Cairngorms Nation­al Park Author­ity Intern­al Audit Report: Stra­tegic Plan­ning (Novem­ber 2018)

CAIRNGORMS NATION­AL PARK AUTHORITY Audit & Risk Com­mit­tee Paper | Annex 1 | 08/03/2019

BDO

Con­tents

• Exec­ut­ive Sum­mary — 3
• Obser­va­tions — 8
• Appen­dices:
  • I Staff Inter­viewed — 9
  • II Defin­i­tions — 10
  • III Terms of Ref­er­ence — 11

Report Status

• Aud­it­ors: Scott Peterson
• Dates work per­formed: 05/11/2018 — 07/11/2018
• Draft report issued: 29/11/2018
• Final report issued: 13/12/2018

Dis­tri­bu­tion List

• Grant Moir — CEO
• Dav­id Camer­on — Dir­ect­or of Cor­por­ate Services
• Audit & Risk Committee

Restric­tions of use: The mat­ters raised in this report are only those which came to our atten­tion dur­ing the course of our audit and are not neces­sar­ily a com­pre­hens­ive state­ment of all the weak­nesses that exist or all improve­ments that might be made. The report has been pre­pared solely for the man­age­ment of the organ­isa­tion and should not be quoted in whole or in part without our pri­or writ­ten con­sent. BDO LLP neither owes nor accepts any duty to any third party wheth­er in con­tract or in tort and shall not be liable, in respect of any loss, dam­age or expense which is caused by their reli­ance on this report.

Exec­ut­ive Summary

Level of Assur­ance (See Appendix II for definitions)

• Design: Sub­stan­tial — There is a sound sys­tem of intern­al con­trol designed to achieve sys­tem objectives.
• Effect­ive­ness: Sub­stan­tial — The con­trols that are in place are being con­sist­ently applied.

Sum­mary of Recom­mend­a­tions (See Appendix II)

• High: ▲
• Medi­um: ▲
• Low: ▲
• Total num­ber of recom­mend­a­tions: 0

Over­view

Back­ground: As part of the 2018 – 19 Intern­al Audit Plan, it was agreed that Intern­al Audit would per­form a review of the Stra­tegic Plan­ning pro­cess in place at Cairngorms Nation­al Park Author­ity (“CNPA”). The pur­pose of the review was to provide assur­ance to the Audit Com­mit­tee and Man­age­ment that the Stra­tegic Plan­ning arrange­ments, in rela­tion to key stra­tegic goals, object­ives and the over­all stra­tegic plan, are well designed and oper­at­ing effect­ively through­out the organisation.

The Part­ner­ship Plan 2017 – 2022 was pub­lished in 2017 and is the third five-year plan cov­er­ing the last 15 years. The part­ners lis­ted in the plan are approx­im­ately 49 organ­isa­tions in the pub­lic, private, and char­it­able sec­tor. It has been approved by Scot­tish Min­is­ters and sets out how those respons­ible for Cairngorms Nation­al Park will coordin­ate their work to address the Park’s most import­ant issues.

The stra­tegic plan is known as the Cor­por­ate Plan (2018−2022). It was pub­lished in 2018 and details the strategy designed to achieve the Part­ner­ship Plan. The Organ­isa­tion­al Devel­op­ment Strategy was intro­duced in March 2014 and is updated dur­ing annu­al off-site meet­ings (the next off-site is sched­uled for April 2019) with the input of the entire staff (80 FTE) and sets the pro­posed dir­ec­tion and vis­ion for the organ­isa­tion in rela­tion to people. It is designed to devel­op the staff, lead­er­ship, cul­ture, and provide dir­ec­tion in ful­filling the Cor­por­ate Plan.

The Part­ner­ship Plan indic­ates 5 strategies for the man­age­ment plans of the Park: (1) Act­ive Cairngorms — the out­door access strategy (2) Cairngorms Nature — details the con­ser­va­tion pri­or­it­ies (3) Eco­nom­ic Strategy — estab­lishes the eco­nom­ic pri­or­it­ies (4) Loc­al Devel­op­ment — indic­ates the policies for land use plan­ning (5) LEAD­ER Loc­al Devel­op­ment — sets the pri­or­it­ies for pro­mot­ing com­munity-led loc­al devel­op­ment sup­port­ing a sus­tain­able rur­al economy.

The Cor­por­ate Plan has an illus­tra­tion on the first page demon­strat­ing how the Cor­por­ate Plan aligns with the Part­ner­ship Plan. The pri­or­it­ies are: Con­ser­va­tion, Vis­it­or Exper­i­ence, and Rur­al Devel­op­ment. Act­ive Cairngorms is a region­al policy con­text under the Vis­it­or Exper­i­ence pri­or­ity; Cairngorms Nature is a region­al policy con­text under Con­ser­va­tion; and the remain­ing three strategies are region­al policy con­texts under Rur­al Development.

