CAIRNGORMS NATION­AL PARK AUTHORITY

INTERN­AL AUDIT REPORT Fol­low up review March 2020

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

CON­TENTS

Exec­ut­ive Sum­mary 3 Recom­mend­a­tion Status 6

Appen­dices: I Staff Inter­viewed 37 II Defin­i­tions 38 III Terms of Ref­er­ence 39

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

REPORT STATUS Aud­it­or: Abi­gail McGurn Dates work per­formed: 17 Feb 2020 — 17 Mar 2020 Draft report issued: 23 March 2020 Final report issued: 23 March 2020

DIS­TRI­BU­TION LIST Dav­id Camer­on Dir­ect­or of Cor­por­ate Ser­vices Daniel Ral­ph Fin­ance Man­ager Audit & Risk Com­mit­tee Members

Restric­tions of use The mat­ters raised in this report are only those which came to our atten­tion dur­ing the course of our audit and are not neces­sar­ily a com­pre­hens­ive state­ment of all the weak­nesses that exist or all improve­ments that might be made. The report has been pre­pared solely for the man­age­ment of the organ­isa­tion and should not be quoted in whole or in part without our pri­or writ­ten con­sent. BDO LLP neither owes nor accepts any duty to any third party wheth­er in con­tract or in tort and shall not be liable, in respect of any loss, dam­age or expense which is caused by their reli­ance on this report.

2

EXEC­UT­IVE SUMMARY

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

Scope and Work Under­taken Back­ground As part of the pro­vi­sion of con­tinu­al assur­ance with regard to intern­al con­trol arrange­ments, a review of the degree of imple­ment­a­tion of pre­vi­ously agreed Intern­al Audit recom­mend­a­tions was con­duc­ted in March 2020. In accord­ance with the Intern­al Audit Annu­al Plan 2019 – 20, we have con­sidered the imple­ment­a­tion status of all recom­mend­a­tions raised from pre­vi­ous Intern­al Audit work which were due to be imple­men­ted at the time of this review.

In total there are 44 recom­mend­a­tions that we con­sidered dur­ing the fol­low up. A total of 13 recom­mend­a­tions were fol­lowed up from the work under­taken by BDO dur­ing ²⁰¹⁹⁄₂₀ with one chan­ging its date of imple­ment­a­tion to Decem­ber 2020 so this was con­sidered as not yet sched­uled for com­ple­tion, a fur­ther 7 recom­mend­a­tions made in ²⁰¹⁹⁄₂₀ are not yet sched­uled for com­ple­tion and have not been fol­lowed up. We also fol­lowed up on 24 recom­mend­a­tions car­ried for­ward from work under­taken in pre­vi­ous years. The recom­mend­a­tions relate to 16 audit areas, as lis­ted below:

• Risk Man­age­ment ²⁰¹⁶⁄₁₇ (2 recommendations)
• Fin­an­cial Pro­cesses ²⁰¹⁶⁄₁₇ (1 recommendation)
• Grant Fund­ing & Man­age­ment ²⁰¹⁶⁄₁₇ (2 recommendations)
• Tomin­toul & Glen­liv­et Part­ner­ship Man­age­ment ²⁰¹⁶⁄₁₇ (2 recommendations)
• IT Gen­er­al Con­trols ²⁰¹⁶⁄₁₇ (3 recommendations)
• Pro­ject Man­age­ment ²⁰¹⁷⁄₁₈ (2 recommendations)
• Com­mu­nic­a­tions & Social Media Strategy ²⁰¹⁷⁄₁₈ (1 recommendation)
• Part­ner­ship Man­age­ment ²⁰¹⁸⁄₁₉ (2 recommendations)
• Resource Plan­ning ²⁰¹⁸⁄₁₉ (2 recommendations)
• Busi­ness Con­tinu­ity Plan­ning ²⁰¹⁸⁄₁₉ (7 recommendations)
• Payroll Admin­is­tra­tion ²⁰¹⁹⁄₂₀ (4 recommendations)
• Risk Man­age­ment ²⁰¹⁹⁄₂₀ (1 recommendation)
• Expense Claims Pro­cess ²⁰¹⁹⁄₂₀ (4 Recommendations)
• Staff Object­ive Set­ting and Apprais­al ²⁰¹⁹⁄₂₀ (4 Recommendations)

Meth­od­o­logy Cairngorms Nation­al Park Authority’s Intern­al Audit recom­mend­a­tion pro­gress report was reviewed to determ­ine the degree of imple­ment­a­tion achieved. Where the respons­ible per­son stated that recom­mend­a­tions had been imple­men­ted, evid­ence was sought, and test­ing under­taken where rel­ev­ant, to veri­fy con­tin­ued compliance.

