CAIRNGORMS NATION­AL PARK AUTHORITY

INTERN­AL AUDIT REPORT — DRAFT

Fol­low up review

April 2019

---

CON­TENTS

• Exec­ut­ive Sum­mary 3
• Recom­mend­a­tion Status 6
• Appen­dices:
  • I Staff Inter­viewed 26
  • II Defin­i­tions 27
  • III Terms of Ref­er­ence 28

REPORT STATUS

• Aud­it­or: Gemma Rickman
• Dates work per­formed: 4 Feb­ru­ary – 16 April 2019
• Draft report issued: 16 April 2019
• Final report issued: 26 April 2019

DIS­TRI­BU­TION LIST

• Dav­id Camer­on Dir­ect­or of Cor­por­ate Services
• Daniel Ral­ph Fin­ance Manager
• Audit & Risk Com­mit­tee Members

Restric­tions of use

>The mat­ters raised in this report are only those which came to our atten­tion dur­ing the course of our audit and are not neces­sar­ily a com­pre­hens­ive state­ment of all the weak­nesses that exist or all improve­ments that might be made. The report has been pre­pared solely for the man­age­ment of the organ­isa­tion and should not be quoted in whole or in part without our pri­or writ­ten con­sent. BDO LLP neither owes nor accepts any duty to any third party wheth­er in con­tract or in tort and shall not be liable, in respect of any loss, dam­age or expense which is caused by their reli­ance on this report.

---

EXEC­UT­IVE SUMMARY

Scope and Work Undertaken

Back­ground

As part of the pro­vi­sion of con­tinu­al assur­ance with regard to intern­al con­trol arrange­ments, a review of the degree of imple­ment­a­tion of pre­vi­ously agreed intern­al Audit recom­mend­a­tions was con­duc­ted in February/​March 2019. In accord­ance with the Intern­al Audit Annu­al Plan 2018 – 19, we have con­sidered the imple­ment­a­tion status of all recom­mend­a­tions raised from pre­vi­ous Intern­al Audit work which were due to be imple­men­ted at the time of this review. A total of 13 recom­mend­a­tions were fol­lowed up from the work under­taken by BDO dur­ing ²⁰¹⁸⁄₁₉, and 30 recom­mend­a­tions car­ried for­ward from work under­taken in pre­vi­ous years. The recom­mend­a­tions relate to 16 audit areas, as lis­ted below:

• Fin­an­cial Man­age­ment, Plan­ning & Effi­ciency ²⁰¹⁴⁄₁₅ (2 recommendations)
• Cor­por­ate Gov­ernance ²⁰¹⁷⁄₁₈ (1 recommendation)
• Com­munity Engagement/​Stakeholder Engage­ment ²⁰¹⁴⁄₁₅ (1 recommendation)
• Pro­ject Man­age­ment ²⁰¹⁷⁄₁₈ (2 recommendations)
• Risk Man­age­ment ²⁰¹⁶⁄₁₇ (2 recommendations)
• Com­mu­nic­a­tions & Social Media Strategy ²⁰¹⁷⁄₁₈ (3 recommendations)
• Pro­ject Fin­an­cing ²⁰¹⁶⁄₁₇ (2 recommendations)
• Fin­an­cial Report­ing ²⁰¹⁷⁄₁₈ (1 recommendation)
• Fin­an­cial Pro­cesses ²⁰¹⁶⁄₁₇ (1 recommendation)
• Busi­ness Per­form­ance Man­age­ment ²⁰¹⁷⁄₁₈ (1 recommendation)
• Grant Fund­ing & Man­age­ment ²⁰¹⁶⁄₁₇ (2 recommendations)
• Part­ner­ship Man­age­ment ²⁰¹⁸⁄₁₉ (2 recommendations)
• Tomin­toul & Glen­liv­et Part­ner­ship Man­age­ment ²⁰¹⁶⁄₁₇ (2 recommendations)
• Resource Plan­ning ²⁰¹⁸⁄₁₉ (3 recommendations)
• IT Gen­er­al Con­trols ²⁰¹⁶⁄₁₇ (10 recommendations)
• LEAD­ER ²⁰¹⁸⁄₁₉ (1 recommendation)
• Busi­ness Con­tinu­ity Plan­ning ²⁰¹⁸⁄₁₉ (7 recommendations)

Meth­od­o­logy

Cairngorms Nation­al Park Authority’s Intern­al Audit recom­mend­a­tion pro­gress report was reviewed to determ­ine the degree of imple­ment­a­tion achieved. Where the respons­ible per­son stated that recom­mend­a­tions had been imple­men­ted, evid­ence was sought, and test­ing under­taken where rel­ev­ant, to veri­fy con­tin­ued compliance.

Acknow­ledge­ment

We appre­ci­ate the assist­ance provided by the staff involved in the review and would like to thank them for their help and on-going co-operation.

Status of recom­mend­a­tions as at April 2019

The sum­mary below and over­leaf provides a simple over­view of the status of each recom­mend­a­tion. Of the 32 recom­mend­a­tions due to be imple­men­ted, 17 recom­mend­a­tions (53%) have been cat­egor­ised as fully imple­men­ted, 7 (22%) have been cat­egor­ised as par­tially imple­men­ted, 7 (22%) have been cat­egor­ised as not imple­men­ted, and 1 (3%) has been con­sidered as super­seded. Details of the not imple­men­ted and par­tially imple­men­ted recom­mend­a­tions are included from page 6 onwards.

