Safeguarding policy audit checklist for international schools

Most international schools hold a safeguarding policy set that grew in layers. The child protection policy was written when the school opened. A staff code of conduct was added after an incident. An online safety policy arrived with the one-to-one device programme, and a trips procedure was borrowed from a sister school in another country. Each document was sensible on the day it was written. Read together five years later, they no longer describe one system, and staff follow whichever version they were handed at induction. A safeguarding policy audit checklist is how a school finds the places where its own documents stopped agreeing with each other.

An audit tests five separate things, and it helps to keep them separate, because a school usually passes on four and fails on one. Coverage asks whether the school holds a document for every risk it actually carries. Internal consistency asks whether the procedures inside those documents match. Local adaptation asks whether the agencies, telephone numbers and legal duties named in the text belong to the country the school sits in. Accessibility asks whether the adults bound by the policy can read it in a language they use every day. Version control asks whether anyone can say which version is current and who approved it.

The reference points are the same across the sector. The International Task Force on Child Protection, formed in 2014 and hosted by the International Centre for Missing and Exploited Children with the Council of International Schools and other member organisations, publishes expectations written for international schools rather than for one national system. Keeping children safe in education 2026 sets out what schools in England must do, and many international schools use it as a drafting reference even though it carries no legal force outside England. An accreditor adds its own child protection standards on top. Read the ITFCP standards in plain terms before you start, so the checklist measures your documents against something published rather than against your own memory.

Start with a list of what exists, and build it from the file server rather than from the policy index, because the index is usually out of date. An international school carrying a normal range of activity should be able to produce the following.

Coverage is the fastest part of the audit and the least revealing, because most established schools hold most of these. Two gaps recur. Intimate care sits with the nurse and the early years team and often exists as a practice nobody has written down. And a low-level concerns policy, covering behaviour by an adult that falls below the harm threshold, is missing in a large share of the sets I have read, which leaves a head of section with nowhere to put a nagging doubt about a colleague.

• A child protection and safeguarding policy, reviewed at least annually, published where parents can find it.
• A staff code of conduct that describes what appropriate and inappropriate adult behaviour looks like on this campus, in specific terms.
• A low-level concerns policy, or a low-level concerns section inside the code of conduct, covering concerns about an adult that fall below the harm threshold.
• A safer recruitment policy covering identity checks, references, criminal record checks in every country a candidate has worked in, and what the school does when a check cannot be obtained.
• An online safety policy that names the filtering and monitoring in use and says who reviews the logs.
• An intimate care and personal care procedure for early years, the nurse's office and students with additional needs.
• A trips and residentials procedure covering supervision ratios, room allocation, and how a concern is reported from another country.
• A boarding safeguarding procedure where the school boards, covering night cover, house staff supervision and the duty rota.
• A whistleblowing procedure that gives staff a route above the Head of School.
• A visitors, contractors and volunteers procedure setting out who is supervised and who is checked.

This is where an audit finds real problems. Take one scenario and trace it through every document that touches it. A Year 4 teacher notices bruising on a child's upper arm during a swimming lesson on a Friday afternoon. Now read the child protection policy, the staff handbook, the induction pack, the trips procedure, the medical room protocol, and whatever the intranet shows when a member of staff searches for the words report a concern. Count the reporting routes, the named recipients and the deadlines.

The count is rarely one. The child protection policy names the Designated Safeguarding Lead and says the same day. The staff handbook, written by a different person in a different year, says report to your head of section. The medical protocol says the nurse records it and informs the parents. The intranet form goes to an address belonging to someone who left in 2023. Every one of those instructions was written in good faith. Together they give a new teacher four defensible answers and no single correct one.

Check the same way for the definitions that carry weight. Who the Designated Safeguarding Lead and the deputies are, and whether those names match the current organisation chart. What the school calls the threshold for reporting. Which system is the system of record. How long a record is kept and who may read it. What happens when the concern is about an adult rather than a child. Where two documents disagree, write both instructions into the audit finding, because somebody in the building is following each of them.

A policy drafted in England tells staff to refer to local authority children's social care, to consult the local authority designated officer about a concern regarding a colleague, and to contact the police. A school in Astana, Dubai or Bogota has none of the first two. Keeping children safe in education is written for England, and the passages naming English agencies do not transfer. Settle once, in writing and with the board, which parts of that guidance the school adopts and which parts it replaces, rather than leaving each head of section to work it out alone.

