Internal Audit 2022-23 - a year in review

The evolution of risk management continues at pace. The role that the Audit and Risk Committee needs to play in ensuring that both existing and emerging risk facing the Trust are truly managed is ever more important.

Making isolated, termly updates to the Committee is no longer sufficient thanks to the increasing number of challenges facing the sector.

Macro-economic and geo-political volatility and uncertainty has introduced a whole new set of challenges and emerging risks. Cost of living pressures make future income streams and expenditure projections more difficult to predict.

Schools continue to face retention pressures with mental health and wellbeing playing a key part. Teacher wellbeing indices, school support staff bodies and headlines all indicate that workloads and stress levels are contributing to existing staff reconsidering their futures in the sector. Recruiting into the sector continues to be problematic.

Until recently, uncertainty over pay created further pressures including strike action. This has abated for now, but trusts still need strong leadership and governance to tackle uncertainty over funding and costs. Being able to continue to deliver strategic aims and charitable purpose alongside prudent spending is not a simple task.

Macro-economic volatility and people are therefore the two top risks for trusts. 

Sustainability and the sector’s journey to net zero is another for consideration but with funding needed it is not going to be easy to achieve this. Cyber and fraud risks are another big area of concern. Our reliance upon technology increases our exposure and reports of schools being hacked and held to ransom are increasingly common.

Making sure that risks are identified, reviewed frequently and addressed with appropriate mitigations, and getting assurance over those mitigations are important and perhaps as urgent as they were during the pandemic.

Questions that committees need to ask themselves are: How do we know that we have captured all the emerging risks? Have we assessed our risk appetite? Do we know if the mitigations we have in place are effective? What assurance do we have that what we think is happening, is? And what about those areas where we just aren’t sure?

Core financial compliance continues to remain a popular area of focus as evidenced by our own internal audit benchmarking data. To a large extent this is indicative of a need to get the basics right—i.e., to ensure that underlying financial information is complete and accurate and opportunities for fraud are minimised.

But more and more trusts are (rightly) expanding or redirecting their internal audit coverage to look at other areas other than purely financial. For example, elements of cyber/wider ICT risk, website compliance, governance, and indeed, overarching risk management processes.

The results from our internal audit reviews over the last year continue to indicate a progressive upward trend as trusts continue to strengthen and improve their core financial framework. However, there are several areas that continue to feature in our reports and are seen as the “usual suspects” in day-to-day operational points. These include:

• Registers of interest not being regularly updated for all senior staff. Furthermore, the Finance team not having access to/using the register when setting up new suppliers; a disconnect that could result in potential conflicts being less likely to be proactively identified.
• Retaining evidence to support the level of pay for each member of staff is correct—i.e., bridging from the initial contract through subsequent incremental or promotion increases.
• Linked to the above, the number of employment contracts not being issued and/or signed in a timely manner after the commencement of employment.
• An increasing volume of VAT not being reclaimed from HMRC due to a lack of invoices or evidence being retained, particularly when it comes to charge/credit card purchases. Therefore representing a value for money challenge when it comes to some purchases.
• Websites not being maintained with accurate and relevant information that is either statutory or not. This can impact upon reputations regarding organisational skills as well as triggering a potential Ofsted inspection or parental complaint.
• Cashflow forecasts being created but not agreeing with the trust’s actual cash balances and/or not forecasting a twelve-month period on a rolling basis. This restricts trustees’ ability to assess the trust as a going concern and viable moving forward.

A few of the above have been commonplace in previous years, so whilst in general trusts are improving their overall control frameworks, the above still indicate a need to “get the basics right consistently”.

Share This

Back to blog