According to Riskonnect

“Without a doubt, compliance and risk management are closely aligned: Compliance with established rules and regulations helps protect organizations from a variety of unique risks, while risk management helps protect organizations from risks that could lead to non-compliance—a risk, itself.”

A previous School Governance article noted that:

“a school must have in place and implement policies and procedures that describe their school's legal compliance process to facilitate the school's compliance with all relevant legislation and reduce any risk of non-compliance. They also require a risk management framework or plan for developing, implementing and reviewing risk management strategies in relation to strategic direction, governance, operations and finance and the associated risk register.”

Anyone who has ever been involved in the management or leadership of a school will immediately recognise the extent of the governance, risk management and compliance challenges that schools now face. There is no doubt that non-government schools are heavily regulated. Not only do most schools need to comply with a detailed set of registration guidelines, against which they are assessed at least every five years, they are also subject to multiple other legal obligations, for example, workplace safety and privacy. The regulators have been empowered to work with, or impose sanctions on, those organisations that don't comply, thus heightening the issue of compliance for schools.

However, in very simple terms, I would argue that compliance is what schools must do for today to remain registered and to comply with other legislative requirements, and risk is how they manage tomorrow.

In this article, we will review the issues of compliance and risk from a different perspective-through the lens of the roles of the principal and the deputy principal of a school.

Defining the Roles: the Deputy Principal

In 2016, in School Governance “The Role of the Deputy Principal: When you are Up to Your Neck in Alligators, it’s Hard to Remember the Original Objective was to Drain the Swamp" we wrote:

“Being the deputy principal of a school is usually seen as part of the transition to a principalship; but it is more than a high-level apprenticeship…The deputy principals need to be able to develop skills that are transferable not only between schools but also between the role of a deputy and the role of a principal- and they are remarkably different.”

The role of a deputy principal varies in nearly every school. Within this article we quoted that some of the day-to-day tasks include:

• working closely with the principal on a daily basis to ensure the smooth overall operation of the school
• supporting committees of staff and parents that function to improve the learning and social environment of the school for the students
• teaching classes and developing rapport with the students
• resolving conflicts between students, teachers and/or parents
• assisting in annual teacher evaluations, assisting in providing guidance to staff and students, and encouraging a positive culture in the school
• developing emergency response plans for schools as required by regulators
• record keeping as required through the use of various logs, tracking records, computer programs, inter or intranet software or other programs.

Isn’t it interesting that the bulk of these duties could be considered to be compliance tasks-that is, tasks that are being done “for today”?

As a matter of fact, I would argue, having been a deputy principal and a principal, that the deputy principal’s role is to manage the day-to-day workings of the school. Their job consists of dozens of interruptions. They need to ensure that children are attending and behaving, staff are in their classes and delivering the educational program and that all the administrative business of running a school is being carried out by the people who report to them. Many non-government school deputy principals and business managers must feel that they are ‘compliance Olympians’.

I would argue, therefore, that one of the major components of the role of the deputy principal is to ensure daily compliance. The deputy principal uses most of their waking hours living in the present- dealing with the daily matters and, also perhaps, planning for events that will take place within the next few days, weeks or maybe a month or two. Yes, day-to-day risks must be addressed and managed, but the deputy’s role is to keep the machine running. And it is not easy.

Defining the Roles: the Principal

So, if the deputy principal is tasked with keeping the school running and keeping it compliant, what does the principal do?

The principal, although very much a ‘presence in the present’, works in the future-they manage the risks of tomorrow. This advice was given to me by a principal with many years of experience when I first took on a principalship in 2005. I believe that this advice is as sound today as it was 16 years ago.

The role of the principal is to lead the school, to embody the culture (not to determine it) and to oversee the works of the deputy principal, business manager and all the staff. Additionally, it is the principal that is tasked by the governing body to implement and manage the requirements of the school’s strategic plan. To do this, a principal must be planning at least three to five years ahead. The successful implementation of a school’s strategic plan, and hence the overall management of its strategic risks, can only be effectively accomplished through strategic risk management. Without this forward planning and management of risk, how then can the school progress and grow?

In another School Governance article “Why be a School Principal?” we stated:

“Traditionally, the role is like being the chief executive officer and the face of the school. The principal hires the staff, evaluates them and manages professional development, interprets directives from the board, manages risks and balances the budget.”

According to About Education, the Characteristics of a Highly Effective School Principal are:

• A principal must be a visionary.
• A principal must exhibit leadership.
• A principal must be adept at building relationships with people.
• A principal must balance tough love with earned praise.
• A principal must be fair and consistent.
• A principal must be organised and prepared.
• A principal must be an excellent listener.

Of these matters, the role of being a visionary is listed first and foremost. As we noted earlier, the principal is tasked with ensuring that the strategic plan and the strategic risks identified by the governing body are managed effectively and that strategic targets are reached.

School regulators are looking to see that schools have systems and processes in place for the identification and management of risk. This usually includes a risk management framework and overarching risk management policy, a risk register or registers, evidence that risk controls have been implemented and risks have been regularly reviewed and updated. They also want to know whether school governing bodies and the school principal have been engaged in the risk management processes through (for example) receiving reports, examining operational and strategic risks and reviewing the effectiveness of risk controls.

This can only be done with forward thinking and planning-by identifying the risks that may stop the school from reaching its goals (the ones that will sink your ship) and planning how to manage the risks. Within the school leadership team, this buck stops with the principal.

What Should Schools Be Doing?

While it is known that many schools spend considerable time and expense bringing all their documentation up to speed in the period prior to registration inspection, it is important to recognise that most registration standards in most jurisdictions now reflect a continuing compliance obligation, not a compliance hurdle to be jumped every four or five years.

Schools, therefore, should be moving from a ‘reactive’ state, where policies, procedures and other risk controls are updated only in the three to six months prior to the re-registration audit, to a process of ongoing compliance- which is far more proactive and will greatly reduce the stress associated with registration audits.

In addition, risk management should not be new to schools. Student duty of care, workplace health and safety and the principles of excursion planning, for instance, all require risk assessments to be undertaken. However, for schools looking to establish a robust risk management system, it is recommended that they look to the international standard - ISO 31000:2018 for guidance. This standard is highly regarded and has been adopted by a broad range of organisations in Australia and internationally. Critically, it sets out a detailed methodology that schools and other organisations can follow to establish a risk management program that works in practice.