In short: Trustees' Week (9 to 13 November) and International Fraud Awareness Week (15 to 21 November) sit back to back this year. The thread that joins them is the route by which someone inside a charity can say that something is wrong. Tips find more fraud than any other control, small organisations are the least likely to have a formal route, and the Charity Commission expects trustees to report what they are told. That makes the speak-up route a governance control, and we set out four questions for the board.
Two awareness weeks sit side by side in the November calendar. Trustees' Week runs from 9 to 13 November 2026, and International Fraud Awareness Week, organised by the Association of Certified Fraud Examiners under the #fraudweek banner, follows from 15 to 21 November. They are usually treated as separate conversations. We think they are the same one, and the thread that joins them is quiet. It is the route by which someone inside a charity can say that something is wrong.
What the fraud data keeps telling us
The ACFE's Occupational Fraud 2026: A Report to the Nations is the fourteenth edition of the largest global study of workplace fraud, built on 2,402 real cases from 143 countries and territories. The median loss per case was USD 104,000, and documented losses across the study exceeded USD 3.4 billion. The typical scheme ran for twelve months before anyone noticed.
The detection figures are the part trustees should sit with. Forty-three per cent of frauds were first detected through a tip, nearly three times the share found by internal audit, which stood at 15 per cent. Of those tips, 55 per cent came from employees. The people most likely to notice a fraud are the people who work alongside it every day, and they notice it long before an auditor or a bank statement does.
The report also shows what a formal route for those tips is worth. Where organisations had a formal reporting mechanism, the median loss was USD 100,000 against USD 150,000 where they did not, and schemes were caught in eleven months rather than seventeen. Six months of undetected fraud is a great deal of a small charity's reserves.
Then comes the gap. Among organisations with 100 or more employees, 85 per cent had an established whistleblowing mechanism. Among organisations with fewer than 100 employees, the figure was 24 per cent. The ACFE describes this as the largest implementation gap of the eighteen anti-fraud controls it studied. Most charities in England and Wales sit firmly in the second group.
What the regulator expects of trustees
The Charity Commission's fraud guidance, published alongside its internal financial controls guidance for charities, is clear that trustees must manage the charity's resources responsibly. It asks trustees to promote an anti-fraud culture, to encourage people to voice concerns, and to make sure everyone knows how to raise them. It reminds trustees that fraud can come from inside as well as outside, from employees and volunteers as well as from fake funding requests, and it recommends reviewing fraud risks at least once a year or after any fraud or attempted fraud.
The Commission's serious incident guidance adds the consequence. Fraud and theft are reportable incidents with no minimum value, and repeated low-value incidents should be reported. Responsibility can be delegated to staff, but all trustees bear ultimate responsibility for ensuring the charity makes a report, and does so promptly, even where the police or another agency is already involved. Charities with income over £25,000 confirm in their annual return that no reportable incidents went unreported. If an incident later surfaces that was never reported, the Commission may consider that mismanagement.
A trustee cannot report what they have not been told. That is the point at which the speak-up route stops being an HR nicety and becomes a governance control.
The concerns are already being raised, just not with you
The Commission's own figures for 2025 to 2026 show 594 whistleblowing disclosures made directly to the regulator (we looked at those figures in detail here), up 9 per cent on the previous year and the highest number in a decade. Financial harms were the primary issue in 24 per cent of those disclosures, up from 18 per cent the year before. Sixty-one per cent came from current or former employees, and 39 per cent from volunteers or other non-employees.
Every one of those 594 people had a concern and chose to take it to the regulator. Some will have tried the charity first and got nowhere. Others will have had nowhere to try. Either way, the board heard it from the Commission rather than from its own people.
There is one further detail worth noting. The Commission's guidance for charity employees explains that legal whistleblowing protection applies to workers, not to volunteers. Yet volunteers and other non-employees made up nearly four in ten of those raising concerns with the regulator. If a charity wants volunteers to speak up internally, the route has to be open to them by design, because the law does not do it for them.
The law has moved as well
The Employment Rights Act 2025 received Royal Assent on 18 December 2025. From 6 April 2026, sexual harassment is expressly listed as a category of wrongdoing that can form the basis of a protected disclosure under the Employment Rights Act 1996, so a worker no longer has to fit such a report into a health and safety or legal-breach category to be protected. For charities, which combine paid staff, volunteers and often vulnerable beneficiaries, this widens what a speak-up route needs to be ready to receive. Fraud, safeguarding and harassment arrive through the same door.
Four questions for the board this Trustees' Week
So, as a trustee, what should you ask? First, does a confidential route exist at all, and is it something more than an email address to the chief executive? Second, is it open to volunteers and beneficiaries as well as staff, given that the law only protects one of those groups? Third, who receives a report, and what happens if the report is about that person? Fourth, and this is the one that separates a policy from a control, when did the board last see how many concerns were raised, how quickly each was acknowledged, and what happened to them?
If the honest answer to the fourth question is "we have never seen that", the charity has a document, not a control.
Where we fit
SpeakOutSafe is a safeguarding and whistleblowing reporting platform built for organisations that need a confidential, independent route for staff, volunteers and the people they serve. Reports can be routed group-wide, so a federated charity or a trust with several sites has one consistent channel rather than a patchwork of inboxes. A typical roll-out takes one to two weeks, which means a board that asks the four questions above this Trustees' Week can have a working answer before Fraud Week is over.
If you would like to talk it through, write to hello@speakoutsafe.uk or visit speakoutsafe.uk.
Sources