Reviewing the same areas again may be exactly right. The problem is continuing to review them without checking whether the original reason still applies.
Over time, this can leave a programme following last year's risk picture rather than the trust it is meant to assure. Areas that are now stable may continue to be reviewed while newer or less visible risks go untested.
With the Academy Trust Handbook 2026 taking effect on 1 October and the annual summary report for the year ended 31 August 2026 due by 31 December, October is a useful time to review last year's work and check that the 2026/27 programme reflects the trust as it operates today.
What the 2026 Handbook means for this year's programme
This does not mean every change needs its own internal scrutiny review. Trusts should look at what has changed in the trust and in the wider Handbook, then decide which decisions and controls now need testing.
Trusts must also keep their approach to internal scrutiny under review. If the trust changes in size, complexity or risk profile, it should consider whether its current approach remains suitable.
The audit and risk committee's role is more than approving a list of reviews once a year. It must also have access to the external auditor, as well as the internal scrutineer. It must oversee and approve the programme, ensure that risks are being addressed appropriately and report to the board on the adequacy of the trust's internal control framework. It must also have written terms of reference, agree who will carry out the work, review the ratings and responses on the risk register and consider progress against previous recommendations.
What might need testing this year
The headteacher believes approval sits with the central team. Finance assumes HR has checked the cost. HR assumes the budget holder has authorised it. Each team has completed its own part, but nobody has checked the decision as a whole.
No one has necessarily done anything wrong. The weakness is in the handover between teams.
Following that decision from the original request through to payroll can show gaps in ownership, approval or information that a review of individual procedures would miss.
A good scrutiny programme should follow the decisions and controls that matter most to the trust now, rather than simply repeat last year's schedule.
Internal scrutiny can also identify risks the trust has not yet recognised, such as dependence on one individual, inconsistent practice between schools or changes being made without sufficient oversight. Those findings should feed back into the risk register and influence what is reviewed next.
The programme should also take account of other assurance work, including external audit findings and DfE reviews. The aim is not to repeat work that has already been done, but to identify where assurance is still missing.
Procurement is one example. Instead of commissioning another general policy check, a trust could ask its internal scrutiny provider to follow one recent purchase from route selection through approval, receipt and payment. That would test whether the appropriate route was considered, the rationale recorded, conflicts identified and the necessary approvals obtained. An internal approval of an exception does not, by itself, prove that the procurement route was appropriate.
A newly introduced process may need time to operate before there is enough evidence to test it properly. Internal scrutiny must also be timely, with regular reports to the audit and risk committee. Findings must be made available promptly to all trustees.
Use the annual report to shape the current programme
Trusts must submit their annual summary internal scrutiny report for the year ended 31 August 2026 to the DfE by 31 December 2026, alongside their audited annual accounts.
Preparing it helps trustees consider what the completed work tells them and what remains unresolved. It should inform the 2026/27 programme, but this does not mean
rushing every review prompted by the 2026 Handbook into the report covering the previous year.
The work also feeds into the trust's wider annual reporting. The governance statement must explain which internal scrutiny approach the trust used and why, while the outcome informs the accounting officer's statement of regularity.
Before confirming the programme, the committee should be able to explain what has changed in the trust, which controls have not been independently tested, what previous reviews left unresolved and why each proposed review has priority.
Each review should have a clear reason. It may respond to a changed risk, test a known weakness or give trustees assurance they do not already have. Repeating a review can be right where weaknesses remain, while strong assurance in a stable area may allow the committee to look elsewhere. One example is Aspire Academies Trust, a six-school primary trust in Hertfordshire, Keystone reviewed health and safety, finance, safeguarding, estates management and cyber security. The reviews confirmed strong processes in all five areas and led to recommendations that Aspire has since acted on.
Recommendations should improve practice
The report is only useful if it helps the trust make a better decision or change how something works.
Each agreed action needs an owner and a timescale that reflects the risk. It should then be possible to show what has changed as a result. Completing an action should mean more than issuing a revised procedure.
If the weakness was inconsistent authorisation, for example, a later sample should show whether authorisation is now happening reliably.
Internal Scrutiny should help the trust improve
At Keystone Knowledge, we speak to the people carrying out the work, see systems and controls in use and look at what sits behind the evidence.
That gives us a clearer view of where a process breaks down between schools, central teams and external providers, and what trustees need to know.
Our recommendations draw on experience of running schools and trust functions, so they focus on changes that staff can realistically follow and demonstrate in practice.
If the trust has changed, a programme built around last year's risks may no longer give trustees the assurance they need. The committee should be able to explain why each review is in the programme now and what it is expected to tell trustees.