Internal Scrutiny for UK Schools: What It Is and How to Evidence It

Internal scrutiny is an independent check on whether a school's controls and risk-management arrangements are appropriately designed and working in practice. It tests the system, identifies weaknesses and gives the governing board assurance it cannot obtain from management reporting alone.

The phrase has a precise regulatory meaning for academy trusts. The Academy Trust Handbook requires every trust to maintain a programme of internal scrutiny covering financial and non-financial controls and risk management. Maintained schools operate differently: their governing bodies complete the annual Schools Financial Value Standard (SFVS), work within the local authority's scheme for financing schools and receive audit through arrangements made or commissioned by the authority. A maintained school may arrange additional independent review, but it should not assume the academy handbook's delivery rules apply to it.

That distinction matters when a school describes its arrangements as DfE compliant internal scrutiny. Compliance means following the current framework for the school's legal status, not borrowing a label from another framework.

Internal scrutiny, external audit and SFVS are different

These three forms of assurance are related, but they are not interchangeable.

Internal scrutiny is a planned review of selected controls and risks. It can test whether purchasing approvals are followed, payroll changes are authorised, reconciliations happen on time or risks are being reported accurately. It should produce findings, recommendations and evidence of follow-up.

External audit is a separate assurance engagement. Academy trusts appoint an external auditor to report on their annual accounts and a reporting accountant to provide a regularity conclusion. The external auditor does not take ownership of the trust's internal scrutiny programme. Maintained-school accounts sit within the local authority's accounting and external-audit framework, while the authority's internal audit service may inspect individual schools.

SFVS is an annual self-assessment for local-authority-maintained schools in England. The governing body considers its financial management, governance, controls and value-for-money arrangements, agrees the return and submits it to the local authority. SFVS is neither an external audit opinion nor a substitute for audit work. It should be supported by real records, including previous audit findings and the actions taken in response.

Who can conduct the work?

The right reviewer depends on the school's status, size, risks and local rules.

A local-authority internal audit service commonly reviews maintained schools, either directly or through a provider commissioned by the authority. The school's scheme for financing schools and local audit plan should clarify the arrangement.
An external contracted reviewer can provide bought-in internal audit or specialist scrutiny. Academy trusts may use this option under the handbook; maintained schools should confirm the scope and authority for any additional review with their local authority.
An independent governor or non-employed trustee with relevant expertise may be suitable in some circumstances. For academy trusts, the handbook expressly permits a suitably qualified or experienced non-employed trustee, subject to its restrictions and the trust's size. A maintained school using a governor for an additional review should document competence, conflicts and why the arrangement is sufficiently objective.

Academy trusts can also use an in-house internal auditor or, where permitted, an independent peer review by a chief financial officer from another trust. Larger trusts face tighter requirements, so every trust should check the current handbook rather than rely on a generic list.

Independence from day-to-day management

The reviewer must be able to reach and report conclusions objectively. Someone should not test a control they operate, approve transactions they later review or depend on the manager whose work is being examined.

For academy trusts, internal scrutiny must not be performed by members of the senior leadership or finance team. The scrutineer reports directly to the audit and risk committee, which provides assurance to the board. For maintained schools, the governing body should preserve the same practical separation between operational preparation and governance challenge: a governor with financial skills may scrutinise accounts but should not help prepare them.

Before work starts, record the reviewer's role, qualifications or relevant experience, any conflicts of interest, reporting line, access rights and terms of reference. Independence is evidenced by the arrangement as a whole, not just by calling the reviewer "independent".

What a useful programme should cover

Start with risk, not a recycled checklist. The board or responsible committee should consider the risk register, previous audit reports, control changes, financial pressures and unresolved incidents. It can then approve a proportionate scope for the year.

Possible topics include procurement and tendering, payroll amendments, bank reconciliations, purchasing cards, income collection, assets, segregation of duties, cyber controls, related-party transactions and the accuracy of information used for funding. The scope should say which period and systems will be tested, the sample approach, who will provide records and when findings will be reported.

Academy trusts should spread work appropriately across the year and give the audit and risk committee regular updates. Maintained schools should follow the local authority's audit cycle while monitoring controls continuously. There is no sound governance case for waiting until an annual return is due before checking whether known weaknesses were fixed.

Building an evidence trail

A credible file shows the complete assurance cycle, not only the reviewer's final report. Keep:

the board- or committee-approved annual plan and its risk rationale;
terms of reference, engagement letter and evidence of reviewer competence and independence;
the records requested, tests performed and management responses;
the report, with findings graded where appropriate and clear recommendations;
minutes showing questions, challenge and decisions;
an action log with named owners, deadlines, status and closure evidence; and
follow-up reports confirming that completed actions were tested, not merely declared complete.

Store sensitive working papers with appropriate permissions and retention controls. The board pack can contain the report and action summary without exposing unnecessary personal or security-sensitive detail.

Reporting findings to the whole board

Committee review does not remove the board's overall responsibility. Findings should reach the full governing body or board of trustees promptly, with serious issues escalated immediately. Academy trust audit and risk committees must report on the adequacy of controls and risk management, and internal scrutiny findings must be available to all trustees. Maintained-school governing bodies should receive audit reports and regular progress reports on outstanding actions.

Minutes should capture what assurance was received, the questions asked, whether management accepted each recommendation, the owner and due date, and how closure will be verified. A finance committee noting a report without a route to the full board is an incomplete evidence trail.

A practical termly routine

At least termly, the responsible committee can review new risks, delivery against the plan, overdue actions and emerging themes. The full board should receive a concise assurance update and make any decisions outside the committee's delegation. At year end, academy trusts need the required annual summary and external reporting; maintained schools should use the evidence when completing SFVS and responding to local-authority audit.

The strongest arrangement is visible in ordinary governance records: planned work, independent testing, candid findings, board challenge and verified improvement. That is more persuasive than a certificate assembled for an inspection or submission deadline.

This article provides general governance information for schools in England and is not legal, accounting or audit advice. Requirements differ between maintained schools and academy trusts and change over time. Check the current Academy Trust Handbook, DfE SFVS guidance, your local authority's scheme for financing schools and professional advice before deciding your arrangements.

Frequently Asked Questions

What is internal scrutiny in a UK school?

Internal scrutiny is a planned, objective review of whether financial and other controls and risk-management arrangements are suitably designed and working in practice. Academy trusts must run a programme under the Academy Trust Handbook. Maintained schools instead work within their local authority's audit arrangements and complete the annual SFVS.

Who can carry out internal scrutiny?

Depending on the school's legal structure and the applicable rules, work may be performed by a local-authority internal audit service, a bought-in internal audit provider, an appropriately experienced non-employed trustee or governor, or another permitted independent reviewer. The reviewer must have suitable skills and must not be reviewing their own day-to-day work.

What is the difference between internal scrutiny and external audit?

Internal scrutiny examines selected controls and risks during the year and recommends improvements. An external audit is a separate statutory assurance engagement focused on the annual accounts and, for academy trusts, regularity. One does not replace the other.

How often should internal scrutiny take place?

Academy trusts should approve a risk-based annual programme with work spread across the year and reports provided to each audit and risk committee meeting. Maintained schools should follow their local authority's audit cycle and scheme, while reviewing financial controls and unresolved findings throughout the year rather than waiting for the annual SFVS return.