Risk Management & Compliance

  • Created by: Rehgallab
  • Created on: 15-06-22 18:22
List the steps in Risk Management Strategy
1. ID risk
2. Estimate risk
3. Prioritise risks
4. Mitigate risks
5. Monitor risks
6. Report risks
1 of 140
How can an academy mitigate risks?

+ must act on any advice from auditors
2 of 140
How do academies estimate risk?
Likelyhood x impact

Some argue should be importance times impact
3 of 140
How is risk tolerance set?
By the TB but ESFA can impose a limit.
4 of 140
What does the AFH say about risk?
1. Trusts must have a risk register
2. Trusts must manage risk to ensure effective operation.
5 of 140
What does the AAD say about risk?
1. A new trust will have higher risks while is develops
2. ADD provides sample wording (Coke Town example)
6 of 140
How is risk reported to stakeholders?
In the annual report
- must include principle risks and any uncertainties
- must include summary & strategy
- must disclose financial risks "unless not material for assessment of it's performance"
7 of 140
What is RPA?
Risk Protection Agreement
- run by the ESFA. It's a voluntary pooling scheme which reimburses academies, underwritten by the Government
8 of 140
What does RPA cover?
Buildings, Employment liability, Public liability and business continuity
9 of 140
What does RPA NOT cover?
Motor, overseas, engineering inspections, art
10 of 140
How does an academy fund RPA?
It's a per pupil £ from the GAG.
11 of 140
How much notice does RPA need for you to leave?
3 months
12 of 140
What type of insurance do Trusts have to have?
Employment liability.
13 of 140
What are Trusts responsibilities in terms of Health and Safety at work?
- must ensure the health, safety and welfare of all employees are far as possible

- protect those who might be affected by H&S at work (visitors, pupils)
14 of 140
What are the '5 steps to risk assessment' outlined by the Health and Safety executive?
1. make arrangements to implement measures
2. appoint competent people to support
3. set up emergency prodecures
4. provide clear information and training
5. work together with employees sharing same work space.
15 of 140
What does the Health and Safety executive say are the '3 Principles of effective leadership in H&S'?
1. strong leadership from the top
2. worker involvement
3. assessment and review
16 of 140
What must Trusts do in term of Health and Safety Measures?
- must display a H&S exec approved poster
- must have emergency procedures that all workers are aware of
- must provide adequate equipment, facilities and a first aider
17 of 140
Where should 'near misses' be reported to according to RIDDOR?
Health and Safety executive.
18 of 140
What is the purpose of KCSIE?
1. protect children from maltreatment
2. prevent impairment of disadvantaged pupils
3. ensure safe and effective care for children
4. enable the best outcomes for pupils
19 of 140
How often should the DSL be trained?
Every 2 years, along with the deputy DSL
20 of 140
What does safer recruitment do in Trusts?
- prevent people causing harm
21 of 140
Who needs an enhanced DBS?
- Teaching staff
- anyone caring for or supervising children
- anyone providing training or instructing
- someone doing paid or unpaid unsupervised work with regular contact with children
- engages with intimate or personal care/over night work
22 of 140
What types of incidents don't need reporting to Riddor?
- PE lesson injury (unless hospital)
- Sporting injury
- Injuries on way to school on the bus
- injury on a school trip aboard
23 of 140
When might a school need general consent for activities?
When the activity is in school hours on site
24 of 140
What does a school need special consent?
Out of hours activities/off site.
25 of 140
What are the key requirements of the complaints procedure?
- Must be available to parents
- Must have clear timescales
- Must outline escalation process
26 of 140
Outline the complains process:
1. Informal considerations
2. formal and complaint in writing
3. panel hearing (3 people - 1 not SLT/Trustee)
4. Direct appeal to ESFA
27 of 140
Who is responsible for policies?
- TB responsible but usually delegate to executive
28 of 140
Where can policies be shared?
- Website/VLE
- Staff handbook/Finance handbook
- hard copies (translated)
- master file in the office
29 of 140
How do Trustees manage policies?
- Set review dates
- Receive updates in reports
- Observe in visits
- Compare with other data
- internal and external audits
30 of 140
What does the Trust website have to include?
- Admissions arrangements
- Ofsted report
- Performance tables
- Curriculum
- Remote Education offer
- Behaviour Policy
- Pupil Premium
- Yr 7 Catch up
- Covid catch up premium
- Equality objectives
- PE & Sport premium
- SEND info report
- Careers info
31 of 140
What policies must be on the Academy websites?
- Child protection policy
- behaviour policy
- vision & values
- charging and remissions policy
- Complaints policy
- Whistleblowing policy
- Equality objectives
- Provider access policy
- Gender pay gap info
- Modern slavery act statement
- SRE policy
32 of 140
What must the Admissions policy be compliant with?
Schools admissions code
33 of 140
How often must the admissions policy be reviewed?
34 of 140
What must be included in the admissions policy?
- the order that the admission criteria is applied
- SEND/EHCP admitted first
-LAC/Pre-LAC prioritised
35 of 140
Can academies be selective in their intake?
- converters can continue selection on ability
- academies can introduce ability banding (proportionate respresentation ensuring a full range of ability)
- can be selective for specialisms (no more than 10% and in sport, arts or MFL)
- Pre-established IT/
36 of 140
When does an academy need to consult on admissions?
1. When there is a proposed change
2. if not consulted in the last 7 years

