Supplier management for charities
Conflicts of interest, connected parties, payment fraud and partners who spend your money, handled the way trustees and the Charity Commission expect.
Charities often run with small finance teams, part-time staff and volunteers, and they spend money given for a purpose. Trustees are responsible for protecting it. That makes a few supplier risks matter more than usual: conflicts of interest with trustees, payments to connected people, change-of-bank-details fraud, and partners who spend money on the charity's behalf. This page sets out what the Charity Commission expects and how SupplierVault helps.
This page is written for charities in England and Wales, regulated by the Charity Commission. Charities in Scotland and Northern Ireland have their own regulators (OSCR and the Charity Commission for Northern Ireland) with similar expectations.
What's different for charities
- Trustees carry the duty. Trustees must act in the charity's best interests, manage its resources responsibly and manage conflicts of interest. Supplier decisions are part of that.
- Connected people are common. A trustee's business, a family member's firm or a long-standing volunteer's company may well be the obvious supplier. That isn't banned, but it must be handled properly.
- Payment fraud hits hard. A single diverted payment can wipe out a small charity's reserves, and the loss usually has to be reported to the Commission as a serious incident.
- Some suppliers act in your name. Professional fundraisers, commercial partners and delivery partners carry your reputation with the public.
- Funders ask questions. Grant conditions often require competitive quotes, evidence of value for money or specific procurement rules.
What the Charity Commission expects
Internal financial controls (CC8)
The Commission's guidance Internal financial controls for charities (CC8) expects trustees to put controls in place that suit the charity's size and risks, including over purchases and payments: who can authorise spending, separating duties so one person can't both set up a supplier and pay it, and checking payment details. The Commission updated it in 2023 to cover digital and mobile payments.
Conflicts of interest (CC29)
The Commission's guidance on conflicts of interest for trustees (CC29), revised in 2026, describes five steps: identify, declare, consider removing, manage and record. Trustees should declare interests on a register and at each meeting, and minutes should record who was conflicted and what was done. A trustee, or a person connected to them, must not receive a payment or other benefit from the charity unless it is properly authorised.
Paying trustees or connected people for goods or services
Section 185 of the Charities Act 2011 lets a charity pay a trustee, or a person connected to a trustee, for goods or services in certain circumstances: for example, there must be a written agreement setting the maximum amount, the other trustees must be satisfied it's in the charity's best interests, and only a minority of trustees can benefit. Check the conditions, and your governing document, before you agree to it.
Protecting the charity from harm
The Commission's compliance toolkit includes guidance on due diligence, monitoring and verifying how partners spend charity funds, especially where money goes to partners overseas. Know who your partners are, check them in proportion to the risk, and monitor how funds are used.
Fundraising partners
If a professional fundraiser or commercial participator raises money for you, the Charities Act 1992 requires a written agreement with them, and the Fundraising Regulator's Code of Fundraising Practice sets standards they should meet. Record the agreement and check it's in place before they start.
What to check with your suppliers
| Check | Why |
|---|---|
| Connection to a trustee, staff member or their family | Conflicts must be declared and managed, and payments to connected people authorised |
| Bank details verified by call-back | Stops change-of-bank-details fraud |
| Quotes or tender evidence | Shows value for money to trustees, funders and your independent examiner or auditor |
| Data processing agreement | Suppliers handling donor or beneficiary data must meet UK GDPR Article 28 |
| Safeguarding checks | For suppliers working with children or adults at risk |
| Written fundraising agreement | Required for professional fundraisers and commercial participators |
Where to start in SupplierVault
Choose the Charities starter set-up, or tick "Charity" in Settings at any time. Then:
- Each supplier records whether it's connected to a trustee or staff member, who and how, when it was declared to the trustees and who approved it.
- Purchase requests to a connected supplier are held until the connection is recorded.
- The Related and connected parties report gives your trustees and independent examiner one list.
- Bank detail changes put the supplier's invoices on hold until a call-back and checks are recorded, and a second person releases payment.
- Custom roles let a volunteer treasurer or finance officer see and approve payments without changing anything else.
- Every plan includes unlimited users, so trustees and volunteers can have their own sign-in at no extra cost.
Every setting can be changed afterwards. SupplierVault records the evidence; your trustees and advisers decide what applies.
Useful guides and tools
- Penny test and bank detail fraud
- Supplier due diligence questionnaire
- Supplier code of conduct template
- Modern slavery statement checker
Sources
- Internal financial controls for charities (CC8) (GOV.UK)
- Conflicts of interest: a guide for charity trustees (CC29) (GOV.UK)
- Compliance toolkit chapter 2: due diligence, monitoring and verifying the end use of charitable funds (GOV.UK)
- Charities Act 2011, section 185 (legislation.gov.uk)
- Code of Fundraising Practice (Fundraising Regulator)