What You Will End Up With
You will have a short incident notice, with no names in it, sent to your funder on the timeline your grant agreement sets, and a record of what you sent and when. Some funders require the organizations they fund to share details of reported concerns, so check your funding contract for this duty. Keeping the notice non-identifying protects the survivor and keeps personal data secure. Define in advance what the notice will contain, so it can go out on time. One study found that grantees still fear reporting will lead to their funding being withdrawn.
Before You Start
Gather these before anything goes out.
- The agreement clauses. Check your funding contract for reporting duties on harm caused by staff, associates, operations or programs. If you have several funders, list them, note where each is located, whether each has requirements, whether those requirements match, and whether they carry a timeframe.
- Who can send it. Report authority can sit with a staff member such as the chief executive or the safeguarding lead. If there is doubt, the board should authorize it.
- Your local map. Know in advance the formal authorities for criminal incidents and the support services available to survivors in the place where the incident occurred.
Steps
- Protect the survivor and log the report. Safety and well-being come first, and support should start at once and last as long as needed. Record the report even when there is too little information to follow up, because it may reveal a pattern of harm. You do not need hard evidence for a report to be logged and answered. Move fast to record details as they are recalled, secure immediate safety and prevent further harm.
- Check each funder's clause and deadline. Each funder has its own reporting requirements, so read each clause and follow it. A funder and some statutory bodies may also require being told of sexual exploitation, abuse and harassment reports, so check legal requirements too. Note who else must be told. Some funders expect a report within 24 hours, even though little is known that early.
- Get authority to report. Confirm who signs off, following any delegated-authority protocol, and get that sign-off before the deadline in step 2 arrives.
- Draft the initial notice. One regulator's incident form asks for the following, which makes a useful model: the incident date, what happened, when and how the organization found out, the impact on beneficiaries, finances, staff, operations or reputation, which policies apply and whether they were followed, steps taken to deal with it, and steps to prevent similar incidents. If a deadline arrives before you know much, send what you have: an allegation was received, safety steps are under way, and more will follow. Names stay out, as the next section explains.
- Send it and keep the acknowledgement. A reporting system should answer every report, even with a simple acknowledgement of receipt. File the acknowledgement with your record of what you sent.
- Negotiate if the request is unrealistic. If a funder's condition would put the survivor at risk, ask how to meet it while staying survivor-centered and confidential, and ask whether unrealistic requirements can be negotiated. Funders who push for police reports can expose survivors and witnesses to further harm in some contexts.
- Update as facts change, and keep the case open. An investigation can take weeks, if not months. Keep the funder informed as new information comes in, and tell them as soon as you become aware of material changes. Meanwhile keep to your own internal timeframes for confirming receipt, sorting, documentation, initial decisions and survivor referral. An unproven incident is not a reason to close a case, since the survivor may still need support and further information may emerge.
Reporting to the funder does not replace telling the police or other agencies. If your organization works abroad, one regulator's guidance says criminal activity overseas should usually go to local law enforcement or safeguarding organizations where it happened. You must still explain what happened and how you are dealing with it to each body you answer to.
Keeping the Report Confidential
Personal information about an incident can put people at risk, so the report is where you protect them.
- Leave personal details out of the first notice. Names and other details of the people involved stay out. The receiving body will ask if it needs them. One grant-maker asks only for the contact details of the person reporting, so check what your funder wants.
- Share only non-identifying information. Anyone who is not directly supporting the survivor or handling the case gets nothing that identifies anyone.
- Keep funder requests for personal data minimal. Funders are not responsible for investigations, so push back politely when a request goes further than they need.
- Protect the records. Use systems that protect personal information about exploitation and abuse incidents that could put affected people at risk.
- Guard against retaliation. Protection should cover survivors, people who report, witnesses, advocates and the subject of the report.
Common Mistakes
Assuming every funder has the same rules. Requirements and deadlines differ. One grant-maker asks for a copy of a serious incident report within 24 hours of reporting to the regulator and gives organizations that are not registered charities 48 hours from the incident. Read each clause and track each deadline separately.
Delaying a report out of fear of losing funding. Many respondents felt funding should not be removed when the grantee takes the issue seriously and acts on it. Report, show what you are doing, and keep the record.
Sending nothing because the facts are incomplete. Some funders expect a first report within 24 hours, even though little information is usually available in the early stages of a case. Waiting for a full picture means missing the deadline. Send the short initial notice with what you know, say that more will follow, and then update the funder as the investigation moves, since it can take weeks, if not months.
Treating a report to one body as a report to all. Telling the police, a donor or another regulator does not replace telling the others. Each body still needs to hear what happened and how you are dealing with it, and the regulator should be told which other agencies you have already informed.
Handing over more personal data than anyone needs. A funder is not responsible for the investigation, so the amount of personal information it requests should be kept to a minimum. One grant-maker asks only for the reporter's contact details; in any case, let the receiving body ask if it needs more.