On this basis, we con­clude that Cairngorms Nation­al Author­ity Park has made reas­on­able pro­gress in imple­ment­ing the recom­mend­a­tions made and we can provide assur­ance that management’s resolve to imple­ment pre­vi­ously agreed Intern­al Audit recom­mend­a­tions is sound. How­ever, con­tin­ued focus is neces­sary to ensure the remain­ing out­stand­ing recom­mend­a­tions are imple­men­ted with­in a reas­on­able time­frame, par­tic­u­larly in rela­tion to the four recom­mend­a­tions out­stand­ing from the IT Gen­er­al Con­trols review.

Audit	Fully Imple­men­ted	Par­tially Imple­men­ted	Not Imple­men­ted	Super­seded	Not Due for Imple­ment­a­tion	Total
Fin­an­cial Man­age­ment, Plan­ning & Effi­ciency 2014⁄15	2	0	0	0	0	2
Com­munity Engagement/​Stakeholder Engage­ment 2014⁄15	1	0	0	0	0	1
Risk Man­age­ment 2016⁄17	0	2	0	0	0	2
Pro­ject Fin­an­cing 2016⁄17	2	0	0	0	0	2
Fin­an­cial Pro­cesses 2016⁄17	0	0	1	0	0	1
Grant Fund­ing & Man­age­ment 2016⁄17	0	1	1	0	0	2
Tomin­toul & Glen­liv­et Part­ner­ship Man­age­ment 2016⁄17	0	1	1	0	0	2
IT Gen­er­al Con­trols 2016⁄17	5	1	3	1	0	10
Cor­por­ate Gov­ernance 2017⁄18	1	0	0	0	0	1
Pro­ject Man­age­ment 2017⁄18	0	2	0	0	0	2
Com­mu­nic­a­tions & Social Media Strategy 2017⁄18	2	0	1	0	0	3
Fin­an­cial Report­ing 2017⁄18	1	0	0	0	0	1
Busi­ness Per­form­ance Man­age­ment 2017⁄18	1	0	0	0	0	1
Part­ner­ship Man­age­ment 2018⁄19	0	0	0	0	2	2
Resource Plan­ning 2018⁄19	1	0	0	0	2	3
LEAD­ER 2018⁄19	1	0	0	0	0	1
Fin­an­cial Plan­ning 2018⁄19	0	0	0	0	0	0
Stra­tegic Plan­ning 2018⁄19	0	0	0	0	0	0
Busi­ness Con­tinu­ity Plan­ning 2018⁄19	0	0	0	0	7	7
TOTAL	17	7	7	1	11	43

---

RECOM­MEND­A­TION STATUS — RISK MAN­AGE­MENT ²⁰¹⁶⁄₁₇

Ref. 1

Ori­gin­al Recommendation

>We recom­mend that, on devel­op­ment of a risk man­age­ment policy, staff with risk man­age­ment respons­ib­il­it­ies are required to sign a check­list to con­firm wheth­er they are aware of the organisation’s risk man­age­ment approach or require fur­ther train­ing in this area.

Man­age­ment Response

>Ori­gin­al Agreed. I think the recom­mend­a­tion for staff to sign a check­list and self-cer­ti­fy aware­ness of risk man­age­ment approaches or need for fur­ther train­ing is a very prac­tic­al recom­mend­a­tion that can help avoid staff under­go­ing unne­ces­sary ​“man­dat­ory” training.

August 2018

>The post-hold­er respons­ible for deliv­ery has now left the organ­isa­tion and the recom­mend­a­tion has not been imple­men­ted as inten­ded. The Dir­ect­or of Cor­por­ate Ser­vices, will now seek to draw up a check­list for sign off by appro­pri­ate staff in dis­charge of this recom­mend­a­tion by end of Decem­ber 2018.

Respons­ib­il­ity & Imple­ment­a­tion Date

• Respons­ible Officer: Gov­ernance and Inform­a­tion Officer
• Imple­ment­a­tion Due Date: 31/03/2017

Status at April 2019 & Revised Recommendation

Par­tially Implemented

Staff have not yet been reques­ted to con­firm wheth­er they are aware of the organisation’s risk man­age­ment approach. We note that the Author­ity has integ­rated risk man­age­ment with­in its pro­ject plan­ning tool; how­ever, there has been no form­al con­firm­a­tion received in line with our recom­mend­a­tion that all staff with risk man­age­ment respons­ib­il­it­ies are aware of the approach as detailed with­in the risk man­age­ment policy.

Man­age­ment Response at April 2019

>The Dir­ect­or of Cor­por­ate Ser­vices emailed all Heads of Ser­vice on 31 May 2017 high­light­ing the approach to risk man­age­ment and seek­ing staff train­ing require­ments. We accept that we have not developed a check­list for staff to sign — how­ever, the email approach was inten­ded to act as a sur­rog­ate for a sep­ar­ate checklist.

