Heighten awareness
Risk is not always at the forefront of schools’ considerations, warns Nick Websdell, head of enterprise risk management services at consultancy Barnett Waddingham
Risk is negative, usually not very exciting, and assumes the worst will happen. But it is important. Schools aren’t disconnected from risk, and when it strikes it can do so in very public and damaging way. Covid-19 was an example of that, and safeguarding is another.
Risk isn’t an area schools can afford to ignore, it’s actually quite the opposite. School leaders and governors need to understand the risks they face and the importance of having appropriate actions and controls in place to deal with them proactively.
Some of the challenges for independent schools in this area were highlighted by the chief executive of the Independent Schools Bursars Association, David Woodgate, in an article in Independent School Management magazine in February (‘Ride out the storm’, page 8). He highlighted that schools are generally becoming more business-focused, with greater precision deployed in financial planning and forecasting. But there’s still work to be done in improving the identification and management of risk, as well as having robust risk registers and processes in place.
Woodgate says risk should be on the minds of all those at senior levels – bursars, head teachers, senior leadership teams and the board – and I totally agree. It’s certainly something that features in the minds of parents, who are paying for the education and wellbeing of their children with the expectation that schools are well-managed, safe places.
Insights from bursars
Last year, Barnett Waddingham held a number of research calls with bursars to get a deeper understanding of risk management in schools. We found wide awareness of the need to improve risk management and a desire to do so. The following themes emerged from these conversations:
- Most schools have a risk register of sorts. Excel is the most common format, with some using Word.
- There’s a common theme that risk registers are static and are not referred to and used on an ongoing basis.
- Most described an annual or termly process where registers are dusted down, casually reviewed, and then put back on the shelf until next time.
- There is a general view that risk registers are not being used to inform decisions and priorities.
- Without exception, there is limited time and resource available to ‘do’ or keep on top of risk management processes.
- Risk reporting and related processes are time-consuming and inefficient. No one provided positive views on risk reporting.
The shifting role of risk in organisations
Risk management was once the preserve of banks and financial services businesses, where it has long been a critical activity, because regulators insist upon it. It’s now increasingly expected across all other sectors where it is seen as a useful and important tool, not to mention a regulatory requirement in some cases. After all, what organisation wouldn’t want to understand what could go wrong and make informed decisions about what to do to prevent these things happening, or be prepared to respond effectively when they do happen?
Preparing to respond is important because things will happen – it isn’t realistic to think you can remove risk completely. Taking the opportunity to put proactive continuity and recovery plans in place, and ensure these are understood and up to date, is an example of good risk management.
Risk management also isn’t something you do once or on an annual basis. To be effective and maximise its value, it needs to be dynamic and reviewed and updated regularly.
A key challenge for schools
A key barrier to effective risk management in schools is that bursars are busy people – they have a wide range of different priorities competing for their time. I think it’s also true to say that, generally, bursars have relatively limited experience of the tools, processes and techniques associated with risk management.
When looking to implement and maintain good risk management processes in schools, it’s important to ensure proportionality. Risk is always going to be around, the skill is not to over-complicate it.
Given the time and resource constraints, risk management must be easy to ‘do’. At its most basic, this is just about understanding what can go wrong and putting appropriate and proportionate controls and responses in place.
At Barnett Waddingham, we recognise the challenges bursars and schools face and that’s why we have developed our own risk management software tool, Celestia Risk, which enables schools to be more proactive in identifying, managing and communicating risk through visually engaging reports.
Through research and collaboration with independent schools, we have pre-populated Celestia Risk with 15 standard risks grouped into five different categories. These standard risks cover the universe of risks facing schools. While each school is unique, schools also have lots in common and need to respond, broadly to the same set of risks. The categories are:
- Operational – covering areas such as the ability to recruit and retain staff, business continuity, technology, data protection, and premises and accommodation.
- Legal/regulatory – covering breaches of laws, regulations or standards, including health and safety.
- Education – covering the provision of education and the relationships with parents/carers.
- Strategic, business and financial – risks relating to the management and governance of the school and the political/macroeconomic challenges facing schools.
- Safeguarding and welfare – a clear area of focus and priority for all schools.
Celestia Risk produces reports for a variety of audiences and committees and can go a long way towards removing the mystery of risk management and certainly make it easier to ‘do’.
Celestia Risk also provides access to a risk portal with a wide range of resources, such as e-learning, guides, templates and toolkits all aimed at helping schools enhance their risk management and resilience.
Overall, risk management really is hugely important. Understanding your key risks, clearly reporting on them, and making informed decisions to manage them should be a must, not an optional.
Nick Websdell