Cairngorms Nation­al Park Authority

Intern­al Audit Annu­al Report 2018 – 19

April 2019

CAIRNGORMS NATION­AL PARK AUTHORITY Audit & Risk Com­mit­tee Paper 3 Annex I 03/05/18

---

Con­tents

• Exec­ut­ive Sum­mary (Page 3)
• Review of 2018 – 19 work (Page 7)
• Annu­al state­ment of assur­ance (Page 8)
• Per­form­ance against oper­a­tion­al plan (Page 9)
• Audit per­form­ance (Page 10)
• Appen­dices:
  • Defin­i­tions (Page 11)

Restric­tions of use

The mat­ters raised in this report are only those which came to our atten­tion dur­ing the course of our audit and are not neces­sar­ily a com­pre­hens­ive state­ment of all the weak­nesses that exist or all improve­ments that might be made. The report has been pre­pared solely for the man­age­ment of the organ­isa­tion and should not be quoted in whole or in part without our pri­or writ­ten con­sent. BDO LLP neither owes nor accepts any duty to any third party wheth­er in con­tract or in tort and shall not be liable, in respect of any loss, dam­age or expense which is caused by their reli­ance on this report.

---

Exec­ut­ive Summary

Back­ground

Our role as intern­al aud­it­ors is to provide an inde­pend­ent, object­ive assur­ance and con­sult­ing activ­ity designed to add value and improve an organisation’s oper­a­tions. Our approach, as set out in BDO’s Intern­al Audit Manu­al, is to help the organ­isa­tion accom­plish its object­ives by bring­ing a sys­tem­at­ic, dis­cip­lined approach to eval­u­ate and improve the effect­ive­ness of risk man­age­ment, con­trol and gov­ernance processes.

Intern­al Audit Plan 2018 – 19

BDO LLP has been appoin­ted as intern­al aud­it­ors to Cairngorms Nation­al Park Author­ity to provide the Board (via the Audit Com­mit­tee) and Man­age­ment Team with assur­ance on the adequacy of the fol­low­ing arrangements:

• Risk Man­age­ment;
• Cor­por­ate Gov­ernance; and
• Intern­al Control.

Respons­ib­il­ity for these arrange­ments remains fully with man­age­ment, who should recog­nise that intern­al audit can only provide ​‘reas­on­able assur­ance’ and can­not provide any guar­an­tee against mater­i­al errors, loss or fraud. Our role at Cairngorms Nation­al Park Author­ity is also aimed at help­ing man­age­ment to improve risk man­age­ment, gov­ernance and intern­al con­trol, so redu­cing the effects of any sig­ni­fic­ant risks facing the organisation.

Our risk eval­u­ations and tests are designed to ensure that con­trols are sound both in design and effect­ive in oper­a­tion. Our con­clu­sions are based on evid­ence obtained dur­ing the course of our audit work, veri­fic­a­tion tests and samples selec­ted from the year’s trans­ac­tions to date. How­ever, our con­clu­sions should not be taken to mean that all trans­ac­tions have been prop­erly author­ised and pro­cessed or that all ele­ments of sys­tems have been tested.

Audit Approach

We have reviewed the con­trol policies and pro­ced­ures employed by Cairngorms Nation­al Park Author­ity to man­age risks in busi­ness areas iden­ti­fied by man­age­ment set out in the 2018 – 19 Annu­al Intern­al Audit Plan approved by the Audit Com­mit­tee. This report is made solely in rela­tion to those busi­ness areas and risks reviewed in the year and does not relate to any of the oth­er oper­a­tions of the organisation.

Our approach com­plies with best pro­fes­sion­al prac­tice, in par­tic­u­lar, Pub­lic Sec­tor Intern­al Audit Stand­ards and the Chartered Insti­tute of Intern­al Aud­it­ors’ Pos­i­tion State­ment on Risk Based Intern­al Auditing.

We dis­charge our role, as detailed with­in the audit plan­ning doc­u­ments agreed with Cairngorms Nation­al Park Author­ity man­age­ment for each review, by:

• Con­sid­er­ing the risks that have been iden­ti­fied by man­age­ment as being asso­ci­ated with the pro­cesses under review
• Review­ing the writ­ten policies and pro­ced­ures and hold­ing dis­cus­sions with man­age­ment to identi­fy pro­cess controls
• Eval­u­at­ing the risk man­age­ment activ­it­ies and con­trols estab­lished by man­age­ment to address the risks it is seek­ing to manage
• Per­form­ing walk­through tests to determ­ine wheth­er the expec­ted risk man­age­ment activ­it­ies and con­trols are in place
• Per­form­ing com­pli­ance tests (where appro­pri­ate) to determ­ine wheth­er the risk man­age­ment activ­it­ies and con­trols are oper­at­ing as expected.

