Internal control and audit committees - the new Academies Financial Handbook

In the past there was a degree of ambiguity about whether academies had to have an audit committee. The 2006 Academies Financial Handbook itself did not require one but it included, as an appendix, a document which did. The 2012 Academies Financial Handbook (AFH) clarifies the situation.

The AFH states the role of the audit committee:

The committee must review the risks to internal financial control at the [academy trust] and must agree a programme of work that will address these risks, inform the statement of internal control and, so far as is possible, provide assurance to the external auditors.

 
The AFH clearly requires that academy trusts (which, of course, includes free schools) must establish “either an audit committee or a committee which fulfils the functions of an audit committee”. Some trusts by virtue of size or nature are expected to have a separately constituted audit committee (i.e. one which does not also function as a finance committee).

Every [academy trust] must have in place a process for independent checking of financial controls, systems, transactions and risks.

Ideally this process should be driven by an audit committee appointed by Governors, but EFA recognises that this may not be a practical position for every [academy trust], especially the smaller ones or ones where there is a limited pool of potential governors to provide the necessary direction. So, EFA has provided for a system which allows some flexibility as to how any particular [academy trust] discharges these requirements.

 All [academy trusts] must establish either an audit committee or a committee which fulfils the functions of an audit committee (i.e. it could be an addition to the terms of reference to an existing committee and have an overlapping or fully integrated membership). The decision will be for Governors and should reflect the size and complexity of the organisation.

EFA's expectations are that that:

All [academy trusts] that are a multi-academy federation must have a dedicated audit committee;

All [academy trusts] with an income of over £10m or capitalised asset value of over £30m should consider having a dedicated audit committee;

All other [academy trusts] may have a dedicated audit committee.

The new Academies Financial Handbook (AFH) moves beyond internal financial controls and risks to internal control more broadly. This makes sense: while financial viability is vital so are other objectives –

The AFH states:

The [academy trust] should have in place sound internal control and risk management processes.

While the AFH talks of internal control and risk, strangely the AFH section on internal control is narrowly focused on matters such as producing annual accounts, preparing contingency plans, obtaining insurance etc.

These things all matter. But tinternal financial control falls short of the concept of internal control developed by the Turnbull Committee for listed companies and adopted by the Treasury for the public sector over a decade ago. "Turnbull" required:

An internal control system encompasses the policies, processes, tasks, behaviours and other aspects of a company that, taken together:

facilitate its effective and efficient operation by enabling it to respond appropriately to significant business, operational, financial, compliance and other risks to achieving the company's objectives. This includes the safeguarding of assets from inappropriate use or from loss and fraud, and ensuring that liabilities are identified and managed;

help ensure the quality of internal and external reporting. This requires the maintenance of proper records and processes that generate a flow of timely, relevant and reliable information from within and outside the organisation;

help ensure compliance with applicable laws and regulations, and also with internal policies with respect to the conduct of business.

If you plug in academy in place of company, that is highly relevant to good governance and management. It is also far more wide-ranging than contingency plans and insurance policies. It is about staff and pupil safety, academic performance, inspection grades, legal compliance, equality and diversity, and many other objectives.

So what should academies be doing if they should be thinking about controls and risks beyond the financial?

Academies need to ensure that audit committee review not only the risks to internal financial control but also the risks to delivery of all critical objectives. In performing that review, they should be directing the Responsible Officer or the internal auditor (or whatever the assurance function is called) to evaluate controls and test controls in those critical areas. At new academies with immature financial processes, much of the work will be around payroll and purchasing. As academies get better established, non-financial systems will get more attention and financial ones less.

The path from local authority control to independence has been trod before. In the 1990s over 400 further education colleges went that way. Many survived. Some lived on within merged institutions. A few merged or closed after failure – sometimes in scandal. For those of us working with colleges then and now, there were lots of interesting case studies and good practice and not-so-good practice.

Audit committees and internal audit contributing (or not) to internal control were part of the reason why colleges succeeded (or not).

"Turnbull" was an issue for colleges then. Now it should be a challenge for academies. Taking the AFH and going further – rigorous review of both financial and non-financial risks with audit committees pushing that agenda.