Ref. 2

Ori­gin­al Recommendation

>We recom­mend that all pro­ject risk registers should be developed using a con­sist­ent approach aligned to the Stra­tegic Risk Register.

Man­age­ment Response

>Ori­gin­al Agreed. While the key point remains to ensure that risks and recog­nised, doc­u­mented and man­aged, we accept that risk registers should ideally be in a con­sist­ent format to aid review and escal­a­tion pro­cesses. We will rein­force the need for use of the tem­plate to sup­port con­sist­ency of prac­tice in our pro­ject man­age­ment com­mu­nic­a­tions and intern­al reviews.

August 2018

>The entirety of the pro­ject man­age­ment sup­port sys­tem is cur­rently under review, and this low level risk will be cap­tured with­in that review. We will aim to com­plete this work by Janu­ary 2019.

Respons­ib­il­ity & Imple­ment­a­tion Date

• Respons­ible Officer: Gov­ernance and Inform­a­tion Officer
• Imple­ment­a­tion Due Date: 31/03/2017

Status at April 2019 & Revised Recommendation

Par­tially Implemented

A revised risk register tem­plate has been included with­in the Authority’s Pro­ject Toolkit; how­ever, as this has not yet been applied to pro­jects, Intern­al Audit are unable to veri­fy the con­sist­ent adop­tion of the risk register with­in projects.

Man­age­ment Response at April 2019

>As noted in the above status update, this recom­mend­a­tion is sub­stan­tially com­plete with­in revised timetable. The risk tem­plate is included with­in updated pro­ject man­age­ment toolkit and we simply have not had an oppor­tun­ity yet to tri­al on pro­jects. The first tri­al is cur­rently under­way for the Cus­tom­er Records Man­age­ment Sys­tem imple­ment­a­tion project.

---

RECOM­MEND­A­TION STATUS — FIN­AN­CIAL PRO­CESSES ²⁰¹⁶⁄₁₇

Ref. 3

Ori­gin­al Recommendation

>We recom­mend that the Fin­ance Man­age­ment sched­ule is updated to provide detailed policies and guid­ance on all fin­an­cial pro­cesses. These should be reviewed on an annu­al basis. We also recom­mend that clear roles and respons­ib­il­it­ies demon­strat­ing segreg­a­tion of duties are doc­u­mented with­in the guid­ance notes for all fin­an­cial pro­cesses. We recog­nise that man­age­ment have made pro­gress in devel­op­ing the sched­ule and that com­ple­tion of this was delayed due to the imple­ment­a­tion of the new Sage system.

Man­age­ment Response

>Ori­gin­al Accep­ted. We are cur­rently review­ing and updat­ing all procedures.

August 2018

>High level tasks relat­ing to month end and year end routines and pro­ced­ures are in place. Doc­u­ment­a­tion of lower level tasks to imple­men­ted by 31 Decem­ber as part of gen­er­al review of policies, pro­ced­ures and respons­ib­il­it­ies. It should be noted that when a spe­cif­ic spread­sheet is developed for either report­ing or fin­an­cial man­age­ment notes are imbed­ded stat­ing the reas­on for the spread­sheet and how it is to be pre­pared. These are usu­ally high level and cur­rently main­tained by the fin­ance man­ager, spe­cific­ally for record­ing and track­ing LEAD­ER claims.

Respons­ib­il­ity & Imple­ment­a­tion Date

• Respons­ible Officer: Fin­ance Manager
• Imple­ment­a­tion Due Date: 31/06/2017

Status at April 2019 & Revised Recommendation

Not Imple­men­ted

The Fin­ance Man­age­ment sched­ule and guid­ance notes are yet to be updated in line with our recom­mend­a­tion. Man­age­ment have advised that pro­cesses will be reviewed and there­after doc­u­mented accordingly.

Man­age­ment Response at April 2019

>Review and updat­ing of doc­u­ment­a­tion will be car­ried out before the ¹⁸⁄₁₉ audit in June, ie by 16^th June.

---

RECOM­MEND­A­TION STATUS — GRANT FUND­ING & MAN­AGE­MENT ²⁰¹⁶⁄₁₇

Ref. 4

Ori­gin­al Recommendation

>We recom­mend that the Grant Toolkit is com­pleted, encom­passing all pro­cesses in place for the award­ing, record­ing and mon­it­or­ing of grant fund­ing. The toolkit should also clearly define the fol­low­ing: — Actions to be taken when grant con­di­tions are not being met or terms and con­di­tions are breached; — The pro­cess for con­sid­er­a­tion of the risk and value of grant fund­ing applic­a­tions to determ­ine the pro­por­tion of resource required to eval­u­ate these; and — Review and scru­tiny arrange­ments for pro­gress reports provided by grantees.

Man­age­ment Response

>Ori­gin­al Accep­ted. Final­isa­tion of the toolkit has been delayed by oth­er pri­or­ity activ­it­ies and will now be accelerated.

August 2018

>Work to recom­mence in Octo­ber and linked to pro­ject man­age­ment: To be imple­men­ted by Janu­ary 2019. The inten­tion is to com­plete this in par­al­lel with work on pro­jects to ensure a com­mon­al­ity in a risk based approach to pro­ject and grant management.

