Statutory Compliance in Schools: Can You Prove It?

Let’s start with a simple question. If someone asked you to show them your school’s latest fire risk assessment, gas safety certificate and legionella records today, how long would it take you to find them?

If you’d answer, “Give me a few minutes”, that’s good. However, if your answer would be more like “I’d need to ask the contractor”, “I think the business manager has it” or “It should be on the portal somewhere”, this piece is for you.

This isn’t about frightening anyone. Most school senior management teams believe their estate is safe, compliant and risk free. Most of the people looking after their schools do a good job. The trouble is that being safe and being able to show you’re safe are two different things. More often, it’s the second one you’ll be asked about.

What statutory compliance actually means.

Statutory compliance means the inspections, tests and risk assessments and consequential remedial work the law requires to keep a building and the people in it safe. That covers fire, asbestos, gas, electrical systems, water hygiene, lifts, pressure systems, and so on.

A policy on its own doesn’t make you compliant. You’re compliant when you can show the policy is being carried out, evidenced and recorded against a requirement schedule. In practice that means the inspection was done on time by someone competent, a certificate or report exists, any actions it raised have an owner, and someone has checked they’ve been closed.

So the question to ask isn’t “Do we have a policy?” It’s “Can we show it’s working?”

Why it matters more now: the DfE has raised the bar.

In April 2025 the DfE published the School Estate Management Standards. They cover 11 areas of estate management. Five of those areas are about compliance directly:

●     Health and safety

●     Fire safety

●     Asbestos

●     Legionella and water hygiene

●     Other statutory compliance

The standards are set out in maturity levels. Level 1 is the minimum every school is expected to meet: up-to-date compliance records and clear responsibility for estates and compliance. Responsible bodies are expected to work towards Level 3, “fully effective”, which means governed, proactive and risk-based.

This autumn the standards stopped being guidance on a shelf. The 2026–27 annual return opened in September through Manage Your Education Estate, and the deadline is late November. Every local authority, trust and diocese eligible for DfE capital funding has to submit one, and someone in a senior estates role has to sign it off.

The DfE has said there’s no penalty for falling short this year. What the return does do is put your estate maturity on record, in front of the department, in your own words. That’s a good reason to make sure your answers are ones you can back up with evidence.

So, whose job is it?

It’s shared, and that’s exactly why things fall through the gaps.

Depending on how your school is set up, the people involved might include the governing board, the trust or local authority as responsible body, the head, the business or estates manager, an FM provider, specialist subcontractors and, obviously where relevant, a PFI contractor.

A contract can hand the work to someone else. It can’t hand away your oversight. The responsible body still has to know that the right things are happening.

What this means for you as a CEO or head.

Nobody expects you to test a fire alarm panel or sample water temperatures yourself. You do need, however, to be confident of three things:

1. The right systems are in place - you know what has to be done and how often.
2. Competent people are doing it - whether that’s in-house staff, a contractor or the PFI provider.
3. Someone is checking -  records are reviewed, overdue actions get chased, and problems are escalated.

If you can answer yes to all three and point to the evidence, you’re in a strong position.

If you’re in a PFI school.

PFI adds a layer of contract on top of all this. The Project Agreement will usually give the contractor responsibility for planned maintenance, statutory testing, repairs and record-keeping. That’s useful, because that means much of the work should be done for you.

It’s also where we see the biggest blind spot. A PFI contractor’s monthly report that says “compliant” is not the same as evidence, nor does it acknowledge pending work requirements. You’re entitled to see the certificates, the remedial actions and how quickly they were closed, and you should be seeing them, locally not locked away on a FM contractors site 20 miles away. The payment mechanism exists for a reason. If the service isn’t being delivered, the contract gives you tools to deal with it, but only if someone is watching, and understands what the contract is saying about who is responsible.

Our advice to every PFI school is to get comfortable asking one question: “Can you show me?”

What about personal liability?

It’s a fair question, so here’s a measured answer. Health and safety law does allow individuals to be held responsible in some circumstances, usually where there has been serious neglect, or where known risks were ignored. That’s rare, and

it’s not what happens when an honest mistake is made inside a well-run system.

The best protection is the same thing the DfE is asking for: clear responsibilities, good records, and evidence that you act when something isn’t right.

A 10-minute compliance health check.

Could you put your hands on these today?

●     Current certificates and reports for every statutory discipline

●     Your fire risk assessment, and proof its actions are being closed

●     Your asbestos register and management plan

●     Gas and electrical (EICR) safety records

●     Legionella risk assessment and monitoring logs

●     A record of remedial works, with dates and who signed them off

●     A clear split of responsibilities, especially under a PFI or FM contract

●     Evidence you’re monitoring contractor performance

●     An escalation trail for issues that haven’t been resolved

Signs that it’s time to take a closer look.

●     You can’t find the latest certificate.

●     An inspection raised an issue, but nobody owns the action.

●     The same defect keeps coming back.

●     Contractor reports say “compliant” but don’t give much detail.

●     You’re not sure who is responsible for a particular check.

●     Compliance information sits in three systems and nobody has the full picture.

None of these means your school is unsafe. Each of them means you can’t be sure, and under the new standards that’s the gap that matters.

How we help: Inscyte ELEMENT and a support desk that picks up.

Here’s how it fits together.

Inscyte Support  runs the compliance. We cover all 14 statutory and PPM disciplines with a live Statutory Compliance Register and PPM Schedule. Every certificate is tracked and RAG-rated, and you get alerts before anything expires, so you’re not finding out after the event.

Our support desk is there when something goes wrong. You can report a reactive issue to a team that logs it, sends the right contractor and chases it until it’s closed. You won’t be left wondering who’s dealing with it, because you’ll be able to see who is.

Inscyte ELEMENT  gives you the full picture. It’s the data layer that sits around Support. It connects your building systems (BMS, energy, fire, security) into one view, with live compliance dashboards, an asset register, as-built drawings and five-year investment modelling. Because the compliance data feeds straight into it, your RAG ratings are based on what’s actually happening in the building, not on what someone has typed into a spreadsheet. It’s built to meet the DfE’s digital estate data standards, and the energy savings pay for it.

Together, that’s compliance managed, issues fixed and the evidence ready whenever someone asks for it. It works whether your FM is in-house, outsourced or delivered through PFI.

We’ve spent 19 years on the client side of PFI contracts, supporting schools, local authorities and academy trusts. We know where the evidence tends to go missing, and we’ve built all of this so it doesn’t.

From uncertainty to confidence.

Good compliance isn’t a folder you pull out when an auditor turns up. It’s knowing the right things are happening, being able to prove it, and acting quickly when they’re not.

The DfE has set out what good looks like. The question is whether you can show you’re there.

Want to know where you stand? Talk to us. We’ll show you the gaps and how to plug them before anyone else finds them.