Acknow­ledge­ment We appre­ci­ate the assist­ance provided by the staff involved in the review and would like to thank them for their help and on-going co-operation.

3

EXEC­UT­IVE SUMMARY

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

Scope and Work Under­taken Status of recom­mend­a­tions as at March 2020

The sum­mary below and over­leaf provides a simple over­view of the status of each recom­mend­a­tion. Of the 36 recom­mend­a­tions due to be imple­men­ted, 8 recom­mend­a­tions (22%) have been cat­egor­ised as fully imple­men­ted, 19 (51%) have been cat­egor­ised as par­tially imple­men­ted and 9 (24%) as not imple­men­ted. Details of the not imple­men­ted and par­tially imple­men­ted recom­mend­a­tions are included from page 6 onwards.

On this basis, we con­clude that Cairngorms Nation­al Park Author­ity has made some pro­gress in imple­ment­ing the recom­mend­a­tions made, how­ever, the imple­ment­a­tion rate is low and con­tin­ued focus is neces­sary to ensure the remain­ing out­stand­ing recom­mend­a­tions are imple­men­ted with­in a reas­on­able timeframe.

Audit	Fully imple­men­ted	Par­tially Imple­men­ted	Not Imple­men­ted	Super­seded	Not due for imple­ment­a­tion	Total
Risk Man­age­ment 2016⁄17	-	2	-	-	-	2
Fin­an­cial Pro­cesses 201⁄17	-	1	-	-	-	1
Grant Fund­ing & Man­age­ment 2016⁄17	-	1	1	-	-	2
Tomin­toul & Glen­liv­et Part­ner­ship Man­age­ment 2016⁄17	-	2	-	-	-	2
IT Gen­er­al Con­trols 2016⁄17	-	1	2	-	-	3
Pro­ject Man­age­ment 2017⁄18	-	2	-	-	-	2
Com­mu­nic­a­tions & Social Media Strategy 2017⁄18	1	-	-	-	-	1
Part­ner­ship Man­age­ment 2018⁄19	-	2	-	-	-	2
Resource Plan­ning 2018⁄19	-	-	2	-	-	2

(con­tin­ued over­leaf) 4

EXEC­UT­IVE SUMMARY

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

Audit	Fully imple­men­ted	Par­tially imple­men­ted	Not Imple­men­ted	Super­seded	Not due for imple­ment­a­tion	Total
Busi­ness Con­tinu­ity Plan­ning 2018⁄19	-	6	-	-	1	7
Payroll Admin­is­tra­tion 2019/20*	2	1	2	-	1	6
Risk Man­age­ment 2019⁄20	1	-	-	-	2	3
Expense Claims Pro­cess 2019⁄20	3	1	-	-	3	7
Staff Object­ive Set­ting & Apprais­al 2019⁄20	1	1	1	-	1	4
TOTAL	8	19	9	0	8	44

• For the 2 recom­mend­a­tions noted as Not Imple­men­ted in the Payroll Admin­is­tra­tion Review, CNPA have informed us that there is are monthly reports com­pleted, reviewed and signed as agreed in the ori­gin­al recom­mend­a­tion. How­ever, due to the sens­it­ive nature of the evid­ence we have not been provided with the evid­ence elec­tron­ic­ally. Fol­low­ing the out­break of COV­ID-19 BDO were unable to travel to the cli­ent to con­firm this. CNPA con­sider this as Fully Imple­men­ted but we have been unable to con­firm this is the case.

5

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

RECOM­MEND­A­TION STATUS — RISK MAN­AGE­MENT ²⁰¹⁶⁄₁₇

Ref.	Ori­gin­al Recom­mend­a­tion	Sig.	Man­age­ment Response	Respons­ib­il­ity & Imple­ment­a­tion Date
2	We recom­mend that, on devel­op­ment of a risk man­age­ment policy, staff with risk man­age­ment respons­ib­il­it­ies are required to sign a check­list to con­firm wheth­er they are aware of the organisation’s risk man­age­ment approach or require fur­ther train­ing in this area.		Ori­gin­al Agreed. I think the recom­mend­a­tion for staff to sign a check­list and self-cer­ti­fy aware­ness of risk man­age­ment approaches or need for fur­ther train­ing is a very prac­tic­al recom­mend­a­tion that can help avoid staff under­go­ing unne­ces­sary ​“man­dat­ory” train­ing. April 2019 The Dir­ect­or of Cor­por­ate Ser­vices emailed all Heads of Ser­vice on 31 May 2017 high­light­ing the approach to risk man­age­ment and seek­ing staff train­ing require­ments. We accept that we have not developed a check­list for staff to sign how­ever, the email approach was inten­ded to act as a sur­rog­ate for a sep­ar­ate checklist.	Gov­ernance & Inform­a­tion Officer

Status at March 2020 & Revised Recom­mend­a­tion Par­tially Implemented

Man­age­ment Response at March 2020 Status remains same as 2019.

