Audit and Risk Committee - November 2025

This document contains the agenda for the Audit and Risk Committee meeting of the Cairngorms National Park Authority (Park Authority) on 14 November 2025 at 9am. The meeting will be held in the Don meeting room at the Park Authority headquarters and will be a hybrid meeting. The agenda includes items for decision, discussion, and information, such as the election of a Deputy Chair, strategic risk registers, information requests and complaints updates, geographic distribution of contracts awarded, the draft audit and risk committee annual report, draft accounts, a letter of representation, and an external audit update and annual audit report. The agenda also includes a motion to take the confidential items in a confidential session and notes that the date of the next meeting will be 13 March 2026.

This document contains the draft minutes of the Audit and Risk Committee meeting held on 12 September 2025 at the Cairngorms National Park Authority office. The meeting included discussions on internal audit progress, strategic risk registers, and procurement approaches with lessons learned. The committee considered external audit assurances, reviewed action items from previous meetings, and noted that there were no declarations of interest. The Chair thanked Peter Cosgrove for his service as Vice-Chair, and the next meeting was scheduled for 14 November 2025. The public portion of the meeting concluded at 1.46pm.

This document contains a paper for discussion by the Audit and Risk Committee of the Cairngorms National Park Authority, prepared by Louise Allen, Head of Finance and Corporate Operations, on 14 November 2025. The paper supports a review of the Park Authority's strategic risk management position. The Audit and Risk Committee is asked to consider the coverage and adequacy of the Park Authority's strategic risk management position and the Cairngorms 2030 programme risk management position, and advise on any gaps or amendments required to the current risk registers. The most recent strategic risk register was reviewed on 17 October 2025, and there remain 13 active risks. The total programme risk profile was changed from green to amber in March due to funding risks for Active Communities transport projects, but this risk has now been significantly reduced. The Committee is invited to consider the current coverage of the risk registers as set out in the Annexes.

This document contains a risk assessment from the Audit and Risk Committee, identifying several potential risks and planned actions for the Cairngorms National Park Authority. These risks include financial constraints affecting the corporate plan and match funding for the Cairngorms 2030 (C2030) program, as well as gaps in staff skill sets, particularly in procurement and construction project management. Other identified risks cover the potential for failure in wildlife crime strategic partnerships, IT service robustness, business continuity planning, reputational damage, workforce flexibility, and legal liabilities, along with uncertainties around achieving community transport infrastructure enhancements. Mitigation strategies and planned actions are outlined to address each risk, along with target completion dates.

This document contains the Cairngorms 2030 Programme risk assessment for quarter three of 2024. It lists several risks, including potential loss of funding, insufficient match funding, and impacts on the Park Authority's budget. Mitigation strategies are outlined for each risk, with progress tracked using a red, amber, green (RAG) status system. The document also identifies owners and reassessment dates for each risk, as well as a forward look to quarter four of 2025.

This document contains an update on information requests and complaints handled by the Cairngorms National Park Authority. The paper, prepared by the Information Manager, Paul Davison, is for the Audit and Risk Committee on 14 November 2025. It covers the first half of financial year 2025/26, providing figures on Freedom of Information (Scotland) Act (FOISA)/Environmental Information (Scotland) Regulations (EIR) requests and formal complaints. Total requests are predicted to be around 60 for the year, higher than previous years. The Park Authority's performance in responding to requests within the required timeframes is generally good but has dipped slightly to 89% in the latest half-year. There have been no subject access requests to date and only one Stage 2 complaint this financial year.

This document contains information for the Audit and Risk Committee about procurement activity for the year ending 31 October 2025, focusing on where the successful suppliers are located; this information was requested by a committee member. The Park Authority awarded 43 contracts in total, with 20 advertised publicly on Public Contracts Scotland (PCS) to comply with regulations. Nine contracts were published via the Quick Quotes portal on PCS to selected tenderers, and 12 lower value contracts were awarded based on a minimum of three quotes. Most winning tenderers (71%) are based outside the park boundary, while 29% are based in or around the park. The data collected will help develop a procurement approach that benefits the local community, and the Park Authority aims to support local firms through fair practices.

This document contains the draft annual report of the Audit and Risk Committee for the Cairngorms National Park Authority, prepared by David Cameron, Deputy CEO, for consideration prior to submission to the Board. The report covers the committee's activities from September 2024 to September 2025, including the consideration of final accounts for 2023/24 and oversight of the 2024/25 external audit. Key activities included risk management, detailed risk analysis, reviewing accounting policies, approving the governance statement, and monitoring progress on previous audit recommendations. The Committee also addressed weaknesses in procurement controls and agreed on an internal audit plan for 2025/26. The report concludes that the Committee has successfully progressed the Board's governance and internal control priorities, welcoming the work of the Authority's finance team and recognizing the valuable contribution of the wider Corporate Services team.