Mosaic LGBT+ Young Persons’ Trust, Charity Number 1166676

 

Policy Owner: FRG Committee

Review Cycle: 24 Months

Next Review Date: July 2027(Updated and re-approved July 2025)

 

M Mindful

O Open

S Safe

A Agile

I Inclusive

C Community

Introduction

 

This policy lays out how Mosaic LGBT+ Young Persons’ Trust handles risk.

 

We also have a “Whistleblowing” policy, which encourages all users of our services and the public to report any misconduct, law-breaking or failure to act by any of Mosaic’s staff, Trustees or volunteers.  

 

You can always contact trustees directly if you have concerns, or complaints or wish to “blow the whistle” on something that is going on and we will support you in dealing with your concerns.

 

You can contact any of the trustees below:

 

• Ken Batty is the Chair of Mosaic’s board of trustees: ken.batty@mosaictrust.org.uk
• Madison (Madi) Pollard is the Vice Chair:  madison.pollard@mosaictrust.org.uk 
• Jo Wittams chairs our Finance, Risk and Governance Committee:    jo.wittams@mosaictrust.org.uk 
   

Risk Management Policy

 

1. Purpose

 

a) This policy forms part of Mosaic’s internal control and governance arrangements. It explains the underlying approach to risk management and identifies the roles and responsibilities of the Board of Trustees (the Board) and other key parties. It also outlines key aspects of the risk management process.

 

b) Properly identifying and monitoring risks allows Mosaic LGBT+ Young Persons’ Trust (referred to as Mosaic) to make informed decisions and take timely actions, ultimately achieving its aims successfully, and ensuring a higher positive impact for young persons. Risk management is a requirement for Mosaic’s trustees, to achieve the organisation’s objectives and safeguard its funds and assets. It also allows Mosaic staff and volunteers to make day-to-day decisions in ways that do not put Mosaic’s beneficiaries and/or the organisation at risk.

 

2. Definitions and applicable laws

 

a) Mosaic has a responsibility under charity law to state in its annual accounts that the major risks to which the charity is exposed, as identified by the Trustees, have been reviewed, and systems have been established to mitigate those risks. For more information please see: Charity Commission Guidance - Charities and Risk Management.

 

b) “Risk” is used in this policy to describe the uncertainty surrounding events and their outcomes that might have a significant impact, either enhancing or inhibiting operational performance, achievement of aims and objectives, or meeting the expectations of stakeholders. 

 

3. Roles and responsibilities

 

Mosaic will proactively take measures for the identification, evaluation and effective control of risks to ensure they are managed to an acceptable level. It is acknowledged that some risks will always exist and will never be eliminated.

 

a) The Board of Trustees is responsible for making a statement on risk management in the annual accounts of the Trust. In order to be able to make the required statement with reasonable confidence, the Trustees should ensure that risks have been adequately identified, assessed and mitigated, ensuring that risk management is ongoing and embedded in management and operation procedures. The statement should also reflect the Trustees’ views as to the levels of acceptable risk.

 

b) The Board of Trustees is responsible for overseeing the development and implementation of procedures which ensure proper risk management. This responsibility of specific areas is delegated to the subcommittees to manage. 

 

c) Overall operational risks are delegated to the Chair or Vice-Chair of the Board, with support from other Trustees as appropriate.

 

d) The Finance, Risk and Governance sub-committee is delegated with the overall oversight of Mosaic’s risk management processes and the management and ownership of finance and governance-related risks. 

 

e) The Frontline, Fundraising, Marketing and Communications sub-committees are delegated with the management and ownership of the risks related to their respective areas.

 

f) The Executive Director is responsible for supporting the Board in their risk management activities, by ensuring the effective operation and implementation of mitigation measures and reporting any gaps. The Executive Director is the co-owner of all risks, in particular in regard to specific mitigation actions for which is responsible for and can delegate some mitigation actions and/or day to day risk management to other Mosaic staff.

