Risk, Safeguarding, Data Protection & Ethics Framework
The control environment for operating across ten counties, collecting school evidence, interacting with learners and handling public money and external partners - aligned to Kenyan law including the Data Protection Act, the Children Act and NACOSTI research licensing. One Big Change Kenya, September-December 2026.
This Appendix sets out the proposed framework for identifying, preventing, managing, escalating and reporting:
- programme risk
- safeguarding risk
- child-protection concerns
- data-protection risk
- research and evidence ethics
- financial and procurement risk
- political and reputational risk
- fieldwork and travel risk
- technology and cyber risk
- partner and conflict-of-interest risk
The objective is to ensure that the One Big Change Kenya Founding Implementation Programme can operate across ten schools and ten counties without exposing learners, educators, schools, Government, partners or programme personnel to unmanaged risk.
Risk management is a core programme function. It is not an administrative exercise carried out after delivery decisions have already been made.
The programme will operate according to the principle:
No programme outcome, evidence target, partnership, deadline or financial objective takes precedence over the safety, dignity, rights and lawful treatment of the people participating in the programme.
Where programme delivery and safeguarding conflict:
safeguarding prevails.
Where evidence collection and privacy conflict:
lawful and proportionate data use prevails.
Where speed and proper financial control conflict:
financial control prevails.
The programme will operate within applicable Kenyan law and regulation. Relevant frameworks include:
- the Constitution of Kenya
- the Children Act
- the Data Protection Act
- applicable Data Protection Regulations
- applicable education legislation and regulations
- public procurement and public-finance requirements where applicable
- employment law
- health and safety requirements
- research licensing and ethics requirements where programme activity constitutes research
The Children Act places the best interests of the child at the centre of actions concerning children and protects children from abuse, exploitation and harmful treatment.
Source: Children Act - Kenya Law.
Kenya's Data Protection Act regulates the processing of personal data and establishes obligations for data controllers and processors.
Source: Data Protection Act - Kenya Law.
The Office of the Data Protection Commissioner also publishes specific guidance concerning:
- education-sector processing
- children's data
- research
- consent
- Data Protection Impact Assessments
- data sharing
Source: Office of the Data Protection Commissioner (ODPC) Guidelines.
The programme's Kenyan legal and data-protection advisers will confirm the precise obligations that apply before implementation begins.
The programme will maintain a live Risk Register covering:
Every material risk must have:
- description
- category
- cause
- consequence
- likelihood
- impact
- overall rating
- mitigation
- owner
- review date
- escalation threshold
Risks will be assessed using likelihood and impact.
Likelihood
Rare
Unlikely to occur.
Unlikely
Could occur but is not expected.
Possible
Realistic possibility.
Likely
Expected to occur without mitigation.
Almost Certain
Highly likely or already occurring.
Impact
Minor
Limited effect on programme delivery.
Moderate
Manageable disruption.
Significant
Meaningful effect on milestone, school or budget.
Major
Threatens major programme objectives, reputation or safety.
Critical
Threatens safety, legality, financial integrity or programme continuation.
Risk responses may include:
Avoid
Do not undertake the activity.
Reduce
Introduce controls.
Transfer
Use insurance, contract or specialist provider.
Accept
Retain the risk where proportionate and authorised.
Escalate
Refer the decision to a higher authority.
Critical safeguarding, fraud, corruption, serious data-breach and major legal risks may not simply be accepted at operational level.
The following represents the initial risk profile.
