Free governance, risk and compliance templates for schools

Chairs and directors usually start with the board pack, then the resolutions register, then the risk appetite statement. Each one is written to run as an item at the next meeting.

Everything a board chair needs in one easy place Inside: Board-Pack.docx built above and below a line, with one school's finished September pack in the appendix; the How-to and the What-next brochure for Board Management. Every decision in its exact words Inside: Board-Resolutions-Register.xlsx with one school's board year worked through (thirteen resolutions and the eight actions they created), a blank register, an amendment history and a proposed-resolution form; the How-to and the What-next for Board Management. Nine sentences your board can vote on Inside: Risk-Appetite-Statement.docx: five bands defined and numbered, nine domains with one sentence each including the AI sentence, and a worked example at the back; the How-to and the What-next for Risk Management.

Executives tend to arrive on a compliance question, a risk question or an AI question. The risk register and the assurance log are the two most schools open first.

Risks and hazards in one workbook, linked Inside: Risk-Register.xlsx: ten organisational risks and four hazards worked through, rated inherent and residual on a five-by-five matrix, linked both ways, with a heat map and a board summary; the How-to draws the bowtie for one risk. The evidence, organised by the question a regulator asks Inside: Assurance-Log.xlsx: twenty-four verified activities across eight assurance areas in the worked example, twenty already listed on your register, organised by the question a regulator asks, with a board summary. Mission to activity to KPI, in one cascade Inside: Strategic-Plan.xlsx: Strategy, Plan and RASCI tabs with a worked example beside your own, a library of thirty KPIs, and the plan on one page. Every policy a school is expected to hold, already listed Inside: Policy-Register.xlsx: twenty-three policies an independent school is expected to hold, across six domains, so the empty cells are your gaps; a coverage read and a board summary; the What-next for PolicyAI.

Three downloads share one idea: an AI policy is a lens over duties a school already carries in child safety, privacy, records, WHS and staff conduct. Beside them, the AI governance framework, the AI value creation kit and the cyber and AI position pages lead to the AI maturity assessment.

Twelve AI risks on your register before the board asks Inside: AI-Risk-Register.xlsx: twelve AI risks pre-filled from what regulators asked for between 24 August and 7 September 2026, each with its trigger, the document it lives in and the sentence that document should contain; an AI tool inventory; twenty-three dated sources. Know where the student data goes before you sign Inside: AI-Vendor-Assessment.xlsx: forty questions across nine areas, ten of them gates, a scoring tab, and EthosOne's own answers as the worked example. The first 24 hours, already planned Inside: AI-Incident-Response-Plan-for-Schools.docx for four incident types: five roles, the first 24 hours by the hour, notification duties with blank contacts, the log and the review; the How-to carries a tabletop exercise.

One form. Tell us who you are on the pack's page and the file is in your inbox within a minute, with a four-page How-to as the first document in every zip, so you know which tab to open and what to do this week.

Every pack has seeded rows or a worked example, because a blank workbook is effort and a populated one is a decision. The AI Risk Register ships with twelve rated risks; the Board Resolutions Register with thirteen resolutions; the Risk Register with ten risks and four hazards; the Risk Assessment Template with one activity assessed end to end, fifteen hazards rated before and after controls.

Every pack has a live version inside EthosOne. The register becomes a controlled record with an owner, a review date and a history; the calendar generates its own occurrences and asks for evidence; the board pack assembles itself from the live position. The What-next brochure in every pack shows the same work inside EthosOne and names the page where the live version lives, so the path from the file to the platform is one link.