RISK MANAGEMENT POLICY & RISK REGISTER

Transcription

1 RISK MANAGEMENT POLICY & RISK REGISTER Version 1.0 The Risk Register is a working document and will be regularly upd and monitored by the school and the Audit and Resources Committees. Only changes to the Risk Management Policy will require agreement by the Full Governing Body. Review by Resources Committee: 7th October 2014 Adopted by Governing Body: 13th October 2014 Next Committee Review Due: Summer 2019 Reviewer: Governor Link: Nick Christou/Sue Waters Audit Committee Risk Management Policy & Risk Register Version

2 Risk Management Policy & Risk Register East Barnet School, Chestnut Grove, East Barnet, EN4 8PU Contents Risk Management Policy 3 Risk Register 4 A. Strategic and Reputational Risks 5 B. Operational Risks 9 C. Compliance Risks 13 D. Financial Risks 15 Risk Management Policy & Risk Register Version

3 Risk Management Policy 1. The management s to the School is undertaken in accordance with the Funding Agreement and the Academies Financial Handbook. 2. The Governing Body is for management and for maintaining a sound system internal control that supports the achievement policies, aims and objectives, whilst safeguarding public funds and other funds and assets for which it is. The Governing Body is advised in this role by the Resources Committee and both are advised and informed by the Senior Leadership Team. 3. The Governing Body fulfils its role by establishing the system internal control: 3.1. Approving and ing a series policies that underpin the internal control process; 3.2. Agreeing objectives, plans and resources by means the budget and the annual School Improvement Plan; 3.3. Approving this policy statement and the attached Risk Register (prepared by the Resources Committee) and ing them carefully each year to identify s, near misses and opportunities; 3.4. Considering carefully the advice from the Responsible Officer and Auditor on internal financial controls, together with advice from any external consultants or inspectors. 4. The Senior Leadership Team fulfils its Risk Management role by: 4.1. implementing governors policies on management and internal control; 4.2. advising the Resources Committee the fundamental s faced by the school and helping to evaluate them; 4.3. providing timely and sufficient information to governors and the Resources Committee on the status s and controls; 4.4. assisting the Resources Committee to draw up and revise the Risk Register; 4.5. working to embed management and -based internal control in all aspects school management. 5. The Risk Register has been completed in the form recommended in the Academies Financial Handbook and it uses the terms listed there. It shall be revised annually by the Resources Committee who will recommend it to the Governing Body. 6. In its annual consideration the Risk Register the Governing Body should consider these issues: 6.1. Whether management continues to be linked to the achievement the School's objectives; 6.2. The appropriate appetite or level exposure for the School as a whole; 6.3. Whether procedures cover fundamental strategic and reputational, operational, compliance, financial and other s to achieving the School's objectives; 6.4. Whether assessment and -based internal control are embedded in on-going operations and form part its culture; 6.5. Changes in the nature and extent fundamental s and the School's ability to respond to changes in its internal and external environment since the last assessment; the scope and quality management's on-going process monitoring the system internal control including such elements as the effectiveness assurance functions; 6.6. The extent and frequency reports on internal control to the Governing Body and whether this is sufficient for the Governing Body to build up a cumulative assessment the state control and effectiveness management; 6.7. The incidence any fundamental control failings ( events) or weaknesses identified at any point within the year (near misses) and the Risk Management Policy & Risk Register Version

4 impact that they have had or could have on financial results; 6.8. The effectiveness the School's public reporting processes; 6.9. The effectiveness the overall approach and policy to management and whether changes or improvements to processes and procedures are necessary. RISK REGISTER The Risks to the Academy are divided into four sections: A. Strategic and Reputational Risks B. Operational Risks C. Compliance Risks D. Financial Risks Abbreviations Used In The Risk Register: ABM Academy Business Manager Academy Finance Manager AGM Academy Trust Members Annual General Meeting GB Governing Body RO Responsible Officer Notes about possible responses to Risks: TRANSFER This may be done by conventional insurance or by paying a third party to take the in another way. TOLERATE Exposure to may be tolerable without any further action. Alternatively, it may not be possible to do anything about the without a disproportionate cost. TREAT TERMINATE This may not obviate the it is more likely that the aim will be to contain it to an acceptable level. This response is used when the only way to contain a to acceptable levels is to discontinue the activity that gives rise to the (not possible if there is a legal duty to engage in the activity). Risk Management Policy & Risk Register Version

