The 2020 Financial Handbook reiterated the importance of risk management within academies and mandated that a full risk register should be maintained. But how, when academies have been living through one of the most challenging and unprecedented periods in our lifetime when regulations change daily if not hourly, can formalised risk management remain a meaningful use of scarce time and resources?
With the new academic year starting in a matter of weeks, now is the time for governing bodies and audit committees to regroup, reassess, and refocus risk management. Risk registers shouldn’t be dusty documents wheeled out for an annual update: they need to be punchy, relevant working documents that are consulted and challenged at every Governors’ meeting.
So, what should academies be doing right now?
- Set a date for your first audit committee meeting of the year. Reserve time on the agenda for reviewing risks: all risks, not just financial. Increase the proportion of time spent discussing future and emerging risks.
- Review the composition of your governing body and audit committee to ensure you have the diversity of skills you need to manage risks effectively. Consider co-opting extra members if necessary.
- Reassign day to day responsibility for risk management to operational staff, preferably the Principal or their deputy, with a clear link to operational lines of responsibility. Ensure risk management activities are documented and evidenced through the use of policies, procedures, guides, handbooks, checklists etc. Monitoring the risk register shouldn’t be the responsibility of the finance team.
- Review key suppliers and business partners and implement contingency arrangements in case of future financial failure e.g. catering, school transport, cleaning. It’ll be some time yet before we understand the true impact of Covid on the economy.
- Talk to your internal auditors about areas of risk where you need more assurance that they’re being well managed. Any reputable internal audit provider will be able to undertake specific reviews at relatively short notice, or help the academy pull together existing sources of assurance to form an overall view.
- Don’t lose sight of fraud risk factors: the last five months have seen an amazing collective response from our local communities, but we’ve all had to do things differently, and that brings with it the risk that checks and balances haven’t quite operated as effectively as they could have. From local businesses struggling to remain financially viable to individuals suffering from a loss of income, there is scope for academies to be subjected to all manner of attempted frauds and misappropriations, and adherence to policies and procedures needs to be robust, even during times of lockdown and home working, if these attempts are to be prevented.
Use your internal auditors as a critical friend and keep your internal audit programme dynamic and under continual review. Don’t waste valuable time and money auditing routine areas of little risk: focus on quality rather than quantity in the areas of greatest risk that need most assurance.
If you’d like to discuss your approach to risk management, or invite us in to review your risk register, we’d be delighted to hear from you.
