Top risks facing housing associations

Tenant safety remains the most significant risk facing the sector. Housing associations are expected to demonstrate robust compliance with statutory requirements relating to fire safety, gas safety, electrical safety, asbestos management, water hygiene and lift safety.

The challenge for many organisations is no longer simply completing compliance activities, but ensuring accurate property data, effective monitoring and reliable reporting to management and boards.

Increasingly, regulators expect organisations to evidence not only compliance but also effective oversight and assurance over compliance arrangements.

Questions for Boards

• Can we demonstrate full compliance with statutory safety requirements?
• Is our compliance data accurate, complete and up to date?
• How are compliance exceptions monitored and escalated?
• Does the board receive meaningful assurance over tenant safety risks?

The financial environment remains challenging. Inflationary pressures, increased borrowing costs, investment in existing homes, building safety requirements and ambitious development programmes are placing significant strain on budgets.

Boards must strike a balance between maintaining existing homes, investing in new developments, delivering tenant services and preserving financial sustainability.

Robust treasury management, business planning and stress testing will remain critical throughout 2026/27. Key risk indicators include reduced operating margins, increased interest costs, cashflow pressures, reduced development viability and higher maintenance expenditure.

Questions for Boards

• Has the business plan been adequately stress-tested?
• Are financial forecasts regularly reviewed and challenged?
• How resilient is the organisation to adverse economic scenarios?

Repairs and maintenance services continue to attract significant tenant, regulator and board attention.

Delays in repairs, contractor performance issues and increasing maintenance costs can result in tenant dissatisfaction, reputational damage and regulatory scrutiny.

Many housing associations rely extensively on external contractors, which creates additional risks relating to procurement, contract management and service quality.

Questions for Boards

• Do we have effective oversight of contractor performance?
• Are repairs completed within target timescales?
• How do we measure service quality and tenant satisfaction?

Cyber security remains one of the fastest-growing risks across all sectors, including housing. Housing associations hold significant volumes of sensitive tenant, employee and financial information.

Cyber attacks can result in operational disruption, financial losses, data breaches and reputational damage.  As organisations become increasingly reliant on digital services and third-party suppliers, boards are expected to take greater ownership of cyber resilience.

Emerging threats include ransomware attacks, phishing campaigns, business email compromise, supplier cyber vulnerabilities and data breaches.

Questions for Boards

• Have we independently assessed our cyber maturity?
• Are staff adequately trained to recognise cyber threats?
• Do we have tested incident response and business continuity plans?

Strong governance remains fundamental to organisational success. Boards are expected to provide effective oversight, challenge management appropriately and ensure that strategic decisions are supported by robust information.

Common governance challenges include inadequate risk reporting, poor-quality management information, insufficient board assurance, outdated policies and frameworks and unclear accountability structures.

Questions for Boards

• Does our governance framework remain fit for purpose?
• Are we receiving sufficient assurance over key risks?
• Is board reporting supporting effective decision-making?

The quality of decisions is dependent upon the quality of information available. Many housing associations increasingly rely on multiple systems, spreadsheets and manual processes to manage compliance, repairs, assets and performance data.

Poor data quality can undermine decision-making and result in inaccurate reporting to boards, regulators and stakeholders.

Typical issues identified during audits; duplicate records, incomplete property data, inconsistent reporting, manual workarounds and weak data ownership.

Questions for Boards

• Can we rely on the information presented to us?
• Are key performance indicators supported by accurate data?
• Do we understand our most significant data quality risks?

Housing demand continues to drive development ambitions across the sector. However, development programmes carry significant strategic and financial risks.

Challenges include: construction cost inflation, contractor insolvency, planning delays, project overruns and funding pressures.

Weak project governance can have significant financial consequences and impact organisational objectives.

Questions for Boards

• Do we have adequate oversight of development projects?
• Are project risks being reported effectively?
• How are cost increases being managed and challenged?

Attracting and retaining skilled staff continues to present difficulties across the sector. Workforce challenges can impact service delivery, organisational resilience and succession planning.

Questions for Boards

• Have we identified key person dependencies?
• Do we have succession plans for critical roles?
• How are workforce risks monitored and reported?

As organisations face an increasingly complex risk environment, boards require confidence that key risks are being effectively managed. An effective risk management framework should:

• Identify emerging risks early
• Link risks to strategic objectives
• Clearly define risk ownership
• Support informed decision-making
• Provide robust board assurance

Internal audit has a key role to play in independently assessing whether controls are operating effectively and whether assurance arrangements remain fit for purpose.

Questions for Boards

• Does our risk register reflect today’s challenges?
• Are we focusing assurance activity on our highest risks?
• Do we have assurance gaps across critical areas?