- must consult for 6 weeks between 1 Oct and 31 Jan the year before the year of changes. I.e Jan 2022 for September 2023
37 of 140
Do academies need to consult to increase PAN?
38 of 140
What must the Behaviour policy include?
- outline sanctions
- promote good behaviour
- anti bullying strategy
39 of 140
When can an academy ask for payment/contributions?
Contributions - activities during school day (can't discriminate!)

Charge - optional extras
40 of 140
What can't an academy charge for?
- education outside of the school day if it is NC or has a public exam
- public exam
- admissions
- education during school hours
41 of 140
How often should the 'children with health needs who cannot attend school' policy be reviewed?
Annually and the Trust must have one
42 of 140
Who is the data controller?
43 of 140
What is the ICO?
Information Commissioners Office
44 of 140
What must the Trust do as Data controller?
register with the ICO
45 of 140
What are the 8 principles of Data protection act/GDPR?
1. personal data processed fairly and lawfully
2. obtained and used for only 1 purpose
3. data will be relevant and not excessive
4. data will be accurate and up to date
5. not kept longer than necessary
6. processed in accordance to rights of data subjec
46 of 140
How often must the Data protection policy be reviewed?
Every 2 years
47 of 140
How often must the exclusions policy be reviewed?
48 of 140
What must the home school agreement include?
- school aim and values
- school responsibilities to pupils education
- school conduct expectations for pupils
- parental responsibilities
49 of 140
What must the SRE policy include?
-definition of SRE
- Describe how it delivered and by who
- say how it is monitored and evaluated
- include info on parents rights to withdraw
50 of 140
How often should the Staff capability policy be reviewed?
51 of 140
How often should NQT policy be reviewed?
52 of 140
What must be included in the SEND policy?
- arrangements for disabled persons admissions
- preventative steps for disability discrimination
- supportive facilities in place
- accessibility plan
53 of 140
How often must the SEND policy be reviewed?
Annually by TB and updated as necessary
54 of 140
What informs the staff discipline, conduct and grievance policy?
ACAS statutory code of practice otherwise a tribunal can award 25% for failure to comply
55 of 140
What should be included in the 'Supporting pupils with medical conditions' policy?
- procedure to follow
- role of individual healthcare plan
- R&R of all involved
- How staff are supported/trained/assessed
- arrangements for competent pupils
- emergency procedures
-insurance details
- how complaints are made and handled
56 of 140
How often is the 'Supporting pupils with medical conditions' policy reviewed?
TB determine frequency but must be minimum every 3 years.
57 of 140
List the statutory documents required for a Trust
- Accessibility Plan
- Premises management documents
- Register of pupil attendance
- central record of recruitment/vetting
- minutes/papers
- register of pupil admissions to school
58 of 140
What is the aim of the accessibility plan?
- increase participation for disabled pupils in NC
- Improving physical environment
- Improve availability of accessible info
59 of 140
How often must the accessibility plan be reviewed?
Every 3 years
60 of 140
How long must minutes/papers be kept for?
Companies Act - 10 years