6

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

RECOM­MEND­A­TION STATUS — RISK MAN­AGE­MENT ²⁰¹⁶⁄₁₇

Ref.	Ori­gin­al Recom­mend­a­tion	Sig.	Man­age­ment Response	Respons­ib­il­ity & Imple­ment­a­tion Date
3	We recom­mend that all pro­ject risk registers should be developed using a con­sist­ent approach aligned to the Stra­tegic Risk Register. We recog­nise that man­age­ment have iden­ti­fied that in prac­tice pro­jects evolve their own approach to devel­op­ing risk registers and have accep­ted this, provid­ing the pro­ject teams are recog­nising and man­aging risk. How­ever, imple­ment­ing a con­sist­ent approach for devel­op­ing risk registers will ensure risks are being assessed and under­stood con­sist­ently through­out the organ­isa­tion, ensure con­sist­ent high qual­ity and will improve the pro­cess for escal­at­ing and de-escal­at­ing risks to the Stra­tegic Risk Register.		Ori­gin­al Agreed. While the key point remains to ensure that risks and recog­nised, doc­u­mented and man­aged, we accept that risk registers should ideally be in a con­sist­ent format to aid review and escal­a­tion pro­cesses. We will rein­force the need for use of the tem­plate to sup­port con­sist­ency of prac­tice in our pro­ject man­age­ment com­mu­nic­a­tions and intern­al reviews. August 2018 The entirety of the pro­ject man­age­ment sup­port sys­tem is cur­rently under review, and this low level risk will be cap­tured with­in that review. We will aim to com­plete this work by Janu­ary 2019. April 2019 As noted in the above status update, this recom­mend­a­tion is sub­stan­tially com­plete with­in revised timetable. The risk tem­plate is included with­in updated pro­ject man­age­ment toolkit and we simply have not had an oppor­tun­ity yet to tri­al on pro­jects. The first tri­al is cur­rently under­way for the Cus­tom­er Records Man­age­ment Sys­tem imple­ment­a­tion project.	Gov­ernance & Inform­a­tion Manager

7

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex 1 27/03/2020

RECOM­MEND­A­TION STATUS — RISK MAN­AGE­MENT ²⁰¹⁶⁄₁₇

Status at March 2020 & Revised Recom­mend­a­tion Par­tially Imple­men­ted A tem­plate has been developed to stand­ard­ise the approach to risk man­age­ment, once pro­jects begin to adopt the tem­plate we will be able to veri­fy the imple­ment­a­tion of the recommendation.

Man­age­ment Response at March 2020 Status remains same as 2019 no signed check­list in place as yet.

8

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

RECOM­MEND­A­TION STATUS — FIN­AN­CIAL PRO­CESSES ²⁰¹⁶⁄₁₇

Ref.	Ori­gin­al Recom­mend­a­tion	Sig.	Man­age­ment Response	Respons­ib­il­ity & Imple­ment­a­tion Date
2	We recom­mend that the Fin­ance Man­age­ment sched­ule is updated to provide detailed policies and guid­ance on all fin­an­cial pro­cesses. These should be reviewed on an annu­al basis. We also recom­mend that clear roles and respons­ib­il­it­ies demon­strat­ing segreg­a­tion of duties are doc­u­mented with­in the guid­ance notes for all fin­an­cial pro­cesses. We recog­nise that man­age­ment have made pro­gress in devel­op­ing the sched­ule and that com­ple­tion of this was delayed due to the imple­ment­a­tion of the new Sage system.		Ori­gin­al Accep­ted. We are cur­rently review­ing and updat­ing all pro­ced­ures. August 2018 High level tasks relat­ing to month end and year end routines and pro­ced­ures are in place. Doc­u­ment­a­tion of lower level tasks to imple­men­ted by 31 Decem­ber as part of gen­er­al review of policies, pro­ced­ures and respons­ib­il­it­ies. It should be noted that when a spe­cif­ic spread­sheet is developed for either report­ing or fin­an­cial man­age­ment notes are imbed­ded stat­ing the reas­on for the spread­sheet and how it is to be pre­pared. These are usu­ally high level and cur­rently main­tained by the fin­ance man­ager, spe­cific­ally for record­ing and track­ing LEAD­ER claims. April 2019 Review and updat­ing of doc­u­ment­a­tion will be car­ried out before the 18⁄19 audit in June, ie by 16th June.	Fin­ance Manager

Status at March 2020 & Revised Recom­mend­a­tion Not Imple­men­ted This has not yet been imple­men­ted. Man­age­ment have informed us that the routines and pro­cesses will be reviewed and updated by mid-June.