| Risk | Potential Impact | Initial Rating | Principal Mitigation |
|---|---|---|---|
| Delay in Government contracting | September mobilisation delayed | High | Pre-mobilisation planning, realistic start trigger, revised critical path |
| Senior Kenya roles not appointed | Weak execution capacity | High | Executive search before field deployment, interim accountability |
| Ten-county logistics become unmanageable | Missed school visits | High | Route planning, local associates, travel contingency |
| School withdrawal | Cohort incomplete | Medium/High | Readiness screening, reserve school list |
| Poor school engagement | Weak evidence | High | Senior sponsor, champion, participation agreement |
| Change Lens creates excessive burden | School resistance | Medium | Proportionate methodology and reuse of existing evidence |
| Programme interpreted as inspection | Reduced honesty | High | Clear communications and confidentiality |
| Safeguarding incident | Harm to child or adult, legal/reputational impact | Critical | Safeguarding policy, trained lead, escalation pathway |
| Inappropriate collection of learner data | Privacy/legal harm | Critical | Data minimisation, DPIA where required, access controls |
| Cyber/data breach | Confidential information exposed | Critical | Security controls, incident plan, restricted access |
| Evidence overstated | Decision Gate compromised | High | Evidence QA, independent challenge, limitations reporting |
| Political capture | Programme credibility damaged | High | Political neutrality, transparent selection |
| Procurement conflict | Financial/legal risk | High | Conflict register, segregation of duties |
| Fraud or misuse of activation funds | Financial loss | High | Controlled release, evidence, procurement controls |
| Traction Partner influence over findings | Evidence independence compromised | High | Written partner boundaries |
| International expertise displaces Kenyan capability | Dependency | Medium | Kenyan-first expertise and knowledge transfer |
| Programme costs exceed estimate | Financial pressure | Medium/High | Monthly forecasting and contingency controls |
| Staff turnover | Delivery disruption | Medium | Documentation, deputies, succession arrangements |
| Research activity begins without appropriate approval | Legal/ethical risk | High | Research-status review before evidence activity |
| Media disclosure of sensitive school information | Reputational/safeguarding harm | High | Communications approval and consent protocols |
| 90-day period insufficient to prove outcomes | Overclaiming | High | Early-outcome focus and explicit limitations |
The register will be updated throughout implementation.
The programme will adopt a safeguarding approach based on:
Prevention
↓
Identification
↓
Reporting
↓
Response
↓
Learning
Safeguarding applies to:
- learners
- staff
- volunteers
- contractors
- guests
- programme personnel
- other vulnerable participants
A child is not programme content. A learner's:
- story
- photograph
- video
- assessment information
- personal circumstances
- disability
- wellbeing information
- safeguarding experience
must never be used merely because it makes programme communications more compelling. The best interests and welfare of the child will take priority.
This aligns with the Children Act's requirement that the best interests of the child be a primary consideration in actions concerning children. Source: Children Act - Kenya Law.
Before field implementation, the programme will appoint or contract a Safeguarding, Data & Ethics Lead. The role will have authority to:
- stop an unsafe activity
- restrict staff access
- escalate concerns
- require safeguarding action
- require consent clarification
- refer a matter to appropriate authorities where required
- escalate directly to senior programme leadership
The Safeguarding Lead must not be subordinate to an individual whose programme targets could create a conflict with safeguarding decisions.
The programme will maintain a written safeguarding policy covering:
- child protection
- adult safeguarding
- conduct
- reporting
- allegations against programme personnel
- online interaction
- photography/video
- one-to-one contact
- transport
- fieldwork
- school access
- digital communications
- whistleblowing
- retaliation protection
- escalation
All programme personnel interacting with schools will follow a Code of Conduct. It will prohibit conduct including:
- sexual or exploitative relationships with learners
- harassment
- discrimination
- humiliation
- inappropriate physical contact
- inappropriate private messaging
- unauthorised photography
- gifts intended to influence participation
- requesting unnecessary personal information
- being alone with learners in inappropriate circumstances
- use of programme access for personal commercial activity
Appropriate vetting will be completed for roles involving direct or repeated interaction with children. The precise screening mechanism will be confirmed with Kenyan legal/safeguarding advisers. Screening requirements may differ for:
- employees
- contractors
- volunteers
- experts
- photographers
- event personnel
No individual should be placed in a child-facing role solely because they are known personally to a programme leader.
