CAIRNGORMS NATION­AL PARK AUTHORITY

Approved MINUTES AUDIT & RISK COM­MIT­TEE 08/03/19

Approved MINUTES of MEET­ING of the AUDIT & RISK COM­MIT­TEE of THE CAIRNGORMS NATION­AL PARK AUTHORITY

held in Dee & Spey Meet­ing rooms, Cairngorms NPA, Grant­own on Spey on 8 March 2019

Present:

• Dave Fal­lows (Chair)
• Peter Argyle
• Janet Hunter
• John Lath­am
• Gaen­er Rodger
• Judith Webb

In Attend­ance:

• Claire Robertson, BDO
• Scott Peterson, BDO
• John Boyd, Grant Thornton via Video Con­fer­en­cing Link
• Grant Moir, Chief Executive
• Dav­id Camer­on, Dir­ect­or of Cor­por­ate Services
• Danie Ral­ph, Fin­ance Manager
• Alix Hark­ness, Clerk to the Board

Apo­lo­gies: None.

1. Wel­come and Apologies

The Con­vener wel­comed every­one to the meet­ing and the apo­lo­gies were noted.

2. Minutes of Pre­vi­ous Meeting

The draft con­fid­en­tial minutes of the 23 Novem­ber 2018 meet­ing were approved sub­ject to the fol­low­ing amendment:

• At In Attend­ance: The oth­er Board Mem­bers who atten­ded the meet­ing to be lis­ted: Dr Gaen­er Rodger, Wil­li­am Mun­ro and Derek Ross.

3. Minutes of Pre­vi­ous Meeting

The draft minutes of the 23 Novem­ber 2018 meet­ing were approved sub­ject to the fol­low­ing amendment:

• At In Attend­ance: The oth­er Board Mem­bers who atten­ded the meet­ing to be lis­ted: Dr Gaen­er Rodger, Wil­li­am Mun­ro and Derek Ross.
• At Para 4a: Autumn 2016 should be Autumn 2018, to be amended.

4. Mat­ters Arising

Dav­id Camer­on repor­ted that move­ment on the out­stand­ing actions through­out and lis­ted at the bot­tom of the 23 Novem­ber 2018 Audit & Risk Com­mit­tee Minutes are:

a) Intern­al Auditor’s Fol­low Up Review Report – Open – Had hoped to bring it to this meet­ing how­ever Dav­id Camer­on repor­ted that he had not had time to pull togeth­er an intern­al fol­low up note on what man­age­ment were going to do to address the points raised. Would be brought to the next meet­ing in May 2019.

b) Audit & Risk Com­mit­tee mem­ber train­ing – Open – Dav­id Camer­on reminded the Com­mit­tee that full Board On Board Train­ing had been organ­ised for 5^th April 2019. He added that he hoped Audit & Risk Com­mit­tee induc­tion train­ing would be set up for early sum­mer 2019. He explained that once the dates were set Loch Lomond & Trossachs Nation­al Park Audit & Risk Com­mit­tee would be invited to attend.

c) Audit & Risk Com­mit­tee mem­ber induc­tion pack – Open – Dav­id Camer­on repor­ted that he had just received an updated copy of the Scot­tish Gov­ern­ment Audit & Risk Com­mit­tee hand­book and once through it he would dis­trib­ute it to Com­mit­tee mem­bers in the next couple of weeks.

d) Risk Mit­ig­a­tion action for LEAD­ER Account­able Body role – let­ter to Scot­tish Gov­ern­ment as out­lined in paper to Com­mit­tee 31 August 2018 – Open – Would be actioned in due course at appro­pri­ate time.

5. Elec­tion of Com­mit­tee Vice-Chair

Dav­id Camer­on high­lighted that accord­ing to Stand­ing Orders fol­low­ing the revi­sion of Board mem­ber­ship on Com­mit­tees and Groups at the Decem­ber 2018 Board meet­ing, the Elec­tion of Com­mit­tee Vice-Chair was due to take place. He there­fore asked for nom­in­a­tions for the Vice-Chair of the Committee.

