Phishing: should you be worried of cyber fraud?

1.    What exactly is ‘phishing’?

The text book definition is: “the illegal attempt to acquire sensitive information such as usernames, passwords and account details often for malicious reasons by masquerading as a trustworthy entity in electronic communication”.

2.    What are the worst cases of online fraud/phishing that you’ve heard of?

Victims of phishing may be shy. But we do know that schools can fall victim to online scams.  St Aldhelm's Academy in Poole was contacted by fraudsters pretending to be bank employees and asking about the school's bank account. Staff provided the requested details and the criminals withdrew over £1million. The academy subsequently suffered the ignominy of national press coverage and a financial notice to improve from its funder and regulator, the Education Funding Agency.

3.    What advice would you offer schools wanting to avoid falling victim to online fraud?

Complacency is the greatest threat. Many of us will have had a poorly spelt and badly worded email from a United Nations official or the widow of a recently deposed dictator.  These missives asking for help in transferring funds are often safely redirected straight to our junk filters. However, we must not assume all phishing emails are so blatant. Increasingly, scammers are raising their game and making their emails more professional and hence believable.

4.    What are the most common online scams?

Attempts – both online and offline - to redirect payments from legitimate suppliers to fraudsters appear to be the most common scam in the education sector. There have been increasing reports in recent years of both successful and failed attempts to defraud schools and colleges as well as other not-for-profits.

While technology allows fraudsters to go phishing on an industrial scale, some of the most effective scams have been offline exploiting our innate trust in paper.  There have been several recent cases where BACs electronic payments have been made directly into fraudsters’ bank accounts after correspondence on convincing letterheads asked for the bank details of suppliers to be changed. In 2010 Oldham Sixth Form College transferred £730,000 after receiving such a letter.

Sometimes the fraudsters supplement their paper letters with fake websites as part of the scam.

5.    How can schools tighten up their online security?

While schools should have robust cybersecurity, common sense and caution are essential too. Never give information to your bank which your bank should already know. If in doubt, speak to your bank manager. Always verify verbally any paper or electronic request to change supplier bank details with known contacts. Above all, take care!

Fraud in Schools - what can be done?

In July news emerged of an investigation into an alleged fraud at a London academy after £4million of school funds disappeared. The case was kept under wraps for two years while parents were asked not to speak to reporters although hawk-eyed readers of the Department for Education’s annual accounts for 2012/13 might have noticed oblique references to an “irregularity” at the Haberdashers Aske’s academy trust. The case is believed to be largest school fraud in British education history.

While school managers might expect to notice and stop millions of pounds being siphoned off, schools are at risk from fraud perpetrated by those on the inside and the outside. Complacency - “it could never happen here” – worsens that vulnerability.

A perusal of Google news over a month or two will unearth cases of schools falling victim to managers signing off fake timesheets, finance assistants using cards to pay for holidays and heads appointing friends and family without due process. There are many more con artists outside trying to defraud schools – last year a solicitor was jailed for his part in tricking a sixth form college into paying over £730,000 intended for a genuine contractor into a bogus bank account.

While fraud risks cannot be eliminated, schools can mitigate them. A few simple steps can help:

1.       Get the tone from the top right

School leaders need to lead by example and emphasise probity. That means a fraud policy with zero tolerance of irregularity. There should be a register of interests for governors, senior managers and other staff with significant financial authority or influence. Similarly there should be a policy on gift and hospitality. Everyone should know about these policies – where to find them and what they require. 

2.       Assess risks and mitigate them

The identification, assessment and management of fraud risks should be covered by school risk registers – particularly in the risky area of purchasing.  There is plenty of free guidance available online including fraud risk self-assessments. The Chartered Institute of Public Finance and Accountancy recently published a Schools Fraud Health Check. Simple checks and balances with segregation of duties and independent review of transactions are effective in mitigating risks. This is more challenging for smaller schools, particularly primaries. However, there is normally a second pair of eyes, even if it is a governor, who can ensure that there is never too much reliance upon one member of staff.