ICSA + Commission - lifetime of the company
61 of 140
What information must be kept in the register of pupils admission?
- Name, sex, parents, residence, DOB, admission date, last school.
62 of 140
Who is responsible for ensuring that all staff are safeguarding trained and DBS checked?
Trust Board
63 of 140
Should Trustees be safeguarding trained?
Yes "best practice" - Gov handbook
64 of 140
How are pupils taught safeguarding?
Through PSHE and online safety
65 of 140
What is the TB responsibility for Prevent Duty?
- Train all staff
- clear procedures in place
66 of 140
When must a referral be made to DBS?
When a colleague is removed for safeguarding reasons
67 of 140
What are Trustees responsibilities in regard to conflict of interests and declarations?
Trustees must avoid conflicts of interest and declare or gain prior agreement for financial transactions.
68 of 140
What is the payment bracket for RPT?
contract over £20,000 needs ESFA prior approval

RPT over £2500 must be 'at cost'
69 of 140
How many staff/Trustees are appointed as contacts for whistleblowing?
1 staff and 1 Trustee appointed by the TB
70 of 140
How to whistleblowers file reports?
To the ESFA.
- it is confidential unless there is a need to reveal the identity to further the investigation
71 of 140
When can the whistle be blown?
- criminal offenses
- failing legal obligations
- miscarriage of justice
- H&S endangered
- environment damaged
- deliberately concealing information
72 of 140
Under the FOI Act how is transparency ensured with public funds?
1. certain information is published
2. public can request other information
73 of 140
What information is shared in an FOI request?
- letters
- emails
- files
- audio/visual
- information stored by a third party for the Trust
74 of 140
What information is not shared in an FOI request?
Personal sensitive or Trade Union related data but an application can be made to access your own data.
75 of 140
What is the code of practice for Trusts to consider regarding FOI requests?
- Good admin practice handling requests
- protect applicants by setting standard and encouraging effective complaining
- consider third party interests in disclosures
- consider implications for FOI before releasing information
76 of 140
What determines how a Trust publicises information?
It must adopt a publication scheme which outlines:
- what is published
- how and where
- whether it is free or charged
77 of 140
How does someone request information?
a written request which includes the individuals real name, a description of the information requested and an 'address' for correspondence
78 of 140
Does an FOI request have to be specifically requested?
79 of 140
Does a reason for the FOI need to be provided?
80 of 140
Outline the timescale for an FOI request:
20 school days or 60 work days (shortest) starting the day the request was submitted
81 of 140
Can charges be made for FOI requests?
Some charges for communication (post) can be made but not for time spent on the request by staff
82 of 140
Can the Trust delay providing the information until any payments are made?
83 of 140
On what grounds can an FOI be refused?
- cost too much/too much time for staff
- vexatious
- a repeat request
84 of 140
What are the exemptions for information included in FOI?
- info would endanger an individuals wellbeing or safety
- info was given in confidence
- the info was intended for future publication
- Info available by other means
85 of 140
Can information be redacted in an FOI request?
Yes, elements can to ensure compliance.
86 of 140
What is the Data protection act?
It regulates the processing of an individuals data
87 of 140
What are the 'conditions for processing' that a data controller must demonstrate one of to legally process data?
1. subject consent
2. necessary for a contract with subject
3. necessary for legal obligation
4. necessary to protect subject vital interests
5. necessary admin for justice, statutory, Governmental or public functions
6. in accordance with 'legitimate int
88 of 140
What category of data is treated on a stricter basis?
Sensitive personal data
89 of 140
What is a SAR?
Subject Access Request
- someone can request any personal information
90 of 140
Outline the time scale for SAR:
request must be in writing and detail the information wanted, a response must be given in 40 calendar days.
91 of 140
What information can be withheld from a SAR?
- to prevent/detect/investigate a crime
- national security or armed forces
- assessment or collection of tax
- judicial/ministerial appointments
92 of 140
Can a parent access a child's information?
Yes but the child does hold the rights and releasing the information should be in their interests.

