time and the inclination to read all this? I’ve prepared summaries of both documents, available to members; drop us a line.

7. Business Continuity and Disaster Recovery
We’ve been sending out our example policy recently. We’ve made some big changes to put more detail into it. (Thanks everyone who helped us in this, my valuable friend Ian in particular.) Let us know if you’d like our updated version.

8. On-line Learning
The online learning course I’ve been telling you about is now live. My first course is ‘All About Trustees’. It’s in 3 parts. There’s also a small course on Charity Trading. I’m working on Fundraising, Volunteers and GDPR Made Simple. As a marketing tactic to get traffic to the site, all courses are being offered at half price until Christmas which means exceptionally good value. www.bowringandjazz.com

9. Fundraising
If you need help kickstarting your fundraising or if you want someone to run a ruler over the way you do things, or if things have got a bit stale, e-mail us. We have some capability to help make a difference. We’re developing a good relationship with a fundraising specialist who mentors fundraisers. I’ve seen her output, and she’s well worth talking with to see what she can do for you.

10. Manage Cyber and Data Risks by putting in place Insurances
This item comes from our partner, Tim Wiltshire at Access Insurance.
For any organisation, keeping data safe is becoming increasingly important and also more challenging. Access Insurance help their clients manage cyber and data risks by putting in place insurances to deal with the consequences of a data breach. So how does insurance help? Dealing with a data breach can be very costly. There are large costs involved in notifying relevant parties, dealing with complaints, investigating and remedying the breach, paying compensation where there is a liability, and the losses as a result of consequential business interruption. Insurance policies can be arranged to pay these expenses and cover the losses.

Key covers of a Cyber Policy include:

• The cost of repairing or replacing your computer systems, including sending an IT forensic expert to your office to assist.
• Cyber extortion.
• Business Interruption as a result of a malicious attack on your network.
• Third party liability cover.
• Errors and omissions cover in terms of your service provision, such as technology or software consulting.
• Infringement of intellectual property.
• Online identity fraud.
• Fines and Penalties from regulatory bodies where the law allows insurance to cover the costs.
• PR costs and support from a specialist to limit damage to reputation.

Be aware that not all of the above covers will be available on some cyber insurance policies. It is important to speak to a specialist like Access Insurance as they will be able to advise on appropriate covers levels before providing a competitive quotation. For further information please contact Access Insurance on 020 8651 7420 and ask for Tim Wiltshire.

11. How can we help you?
The list of our support services gets ever longer:

All aspects of accounts including year-end and book-keeping, including
Migration to Xero and QuickBooks online accounting platforms
Mentoring
Outsourcing (Book-keeping, virtual FD, Gift Aid etc.
Data Protection (GDPR) and compliance
HR support
Legal advice
Trading Issues (including charity shops)
Community Halls
Fundraising: reviewing, advising, mentoring, bid writing.
Training, including online learning
General Advice and Consultancy
Extensive library of briefings and policy templates

Contact us if you need help in any of these areas.

12. And Finally...

Earlier this month we were at the Christian Resources Exhibition at Esher catching up with old friends and making new ones. Several people came up to tell me how much they enjoyed my AND FINALLY jokes. Well, I ran out of good jokes some months ago (a good joke is very hard to find - send it me if you have one). So for some time I’ve been posting prayers; some of these are being posted on around the world, having quite an impact on readers.

This prayer is attributed to Father Pedro Arrupe (1903- 1991) from the Basque region of Spain.

Be Practical
Nothing is more practical than finding God, that is,
than falling in love in a quite absolute final way.

What you are in love with,
what seizes your imagination,
will affect everything.
It will decide what will get you out of bed in the morning,
what you do with your evenings,
how you spend your weekend,
what you read, who you know,
what breaks your heart,
and what amazes you with joy and gratitude.

Fall in love,
stay in love,
and it will decide everything.

Go well. Thank you for your encouraging messages. We look forward to hearing from you with your questions, your suggestions, your requests for help and advice. If you find this bulletin helpful, could you take a moment to pass it onto others who might appreciate it.

Daryl Martin