The education sector continues to operate in a fast-changing and uncertain environment. For academy trusts, a combination of evolving regulatory expectations and ongoing economic pressures is creating a complex risk landscape.
Effective risk management has never been more important. The latest Kreston Academies Benchmark Report 2026 highlights that trusts consistently cite three key areas of concern: financial sustainability and funding, pupil numbers and demographics, and workforce challenges.
These are not new risks, but they are becoming more pronounced. At the same time, new and emerging threats, such as cyber security, are adding further complexity. In this environment, the ability to anticipate challenges and respond with confidence is critical.
This is where internal audit has an increasingly important role to play.
It is no surprise that financial sustainability and funding continue to top the list of risks for academy trusts. For several years, funding has struggled to keep pace with inflation, while costs continue to rise across multiple areas.
Estate maintenance, utilities and SEND provision are placing additional strain on budgets. At the same time, trusts must balance financial pressures with the need to attract and retain talented people, including meeting expectations around pay.
Combined with tighter reserves, cashflow pressures and, in some cases, in-year deficits, these factors create a challenging financial outlook.
Internal audit can provide valuable assurance in this area. By reviewing financial controls, reporting processes and forecasting assumptions, trusts can ensure their financial information is accurate, robust and compliant. This in turn supports better decision-making, helping leaders to identify risks early and plan more effectively for the future.
Changes in pupil numbers continue to have a direct impact on funding and long-term sustainability. Many trusts are now experiencing, or anticipating, a decline in pupil numbers, particularly within primary settings.
Competition for post-16 places is also increasing, which is affecting sixth form recruitment. These trends are largely driven by demographic changes, including falling birth rates and local population shifts.
While there may be some movement of pupils from the independent sector into state education, this is unlikely to offset wider national trends.
It is also important to recognise that the picture varies by region. Some areas, particularly parts of London, are seeing more pronounced declines, while others continue to experience modest growth. As a result, a one-size-fits-all approach is unlikely to be effective.
Although these risks are influenced by external factors, internal audit can still add significant value. By bringing insight from across the sector, sharing best practice and challenging assumptions, internal audit can help trusts strengthen their approach to forecasting, planning and risk management.
Workforce costs remain the largest area of expenditure for most trusts, and rising salaries, agency fees and changes to minimum wage levels are adding further pressure.
However, the challenge goes beyond cost. Recruitment and retention remain significant concerns, with many trusts finding it difficult to attract and retain high-quality staff across both teaching and support roles.
Workload and wellbeing are key factors in this, with increasing demands contributing to burnout and higher turnover. This in turn drives additional recruitment costs and disrupts continuity.
Succession planning is another important consideration. Many trusts face challenges in identifying and developing future leaders, particularly at senior and governance level. Without a clear plan, there is a risk of over-reliance on a small number of individuals, which can leave organisations exposed.
Internal audit can support trusts by reviewing core HR processes and controls. This includes payroll, recruitment, training, wellbeing initiatives and contract management. Governance should also be a focus, with audits assessing board effectiveness, compliance and the clarity of schemes of delegation.
Strong governance arrangements underpin effective decision-making and accountability, making them a critical component of overall risk management.
As academy trusts continue to adopt digital systems and processes, cyber security has become a growing area of risk.
Threats such as data breaches, system failures and cyber attacks are becoming more common, and many trusts are operating with a mix of IT systems that may not always be fully aligned. This can create additional risk in areas such as data protection and GDPR compliance.
Internal audit should play a key role in assessing cyber resilience. Reviews can cover areas such as data protection policies, user access controls, system permissions and processes for managing leavers’ access.
Trusts should also ensure they are investing appropriately in cyber security, including preventative measures such as multi-factor authentication, regular software updates and staff training to reduce the risk of human error.
In a sector where uncertainty is the norm, internal audit provides far more than a compliance function. It offers assurance, insight and practical recommendations that can help academy trusts strengthen their resilience.
By focusing on both financial and non-financial risks, internal audit enables trusts to take a more proactive approach to risk management. It supports better governance, more informed decision-making and a stronger foundation for long-term success.
Duncan & Toplis provides specialist support to academy trusts, helping them navigate risk and strengthen financial and operational performance.
Our services include internal and external audit, VAT advice, cyber security reviews and trustee training. We work closely with trusts of all sizes, offering practical, tailored advice to support sustainable growth and long-term resilience. Contact us to find out how we can help you.
