We offer the most comprehensive, expert-led suite of internal audit services available to the academy sector. There is no area of a trust’s operations that our services do not reach.
Each audit plan is tailored to the trust, producing a risk-focused programme that balances assurance needs against budget — every programme drawing on first-hand sector experience and our shared mission of improving outcomes for learners.
Our Internal Audit Coverage
Finance
- Key financial controls: audit of purchasing, procurement, payroll, income, credit cards, petty cash, staff expenses and reporting accuracy. We test a risk-based sample following a review of the year’s transactions to identify non-compliance with financial regulations, ATH requirements and approved budgets.
- Budgeting, forecasting and financial reporting: a review of budgeting, forecasting and reporting procedures, including how well they integrate with educational plans and the usability and accuracy of outputs to trustees and leadership.
- Financial reporting: review of board reporting packs against regulatory requirements and user needs, including interviews with key users to assess how well current reporting is understood and valued, and benchmarking against best practice.
- SEND income: review of central controls ensuring SEND income from local authorities is complete and reasonable against associated costs; where required, assurance over the adequacy of SEND interventions and reporting.
Education
- Safeguarding: conducted by our education specialists — experienced Ofsted inspectors, DfE consultants and executive headteachers — alongside our audit team. Scope typically includes site visits, review of key systems, audit of the Single Central Record, and assessment of filtering, monitoring, reporting and escalation. Where a trust runs its own safeguarding inspection process, we can review its methodology, findings and remediation to provide trustee-level assurance in line with ATH requirements.
- School Improvement: specialist-led assurance at trust-wide and academy level, on-site or remote. Where school-improvement assurance is provided trust-wide, we consolidate key risks identified by school-improvement officers into a single internal audit engagement, assess the skills, competence and independence of advisers, and review how school-improvement contracts are procured — producing findings suitable for audit-committee reporting and DfE submission.
HR
- HR processes: detailed audit of recruitment and onboarding, and adherence to both KCSIE and UK employment law.
- Recruitment and retention (including absence management): retention, absence and supply-cover costs are a key risk for all trusts, especially in teaching and executive roles. Our approach gives trustees assurance that these risks are managed, including adherence to return-to-work and staged formal reviews.
- Payroll: as the most material area of trust expenditure, payroll is a key risk requiring regular focus — particularly following significant system change.
ICT
- Trust-wide ICT overview: trusts have been targeted by numerous cyber-attacks, and the ATH now requires cyber risks to be considered and managed. We cover hardware and software risks (back-ups, redundancy, personal devices and disaster recovery) and staff training in ICT use and cyber awareness.
- ICT detailed assurance: on-site audits of device use, security protocols versus those expected, and hardware/software registries verified first-hand, plus assessment of user knowledge and training to gauge how consistently good practice is embedded.
- Both ICT audit types include dark-web scans to identify compromised passwords.
Estates
- Capital funding compliance: the ATH requires the audit committee to gain assurance that funding claims to the DfE are accurate. This audit focuses on capital claims and compliance with grant terms and conditions.
- Asset management and estates: assurance over controls for managing and recording trust assets — including grant compliance, expenditure against policy, strategic estates planning, authorisation of capital spend, record-keeping, management of capital programmes and associated reporting.
- Health & Safety: review of statutory testing and monitoring; consolidation of the latest inspection findings into an audit-ready format; review of estates investment plans against financial forecasts and H&S findings; interviews with the estates team and core suppliers; review of provider competence; and audit of incident-reporting data.
Governance
- A key area of risk and of focus for the DfE and Ofsted, and one that can affect a trust’s ability to gain approval to grow. We review the governance framework against the Academy Trust Handbook, the Governance Handbook and associated guidance (including the NGA’s), and can extend scope to assess governance effectiveness at both trust and local level.
Risk Management
- The risk register is the foundation on which internal assurance sits. We review it against the DfE’s current recommended practice, helping embed risk management into the governance and reporting framework in support of the trust’s strategic objectives.
Compliance
- ATH “musts”: regulatory requirements a trust must meet to comply with the ATH and its funding agreement. We review each “must” (Part 8: Schedule of requirements) and provide detailed traffic-light findings.
- GDPR: compliance failures can bring significant fines and reputational damage. Delivered by our audit team with our GDPR specialist, who has extensive data-compliance and consultancy experience.
- Website compliance: review of ATH website requirements, of each academy’s website for full compliance, and of formatting/branding consistency across the trust.
Strategy
- Central services and capacity to grow: during growth, the central team needs the capacity to support it. We benchmark current central capacity against trusts across the sector through market research.
- Succession planning: changes in senior roles such as CEO carry inherent risk given the strategic nature of the role and the CEO’s responsibilities as accounting officer. We review the procedures around delivery and recording of succession initiatives and the appropriateness of trustee monitoring.
- Due diligence: acquiring a new academy or free school is among the riskiest decisions a trust makes. We ensure there is a robust process of information-gathering and assessment so trustees and management are fully informed before committing.