Many schools have risk registers and provide reports on these registers to the school governing body or executive team. Sometimes, often due to schools focusing only on some components of their risk management system, these risk register miss crucial information that would assist schools to manage their risks much more effectively.

Having a Risk Register Is Not Enough

Having a risk register that has identified the key risks in the school should not give you any comfort that those risks listed on the register are being effectively controlled. Yet some schools take the view that having a risk register is all that they need to do in the area of managing risk.

The development of a risk register is really only the first step in managing risk. Risk management is ongoing, iterative and cyclical. You never arrive at a point of risk maturity. The essence of risk management is the ongoing continuous improvement and evaluation of your risk management systems and practices to enable you to better control your risks, identify new and merging risks, and, as a result, help you achieve your objectives.

Have You Identified Risk and Properly Implemented Controls For Each Risk?

Many schools fail to identify specific risk controls for each risk. For example, for a child protection risk, a specific control is ensuring that all staff undertake training in this area and that background checks and Working with Children Check clearances are obtained.

Where risk controls are identified, some schools list risk controls that they are planning to put in place but have not yet done so or fully implemented them. If you have risk controls in those categories on your risk register, what are you actually rating as your residual risk (the risk that remains after controls are implemented)? Are you rating the residual risk on the basis that all of the controls including the ones that are planned and not yet implemented will be done effectively? If you have not actually implemented a particular risk control then it is not a risk control that should be considered when determining your residual risk rating.

If you manage risk in your school, you will know that one of the issues of most concern is knowing whether the risk controls are actually being implemented effectively. Are the people that are required to implement risk controls actually implementing them? And, is the implementation of the controls resulting in changed behaviours that support or enhance the culture of your school?

COVID-Related Risk Controls

In the current COVID-19 pandemic environment, knowing that risk controls related to reducing the spread of infection are being effectively implemented is crucial. Given the large number of ‘COVID safe’ systems and procedures that schools must implement to control the COVID risk, it is perhaps more important than ever that those responsible for these risks are able to get some ‘assurance’ that the risk controls are working and being undertaken correctly.

Risk Control Assurance Information

The idea of assurance in risk management is a term in wide usage by risk management professionals. It refers to the information and systems that an organisation develops to validate and verify that risk controls are being effectively implemented and also that they are producing the desired risk control outcome. It also refers to systems that capture data that help an organisation to monitor whether these controls are working. Sometimes this information is classified as lead and lag risk indicators, key risk indicators, root cause analysis information and so on.

Getting Started

While the complexities of risk control assurance information are worth exploring, the most important thing is to get started. The starting point is making sure that, for each risk in your risk register, you identify the risk control assurance information that you need to help verify and validate that the risk controls are working. In a school context the most obvious first data source is data from incident reports, whether these are incidents and accidents resulting in injuries to staff, students, visitors and volunteers etc, reporting near misses or reporting health and safety hazards. The data from these sources can provide information that will be useful in determining whether risk controls for some important risks are actually working effectively.

Right Information, Right Time, Right People = Good Decisions

Gathering the right risk control assurance information is vital if your governing body and executive team are to have the information that they need to make good risk management decisions.

All of these issues and much more will be discussed in the next webinar in our risk series…

Free Webinar: Reporting – Verifying that Your School Risk Controls are Working, So You Can Sleep At Night

In this practical webinar, Jonathan Oliver and Craig D’cruz discuss the missing link in risk management in schools – assurance! 

This webinar is one in a 5-part series on School Risks. Access all five webinars here.