Independent schools are facing an unprecedented level of challenge and uncertainty. While you cannot plan for the unknown, you can ensure that your school is in the best position to face its challenges head-on.
We have produced a Governance, Risk and Control best practice guide to assist schools in assessing their own stability and resilience, to equip you with the tools you need to move forward with confidence. Our guide focuses on four key areas:
- Do you have the right skills?
- Looking at the right risks?
- What assurance do you need?
- Do you have the right tools?
- GRC maturity self-assessment
Do you have the right skills?
Do you have the right skills?
In order for your school to operate effectively you need to start with the right skills on your Board. For example, when did you last undertake a skills audit of the Board? Do you have the right people to meet the school’s current and future challenges? How effective is the Board in meeting its objectives?
As best practice, you should take additional steps to implement or report on your Board’s effective processes or procedures. Consider the diversity of skills and profile of Governors on the Board to ensure that your Board is diverse and contains the skills you need. Consider using benchmarking tools based on market data, such as from sector surveys and reports, to inform and review Board structure.
Repositioning your Board structure in line with a tried and tested method, clearly evidenced in your annual report and delivered effectively by Governors downwards throughout the organisation, will give your school the best chance at succeeding in its goals. The Charity Governance Code, in line with the existing SORP, recommends a 'formal, rigorous and transparent procedure to appoint new trustees'.
Further to this there should be a rigorous review process that is disclosed within the annual report. Beyond having a Governor recruitment process, schools need to display their consideration towards Board reviews and skills audits, talent of the collective Board composition and an adherence to keeping the Board size between the recommended five and 12 Governors.
Should you set up a separate audit committee?
Schools must decide whether they set up separate committees to deal with audit, finance and risk issues or create combined committees for two or three of these areas.
Combined committees can deliver significant management and Governor time savings, while separate committees can provide greater independence from management and increased emphasis on risk and control. If you do decide that a separate audit committee is needed to manage risk in your school, this you should consider are:
What is the committee’s remit?
A clear Terms of Reference is needed to set out the committee’s overall purpose, responsibilities and authority.
What is the right number of people for the committee?
To meet the objectives set by the Board, audit committees must be the right size. When they are too large, committees run the risk of becoming inefficient. When they are too small, committees may find they are not quorate and lack the authority to make valid decisions, particularly if a member is unable to attend a meeting.
The right people
If an audit committee is to add value, it must comprise suitably qualified individuals. As with the wider Board, diversity of skill set is important. Expertise should span the core aspects of the committee’s duties: primarily finance, audit and risk. In some cases, membership may also need strategy, IT, compliance, fundraising and HR skills.
An effective chairperson
A strong chair understands the need to focus on the key risks facing the school and the need to keep committee members engaged.
For more information on setting up an effective audit committee please download a copy of Turning Lights Green – a best practice guide for audit committees.
For more information on how to adopt the Charity Governance Code at your school please read Decoding the Charity Governance Code.
Looking at the right risks?
Are you looking at the right risks?
Whether you are driven by the desire to obtain more value from your Governors meetings or improve your existing risk management then you should make sure you undertake a review of your strategic risks.
At the least, it will confirm what you thought you knew (no bad thing) and at best, it might just change your school altogether and maybe for the better. So, what do we mean by strategic risk?
Those risks that, if realised, could fundamentally affect the way in which your school operates or achieves its outcomes in the next one to three years. These risks will have a detrimental effect on the achievement of your school’s key objectives. The risk realisation will lead to material failure, loss or lost opportunity.
Charitable schools are required to include a disclosure statement in their annual report confirming that the major risks, to which it is exposed, as identified by the Trustees, have been reviewed and systems or procedures have been established to manage those risks. Many schools respond to this requirement from a ‘must do’ perspective rather than a ‘must have’; the result in most cases being a benign and academic approach to the management of risk, ie we have risk register, tick box.
Governing bodies are, however, really missing a trick if they have not spent sufficient time in focusing on the dimension of strategic risk. We know from our experience in all other sectors that Boards are often good at focusing on and preventing operational failures in their many guises but are not using strategic risk to set the organisation’s future agenda and direction. In some cases, we have found that Boards are not keen to even consider strategic risk because they are afraid of what they might find; either as a result of ignorance (do not want to know!) or dogmatic Boardroom behaviours (I do not need to know!).