3.       Look out for risk indicators

Both the Education Funding Agency and the Audit Commission have published advice on fraud risk indicators. The Commission’s list of behavioural warning signs included: reluctance to take holiday entitlement; poor work practices such as “bending rules”; a lifestyle not equal to income. There may be innocent reasons for strange behaviour but sometimes these can be indications of a staff member with something to hide. 

4.       Use data

While there are software packages to highlight strange patterns in financial data, a spreadsheet is sometimes enough to spot anomalies. A key check to perform is looking at the top dozen or so suppliers over the last year compared with previous years – does it make sense? There may be nothing untoward about using the same suppliers or contractors again and again. But, on the other hand, it may be a sign of an overly cosy or even inappropriate relationship with a supplier. (Aside from fraud risks, this simple review of spend patterns may identify value-for-money opportunities.)

5.       Welcome whistleblowing

Appropriate arrangements for confidential reporting are not only a legal must-have, whistleblowing is vital defence against fraud and other wrong-doing. Staff must know where to find the whistleblowing policy. The policy itself should link into the governance framework, including those elements perceived as most independent e.g. the audit committee, the internal and external auditors.

Are schools doomed to be scammed?

Before the National Fraud Authority ended up on the Coalition’s bonfire of quangos it did a lot of work on raising awareness of fraud. One of its major projects was estimating the total value of fraud in the economy – everything from “blue badge” parking abuse to multi-million VAT fraud. Before the NFA disappeared, it published Annual Fraud Indicators which estimated the loss to the economy of fraud to be £52billion (pdf available).

What has that number got to do with schools? In one month the press reported:

·         Arrests following concerns over the use of£162,000 at an academy following an Education Funding Agency report.

·         Finance staff giving away bank details in response to a phishing email with a subsequent loss of £1m

·         A school bursar being convicted of signing-off fake overtime claims with a loss of £18,000

·         A former head being found to have fallen below the standards expected of school leaders for his involvement in the recruitment of a family member which "breached the expected standards of transparency".

Much detected (and obviously undetected) fraud does not get into the papers. The 2012/13 Department for Education accounts mention a £2m “irregularity” at one academy chain – a Google suggests that the case never got into the press.

The NFA cautioned against its estimates being used for identifying trends. But is fraud getting worse? Quite possibly: while staff will generally be honest and public-spirited, after years of pay freezes and 1% rises, a minority may be demoralised and feel squeezed;  many organisations are struggling to cope with financial pressures so some managers may be tempted to bend rules; greater autonomy for schools creates opportunities but not all are positive.

Are schools doomed to be scammed? In fact, schools can protect themselves through simple steps. But the first step is to recognise that fraud is an issue.

 

 

Later this month I am talking at EdExec Live about how schools can protect themselves. Tickets are still available.

EFA asks academy principals and boards to think about fraud

Today the chief executive of the Education Funding Agency sent a letter to accounting officers (i.e. principals) at all academies in England. It reminded them of the requirements in relation to fraud, connected parties and special payments.

The letter included an annex setting out questions for principals and trustees to consider in order to minimise the risk of fraud or irregularity:

• Authority – Do you have a written scheme of delegation, approved by the trustees, so that individuals are clear about their levels of financial authority?
• Purchasing – Are you confident you are procuring all goods and services in an open, competitive and transparent way?
• Payroll – Do you have robust controls for payroll including checks that payments are for the right amounts and paid to bona fide employees?
• Oversight – Do you ensure that financial reports are produced that fairly reflect the activity at the trust, that they are properly reconciled at least monthly and are shared regularly with the trustees for formal review?
• Cash management – Are your bank accounts reconciled at least monthly?
• Assets – Is all of the trust’s property under proper control and measures in place to prevent loss or misuse?
• Segregation – Do you have appropriate separation of responsibility in your finance team? And are you providing proper management support to your finance staff to help them to operate in a role where they are well-placed to provide you with a “first line of defence” in terms of upholding propriety, regularity and value for money in the use of public funds?
• Records – Do you have robust procedures for recording, documenting, evidencing and monitoring information and especially the reasons for entering into major spending commitments?
• Scrutiny and audit – Do you have properly constituted arrangements for internal review (such as a responsible officer or internal auditor) to give you and trustees a further safeguard that the trust’s financial systems and controls are operating effectively and efficiently? Does the trust debate, and agree how to act upon, recommendations arising both from these internal reviews and from the work of its external auditors?
• Risk – Do you have an effective process for identifying and responding to the major risks that the trust faces?