The assur­ance state­ment provided on page 8 of this report is based on his­tor­ic­al inform­a­tion and the pro­jec­tion of any inform­a­tion or con­clu­sions con­tained in our assur­ance state­ment to any future peri­ods is sub­ject to the risk that changes may alter its validity.

Cov­er­age

Dur­ing 2018 – 19 BDO LLP has reviewed and eval­u­ated Cairngorms Nation­al Park Authority’s pro­cesses in the fol­low­ing areas:

• Part­ner­ship Management
• Resource plan­ning
• LEAD­ER Review
• Stra­tegic Planning
• Busi­ness Con­tinu­ity Planning
• Fin­an­cial Planning

Recom­mend­a­tions

To assist man­age­ment in address­ing our find­ings, we cat­egor­ise our recom­mend­a­tions accord­ing to their level or pri­or­ity. The recom­mend­a­tions made in the com­pleted reviews totalled 13.

Sum­mary of Recom­mend­a­tions (SEE APPENDIX I)

• High: 1
• Medi­um: 6
• Low: 6
• Total num­ber of recom­mend­a­tions: 13

Report­ing mech­an­isms and practices

Our ini­tial draft reports are sent to the key officer respons­ible for the area under review in order to gath­er man­age­ment responses. In every instance there is an oppor­tun­ity to dis­cuss the draft report in detail. There­fore, any issues or con­cerns can be dis­cussed with man­age­ment before final­isa­tion of the reports. Our meth­od of oper­at­ing with the Audit Com­mit­tee is to agree reports with man­age­ment and then present and dis­cuss the mat­ters arising at the Audit Com­mit­tee meetings.

Man­age­ment action on our recommendations

Man­age­ment have been con­scien­tious in review and com­ment­ing on our reports. For the reports which have been final­ised, man­age­ment have respon­ded pos­it­ively. The responses indic­ate that appro­pri­ate steps to imple­ment our recom­mend­a­tions are being put in place.

Rela­tion­ship with extern­al audit

All our final reports are avail­able to the extern­al aud­it­ors through the Audit Com­mit­tee papers and are avail­able on request. Our files are also avail­able to Extern­al Audit should they wish to review work­ing papers in order to place reli­ance on the work of Intern­al Audit.

Fol­low up

Dur­ing the year we under­took inde­pend­ent exer­cises to assess the pro­gress made by Cairngorms Nation­al Park Author­ity in imple­ment­ing intern­al audit recom­mend­a­tions made in pre­vi­ous years.

Imple­ment­a­tion of recom­mend­a­tions is a key determ­in­ant of our annu­al assur­ance state­ment. If recom­mend­a­tions are not imple­men­ted on a timely basis then weak­nesses in con­trol and gov­ernance frame­works will remain in place. Fur­ther­more, an unwill­ing­ness or inab­il­ity to imple­ment recom­mend­a­tions reflects poorly on management’s com­mit­ment to the main­ten­ance of a robust con­trol envir­on­ment. With­in Cairngorms Nation­al Park Author­ity we found an adequate level of com­mit­ment and effort in clear­ing as many out­stand­ing recom­mend­a­tions as pos­sible from pre­vi­ous audit reports, how­ever con­tin­ued focus is neces­sary to ensure the remain­ing out­stand­ing recom­mend­a­tions are imple­men­ted with­in a reas­on­able timeframe.

We fol­lowed up 43 recom­mend­a­tions from 2018 – 19 and pri­or years. At the time of our work, we noted that 17 of these recom­mend­a­tions had been fully imple­men­ted, 7 had been par­tially imple­men­ted, 7 recom­mend­a­tions were not imple­men­ted and 1 recom­mend­a­tion was super­seded. 11 recom­mend­a­tions were not yet due for implementation.

On the basis of fol­low up work and addi­tion­al com­ment­ary provided by man­age­ment on planned imple­ment­a­tion actions we can take reas­on­able assur­ance that management’s resolve to imple­ment pre­vi­ously agreed recom­mend­a­tions is sound.

Sum­mary of work performed

Details of the six intern­al audit reviews and the fol­low up review have been repor­ted to the Audit Com­mit­tee through­out the year and have been dis­cussed at length with con­sid­er­a­tion and scru­tiny of man­age­ment responses and times­cales proposed.

For the pur­pose of this annu­al report, we set out in the fol­low­ing pages our sum­mary of recom­mend­a­tions and assess­ment of the design and effect­ive­ness of the risk assur­ance for each of the audit areas reviewed.