Respons­ib­il­ity & Imple­ment­a­tion Date

• Respons­ible Officer: Dir­ect­or of Cor­por­ate Services
• Imple­ment­a­tion Due Date: 30 Septem­ber 2017

Status at April 2019 & Revised Recommendation

Not Imple­men­ted

This recom­mend­a­tion is yet to be implemented.

Man­age­ment Response at April 2019

>Revised date for com­ple­tion 30 Septem­ber 2019

Ref. 5

Ori­gin­al Recommendation

>We recom­mend that man­age­ment devel­ops and main­tains a grant register which records all grant fund­ing provided. The per­form­ance require­ments detailed with­in each grant award terms and con­di­tions should be recor­ded and mon­itored with­in the track­er. The register should be reviewed on a reg­u­lar basis to ensure funds are used effect­ively and agreed object­ives are achieved.

Man­age­ment Response

>Ori­gin­al Agreed. This is a sens­ible recom­mend­a­tion and one which mir­rors recent think­ing with­in the Fin­ance Team that we should estab­lish and main­tain a cent­ral register of live grant fund­ing initiatives.

August 2018

>Per­form­ance require­ments to be back loaded for all ²⁰¹⁸⁄₁₉ grants by 31 Octo­ber; per­form­ance require­ments for all sub­sequent grants to be loaded when entered in register when a grant offer is made.

Respons­ib­il­ity & Imple­ment­a­tion Date

• Respons­ible Officer: Fin­ance Manager
• Imple­ment­a­tion Due Date: 30/11/2017

Status at August 2018 & Revised Recommendation

Par­tially Implemented

The Author­ity is in the pro­cess of pop­u­lat­ing its grant register. The register does not yet detail the per­form­ance require­ments included in the terms and con­di­tions and per­form­ance against these.

Man­age­ment Response at August 2018

>Pri­or­ity will be giv­en to pop­u­lat­ing the ¹⁹⁄₂₀ register and then back filling pre­vi­ous 2 years by 30 Septem­ber with all rel­ev­ant terms and conditions.

---

RECOM­MEND­A­TION STATUS — TOMIN­TOUL & GLEN­LIV­ET PART­NER­SHIP MAN­AGE­MENT ²⁰¹⁶⁄₁₇

Ref. 6

Ori­gin­al Recommendation

>We recom­mend that all pro­ject man­age­ment tem­plates are com­pleted for the deliv­ery phase of the TGLP pro­ject. We also recom­mend that more detailed pro­ject man­age­ment pro­to­cols are defined with­in the Pro­ject Man­age­ment Guid­ance and Pro­cess doc­u­ments. The pro­to­cols should clearly define the pro­cess to be fol­lowed for the fol­low­ing stages of a pro­ject: — Option selec­tion and pri­or­it­isa­tion; — Col­lab­or­a­tion with part­ners; — Solu­tion devel­op­ment; — Deliv­ery (includ­ing mon­it­or­ing and report­ing); and — Changes (includ­ing time, cost, qual­ity and risk changes). The change man­age­ment pro­cess for the deliv­ery phase of the pro­ject should be clearly doc­u­mented, includ­ing the iden­ti­fic­a­tion of defined lim­its out­lining at which point HLF approv­al is required.

Man­age­ment Response

>Ori­gin­al Agreed. The Pro­gramme Man­ager has now been recruited for this pro­gramme and will be charged with com­plet­ing all pro­ject man­age­ment tem­plates to enhance robust­ness of man­age­ment con­trols. As the doc­u­ment­a­tion will be com­pleted and owned by the Pro­gramme Man­ager this will also enhance lines of man­age­ment responsibility.

August 2018

>To be fully imple­men­ted by 30 Novem­ber 2018.

Respons­ib­il­ity & Imple­ment­a­tion Date

• Respons­ible Officer: Tomin­toul & Glen­liv­et Pro­gramme Man­ager with Head of Land Man­age­ment and Conservation
• Imple­ment­a­tion Due Date: 31 July 2017

Status at April 2019 & Revised Recommendation

Par­tially Implemented

Man­age­ment have advised that the guid­ance and pro­cess doc­u­ments are yet to be com­pleted in line with our recom­mend­a­tion. We note that a selec­tion of pro­ject man­age­ment tem­plates are now in place; how­ever, Intern­al Audit were unable to retrieve evid­ence to sup­port that all pro­ject man­age­ment tem­plates are now being used for the TGLP pro­ject. For example, a large pro­ject plan, pri­vacy impact assess­ments, and issues logs were not provided. We do how­ever acknow­ledge that staff are mak­ing pro­gress in adopt­ing the pro­ject man­age­ment templates.

Man­age­ment Response at April 2019

>Fur­ther evid­ence will be provided by 30 June, 2019.

Ref. 7

Ori­gin­al Recommendation

>We recom­mend that changes in spend pro­file exceed­ing an agreed threshold are repor­ted to the TGLP Board on a monthly basis.

Man­age­ment Response

>Ori­gin­al Agreed.