These are all basic and sensible measures.

Next month I will be talking about fraud risk at the EdExec Live conference. I will be explaining what more academies can do to protect themselves from fraudsters both inside and outside their organisations.

Fraud in schools - some thoughts on the DfE's risk indicator checklist for academies

Allegations, fraud, corruption and bad behaviour have been in the news. A knighted Headteacher was convicted of false accounting and narrowly missed a custodial sentence for false accounting. A free school was being investigated after allegations of irregularities. Derby University was forced to strongly deny claims that it falsified official statistics on graduate employment.

Also this week Times Higher Education carried an article about a Transparency International report which warned financial pressures could impact on ethical standards. Global Corruption Report: Education noted:

The very structure and culture of colleges and universities, as well as the current constraints under which many…operate, can create conditions that facilitate fraud.

This makes it timely to look at the recently published guidance from the Department for Education (DfE ) on fraud. Last month the Education Funding Agency at the DfE issued Fraud Indicators: A checklist for academies (download here).

The Fraud Indicators checklist details “generic” indicators including “personal and organisational motives for fraud, possible weakness of internal controls, transactional indicators and possible methods of committing and concealing fraud”. The DfE suggest that the checklist “may be helpful for use as a checklist where concerns exists that fraudulent activity may be taking place”.

It would be easy to mock the section headed Personal Motives – many organisations would show a red flag on fraud indicators such as “personnel believe they receive inadequate compensation and/or rewards”, “disgruntled employee”, “recent failure associated with specific individual” and “personal animosity or professional jealousy”. Nevertheless these soap opera indicators do highlight that in the fraud triangle motivation and rationalisation sit with opportunity.

Under the heading of Organisational Motives, how many of us have known organisations “experiencing financial difficulty”, burdened by “under unusually tight time deadlines to achieve level of outputs” or having “suffered disappointment/reverses/consequences of bad decisions”.  Still the checklist is right to point to the problems which arise from an all-powerful head and governance which lacks clarity and direction. How many schools are dominated by Heads with Maxwell-sized egos.

Flippancy aside, this is all useful stuff. However, as with all self-assessments, they are treated most seriously by those who are least in need of reflection and criticism.

The checklist sets out what poor policies, procedures and practices look like. The document is fairly comprehensive. One area where the checklist says little is audit. It notes that critical audit reports and obfuscating auditees are fraud indicators. But what about where managers do not put in place robust internal audit arrangements and/or where governors let weak internal audit arrangements persist. The Principal’s PA or a governor without the time and skills to be an internal auditor is never enough.

Also it is worth noting that the checklist focuses on fraud risks internal to academies. There are plenty of external risks – and organisations tend to pay more attention to them (even if, not enough).

So what is my conclusion? If you are a manager, governor, internal or external auditor, spend some time working through the Fraud Indicators: A checklist for academies. If enough academies do treat fraud risks more seriously, academy assets and public funds will be better safeguarded as will the reputation of the sector.

The National Audit Office on risks in academies

Over the summer the National Audit Office published guidance to the external auditors of academies. The guidance, NAO Communication with academy auditors 2013, has been issued as the academies are consolidated into the “group accounts” of the Department for Education – so academy auditors are auditing parts of the DfE.

The guidance will be fascinating for audit anoraks. It will also be of interest to anyone many others including principals, senior managers, governors and ROs/internal auditors. The short guide highlights what the auditors at the NAO worry about.

