Board Assurance Frameworks (BAF) and Governance in Practice

Razia Gent, Director of Internal Audit at Bishop Fleming, set the tone for Charity Recruit’s latest virtual boardroom session, ‘Board Assurance Framework (BAF) and Governance in Practice,’ hosted by Divisional Director Emily Formby. The session was built around one idea: governance in the charity sector has moved past tick box compliance and boards now need real evidence that their oversight is doing its job. 

“Good governance is no longer assumed. It has to be visible.” 

Why governance is under the spotlight 

Charities are under a particular kind of pressure right now.Regulatory scrutiny has increased and the cost-of-living crisis has tightened funding across the sector. Public trust now hinges on whether donated money reaches the causes it was meant for. Trustees stay accountable even when day to day responsibility sits elsewhere in the organisation. That accountability cannot be passed on.

She also flagged how wide the definition of fraud has become. Fraud stretches well beyond a missing donation tin, covering payroll irregularities, inflated expenses and weak oversight across the organisation. Internal audit teams now apply a fraud lens across every area they review.

Themes coming up again and again 

A good chunk of the session focused on issues Razia sees repeatedly across the sector: 

• Out of date policies and procedures: Documents sitting on an intranet that no longer match how the charity actually works 

• Conflicts of interest and related party transactions: Declarations that are missing or stale, with procurement sometimes lacking independence 

• Value for money gaps: Suppliers chosen without a proper tender process, leaving boards unsure whether spend delivers what was promised 

• Board composition and skills gaps: Trustees give their time generously but often without the skills a risk area needs, while succession planning lags behind 

• Tone from the top: When boards do not visibly live by the policies they approve, that gap travels down to staff and weakens governance overall 

Putting the three lines model to work 

Razia spent time on the three lines model, familiar to most attendees by name if not always in practice. The first line handles day to day compliance, the second line sits with the board and trustees who review and challenge what comes from operations, and the third line is independent assurance, whether internal audit, external audit or specialist inspection. Her point was that these lines only add value when they actually talk to each other. 

This is where a Board Assurance Framework earns its place. Rather than treating risk registers and audit reports as separate documents, a BAF pulls everything into one place so trustees can see where assurance is strong, where it is thin and why a risk sits where it does. 

Razia illustrated this with a live walkthrough of risk assurance mapping, showing how a risk owner should be able to explain exactly which controls sit underneath their risk and what assurance comes from each line. 

“If you own the risk, surely you should know what controls lie underneath that risk.” 

That line from Razia drew a few knowing nods on camera. It captured the gap she sees most often, which is people scoring risks without fully understanding what holds that score in place, or why. 

Oversight, insight, foresight and hindsight 

Boards, she explained, need four lenses. Oversight checks whether things run as they should. Insight questions why something was set up a certain way. Foresight scans risks on the horizon, while hindsight reviews past failures and feeds those lessons back into planning. Together, these give trustees a fuller picture than a single risk score ever could. 

Questions from the floor 

The Q&A raised two concerns many smaller charities wrestle with. One attendee asked how to decide whether an organisation is big enough to justify an internal audit function. Razia’s answer was simple, claiming that even where a full team is not affordable, some form of independent viewpoint is best practice, acting as a critical friend that benchmarks the charity against others in the sector.  

A second question explored where strategy setting should sit between senior leadership and the board. Her view was that strategy works best as a shared process, with the board involved from the start rather than signing off something it had no hand in shaping. 

If the session proved one thing, it is that a Board Assurance Framework is not paperwork for its own sake. Done properly, it is the difference between a board that assumes it has good governance and one that can actually show it.