9

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

RECOM­MEND­A­TION STATUS — FIN­AN­CIAL PRO­CESSES ²⁰¹⁶⁄₁₇

Man­age­ment Response at March 2020 Delayed: while changes to prac­tices are updated in advance of the annu­al extern­al audit, for the bene­fit of the extern­al aud­it­ors and walk through tests, a com­pre­hens­ive rework has not taken place due, most recently, staff­ing issues. It is still the inten­tion to have a com­pre­hens­ive refresh and real­ist­ic­ally this will not be until after the ¹⁹⁄₂₀ audit which is due to com­plete mid-June. We will tar­get this work in quar­ters 2 and 3 of ²⁰²⁰⁄₂₁.

10

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex 1 27/03/2020

RECOM­MEND­A­TION STATUS — GRANT FUND­ING & MAN­AGE­MENT ²⁰¹⁶⁄₁₇

Ref.	Ori­gin­al Recom­mend­a­tion	Sig.	Man­age­ment Response	Respons­ib­il­ity & Imple­ment­a­tion Date
1	We recom­mend that the Grant Toolkit is com­pleted, encom­passing all pro­cesses in place for the award­ing, record­ing and mon­it­or­ing of grant fund­ing. The toolkit should also clearly define the fol­low­ing: Actions to be taken when grant con­di­tions are not being met or terms and con­di­tions are breached; — The pro­cess for con­sid­er­a­tion of the risk and value of grant fund­ing applic­a­tions to determ­ine the pro­por­tion of resource required to eval­u­ate these; and Review and scru­tiny arrange­ments for pro­gress reports provided by grantees.		Ori­gin­al Accep­ted. Final­isa­tion of the toolkit has been delayed by oth­er pri­or­ity activ­it­ies and will now be accel­er­ated. August 2018 Work to recom­mence in Octo­ber and linked to pro­ject man­age­ment: To be imple­men­ted by Janu­ary 2019. The inten­tion is to com­plete this in par­al­lel with work on pro­jects to ensure a com­mon­al­ity in a risk based approach to pro­ject and grant man­age­ment. April 2019 Revised date for com­ple­tion 30 Septem­ber 2019	Respons­ible Officer: Dir­ect­or of Cor­por­ate Ser­vices Imple­ment­a­tion Due Date: 30 Septem­ber 2017

Status at March 2020 & Revised Recom­mend­a­tion Not Imple­men­ted This recom­mend­a­tion has not yet been imple­men­ted, man­age­ment have advised that it will not be imple­men­ted until ²⁰⁄₂₁.

Man­age­ment Response at March 2020 We will give resource pri­or­ity to devel­op­ing and rolling out the use of a grant toolkit over the course of ²⁰²⁰⁄₂₁.

11

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

RECOM­MEND­A­TION STATUS — GRANT FUND­ING & MAN­AGE­MENT ²⁰¹⁶⁄₁₇

Ref.	Ori­gin­al Recom­mend­a­tion	Sig.	Man­age­ment Response	Respons­ib­il­ity & Imple­ment­a­tion Date
2	We recom­mend that man­age­ment devel­ops and main­tains a grant register which records all grant fund­ing provided. The per­form­ance require­ments detailed with­in each grant award terms and con­di­tions should be recor­ded and mon­itored with­in the track­er. The register should be reviewed on a reg­u­lar basis to ensure funds are used effect­ively and agreed object­ives are achieved.		Ori­gin­al Agreed. This is a sens­ible recom­mend­a­tion and one which mir­rors recent think­ing with­in the Fin­ance Team that we should estab­lish and main­tain a cent­ral register of live grant fund­ing ini­ti­at­ives. April 2019 Pri­or­ity will be giv­en to pop­u­lat­ing the 19⁄20 register and then back filling pre­vi­ous 2 years by 30 Septem­ber with all rel­ev­ant terms and conditions.	Respons­ible Officer: Fin­ance Man­ager Imple­ment­a­tion Due Date: Novem­ber 2017

Status at March 2020 & Revised Recom­mend­a­tion Par­tially Imple­men­ted This recom­mend­a­tion has not yet been imple­men­ted, man­age­ment have advised that it will not be imple­men­ted until after the year end.

Man­age­ment Response at March 2020 Delayed: This remains par­tially imple­men­ted hav­ing fall­ing into arrears due to recent staff­ing issues. This will be addressed post com­ple­tion of the annu­al audit when the fin­ance depart­ment will be back to full capacity.