We … consider, because of the number and variety of providers, there is an inherent risk that across the academies sector there could be material or systemic irregularity, which may be heightened in newly converted academies. Particular areas of concern include:

• Approval from the Secretary of State not being sought for certain transactions above delegated authorities, outlined in the academies financial handbook;
• Fraud or misappropriation of funds, especially at the Trust level in a multi academy trust; and
• The increasing risk that academies with long standing deficits may become insolvent.

Fraud and insolvency are of wider public interest too.

In terms of regularity (i.e. income and expenditure being applied, in all material respects, for the purposes intended by Parliament), the NAO advise:

• There are a number of themes which the auditor should consider when identifying the risk of irregularity. These themes include:
• Misuse of funds by head teachers (i.e. using academy funds for personal gain);
• Governance at multi academy trusts (i.e. oversight of activities of individual academies, or weak controls at the trust level)
• Weaknesses in procurement (i.e. non-compliance with EU procurement rules, or employment/contracting with related parties)

Clearly audit and assurance are vital to keeping academies on the right track – and spotting problems if they do start to go off the rails.

Governance of social landlords – themes in a tagcloud

Since the Homes and Communities Agency (HCA) has taken over social housing regulation, there have been some eye-catching Regulatory Judgements (RJs). In seven cases social landlords have been graded as weak with a G3 or G4 (see Footnote).

Hopefully in there will be detailed work on these and other social landlords in with governance difficulties. In the past there was the Problem Cases trilogy – research by the Housing Corporation and consultancy CampbellTickell on housing associations who had been placed in regulatory supervision. Perhaps in the age of austerity there will be no funding for looking at case studies of failure.

While we wait for more detailed research we might be able to visualisation techniques to pull out some of the themes from the first seven social landlords to get G3 or G4 in their RJs. With a population of seven, the statistical significance will be limited. Nevertheless, the TagCloud does highlight issues like development. Also, the TagCloud shows the importance of frameworks for risk management and assurance for governance. As the HCA churns out more RJs, TagClouds may prove more instructive.

Footnote:

G3 = The provider does not meet all of the requirements on governance set out in the Governance and Financial Viability standard. There are issues of regulatory concern and in agreement with the regulator the provider is working to improve its position.

G4 = The provider does not meet the requirements on governance set out in the Governance and Financial Viability standard. There are issues of serious regulatory concern and the provider is subject to regulatory intervention or enforcement action.

Academies, Responsible Officers and risks: getting the basics right

Tomorrow is the last working day of August. So the long-promised revised Academies Financial Handbook must be quite imminent as it is due this month for the new financial year. When it does arrive on the DfE website, academies and free schools will need to do some thinking about their assurance arrangements.

In the past academies were given somewhat ambiguous and vague advice on who could be appointed as the Responsible Officer (RO) to give assurance to Governing Bodies on internal financial control. That led to a range of approaches – good practice and not-so-good. Given the rhetoric around freedom as well as common sense, the new Handbook will doubtless formalise that flexibility.

In terms of what ROs did, there was more direction if not prescription. The RO was given a list of Suggested System Control Checks to be done on a quarterly basis (in practice for many academies, termly basis). These will, I suspect, go out the window. What will be in their place?

If the RO is to evolve into something resembling internal audit, the RO’s work will be driven by the risk register. That makes sense - the assurance function for control and risk should be informed by the risk register.

But maybe there is a hitch? Many academies – not only new ones – have in place risk registers that look remarkably like the one in the 2006 Academies Financial Handbook. Using a template is a useful aid but organisations have to think about their own specific risks – not simply the generic ones. They need to rigorously review and objectively assess risks. How many do that?

ROs need to start their work with some attention to risk registers. If ROs have knowledge, understanding and experience when it comes to risk management – as well as common sense – they will add real value as well as ensure that their own testing driven by the risk register addresses real risks.

If academies and their ROs can get their risk registers in shape, they can then progress onto assurance mapping. But that will have to be another blog post.

