When Risk Management Fails

🛡️ Safeguarding and Compliance Drift

Safeguarding failures remain one of the most serious risk categories for schools. Published ESFA (formerly EFA) investigation reports have repeatedly identified patterns where compliance controls deteriorated over time without adequate board oversight.

The Cuckoo Hall Academies Trust investigation (published 2016) identified significant failings including: incomplete Single Central Record (SCR) checks, inadequate DBS verification processes, fire safety compliance gaps, and insufficient risk assessment procedures. Critically, the investigation found that these risks had not been adequately escalated to trustees, and risk registers were not being maintained as live documents.

The trust was subsequently rebrokered, with schools transferred to new sponsors.

🏗️ Estates and Building Safety: The RAAC Crisis

In August 2023, the Department for Education issued urgent guidance requiring schools to identify and mitigate risks from Reinforced Autoclaved Aerated Concrete (RAAC). This lightweight concrete, used widely in school buildings from the 1950s to 1990s, had been found to pose structural risks including sudden collapse.

The resulting disruption affected over 200 schools and colleges at its peak, with some institutions requiring partial or full closures, emergency decanting of pupils, and significant business continuity challenges. Analysis from the Education Policy Institute highlighted that many trusts had limited visibility of their estates risk profile, with condition surveys incomplete or outdated.

Key lessons included: the need for systematic estates risk identification, integration of building condition data into board-level risk registers, and robust business continuity planning for premises-related disruption.

📋 Governance After a Major Incident

When a significant incident occurs—such as a school fire—the aftermath often reveals weaknesses in risk management, insurance arrangements, and board oversight that had previously gone unnoticed.

The Vantage CE Academies Trust received a Financial Notice to Improve (FNtI) following a school fire in 2019. The subsequent ESFA investigation identified that the trust had inadequate insurance arrangements, with cover insufficient for the actual reinstatement costs. The investigation also found breaches of the Academies Trust Handbook relating to financial management, internal control, and governance oversight of residual risk.

This case illustrates how risks that appear theoretical can crystallise rapidly, and how gaps in board-level risk oversight only become apparent when incidents occur.

💻 Cyber Security and Operational Disruption

Ransomware and cyber attacks on UK schools and trusts have increased significantly in recent years. The National Cyber Security Centre (NCSC) and Department for Education have issued specific guidance for the education sector, recognising schools as attractive targets due to the sensitive data they hold and often limited IT resources.

While many incidents go unreported, several high-profile cases have been widely covered. Large multi-academy trusts have reported recovery costs running to six figures following ransomware attacks, with disruption lasting weeks. In some cases, exam data, safeguarding records, and financial information have been compromised or encrypted.

The common theme in post-incident reviews is that cyber risk was not being treated as a board-level concern. Risk registers either omitted cyber entirely, or recorded it without clear ownership, controls, or residual risk assessment. When attacks occurred, there was no documented business continuity plan for IT systems failure.

📊 Why Spreadsheet-Based Risk Registers Fail

Many trusts still manage risk using spreadsheets shared via email or stored on network drives. While this approach may work initially, it creates systemic vulnerabilities that become apparent under scrutiny or during incidents.

Common failure patterns include:

• Stale data: Review dates pass without action; the register becomes a static document rather than a live management tool
• No clear ownership: Risks are logged but nobody is accountable for monitoring controls or escalating concerns
• Version control problems: Multiple copies circulate; it's unclear which is current or authoritative
• No audit trail: When auditors or regulators ask what was known and when, there's no evidence of the evolution of risk assessment
• Weak board reporting: Collating data for board packs requires hours of manual work; residual risk trends are invisible
• Siloed view: Each school maintains its own register; the trust lacks visibility of common risks or emerging patterns

These weaknesses feature repeatedly in ESFA investigation reports and audit findings. A Financial Notice to Improve often requires trusts to demonstrate improved internal control—including risk management—and spreadsheet-based systems rarely provide the evidence required.