Audit & Risk Committee - March 2023

This document contains the agenda for a Cairngorms National Park Authority Audit and Risk Committee meeting on 24 March 2023 at 2.30pm. The meeting, held in Grantown on Spey, will cover various topics including welcoming attendees, reviewing previous meeting minutes, declarations of interest, and internal and external audit reports. Discussions will also include data management, the 2023/24 internal audit plan, and strategic risk management. The next meeting is scheduled for 23 June 2023.

This document contains an internal audit report on the Cairngorms National Park Authority's data management. The audit, conducted by Azets, reviewed the Park Authority's approach and controls. Two significant recommendations were made, both accepted by management. These relate to the ongoing migration of data and records to a SharePoint cloud platform. The Park Authority is currently recruiting an Information Manager to manage this transition.

This document contains the Cairngorms National Park Authority's (CNPA) internal audit report for 2022/23 on data management. The audit found that CNPA lacks a complete set of data policies and that existing policies haven't been updated. While a migration plan to SharePoint exists, it lacks detail. The report highlights the connection between policy, risk identification, and procedures, which are not sufficiently established within CNPA. The audit suggests improvement actions focusing on policy development and detailed planning for the SharePoint migration, aiming to address identified risks and ensure data security. A management action plan is included with deadlines for implementation.

This document contains an internal audit progress report prepared by Elizabeth Young and Stephanie Hume of Azets for the Cairngorms National Park Authority. It summarizes internal audit activity since the last meeting and confirms the planned reviews for the next quarter, noting any changes to the annual plan. The Board is asked to review this report and the plan for the next quarter.

This document contains the Cairngorms National Park Authority's internal audit progress report for March 2023. It summarizes internal audit activities since the last meeting, noting the completion of the Data Management audit. The payroll and expenses report, originally planned for March, will now be presented in June due to management needing more time. The report outlines the audits planned for the next quarter: payroll and expenses, a follow-up report, and the annual internal audit report. Finally, it asks the Audit and Risk Committee to review the report and approve the plan.

This document contains the Cairngorms National Park Authority's proposed internal audit plan for 2023/24. Prepared by Azets, the plan was reviewed considering the previous two years' work, changing risks, and discussions with the Chief Executive and Director of Corporate Services. The Audit and Risk Committee is asked to review the strategic plan, the 2022/23 plan's appropriateness, and agree to the 2022/23 plan. The revised 2023/24 plan, incorporating feedback, is included as Annex 1.

This document contains the Cairngorms National Park Authority's internal audit plan for 2023/24. It outlines the planned audits, their objectives, and the timetable for completion. The plan is risk-based, focusing on key areas to ensure effective management and governance. It also details the internal audit team, their approach, and how they will work with the Audit and Risk Committee and external auditors to provide best value and ensure compliance. The document includes appendices with further information, such as the corporate risk register and internal audit charter.

This document contains a review of the Cairngorms National Park Authority's (CNPA) strategic risk management. The Audit and Risk Committee needs to check if the CNPA's current strategic risk register is complete and accurate. The CNPA is currently reviewing its strategic risk management as part of a new corporate plan. A workshop will be held on 26 May to help the board understand strategic risk and update the register. The document highlights several potential risk areas, including financial risks related to the budget, IT system security and robustness, and the maintenance of assets like paths and infrastructure. The Committee is asked to consider these potential changes and offer any other feedback on the strategic risk register.