 

Audits and risks: the new Funding Agreement for sixth form colleges

The Education Funding Agency’s new Funding Agreement for sixth form colleges is a strange beast. It is clearly a slimmed down version of the 2006 Learning and Skills Council’s variant. But in slopping parts off, there seem to be some strange and perhaps unintended consequences.
In the 2006 Financial Memorandum colleges were instructed:

The College must ensure that it has an effective policy of risk management (including appropriate insurance arrangements). The College’s risk management arrangements should consider the key principles given in LSC guidance.

In a far more uncertain and hazardous environment, the 2012 Agreement does not utter a word to sixth form colleges on risk management. As established and largely mature organisations, I would hope they will carry on managing risks and enhance their arrangements.

While the words on risk management are omitted from the 2012 Agreement, oddly the wording on internal remains unchanged. So where the 2006 Memorandum states:

The governing body shall appoint an audit committee and arrange to provide for internal and financial statements audit, including regularity audit, in accordance with the LSC’s Audit Code of Practice and any other directions drawn up and published by the LSC in consultation with colleges. Any mandatory requirements under the LSC Audit Code of Practice shall be a condition of funding under this financial memorandum.

The 2012 Agreement states:

The Governing Body shall appoint an audit committee and arrange to provide for internal and financial statements audit, including regularity audit, in accordance with the Joint Audit Code of Practice and any other directions drawn up and published by the EFA in consultation with SFC. Any mandatory requirements under the Joint Audit Code of Practice shall be a condition of funding under this Funding Agreement.

Some mistake surely?

Only today, the Education Funding Agency reminded sixth form colleges that they did not have to make provisions for internal audit from August 2012. (Of course, any sensible college will await the Agency’s guidance before making use of this new flexibility.)

The Priory – the report and the risks for academies

There has been plenty of press coverage of the Department for Education report about the Priory academy federation in Lincoln. The internal audit report is available on the DfE website.

On Twitter (where you can follow my Twitterstream), there is a Twittersplurge analysis of the Priory by the Education Editor of The Times, Greg Hurst:

Risks exposed by Priory Academy scandal: 1. Academy chain HQs handle much larger sums of money than a maintained school ...

2. Entrepreneurial activity by academies/chains widen scope for abuse eg buying grade II Georgian manor house / activity centre in France ..

3. Many academy chains built / led by dominant charismatic figure who other staff / governors may find harder to challenge

4. Academy chains with business links / sponsors have greater scope for conflicts of interest with suppliers, a risk that grows with scale

5. Many academy chains generate commercial / private revenue steams from leaders ' speaking, training, conferences, consulting

6. Business people who join chains in corporate / governance roles may not be as used to dealing with public rather than private money

Something for boards and managers to think about (especially audit committees - where academies have them).

Risk management and reputations: capsized cruise ships and mice in salads

Today, as stock markets opened, the share price of Carnival fell by 20%. I wondered if the directors and managers of the owners of Costa Concordia had listened to the Freakonomics podcast about A Mouse in the Salad.

The podcast recalls as case of a mouse being found in a salad at an up-market chains. It uses the case study to describe how companies deal with unfortunate incidents which pose a threat to their reputations.

The issue of reputational risk is not just a matter for shareholders and directors in the commercial world where brands are worth billions. Reputational risk can blow public and third sector organisations off-course too. Last year we saw the Metropolitan Police shaken at the very top by allegations.

Being prepared is always a good start when it comes to risk management. Too many organisations think that a periodic update of a risk register is enough. Contingency plans for specific situations as well as generic bad stuff should be in place. While media training may not be necessary for smaller organisations, leaders of all organisations need some support and guidelines in place for when necessary, especially if they might be unfamiliar with media glare. Having a link with PR agency for emergencies might come in handy as well as building up strong relationships with the media and other stakeholders in good times.

Listening to the Freakonomics podcast (or reading the transcript) highlights the importance of communication, transparency and ownership when things go wrong. The sooner that Carnival learn that, the quicker that their business will right itself.

Fraud Friday: some scams in the news

Maybe it’s a sign of the times or the phase in the business cycle, but fraud seems to everywhere. Its not just the freshly sentenced former minister Elliot Morley who dishonestly claimed more than £30,000 in parliamentary expenses in what the judge deemed was not a very sophisticated fraud.