The programme does not replace school safeguarding responsibilities. Before activity begins at each school, One Big Change should establish:
- named school safeguarding contact
- reporting route
- emergency contact
- relevant visitor rules
- photography/recording rules
- learner-contact rules
- incident procedure
Programme staff should know whether a concern must be reported through:
- the school's safeguarding process
- One Big Change
- statutory authority
- more than one route
A safeguarding concern may include:
- suspected abuse
- disclosure of abuse
- neglect
- exploitation
- harassment
- inappropriate adult behaviour
- peer abuse
- self-harm concern
- online harm
- unsafe programme activity
Programme personnel should report concerns rather than investigate them personally unless their formal role authorises investigation.
The immediate sequence should be:
Protect immediate safety
↓
Listen without unnecessary questioning
↓
Record factual information
↓
Report promptly
↓
Escalate through the safeguarding pathway
↓
Refer externally where legally or professionally required
↓
Protect confidentiality
↓
Review programme implications
Participants must not be promised absolute confidentiality where a safeguarding concern may require escalation. Where appropriate, programme information should explain:
Information will be treated confidentially, but concerns regarding safety or serious harm may need to be shared with the appropriate safeguarding or statutory authority.
Learner voice may add value to the programme. However, learner involvement must be:
- relevant
- age appropriate
- voluntary where applicable
- ethically designed
- safeguarded
- proportionate
A learner should not be disadvantaged because they do not participate in programme evidence or communications.
Photographs, recordings and learner stories require controlled processes. Before use, the programme should establish:
- lawful basis
- applicable consent/authorisation
- intended use
- platforms on which content may appear
- retention
- withdrawal process where applicable
- safeguarding considerations
Consent to participate in a school activity is not automatically consent to appear in public media.
The programme will seek to collect the minimum personal data necessary to fulfil the defined implementation and evidence purpose.
The Kenyan Data Protection Regulations require processing to be designed around lawful purpose, transparency and appropriate safeguards, including specific protections for children and vulnerable groups. Source: The Data Protection (General) Regulations, 2021 - Kenya Law.
Before processing begins, the programme will determine and document:
- which organisation is the data controller for each activity
- whether another organisation acts as joint controller
- which suppliers are data processors
- which organisations receive shared data
- contractual responsibilities
- lawful basis for processing
- retention arrangements
The programme will also confirm whether registration obligations with the Office of the Data Protection Commissioner apply to relevant entities.
A programme Data Inventory will identify:
- dataset
- purpose
- data subjects
- personal-data categories
- sensitivity
- lawful basis
- source
- access
- sharing
- storage location
- retention period
- deletion/anonymisation approach
Potential information may include:
School-Level Information
- school context
- staffing
- facilities
- implementation information
Staff Information
- name
- role
- contact details
- questionnaire responses
- professional-development information
Learner Information
- Only where genuinely necessary.
Parent Information
- Only where relevant to the selected intervention.
Programme Personnel Information
- contracts
- payment
- HR
- contact details
Particular care should be applied to data relating to:
- children
- health
- disability
- wellbeing
- safeguarding
- ethnicity
- religion
- biometric information
- financial circumstances
- other sensitive personal information
The programme should avoid collecting sensitive data merely because it might later be interesting.
Before adding any field to the Change Lens or evidence system, the programme should ask:
If there is no credible use, the field should not be collected.
The programme will conduct a Data Protection Impact Assessment where required by law or where processing presents high risk.
Kenya's Data Protection Regulations identify processing involving children's data, vulnerable groups, large-scale personal-data processing, sensitive data, linked datasets and certain innovative technologies among activities that may require a DPIA. Source: The Data Protection (General) Regulations, 2021 - Kenya Law.
The founding programme should therefore complete an initial programme-level DPIA before large-scale evidence collection involving learners begins. Additional DPIAs may be required for particular tools or processing activities.
Data protection must be built into the programme before collection starts. This includes:
- minimum-access design
- secure defaults
- clear privacy notices
- collection limitation
- role-based permissions
- secure sharing
- retention controls
- logging
- deletion/anonymisation
Kenya's Data Protection Regulations expressly require data protection by design or default. Source: The Data Protection (General) Regulations - Kenya Law.
The programme must obtain specialist Kenyan data-protection advice regarding the hosting architecture for any personal data used in basic education.