5 A. Strategic and Reputational Risks Category Sub-category Specific A1. Strategic Academy objects Academy status Long term demand Competition Stakeholder Alliance / partnership Investment powers Academy is not operating within its objects Academy s objects become out / are no longer appropriate Academy receives unfavourable Ofsted report Risk that academy could lose its academy status Insufficient demand for the academy s services leaves it unsustainable Presence other organisations with similar objects and little scope for differentiation. Other organisations competing for the same sources income Beneficiaries/other stakeholders don t consider that academy provides a valuable/high quality service Co Sec/Chair 1 1 Tolerate Members keep under Chair 1 4 Treat 1 4 Tolerate Regular School Evaluations and Head s targets. Use independent consultants to assess. Outstanding from 2013 Critical examination new activities by GB Head Chair/Head 1 5 Treat Head 5 5 Treat Regular discussion item in SLT and GB to identify ways improving further. Chair/Head 5 4 Treat Chair/Head 2 1 Treat Chair/Head Appropriateness alliance 1 1 Tolerate Not a practical at present Chair/Head Integrity partner 1 1 Tolerate Not a practical at present Chair/Head Risk the Trustees not acting in accordance with their investment powers 1 2 Treat Procedures in Finance Policy followed Chair Date next Risk Management Policy & Risk Register Version

6 A2. Public prile Insurance Macroeconomic Natural disaster Technology Academy objects Trustee prile Risk financial loss/inability to replace items if academy does not have adequate insurance cover Risk the impact an uncontrollable event will have on the academy e.g. recession, war, oil crisis Risk the impact an uncontrollable event will have on the academy, e.g. fire, flood 1 4 Treat Annual insurance value against assets 1 4 Treat Manage reserves to reduce s. 2 4 Treat / Transfer Information security 4 4 Treat Virus /corruption data 4 4 Treat IT systems out / no longer supported Academy not seen by the public to be meeting its objects Objects the academy are controversial or may attract a high level public interest Trustees have a high public prile and may cause the academy to attract publicity Trustees are seen by the public to be paid a high amount for expenses Some transferred to insurers. Regular Business Continuity Policy.. Procedures in ICT Policy Robust backup procedures Anti-virus stware on all machines Robust backup procedures 3 3 Treat Planning for regular renewal Dir Data IT Network Manager IT Network Manager Publicise what the school actually does. Head 1 2 Tolerate Not a practical at present Chair 1 2 Tolerate Not a practical at present Chair 1 2 Treat Policy on Governors Expenses Chair Date next Trustees considered to be arm s length from the academy 1 2 Treat Not a practical at present Co Sec/ Chair/ Head Expenditure Management and administration costs are perceived by the public to be high 2 3 Treat Regularly ed by Resources Cttee Chair Resources Risk Management Policy & Risk Register Version

7 A3. Governing Body organisation Quality service / product Fraud Failure to comply with legislation Senior management the academy are seen by the public to be paid high salaries Reserves level Academy seen to be holding reserves and not spending enough on its academy objects Academy provides a poor quality service to its beneficiaries/customers Fraud discovered at the Academy attracts bad publicity Failure to comply with Health and Safety legislation results in an employee, volunteer, or beneficiary the academy being injured at work, attracting bad publicity Failure to comply with employment law e.g. unfair dismissal an employee attracts adverse publicity 1 2 Treat Salaries ed against pay scales see Pay Policy 1 1 Tolerate Not a at present Review regularly to ensure high standards maintained. Chair Resources Chair Resources Head 1 4 Treat Financial procedures & audit in place & Ops 2 4 Treat Litigation Academy is involved in litigation 2 5 Treat Delegation Committees not established with delegated authority, e.g. finance, personnel, etc. Committee terms reference not sufficiently flexible Trustees delegate too little / too much to the Principal and/or Finance Director Apply Health and Safety Policy and Risk Assessments. Oversight by Resources Cttee Make full use HR advice to avoid such situations. Maintain high standards in all aspects the School s work. Periodic to ensure they are still current and working effectively Periodic to ensure they are still current and working effectively 2 4 Treat Keep under regular. Chair Resources Head Head Chair/ Co Sec/Head Chair/ Co Sec/Head Chair/ Co Sec/Head Date next Risk Management Policy & Risk Register Version

8 Principal/FD absence Trustees do not ensure rigorous monitoring is undertaken in the absence the Principal and/or Finance Director 2 4 Treat Chair Date next Risk Management Policy & Risk Register Version