Third Sector reported yesterday that the Charity Commission had found that the Director and chair of an education charity not only stole £245,000 from two charities but also made fraudulent payments for training and other activities.

When trustees abuse their position it can be difficult for other employees to know and stand in their way. However, it is disturbing that the charity failed to submit audited accounts for two financial years. Trustees really should pay attention. Too often trustees place undue reliance on their more financially literate colleagues - maybe this happened here.

The headline on this week's Inside Housing is: Landlords targeted by electronic con. In fact the scam does not seem that technological: housing associations seem to have fallen for fake letters requesting changes to supplier details.

Last month the Young People's Learning Agency issued a fraud alert to colleges and academies which warned:

All Academies and sixth form colleges are asked to be vigilant when dealing with notifications of changes of bank account from their suppliers, and if necessary to review their procedures for dealing with changes. The YPLA has been notified of an alleged attempted fraud in which an apparently genuine change of bank details for a supplier (a building contractor) was notified and acted upon. The notification was subsequently been discovered to be false once the genuine supplier raised a query over a missing payment.

The police are currently investigating this incident – the YPLA has been informed that similar attempts have been made elsewhere in the country

While most people are wary of emails and phone calls - particularly the most amateur of 419 scams such as those highlighted on the 419eater website - too often people accept a piece of paper if it is signed and looks official.

Government “retreat” on public sector pensions levy?

Yesterday Guardian readers who work in the public sector may have been pleasantly surprised to learn: “Treasury retreats over public sector pensions reforms”. The article went on:

The government has retreated over reforms to public sector pensions, saying it will not have proposals ready until the summer rather than pressing ahead with planned higher contributions in the March budget

In plain English: this means is that the consultation period for the *3% pensions levy on most public sector workers will end three months later than previously planned. This is hardly a U-turn. It could be seen as a tactical move to avoid industrial action on pensions before the May local elections.

More significantly this week it became clear that the extra pensions contributions for public sector workers would be the rallying cry for co-ordinated industrial action. Strikes really should start featuring on risk registers across the public sector.


* The 3% may actually be significantly more for some if lower paid workers’ contributions are kept constant.

Prophecy and the Spending Review

I was intrigued to see a firm advertising for a “Prophet Modeler”. Apparently Prophet is a liability forecasting system. Nevertheless, at this time there is a need for foresight.

While double-dip fears seem to have receded, no one can tell what a huge fiscal retrenchment (significant public spending cuts and maybe a step change in pension contributions for public sector workers) will do to consumer confidence. The optimists promise a "choppy recovery".

These concerns plus the practical issues with cutting spending and contracts in the short-term explain speculation about some re-profiling (aka delay) in the fiscal squeeze. Likewise, Chris Huhne's suggestion of Plan B from within the Cabinet.

Looking for a silver lining, the ferocity on fiscal policy is likely to be offset on the monetary policy. (While the bankers to a college that I work with love to send me terrifying articles from the Daily Telegraph warning of 8% base rates, I suspect that base rates will say low for a couple more years. Of course they can only go in one direction but I am less worried about interest rate risk than six months ago. There are plenty of other things to worry about and highlight on the risk register.)

I will be interested to see the Office for Budget Responsibility's forecast next week - the first under its new chair, the respected former head of the Institute for Fiscal Studies, Robert Chote. It may be overshadowed by the cuts but it will give some clues to the whole economy impact.

Academies, crisis management and risk management

Last week the website Children & Young People Now carried an article about changes to the academies funding agreement. Various duties have been erased – how these deletions are interpreted depends on your perspective.

One of the requirements struck out was the duty to have a crisis management plan in place before an academy opens. While I am all for reduced bureaucracy for academies (and other schools too), I do hope that academies do still have appropriate arrangements in place before opening.

Crisis management plans are is basic risk management – and it’s not too difficult either. There are plenty of templates on the internet. For example, here, here and here. Have a look; take your pick; tailor to your organisation; and be prepared for the unexpected.

