Tuesday, September 25, 2012

Academies and audit committees: where to start with terms of reference

The Academies Financial Handbook issued last week by the Department for Education nudges Academy Trusts (ATs) towards audit committees but allows other committees to incorporate the role of an audit committee into their remits.

The Handbook states:

All ATs must establish either an audit committee or a committee which fulfils the functions of an audit committee (ie it could be an addition to the terms of reference to an existing committee, other than the finance committee, and have an overlapping or fully integrated membership).

The apparent block on combined finance and audit committees may pose a challenge to some ATs. It will not be a surprise who are familiar with audit codes of practice in the college sector.

The audit code of practice introduced for colleges in 2004 (pdf) offers a useful template for setting out the role of an audit committee. Below I have modified its terms of reference to suit an AT:

The Audit Committee will consider matters relating to internal control and auditors. In particular the Committee is to:

  • advise the governing body on the adequacy and effectiveness of the Academy Trust’s systems of internal control and its arrangements for risk management, control and governance processes, and securing economy, efficiency and effectiveness (value for money) ;
  • review the statement on internal control and make appropriate recommendations to the governing body;
  • advise the governing body on the appointment, reappointment, dismissal and remuneration of auditors (both external auditors and internal audit);
  • monitor the effectiveness of auditors, including the use of auditor performance indicators;
  • ensure effective coordination between auditors;
  • ensure that additional services undertaken by the auditors is compatible with the audit independence and objectivity;
  • agree the work programme of internal audit including the checking of financial controls, systems, transactions and risks;
  • consider the reports of the auditors and, when appropriate, advise the governing body of material controls issues;
  • monitor the implementation of agreed audit recommendations;
  • ensure that all allegations of fraud and irregularity are appropriately investigated and controls weaknesses addressed;
  • recommend the annual financial statements to the governing body for approval
  • review the committee’s membership and effectiveness on a annual basis to ensure that it has appropriate skills and relevant experience.
This wording assumes that the Academy Trust refers to its assurance function as internal audit rather than a Responsible Officer. The wording can be tweaked on this and other Academy Trust specifics. Otherwise it can be adopted for a standalone committee or inserted into the terms of reference for another committee.

Saturday, September 22, 2012

Internal control and audit committees - the new Academies Financial Handbook

In the past there was a degree of ambiguity about whether academies had to have an audit committee. The 2006 Academies Financial Handbook itself did not require one but it included, as an appendix, a document which did. The 2012 Academies Financial Handbook (AFH) clarifies the situation.

The AFH states the role of the audit committee:

The committee must review the risks to internal financial control at the [academy trust] and must agree a programme of work that will address these risks, inform the statement of internal control and, so far as is possible, provide assurance to the external auditors.
The AFH clearly requires that academy trusts (which, of course, includes free schools) must establish “either an audit committee or a committee which fulfils the functions of an audit committee”. Some trusts by virtue of size or nature are expected to have a separately constituted audit committee (i.e. one which does not also function as a finance committee).

Every [academy trust] must have in place a process for independent checking of financial controls, systems, transactions and risks.

Ideally this process should be driven by an audit committee appointed by Governors, but EFA recognises that this may not be a practical position for every [academy trust], especially the smaller ones or ones where there is a limited pool of potential governors to provide the necessary direction. So, EFA has provided for a system which allows some flexibility as to how any particular [academy trust] discharges these requirements.

 All [academy trusts] must establish either an audit committee or a committee which fulfils the functions of an audit committee (i.e. it could be an addition to the terms of reference to an existing committee and have an overlapping or fully integrated membership). The decision will be for Governors and should reflect the size and complexity of the organisation.

EFA's expectations are that that:

All [academy trusts] that are a multi-academy federation must have a dedicated audit committee;

All [academy trusts] with an income of over £10m or capitalised asset value of over £30m should consider having a dedicated audit committee;

All other [academy trusts] may have a dedicated audit committee.

The new Academies Financial Handbook (AFH) moves beyond internal financial controls and risks to internal control more broadly. This makes sense: while financial viability is vital so are other objectives –

The AFH states:

The [academy trust] should have in place sound internal control and risk management processes.

While the AFH talks of internal control and risk, strangely the AFH section on internal control is narrowly focused on matters such as producing annual accounts, preparing contingency plans, obtaining insurance etc.

These things all matter. But tinternal financial control falls short of the concept of internal control developed by the Turnbull Committee for listed companies and adopted by the Treasury for the public sector over a decade ago. "Turnbull" required:

An internal control system encompasses the policies, processes, tasks, behaviours and other aspects of a company that, taken together:

facilitate its effective and efficient operation by enabling it to respond appropriately to significant business, operational, financial, compliance and other risks to achieving the company's objectives. This includes the safeguarding of assets from inappropriate use or from loss and fraud, and ensuring that liabilities are identified and managed;

help ensure the quality of internal and external reporting. This requires the maintenance of proper records and processes that generate a flow of timely, relevant and reliable information from within and outside the organisation;

help ensure compliance with applicable laws and regulations, and also with internal policies with respect to the conduct of business.

If you plug in academy in place of company, that is highly relevant to good governance and management. It is also far more wide-ranging than contingency plans and insurance policies. It is about staff and pupil safety, academic performance, inspection grades, legal compliance, equality and diversity, and many other objectives.

So what should academies be doing if they should be thinking about controls and risks beyond the financial?

Academies need to ensure that audit committee review not only the risks to internal financial control but also the risks to delivery of all critical objectives. In performing that review, they should be directing the Responsible Officer or the internal auditor (or whatever the assurance function is called) to evaluate controls and test controls in those critical areas. At new academies with immature financial processes, much of the work will be around payroll and purchasing. As academies get better established, non-financial systems will get more attention and financial ones less.

The path from local authority control to independence has been trod before. In the 1990s over 400 further education colleges went that way. Many survived. Some lived on within merged institutions. A few merged or closed after failure – sometimes in scandal. For those of us working with colleges then and now, there were lots of interesting case studies and good practice and not-so-good practice.

Audit committees and internal audit contributing (or not) to internal control were part of the reason why colleges succeeded (or not).

"Turnbull" was an issue for colleges then. Now it should be a challenge for academies. Taking the AFH and going further – rigorous review of both financial and non-financial risks with audit committees pushing that agenda.