6. Nom­in­a­tions

Nom­in­a­tions were made. Dave Fal­lows nom­in­ated Judith Webb and this was seconded by Janet Hunter. Judith Webb accep­ted this nom­in­a­tion. Mem­bers present con­firmed that Judith Webb take on the role of Com­mit­tee Vice-Chair. There being only one nom­in­a­tion, it was declared that Judith Webb be appoin­ted as Vice-Chair.

7. Action:

i. Judith Webb to take the pos­i­tion of Vice-Chair of the Audit & Risk Com­mit­tee to last 3 years.

8. Intern­al Audit Review: Stra­tegic Plan­ning (Paper 1)

Claire Robertson presen­ted a Paper which presents the intern­al auditor’s report on the Authority’s stra­tegic plan­ning pro­cesses and controls.

9. The Audit & Risk Com­mit­tee made the fol­low­ing com­ments and observations:

a) The Con­vener con­grat­u­lated all for the achieve­ments high­lighted in the report.

b) Was the Organ­isa­tion­al Devel­op­ment Strategy a pub­lic doc­u­ment? Dav­id Camer­on advised that it was not. Grant Moir added that it was a doc­u­ment set­ting out how intern­ally the Author­ity devel­ops it staff base to deliv­er the Nation­al Park Part­ner­ship Plan. Resound­ing agree­ment that the Staff­ing & Recruit­ment Com­mit­tee were bet­ter placed to over­see the strategy.

c) With ref­er­ence to page 4 of the Annex where it states ​‘bring­ing people togeth­er towards a com­mon pur­pose’, what did this mean? Grant Moir reminded the Com­mit­tee that this phrase was taken dir­ectly from the Nation­al Park Part­ner­ship Plan which had been developed the Board and staff.

d) The Con­vener drew the Committee’s atten­tion to the Obser­va­tion sec­tion of the Annex (page 8), and repor­ted that it was well explained there. Dav­id Camer­on agreed and said he would have a dis­cus­sion with man­age­ment team to decide wheth­er it would be wise cre­at­ing a new risk around that sub­ject on the Stra­tegic Risk Register. The stra­tegic risk register would be brought back to the Com­mit­tee at their next meeting.

e) Was there any fin­an­cial bene­fit of hav­ing received such a pos­it­ive report? Dav­id Camer­on advised that there was a resource bene­fit in that as a team there is no need to adjust stra­tegic plan­ning pro­cesses there­fore resources can be focused in delivery.

f) Was there a pub­lic rela­tions oppor­tun­ity in this achieve­ment? Grant Moir repor­ted the com­mu­nic­a­tions plan for March which would help show seni­or civil ser­vants in the gov­ern­ment how suc­cess­ful the Author­ity are at lever­aging in funding.

g) Dis­cus­sion around com­mu­nic­at­ing the Committee’s praise back to staff. Agree­ment that the Chair and Vice-Chair write a post for the intranet prais­ing them for the good work in this report.

10. The Audit & Risk Committee:

a) Con­sidered the intern­al auditor’s find­ings on the Authority’s arrange­ments for stra­tegic planning;

b) Endorse the man­age­ment responses to recom­mend­a­tions for action raised by the intern­al auditor.

11. Actions:

i. Audit & Risk Com­mit­tee Chair and Vice-Chair write a post for the intranet prais­ing staff for the good work in this report.

12. Intern­al Audit Review: Fin­an­cial Plan­ning Review (Paper 2)

Claire Robertson presen­ted a Paper which presents the fin­an­cial plan­ning review.

13. In dis­cus­sion the Audit & Risk Com­mit­tee made the fol­low­ing com­ments and observations:

a) Obser­va­tion that it was a very good report which high­lighted good prac­tice. Com­ment made that the pos­it­iv­ity of the report should not be under­es­tim­ated. Agree­ment that the Chair and Vice Chair write a post for the intranet prais­ing staff for the pos­it­ive report.

b) Was a fin­an­cial mod­el fol­lowed in order to determ­ine core costs? Dav­id Camer­on explained that core costs tend to be fixed costs such as staff, IT and pro­fes­sion­al sup­port where­as the Oper­a­tion­al Plan invest­ment tends to be more flex­ible how­ever less flex­ible at present due to three and four year com­mit­ments made to pro­jects. He explained that the ambi­tion was to keep £1m for the Oper­a­tion­al Plan. Grant Moir added that over the past five years the Author­ity had been extremely suc­cess­ful at increas­ing staff whilst keep­ing the cost of these down and still man­aging to budget over £1m for the Oper­a­tion­al Plan as a res­ult of the lever­aging of mon­ies which helps to deliv­er the projects.

