School Governance
Assurance Framework
Assurance Framework
Structured governance assurance for UK school governing boards.
Structured governance assurance for UK school governing boards.
A governance risk register built around ten categories from the Orange Book and DfE guidance. Score it your way, record a treatment and an owner for each risk, and watch principal risks surface for the board. For an academy trust, every school's register rolls up into one heatmap and a board-ready paper.
A risk register is meant to be the document that focuses the board on what could go wrong and what is being done about it. In most schools it has become a static spreadsheet, written once, filed away and opened only when an inspector asks for it. The risks are listed, but nobody is acting on them.
Worse, it sits apart from everything else the board already holds. The signals are right there in the Headteacher Report, the School Data Check and the website audit, but the register never picks them up. So the board reviews risk in one meeting and the data that should inform it in another, and the two never meet.
The Risk Register puts that right. Ten clear categories, scored the way your board prefers, with a treatment and an owner against every risk. Principal risks surface on their own. And because it draws candidate risks from the data you already hold, the register reflects the school as it actually is, not as it was when someone last had time to update it.
Every risk a governing board carries falls into one of ten categories, modelled on the government's own risk taxonomy in the Orange Book and DfE guidance for schools. Nothing important is left without a home.
Child protection, KCSIE duties, single central record, culture and reporting.
Budget setting, reserves, in-year position, controls and value for money.
Roll against capacity, intake, in-year movement and forecast viability.
Condition, compliance, capital works, health and safety of the premises.
Recruitment, retention, capacity, wellbeing and leadership succession.
Attainment, progress, curriculum quality and outcomes for every cohort.
Board capacity, skills, compliance, decision quality and oversight.
Data protection, system resilience, online safety and information security.
Public confidence, complaints, communications and standing in the community.
Business continuity, emergency planning and the school's response to disruption.
A single school usually wants a clear status it can read at a glance. An academy trust usually wants a defensible score it can compare across schools. The register supports both, and the amber and red thresholds are set by the trust.
Each risk is marked green, amber or red. Fast to keep current, easy for every governor to read and exactly what most single-school boards want to see on the page.
Each risk is scored on likelihood and impact, plotting onto a five by five matrix. The trust sets where amber begins and where red begins, so every school's scoring is consistent and comparable.
Likelihood across the bottom, impact up the side. Thresholds are configurable per trust.
A score on its own tells the board what is wrong. The register goes further, recording what the board has decided to do, who owns it and how it is moving.
The board's chosen response to the risk, recorded against each entry.
Whether the risk is getting better, getting worse or holding steady since the board last looked.
The named person accountable for the risk, so no entry is left without someone responsible for it.
When the risk is due to be looked at again, so reviews are scheduled rather than forgotten.
Marks the risks significant enough to be put in front of the governing board, the ones that become principal risks.
What the school will do if the risk materialises, captured alongside the mitigation already in place.
Principal risks surface on their own. Any risk flagged as board-reported, or scored outside the trust's stated appetite, is extracted into a principal risks list, so the board sees the risks that matter most without hunting for them.
The signals that point to risk are already in your other tools. The register reads them, proposes candidate risks for the board to weigh and, where the board agrees, records them. Nothing is ever added without a person deciding.
Termly numbers that point to emerging pressure.
Published figures flagged against national benchmarks.
Compliance findings that carry governance risk.
Suggestions from each source are pulled together and de-duplicated, so the board sees one clean shortlist of candidate risks rather than the same concern raised three times.
There is no rule engine quietly writing risks in the background, and the register does not populate itself. It surfaces candidates for the board to consider, and the board stays in control of what its register says.
For an academy trust, the register is most powerful at the centre. Each school's register rolls up into a single heatmap and a board-ready paper, so the central board sees risk across every school at a glance.
Schools down one side, the ten categories across the top. The colour in each cell shows where each school stands, so the board can scan the estate and see at once which schools and which categories need attention.
When the work is done in the tool, the documents come out finished. No reformatting, no copying figures into a template the night before the meeting.
The full register for a single school as a Word document, every category, score, treatment and owner laid out for the file or the meeting pack.
A board-ready paper for the central board, leading with the principal risks across the estate and the decisions in front of the board.
The trust-wide heatmap as a spreadsheet, schools by categories, ready to share, filter or fold into the trust's own reporting.
The register is where the operating system’s warnings become decisions. What the other tools notice, the board weighs here and acts on.
As risks are mitigated and closed, the register becomes a living record of the board doing its job, clear evidence of active oversight across the year.
Your Headteacher Report, School Data Check and Website audit each surface candidate risks for the board to weigh and, where it agrees, record. The board decides; nothing is added without a person.
School registers roll into one trust heatmap and a board-ready paper, so the central board sees principal risks across every school at a glance.