9 B. Operational Risks Category Sub-category Specific B1. Management information B2. Human resources Quality Timeliness Review Quantity Trustee Risk that information produced for trustees and SLT is not accurate or not in a format suitable for monitoring the performance the academy Risk that management information is not available quickly after the period to which it relates Risk that management information is not subject to Risk that action is not taken after the management information Risk that too little management information is produced to facilitate informed decision making Insufficient experience the academy/ education sector Trustees without required expertise Lack availability/poor attendance at meetings Entrepreneurial that trustees are too entrepreneurial. Risk that activities the academy could be outside its objects. 2 4 Treat 1 4 Treat Internal quality assurance. Information is monitored using independent sources advice, especially Responsible Officer, Auditor, independent advisers, RAISEonline. Kept under by SLT, Governors Committees and GB. Periodic by SLT, GB & Committees Action Points always identified in Minutes and ed at next meeting. Kept under by Governors Committees and GB. Governor training. Co-option persons with expertise. 3 1 Treat Governor training Head Chair/Head Chair/Head Clerk/Chair committee Chair/Head Chair/Head Membership ed by GB Clerk/Chair 1 4 Tolerate Not a at present Co Sec/Chair Date next Risk Management Policy & Risk Register Version

10 B2. Human resources B2. Human Management Staff Risk Trustees become too involved with management the academy. Trustees independent management Trustees do not act solely in the interests the academy but for their business/other interests etc. No member with responsibility for financial oversight is appointed 1 3 Tolerate 2 3 Treat 1 5 Treat 1 4 Treat Declarations interest required Trustees. Appoint Chair and members Resources Cttee. Chair/ Co Sec/Head Chair/ Co Sec/Head Chair/ Co Sec/Head Passive trustees 2 3 Treat Governor training. Chair/Clerk Senior management capability / experience academy sector 1 4 Treat Provide training. Head Integrity 1 4 Tolerate Pressional code conduct in place. Head/Chair Key person loss / succession 2 3 Treat Put succession plan in place Chair/Head Entrepreneurial that management is too entrepreneurial. Chair/Clerk/ 1 1 Tolerate Not a practical at present Risk that activities the Co Sec academy could be outside its objects. Low morale 2 3 Treat Monitored by Head Dir RJ Retention 2 2 Treat Review pay policy and allowances Head/Chair Unable to attract the right level skills in some subject areas 4 4 Treat Review pay policy and allowances Head/Chair Recruitment (recruiting someone unsuitable to work with children) 1 5 Treat Follow best practice in recruitment. Ensure DBS procedures are strictly applied. Appraisal / assessment Head/ Chair Head Date next Risk Management Policy & Risk Register Version

11 resources Volunteer H & S Security Staff matters not referred to HR pressionals, may lead to tribunals 2 4 Treat Lack training 1 2 Tolerate HR advice sought regularly on all difficult issues. Ensure all staff have training opportunities Technical capability 2 4 Treat Provide training. Head/ Head/ / SLT Head/ / SLT Excessive reliance on volunteers 1 2 Tolerate Not a practical at present Head/ Lack control over volunteers 1 2 Treat Provide training. Head/ Training 1 2 Treat Head/ Risk that volunteers appropriate quality/vetted/subject to police checks 1 5 Treat Apply Safeguarding Policy Head/ Injury to students, staff or visitors while on site Incident on a trip outside school, possibly abroad Fatality to staff, student or visitors Contractors on site do not abide by H&S rules 5 2 Treat 3 4 Treat 1 5 Treat 2 3 Treat Outbreak illness or disease Outbreak illness or disease on the farm The site is targeted by thieves and items stolen Ensure adequate numbers trained first aiders Ensure trip leaders are aware the s and complete appropriate assessments Apply procedures in the Critical Incident Plan. Ensure appropriate supervision and intervene if any breaches are observed Ensure communication with all parties is clear. Involve HPA if necessary 1 2 Treat Consult vet if animals appear unwell 5 3 Treat/ Transfer Improve site security Insurance policies to cover theft Head/ /SLT Head/ /SLT Head/ /SLT Head/ /SLT Head/ /SLT Head/ /SLT Head/ Date next B3. Income Donor Academy heavily reliant on one donor 1 1 Tolerate Not a practical at present Head/ Risk Management Policy & Risk Register Version

12 B4. Supplier Marketing Grants receivable Supplier selection Donor has a strong influence / power over academy s activities Other charities competing for donations or similar sources income Grants receivable not used for the purposes for which they were given Grants receivable reporting requirements adhered to GAG received late or sum reduced 1 1 Tolerate Not a practical at present 2 2 Treat 2 3 Treat 1 2 Treat Find new sources funding / improve competitiveness. Use Finance Policy. Auditors to identify problems. Use Finance Policy. Auditors to identify problems. Chair/Head/A FM Chair/Head/A FM Head/ Head/ 3 4 Tolerate Reserves managed prudently. Supplier financial viability 2 3 Treat Rigorous tendering and payments processes applied. Supplier inappropriate 2 3 Treat Apply Financial Procedures. Supplier connected with either trustees or staff Declaration interest by Trustees and staff Quality 2 3 Treat Clear specifications Key supplier Risk that supplies not available 2 3 Tolerate No action practicable to avoid the. Date next Dependency Value for money Risk dependency on few suppliers 2 3 Treat Rigorous tendering process. Purchase price 2 2 Treat Regular s suppliers Efficiency 2 3 Treat Regular monitoring. Risk Management Policy & Risk Register Version