August 2018

>Fin­ance risk is now being con­sidered in more detail by the board as more major pro­jects are either due to start or pro­ject plans are revised. To date, as only 1 major pro­ject has been under­taken, and is cur­rently show­ing a £6k under­spend, there has been no need to set a vari­ance against pro­ject budgets, espe­cially as the Museum Refur­bish­ment was closely mon­itored by the Pro­ject man­ager. What has been agreed is that in Septem­ber a com­pre­hens­ive review of all pro­ject costs will be under­taken and the recast pro­ject costs and pro­filed spend will then be used as the bench mark for cash man­age­ment, cost mon­it­or­ing on a monthly basis. This will then be included in the monthly fin­ance paper and sup­ple­men­ted by any spe­cif­ic con­cerns by the Pro­ject man­ager. As a first step a Con­tin­gency Request form has been intro­duced. This is a request to the Board for con­tin­gency fund­ing where cost over­runs have been iden­ti­fied on review. Secondly post Septem­ber review vari­ances against plan will be repor­ted to the Board monthly. No report­ing level has been set but great­er emphas­is will be placed on the high value con­struc­tion projects.

Respons­ib­il­ity & Imple­ment­a­tion Date

• Respons­ible Officer: CNPA Fin­ance Manager
• Imple­ment­a­tion Due Date: 30 Septem­ber 2017

Status at April 2019 & Revised Recommendation

Not Imple­men­ted

Con­tinu­ation requests are now in place where approv­al for fur­ther pro­ject expendit­ure is sought from the TGLP Board. How­ever, changes in spend pro­file exceed­ing an agreed threshold have not yet been repor­ted to the TGLP Board on a monthly basis.

Man­age­ment Response at April 2019

>Report­ing to the Pro­ject Board in May will include the revised pro­jec­ted spend and fund­ing from ​“con­tin­gency” fund­ing agreed to date. There is likely to be a revi­sion on how vari­ances are now iden­ti­fied and com­mu­nic­ated to the Board.

---

RECOM­MEND­A­TION STATUS — IT GEN­ER­AL CON­TROLS ²⁰¹⁶⁄₁₇

Ref. 8

Ori­gin­al Recommendation

>We recom­mend that all secur­ity and crit­ic­al patches are imple­men­ted as a mat­ter of course, in order to min­im­ise known mal­ware, ransom­ware etc.. How­ever, we recom­mend that less crit­ic­al, for example, design ori­ent­ated patches are first tested on a smal­ler group of non-busi­ness crit­ic­al serv­ers (or test serv­ers that mir­ror the live envir­on­ment) to assess wheth­er these res­ult in any adverse con­sequences to Author­ity sys­tems before they are rolled out across the rest of the serv­er estate.

Man­age­ment Response

>Ori­gin­al Agreed.

August 2018

>We have imple­men­ted what we believe to be the most secur­ity crit­ic­al ele­ment of this recom­mend­a­tion, i.e. imme­di­ate update of crit­ic­al patches. We have not yet had the time or resource avail­ab­il­ity to design appro­pri­ate test serv­er infra­struc­ture in which to test ​“design ori­ented” patches. We will dis­cuss this aspect of the recom­mend­a­tion fur­ther with IT col­leagues from Loch Lomond and the Trossachs NPA. Pri­or­ity will be giv­en in the first instance to oth­er aspects of out­stand­ing recom­mend­a­tions as regards IT and cyber secur­ity and dis­aster recov­ery test­ing. The Fin­ance Man­ager and IT Man­ager will aim to resolve this remain­ing mat­ter by end of May 2019, to inform the ²⁰¹⁸⁄₁₉ year end audit fol­low up.

Respons­ib­il­ity & Imple­ment­a­tion Date

• Respons­ible Officer: IT Manager
• Imple­ment­a­tion Due Date: 31 Janu­ary 2018

Status at April 2019 & Revised Recommendation

Par­tially Implemented

Man­age­ment Response at April 2019

>Neither CNPA or LLT­NPA have the resources to ​“sand box” updates for a peri­od of time before imple­ment­a­tion. We will install crit­ic­al updates when advised by the soft­ware vendor. Oth­er less crit­ic­al patches will be applied at some point and we believe that the risk of mal­ware. Ransom­ware etc will dimin­ish by this delay as oth­er users imple­ment and report on any install­a­tion issues. Addi­tion­ally, post imple­ment­a­tion there are oth­er com­pens­at­ing con­trols in place that will help identi­fy risks eg Sophos fil­ter­ing. We there­fore sug­gest that this recom­mend­a­tion has been applied as fully as we are cap­able of.

Ref. 9

Ori­gin­al Recommendation

>We recom­mend that, as per the require­ments of the Secur­ity Policy, there is reg­u­lar full-restore test­ing of backups i.e. the full recov­ery of sys­tems on a bare-met­al serv­er using backup media. We also recom­mend that a form­al backup plan/​policy is developed to ensure a con­sist­ent approach is taken to man­aging backups includ­ing imple­ment­a­tion, mon­it­or­ing over their success/​failure, rerun­ning failed backups and reg­u­lar testing.

Man­age­ment Response

>Ori­gin­al Agreed.