14. The Audit and Risk Com­mit­tee con­sidered the intern­al auditor’s find­ings on the Authority’s arrange­ments for fin­an­cial planning.

15. Actions:

i. Audit & Risk Com­mit­tee Chair and Vice-Chair write a post for the intranet prais­ing them for the good work in this report

16. ²⁰¹⁸⁄₁₉ Audit Plan (Paper 3)

John Boyd presen­ted Paper 3 which presents the extern­al auditor’s Annu­al Audit Plan for the audit of the ²⁰¹⁸⁄₁₉ accounts. The plan sets out the key chal­lenges and risks faced by the Author­ity asso­ci­ated with this year-end audit review and the asso­ci­ated audit work that Grant Thornton pro­poses to under­take. He high­lighted that there was a typo on page 9 of the Annex, in the Key audit deliv­er­ables, the second July 2019 should be Septem­ber 2019.

17. Dav­id Camer­on advised that he was con­tent with the fee being pro­posed. He reminded the Com­mit­tee that at the end of last fin­an­cial year the Author­ity were in a dif­fi­cult pos­i­tion with regards to the Scot­tish Gov­ern­ment owing the Author­ity LEAD­ER mon­ies. He repor­ted that this had now all been resolved and the back­log had been caught up with and it was now a clear year end.

18. In dis­cus­sion the Audit & Risk Com­mit­tee made the fol­low­ing com­ments and observations:

a) With ref­er­ence to page 5 of the Annex, why had 0.120million be writ­ten out like that and not in thou­sands? John Boyd advised that he did not know why this was the case but agreed to find out.

b) A query around thresholds which were set at £6k, was this the sum of all mis­takes as long as they were under £6k? John Boyd advised that any­thing above £6k would be repor­ted and that they are also required to report on the cumu­lat­ive threshold. He added that £6k is the threshold for report­ing to the Committee.

19. The Audit & Risk Committee:

a) Con­sidered the extern­al auditor’s Annu­al Audit Plan for the audit of the Authority’s ²⁰¹⁸⁄₁₉ accounts and wider reviews of operations.

b) Agreed, sub­ject to any com­ments, Audit Scotland’s Annu­al Audit Plan for ²⁰¹⁸⁄₁₉

c) Agreed the extern­al audit fee on behalf of the Board, as set out in the Plan, page 11, Fees and independence.

20. Actions: None.

21. Draft Gov­ernance State­ment (Paper 4)

Danie Ral­ph, Fin­ance Man­ager presen­ted the draft Gov­ernance State­ment for incor­por­a­tion in the Authority’s Annu­al Accounts for ²⁰¹⁸⁄₁₉.

22. In dis­cus­sion the Com­mit­tee agreed to the sug­ges­tion to include the word assur­ance into para­graph X of the Annex.

23. The Audit & Risk Com­mit­tee agreed to endorse the draft Gov­ernance State­ment for inclu­sion in the Authority’s ²⁰¹⁸⁄₁₉ Annu­al Accounts with the addi­tion on the word assur­ance into para­graph X of the gov­ernance statement.

24. Action:

i. Addi­tion­al work ​‘assur­ance’ to be added to the gov­ernance state­ment to be included in the Authority’s 2018 – 19 Annu­al Accounts.

25. Stra­tegic Risk Review: Work­force Man­age­ment (Paper 5)

Dav­id Camer­on presen­ted the Paper which presents an in depth review of the stra­tegic risk included in the Authority’s Stra­tegic Risk Register asso­ci­ated with the Authority’s work­force man­age­ment strategy and asso­ci­ated activities.