---

Review of 2018 – 19 Work

Reports Issued	High	Medi­um	Low	Design	Oper­a­tion­al Effectiveness
Part­ner­ship Management	0	0	2	Sub­stan­tial	Sub­stan­tial
Resource Plan­ning	0	0	3	Mod­er­ate	Mod­er­ate
LEAD­ER Review	0	1	0	Sub­stan­tial	Mod­er­ate
Stra­tegic Planning	0	0	0	Sub­stan­tial	Sub­stan­tial
Busi­ness Con­tinu­ity Planning	1	5	1	Lim­ited	Lim­ited
Fin­an­cial Planning	0	0	0	Sub­stan­tial	Sub­stan­tial
Fol­low Up	n/​a	n/​a	n/​a	n/​a	n/​a

---

Annu­al State­ment of Assurance

Report by BDO LLP to Cairngorms Nation­al Park Authority

As the intern­al aud­it­ors of Cairngorms Nation­al Park Author­ity we are required to provide the Board, via the Audit Com­mit­tee, and the Seni­or Man­age­ment Team with a view on the adequacy and effect­ive­ness of Cairngorms Nation­al Park Authority’s risk man­age­ment, gov­ernance and intern­al con­trol processes.

In giv­ing our view it should be noted that assur­ance can nev­er be abso­lute. The intern­al audit ser­vice provides Cairngorms Nation­al Park Author­ity with reas­on­able assur­ance that, there are no major weak­nesses in the intern­al con­trol sys­tem for the areas reviewed in 2018 – 19. There­fore, the state­ment of assur­ance is not a guar­an­tee that all aspects of the intern­al con­trol sys­tem are adequate and effect­ive. The state­ment of assur­ance should con­firm that, based on the evid­ence of the audits con­duc­ted, there are no signs of mater­i­al weak­ness in the frame­work of control.

In assess­ing the level of assur­ance to be giv­en, we have taken into account:

• All intern­al audit reviews under­taken by BDO LLP dur­ing 2018 – 19;
• Any fol­low-up action taken in respect of audits from pre­vi­ous peri­ods for these audit areas;
• Wheth­er any sig­ni­fic­ant recom­mend­a­tions have not been accep­ted by man­age­ment and the con­sequent risks;
• The effects of any sig­ni­fic­ant changes in the organisation’s object­ives or systems;
• The require­ments of the Pub­lic Sec­tor Intern­al Audit Stand­ards; and
• Any lim­it­a­tions which may have been placed on the scope of intern­al audit (no restric­tions were placed on our work).

Con­clu­sion

In our view, based on the reviews under­taken dur­ing the peri­od, and in the con­text of materiality:

• The risk man­age­ment activ­it­ies and con­trols in the areas which we examined were found to be suit­ably designed to achieve the spe­cif­ic risk man­age­ment, con­trol and gov­ernance arrange­ments, with the excep­tion of the busi­ness con­tinu­ity plan, where fur­ther work is required.
• Based on our veri­fic­a­tion reviews and sample test­ing, risk man­age­ment, con­trol and gov­ernance arrange­ments were oper­at­ing with suf­fi­cient effect­ive­ness to provide reas­on­able, but not abso­lute assur­ance that the related risk man­age­ment, con­trol and gov­ernance object­ives were achieved for the peri­od under review, in all areas except busi­ness continuity.

---

Per­form­ance Against Oper­a­tion­al Plan

Vis­it	Date of vis­it	Pro­posed Audit	Planned Days	Actu­al Days	Status
1	July 2018	Part­ner­ship Management	5	5	Com­plete
2	July 2018	Resource Plan­ning	5	5	Com­plete
3	August 2018	LEAD­ER Review	6	6	Com­plete
4	Novem­ber 2018	Stra­tegic Planning	5	5	Com­plete
5	Decem­ber 2018	Fin­an­cial Planning	5	5	Com­plete
6	Feb­ru­ary 2019	Busi­ness Con­tinu­ity Planning	4	4	Com­plete
7	August 2018	Fol­low Up	3	3	Com­plete