Local adaptation means every external body in the policy is real, reachable and named with a current telephone number, and with a named contact where the school has one. That list usually covers the children's rights or guardianship authority, the police unit that handles offences against minors, the local hospital and the ministry or department of education. It also covers the embassy or consulate for the passport countries a large share of students hold, because consular notification is a genuine step in some cases.

The second half of local adaptation is the legal duty. Many countries place a personal reporting duty on the individual who learned of the harm rather than on the institution, with a deadline measured in hours and a penalty for failing to report. Where that is true, the policy has to say so plainly in the section a teacher reads, and not in an annex. How international schools handle local reporting duties alongside their own internal route is the adaptation most imported policies skip.

The policy binds the bus driver, the guard on the gate, the catering team, the cleaners and the maintenance staff, and in most international schools those adults do not work in English. A child protection policy that exists only in English is a document a large part of the staff body cannot read and is still accountable to. Treat the language question as a drafting decision at the start rather than a translation task at the end.

Check three things. First, which languages the policy exists in, and whether each translated version carries the same version number as the source. Second, the reading level: a policy written in the register of a legal opinion will not survive contact with a driver who has ten minutes before the afternoon run. Third, where the document lives, and whether a member of staff without a school laptop can reach it from a phone.

Training inherits the same problem, and it runs deeper than swapping the words, because the examples and the reporting route have to change with the language. The same applies to who is covered at all. A driver, a guard and a kitchen supervisor meet situations a classroom teacher never sees, and a policy written as though every reader stands in front of a class leaves them without an answer.

Every safeguarding document should carry five fields on its first page: a version number, the date it was approved, the person or body that approved it, the owner responsible for the next review, and the date that review falls due. Keeping children safe in education asks schools in England to review the child protection policy at least annually and to publish it. Accreditors ask to see the approval trail. Neither is satisfied by a file called policy_final_v3_updated.docx sitting in a shared drive.

Two failures show up repeatedly. Translated versions drift, because the English text was revised in March and the Russian version still describes the previous reporting route. And the copy published on the school website is older than the internal copy, so parents read one procedure while staff follow another. Both are cheap to fix, and both look serious to an evaluator, because they suggest nobody owns the document. What an accreditation visit asks to see tends to start with the approval trail rather than the prose.

I coordinated CIS accreditation at Miras International School in Astana, a well-established school with two accreditation cycles behind it and a policy set that had been reviewed and approved more than once. When I ran that school's own documents through a policy audit, measuring the procedures against what those same documents said the school would do, the alignment came back at roughly 60 percent. The comparison was against the school's own stated expectations, not against an external standard.

The gaps were of the kind described above: reporting routes that had been superseded but never removed, a code of conduct that predated the current safeguarding policy and used a different threshold, and local agency details that had changed since anyone last checked them. None of it came from carelessness. It came from a document set that had grown for a decade while nobody had ever read the whole of it in one sitting.

That figure is one school on one day, and I would not offer it to anyone else as a benchmark. What it changed was the response: the school rewrote its policies rather than running another annual review of the same text. If you work through this checklist honestly on your own set, expect the fix to be structural rather than editorial.

I built SafeguardIS after that audit. The policy audit feature checks a school's documents against ITFCP-aligned expectations and produces an action plan, so the first output is a list of gaps with the document and section each one sits in. I also run whole-school safeguarding audits and live workshops in English and Russian, for schools that want a person in the room as well as a report.

The same logic carries into training. Every module comes from the school's own safeguarding and child protection policies, so what staff learn matches what the school actually does, and the Designated Safeguarding Lead signs off each one before staff see it, with the approval and a content hash both logged. When a member of staff is unsure how a policy applies, the AI policy assistant answers from those same documents, though the safeguarding decision itself always stays with the DSL and no child's details go into the chat. Training ships in English, Russian and Kazakh today. If your staff work in a language the platform does not ship yet, I build that language in for your school as part of the pilot.

Miras International School in Astana is the pilot school. If you want to see the audit output and the module review step run against your own documents, book a 20-minute walkthrough.