13 C. Compliance Risks Category Sub-category Specific C1. Main Controlling Agency C2. Employee legislation EFA Employment laws Non-compliance with EFA requirements 1 5 Treat Ensure deadlines ed and submissions made on time Termly ups provided by Babcocks 1 4 Treat as well as website Discrimination 1 4 Treat See Equality Opportunity Policy Data Protection 3 4 Treat Apply Data Protection Policy. Human Rights See Equality Opportunity Policy. Equal opportunities 1 4 Treat Contract 1 3 Transfer Review standards terms Head/ Date next C3. Environmental legislation C4. Financial reporting Pension Health and safety UK legislation EU legislation Statutory accounts Accounting standards SORP compliance 1 3 Transfer 2 3 Transfer 2 3 Treat 2 3 Treat 1 4 Treat / Transfer Treat / Transfer Auditors and actuarial revaluation Apply Health & Safety Policy. Employ external monitoring. Research and consider all relevant legislation. Ensure finance staff are trained. Auditor to ensure compliance Ensure finance staff are trained. Auditor to ensure compliance Ensure finance staff are trained. Auditor to ensure compliance Risk Management Policy & Risk Register Version

14 C5. Academies legislation C6. Tax legislation VAT / PAYE / NI Risk trustees aware the legislative requirements being on the Forum 1 2 Treat 1 2 Treat 2 3 VAT Treat PAYE/ NI - Transfer Provide training. Requirements listed in Handbook Governance. Auditors to advise. Payroll outsourced to Strictly Education Date next C7. Data Protection Act C8. Welfare compliance C9. Sector compliance Disability Child Protection Curriculum compliance Mental health compliance Apply Data Protection Policy rigorously. /Clerk Apply Equality Opportunity Policy. Apply Safeguarding Policy. 1 2 Treat Apply Common Curriculum Policy. Head Curriculum Head Curriculum 1 2 Treat Refer to HR consultant. C10. Local Authority and Central Government Grant criteria Licensing Grant terms and conditions are not complied with 1 2 Tolerate Not a practical at present. 2 2 Treat Apply ICT Policy and copyright procedures. Ensure lettings and events comply with licensing/gambling regulations Risk Management Policy & Risk Register Version

15 D. Financial Risks Category Sub-category Specific D1. Overall financial control Budget Reconciliation Consolidation Systems suitability Risk that budget cannot be prepared in accordance with DfE 1 2 Treat Apply Finance Policy. timetable Risk that budget will be in deficit 3 4 Treat Careful planning resources. Risk that actual performance is not measured against budget on a regular basis Risk that budget headings are manipulated to ensure targets are met Risk that bank reconciliations / other key reconciliations completed and ed Risk that suspense accounts are not cleared or reconciled Risk that results subsidiaries / associates consolid with results parent academy Risk that financial system is not suitable for the academy s needs 1 4 Treat 1 4 Treat / Transfer 1 2 Treat / Transfer Regular meetings Resources Committee Budget is prepared in consultation with budget holders. Apply month end procedures. Auditors to cover. Apply month end procedures. Auditors and RO to advise. Chair Resources Committee 1 1 Tolerate Not a practical at present. New system obtained for academy operation. Continue to develop. Date next D2. Financial systems Maintenance Disaster Risk that financial system will not be maintained by provider in long term Risk that financial information cannot be recovered in the event a disaster (e.g. fire, theft, vandalism) 1 4 Tolerate 1 4 Treat Not possible to prevent but keep under. Backup tapes in firepro safe (see ICT Policy). IT Network Mgr Access Risk unauthorised access to financial systems 2 4 Treat Apply ICT Policy. IT Network Mgr Risk Management Policy & Risk Register Version

