The requirements for internal scrutiny were significantly enhanced in the 1 September 2019 version of the Academies Financial Handbook. All academy trusts must have a programme of internal scrutiny to provide independent assurance to the board that its financial and other controls, and risk management procedures, are operating effectively.
The handbook also mandated that internal scrutiny needed to be driven by the risk register and that academies must submit an annual summary report of their internal scrutiny activities, along with the audited accounts, by 31 December each year.
Do academies still need to comply?
Following the coronavirus lockdown and the cessation of on-site internal scrutiny visits, academy trustees have been concerned as to how they might gather the assurance required to be in a position to make their summary report.
The ESFA have offered some guidance; on 21 April 2020, the Chief Executive of the ESFA wrote to academies stating:
‘In relation to the internal scrutiny requirements in the handbook, whilst in-person review visits to academies would be inappropriate at present, it is at boards’ discretion whether remote checks are feasible and helpful in managing risk during school closures. Looking further forward, trusts’ audit committees may find that the current unique circumstances can help shape their plans for internal scrutiny and crisis management in the future.’
This doesn’t remove the responsibility of boards and trustees to manage risks but acknowledges that this may need to be in a different way to that envisaged at the beginning of the year. Regardless of ESFA requirements, trustees will want to know for their own purposes that existing, and new, risks are being identified and managed.
The operating environment is very different; education providers went into lockdown from 20 March 2020 and, for the academies sector, five months of the current academic year (April to August inclusive) will have occurred in the lockdown and post lockdown and possibly the ‘new normal’ periods.
During lockdown, and thereafter, the governance, risk management and internal control environment has been operating differently through remote means. For trustees to be assured that these new arrangements are operating as planned and that key processes, such as payment of staff, are continuing, a level of internal scrutiny is needed over the environment as it has operated during this period of unprecedented change.
How RSM can help
Across our education clients, RSM has already undertaken many reviews through remote means. A secure portal is established where evidence can be uploaded, we have been able to share screens with staff at our clients’ sites, so they can show us evidence of the system processes and we have held calls through all the available means of Skype, Teams and Zoom, to name a few, so that we have the engagement throughout the review as we would do whilst on-site.
Planning ahead for 2020/21, it seems certain that there will be significant disruption to education providers as they are likely to need to implement social distancing on an ongoing basis for some time.
Internal audit can review business continuity and business restart plans and measures against good practice seen across our client base. We can also review the business as (new) usual activities such as finance, HR, estates, and data protection, as well as frontline activities such as academic quality processes and how these have been adapted to account for the changed operations.
We recommend that the committee fulfilling the function of the audit committee takes the following steps:
For 2019/20: hold a remote meeting with the internal scrutiny provider to revisit any remaining work planned for 2019/20, to identify:
- whether these plans remain appropriate
- whether different areas would benefit from review, and
- to run through how these can be delivered remotely.
It may also be that some work can be carried after the year end that would still give comfort over the operation of controls during the year.
For 2020/21: revisit your risk register to understand the impact of coronavirus on the risks. As we move through the first peak, coronavirus will need to move from just being a risk, to recognising the impact it has on all other risks. Use this assessment to decide with your internal scrutiny provider where assurance coverage will be focused. Also consider which reviews could be done wholly or in part remotely to minimise on-site activity to that which is essential.