Current Kenyan Data Protection Regulations include basic education within specified processing of strategic interest and contain requirements concerning processing through Kenyan servers/data centres or maintaining a serving copy in Kenya. Source: The Data Protection (General) Regulations, 2021 - Kenya Law.
Therefore, the technology architecture must be legally reviewed before learner-level personal data is placed into cloud systems.
Before using a cloud provider, the programme should assess:
- location of data
- sub-processors
- encryption
- authentication
- access controls
- backup
- breach notification
- deletion
- cross-border transfer
- contractual protection
Convenience will not determine the choice of system.
Data will follow least-access principles. A person should only have access where required for their role. Possible access levels include:
School
Own school information.
Field Team
Assigned school records.
Evidence Team
Required programme evidence.
Executive Team
Aggregated programme information and controlled underlying access.
Government
Contractually agreed reports/data.
Traction Partners
Only information required for the agreed resource relationship.
Traction Partners should not receive unrestricted Change Lens data.
Personal data will not be shared informally because two organisations happen to be programme partners. Where sharing is required:
- purpose must be defined
- lawful basis confirmed
- minimum data identified
- security confirmed
- responsibilities documented
- applicable agreement completed
Kenya's Data Protection Regulations include requirements concerning data-sharing arrangements and data-controller/data-processor contracts. Source: The Data Protection (General) Regulations, 2021 - Kenya Law.
Consent will only be used where it is the appropriate lawful basis. Where processing relies on consent, the programme will ensure it is:
- informed
- specific
- understandable
- appropriately documented
- capable of withdrawal in accordance with applicable requirements
Kenyan regulations require information concerning purpose, data collected, sharing, withdrawal and relevant risks when consent is the basis for processing. Source: The Data Protection (General) Regulations, 2021 - Kenya Law.
Consent will not be treated as a universal solution for every programme activity.
Where children's personal data is processed, enhanced safeguards will apply. The programme will:
- establish a clear necessity
- minimise collection
- use child-appropriate explanations where relevant
- confirm appropriate parent/guardian processes where required
- restrict access
- consider DPIA requirements
- avoid direct marketing or inappropriate profiling
Current Kenyan regulations specifically address the exercise of data rights involving children and require attention to the risks and safeguards associated with children's data. Source: The Data Protection (General) Regulations, 2021 - Kenya Law.
Where individual identification is unnecessary, programme reporting should use aggregated information, anonymised data, and pseudonymised data where appropriate.
The Ministry does not need the identity of an individual learner to understand that a particular implementation barrier exists.
The programme will establish a Data Retention Schedule. For each dataset it will specify:
- purpose
- retention period
- review point
- deletion
- anonymisation
- archive requirement
Kenyan Data Protection Regulations require retention to be linked to the lawful purpose and provide for retention schedules and deletion, anonymisation or pseudonymisation when the purpose has ended. Source: The Data Protection (General) Regulations, 2021 - Kenya Law.
Processes will be established for applicable requests relating to:
- access
- correction
- objection/restriction
- erasure
- portability
- other rights provided under applicable law
Requests involving children will follow the applicable safeguards.
Minimum security controls should include:
- multifactor authentication where available
- strong authentication
- role-based access
- encryption in transit
- appropriate encryption at rest
- secure device management
- patching
- backups
- audit logs
- secure password practices
- controlled file sharing
Personal data should not routinely be stored in personal WhatsApp accounts, uncontrolled spreadsheets or personal email accounts.
Field teams should receive clear rules concerning:
- devices
- paper records
- photographs
- recordings
- file transfer
- lost devices
- public Wi-Fi
- deletion after secure upload
Paper records containing sensitive information must not be left in vehicles, hotels or public spaces.
The programme will maintain a Data Breach Response Procedure covering:
identify
↓
contain
↓
preserve evidence
↓
assess affected information
↓
assess harm
↓
escalate
↓
notify required authorities/data subjects where applicable
↓
remediate
↓
document
↓
learn
Applicable statutory notification requirements will be confirmed by the Data Lead and Kenyan counsel.
