The Charity Commission published its latest Charity sector risk assessment on 18 August 2026, and much of it will feel familiar to anyone running a theatre, museum, gallery, festival or community arts organisation. The regulator's message is that the risks charities face are multiplying and, increasingly, overlapping. For the many cultural organisations that are registered charities, or that run a charitable arm, several of the findings land close to home.
The clearest signal is financial. Across the sector, around two in five charities (41%) spent more than they received last year, and the Commission found the narrowest margins among the smallest organisations. Its casework tells the same story: cases relating to insolvency and financial difficulty rose by 27.7%, to 235, and the number of charities removing themselves from the register voluntarily climbed by more than a third. For cultural organisations juggling standstill grant funding, rising costs and audiences whose spending is still recovering, none of that will come as a surprise.
Financial strain has a way of surfacing elsewhere. The Commission recorded a 57% rise in disputes within charities, from 579 cases to 909, which it links partly to the hard decisions boards are having to take under financial pressure and partly to wider social tensions. Some charities, it notes, are struggling to recruit enough trustees. In a small cultural organisation, where a handful of committed volunteers are ultimately responsible, a single dispute or resignation can stall an entire programme of activity or make good governance hard to deliver.
Safeguarding and cyber risk both feature prominently. Around a quarter of all concerns raised with the Commission relate to safeguarding, a reminder that any organisation working with children, young people, participants or vulnerable audiences carries real responsibility, whether the contact happens in a workshop, a youth theatre or a community project. And cyber risk has moved firmly into the mainstream: 30% of charities reported experiencing a cyber attack, with phishing the most common and ransomware on the rise. Ticketing platforms, membership databases and donor records make cultural organisations an attractive target.
The Commission also flags a newer concern: bad actors using charities for private benefit, in some cases setting one up for exactly that purpose, and using AI to smooth fraudulent registration applications. That is less likely to touch an established arts charity directly, but it is a useful prompt to check that your own financial controls would stand up to scrutiny.
So what can smaller cultural organisations do? Two things are worth prioritising, and both are about process rather than panic.
First, give your board a genuine early view of the numbers. That means income forecasts built around your actual operating costs, monitoring reserve levels, and financial reporting detailed enough to discuss problems while you still have time to act.
The second is to keep the plumbing of good governance in good repair precisely when you are busy and stretched: clear financial controls so that no one person can move money unchecked, conflicts of interest recorded and managed, a realistic plan for recruiting and refreshing trustees, and some basic cyber hygiene, such as staff training on phishing and multi-factor authentication on the systems that hold personal data. We have written before about the free data protection training the Information Commissioner's Office (ICO) offers, and about handling workplace disputes under the Acas Code of Practice, both of which are a sensible place to start.
None of this is about bracing for disaster. It is about the ordinary, unglamorous habits that let cultural organisations keep doing the work that matters when conditions are hard. If you would like us to review your governance, financial controls or data protection arrangements, or help you put a plan in place, do get in touch.
Sources: Charity sector risk assessment 2026, Charity Commission