12

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

RECOM­MEND­A­TION STATUS — TOMIN­TOUL & GLEN­LIV­ET PART­NER­SHIP MAN­AGE­MENT ²⁰¹⁶⁄₁₇

Ref.	Ori­gin­al Recom­mend­a­tion	Sig.	Man­age­ment Response	Respons­ib­il­ity & Imple­ment­a­tion Date
1	We recom­mend that all pro­ject man­age­ment tem­plates are com­pleted for the deliv­ery phase of the TGLP pro­ject. We also recom­mend that more detailed pro­ject man­age­ment pro­to­cols are defined with­in the Pro­ject Man­age­ment Guid­ance and Pro­cess doc­u­ments. The pro­to­cols should clearly define the pro­cess to be fol­lowed for the fol­low­ing stages of a pro­ject: — Option selec­tion and pri­or­it­isa­tion; — Col­lab­or­a­tion with part­ners; — Solu­tion devel­op­ment; — Deliv­ery (includ­ing mon­it­or­ing and report­ing); and — Changes (includ­ing time, cost, qual­ity and risk changes). The change man­age­ment pro­cess for the deliv­ery phase of the pro­ject should be clearly doc­u­mented, includ­ing the iden­ti­fic­a­tion of defined lim­its out­lining at which point HLF approv­al is required.		Ori­gin­al Agreed. The Pro­gramme Man­ager has now been recruited for this pro­gramme and will be charged with com­plet­ing all pro­ject man­age­ment tem­plates to enhance robust­ness of man­age­ment con­trols. As the doc­u­ment­a­tion will be com­pleted and owned by the Pro­gramme Man­ager this will also enhance lines of man­age­ment respons­ib­il­ity. August 2018 To be fully imple­men­ted by 30 Novem­ber 2018.	Respons­ible Officer: Tomin­toul & Glen­liv­et Pro­gramme Man­ager with Head of Land Man­age­ment and Con­ser­va­tion Imple­ment­a­tion Due Date: 31 July 2017

Status at March 2020 & Revised Recom­mend­a­tion Par­tially Imple­men­ted This recom­mend­a­tion has not yet been imple­men­ted and the pro­ject is reach­ing com­ple­tion. Spread­sheets were developed to mon­it­or changes how­ever not all points of the recom­mend­a­tion have yet been addressed.

13

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

RECOM­MEND­A­TION STATUS — TOMIN­TOUL & GLEN­LIV­ET PART­NER­SHIP MAN­AGE­MENT ²⁰¹⁶⁄₁₇

Man­age­ment Response at March 2020 The pro­ject is now 7 months from clos­ure and more work is being under­taken on mon­it­or­ing the fin­ance pos­i­tion and pro­ject out­turns. A num­ber of spread­sheets are now used as a basis of mak­ing reports to the Pro­ject Board (TGLP Budget mon­it­or­ing live v4 and onwards). We have provided a copy of the key spread­sheet which was reviewed and which rein­forces sig­ni­fic­ant fin­an­cial man­age­ment over­sight and con­trols imple­men­ted since audit. The wider find­ing on pro­ject man­age­ment has been super­seded as we are now in the final half year of deliv­ery. Accord­ingly, the resource focus is now on pro­gramme clos­ure and devel­op­ment of leg­acy arrangements.

14

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

RECOM­MEND­A­TION STATUS — TOMIN­TOUL & GLEN­LIV­ET PART­NER­SHIP MAN­AGE­MENT ²⁰¹⁶⁄₁₇

Ref.	Ori­gin­al Recom­mend­a­tion	Sig.	Man­age­ment Response	Respons­ib­il­ity & Imple­ment­a­tion Date
2	We recom­mend that changes in spend pro­file exceed­ing an agreed threshold are repor­ted to the TGLP Board on a monthly basis.		Ori­gin­al Agreed. August 2018 Fin­ance risk is now being con­sidered in more detail by the board as more major pro­jects are either due to start or pro­ject plans are revised. To date, as only 1 major pro­ject has been under­taken, and is cur­rently show­ing a £6k under­spend, there has been no need to set a vari­ance against pro­ject budgets, espe­cially as the Museum Refur­bish­ment was closely mon­itored by the Pro­ject man­ager. What has been agreed is that in Septem­ber a com­pre­hens­ive review of all pro­ject costs will be under­taken and the recast pro­ject costs and pro­filed spend will then be used as the bench mark for cash man­age­ment, cost mon­it­or­ing on a monthly basis. This will then be included in the monthly fin­ance paper and sup­ple­men­ted by any spe­cif­ic con­cerns by the Pro­ject man­ager. As a first step a Con­tin­gency Request form has been intro­duced. This is a request to the Board for con­tin­gency fund­ing where cost over­runs have been iden­ti­fied on review. Secondly post Septem­ber review vari­ances against plan will be repor­ted to the Board monthly. No report­ing level has been set but great­er emphas­is will be placed on the high value con­struc­tion projects.	Respons­ible Officer: CNPA Fin­ance Man­ager Imple­ment­a­tion Due Date: 30 Septem­ber 2017

