7 steps to efficient internal scrutiny (part 2)

Internal scrutiny is at the heart of risk management, providing oversight of your management controls, reducing risk to your trust and ultimately benefiting pupils by ensuring resources are protected and used properly.

The first blog in this series focussed on the steps for effective internal scrutiny before any audits take place. In part two, we're going to examine the steps to take after an internal audit, and how to ensure that your trust is fully benefitting from the internal scrutiny that is being carried out.

To recap, Keystone's 7 steps to effective internal scrutiny are:

• Appoint - choose an internal scrutiny partner
• Assess risk - link your annual scrutiny to your risk register
• Audit plan - plan your internal scrutiny visits
• Audit - work with your IS partner during the audit
• Analyse - review the audit findings
• Action – complete the actions from the audit
• Assess impact - assess the impacts of the actions

These steps create  a cyclical framework for effective internal scrutiny across your trust, as well as ensured compliance with the Academy Trust Handbook.

Reviewing your audit findings

Following your audit, a review of the findings is the next step towards managing risk in your trust. (This may sound obvious, but you'd be surprised at the amount of time this doesn't happen.) In line with the Academy Trust Handbook, your internal scrutiny partner should have reviewed their findings and provided you with advice and insight into how to make improvements to your processes, or compliance with your processes, based on their audit. The findings and recommendations from the internal scrutiny should be presented to your risk and audit committee for discussion, and subsequently to your board, as regular agenda items. Your risk register should also be updated according to findings.

It is important to sense-check advice or recommendations received against the context of the school or trust audited. Your internal scrutiny partner should have suitable understanding of your setting to provide tailored advice, however this is not always the case so recommendations should be considered rather than blindly followed. This isn't to say that advice should be ignored, merely that the desired results can often be achieved in a number of ways, so find one that works for your trust.

One thing to remember is that any recommendations for improvement are made by a with a view to strengthen your trust, rather than pointing fingers at mistakes. Your internal scrutiny partner is an independent set of eyes who will look at what you're doing and tell you how to improve, with the trust's best interests at heart.

Putting recommendations into action

Following a review of the recommendations made, a schedule of specific actions can be created with timescales and assigned responsibility. This way, actions can be logged and improvement to trust processes recorded. The value of internal scrutiny really makes itself known when taking feedback on paper to living practices in your schools.

Your internal scrutiny partner should rate the risk associated with their findings, and the timescales for putting recommendations into action will depend on the level of risk associated with the issue found. If there are major weaknesses found in financial processes that make fraud easy to perpetrate, or swathes of information missing from the SCR, these should be identified as high risk and resolved as such, whereas a delay in a school uploading records to your estates management system so that they are reconcilable by the central team is a more minor issue and can therefore be resolved with less urgency.

Assessing the impact of actions taken

The final step for effective internal scrutiny is a review of the actions that have been taken to reduce the risks identified through the scrutiny process. A review of amended processes should be made, and re-evaluations of risk levels updated in your risk register as tangible impact of the work carried out.

This review then ultimately feeds into the planning cycle for your next round of internal scrutiny. As we discussed in the last blog, developing a three year programme of areas for review allows you to plan, with trustees, reviews over areas which are showing the most risk either right now, or with changes you foresee happening over the next couple of years.

Keystone Knowledge's team of school experts are here to help you plan your internal scrutiny and make it an effective tool for your school or trust. Find out more here.

¹Academy Trust Handbook - Part 3: Internal scrutiny - Guidance - GOV.UK