Cyber incidents may include:
- compromised credentials
- malware
- phishing
- unauthorised access
- data exfiltration
- ransomware
- device theft
Critical incidents will be escalated immediately.
Not every evidence activity is automatically academic research. The programme will distinguish between:
Routine Programme Monitoring
Information necessary to manage and evaluate delivery.
Evaluation
Structured analysis of programme effectiveness.
Research
Activity intended to generate generalisable or publishable knowledge and falling within applicable research requirements.
The programme will obtain specialist advice rather than self-declare an activity exempt where the distinction is uncertain.
If One Big Change, a university or another partner undertakes activity that constitutes research in Kenya, the appropriate research licensing route must be confirmed before that research commences.
NACOSTI currently states that persons intending to undertake research in Kenya must apply for a Research Licence. Source: NACOSTI FAQs.
Research activity will not commence on the assumption that the Government programme contract itself replaces research licensing.
Where research involves human participants or otherwise requires ethical review, the programme will seek the appropriate review through a NACOSTI-accredited Institutional Ethics Review Committee or other applicable route before research begins.
NACOSTI provides information on accredited ethical-review arrangements and research licensing. Source: Kenya - National Science and Ethical Committee (NSEC).
No university's participation will be treated as automatic ethical approval.
Where formal research consent is required, participants should understand:
- who is conducting the research
- purpose
- participation
- data use
- risks
- benefits
- confidentiality
- withdrawal
- publication
School permission alone may not substitute for individual consent where individual consent is legally or ethically required.
The programme will prohibit:
- fabricated evidence
- selective deletion of negative findings
- retrospective manipulation of baselines
- changing indicators after seeing results without disclosure
- presenting estimates as observed outcomes
- presenting partner intentions as commitments
- counting the same beneficiary repeatedly without disclosure
Research papers, reports, case studies and communications must distinguish:
- confirmed result
- preliminary result
- inference
- limitation
- future hypothesis
Publication should not disclose confidential school information merely because the programme owns the underlying report.
Where AI tools are used to support:
- analysis
- transcription
- summarisation
- categorisation
- matching
- reporting
the programme will establish controls concerning:
- personal-data exposure
- accuracy
- bias
- human review
- vendor terms
- data retention
- security
AI-generated analysis will not constitute final professional judgement without human review.
Automated decisions with significant effects require particular care under Kenya's data-protection framework. Source: The Data Protection (General) Regulations, 2021 - Kenya Law.
AI will not be used to generate consequential individual judgements about learners without an appropriate lawful, ethical and professionally validated basis.
One Big Change's purpose is implementation support. It is not building an automated learner-ranking system.
Financial risk includes:
- unauthorised expenditure
- duplicate payment
- supplier fraud
- false invoicing
- unsupported expenses
- activation-fund misuse
- undisclosed conflicts
- contingency misuse
Controls are detailed further in Appendix 9.
The School Implementation Activation Fund is particularly sensitive. Controls must include:
- evidence of need
- approved implementation plan
- budget
- authorised expenditure
- procurement evidence
- confirmation of receipt
- asset identification where relevant
- implementation evidence
- variance review
No participating school or individual is automatically entitled to KSh 1.5 million in cash.
One Big Change will adopt zero tolerance for:
- bribery
- kickbacks
- facilitation payments
- procurement manipulation
- false expenses
- supplier collusion
- payments for political access
- inducements linked to Government decisions
Programme staff and partners must be able to report concerns through an appropriate whistleblowing mechanism.
A Gifts and Hospitality Register should be maintained. Programme personnel should not accept or provide gifts that could reasonably be interpreted as seeking to influence:
- procurement
- school selection
- partner appointment
- Government decision
- LocaeAwards selection
- employment
Relevant personnel will declare interests including:
- companies
- suppliers
- schools
- relatives
- investments
- consultancy relationships
- public office/political interests
A declared conflict does not automatically imply misconduct. An undisclosed material conflict is a governance concern.
Supplier selection should be based on:
- need
- specification
- competence
- value
- due diligence
- appropriate competition where required
- documented approval
The fact that a supplier is known to a programme director is not sufficient justification for appointment.