If they are 'mature enough' the request should go through the child.
93 of 140
What considerations should be given by Trusts around SARs by parents for their children?
- Is the child mature enough?
- What is the nature of the requested data?
- Are there court orders around the parents?
- what will be the consequences of releasing the data?
- will it be detrimental to the child?
- what is the opinion of the child?
94 of 140
Who does GDPR apply to?
Data controller and Data processors
95 of 140
What types of data does GDPR apply to?
- identifiable personal data
- Sensitive personal data
96 of 140
What is classed as sensitive personal data?
- race
- religion
- TU membership
- politics
- health
- sexual orientation
97 of 140
Is the DPO personally liable for compliance?
98 of 140
What is Article 6?
The lawful basis that must be determined and recorded for processing personal data.

- Trust must determine and document basis before processing!
- Trust must give privacy notice stating the basis
- 1 basis for general data and an additional lawful basis
99 of 140
List the lawful basis for processing personal data:
legal obligation
public task
vital interests
legitimate interest
100 of 140
What are the rights of an individual with regards to their data and GDPR?
- right to be informed about collection and use
- right to access data and verify lawfulness of use
- right to rectify inaccurate data (1 month)
- right to be forgotten (verbal/written, 1 month)
- right to restrict processing (1 month)
- right to data por
101 of 140
How old does someone have to be to give consent to their personal data being processed?
102 of 140
Who does the DPO report to?
103 of 140
What is the role of the DPO?
- advise on GDPR and data laws
- monitor compliance
- raise awareness, train staff
- conduct internal audits
- monitor and advise Data Protection Impact Assessment
- co-operate with supervisory official
- first point of contact
104 of 140
Who is the supervisory official for data processing?
ICO (information commission office)
105 of 140
What if a Trust is non-compliant with the Data protection act and GDPR regulations?
compensation can be sought and fines of up to £20 million or 4% of the world turnover.
106 of 140
What governance documents need to be published on the Trust website?
- funding agreement
- memorandum
- Annual report and accounts
- Name of Trustees
- Name of members
107 of 140
What contact details must be included on the Trust website?
- academy name, address, number
- name of staff who handles enquiries
- name of HT
- Name/address for the Chair
108 of 140
What sponsor details need to be on the website?
- full name and contact details


- address and officer number if organisation
109 of 140
When should the annual report and accounts be added to the website by each year?
31 January
110 of 140
What Careers info should be on the website?
- Careers offer & leader contact details
- policy statement outlining arrangements (reviewed annually)
111 of 140
When should the admissions appeals timetable for colleges be published on the website for each year?
28 February
112 of 140
What are the aims of the equality objectives?
1. eliminate discrimination
2. improve opportunities for those with protected characteristics
3. consult/involve those affected by inequality
113 of 140
What must a Trust publish on Gender pay gap reporting?
- 250+ employees must publish pay gap data

- the average gender pay gap
- the average (mean and median) bonus pay gap
- what portion of M/F employees receive a bonus
- What portion of M/F are in each pay band

Don't have to include a narrative
114 of 140
Who is responsible for preparing the Governance Statement in the Annual Report?
115 of 140
What must be included in the Governance statement?
New Trust - how they have developed their structure and composition of TB

Established Trust - assessment of Governance, review composition and effectiveness.
116 of 140
What is the aim of PE and Sport premium funding?
- Develop PE and sport offer for pupils beyond NC
- build and develop capacbility in staff
117 of 140
Does the SEND information report need to be an explicit document?
No can be included in the SDP
118 of 140
When must an organisation publish a slavery and human trafficking statement?
annual turn over of £36 million + supplying goods/services in UK.

