Education Matters – March 2024

By David Woodgate, Chief Executive, Independent Schools’ Bursars Association (ISBA)

Anyone involved in the leadership, governance or management of an independent school will be aware of the various political, economic and business threats facing the sector. The headwinds, already significant, will strengthen and while the threats may be understood, some schools are not making sufficiently detailed, researched and realistic plans to address them. Now is the time to coldly and objectively assess business risks, carry out well informed financial modelling, develop financial and non-financial scenarios and use sensitivity analysis to underpin the operational planning for schools over the next 18 months or so.

ISBA is seeing forecasts that are based on arguably unrealistic forecasts of pupil number growth. We know that after previous economic downturns, there is a lag effect on pupil numbers – parents make sacrifices to keep their children in independent education, but there is a risk that this will be until the end of the next key stage only rather than through to age 18. Equally, the current economic situation and uncertainty will affect parent confidence and impact the pipeline; a realistic assessment of the likely number of newly recruited pupils is critical. A possible change in the pattern of parental buying behaviour may impact this. Rather than automatically committing to educating children from 3 to 18 independently, more parents are likely to “invest” selectively, opting in and out at different stages. They may buy prep only with a view to getting their children into the academic stream of a good academy or a faith school or indeed into grammar schools where they still exist.

Alternatively, they may keep their children in the state sector for primary education, only buying secondary education. They may choose a state sixth form college rather than an independent school. The boarding pattern may change and we may see a trading down from more expensive to more cost-effective schools.

There is thus uncertainty around predicting pupil numbers over the next few years. This comes at a time when the recent inflationary pressures have impacted materially on the cost base of independent schools, and there is a further increase in TPS employer contributions to 28.68% from April. Subject to proper consultation, the TPS costs are controllable because schools can withdraw or at least close to new joiners (by the process known as phased withdrawal). Indeed, as of mid-January, around 500 schools have withdrawn or closed to new entrants, and we know that many more schools are now in consultation or have adopted some form of hybrid or pay-and-benefits model.

Political uncertainty is also impacting. ISBA suggests three assumptions:

1. Labour is likely to win the next general election.
2. The party is serious about and fully committed to abolishing mandatory business rate relief for charitable schools and imposing VAT at 20% on school fees.
3. This can be done relatively quickly through a Finance Bill without changing charity law. (Schools that are charitable will remain so with governors remaining trustees although the tax treatment will be different).

VAT could be introduced with effect from April or September 2025. At this stage, we cannot be specific about a date and, while the headline policy has been well trumpeted, the devil is in the detail and we just do not know how VAT will be applied in practice. Will some pupils, such as those with additional needs, be treated differently to other pupils? We do not know what the anti-forestalling measures will be and when these will take effect, other than to say they are likely to be robust.

This throws into sharp relief the pressing need to track risks as they develop, model different financial scenarios, and determine how schools will respond to a range of possible outcomes post the election. Such risk-assessed plans must be kept under constant review – certainly at each governors’ meeting and at finance and general purposes committees, with additional meetings being scheduled in case of need to face up to an evolving picture. For the slightly longer term, many schools are considering mergers, for instance, a single sex girls’ school with a single sex boys’ school. Consideration is also given to coming together with a senior school or a school group, be that a charitable or a for-profit organisation. Such considerations should not be taboo and should be looked at realistically together with a range of other options as a way of future-proofing the school – and with action being considered when the school remains in a position of relative strength. The nature of the sector is changing and every school needs to consider its place in the new post-election world. This is something both ISBA and AGBIS can help boards of governors come to terms with.

Indeed, we are giving many presentations to governing bodies looking at the general political environment and overlaying this, where required, with considerations around TPS and mergers and acquisitions. Please do get in touch if such a presentation would help governors understand current challenges and consider various options to address them. Similarly other professional advisers can assist of course.

Plan for the worst, hope for the best but be ready to be surprised must be the maxim for the next 18 months for governors and senior leaders in UK independent schools.

By Richard Jackson, Strategic Business Manager, Moore ClearComm

Education is without doubt one of the most targeted sectors for cybercrime, and the impact of lost data on schools, colleges and universities is immediate, costly, and well reported in the media. This leads to damage on a reputational level, as well as operational and financial. However, a specific target for schools came to the fore in 2023; the single central record (SCR) where the attack resulted in the school having to remain shut.

In this article, we consider the risks posed by the SCR when in digital form, supported by a recent case study, as well the six key privacy risk areas for schools and multi-academy trusts for consideration in 2024.

What are the privacy risks?

Thought leaders in cyber security identified six key privacy risk areas for the education sector in 2023, and these issues remain as we move towards the mid-2020s:

1. Special category data

In a school or MAT setting, it is best practice to treat all of the following information as sensitive:

• safeguarding matters;
• pupils in receipt of pupil premium;
• pupils with special educational needs and disability (SEND);
• children in need (CIN);
• children looked after by a local authority (CLA).