Traction Partners may provide substantial value. Potential risks include:
- commercial influence
- brand capture
- inappropriate access to schools
- sales pressure
- data access
- inappropriate learner marketing
- resource dependency
- inflated valuation of in-kind support
Every significant partnership should therefore define:
- contribution
- restrictions
- data access
- branding
- safeguarding
- reporting
- conflict provisions
- exit
The founding programme may operate during a politically sensitive period. Risks include:
- perceived party alignment
- programme launches becoming political events
- county selection being interpreted politically
- educational evidence being used selectively
- pressure to accelerate unsupported claims
The programme will maintain political neutrality.
One Big Change may communicate educational outcomes. It should not:
- endorse candidates
- provide campaign resources
- condition school support on political affiliation
- target programme expenditure for electoral advantage
- alter evidence for campaign messaging
The programme should be able to continue under any lawful future administration.
Reputational risks may arise from:
- inaccurate claims
- safeguarding failure
- financial misuse
- weak delivery
- inappropriate partner
- premature announcement
- misrepresentation of university relationships
- political perception
Programme communications require evidence discipline.
Organisations will be described accurately. The programme will distinguish:
- confirmed contracted partner
- memorandum/discussion
- exploratory relationship
- potential partner
No organisation should appear under "Partners" solely because a conversation took place.
Participation should not expose a school to public humiliation. The programme should not publish headlines such as:
"School X fails CBA readiness."
Instead, public learning should normally use aggregated evidence, anonymised examples, consented case studies, and strengths and learning.
Fieldwork across ten counties creates risks including:
- road accidents
- fatigue
- weather
- security
- delayed transport
- unsafe accommodation
- lost equipment
- staff isolation
A fieldwork protocol should address:
- journey planning
- approved transport
- emergency contacts
- check-in
- accommodation
- insurance
- lone working
- incident reporting
Field travel should require:
- approved purpose
- itinerary
- traveller details
- school contact
- emergency information
- cost authorisation
High-risk travel may require additional assessment.
Programme people risks include:
- slow recruitment
- poor performance
- burnout
- inappropriate conduct
- unclear accountability
- excessive dependency on volunteers
- conflict within leadership
Mitigation includes:
- clear roles
- performance expectations
- onboarding
- supervision
- succession
- wellbeing
- disciplinary procedures
Volunteers add capacity but cannot substitute for professional accountability. Volunteers should not independently undertake:
- safeguarding decisions
- financial approvals
- legal decisions
- sensitive interviews
- high-risk data processing
- clinical or specialist interventions
unless appropriately qualified and formally authorised.
A poorly designed programme could consume school time without improving implementation. The programme will monitor:
- meeting volume
- reporting burden
- data requests
- teacher time
- event attendance
Where burden exceeds value, the programme should simplify.
Even well-intended interventions can create unintended effects. Examples include:
- increased teacher workload
- inequitable access
- technology without support
- equipment without maintenance
- public labelling
- diversion from existing priorities
Each school implementation plan should consider unintended consequences.
Before deploying equipment or technology, the programme should consider:
- ownership
- maintenance
- licence renewal
- connectivity
- electricity
- staff competence
- replacement
- ongoing cost
A resource that cannot be maintained may create dependency rather than capability.
Before national scale, technology must be tested for:
- reliability
- usability
- offline/low-connectivity environments
- security
- scalability
- support
- cost
- interoperability
- vendor dependency
Technology should not become a condition of participation where infrastructure makes its use unrealistic.
The greatest evidence risks include:
- confirmation bias
- positive-story bias
- incomplete baseline
- weak comparator
- short implementation window
- attribution error
- selective reporting
Appendix 5 establishes controls to mitigate these risks.
A successful ten-school programme does not automatically prove that a 6,000-school network will succeed. Scale creates different risks:
- diluted quality
- workforce shortage
- weak Hub leadership
- inconsistent evidence
- excessive centralisation
- fragmented governance
- technology load
- financial control
These will form part of the December scale-readiness assessment.
