Audit & Risk Committee - November 2023

This document contains the agenda for the Cairngorms National Park Authority's Audit and Risk Committee meeting on 24 November 2023 at 3.00pm. The meeting, held in Grantown on Spey, will cover topics including the approval of previous meeting minutes, financial accounts, external and internal audit reports on various subjects (Heritage Horizons, Health and Safety, management action follow-up, and the replacement of the finance system), strategic risk management, and an update on internal audit progress. The next meeting is scheduled for 19 April 2024.

This document contains the 2022/23 final accounts for the Cairngorms National Park Authority. Prepared by Louise Allen, it's meant to get approval for the annual report and accounts before they're sent to Audit Scotland. The report includes details on the Park Authority's finances, including changes in accounting practices and an overview of their operational activity. The Audit and Risk Committee is asked to approve the accounts, which will then be signed by the Chief Executive.

This document contains the Cairngorms National Park Authority's annual report and accounts for 2022/23. It covers the Park Authority's work, including its key personnel, strategic aims and priorities, financial performance, and governance. The report highlights achievements in woodland expansion, peatland restoration, and nature restoration projects, as well as progress on community engagement and active travel initiatives. The document also includes details on the Park Authority's financial performance and budget for the year, along with information about risk management, staff matters, and sustainability efforts. Finally, it presents the audited financial statements, an independent auditor's report, and the Accounts Direction issued by the Scottish Government.

This document contains the Cairngorms National Park Authority's external audit update for the year 2022/23. Prepared by Louise Allen and presented by Tom Reid of Mazars, the report summarizes the audit's findings and conclusions. The Audit and Risk Committee is asked to review the report, specifically the management representation letter, and approve it for the Accountable Officer's signature. The report includes details on the audit's status, approach, key findings, internal controls, and misstatements. The Park Authority expresses its gratitude to the audit team.

This document contains the Cairngorms National Park Authority's annual audit report for the year ending 31 March 2023. The report, prepared by Mazars LLP, details a substantially complete audit with an expected unqualified opinion on the financial statements. The audit highlighted some minor misstatements, all corrected by management, and identified some internal control recommendations, primarily focusing on improving security procedures to prevent fraud and streamlining financial processes. The wider scope review found no significant risks to the Park Authority’s financial sustainability or governance.

This document contains an internal audit report on the Cairngorms 2030 (Heritage Horizons) Programme's governance and reporting. The audit, completed by Azets, found the programme's governance and reporting arrangements robust over the past two years. It made two recommendations for improvement, which management has accepted and responded to. The Audit and Risk Committee is asked to review the audit findings and endorse management's response. The full audit report is included as an annex.

This document contains the Cairngorms National Park Authority's internal audit report for 2023/24 on the Heritage Horizons Programme. The audit found the programme has good governance and reporting, with established structures for timely updates. However, it identified opportunities to improve reporting by including more detail on risks, assumptions, and progress against budget. The Heritage Horizons Programme aims to tackle climate and nature crises through twenty long-term projects, benefiting people's health and well-being. The audit also highlighted the need for improvements in updating project reports to include details like risks and Key Performance Indicators (KPIs) and for developing processes to document and share lessons learned. Finally, the report notes that the programme is moving into its delivery phase and confirms that several processes are being implemented to ensure ongoing success.

This document contains a follow-up review of the Cairngorms National Park Authority's management actions on previous internal audit recommendations. The review, conducted by Azets, shows progress in addressing 35 open actions, with 11 closed and another 20 partially complete. Three actions were deemed no longer applicable. The Audit and Risk Committee is asked to note the progress made and any revised deadlines for outstanding actions. Further work is needed to complete the remaining recommendations.

This document contains the Cairngorms National Park Authority's internal audit report for 2023/24, specifically focusing on management action follow-up. The report reviews the progress made on implementing actions from previous audit reports, checking in with park staff for updates. It shows that of 55 actions, 11 were completed and three were no longer needed by November 2023. The remaining open actions are categorized by their completion status and risk level, with recommendations given to management for prioritising outstanding items. Appendices provide a detailed breakdown of action status, outstanding actions past their due dates, and a description of audit risk categorisations.

This document contains an internal audit report on the Cairngorms National Park Authority's health and safety processes, procedures, and controls. The audit, completed as part of the 2023/24 internal audit program, resulted in six recommendations for improvement. Management welcomed the report and accepted all recommendations, with responses included in the attached report. The committee is asked to review the findings of the audit and endorse the management responses.

This document contains the Cairngorms National Park Authority's 2023/24 internal audit report on health and safety. The audit found that the Park Authority has a health and safety policy in place, but identified several areas for improvement, including updating policies and procedures, improving staff training completion rates, and ensuring the accident log is up-to-date. The report also highlighted the need for more robust monitoring and reporting of health and safety matters to senior management. A management action plan outlines steps to address these issues.

This document contains the Cairngorms National Park Authority's November 2023 Internal Audit Progress Report. It summarizes internal audit activities since the last meeting, noting the completion of three audits (Health and Safety, Heritage Horizons, and a Follow Up report). The Finance System review will take a consultancy approach, helping management assess current and future systems. The report outlines the plan for the next quarter, including upcoming reports on procurement, a follow-up report, and the annual report. Finally, it requests the Audit and Risk Committee to review and approve the plan and provide feedback.

This document contains a proposal for improved risk management at the Cairngorms National Park Authority. Following an internal audit, the Park Authority is recommending a revised risk management policy and a new risk register format. The updated system will include clearer procedures for identifying, recording, and reporting operational risks, a regular review process, a scoring matrix aligning risk scores with the organisation's risk appetite, and updated risk register templates to track actions and their due dates. These improvements aim to make the risk management process more effective and relevant.

This document contains the Cairngorms National Park Authority's risk management strategy. It explains that risk management involves identifying, assessing, and controlling uncertainties and opportunities affecting the organisation's goals. This process happens at both strategic and operational levels, using a system of people, processes, and technology. The strategy defines risk appetite – the level of risk the organisation is willing to take – and outlines how this is managed, regularly reviewed, and how risks are categorized and addressed using methods like avoidance, reduction, sharing, and transfer. The document also details the roles and responsibilities of different teams in the risk management process, along with procedures for escalating and monitoring risks.

This document contains a risk register for the Cairngorms National Park Authority as of 14 November 2023. It lists several risks, including financial constraints due to public sector funding, insufficient funding for community projects, inadequate maintenance funding for assets, insufficiently robust IT services, and staff shortages. Other risks involve cybersecurity threats, inadequate business continuity plans, insufficient power to address wildlife crime, challenges in peatland restoration, ineffective communication with partners, and the need to improve conservation strategies. The register details the current impact and likelihood of each risk, along with mitigation strategies, planned actions, and risk owners. Many risks are categorized as "escalating" or "static", indicating ongoing concerns and the need for continued monitoring and action.