2. Criminal offence data

Schools process criminal offence data in storing the outcome of a disclosure and barring service (DBS) check on their employees, non-employed staff and volunteers. As this data relates to criminal convictions, collecting and retaining it means the school is processing criminal offence data.

Criminal offence data includes:

• the alleged committing of an offence;
• the legal proceedings for an offence that was committed or alleged to have been committed, including sentencing.

3. Data subjects

Schools collect, store and use personal data about a variety of individuals. In this context, those individuals are known as ‘data subjects’ and include:

• pupils and former pupils;
• parents and carers;
• employees and non-employed staff;
• governors and trustees;
• local authority personnel;
• volunteers, visitors and applicants.

4. Governors and trustees

The responsibility and accountability for compliance sits with governors and trustees, who must ensure that their school or MAT:

• monitors its data protection performance;
• supports the data protection officer;
• has good network security infrastructure, to keep personal data protected;
• has a business continuity plan that includes cyber security.

5. Senior leaders

Senior leadership teams hold significant responsibility for data privacy and, as such, represent a risk to security of data. Their level of risk awareness should exceed that of the general staff population.

6. All staff in the school setting

Schools and MATs should ensure that all staff are aware of their data privacy responsibilities, benefit from regular training and awareness, understand the likelihood of social engineering attacks and recognise likely fraudulent activity.

Single central record: risk and reward

A single central record (SCR) is a compulsory record kept by schools, academies and MATs in the UK, for the purpose of safeguarding. It is a statutory requirement and must detail all recruitment and vetting checks carried out on staff.

The SCR links closely to the risks outlined above (in criminal offence data) and is an attractive target for cyber criminals, when stored in digital form. No school can legally remain open if its SCR becomes inaccessible. This is key to why it has become attractive to cyber criminals.

A school under attack

In June 2023, Leytonstone School was closed temporarily as the result of a cyber attack that rendered its single central record inaccessible. The 800 pupils at the North East London school were forced to take classes remotely until the school could reopen. The attack caused a significant amount of personal data to be accessed by the criminals, with the school’s Wi-Fi offline and its web-based phone systems not working.

In a letter to parents, the Head Teacher Jessica McQuaid said: “I am incredibly sorry for the short notice…but it is illegal for the school to be open without this document in place.” She added: “I am devastated that this IT incident has taken place and impacted the start of the half term for pupils.” (Source: Evening Standard, June 2023)

The school was eventually able to reopen once access to the SCR had been restored. This story shows that cyber criminals are evolving their strategy for the education sector.

The mandatory closure of a school when a SCR is inaccessible is a highly powerful lever for cyber criminals to apply. It increases the pressure on schools to pay ransom demands, does irreparable damage to their reputation, and puts staff and stakeholders at risk of financial and physical harm.

This means that all schools should review their business continuity plans regarding the SCR and ensure that complete reliance on digital access is avoided at all times.

Food for thought

Recent research from the National Cyber Security Centre (NCSC) has identified that all types of education institutions are more likely to identify breaches or attacks than the average UK business. (Source: NCSC report Cyber Security Breaches Survey 2023: Education Institutions Annex)

By Dan Leaman, Partner, Moore Kingston Smith Corporate Finance

Mergers and acquisitions in the independent school sector seem to be buoyant and with no sign of slowing down despite political risks, higher interest rates, a rise in TPS contributions and inflationary pressures.

So, what is the catalyst behind this? The three main drivers are:

1. There is a scarcity of high-quality, profitable, independent schools coming to market combined with a good level of demand from several buyer pools. These include international buyers who remain attracted to the UK independent school market and private equity-backed consolidators, some of whom have secured additional funding to continue their buy-and-build strategies. At the top end of the market, pricing seems to have been maintained for profitable, well-run schools and we continue to see 12-15 x multiples of EBITDA being paid for the best schools.

2. At the other end of the market, we are also seeing demand for financially stressed schools – often standalone prep schools with the potential for turnaround. Some buyers are willing to leverage the asset base of the target schools to help fund an acquisition and investment in the schools where they believe they can improve the results of those schools and there is a strategic fit with their existing holdings.

3. We continue to see a trend of smaller standalone charitable prep schools that are either financially stressed or concerned that they may become financially stressed seeking safety in

numbers and economies of scale from mergers with larger charitable schools that are on stable and secure financial footings. These charity-to-charity mergers are becoming more common and we expect them to continue, as the threat of VAT on school fees and the loss of charitable rates relief and the increase in TPS costs continue to focus governing bodies’ minds on sustainability in the current economic environment.

What we can be certain of is there will always be challenges and benefits which the school will have to take into consideration before taking such a bold step. At the end of the day, the interest of the school and its students should be the number one priority.