August 2018

>Plan­ning for office exten­sion and asso­ci­ated IT sys­tems devel­op­ment, fol­lowed by staff turnover in sum­mer 2018 has pre­ven­ted this work from being taken for­ward as planned and ori­gin­ally timetabled. We will aim to devel­op this in the second half of ²⁰¹⁸⁄₁₉. Dir­ect­or of Cor­por­ate Ser­vices to take for­ward, sup­por­ted by Cor­por­ate Man­age­ment Group, to com­plete by end Feb­ru­ary 2019.

Respons­ib­il­ity & Imple­ment­a­tion Date

• Respons­ible Officer: Gov­ernance and Cor­por­ate Per­form­ance Man­ager with IT Manager
• Imple­ment­a­tion Due Date: 31 Janu­ary 2018

Status at April 2019 & Revised Recommendation

Not Imple­men­ted

This recom­mend­a­tion is yet to be implemented.

Man­age­ment Response at April 2019

>There are no cur­rent plans to attempt a full-restore of backups.

Ref. 10

Ori­gin­al Recommendation

>We recom­mend that an IT dis­aster recov­ery plan with sup­port­ing tech­nic­al recov­ery plans are developed to sup­port the recov­ery of busi­ness crit­ic­al sys­tems fol­low­ing an IT dis­aster. The plans should be suf­fi­ciently detailed to allow engin­eers that are not famil­i­ar with Author­ity sys­tems to rebuild and recov­er serv­ers and net­work hard­ware i.e. plans should include cur­rent con­fig­ur­a­tion and sys­tems set­ting information.

Man­age­ment Response

>Ori­gin­al Agreed.

August 2018

>Revised date for com­ple­tion 31 Decem­ber 2018. Plan­ning for office exten­sion and asso­ci­ated IT sys­tems devel­op­ment, fol­lowed by staff turnover in sum­mer 2018 has pre­ven­ted this work from being taken for­ward as planned and ori­gin­ally timetabled.

Respons­ib­il­ity & Imple­ment­a­tion Date

• Respons­ible Officer: Gov­ernance and Cor­por­ate Per­form­ance Man­ager with IT Manager
• Imple­ment­a­tion Due Date: 31 Janu­ary 2018

Status at April 2019 & Revised Recommendation

Super­seded

Recom­mend­a­tion now super­seded by the BDO Busi­ness Con­tinu­ity Plan­ning audit report.

Man­age­ment Response at April 2019

>Noted.

Ref. 11

Ori­gin­al Recommendation

>We recom­mend that all net­work devices are con­figured with ref­er­ence to recog­nised secur­ity baselines to ensure that all act­ive net­work com­pon­ents have met a min­im­um secur­ity standard.

Man­age­ment Response

>Ori­gin­al Agreed.

August 2018

>To be com­pleted by 31 Decem­ber 2018.

Respons­ib­il­ity & Imple­ment­a­tion Date

• Respons­ible Officer: IT Manager
• Imple­ment­a­tion Due Date: 31 March 2018

Status at April 2019 & Revised Recommendation

Not Imple­men­ted

This recom­mend­a­tion is yet to be implemented.

Man­age­ment Response at April 2019

>Revised date for imple­ment­a­tion 31 Decem­ber 2019.

Ref. 12

Ori­gin­al Recommendation

>We recom­mend that the Author­ity con­sider devel­op­ing and imple­ment­ing a net­work secur­ity mon­it­or­ing and log­ging strategy to ensure that areas of the net­work that are used to store or pro­cess sens­it­ive data are sub­ject to pro­act­ive mon­it­or­ing con­trols. Also, we recom­mend that man­age­ment con­sider intro­du­cing a sys­log for securely cap­tur­ing and retain­ing log inform­a­tion to ensure the avail­ab­il­ity and integ­rity of log data is maintained.

Man­age­ment Response

>Ori­gin­al Agreed.

August 2018

>The first phase of the Cyber Essen­tials cer­ti­fic­a­tion is in pro­gress and the ini­tial report is awaited.

Respons­ib­il­ity & Imple­ment­a­tion Date

• Respons­ible Officer: IT Manager
• Imple­ment­a­tion Due Date: 31 March 2018

Status at April 2019 & Revised Recommendation

Not Imple­men­ted

This recom­mend­a­tion is yet to be implemented.

Man­age­ment Response at April 2019

>Cyber Essen­tials+ cer­ti­fic­a­tion has been gained — com­ple­tion was in Decem­ber 2018.

---

RECOM­MEND­A­TION STATUS — PRO­JECT MAN­AGE­MENT ²⁰¹⁷⁄₁₈

Ref. 13

Ori­gin­al Recommendation

>We recom­mend that all pro­ject man­age­ment tem­plates are com­pleted for future pro­jects in line with the pro­ject man­age­ment guidelines. We also recom­mend that a pro­cess for request­ing and approv­ing changes to defined lim­its relat­ing to cost, time, qual­ity and risk is doc­u­mented and applied. We also recom­mend that all changes are recor­ded with­in a pro­ject change log.

