This is an adapted version of an article written by Duncan Gotobed, trustee of South West Essex Community Education Trust, which appeared in NGA's bi-monthly Governing Matters magazine.
The ability to identify, evaluate and prioritise organisational risks and ensure appropriate action is taken to mitigate against them is a key competency for governors/trustees. This involves monitoring political, economic and social risks. External uncertainty, such as future funding levels or pupil numbers, are beyond the control of a school. All the school leadership team can do is to have an appropriate contingency plan ready to activate if necessary.
In contrast, governors/trustees should first focus their attention on those factors that threaten the school’s ability to achieve its strategic priorities or improvement targets. Secondly, they need to look at risks that carry a direct cost if they become an issue and that can be controlled. For example, if an academy has poor financial practices because it has not effectively implemented the Academies Financial Handbook, the Education Funding Authority (EFA) may decide to withdraw its funding.
Thirdly, governors/trustees need to ensure that risk management informs budget-setting activities, school policies and strategic decision-making rather than being an isolated activity. Risk management needs to be underpinned by a policy that sets out the school’s approach to risk; identifies who is responsible for managing it; and describes the key processes, such as:
Identifying risks through examining past records, brainstorming sessions and reviewing the results of recent internal/external audits, etc.
Evaluating risks by quantifying the severity of the risk based on its likelihood and impact/consequences. Research suggests that people understand a ‘very likely’ risk to mean that it has a 43% to 99% chance of occurring. Describing an ‘almost certain’ risk as having a greater than 50% chance of occurring ensures that everyone is talking about risk in the same way.
Assessing the amount of risk to which the school is prepared to be exposed before it prioritises time and resources to reduce, avoid or mitigate it. This can be very specific about a particular risk, such as safeguarding, or more generic in the sense that “the academy is prepared to accept a maximum level of risk at any one time”.
Identifying suitable responses to key risks by addressing their underlying causes. For example, a school identified poorly worded advertisements as the main reason it had not attracted any interest in its vacant positions. By rewording its advertisements and highlighting the benefits of working at the school, it was able to reduce its reliance on recruitment agencies.
Gaining assurance about the effectiveness of controls. Internal controls encompass the school’s policies, processes and behaviours that help it to respond effectively to risk, provide accurate information to stakeholders and ensure its compliance with statutory requirements. Controls can help prevent problems, detect them when they occur and ensure they are dealt with correctly.
Embedding a culture of risk management. It is important to ensure that everybody understands the role they play in managing the risks faced by the school and that good risk management practice is shared with those who could benefit from it.
Four responses to dealing with risks
What can governors and trustees do?
1 Check assumptions
It is easy to assume that when people assess a risk, they have all the information they need and can use that information in a rational way to do the assessment correctly. Unfortunately, a number of studies have shown that people are not very good at estimating the likelihood or impact of uncertain events for a variety of reasons.
Once we believe something to be true, we typically screen out conflicting information. The more quickly we think of something, the more familiar we judge that thing to be. We also tend to be overconfi dent when forecasting outcomes because we think we know more about a situation than we do. Consequently, governors/trustees have a key role to play in asking questions about the risks faced by a school and how the senior leadership team arrived at their assessment.
2 Get clarity
A risk register that lists all the key risks and threats faced by the school is an invaluable tool. However, it is important to ensure that the risks are clearly defi ned, and all relevant risks have been considered.
When defining a risk, three elements should be identified: the cause, e.g. a senior leader leaving a school; the uncertainty, such as the governing board not being able to attract a suitable replacement; and the consequences, namely the leadership in, and management of, the school falling below acceptable Ofsted standards. It should also have a level of detail that enables it to be assigned to a single owner who can manage and report on it.
It is not always possible to clearly define a risk from the outset, so it is important to ensure all risks are regularly reviewed. It can also be helpful to classify risks to ensure that all the relevant risks have been identified. The essential categories to consider are:
- financial – e.g. failure to adhere to financial controls
- operational – e.g. inadequate safeguarding systems
- people – e.g. inability to secure the required number and quality of staff
- strategic – e.g. underestimating the resources required to sponsor an academy
3 Ensure appropriate action
There are four different responses to dealing with risks: tolerate, treat, transfer and terminate. A school will normally tolerate a risk if its severity is less than the amount of risk to which the school is prepared to be exposed. Risks are treated when an organisation takes action to modify the severity, likelihood or impact. Alternatively, a school may try to transfer its exposure to risk to a third party such as an insurance company. A school may need to terminate an activity associated with a risk after it has considered all the other options.
Governors/trustees play a key role in assessing and managing risk. To do this they need to understand risk management, as well as the principles and processes that support it. More importantly, governors/trustees can support risk management by checking the assumptions made by senior leaders; ensuring everyone understands the risks the school faces and their role in managing them. They can also ensure that the underlying causes of key risks are diagnosed and that the school takes appropriate action to mitigate against them.