Both characteristics you might find in less well-governed organisations. There are also organisations that think they know what their strategic risks are, but the risks, by their very nature, are not strategic (or do not meet the criteria in the definition above). Thus, the organisation does not get the real benefit. Don’t let your school be one of these organisations.
To consider whether your Board really understands the school’s major risks, undertaking a strategic risk identification exercise can bring the following benefits:
|1||the Governors (collectively and individually) having ‘head room’ and time to consider, debate and articulate the future strategic risks of the organisation, including the risk of missed opportunities;|
|2||development of a common understanding of the strategic objectives, risks and organisational values;|
|3||an opportunity for the Board to assess its own vulnerability – does it know as much as it should? Or are there any knowledge gaps?|
|4||the chance to challenge plans, that will help mitigate the strategic risks, and ensure they are as robust as they should be;|
|5||an opportunity to refocus the Board meeting agenda, or at least check that it reflects what it should do; and|
|6||demonstrate to others that the Board takes its risk management and governance seriously.|
To identify the strategic risks there must be a starting point. In all cases this should be your strategic objectives, after all, this is what your school is looking to achieve.
Your Board is encouraged to determine the correlation between the risks and each strategic priority, enabling them to understand which risk will have the most detrimental effect. This will start to form a strategic risk appetite. A further step is to link the operational risks to strategic risks. By their very nature the strategic risks will take some time to materialise, unlike the operational risks which can present themselves more quickly and be used as early warning indicators. What your Board will have eventually is a risk management methodology that is focused totally on the achievement of its strategic objectives and outcomes.
Make the difference! It does not matter how your Board gets an understanding of the strategic risks being faced, as long as it does. It is always better to be prepared and ready, so that you can protect your school as well as take advantage of the opportunities presented. Governors with an eye on both the short and long term strategic objectives could be the real difference between success and failure.
For more information on how to focus your Governors’ agenda please get in touch for a copy of our ‘Boredom in the Boardroom’ publication.
What assurance do you need?
What assurance do you need?
Within an independent school the responsibility for managing risk rests with the Board of Governors. Should a risk materialise such as breakdown in safeguarding or financial mismanagement, there is no doubt that questions will be raised regarding the governance and risk management processes. The responsibility of the Governors is to seek assurance that all principal risks are managed effectively.
One major, but often overlooked, dimension of strategic risk is a failure of the ‘business as usual’ control environment, being the realisation of one or more risks that under normal circumstances should have been within the school’s control. Where the risk mitigation control is applied ineffectively the school becomes exposed to risk automatically.
Governors often fail to put in place suitable arrangements that enable the reporting and monitoring of the core controls that protect the school from the majority of business as usual risks. This is where assurance becomes a key element of the Board’s risk management approach.
Assurance goes to the heart of the work of any Board. The provision of education involves risk, and being assured is a major factor in successfully controlling risk. Having the right assurances gives confidence that risks are being controlled effectively, or, conversely, highlights that certain controls are ineffective or that there are risks where no assurances are being provided.
A Board Assurance Framework brings together in one place all the relevant information on the risk to the Board’s strategic objectives. It is an essential tool for Boards, but like all tools it needs to be used with skill and diligence.
What is a Board Assurance Framework?
The HM Treasury Guidance on Assurance Frameworks (2012) defines an assurance framework as:
"An assurance framework is a structured means of identifying and mapping the main sources of assurance in an organisation, and co-ordinating them to best effect."
...Or more simply put, do we really know what we think we know?
The development of Board assurance arrangements should be a logical extension of an independent school’s existing risk management arrangements. It is important therefore that you are satisfied with how your Board, finance and sub-committees and external reviewers understand and implement risk management, and that you maintain an informed engagement with the risks and opportunities that you face. If these arrangements are effective they will help you to understand the process and control environment, and help you answer the core questions:
- what do we want assurance over? and
- how much assurance do we need?
