ASF Institutional Policy Manual · Aligned with PHIG, September 2026
Part of the ASF policy framework, aligned with the equivalent PHIG policy. To raise a concern: see the ASF Complaints and Reporting Channel.
ASF identifies its main risks, assigns an owner to each and keeps working through disruption. Owner: Board Chair, reporting to the Board.
Risk register
A register rates each risk by likelihood and impact across six areas: finance and fraud, safeguarding, security, compliance with donor rules, reputation and operations (including IT). Each risk has an owner, controls and actions. The register is updated every quarter and reviewed by the Board twice a year; each new project adds its own risks.
Business continuity
- Critical functions defined: payroll, donor reporting, payments, website and platforms, and communication with staff.
- Remote working possible for all staff; data backed up (Policy 32).
- Contact tree and deputies for each focal point, so no function depends on one person.
- Continuity plan tested once a year, and after any major disruption.