Earlier policy library. This page belongs to an earlier library of ASF policies. The current, approved governance set is the ASF Standards Package 2026 (GOV, OPS, QMS and EV documents). Where this page and the 2026 package differ, the 2026 package applies.
ASF Institutional Policy Manual · Aligned with PHIG, September 2026
Part of the ASF policy framework, aligned with the equivalent PHIG policy. To raise a concern: see the ASF Complaints and Reporting Channel.
ASF identifies its main risks, assigns an owner to each and keeps working through disruption. Owner: Board Chair, reporting to the Board.
Risk register
A register rates each risk by likelihood and impact across six areas: finance and fraud, safeguarding, security, compliance with donor rules, reputation and operations (including IT). Each risk has an owner, controls and actions. The register is updated every quarter and reviewed by the Board twice a year; each new project adds its own risks.
Business continuity
- Critical functions defined: payroll, donor reporting, payments, website and platforms, and communication with staff.
- Remote working possible for all staff; data backed up (Policy 32).
- Contact tree and deputies for each focal point, so no function depends on one person.
- Continuity plan tested once a year, and after any major disruption.