The Cor­por­ate Plan has a clear vis­ion, mis­sion, val­ues, and strategies. It is avail­able in hard copy and on the website.

• Cor­por­ate Plan Vis­ion: CNPA aims to provide lead­er­ship for the Nation­al Park and to tackle issues in the park in a col­lab­or­at­ive way based on the Found­ing Nation­al Parks (Scot­land) Act 2000.
• Nation­al Park Vis­ion: An out­stand­ing Nation­al Park, enjoyed and val­ued by every­one, where nature and people thrive together.
• Cor­por­ate Plan Mis­sion: To lead the way in deliv­er­ing for the Cairngorms Nation­al Park by:
  • bring­ing people togeth­er towards a com­mon purpose
  • enhan­cing the park for everyone
  • inspir­ing new gen­er­a­tions to be park champions.
• Cor­por­ate Plan Val­ues: The CNPA is an open, inclus­ive, innov­at­ive and pro­fes­sion­al organ­isa­tion that behaves with integ­rity; the CNPA will also oper­ate in an envir­on­ment­ally friendly way that provides lead­er­ship in this area.

The Cor­por­ate Plan out­lines the respons­ib­il­it­ies by the key aims or pri­or­it­ies (Con­ser­va­tion, Vis­it­or exper­i­ence, and Rur­al Devel­op­ment). Each aim has a respons­ible Dir­ect­or and has key met­rics. The staff are held account­able for deliv­er­ing the met­rics via incor­por­at­ing them in the depart­ment and indi­vidu­al per­form­ance objectives.

The res­ults in deliv­er­ing against the Cor­por­ate Plan are dis­cussed and repor­ted in reg­u­lar man­age­ment meet­ings and at each Board meet­ing. The res­ults are also form­ally repor­ted in the Annu­al Review pub­lished on the web­site. It reit­er­ates the stra­tegic pri­or­it­ies, object­ives, and met­rics as set out in the Part­ner­ship Plan. It then details the res­ults against for the repor­ted year. The latest Annu­al Review was pub­lished in Novem­ber 2018 and cov­ers achieve­ments in ²⁰¹⁷⁄₁₈.

Scope and Approach

The scope of our review was to assess whether:

• The stra­tegic plan has artic­u­lated the vis­ion, mis­sion, val­ues and strategies of CNPA, and it has been effect­ively communicated;
• Appro­pri­ate indi­vidu­als and stake­hold­ers have been involved in the for­mu­la­tion of the wider stra­tegic object­ives of the planning;
• Sup­port­ing strategies, for example, the Organ­isa­tion­al Devel­op­ment Strategy, align to the stra­tegic plan;
• The stra­tegic plan con­tains clear object­ives with meas­ur­able suc­cess indicators;
• Key Stra­tegic goals have been artic­u­lated into actions that are set into a clear frame­work of deliv­ery includ­ing timetables and deliv­ery metrics;
• There is a frame­work in place to meas­ure and report upon the achieve­ment of object­ives with­in the stra­tegic plan.

Our approach was to con­duct inter­views and review doc­u­ment­ary evid­ence of the stra­tegic plan­ning pro­cess. We eval­u­ated the plans, pro­cesses, and strategies to identi­fy wheth­er they adequately address the risks involved in stra­tegic plan­ning. We also drew from test­ing per­formed in pri­or related intern­al audit engage­ments, spe­cific­ally, Busi­ness Per­form­ance Man­age­ment (July 2018) and Part­ner­ship Man­age­ment (Octo­ber 2018).

Good Prac­tice

The pro­cess for design­ing the Cor­por­ate Plan and Organ­isa­tion­al Devel­op­ment Strategy was highly trans­par­ent and the entire CNPA staff (80 FTE) were engaged. It included a top-down devel­op­ment from a stra­tegic approach and a bot­tom-up devel­op­ment from a deliv­ery approach. The object­ives from the plans and strategies are included in indi­vidu­al staff per­form­ance apprais­als and each per­son under­stands how their dif­fer­ent roles contribute.

The Cor­por­ate Plan breaks down the five-year object­ives from the Part­ner­ship Plan into achiev­able annu­al met­rics. The pro­gress towards accom­plish­ing the met­rics is repor­ted in an annu­al pro­gress report that is pub­lished on the website.

The dia­gram on the first page of the Cor­por­ate Plan provides a com­pre­hens­ive and easy-to-under­stand illus­tra­tion of the strategies, pri­or­it­ies, vis­ion, and expec­ted out­come. It demon­strates how the Cor­por­ate Plan, as well as oth­er plans and strategies, con­trib­ute to accom­plish­ment of the Part­ner­ship Plan as well as the over­all Park vision.

