Your charity's IT is outsourced. Here's what the finance lead should still be asking

In a lot of charities with separate departments, the finance director or finance lead is the main contact for the outsourced IT provider. It makes sense: finance signs the contract and pays the invoices. It also puts you exactly where most cyber criminals are aiming, because what they usually want is money.

This article is for you if you didn't come from an IT background but find yourself holding the IT relationship. It covers what stays your responsibility, the payment controls only finance can put in place, and the questions that tell you whether your IT provider has the basics covered.

Outsourcing IT doesn't outsource responsibility

The Charity Commission is clear that trustees can delegate cyber security to someone else, such as an IT team, but all trustees remain responsible for making sure the charity is protected. In practice, the finance lead is often the person trustees look to for that assurance.

The latest government survey suggests many charities haven't closed this gap:

• Only 30% of charities formally assign board-level responsibility for cyber security.
• Only 35% have any form of cyber insurance.
• Cyber security was a high priority for senior management in 60% of charities, down on previous years.

The attack aimed at finance: payment diversion fraud

Payment diversion fraud, also called business email compromise or mandate fraud, is when a criminal impersonates someone you trust to redirect a payment. It typically looks like one of these:

• A supplier emails to say their bank details have changed, just before a large invoice is due.
• Your chief executive or chair emails asking for an urgent, confidential payment.
• A real supplier's email account has been hacked, so the request comes from their genuine address and quotes a genuine invoice.

The NCSC's report on threats to the charity sector described a business email compromise that cost a West Midlands hospice £17,000. Technology helps, but the strongest defences here are finance processes, and those are yours to set:

1. Verify every change of bank details by phone, using a number you already hold, never one from the email or invoice.
2. Require two people to add a new payee, change bank details, or approve payments above a set amount.
3. Act on Confirmation of Payee warnings. If your bank says the account name doesn't match, stop and check.
4. Treat urgency and secrecy as red flags. "Don't tell anyone" and "it must go today" are the fraudster's tools.
5. Make sure MFA is on for every finance, banking and email account, so a stolen password alone isn't enough.

Eight questions to ask your IT provider

In November 2025 the NCSC published guidance on choosing a managed service provider, with a due diligence checklist. These eight questions are based on it. A good provider will be glad you asked, and the answers belong in your contract.

1. Do you hold Cyber Essentials Plus? The NCSC recommends using providers with recognised certifications such as Cyber Essentials Plus. You can check any organisation on the IASME certificate search.
2. Is MFA switched on for all our users and every cloud service we use, and for your own accounts that access our systems? Your provider's admin access is a route into your charity, so it needs protecting too.
3. How quickly do you install security updates? Cyber Essentials allows a maximum of 14 days for critical and high-risk fixes. We'd like to see providers working well inside that.
4. What's backed up, how often, where is it kept, and when did you last test a restore? Backups you can't restore aren't backups.
5. Who in your team can access our systems with admin rights, and how is that access controlled? Ask for least privilege: only the access each person needs.
6. If you have a security incident, or we do, how and how quickly will you tell us? The NCSC suggests the notification process is written into the contract.
7. What regular reports will we get? For example, updates applied, backup success, and security alerts. Insurers may ask for these after a claim.
8. Which of our systems are near end of life, and who is tracking it? Unsupported software stops getting security fixes and fails Cyber Essentials.

Ask too for a simple responsibilities matrix: what the provider does, and what remains with the charity. Gaps usually sit in the space between the two.

If money goes missing

1. Call your bank straight away, using the number on its official website or your card. Speed gives the best chance of recovery.
2. Tell your IT provider, because an email account may have been compromised.
3. Report it to Report Fraud (England, Wales and Northern Ireland) on 0300 123 2040 and get a crime reference number. In Scotland, call Police Scotland on 101.
4. Consider whether it's a serious incident for your regulator. The Charity Commission covers how to report a serious incident in England and Wales; OSCR and the Charity Commission for Northern Ireland have their own reporting.
5. Check whether personal data was involved. If so, you may need to tell the ICO within 72 hours of becoming aware.
6. Contact your insurer early. Many policies, including the Cyber Essentials insurance, include an incident helpline.

Where Cyber Essentials helps the finance lead

Cyber Essentials gives trustees and funders independent evidence that the basics are in place, rather than your IT provider marking its own homework. It also gives your provider a clear, government-backed standard to work to.

The final declaration is signed by a senior person at the charity, not by the IT provider, which is a useful moment for the board to see where things stand. Charities with turnover under £20 million that certify the whole organisation can opt in to £25,000 of cyber liability insurance, arranged by IASME, with a 24-hour incident helpline.

We're a certification body, so we stay independent: we don't sell IT support or products. We identify where your setup doesn't meet the requirements and explain what a compliant setup needs to do; your IT provider makes the changes. Registered charities turning over less than £2 million can apply for our Charity Special Offer. Larger charities can request a quote for our Supported Service.

Sources

• Protect your charity from cyber crime, Charity Commission (trustee responsibilities; Report Fraud)
• Cyber security breaches survey 2025/2026, DSIT, 30 April 2026
• Choosing a managed service provider (MSP), NCSC, 24 November 2025
• Charities offered latest insight into key cyber threats, NCSC (hospice case study)
• Business payment fraud, NCSC
• Report Fraud service goes live, City of London Police, 4 December 2025
• How to report a serious incident in your charity, Charity Commission
• Cyber Liability Insurance, IASME