15

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex 1 27/03/2020

RECOM­MEND­A­TION STATUS — TOMIN­TOUL & GLEN­LIV­ET PART­NER­SHIP MAN­AGE­MENT ²⁰¹⁶⁄₁₇

Status at March 2020 & Revised Recom­mend­a­tion Par­tially Imple­men­ted Cli­ent have provided doc­u­ment­a­tion on spend and what is dis­cussed at meet­ings — not exact imple­ment­a­tion of recom­mend­a­tion but appro­pri­ate mon­it­or­ing is con­duc­ted. Par­tially Imple­men­ted as evid­ence of agreed threshold not provided.

Man­age­ment Response at March 2020 The pro­ject is now 7 months from clos­ure and more work is being under­taken on mon­it­or­ing the fin­ance pos­i­tion and pro­ject out­turns. A num­ber of spread­sheets are now used as a basis of mak­ing reports to the Pro­ject Board (TGLP Budget mon­it­or­ing live v4 and onwards). We have provided a copy of the key spread­sheet which was reviewed by CNPA fin­ance to ensure repor­ted costs are in line with the fin­an­cial sys­tem. Also provided is a list of dis­crep­an­cies iden­ti­fied and coded on a RAG sys­tem (dif­fer­ences iden­ti­fied). Anoth­er spread­sheet, monthly build-up of costs (T&G monthly), has also been developed which is auto­com­pleted com­pleted and com­pared with the agreed budgets so and inde­pend­ent mon­it­or­ing can be car­ried out by CNPA Fin­ance. (This is the first iter­a­tion of this spread­sheet and it is imbed­ded in the main track­er used to record and con­sol­id­ate all CNPA fin­ances from TB to final accounts.) It should be noted that the 4 largest pro­jects are either com­plete or in the final stages of com­ple­tion (Museum, Blairfindy, Scalan and Access.). Oth­er than increased fin­an­cial over­sight from CNPA it is not pro­posed to intro­duce any fur­ther mon­it­or­ing and controls.

16

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

RECOM­MEND­A­TION STATUS — IT GEN­ER­AL CON­TROLS ²⁰¹⁶⁄₁₇

Ref.	Ori­gin­al Recom­mend­a­tion	Sig.	Man­age­ment Response	Respons­ib­il­ity & Imple­ment­a­tion Date
6	We recom­mend that, as per the require­ments of the Secur­ity Policy, there is reg­u­lar full-restore test­ing of backups i.e. the full recov­ery of sys­tems on a bare-met­al serv­er using backup media. We also recom­mend that a form­al backup plan/​policy is developed to ensure a con­sist­ent approach is taken to man­aging backups includ­ing imple­ment­a­tion, mon­it­or­ing over their success/​failure, rerun­ning failed backups and reg­u­lar testing.		Ori­gin­al Agreed. April 2019 There are no cur­rent plans to attempt a full- restore of backups.	Respons­ible Officer: Gov­ernance and Cor­por­ate Per­form­ance Man­ager with IT Man­ager Imple­ment­a­tion Due Date: 31 Janu­ary 2018

Status at March 2020 & Revised Recom­mend­a­tion Par­tially Implemented.

Man­age­ment Response at March 2020 There has been ​‘test­ing’ of back up arrange­ments neces­sit­ated by serv­er fail­ure in Autumn 2019 — there­fore a form­al run of pro­ced­ure rather than desk or arti­fi­cial test­ing exer­cise. More com­pre­hens­ive test plans are being incor­por­ated with­in the Busi­ness Con­tinu­ity Plan in devel­op­ment and covered by responses to oth­er audit findings.

17

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

RECOM­MEND­A­TION STATUS — IT GEN­ER­AL CON­TROLS ²⁰¹⁶⁄₁₇

Ref.	Ori­gin­al Recom­mend­a­tion	Sig.	Man­age­ment Response	Respons­ib­il­ity & Imple­ment­a­tion Date
10	We recom­mend that all net­work devices are con­figured with ref­er­ence to recog­nised secur­ity baselines to ensure that all act­ive net­work com­pon­ents have met a min­im­um secur­ity standard.		Ori­gin­al Agreed. August 2018 To be com­pleted by 31 Decem­ber 2018. April 2019 April 2019 Revised date for imple­ment­a­tion 31 Decem­ber 2019.	Respons­ible Officer: IT Man­ager Imple­ment­a­tion Due Date: 31 March 2018

Status at March 2020 & Revised Recom­mend­a­tion Not Implemented

Man­age­ment Response at March 2020 Con­sider drop­ping: This isn’t con­sidered cost effect­ive giv­en the soft­ware land­scape: our oper­a­tions are geared to MS office, Sage products, GIS and iDox. We con­sider that exist­ing prac­tices are sufficient.

