According to the 2019 Academies Financial Handbook, each Academy Trust must have a Risk Register and maintain it, as a key part of the Internal Audit and Security processes.

EFSA requires all Academy trusts to comply with the handbook as a condition of their funding agreement.

A Risk Register, if you have never managed one, is not particularly complicated and is a “Living document” used to manage projects and operational risks. There are any number of views on what should comprise a Risk Register, but in our experience, these should form the core:

  • Risk Identifier
  • Date Identified
  • Date Closed
  • Risk Description
  • Probability
  • Impact
  • Risk Score
  • Mitigation
  • Risk Owner
  • Date Updated
  • Updated Probability
  • Updated Impact
  • Updated Risk Score
  • Residual Risk

Other options include the acceptance of probability and impact, but if this is the first Risk Register that you will use or manage, the above will provide a good starting point.

Many Academy Trust Risk Registers omit Residual Risk. We consider this to be a critical element as there are instances where, even after treatment, for example enhancing IT Security to minimise the chance of a cyberattack, the risk will remain as cyber criminals become more sophisticated.

You may have notice that we have not covered what needs to be included in the Academy Trust Risk Register. These will be all the risks that pertain to your Academy. These may relate to Academy Trips, Compliance, Facilities Management, Health and Safety, IT Infrastructure, Safeguarding, Staff Issues and a plethora of External Threats.

The easiest way of identifying these risks is by conducting a Risk Assessment which should result in determining the probability and impact of each threat which will provide a (risk) score which, in turn, will identify the severity of each risk.

For those of our Academy Trust clients who are recording incidents in the MIMS, it should be possible to identify trends, e.g. incidents that occur in the same place or at the same time of day and this may enable the identification of some risks. However, this is no substitute for conducting a Risk Assessment in order to accurately populate the Risk Register.

To assist Academy Trusts in creating a Risk Register, Continuity West has a detailed Risk Assessment which comprises a one-day workshop with a target attendance of Decision Makers from the key disciplines within the Academy and Trust Board.