Man­age­ment Response

>Ori­gin­al Recom­mend­a­tion accep­ted. The Oper­a­tion­al Man­age­ment Group, com­pris­ing all Heads of Ser­vice, have addi­tion­ally com­menced an intern­al review of the adequacy of the pro­ject man­age­ment tem­plates and wheth­er the approach to pro­ject man­age­ment approv­al and gov­ernance can be stream­lined without com­prom­ising intern­al con­trol stand­ards. The res­ults of this review will be applied while also ensur­ing the cur­rent recom­mend­a­tion is imple­men­ted: ensur­ing that the revised pro­ject toolkit is used fully and appropriately.

August 2018

>The entirety of the pro­ject man­age­ment sup­port sys­tem is cur­rently under review, and this action will be cap­tured with­in that review. We will aim to com­plete this work by Janu­ary 2019.

Respons­ib­il­ity & Imple­ment­a­tion Date

• Respons­ible Officer: Dir­ect­or of Cor­por­ate Ser­vices with Head of Organ­isa­tion­al Development
• Imple­ment­a­tion Due Date: 30 June 2018

Status at April 2019 & Revised Recommendation

Par­tially Implemented

A pro­ject man­age­ment toolkit is now in place which aims to ensure a con­sist­ent approach to pro­ject man­age­ment. Man­age­ment have advised that this toolkit is cur­rently being rolled out to projects.

Man­age­ment Response at March 2019

>As noted above, the updated pro­ject toolkit is com­plete and being rolled out. We are still to com­plete pro­cesses around change requests, being mind­ful of one of the Authority’s key attrib­utes of being flex­ible and adapt­able. We will con­sider these final ele­ments as we review the roll out of pro­ject man­age­ment over 2019.

Ref. 14

Ori­gin­al Recommendation

>We recom­mend that roles and respons­ib­il­it­ies are fully doc­u­mented for all key people and groups with respons­ib­il­it­ies for each project.

Man­age­ment Response

>Ori­gin­al Agreed.

August 2018

>Man­age­ment will revis­it the register of pro­jects and detail those sig­ni­fic­ant and large scale pro­jects for which the roles and respons­ib­il­it­ies of all key people and groups should be documented.

Respons­ib­il­ity & Imple­ment­a­tion Date

• Respons­ible Officer: Dir­ect­or of Cor­por­ate Services
• Imple­ment­a­tion Due Date: 31 July 2018

Status at April 2019 & Revised Recommendation

Par­tially Implemented

As repor­ted in our 2017 – 18 fol­low up report, anti­cip­ated staff resources have been detailed with­in the Authority’s register of pro­jects. This details the staff mem­bers involved for each pro­ject, and the approx­im­ate amount of time required from each. How­ever, detailed pro­ject respons­ib­il­it­ies have not been doc­u­mented for each pro­ject. Man­age­ment have advised that there is a need to fur­ther cap­ture roles and respons­ib­il­it­ies with­in the pro­ject plan­ning toolkit.

Man­age­ment Response at April 2019

>As noted above in status update. How we best cap­ture roles and respons­ib­il­it­ies with­in the revised toolkit is under review.

---

RECOM­MEND­A­TION STATUS — COM­MU­NIC­A­TIONS & SOCIAL MEDIA STRATEGY ²⁰¹⁷⁄₁₈

Ref. 15

Ori­gin­al Recommendation

>We recom­mend that feed­back on the effect­ive­ness of key digit­al com­mu­nic­a­tions is sought and respon­ded to from stake­hold­ers. We recom­mend that the Com­mu­nic­a­tions and Engage­ment team con­siders con­duct­ing a stake­hold­er sur­vey cam­paign to gain feed­back on the digit­al plat­forms and accounts which are cur­rently in use by CNPA. We also recom­mend that man­age­ment con­sider con­duct­ing this pro­cess pri­or to the com­ple­tion of the com­mu­nic­a­tions and social media strategy.

Man­age­ment Response

>Ori­gin­al We agree with this recom­mend­a­tion and will carry out a short sur­vey on our digit­al com­mu­nic­a­tions and social media activ­ity with our stake­hold­ers pri­or to the com­ple­tion of the social media strategy.

August 2018

>We have ini­ti­ated a review of our stake­hold­er com­mu­nic­a­tions, with an ini­tial focus on res­id­ents, over July and August with a work­shop held on 14 August to review ini­tial res­ults of this exer­cise and explore options for future activity.

Respons­ib­il­ity & Imple­ment­a­tion Date

• Respons­ible Officer: Sian Jamieson
• Imple­ment­a­tion Due Date: 30 April 2018

Status at April 2019 & Revised Recommendation

Not Imple­men­ted

With­in our 2017 – 18 fol­low up review it was repor­ted that an extern­al con­sult­ant had been recruited to review com­mu­nic­a­tions and engage­ment prac­tices with Park res­id­ents and devel­op recom­mend­a­tions for future engage­ment. How­ever, since this exer­cise there has been no form­al stake­hold­er engage­ment sur­vey or activ­it­ies. Intern­al Audit have been advised that the Author­ity aims to con­duct form­al stake­hold­er sur­veys through­out the remainder of 2019.

Man­age­ment Response at April 2019

>A new com­mu­nic­a­tions approach has been adop­ted (The Com­mu­nic­a­tions Grid) which is a more struc­tured approach to our com­mu­nic­a­tions, includ­ing digit­al. A pro­gramme of work has been agreed com­men­cing in May res­ult­ing in imple­ment­a­tion in Decem­ber 2012.