 

g) All staff and volunteers are responsible for encouraging good risk management practice within their areas of work. 

 

4. Risk management process and Mosaic’s Risk Register

 

The main operational document in regard to risk management is Mosaic’s Risk register.

This is a live document which is reviewed frequently by the Board and relevant

sub-committees.

 

4.1 Risk Identification

 

The process of risk identification involves both Trustees and staff and should be

revisited at least once a year and when major organisational or external operational

environment changes take place. Consideration will be given to the following factors:

 

• Mosaic's vision, values and strategic goals are defined in Mosaic’s Strategy.
• The nature and scale of Mosaic’s activities, both current and planned.
• External factors that may affect Mosaic, such as legislation and regulation. 
• Mosaic’s relations and reputation with its key stakeholders.
• The operating structure and changes in Mosaic’s team and/or management processes. 

 

4.2 Risk Assessment 

 

When the Board and/or the delegated sub-committees assess Mosaic’s risks, they need to:

 

• Discuss and agree that all involved are satisfied with the list of identified risks and the impact and likelihood levels of each risk. 
• The maximum number of risks included in the Risk Register is ten (10). This limit will facilitate the prioritisation of risks and the allocation of resources to address areas of high exposure. The risks that are included in the risk register will be the ones with the highest risk rating. In case of more than 10 with high risk rating, the ones with the highest impact will be prioritised.
• Determine the appropriate response to each risk.
• Assess existing measures and determine any additional appropriate actions.
• Allocate responsibility for action and timeframe for implementation.

 

4.3 General considerations

 

• The risk level for each identified risk is calculated by multiplying the likelihood and the impact scores.
• The Risk Register describes the risks, the potential impact if they materialise, the risk level and the mitigation actions taken or to be taken. 
• The Risk Matrix provides a snapshot of the risk level that Mosaic is currently in.
• Please see Mosaic’s Risk Register for the list of identified risks and mitigation measures, as well as the Risk Scoring Guidance for further details of the definition of Impact and likelihood, and risk level calculation.
• With this exercise complete, the Board of Trustees will decide what their risk appetite is, (what level of risk they are willing to tolerate). This will determine what response the Board wishes to make to each risk. 

 

4.4 Action Planning

 

• All potential significant risks (to a maximum of ten) should be recorded in Mosaic’s Risk register. For each risk, Mosaic trustees and staff will need to identify the actions which are required to produce an acceptable reduced risk level and add those actions in the risk register.
• Clear responsibilities should be allocated to these actions along with a deadline for any specific actions to be completed. 
• There are different ways to manage or mitigate risk, either by lessening the likelihood or the impact of the risk. The following are examples of possible actions: the risk may need to be avoided by ending that activity; the risk could be transferred to a third party; the risk could be shared with others (eg. a joint venture project); the charity's exposure to the risk can be limited; the risk can be reduced or eliminated by establishing or improving control procedures; the risk may need to be insured against; the risk may be accepted as being unlikely to occur and/or of low impact and therefore will just be reviewed annually, etc.

 

4.5 Monitoring and Review 

 

• All actions that are linked to mitigation measures will be captured in the Board’s Actions document and reviewed in each Board meeting.
• In each in-person Board meeting, the Board will discuss in rotation a category of risks under the responsibility of each committee. 
• Each sub-committee will include a risk monitoring item in their meetings agenda, so that the risks that are relevant to each committee are monitored regularly, including the following questions: “Do the identified risks describe correctly the actual risks in our area of responsibility?”; What have we done in the last three months and what do we need to do in the next three months in order to maintain the post mitigation risk level to an acceptable for Mosaic level?”.
• Each sub-committee will also have an annual cycle of risk identification and assessment, in which they will review in depth identified and potentially new risks.
• When a risk has its post-mitigation level increased to critical or a new critical risk is identified, this will be discussed at the Board level to decide whether a new risk needs to be included in the Risk Register and/ or further mitigation actions need to be implemented.