Since com­ple­tion of the intern­al audit, the Author­ity has focused on deliv­er­ing infra­struc­ture devel­op­ments in line with Scot­tish Government’s Cyber Secur­ity Plus cri­ter­ia. To stream­line pro­cesses and action plans, we will focus on this line of devel­op­ment and mon­it­or­ing / review for IT infra­struc­ture design.

18

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

RECOM­MEND­A­TION STATUS — IT GEN­ER­AL CON­TROLS ²⁰¹⁶⁄₁₇

Ref.	Ori­gin­al Recom­mend­a­tion	Sig.	Man­age­ment Response	Respons­ib­il­ity & Imple­ment­a­tion Date
11	We recom­mend that the Author­ity con­sider devel­op­ing and imple­ment­ing a net­work secur­ity mon­it­or­ing and log­ging strategy to ensure that areas of the net­work that are used to store or pro­cess sens­it­ive data are sub­ject to pro­act­ive mon­it­or­ing con­trols. Also, we recom­mend that man­age­ment con­sider intro­du­cing a sys­log for securely cap­tur­ing and retain­ing log inform­a­tion to ensure the avail­ab­il­ity and integ­rity of log data is maintained.		Ori­gin­al Agreed. August 2018 The first phase of the Cyber Essen­tials cer­ti­fic­a­tion is in pro­gress and the ini­tial report is awaited. April 2019 Cyber Essen­tials+ cer­ti­fic­a­tion has been gained — com­ple­tion was in Decem­ber 2018.	Respons­ible Officer: IT Man­ager Imple­ment­a­tion Due Date: 31 March 2018

Status at March 2020 & Revised Recom­mend­a­tion Not Implemented

Man­age­ment Response at March 2020 Con­sid­er­ing drop­ping: in pro­jec­tions for spend to 31/03/20 is one piece of soft­ware — AD audit + — which would allow track­ing of deleted, moved folders etc. which would addi­tion­ally help us to com­ply with GDPR require­ments. While this is in pro­jec­tions no requis­i­tion has yet been raised.

We have imple­men­ted Cyber Secur­ity Essen­tials Plus with com­ple­tion in Decem­ber 2018 and reac­cred­it­a­tion now being pur­sued. We pro­pose to retain this audit risk as par­tially imple­men­ted rather than super­seded in order to ensure a cross-check is in place between con­trols imple­men­ted to meet cyber secur­ity require­ments with con­trols being put in place for data access and wider secur­ity of data man­age­ment systems.

19

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

RECOM­MEND­A­TION STATUS — PRO­JECT MAN­AGE­MENT ²⁰¹⁷⁄₁₈

Ref.	Ori­gin­al Recom­mend­a­tion	Sig.	Man­age­ment Response	Respons­ib­il­ity & Imple­ment­a­tion Date
1	We recom­mend that all pro­ject man­age­ment tem­plates are com­pleted for future pro­jects in line with the pro­ject man­age­ment guidelines. We also recom­mend that a pro­cess for request­ing and approv­ing changes to defined lim­its relat­ing to cost, time, qual­ity and risk is doc­u­mented and applied. We also recom­mend that all changes are recor­ded with­in a pro­ject change log.		Ori­gin­al Recom­mend­a­tion accep­ted. The Oper­a­tion­al Man­age­ment Group, com­pris­ing all Heads of Ser­vice, have addi­tion­ally com­menced an intern­al review of the adequacy of the pro­ject man­age­ment tem­plates and wheth­er the approach to pro­ject man­age­ment approv­al and gov­ernance can be stream­lined without com­prom­ising intern­al con­trol stand­ards. The res­ults of this review will be applied while also ensur­ing the cur­rent recom­mend­a­tion is imple­men­ted: ensur­ing that the revised pro­ject toolkit is used fully and appro­pri­ately. August 2018 The entirety of the pro­ject man­age­ment sup­port sys­tem is cur­rently under review, and this action will be cap­tured with­in that review. We will aim to com­plete this work by Janu­ary 2019. April 2019 As noted above, the updated pro­ject toolkit is com­plete and being rolled out. We are still to com­plete pro­cesses around change requests, being mind­ful of one of the Authority’s key attrib­utes of being flex­ible and adapt­able. We will con­sider these final ele­ments as we review the roll out of pro­ject man­age­ment over 2019.	Respons­ible Officer: Dir­ect­or of Cor­por­ate Ser­vices with Head of Organ­isa­tion­al Devel­op­ment Imple­ment­a­tion Due Date: 30 June 2018

20

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex 1 27/03/2020

RECOM­MEND­A­TION STATUS — PRO­JECT MAN­AGE­MENT ²⁰¹⁷⁄₁₈

Status at March 2020 & Revised Recom­mend­a­tion Par­tially Imple­men­ted Once pro­jects are under­taken with the new pro­ject man­age­ment toolkit it will be pos­sible for this to be sample tested.

