Foresight Before Assurance: Rebuilding the Board’s Risk Register for 2026

Risk registers are often at their most impressive when they are least useful. A board can point to a neat grid of likelihood and impact, a named owner for every line, and a colour-coded summary that travels smoothly into an inspection conversation. Yet the same document may never ask whether the school’s fee model can withstand a 10 per cent fall in demand, whether the estate backlog is being funded by deferred maintenance, or whether a cyber incident would be contained before it reached the admissions database. For independent school governors in 2026, the test is not whether the register satisfies a framework. It is whether it sharpens judgement before events do.

The compliance trap

Compliance has its place. Governors need evidence that statutory duties are understood, that safeguarding arrangements are credible, and that financial controls are sound. But a register built primarily for external assurance tends to reward completeness over candour. Lines are added after incidents rather than before them. Risks are described in broad categories that no one can disagree with. Ownership is assigned to a committee rather than a person. The document grows, but the board’s understanding of what could genuinely alter the school’s trajectory does not.

A foresight register works differently. It is shorter, more argumentative and explicitly linked to strategic choices. Each entry should record not only the risk and its mitigation, but the assumption being made, the early warning signal, and the decision the board would take if that signal appeared. The question is not ‘have we covered this?’ but ‘what would change our minds?’

Five exposures that deserve board attention

Fee dependency and demand elasticity

Most independent schools are, in practice, single-product businesses. Fee income funds the majority of activity, and small movements in pupil numbers can produce disproportionate effects on surplus. Governors should test concentration by year group, by fee band and by catchment. A register that records ‘fee income risk’ without modelling a realistic range of retention and recruitment outcomes is a comfort, not a control. Useful questions include: which year groups are most exposed to a single cohort leaving? How quickly could the school adjust staffing without damaging quality? What is the break-even pupil number, and how much headroom remains?

Cyber resilience

The risk is no longer confined to data loss. A ransomware event can interrupt admissions, payroll, safeguarding records and parent communications at the same time. Boards should ask for evidence of tested recovery, not merely a policy. Has the school run a live restoration exercise? Are third-party suppliers assessed for their own resilience? What would the school do if the management information system were unavailable for a week? The register should distinguish between prevention, detection and recovery, because each demands a different board response.

Regulatory change

Independent schools operate within a shifting framework of charity, employment, safeguarding and inspection expectations. The risk is not that regulation changes; it is that the school responds late or inconsistently. Governors should maintain a short regulatory horizon scan and ask which changes require policy revision, staff training or budget provision. A useful discipline is to record the date by which the board expects to receive assurance, not simply the name of the regulation.

Estate investment

Deferred capital expenditure is one of the quietest risks in the sector. A backlog can be carried for years without appearing in the operating surplus, then surface as an urgent repair or a compliance failure. The register should include a condition survey summary, a funded maintenance plan and a clear distinction between routine repairs and strategic investment. Governors should ask whether the current fee level genuinely funds the estate, or whether future cohorts are subsidising present ones.

Safeguarding pressures

Safeguarding risks are often treated as operational matters to be handled by designated leads. That is necessary but not sufficient. The board needs assurance that pressures are visible: increases in referrals, delays in multi-agency support, recruitment difficulties in pastoral teams, or changes in pupil needs. The register should capture the dependencies that sit outside the school’s direct control, because those are precisely where governance adds value.

From register to foresight

A foresight register should fit on a few pages. Each risk should carry a plain-language statement of what could happen, the assumption that currently protects the school, the leading indicator that would challenge that assumption, and the board’s agreed response. The language should be specific enough that a new governor can understand it without a briefing, and direct enough that a experienced governor can disagree with it.

It is also worth separating risks that threaten viability from risks that threaten quality or reputation. They require different appetites and different cadences. A viability risk may need monthly monitoring by a small group; a quality risk may be better reviewed termly with the education committee. Mixing them produces a long list and a short discussion.

A termly cadence

A practical rhythm is to review the register three times a year, with one deeper session annually. The termly review should focus on movement: which indicators have shifted, which assumptions now look weaker, and which mitigations have actually been tested. The annual session should step back and ask whether the register reflects the school’s strategy, not merely its insurance schedule.

Committee chairs should bring exceptions rather than summaries. The full board does not need to read every line, but it does need to see where the school is most exposed and what decisions are pending. Minutes should record the board’s judgement, not just the fact that the register was received.

Questions for the next meeting

Before the next review, governors might ask: Which three risks would most change our strategic plan if they materialised? Which assumptions have we tested with evidence rather than experience? What would we stop doing if our worst-case budget scenario became the base case? Who outside the leadership team would tell us if our mitigation were failing? And when did we last change a decision because of the register?

A risk register that never changes the agenda is unlikely to change outcomes. The aim for 2026 is not a more elaborate document, but a more honest conversation. For SHMIS members, that conversation is the real assurance.