Internal Audit 2023-24 - a year in review

25th Nov 2024

It’s once again been another challenging year for the academy sector from a risk and control perspective. As well as dealing with the challenges which the “back to school” period brings, we had a general election and very little in the way of information on what the outcome would be for the education sector. This, coupled with the continuing financial challenges brought by a cost-of-living crisis and a crippling school estate, has meant academy trusts have had their hands even more full.

Whilst these changes bring forward new risks for trusts to consider, these need to be balanced with existing risks, as key assurance is still needed on the key standing risks for any Trust—namely, keeping children safe and providing a high-quality education for all. But are you just assuming you are achieving both? Areas of focus such as quality of teaching and learning, safeguarding, health and safety and of course financial control and resilience must be monitored alongside the new risks on the block.

Audit committees and boards should be more aware than ever that all of the above represents an ever-increasing workload for a finite senior management team. This is where internal audit can help by providing assurance on most risks facing academy trusts. Let them help.

Risks facing the sector

Last year we highlighted macro-economic volatility and people as the top two risks facing the sector. The ability to recruit and retain top talent remains a top risk, especially on the pay side, with schools finding themselves competing against local employers for their lower paid support staff. This is only likely to increase further with special education needs demands increasing. Some trusts are already making moves to reduce this threat by replacing teaching assistants with more highly skilled staff.

Other risks being featured in discussions and risk registers include:

Political challenges – although we have a new government, we are still somewhat in the dark with what this will mean for education. We know Ofsted judgements have changed but what about finances? The Autumn Budget did bring more certainty but at whose cost?
Estates management – RAAC was a hot topic this time last year and continues to remain a concern for many, but equally so many schools are facing crumbling buildings in dire need of urgent improvements. The the new government appear to be funding such improvements via higher taxes - but how long will this be able to continue?
Falling pupil numbers, particularly in primary schools, will see a significant decrease in core funding.
Geo-political warfare in the Middle East, alongside Russia’s continued invasion, poses a threat to fuel and energy supplies in the future.
The mental health and wellbeing of both students and staff.
New legislation in the workplace could also prove to be challenging for some schools and we may well see an increase in disciplinary action and claims.

Strong leadership is needed, more than ever, to navigate these risks and challenges safely. Getting the balance right between identifying, assessing and addressing these risks, being prudent with expenditure and ensuring that the trust can continue to deliver on its strategic aims and charitable purpose is not a simple task.

Making sure that risks are identified, reviewed frequently and addressed with appropriate mitigations and getting assurance over those mitigations continues to be as important and urgent as it was during the pandemic, albeit with a different focus. Trust boards need to ask themselves the following questions:

How do we know that we have captured all the emerging risks?
Have we assessed our risk appetite?
Do we know if the mitigations we have put in place are effective?
What assurance do we have that what we think is happening actually is? And what about the areas where we are not sure?

We often recommend that “risk register” is added as a standing agenda item to trust board meetings. Why? To help prompt the question “is there anything we have discussed today which impacts our risk register?” This will help boards ensure they meet the Academy Trust Handbook’s clear and explicit requirements for management and audit committees to be aware of both risk and the associated effectiveness of action.

Areas for review

The ESFA continues to encourage trusts to adopt a risk-based approach, therefore widening the view that the internal auditor should focus solely on finance. The ATH’s continued focus on the need to obtain assurance on all risks and not “just financial” areas means trusts of all sizes should ensure that the scrutiny scope is broad enough to provide this wider assurance. The key is to ensure the assurance is obtained from persons with the right skills or even a combination of internal audit and external reviewers. This would certainly apply in areas such as safeguarding, governance and health and safety to name a few.

The approach to internal audit should meet your needs and be appropriate to your trust’s size. There is no one-size-fits-all model, as the risks faced by each trust will vary depending on the specific circumstances and structure.

This year we’ve seen an increase in focus on non-financial areas including estates management, governance, website compliance and cyber and ICT security.

Thinking about the common risks that can be identified such as people, estates, fraud and finance can help address wider areas for focus.

For example, a key risk to finance is changing pupil numbers and characteristics. A review of census arrangements to ensure pupil numbers and characteristics are accurate would be an effective response.

Common themes arising from our reviews

The results of internal audits conducted across our clients over the last year indicate that once again, trusts are working hard to strengthen and improve their core control framework. That said, there were still several common recommendations to address control weaknesses and also opportunities to strengthen controls. These included:

A lack of ICT processes and systems being documented via policies and procedures, leading to exposure for when these are not followed.
Right to work checks not being performed in line with statutory guidance.
Member appointment and resignations not being completed in line with Companies Act legislation or in a timely manner.
Other income and lettings rates not being increased and procedures not being followed.
Cashflow forecasts not reflecting a rolling 12-month forecast and only running to the end of the academic year.
Staff (both permanent and agency) being appointed outside of budget without approval.
Registers of interests not being updated or published in full on websites.
Pupil premium or PE and Sport premium website reports being out of date.
Credit or charge card purchases only having a till receipt as evidence of purchase rather than an itemised VAT invoice.

The sector’s risk profile will continue to expand and widen. This will provide additional challenges to both management teams and boards to manage alongside the day-to-day core business. Having clarity and visibility over these risks whilst ensuring you can prepare and mitigate against them is going to be key.

Back to blog