16 D3. Income EFA Completeness Restricted income Sponsorship funding Cut f EFA change their guidelines and funding without notice Invoices not raised for all transactions Donations in kind or intangibles recorded or recognised in the financial statements Income is not identified as restricted on receipt Restricted income is used for purposes other than restriction Restricted funds are transferred to unrestricted funds without consent donor 5 5 Tolerate 2 3 Treat 2 2 Treat 1 1 Treat 2 2 Treat Ensure we are aware changes in the pipeline and undertake scenario planning Apply Finance Policy. Apply Financial procedures. Apply Finance Policy. Apply Finance Policy. Head/ 3 1 Treat / Transfer Learn from first year new procedures. Auditors and RO to advise. Sponsorship targets met 1 1 Tolerate Not a practical at present. Sponsorship promised by individual partners is not delivered Risk that income is accounted for in the wrong accounting period 1 1 Tolerate Not a practical at present. 2 2 Treat Apply Finance Policy and procedures. Date next D4. Expenditure Fraud Authorisation Allocation Price Risk that donations are misappropriated Risk that expenditure is not authorised Risk that expenditure is allocated between headings using inappropriate Risk that discounts secured or price reductions obtained on purchases or services 1 4 Treat Apply Finance Policy. 1 2 Treat 1 2 Treat 2 2 Treat Apply Finance Policy. Apply Finance Policy and procedures carefully, as advised by RO and Auditor. Apply Best Value Statement and principles to all decisions. Risk Management Policy & Risk Register Version

17 Cut f Risk that expenditure is accounted for in the wrong accounting period 2 2 Treat Apply Finance Policy and procedures. Review by Finance Mgr Date next D5. Treasury D6. Fixed asset Fraud False invoice / payment 2 2 Treat Cash flow Capital construction Asset recognition Risk that cash flow requirements forecast Risk that cash is all tied up in investments and insufficient is readily available to meet short term cash flow needs Risk that assets built by constructors do not meet specifications, or actual cost exceeds budget Risk that assets capitalised Risk that depreciation rate is not appropriate 2 2 Treat Apply proper authorisation checks. Payments signed by 2 signatories Apply Finance Policy and procedures carefully. 2 4 Treat Only bank deposits used 1 1 Tolerate 1 1 Tolerate 2 3 Treat School changing rooms are LA project approved Not a practical at present. Apply Financial procedures. Auditors to check D7. Investment Fraud Return Fraud Risk that assets are misappropriated Risk that the return on investments is not being maximised Risk that trustees acting in accordance with their investment policy / powers (e.g. investing in high investments which in best interests the academy) 2 2 Treat Apply Financial procedures. 1 1 Tolerate Not a practical at present. 1 1 Tolerate Not a practical at present. Risk Management Policy & Risk Register Version

18 D8. Stock D9. Debtors D10 Taxation D11. Provisions and contingent liability D12. Related party Recoverability Completeness Cut f Cash flow Non-academy trading Change in legislation Recognition Contractual commitments Identification Risk that stock is misappropriated 2 2 Treat Apply Financial procedures. Restricted access to storage areas Risk that debts recovered 2 2 Treat Auditors and RO to advise. Risk that provision for doubtful debts is overstated / understated 1 1 Tolerate Not a significant at present. Risk that debtors record is not complete 1 1 Tolerate Not a significant at present. Risk that debtors are accounted for in the 2 2 Treat wrong accounting period Risk that prile aged debtors deteriorates which impacts on 1 1 Tolerate Monthly aged debtors. cash flow Risk that the academy is liable to tax on 1 1 Tolerate Not a significant at present. non academy trading activities Risk that academy is not aware changes 2 3 Treat Not a significant at present. in legislation Risk that academy is not recognising provisions or commitments in accordance with FRS 12 Risk that the academy has entered into future commitments without having the future funding available to meet them Risk that related party transactions / transactions with connected persons identified Risk that connected charities are not identified 1 1 Transfer Keeping up to by reading and training. Auditor and RO to advise. 1 1 Tolerate Not a significant at present. 1 2 Tolerate Apply Financial Procedures. 1 1 Tolerate Not a practical. Date next Risk Management Policy & Risk Register Version

19 D13. Funds D14. Pension Disclosure Level funds Endowment Funding Contribution Risk that related party transactions correctly or fully disclosed in the financial statements Risk that fund levels are too high / low Risk that unrestricted funds are in deficit and restricted funds are in surplus Risk that capital in permanent endowment funds is not maintained Risk that scheme is in significant deficit Risk that employers contribution rate increases Risk that the academy is not making the correct contributions 1 1 Tolerate Auditor and RO to advise. Proper budget management. 2 3 Treat Proper budget management. 1 1 Tolerate None held. 5 1 Tolerate 3 3 Tolerate No practical action is available to the School. No practical action is available to the School. 2 2 Transfer Actuarial valuation Date next Risk Management Policy & Risk Register Version