There is no need for lots of consultancy from people like myself – although my rates are very reasonable!

For guidance on risk management more generally, the Academies Financial Handbook is a wealth of information. The Handbook includes templates for risk registers, although I do believe that a simpler methodology may be more user-friendly and manageable for academies. (There is a revised Handbook in the pipeline so there may be amended guidance and templates when that arrives.)

With academies - and organisations generally - it is vital that risk management becomes a continuous thread through governance, management and operations rather than a ritual that is "done" periodically.

Revised Charity Commission guidance on finance, risk and black swans

Last week the Charity Commission published four updated sets of financial guidance for charities. The documents cover risk management; financial difficulties and insolvency; reserves and internal financial controls.

The Commission says that the guidance has been revised to reflect new developments and the challenging economic climate that charities now face.

The updates include guidance on controls over internet banking and safeguards against fraud and financial crime (Internal Financial Controls) and a checklist of key questions for trustees to establish their charity’s financial position (Financial Difficulties and Insolvency).

Interestingly the Commission is warning charities to beware black swans – i.e. the high-impact, hard-to-predict and rare events spotted in Nassim Nicholas Taleb’s book.

The Commission notes (Charities and Risk Management):

If an organisation is vulnerable to a risk that potentially might have an extremely high impact on its operations, it should be considered and evaluated regardless of how remote the likelihood of its happening appears to be. Charities need to find a balance and they will need to weigh the nature of the risk and its impact alongside its likelihood of occurrence. With limited resources, the risks and the benefits or rewards from the activity concerned will need to be considered. It is important to bear in mind that on rare occasions improbable events do occur with devastating effect, at other times probable events do not happen.

Of course, the trickiest aspect of black swans is knowing what they are. High-impact and low-probability risks are often off the radar. Nevertheless rigorous risk management helps: the organisation with contingency plans for staff absence arising from pandemic flu will be more resilient when coping with absences due to volcanic ash grounding Europe.

First class expenses?

It was only a matter of time before Freedom of Information requests would reveal that college managers had – shock, horror - claimed expenses.

The Hinckley Times found that the principal of North Warwickshire and Hinckley College had claimed expenses for first class train fares and a trip to Canada when she was invited, with a student, to be part of the Calgary 2009 Premiere Experience by UK Skills.

It’s hardly a duck house. In fact, it sounds bona fide. But it is a reminder that colleges (and others working in public services) need to manage potential risks to their reputations.

Pandemic flu, absence rates and risk management

It now appears that the number of people off work due to coughs, colds and flu is three-times higher than normal for the time of year. What will happen when pandemic peaks? What if it comes back worse in the autumn?

What we do know is that many organisations risk management will be tested in the near future.

Over the last few years many people were disinterested in preparedness and tended to humour those of us were encouraged attention to the issue. I suspect this was, in part, due to the Year 2000 risk that never materialised. Hopefully next time people will look at the facts and assess the risks objectively.

The FT on governance and risk management

Today’s Financial Times has a Special Report on Corporate Governance (available for free pdf download on FT.com). I’ve not yet read the full suite of articles but there is a good piece on risk management in the light of recent corporate failures.

Jeremy Grant notes:

… [T]here is much work to be done to figure out what kinds of risk management systems boards should have in the wake of the financial crisis. That exposed how information flowed far too slowly up to the board level to allow early diagnosis of problems.

While boards have policies and processes for risk, the critical information is not getting though in time. (I’ve certainly seen that in the public and third sectors – the private sector has no monopoly on risk management failure.)

The article also reports he wariness of some experts about whether the issue of risk management is too big for audit committees.

Church told to practice good risk management

Following a large financial shortfall left after last year’s Lambeth Conference of bishops, a review was commissioned into the financial management of the Conference. The report published last week found control was insufficiently robust given the risks involved in such a major event.

The report includes the commandment:

overall governance arrangements need to ensure that challenges can be identified, options offered for their resolution, and solutions agreed by the appropriate parties and then implemented in a timely manner.