School assurance software for independent schools
Know what is working. Show it when asked.
Assurance is the confidence that comes from evidence somebody can actually produce.
Real captures · Risk and Compliance · Hogwarts demo tenant.
Assurance in a school is the work of showing that a control, an obligation or a commitment is operating
And holding the evidence that supports the conclusion. EthosOne captures that evidence where the work happens. Every entry takes an identifier derived from its profile, and once saved it carries a history of edits.
What we keep hearing
The inspection happened. Somebody walked the site, checked the kit, signed a sheet and filed it. Eleven months later a reviewer asks for the last four inspections and the school produces three, one of them a photograph of a clipboard. The work was done.
The evidence of the work was a habit rather than a record, and a habit does not survive a staff change.
The problem
A success message is not assurance. A form that submits, a task that closes and a green tick all tell a school that something happened in software. None of them tells a reviewer who did the work, what they found, what changed afterwards or whether the record has been edited since.
Evidence reconstructed later is weaker than evidence captured at the time. Two weeks before a review, somebody assembles a folder. The dates are approximate, the owners are remembered, and the gaps get filled by the person with the best memory rather than the best record.
The same observation lives in four shapes. A hazard noticed on a Tuesday is an email, a spreadsheet row, a note in a meeting and, sometimes, a form. None of them is the record, so all of them have to be searched.
Six views, one reconciled picture. Each one drills to the record it came from.
01Logs catalogue
Every register the school keeps, internal and public, in one list. A person looking for the right place to record something finds it here instead of asking which spreadsheet is current.
02Create a log profile
A register takes a name, a description and an icon, so it is legible to the people who have to use it. At creation it is set as an Assurance Log for authenticated internal capture, or as a Form for submissions from outside the system.
03Dynamic fields
The administrator defines the fields the school actually needs: required and optional, typed, including dropdown options. The schema is the register, so every entry arrives in the same shape rather than in whatever shape its author had time for.
04Add or edit an entry
A record is captured complete, in one action, rather than saved half-finished and returned to. Each entry takes an identifier derived from its profile, so it can be cited in a paper, an email or a response to a reviewer.
05Profile detail
The current entries under one schema, read together. Because the schema is fixed, the register can be scanned rather than interpreted.
- 06
Add a form to this log
The same governed register, opened to submissions from outside the authenticated system. The capture surface changes and the record behind it does not.
Excursions plan through a nine-step workspace covering basic information, staff, participants, venue, transport, medical and emergency, risk assessment, approval and closure. Each one links to a current operational risk assessment rather than a checklist score, and the workspace is reached from the Risk Assessments Excursions folder.
Risk assessments sit in folders by operating context and filter by Draft or Approved. Each hazard records its cause, its consequence, a matrix rating, the response and a responsible owner, and a Bowtie report generates as a PDF.
What it does not do
There is no assurance engagement lifecycle. Evidence requests, findings, management responses and independent closure are not implemented as a coherent lifecycle, and this page is not going to imply otherwise. A school that needs a formal internal-audit workflow, where a finding is raised against an owner, answered, and then closed by somebody independent of the work, does not have that here yet.
What exists is the layer underneath it: structured capture, consistent schema, ownership, identifiers and history. That is the part most schools are missing, and it is the part a reviewer asks for first. If the engagement lifecycle is the requirement rather than the ambition, say so in the demonstration and we will tell you where it stands.
Public form submissions are not certified private. A Form can take submissions from outside the authenticated system. Treat the privacy behaviour of that path as something to verify for your own use rather than something this page has assured you of.
Who it is for
A governance or assurance lead configuring repeatable evidence registers. A business manager who owns the inspection cadence. A principal who signs the declaration. A board or audit committee member who wants to know that the answer to "how do you know" is a record rather than a reassurance.
- Stored in AustraliaAWS Sydney and Melbourne, one database per school
- AI stays in the country tooAmazon Bedrock; never trained on your content
- Published, not describedTrust Centre · ISMS policy · How we handle your data
The ten we are asked every time.
Still weighing something up? Thirty minutes with us, on your own registers, answers the rest.
Book your school a demo01What is an assurance log, in practice?
A register with a fixed shape. An administrator defines the fields the school needs, required and optional, typed, including dropdown options, and every entry recorded against that profile arrives in the same shape. It replaces the spreadsheet that each person filled in differently.
02Do we need a developer, or a support ticket, to set one up?
No. An administrator creates the profile: a name, a description and an icon so it is legible to the people who use it, then the fields. The school builds the registers it needs rather than asking for them.
03Can people outside the school submit to a register?
Yes. A profile runs either as an internal Assurance Log for authenticated capture, or as a Form that accepts submissions from outside the system. Two things to weigh before you open one. Do not put a register holding confidential content behind a public form, and treat the privacy behaviour of the external path as something to verify for your own use rather than something this page has assured you of. We would rather say that than let you find it out.
04Can we tell who changed an entry, and when?
Yes. Each entry takes an identifier derived from its profile, so it can be cited in a paper or a response to a reviewer, and persisted entries carry a history of edits. What the record said, and what it says now, are both answerable.
05What happens if somebody deletes an entry?
Removed entries are retained rather than destroyed, and can be recovered.
06Can an entry carry a due date or a review date?
Yes. An entry can carry reminder and expiry timing, so a check that has to happen again is attached to the record rather than to somebody's calendar.
07Is this an internal audit system?
No, and it is worth being plain about it. Evidence requests, findings, management responses and independent closure are not implemented here as a coherent lifecycle. If your requirement is a formal internal-audit workflow, where a finding is raised against an owner, answered, and closed by somebody independent of the work, this is not that yet. What exists is the layer underneath: structured capture, one schema, ownership, identifiers and history.
08Does the AI decide whether a control is working?
No. It can suggest a schema to start from, draft a description, propose a field set for an administrator to review, summarise the patterns in entries somebody is already authorised to see, and summarise a history with the events cited. It cannot choose who an audience is, work out access rules, or reach an assurance conclusion. The conclusion is the school's.
09What does it cost?
Assurance logs and forms sit in Risk and Compliance, a Focus module at $5,000 a year on top of Core at $15,000 a year with unlimited users. Every price is published, and the estimator on the pricing page returns your number without a conversation.
10Risk and Compliance, in full: what does it cover?
An administrator builds a structured log with required and optional typed fields, including dropdown options, without a spreadsheet. A log runs either as an internal Assurance Log or as a Form for submissions from outside the authenticated system. Excursions plan through a nine-step workspace covering basic information, staff, participants, venue, transport, medical and emergency, risk assessment, approval and closure, each one linked to a current operational risk assessment rather than a checklist score. Risk assessments record cause, consequence, a matrix rating, a response and a responsible owner for each hazard, and produce a Bowtie report as a PDF.
What are the AI paragraphs you are currently missing from your policies? Watch how we do it.
Free, under ten minutes, and yours to keep whether or not you talk to us.
“It meets all of the real frustrations of business directors in one place.”
“School governance and risk is a complex area without a clear solution.”
Know what is working.Show it when asked.
Risk and Compliance: $5,000 a year with no per-user fees.