200327 Paper 4 Follow Up Annual Report

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit & Risk Com­mit­tee Paper 4 27/03/2020

CAIRNGORMS NATION­AL PARK AUTHOR­ITY AUDIT & RISK COMMITTEE

FOR DIS­CUS­SION

Title: INTERN­AL AUDIT: FOL­LOW UP REVIEW AND ANNU­AL INTERN­AL AUDIT REPORT

Pre­pared by: DAV­ID CAMER­ON, DIR­ECT­OR OF COR­POR­ATE SERVICES

Pur­pose

This paper presents a fol­low up review by BDO, the Authority’s intern­al aud­it­ors, con­sid­er­ing the extent to which man­agers have respon­ded to intern­al audit recom­mend­a­tions and under­taken agreed improve­ment actions.

The paper also presents the intern­al auditor’s annu­al intern­al audit report for ²⁰¹⁹⁄₂₀, which picks up on the extent of man­age­ment com­mit­ment to act on recom­mend­a­tions made while review­ing the over­all oper­a­tion of intern­al con­trols, risk man­age­ment and gov­ernance with­in the organisation.

Recom­mend­a­tions

The Audit & Risk Com­mit­tee is asked to: a) Con­sider the update presen­ted on the Authority’s fol­low up action on intern­al audit recom­mend­a­tions. b) Note the intern­al auditor’s Annu­al Report for ²⁰¹⁹⁄₂₀.

Exec­ut­ive Summary

Fol­low Up Review

1. The Authority’s intern­al aud­it­ors, BDO, have under­taken a review of pro­gress made by the Authority’s man­age­ment in imple­ment­ing actions recom­men­ded to address iden­ti­fied intern­al con­trol and pro­cess improve­ments in the Authority’s sys­tems. The full report on the review is set out at Annex I to this paper.

2. Annex I cov­ers a total of 44 recom­mend­a­tions made fol­low­ing ²⁰¹⁹⁄₂₀ intern­al audits repor­ted to date along­side intern­al audit work dat­ing back to ²⁰¹⁶⁄₁₇. Of the total of 44 recom­men­ded actions, eight are noted as not yet due for imple­ment­a­tion accord­ing to timetables for action agreed by man­age­ment and endorsed by the Audit and Risk Com­mit­tee. Of the remain­ing 36 recom­mend­a­tions, 8 are agreed as hav­ing been fully imple­men­ted with 19 actions par­tially imple­men­ted — a total of 27 (75%) of recom­mend­a­tions with action due being con­firmed as com­pleted or in progress.

3. A fur­ther 2 recom­mend­a­tions have been imple­men­ted by man­age­ment. How­ever, as the evid­ence sup­port­ing this work around payroll admin­is­tra­tion includes a high level of sens­it­ive data which did not mer­it being trans­ferred elec­tron­ic­ally, BDO are unable to veri­fy this pos­i­tion and the actions remain recor­ded as ​“not imple­men­ted” in Annex 1. This pos­i­tion there­fore slightly over-states the num­bers of actions not imple­men­ted and would increase the pro­por­tion of actions com­pleted or pro­gressed to around 81%.

4. While there is a good degree of per­form­ance in imple­ment­ing audit recom­mend­a­tions high­lighted in this report, we note that there remain a num­ber of rather dated actions which remain at the ​“par­tial imple­ment­a­tion” stage. Man­age­ment will give atten­tion to these recom­men­ded actions in the year ahead with a view to either bring­ing the action to a con­clu­sion or con­firm­ing that the actions con­cerned have now been over­taken by oth­er, more cur­rent developments.

²⁰¹⁹⁄₂₀ Intern­al Audit Annu­al Report

1. The intern­al aud­it­ors Annu­al Report for ²⁰¹⁹⁄₂₀ is presen­ted at Annex 2 to this paper.

2. BDO as intern­al aud­it­ors have again fully com­pleted their pro­posed pro­gramme of work for the year. The annu­al report high­lights that, in the view of BDO, on the basis of reviews under­taken dur­ing the peri­od and in the con­text of materiality:

   a. The risk man­age­ment activ­it­ies and con­trols in the areas examined were found to be suit­ably designed to achieve the spe­cif­ic risk man­age­ment, con­trol and gov­ernance arrange­ments; b. Based on BDO’s veri­fic­a­tion reviews and sample test­ing, risk man­age­ment, con­trol and gov­ernance arrange­ments were oper­at­ing with suf­fi­cient effect­ive­ness to provide reas­on­able, but not abso­lute assur­ance that the related risk man­age­ment, con­trol and gov­ernance object­ives were achieved for the peri­od under review.

Dav­id Camer­on 23 March 2020 davidcameron@​cairngorms.​co.​uk