---

APPENDIX I — STAFF INTERVIEWED

NAME	JOB TITLE
Daniel Ral­ph	Fin­ance Manager
Dav­id Cameron	Dir­ect­or of Cor­por­ate Services
Sandy Allan	IT Man­ager

BDO LLP appre­ci­ates the time provided by all the indi­vidu­als involved in this review and would like to thank them for their assist­ance and co-operation.

---

APPENDIX II — DEFINITIONS

LEVEL OF ASSUR­ANCE	DESIGN of intern­al con­trol frame­work	OPER­A­TION­AL EFFECT­IVE­NESS of intern­al controls
Sub­stan­tial	Appro­pri­ate pro­ced­ures and con­trols in place to mit­ig­ate the key risks.	No, or only minor, excep­tions found in test­ing of the pro­ced­ures and controls.
Reas­on­able	In the main there are appro­pri­ate pro­ced­ures and con­trols in place to mit­ig­ate the key risks reviewed albeit with some that are not fully effective.	A small num­ber of excep­tions found in test­ing of the pro­ced­ures and controls.
Lim­ited	A num­ber of sig­ni­fic­ant gaps iden­ti­fied in the pro­ced­ures and con­trols in key areas. Where prac­tic­al, efforts should be made to address in-year.	A num­ber of reoc­cur­ring excep­tions found in test­ing of the pro­ced­ures and con­trols. Where prac­tic­al, efforts should be made to address in-year.
No	For all risk areas there are sig­ni­fic­ant gaps in the pro­ced­ures and con­trols. Fail­ure to address in-year affects the qual­ity of the organisation’s over­all intern­al con­trol framework.	Due to absence of effect­ive con­trols and pro­ced­ures, no reli­ance can be placed on their oper­a­tion. Fail­ure to address in-year affects the qual­ity of the organisation’s over­all intern­al con­trol framework.
Recom­mend­a­tion Significance
High	A weak­ness where there is sub­stan­tial risk of loss, fraud, impro­pri­ety, poor value for money, or fail­ure to achieve organ­isa­tion­al object­ives. Such risk could lead to an adverse impact on the busi­ness. Remedi­al action must be taken urgently.
Medi­um	A weak­ness in con­trol which, although not fun­da­ment­al, relates to short­com­ings which expose indi­vidu­al busi­ness sys­tems to a less imme­di­ate level of threat­en­ing risk or poor value for money. Such a risk could impact on oper­a­tion­al object­ives and should be of con­cern to seni­or man­age­ment and requires prompt spe­cif­ic action.
Low	Areas that indi­vidu­ally have no sig­ni­fic­ant impact, but where man­age­ment would bene­fit from improved con­trols and/​or have the oppor­tun­ity to achieve great­er effect­ive­ness and/​or efficiency.

---

APPENDIX III — TERMS OF REFERENCE

BACK­GROUND

As part of the 2018 – 19 Intern­al Audit plan for Cairngorms Nation­al Park Author­ity, it was agreed that intern­al audit will fol­low up on pre­vi­ously agreed recom­mend­a­tions made in Intern­al Audit reports in pre­vi­ous years, and where rel­ev­ant dur­ing the cur­rent year.

PUR­POSE OF REVIEW

The aim is to provide assur­ance to man­age­ment and the Audit Com­mit­tee that pre­vi­ous intern­al audit recom­mend­a­tions have been imple­men­ted effect­ively and with­in tar­geted timescales.

KEY RISKS

The key risk asso­ci­ated with the area under review is:

• Action is not taken to imple­ment recom­mend­a­tions res­ult­ing in weak­nesses in con­trol and sub­sequent loss, fraud or error.

SCOPE OF REVIEW

We will review management’s action taken to imple­ment intern­al audit recom­mend­a­tions. This will involve the review of recom­mend­a­tions made in each of the intern­al audit reports issued dur­ing 2018 – 19, and a fol­low up of any out­stand­ing recom­mend­a­tions from pre­vi­ous years. We will also review any recom­mend­a­tions made in the 2018 – 19 intern­al audit reports which are due for implementation.

---

BDO LLP, a UK lim­ited liab­il­ity part­ner­ship registered in Eng­land and Wales under num­ber OC305127, is a mem­ber of BDO Inter­na­tion­al Lim­ited, a UK com­pany lim­ited by guar­an­tee, and forms part of the inter­na­tion­al BDO net­work of inde­pend­ent mem­ber firms. A list of mem­bers’ names is open to inspec­tion at our registered office, 55 Baker Street, Lon­don W1U 7EU. BDO LLP is author­ised and reg­u­lated by the Fin­an­cial Con­duct Author­ity to con­duct invest­ment business.

BDO is the brand name of the BDO net­work and for each of the BDO Mem­ber Firms.

BDO North­ern Ire­land, a part­ner­ship formed in and under the laws of North­ern Ire­land, is licensed to oper­ate with­in the inter­na­tion­al BDO net­work of inde­pend­ent mem­ber firms.

Copy­right ©2019 BDO LLP. All rights reserved.

www​.bdo​.co​.uk