COVID-19: Are academy trusts absolved from any internal scrutiny/audit this year?
The recent Education Skills and Funding Agency (ESFA) letter to Accounting Officers covered several areas, including a paragraph on internal scrutiny (or internal audit, as it is commonly known). The lockdown has led to many changes for schools and everyone is having to adapt to a new way of working. One of the key issues arising from the lockdown is that any planned on-site internal audits have to be completed remotely where possible, or deferred pending the re-opening of schools. The letter to Accounting Officers acknowledged this by saying:
“In relation to the internal scrutiny requirements in the Handbook, whilst in-person review visits to academies would be inappropriate at present, it is at boards’ discretion whether remote checks are feasible and helpful in managing risk during school closures. Looking further forward, trusts’ audit committees may find that the current unique circumstances can help shape their plans for internal scrutiny and crisis management in the future.”
To confirm, this is NOT the ESFA allowing boards of academy trusts to absolve the Trust and themselves from the responsibility to manage the risks of their trusts. Boards and trustees still need to document what their key risks are and by what means they are confident that these risks continue to be managed in practice.
So our recommendation is that boards and trustees should continue to ensure their internal scrutiny programmes remain in place for this year, as far as is possible and practical. Obtaining, relying on and taking decisions from clear, robust assurance is critical, now more than ever.
We have set out our reasons for this below.
Internal scrutiny’s requirements were expanded in the Academies Financial Handbook 2019 and made it clear that trusts and boards of trustees were responsible for managing all risks – both financial and non-financial – that faced their trust.
A key element of this risk management was the assurance obtained by the trustees on how effectively these risks were actually being managed in practice. This assurance should come from the trust’s own management team as well as from external sources – for example, by the completion of a programme of internal audit.
Exposure to certain risks has almost certainly increased for many of the risks faced by trusts following the COVID-19 outbreak in the UK and subsequent lockdown imposed by the government. Academy trust staff are being asked to perform a range of duties – new and old – but within unfamiliar situations and locations.
Naturally, senior staff in trusts are having to respond quickly and effectively to the continued ever-changing landscape, but in equal measure they have to ensure the key processes – such as paying staff and suppliers – continue without interruption or incident.
These key processes are now being performed, in the majority of cases, remotely and this only further increases risk. Therefore trust management, committees and boards all need to obtain appropriate comfort and evidence that all that can be done properly is being done so. This will then, hopefully, reduce the exposure to the trust and its employees.
The letter from the ESFA also confirms that trust boards will still need to submit an end of year scrutiny report in relation to the current year. This will be a summary of the work undertaken and outcomes following the reviews of risks facing the trust. In particular, any assurances that have been relied upon to reach a conclusion will also need to be included in the report. Lack of detail may expose the trust to questions from the ESFA on how risk has been mitigated sufficiently during the year.
It is also not clear how the ESFA will react should there be evidence of no reports being issued since lockdown. There might be further guidance issued at a later date, but of course, any potential non-compliance will have already taken place.
In addition, the external auditors, as part of their planning, have to assess whether the system of internal control can be relied upon to help reduce risk and therefore their substantive testing. If there is a lack of internal scrutiny reports to demonstrate a sufficient system of internal control then this may increase the external auditor’s risk assessment. Of course, the counter-argument could be that transactions during lockdown are expected to be far fewer than normal and as such the reliance on internal control might not be required.
External auditors may also consider the lack of reviews taking place to be a potential point to flag in their audit letters and it would not be fair to ask them to consider this right now in such a changing environment.
Look to adapt
Whilst the temptation is there to defer or cancel any internal scrutiny visits, we highly recommend that trusts instead look to work with their provider to determine what assurance can be still be gained remotely during this lockdown. This will go some way to providing boards with a degree of comfort whilst also fulfilling their responsibilities.
In the absence of a visit, we can still do a lot to help and support your trust by undertaking our work remotely. Thanks to our IT systems, all our staff are working remotely and continuing to undertake audit testing on a number of clients.
We can consult your risk registers and discuss with you how best to provide the finance/audit committee with the assurance they need from a management team that are no doubt stretched right now. We can discuss practical steps both parties can take to ultimately deliver a programme of work which helps trusts to positively manage their risks and allow for the opportunity for a completed end-of-scrutiny report to be filed with ESFA. We are here to help and support you. Contact our Academies and education team here.
Subscribe to our newsletters
Our complimentary newsletters and event invitations are designed to provide you with regular updates, insight and guidance.
You can unsubscribe from our email communications at any time by emailing firstname.lastname@example.org or by clicking the 'unsubscribe' link found on all our email newsletters and event invitations.