---

Audit Per­form­ance

AUDIT	COM­PLE­TION OF FIELDWORK/DEBRIEF MEET­ING	DRAFT REPORT	FINAL MAN­AGE­MENT RESPONSES	FINAL REPORT
Part­ner­ship Management	18 July 2018	2 Octo­ber 2018	26 Octo­ber 2018	26 Octo­ber 2018
Resource Plan­ning	19 July 2018	3 Octo­ber 2018	26 Octo­ber 2018	26 Octo­ber 2018
LEAD­ER Review	14 Septem­ber 2018	28 Septem­ber 2018	16 Octo­ber 2018	18 Octo­ber 2018
Stra­tegic Planning	7 Novem­ber 2018	29 Novem­ber 2018	13 Decem­ber 2018	13 Decem­ber 2018
Busi­ness Con­tinu­ity Planning	15 Feb­ru­ary 2019	22 Feb­ru­ary 2019	10 April 2019	12 April 2019
Fin­an­cial Planning	14 Decem­ber 2018	21 Decem­ber 2018	10 Janu­ary 2019	10 Janu­ary 2019
Fol­low up	16 April 2019	16 April 2019	26 April 2019	26 April 2019

On aver­age:

• All reports were issued in draft with­in 10 work­ing days of com­ple­tion of our field­work and debrief meet­ings with man­age­ment, allow­ing for staff sick­ness and annu­al leave.
• Ini­tial responses were received with­in 10 work­ing days of the draft report being issued.
• Final reports were issued with­in 1 work­ing day of final man­age­ment responses being received.

---

Appendix I — Definitions

LEVEL OF ASSUR­ANCE	DESIGN of intern­al con­trol frame­work	OPER­A­TION­AL EFFECT­IVE­NESS of intern­al controls
Sub­stan­tial	Appro­pri­ate pro­ced­ures and con­trols in place to mit­ig­ate the key risks.	No, or only minor, excep­tions found in test­ing of the pro­ced­ures and con­trols. The con­trols that are in place are being con­sist­ently applied.
Mod­er­ate	In the main there are appro­pri­ate pro­ced­ures and con­trols in place to mit­ig­ate the key risks reviewed albeit with some that are not fully effective.	A small num­ber of excep­tions found in test­ing of the pro­ced­ures and con­trols. Evid­ence of non com­pli­ance with some con­trols, that may put some of the sys­tem object­ives at risk.
Lim­ited	A num­ber of sig­ni­fic­ant gaps iden­ti­fied in the pro­ced­ures and con­trols in key areas. Where prac­tic­al, efforts should be made to address in-year.	A num­ber of reoc­cur­ring excep­tions found in test­ing of the pro­ced­ures and con­trols. Where prac­tic­al, efforts should be made to address in-year. Non-com­pli­ance with key pro­ced­ures and con­trols places the sys­tem object­ives at risk.
No	For all risk areas there are sig­ni­fic­ant gaps in the pro­ced­ures and con­trols. Fail­ure to address in-year affects the qual­ity of the organisation’s over­all intern­al con­trol framework.	Due to absence of effect­ive con­trols and pro­ced­ures, no reli­ance can be placed on their oper­a­tion. Fail­ure to address in-year affects the qual­ity of the organisation’s over­all intern­al con­trol framework.

Recom­mend­a­tion Sig­ni­fic­ance	Descrip­tion
High	A weak­ness where there is sub­stan­tial risk of loss, fraud, impro­pri­ety, poor value for money, or fail­ure to achieve organ­isa­tion­al object­ives. Such risk could lead to an adverse impact on the busi­ness. Remedi­al action must be taken urgently.
Medi­um	A weak­ness in con­trol which, although not fun­da­ment­al, relates to short­com­ings which expose indi­vidu­al busi­ness sys­tems to a less imme­di­ate level of threat­en­ing risk or poor value for money. Such a risk could impact on oper­a­tion­al object­ives and should be of con­cern to seni­or man­age­ment and requires prompt spe­cif­ic action.
Low	Areas that indi­vidu­ally have no sig­ni­fic­ant impact, but where man­age­ment would bene­fit from improved con­trols and/​or have the oppor­tun­ity to achieve great­er effect­ive­ness and/​or efficiency.

---

BDO LLP, a UK lim­ited liab­il­ity part­ner­ship registered in Eng­land and Wales under num­ber OC305127, is a mem­ber of BDO Inter­na­tion­al Lim­ited, a UK com­pany lim­ited by guar­an­tee, and forms part of the inter­na­tion­al BDO net­work of inde­pend­ent mem­ber firms. A list of mem­bers’ names is open to inspec­tion at our registered office, 55 Baker Street, Lon­don W1U 7EU. BDO LLP is author­ised and reg­u­lated by the Fin­an­cial Con­duct Author­ity to con­duct invest­ment business.

BDO is the brand name of the BDO net­work and for each of the BDO Mem­ber Firms.

BDO North­ern Ire­land, a part­ner­ship formed in and under the laws of North­ern Ire­land, is licensed to oper­ate with­in the inter­na­tion­al BDO net­work of inde­pend­ent mem­ber firms.

Copy­right ©2019 BDO LLP. All rights reserved. www​.bdo​.co​.uk