Audit & Risk Committee - September 2022

This document contains the agenda for the Cairngorms National Park Authority's Audit and Risk Committee meeting on 30 September 2022 at 2 pm. The agenda includes several items for decision, focusing on internal audits of the Peatland ACTION Programme, performance management, workforce management and planning, and the LEADER Programme. Other discussion points include the internal audit progress report, actions on audit recommendations, an external audit update, and the committee's draft annual report. The next meeting is scheduled for 11 November 2022 at 2.30 pm.

This document contains an internal audit report on the Cairngorms National Park Authority's Peatland ACTION Programme. The audit reviewed the programme's setup, design, and implementation. Nine recommendations were made to improve control systems, with two considered high risk, focusing on agreements with land managers and a review of team processes. Management accepted all recommendations and is taking steps to implement them, including restructuring the team and creating clearer roles. The audit highlighted the challenges of a new, rapidly expanding programme and the need for stronger internal controls.

This document contains the Cairngorms National Park Authority's internal audit report for 2021/22 on the Peatland Action Programme. The audit found that while the Park Authority's "full service" approach to the programme had advantages, it also created significant risks related to legal, financial, and staff resourcing issues. A lack of strategic direction and problems with key controls and communication were also identified. The report highlights several areas needing improvement, including risk assessment, documentation, and communication strategies, and makes recommendations for strengthening the Park Authority’s control framework and ensuring full preparedness for an "open call" for applications.

This document contains the Cairngorms National Park Authority's (CNPA) internal audit report on performance management. Azets, an auditing firm, reviewed the CNPA's systems and found that they demonstrate progress against strategic and operational plans. Three recommendations for improvements were made, all of which were accepted by management. All control objectives were achieved, although there's room for improvement. The Audit and Risk Committee needs to review the report and endorse the management's response to recommendations for future action and system improvements.

This document contains the Cairngorms National Park Authority's (CNPA) 2022/23 Internal Audit Report on Performance Management. The audit found that while the CNPA has a performance management system in place, improvements are needed. Many key performance indicators focus on activities rather than outcomes, and workplans weren't always up-to-date or measurable. The report recommends developing a dashboard for better real-time reporting and ensuring staff workplans are specific, measurable, and timebound, linked to the corporate plan. The audit identified some good practices, such as regular reporting to the Board and Performance Committee, but the overall assessment highlighted areas needing improvement to strengthen the CNPA's control framework.

This document contains an internal audit report on the Cairngorms National Park Authority's workforce management and planning. Azets, an auditing firm, reviewed the Authority's systems and found two areas needing improvement. Management accepted both recommendations, and plans to take action are detailed in the full report. One improvement is considered high-risk, relating to updating the existing workforce strategy. Of four control areas assessed, one was deemed adequate, two had room for improvement, and one was not meeting requirements.

This document contains an internal audit report from July 2022 on the Cairngorms National Park Authority's workforce management and planning for 2022/23. The audit found that while the Park Authority's workforce planning is generally well-designed, its strategy needs updating to reflect current challenges, including the post-pandemic work environment and the impact of increased externally funded projects. The report also highlights the need for improved succession planning and better use of demographic data to support effective workforce planning. Several recommendations are made to strengthen the Park Authority's control framework, including updating its workforce strategy and improving communications and wellbeing initiatives for staff, particularly those working remotely or in hybrid arrangements.

This document contains an internal audit report on the Cairngorms National Park Authority's (CNPA) management of the LEADER Programme. The audit, conducted by Azets, reviewed how well the CNPA met its responsibilities as defined in its agreement with the Scottish Government. The audit found two areas needing improvement, with recommendations for action already accepted by management. One issue is considered moderate risk, the other low risk. Of five control areas assessed, two were found to be fully effective, while three showed room for improvement. The full audit report is included as an appendix.

This document contains an internal audit report on the Cairngorms National Park Authority's LEADER programme for 2022/23. The audit found that the programme's closure procedures followed good practice, with clear guidance and compliance in place. Some minor improvements were identified, such as better documentation of decisions outside standard processes and contingency plans for staff absences. The audit also noted progress in addressing past records management issues, though some challenges remain in maintaining records accessibility and capturing lessons learned from the programme. Overall, the audit highlighted good practices within the LEADER programme, while recommending a few steps to further strengthen internal procedures and risk management.

This document contains an assurance mapping exercise for the Cairngorms National Park Authority. It presents initial work, assessing the needed levels of assurance and planning future progress. The Audit and Risk Committee is asked to review a report on this mapping and advise on the framework's development and initial assessment of assurance needs. The Park Authority has been working on its governance processes, and this assurance framework will complement that work, tying together key areas of assurance, required levels of assurance, and the effectiveness of current systems. The approach and initial assessment of key areas are detailed in annexes to the document.

This document contains an assurance mapping for the Cairngorms National Park Authority (CNPA). It lists several key areas including financial and workforce planning, strategic and operational planning and delivery, corporate governance and culture, recruitment and retention, financial management, funding programmes, IT and information security, facilities management, communication and stakeholder engagement, and project and programme management. Each area has associated risks identified with a high, medium, or low level of assurance need. The document details specific aspects within each area needing attention, for example, financial planning and decision-making, staff training, and stakeholder engagement processes.

This document contains a September 2022 report from the Cairngorms National Park Authority on assurance mapping. It outlines a process, based on a "three lines of defence" model, to help the Audit Committee understand the breadth and quality of assurance received across the organisation. The methodology involves five stages: identifying key assurance areas, confirming assurance sources, assessing assurance quality, determining assurance needs, and finally, creating an assurance map. The report asks the Audit Committee to review a draft list of assurance areas and define the required level of assurance (high, medium, or low) for each. The next steps involve documenting current assurance sources, assessing their quality, and consolidating the information into a final assurance map to be presented in November 2022.

This document contains an update on the Cairngorms National Park Authority's progress in implementing internal audit recommendations. The Audit and Risk Committee needs to review the progress made and decide whether to remove some recommendations that are outdated, superseded, or too expensive to implement. A report detailing this progress, highlighting completed actions in green and ongoing actions in amber, is available. The committee will review recommendations for removal and receive a full update from Azets later, after they have checked that the work has been done and controls are in place.

This document contains an audit of the Cairngorms National Park Authority, detailing various findings and recommendations across different areas. The audit assessed risk management, financial processes, grant funding, IT controls, project management, communications, partnership management, resource planning, business continuity, payroll administration, expense claims, staff objectives, FOI requests, and project finance. Many recommendations involved improving documentation, clarifying roles and responsibilities, implementing electronic systems, and strengthening internal controls. Several recommendations were not taken forward due to factors such as existing informal processes, cost considerations, or the dynamic nature of certain roles. The overall goal was to improve efficiency, transparency, and compliance within the organization.

This document contains the Cairngorms National Park Authority's Audit and Risk Committee's annual report, covering April 2021 to August 2022. The report details the committee's activities, including reviews of financial accounts, risk management strategies, business continuity plans, and internal and external audit findings. The committee considered various reports, agreed on several action plans, and noted the generally positive outcome of audits, with no "very high risk" recommendations identified. The report concludes that the Authority’s internal controls and governance priorities are being met effectively.