Both the Part­ner­ship and Cor­por­ate Plans are pro­fes­sion­ally pro­duced, attract­ive and easy to read.

Con­clu­sion

We can provide sub­stan­tial assur­ance over the design and oper­a­tion­al effect­ive­ness of the Stra­tegic Plan­ning pro­cess and con­trols in place.

Risks Reviewed Giv­ing Rise to No Find­ings of a High or Medi­um Significance

• The stra­tegic plan may not artic­u­late the vis­ion, mis­sion, val­ues and strategies of the Author­ity, or may not be effect­ively communicated;
• Appro­pri­ate indi­vidu­als and stake­hold­ers may not have been involved in the for­mu­la­tion of the wider stra­tegic object­ives of the busi­ness plan;
• Man­age­ment plan strategies as set out in the Part­ner­ship Plan may not be aligned or included in the stra­tegic planning;
• The Stra­tegic Plan may not con­tain clear object­ives with meas­ur­able suc­cess indicators;
• Key stra­tegic goals may not have been artic­u­lated into actions that are set into a clear frame­work of deliv­ery includ­ing timetables and deliv­ery metrics;
• There may not be a frame­work in place to meas­ure and report upon the achieve­ment of object­ives with­in the stra­tegic plan.

Obser­va­tions

1. Util­ise dash­boards to tie Cor­por­ate Plan to Part­ner­ship Plan

The Cor­por­ate Plan should clearly align with the Part­ner­ship Plan’s met­rics, indic­at­ing the cur­rent pro­gress and the cur­rent goal to reach the five-year tar­get. The Part­ner­ship Plan (2017−2022) expresses the tar­get met­rics in terms of the ulti­mate goal at the end of year 2022. The Cor­por­ate Plan is express­ing the same tar­gets, but break­ing them up per annum. For example, the Part­ner­ship Plan has a tar­get of 5,000 Ha of wood­land expan­sion by 2022. The Cor­por­ate Plan (2018−2022) has a tar­get of 1000 Ha per annum. Express­ing the tar­gets per annum without indic­at­ing the pro­gress to date, might give the impres­sion that the plans are out of synch. A graph may be use­ful to demon­strate that these are in synch.

2. Con­flict with first aim (con­ser­va­tion) risk

The Part­ner­ship Plan states that if there is a con­flict between the first aim (con­ser­va­tion) and the oth­er aims, CNPA must give great­er weight to the first aim. This risk was tested in a court case in 2012 (2012 CSOH 153 XA158/10) where a con­ser­va­tion group appealed CNPA’s decision to adopt a loc­al plan that included alloc­a­tions for dwell­ing houses. CNPA man­age­ment indic­ated that the risks of con­flict with the first aim are elab­or­ated in papers presen­ted to the Board or Plan­ning Com­mit­tee. The Board eval­u­ates the likely out­come (includ­ing the pos­sible out­come of a court chal­lenge) in their decision-mak­ing pro­cess. The Board should note the 2012 case and mon­it­or any oth­er cases that arise with CNPA or oth­er author­it­ies to con­tin­ue to enhance the risk assess­ment of likely out­comes as oth­er first aim con­flicts surface.

Appendix I — Staff Interviewed

Name	Job Title
Dav­id Cameron	Dir­ect­or of Cor­por­ate Services
Grant Moir	Chief Exec­ut­ive
Mur­ray Ferguson	Dir­ect­or of Plan­ning and Rur­al Development

BDO LLP appre­ci­ates the time provided by all the indi­vidu­als involved in this review and would like to thank them for their assist­ance and cooperation.

Appendix II — Definitions

Level of Assurance

Level of Assur­ance	Design of Intern­al Con­trol Frame­work	Oper­a­tion­al Effect­ive­ness of Intern­al Controls
Sub­stan­tial	Appro­pri­ate pro­ced­ures and con­trols in place to mit­ig­ate the key risks.	No, or only minor, excep­tions found in test­ing of the pro­ced­ures and con­trols. The con­trols that are in place are being con­sist­ently applied.
Mod­er­ate	In the main there are appro­pri­ate pro­ced­ures and con­trols in place to mit­ig­ate the key risks reviewed albeit with some that are not fully effective.	A small num­ber of excep­tions found in test­ing of the pro­ced­ures and con­trols. Evid­ence of non-com­pli­ance with some con­trols, that may put some of the sys­tem object­ives at risk.
Lim­ited	A num­ber of sig­ni­fic­ant gaps iden­ti­fied in the pro­ced­ures and con­trols in key areas.	A num­ber of reoc­cur­ring excep­tions found in test­ing of the pro­ced­ures and con­trols. Non-com­pli­ance with key pro­ced­ures and con­trols places the sys­tem object­ives at risk.
No	For all risk areas there are sig­ni­fic­ant gaps in the pro­ced­ures and controls.	Due to absence of effect­ive con­trols and pro­ced­ures, no reli­ance can be placed on their oper­a­tion. Non-com­pli­ance and/​or com­pli­ance with inad­equate controls.