Statement must outline steps taken to ensure not taken place and must be formally approved and signed by TB/Chair.
119 of 140
Explain TU facilities time:
Trust must publish TU facilities time data annually before 31 July.
- number of TU reps
- % working hours spent on facilities time
- % of total pay bill spent on facilities time
- time spend on paid TU activities as a %

Reps are allowed reasonable time o
120 of 140
What does AFH say about updating GIAS?
It should be done within 14 days
121 of 140
Who should be on GIAS?
- Members
- Trustees
- Chair
-Accounting officer
- Head
- Chair/LGB governors
122 of 140
How can the TB ensure that execs performance management is robust?
Set KPIs to monitor progress which are:
123 of 140
What kind of information can be used to set KPIs?
- Ofsted reports
- pupil performance data
- attendance
- finances
- % income on staffing costs
- staff performance reviews
124 of 140
What does the AFH say about KPIs?
- include them in the annual trustee report and the Trust must select financial KPIs and regularly analyse.
125 of 140
What is a SEF?
Self evalutation undetaken by executive (previously for ofsted, now voluntary) to outline priorities and risks.
126 of 140
Who is responsible for the executives performance management?
TB is responsible for the process and should make arrangements.

TBs often recruit an external advisor to manage the process how it is still Trustees meeting!
127 of 140
Outline the process for CEO performance management:
- CEO circulates evidence 1 week before appraisal
- any concerns = additional meeting where appropriate
- consider CEO wellbeing/life balance
128 of 140
What does AFH say about setting pay?
Setting Pay and benefits should be transparent, proportionate and justifiable.
129 of 140
List the features of an effective performance management:
- clear process
- independence
- robust decision making
- proportionality
- commercial interests
- documentation
- not increase faster than teachers
130 of 140
When can ESFA intervene on performance management?
Inappropriate pay and benefits can be challenged as the ESFA as mismanagement of funds.

- send a regular letter to Trusts paying exec salary over £150,000 or multiple salaries between £100,00-£150,000
131 of 140
What are some of the features of an effective Chairs 360 review?
- chair seeks feedback
- culture of taking ownership of development
- chair puts TB needs above ambition
- knowledge of various leadership styles
- sets challenging development goals
- leads performance reviews of TB/Committees
- open and honest with TB
132 of 140
What is the aim of an ERG?
- increase board skills, efficiency, focus
- work in different ways
- clear vision and how to achieve it
- board confidence in R&R
- helps hold board leaders to account
133 of 140
Who can carry out an ERG?
- Experience GP
- Experience of Outstanding Governance
- Experience leading SIP
134 of 140
When does the AFH recommend board's do a skills audit?
At key transition periods

- new chair, change in structure etc.
135 of 140
List how a TB can review governance?
- Annual review
- competency framework for Governance
- skills audit
- 360 chairs review
- 20/21 Qs for self review
- ICSA maturity matrix
136 of 140
Outline the competency framework for Governance:
1. all governors recognise strengths and weaknesses and develop
2. learn from others
3. development linked to strategic aims
4. open to training/opportunities
5. feedback from range of colleagues
6. undertake self review
7. evaluate GB impact on outcomes
137 of 140
Outline the ERG process:
1. initial discussion (reviewer/Chair/CEO) - context and agree dates
2. Gather docs for reviewer
3. Reviewer/Chair/CEO meeting
4. Reviewer meets Trustees
5. Board self evaluation conducted by reviewer
6. Areas for development agreed/action plan
7. TB embr
138 of 140
What are the 4 T's of risk management
139 of 140
Other than RAG rating a risk register how else might risks be presented?
On a heat map, additional colours used for important items TB should always review (I.e safeguarding).
140 of 140

Other cards in this set

Card 2


How can an academy mitigate risks?



+ must act on any advice from auditors

Card 3


How do academies estimate risk?


Preview of the front of card 3

Card 4


How is risk tolerance set?


Preview of the front of card 4

Card 5


What does the AFH say about risk?


Preview of the front of card 5
View more cards


No comments have yet been made

Similar Business Management resources:

See all Business Management resources »See all Risk Management resources »