Man­age­ment Response at March 2020 We have estab­lished a list of pri­or­ity pro­jects for over­sight and ​“gate­way review” pri­or to start by the Oper­a­tion­al Man­age­ment Group. How­ever, we accept that this pro­cess has not been looked at closely over the course of ²⁰¹⁹⁄₂₀ and there is still some work to do on ensur­ing an appro­pri­ate level of engage­ment with stand­ard­ised pro­ject man­age­ment pro­cesses by pro­ject man­agers and pro­ject sponsors.

21

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

RECOM­MEND­A­TION STATUS — PRO­JECT MAN­AGE­MENT ²⁰¹⁷⁄₁₈

Ref.	Ori­gin­al Recom­mend­a­tion	Sig.	Man­age­ment Response	Respons­ib­il­ity & Imple­ment­a­tion Date
3	We recom­mend that roles and respons­ib­il­it­ies are fully doc­u­mented for all key people and groups with respons­ib­il­it­ies for each project.		Ori­gin­al Agreed. August 2018 Man­age­ment will revis­it the register of pro­jects and detail those sig­ni­fic­ant and large scale pro­jects for which the roles and respons­ib­il­it­ies of all key people and groups should be doc­u­mented. April 2019 As noted above in status update. How we best cap­ture roles and respons­ib­il­it­ies with­in the revised toolkit is under review.	Respons­ible Officer: Dir­ect­or of Cor­por­ate Ser­vices Imple­ment­a­tion Due Date: 31 July 2018

Status at March 2020 & Revised Recom­mend­a­tion Par­tially Imple­men­ted Once pro­jects are under­taken with the new pro­ject man­age­ment toolkit it will be pos­sible for this to be sample tested.

Man­age­ment Response at March 2020 The pro­ject toolkit is in place as pre­vi­ously repor­ted. How­ever, this toolkit still requires to be tested to determ­ine wheth­er the iden­ti­fied con­trol issue of estab­lish­ing clar­ity in pro­ject roles and respons­ib­il­it­ies has been adequately dealt with.

22

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27/03/2020

RECOM­MEND­A­TION STATUS — PART­NER­SHIP MAN­AGE­MENT ²⁰¹⁸⁄₁₉

Ref.	Ori­gin­al Recom­mend­a­tion	Sig.	Man­age­ment Response	Respons­ib­il­ity & Imple­ment­a­tion Date
1	We recom­mend that the Author­ity issue a ques­tion­naire or feed­back request on an annu­al basis to all key part­ners to seek feed­back and thoughts on how the part­ner­ship, com­mu­nic­a­tion meth­ods and ways of work­ing could be fur­ther improved. We fur­ther recom­mend that feed­back provided is col­lated and actions recorded.		Ori­gin­al We accept the find­ing regard­ing the gap in col­la­tion and ana­lys­is of part­ners’ feed­back and accept the mer­its of con­sid­er­ing the recom­mend­a­tion. As one option, it is pos­sible that the annu­al report pro­cess could be pre­ceded or fol­lowed by a feed­back request to part­ners cov­er­ing the points flagged up by the recommendation.	Respons­ible Officer: Chief Exec­ut­ive with Head of Plan­ning and Rur­al Devel­op­ment Imple­ment­a­tion Due Date: 30 June 19

Status at March 2020 & Revised Recom­mend­a­tion Par­tially Imple­men­ted Once sur­vey closed and ana­lys­is under­taken it will be pos­sible for this to be tested.

Man­age­ment Response at March 2020 We have writ­ten to part­ners to seek their feed­back both on their deliv­ery against Nation­al Park Part­ner­ship Plan agreed object­ives and also to con­sult with part­ners on over­all part­ner­ship work­ing arrange­ments. This pro­cess is con­tinu­ing into ²⁰²⁰⁄₂₁. We also have some instances of part­ners attend­ing Board meet­ings to provide more dir­ect com­mu­nic­a­tions to the Author­ity on part­ner­ship work­ing and pri­or­it­ies. The stake­hold­er sur­vey also feeds into this pro­cess. We have yet to com­pile and ana­lyse the res­ults of this work, hence par­tially implemented.

23

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit and Risk Com­mit­tee Paper 4 Annex I 27÷03÷202