Internal Audit is an independent appraisal function that reviews the internal control system operating within the County Council and the schools it maintains. The service is delivered by Veritau Limited, a company jointly owned by the County Council and the City of York Council, which also delivers Information Governance and Counter Fraud services to a number of public sector organisations.

School Audit Arrangements

Schools are audited in accordance with a risk assessment that takes into account their size, the experience of key members of staff, the date they were last audited and overall opinion that was expressed then, and a number of other factors. As a result the larger secondary schools may be visited every two years whilst smaller primary schools may go a number of years between visits. A secondary school audit will typically take two auditors two days in school, whilst a primary school audit will involve one auditor for two days or two auditors one day. If a secondary school has a sixth form additional checks will be undertaken on behalf of the Young People's Learning Agency which will increase the time spent in school.

The auditors work through an audit programme when they are in school which has the following sections:

  •  Governance
  •  Financial Management
  •  Systems Reconciliation
  •  Petty Cash
  •  Contracts - Ordering and Purchasing
  •  Income
  •  Capital and Property
  •  Extended Schools
  •  Human Resources
  •  Payroll and Staffing
  •  Schools Meals
  •  Pupil Numbers
  •  School Voluntary Funds
  •  Data Protection and Information Technology
  •  Insurance and Risk Management
  •  Joint Use Facilities (where appropriate)
  •  Inventories
  •  Minibus (where appropriate)
  •  Security
  •  Early Years (where appropriate)
  • Safeguarding

Before an audit visit we will give you plenty of warning and request that you complete and return a Pre-Audit Questionnaire that will save us asking you a lot of questions when we come to your school. At the end of the audit we will issue a draft report to the Headteacher and express an overall opinion of the standard of internal controls in the school. There are five standard opinions and these are:

  • High Assurance - Overall, very good management of risk with no significant weaknesses identified. An effective control environment appears to be in operation.
  • Substantial Assurance - Overall, good management of risk with few significant weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified.
  • Moderate assurance - Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made.
  • Limited Assurance - Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation.
  • No Assurance - Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse.

In addition we may recommend that certain actions are taken by the school. These are given a priority ranking, defined as follows:

Priority 1 - A fundamental system weakness, which presents material risk to the system objectives and requires urgent attention by management.

Priority 2 - A significant system weakness, whose impact or frequency presents an unacceptable risk to the system objectives, which needs to be addressed by management.

Priority 3 - The system objectives are not exposed to significant risk, but the issue merits attention by management.

The Headteacher will be asked to give a management response to the draft report, and when that is received we issue a final report to the Chair of the Governing Body and request them to bring it to the attention of the other governors.

Audits are undertaken on behalf of the authority and there is no charge to schools for them.

Other assurance work for schools

Schools are required to submit a Schools Financial Value Standard return to Veritau by the end of March each year, starting in 2013. Further information can be found here. Although this is designed to be a self assessment exercise we can undertake an independent evaluation of your school if that would be helpful.

If your school is considering becoming an Academy please contact us about the services we can offer. We can act as Responsible Officer for you and conduct internal audits.

Training courses

We also offer training courses for Governors and staff. Our Financial Control Really Matters course introduces governors to the work of the internal audit service, discusses the controls that schools should have in place, and provides an opportunity to discuss the requirements of the Schools Financial Value Standard. The Information Governance Matters course is a lively and interactive session that introduces the key concepts of Data Protection and Freedom of Information. Please contact Ian Smithson or Robert Beane for details.

Special investigations

Veritau undertakes investigations into allegations of financial irregularities, and if you suspect one you must notify us as quickly as possible. You may do this anonymously if you wish by leaving a message on the Whistleblower hotline, 01609 760067 or leave a message on the fraud reporting e-form which is available here. In all events we will respect confidentiality.

School Audit Newsletters and Alerts

You can access School Audit Newsletters below.

We also periodically issue email alerts to all schools to warn them of suspect telephone callers. phishing emails or other scams that schools frequently receive.

School Audit Newsletter (Spring 2012)

School Audit Newsletter (Autumn 2011)

Useful downloads

Veritau School Pre-Audit Questionnaire - to be completed at least 5 days prior to the audit visit.


Veritau [new window] - Company website – includes a section for schools