Developing and maintaining Board assurance arrangements is not, and should not be, a separate activity, but rather an embedded tool of management. As a natural extension of risk management, it would be reasonable to incorporate your Board assurance policy and procedures into your risk management documentation, therefore ensuring that risk, control and assurance identification and monitoring processes are considered as a single, not disparate, set of activities.
For more information on how to formulate a Board Assurance Framework for your school please download RSM’s Board Assurance: A Toolkit for Independent Schools
Do you have the right tools?
Governance, Risk and Compliance - Do you have the right tools? Do you have Insight?
Insight4GRC™ is RSM’s proprietary cost effective and powerful suite of governance, risk and compliance software products that can provide your school with the tools needed to monitor and control performance, assess organisational risks and effectiveness of controls, track assigned actions, enable employee awareness and facilitate policy acceptance.
The Insight4GRC™ suite is cloud based, offering instant updating, interrogation and monitoring - making use of interactive dashBoards and user defined reports. Insight4GRCTM is used by over 200 organisations providing you with a complete picture of your school governance risk and compliance environment at the touch of a button.
Powerful and flexible risk management system
4risk™ is a flexible risk and business assurance management information software system that enables an organisation to monitor and measure its overall exposure to risk and examine the effectiveness of its control environment.
4risk™ risk management system will provide you with a complete picture of your organisation’s risk, mitigation and assurance profile enabling the establishment of enterprise-wide risk management, no matter the size of your organisation or number of locations.
Action tracking and recommendation system
4action™ is a powerful action tracking software tool that gives individuals the ability to be assigned and update the status of their actions – thus ensuring that managers always have a complete picture of the status of all agreed tasks and actions across the whole organisation, strengthening accountability, visibility and achievement of desired outcomes.
4action™ is an extensive reporting facilities and the ability to set target dates and automatic notifications for the individuals responsible for actions help ensure administrators have a complete picture of the status of all agreed tasks and management actions.
Employee policy management software
4policies™ enables organisations to deploy their policies and procedures to employees, identify levels of awareness and crucially record their acceptance of these policies and procedures thereby reducing likelihood of non-compliance and potential exposure to operational and legal risks.
4policies™ policy management software enables you to educate your employees on your school policies and procedures, identify levels of awareness and crucially record their acceptance of these policies.
Your key school policies can easily be displayed to your employees and their understanding of them monitored through the extensive reporting facilities built into the software.
Performance management and reporting
4performance™ gathers information from across the organisation and enables management teams to monitor the performance and general ‘health’ of the business so that management time can be invested where it is most needed.
4performance™ uses a simple traffic light display (red, amber and green) to give a quick visual indicator of your organisational situation at any given time. The easy-to understand system draws attention to particular issues and focuses decisions on any critical aspects which are affecting day-to-day operations – enabling you to invest management time where it is most valuable.
GRC maturity self-assessment
Independent School Governance and Risk Compliance (GRC) maturity self-assessment
This self-assessment questionnaire will take approximately 15 - 20 minutes to complete. Each question asked requires a judgement to be made with regards to your school’s GRC arrangements as per below:
|Not Known||unable to make an informed assessment.|
|Emerging||informal approach though not yet effective.|
|Developing||approach meets basic expectation of stakeholders though not as effective as it could be.|
|Maturing||approach built into normal course of business and is generally effective.|
|Enabling||approach clearly contributes to the achievement of organisation objectives and is fully effective.|
|Does not exist||item under assessment does not exist / is not recognised.|
We recommend, however, that this self-assessment be reviewed by the Board or the audit committee as a group so that each area can be fully explored, discussed and challenged so that a sound GRC maturity assessment can be made.
RSM offers a facilitated workshop session to assist you in maximising the outputs from the questionnaire and focusing on areas of development. Please contact Matt Humphrey for more details.
"More so than ever, Independent Schools need to equip themselves both strategically and operationally to face their external challenges. Using RSM’s guide, you can critically assess your own governance, risk and compliance arrangements to ensure that you have the skills and tools needed to run your business effectively and future proof your school."
David Woodgate, Chief Executive, ISBA