Before a school takes on a future Hub role, the programme must assess:
- leadership capability
- safeguarding readiness
- data practices
- capacity
- governance
- peer-support boundaries
Hub status does not permit one school to access unnecessary confidential data from another school.
Awards create incentives. Poorly designed incentives can produce:
- gaming
- exaggerated evidence
- popularity voting
- resource inequality
- political influence
- sponsor influence
LocaeAwards criteria should therefore reward:
- evidenced improvement
- implementation quality
- learning
- inclusion
- sustainability
- sharing practice
LocaeFest may involve learners, public figures, media, sponsors and schools. It will require separate planning covering:
- safeguarding
- photography
- crowd management
- travel
- insurance
- data
- sponsorship
- political neutrality
The programme should establish a confidential mechanism through which:
- staff
- volunteers
- schools
- suppliers
- partners
can raise concerns regarding:
- safeguarding
- fraud
- corruption
- harassment
- unethical conduct
- retaliation
Reports should be assessed by an appropriate independent or senior function.
No participant should suffer retaliation because they raise a genuine concern in good faith.
Malicious complaints may be addressed separately, but fear of retaliation must not suppress legitimate reporting.
A programme complaints process should cover:
- schools
- staff
- parents
- partners
- suppliers
- other affected stakeholders
The process should specify:
- route
- acknowledgement
- review
- escalation
- response
- record
Statutory complaints rights remain unaffected.
Incidents may be classified:
Level 1 - Minor
Local issue, no serious harm.
Level 2 - Significant
Requires programme-level management.
Level 3 - Major
Potential legal, financial, safeguarding or reputational impact.
Level 4 - Critical
Immediate serious risk or harm requiring senior/external escalation.
For critical incidents:
protect safety
↓
activate responsible lead
↓
preserve evidence
↓
notify relevant executive
↓
seek legal/specialist advice
↓
notify authorities where required
↓
communicate carefully
↓
document actions
↓
conduct post-incident review
Potential disruption scenarios include:
- political unrest
- transport disruption
- health emergency
- school closure
- cyber incident
- senior staff absence
- partner withdrawal
The programme should define:
- alternative delivery
- remote capability
- replacement personnel
- backup records
- communication routes
- revised milestones
The programme should define who can pause:
- a school activity
- a data collection activity
- a supplier
- an event
- a partner activation
- the whole programme
A Safeguarding Lead must be able to pause unsafe activity without waiting for a commercial decision.
The Ministry programme report should include:
- top ten risks
- new risks
- closed risks
- significant incidents
- mitigation progress
- safeguarding status
- data-protection status
- financial-control status
Sensitive information may require restricted reporting.
The December Decision Gate should receive a consolidated risk assessment covering:
- founding risks realised
- effectiveness of controls
- unresolved risks
- Year 1 risks
- Hub-specific risks
- data/cyber readiness
- safeguarding readiness
- financial-control readiness
National expansion should not proceed unless there is sufficient evidence that:
- safeguarding architecture can scale
- data infrastructure is lawful and secure
- programme governance can handle scale
- financial controls can handle Hub-level activity
- field workforce can be supervised
- evidence quality can be maintained
- political neutrality can be protected
- complaints and whistleblowing can operate nationally
Before school-facing implementation begins, the Kenya Managing Director should confirm completion of:
Field implementation should not begin merely because the launch date has arrived.
Overall executive accountability
Kenya Managing Director / CEO
Operational risk coordination
Chief of Staff & Operations
Safeguarding, data and ethics
Safeguarding, Data & Ethics Lead
Educational implementation
Education & Implementation Director
Evidence integrity
Evidence, Research & Learning Lead
Finance
Designated Finance Function
Corporate governance
One Big Change Board / Governance Structure
Government retains responsibility for its own statutory and contractual oversight.
One Big Change Kenya will not pursue scale at the expense of safety, evidence integrity, lawful data use, financial accountability or school trust.
The founding phase is intended not only to prove that the implementation model can work. It must also prove that the model can be governed responsibly.