On Thursday 8 October, Taylor Rogers, Partner at Williamson & Croft, spoke at Liverpool Hope University on cyber security and financial governance in academy trusts. The morning briefing, Cyber Security in Education: Protecting Schools, Staff & Pupils in an AI-Enabled World, was organised by Amicis Group. Taylor spoke alongside former multi-academy trust CEO Chris Wiseman and Amicis Group’s cyber security specialists. The audience was trust CEOs, trustees, governors, CFOs and IT leaders.
Taylor’s central point was that cyber risk is a finance and governance responsibility, not an IT one. Many incidents show up first as a payment problem.
Payment diversion: a £385,532 example
Attackers don’t always need to breach a network. If they can tamper with a supplier’s emails and redirect a payment, the weakness is in the finance process rather than the technology.
That is what happened at Wembley Multi-Academy Trust. According to its accounts, as reported by Schools Week, four payments totalling £385,532 were made to a supplier for construction works in 2022-23. They went to the wrong bank account after the supplier’s email was tampered with. The Metropolitan Police investigated.
Taylor set out four steps that would have stopped it, and they apply to any organisation paying suppliers by bank transfer:
- Treat every request to change bank details as unverified.
- Call back on a number you already hold, never one from the email or invoice.
- Require a second, independent approver, so no one person can both amend a supplier’s details and approve payment to them.
- Send a small test payment first, then reconcile promptly rather than at year end.
The wider cost of an incident
Cyber incidents rarely produce a single bill. Active Learning Trust’s July 2024 ransomware attack encrypted files across ten of its sites. DfE’s Cyber Security Hub case study records costs of over half a million pounds and 1,200 hours of staff time.
The exposure is growing. The Cyber Security Breaches Survey 2025/2026 found that 73% of secondary schools identified a breach or attack, up from 60% the year before. The same survey reported 88% of further education colleges and 98% of higher education institutions.
What the Academy Trust Handbook 2026 changes
The Academy Trust Handbook 2026 takes effect on 1 October 2026. Taylor drew out the changes with most bearing on financial governance:
- Ransomware payments: trusts must not pay ransomware or other extortion demands. Prevention, tested backups and recovery planning now carry the full weight of the response.
- CFO qualifications: for trusts with more than 3,000 pupils, recruitment from 1 October 2026 should specify a qualified accountant. This becomes a firm requirement from 1 September 2027.
- Funding transparency: multi-academy trusts must publish a summary statement by 31 January, alongside their accounts, showing how funding is distributed across their schools.
- Going concern: accounting officers must formally notify trustees where a trust’s ability to continue as a going concern may be at risk, so it becomes ongoing governance rather than a year-end exercise.
- Internal scrutiny: the programme now covers non-financial controls and wider organisational risk. It should be built around the trust’s risk register rather than a generic annual checklist.
- Fraud reporting: the £5,000 DfE reporting threshold applies individually or cumulatively across a financial year, so small, repeated irregularities can trigger a reporting duty. Fraud judged unusual or systematic must be reported whatever its value.
Download our latest Academies Benchmark Report for a full summary of what has changed and what trusts should be doing about it.
Five questions for trust boards
Taylor closed with questions a board should be able to answer in a sentence:
- Do we have a documented process for verifying bank detail changes, and is it followed every time?
- Would we spot payment fraud before it crossed the £5,000 DfE reporting threshold?
- Are our reserves and insurance sufficient, given that ransom payments remain prohibited?
- Is financial risk owned jointly by finance and IT, or does it sit with one team?
- When did we last test our financial controls against a real fraud scenario rather than a compliance checklist?
Speak to UHY Williamson & Croft
Williamson & Croft works with academy trusts across Liverpool, Manchester and the wider North West, including on audit, internal scrutiny and financial governance. To discuss how the Handbook changes affect your trust, visit our academy trusts page or contact Taylor Rogers as below.