26. The Audit & Risk Com­mit­tee dis­cussed the fol­low­ing point:

a) It was typ­ic­al of rur­al employ­ers to employ mul­tiple mem­bers of the same fam­ily and reas­sur­ance sought that on con­fid­en­ti­al­ity grounds that there was back­ground aware­ness. Dav­id Camer­on com­men­ted that cur­rently the Author­ity had two mar­ried couples employed by them and it was com­pany policy to nev­er allow someone who is related or mar­ries to line man­age the other.

b) Recog­ni­tion of the bene­fits of the staff sur­vey, sug­ges­tion made to improve Board/​staff rela­tion­ship and in the interest of good gov­ernance to con­duct a Board self-eval­u­ation and a staff eval­u­ation of the board to ensure the res­ults are not too far from each oth­er. Grant Moir agreed and advised he would ask the Head of Organ­isa­tion­al Devel­op­ment to run the sur­vey again this year as there had been a sig­ni­fic­ant change in mem­bers of the Board. Action.

26. The Audit and Risk Committee:

a) con­sidered the in depth review of the stra­tegic risk asso­ci­ated with the Authority’s work­force man­age­ment strategy activities;

b) endorsed the inclu­sion of an addi­tion­al stra­tegic risk in the risk register as set out at para­graph Error! Ref­er­ence source not found.;

27. Action:

i. Head of Organ­isa­tion­al Devel­op­ment to be asked to con­duct the Board self-eval­u­ation and a staff eval­u­ation of the Board this com­ing year.

28. IT Risk (Paper 6)

Danie Ral­ph presen­ted an over­view of the IT risks noted in the Risk Register and what is cur­rently being done, is being planned to be done to mit­ig­ate ICT risk to the Author­ity and provide a road map for future IT development.

29. The Audit & Risk Com­mit­tee made the fol­low­ing com­ments and observations:

a) The Con­vener praised the paper for its com­pre­hens­ive format includ­ing its layout.

b) What were the risk asso­ci­ated with mov­ing to the cloud? How could these be best man­aged? Could the Author­ity con­tin­ue to func­tion should a breech occur? Would it be hos­ted in UK or China? Danie Ral­ph advised that cur­rently the cloud for the Author­ity was a phys­ic­al thing that was man­aged by the Loch Lomond & Trossachs Nation­al Park. Scot­tish Gov­ern­ment prac­tice also meant that Cloud pro­viders were loc­ated in Scot­land or at least the UK. He advised that this could bring the costs down. Grant Moir explained that our risk was con­sid­er­ably small com­pared to oth­er organ­isa­tions as by the nature of our organ­isa­tion we do not hold con­fid­en­tial data.

30. The Audit and Risk Com­mit­tee noted the inform­a­tion con­tained in the paper.

31. Action: None.

32. Com­plaints Log (Paper 7)

Dav­id Camer­on presen­ted a Paper which presents inform­a­tion on the num­ber and nature of com­plaints received by the Author­ity since the last update on this sub­ject to the Com­mit­tee in Novem­ber 2018.

33. The Audit & Risk Com­mit­tee accep­ted the inform­a­tion on com­plaints made to the Authority.

34. Actions: None.

35. Any Oth­er Com­pet­ent Business

Dav­id Camer­on advised that the final pro­posed Intern­al Audit Plan for 2019/2020 had been received this week and had been cir­cu­lated to mem­bers of the Committee.

36. Hav­ing con­sidered the final pro­posed Intern­al Audit Plan for 2019/2020 The Audit and Risk Com­mit­tee agreed it so that the two audits detailed with­in it could begin.

37. Date of Next Meeting

8 March 2019, Am Fas­gadh, High­land Folk Museum, Newtonmore.

38. Meet­ing closed 10.20 hours

Audit & Risk Com­mit­tee: Out­stand­ing Actions

Action	Status
Audit and Risk Com­mit­tee mem­ber training	Open
Audit and Risk Com­mit­tee induc­tion pack	Open
Risk mit­ig­a­tion action for LEAD­ER Account­able Body role — let­ter to Scot­tish Gov­ern­ment as out­lined in paper to Com­mit­tee 31 August 2018	Open
Plan­ning Con­sent Com­plaint dat­ing from 2017 which had been escal­ated to the SPSO, DC to report back to Com­mit­tee when resolved (23 Novem­ber 2018)	Open
Intern­al Auditor’s Fol­low Up Review Report – Open –	FIND
Ori­gin­al request (DATE)	Open