Recom­mend­a­tion Significance

• High: A weak­ness where there is sub­stan­tial risk of loss, fraud, impro­pri­ety, poor value for money, or fail­ure to achieve organ­isa­tion­al objectives.
• Medi­um: A weak­ness in con­trol which, although not fun­da­ment­al, relates to short­com­ings which expose indi­vidu­al busi­ness sys­tems to a less imme­di­ate level of threat­en­ing risk or poor value for money.
• Low: Areas that indi­vidu­ally have no sig­ni­fic­ant impact, but where man­age­ment would bene­fit from improved con­trols and/​or have the oppor­tun­ity to achieve great­er effect­ive­ness and/​or efficiency.

Appendix III — Terms of Reference

Back­ground

As part of the 2018 – 19 Intern­al Audit Plan, it was agreed that Intern­al Audit would per­form a review of the Stra­tegic Plan­ning pro­cess in place at Cairngorms Nation­al Park Author­ity, includ­ing: review­ing the stra­tegic plan, report­ing on object­ives in the stra­tegic plan, key stra­tegic goals have an action plan and deliv­ery date.

Pur­pose of Review

The pur­pose of the review is to provide assur­ance to the Audit Com­mit­tee and man­age­ment that the Stra­tegic Plan­ning arrange­ments in place in rela­tion to key stra­tegic goals, object­ives and the over­all stra­tegic plan are well designed and oper­at­ing effect­ively through­out the organisation.

Key Risks

Based upon the risk assess­ment under­taken dur­ing the devel­op­ment of the intern­al audit oper­a­tion­al plan, through dis­cus­sions with man­age­ment, and our col­lect­ive audit know­ledge and under­stand­ing the key risks asso­ci­ated with the area under review are:

• The stra­tegic plan may not artic­u­late the vis­ion, mis­sion, val­ues and strategies of CNPA and may not be effect­ively communicated;
• Appro­pri­ate indi­vidu­als and stake­hold­ers may not have been involved in the for­mu­la­tion of the wider stra­tegic objectives;
• Sup­port­ing strategies may not align to the stra­tegic plan;
• The Plan may not con­tain clear object­ives with meas­ur­able suc­cess indicators;
• Key Stra­tegic goals may not have been artic­u­lated into actions that are set into a clear frame­work of deliv­ery includ­ing timetables and deliv­ery metrics;
• There may not be a frame­work in place to meas­ure and report upon the achieve­ment of object­ives with­in the stra­tegic plan.

Scope

The Scope of the review is to assess whether:

• The stra­tegic plan has artic­u­lated the vis­ion, mis­sion, val­ues and strategies of CNPA, and it has been effect­ively communicated;
• Appro­pri­ate indi­vidu­als and stake­hold­ers have been involved in the for­mu­la­tion of the wider stra­tegic object­ives of the planning;
• Sup­port­ing strategies, for example, the Organ­isa­tion­al Devel­op­ment Strategy, align to the stra­tegic plan;
• The stra­tegic plan con­tains clear object­ives with meas­ur­able suc­cess indicators;
• Key Stra­tegic goals have been artic­u­lated into actions that are set into a clear frame­work of deliv­ery includ­ing timetables and deliv­ery metrics;
• There is a frame­work in place to meas­ure and report upon the achieve­ment of object­ives with­in the stra­tegic plan.

Intern­al Audit will bring to the atten­tion of man­age­ment any points relat­ing to oth­er areas that come to their atten­tion dur­ing the course of the audit.

BDO LLP Information

BDO LLP, a UK lim­ited liab­il­ity part­ner­ship registered in Eng­land and Wales under num­ber OC305127, is a mem­ber of BDO Inter­na­tion­al Lim­ited, a UK com­pany lim­ited by guar­an­tee, and forms part of the inter­na­tion­al BDO net­work of inde­pend­ent mem­ber firms. BDO LLP is author­ised and reg­u­lated by the Fin­an­cial Con­duct Author­ity to con­duct invest­ment busi­ness. BDO is the brand name of the BDO net­work and for each of the BDO Mem­ber Firms. Copy­right ©2018 BDO LLP. All rights reserved. www​.bdo​.co​.uk