200327 Paper 6 Annex 1 Strategic Risk Register

CAIRNGORMS NATION­AL PARK AUTHORITY

Audit & Risk Com­mit­tee Paper 6 Annex I 27/03/20

CAIRNGORMS NATION­AL PARK AUTHOR­ITY STRA­TEGIC RISK REGISTER

Risk	Ref	Resp	Mit­ig­a­tion	Com­ments	Trend Aug 19	Trend Nov 19	Trend Feb 20
Cross-over risks Resources: pub­lic sec­tor fin­ances con­strain capa­city to alloc­ate suf­fi­cient resources to deliv­er cor­por­ate plan.	AI	DC	Pre­vent­at­ive: Ongo­ing liais­on with Scot­tish Gov­ern­ment high­light­ing achieve­ments of CNPA. Pre­vent­at­ive: Cor­por­ate plan pri­or­it­ised around anti­cip­ated Scot­tish Gov­ern­ment budget alloc­a­tions, tak­ing on Board expect­a­tion of fund­ing con­straints. Remedi­al: Focus resource on diver­si­fic­a­tion of income streams to altern­ate, non-pub­lic income gen­er­a­tion. Remedi­al: Con­tinu­ing to sup­port ​“deliv­ery bod­ies” such as Cairngorms Nature, LAG and OATS in secur­ing inward investment.	Work with Scot­tish Gov­ern­ment has suc­cess­fully secured resources adequate to cov­er Cor­por­ate Plan expect­a­tions into the third year of the cur­rent 4 year Cor­por­ate Plan peri­od. We also con­tin­ue to take for­ward ideas for altern­ate income streams to sup­port future invest­ment, includ­ing col­lect­ive work with all UK Nation­al Parks and now sup­port­ing work on char­it­able activ­it­ies through Cairngorms Trust. Exec­ut­ive team has now developed bal­anced budget for 20⁄21 and sub­mit­ted to Board.	→	→	↓
Gov­ern­ment and Policy: wider nation­al polit­ic­al changes and policy dir­ec­tion force change away from cur­rent objectives.	A2	GM	Pre­vent­at­ive: Invest time in main­tain­ing key gov­ern­ment con­tacts and rela­tion­ships gain­ing notice of poten­tial policy shifts. Work to get full gov­ern­ment back­ing to NPPP which gives longer term strategy commitment.	Spend­ing Review set­tle­ment for 2018⁄20 favour­able for CNPA, there­fore increas­ing con­fid­ence around capa­city to deliv­er exist­ing Cor­por­ate Plan object­ives to 2022 and also on Gov­ern­ment com­mit­ment to CNPA Stra­tegic goals. NPPP and 18⁄22 Cor­por­ate Plan now approved. Mon­it­or­ing ongo­ing poten­tial impacts of EU exit and for­ward budget and policy devel­op­ments, although no escal­a­tion at present.	↓	↓	↓
Resourcing: UK vote to leave EU dis­rupts pro­ject deliv­ery and fin­an­cing plans and exposes Author­ity to longer term fin­an­cial liab­il­it­ies as a res­ult of loss of EU funds.	A12.1	DC	Remedi­al: Risk man­age­ment ana­lys­is of spe­cif­ic EU fun­ded activ­it­ies – par­tic­u­larly of Authority’s expos­ure as Account­able Body for LEAD­ER. Instruc­tions issued on timetable for fund­ing com­mit­ments to be covered by CNPA. Remedi­al: Invest man­age­ment time in oppor­tun­it­ies to engage in new fund­ing pro­grammes designed to replace EU fund­ing programmes.	LEAD­ER fund­ing con­tracts tailored to meet expec­ted EU exit timetable. Great­er clar­ity on Scot­tish Gov­ern­ment pos­i­tion now in place.	→	↓	↓
Resourcing: future com­munity led loc­al devel­op­ment fund­ing cur­rently delivered through LEAD­ER is lost and cre­ates a sig­ni­fic­ant gap in our capa­city to deliv­er against our com­munity devel­op­ment priorities	A12.2	DC	Remedi­al: pri­or­it­ise engage­ment in con­sulta­tions and events around the future devel­op­ment of struc­tur­al and com­munity fund­ing. Pre­vent­at­ive: con­tin­ue to sup­port work of Cairngorms Trust in attract­ing vol­un­tary dona­tions toward com­munity action — although this is likely to remain at a much smal­ler scale for some time.	Added by MT Novem­ber 2019. Good access to oth­er pro­ject fund­ing for cur­rent stra­tegic deliv­ery peri­od. This stra­tegic risk begins to look bey­ond cur­rent cor­por­ate plan peri­od. Plans for replace­ment of cur­rent EU grant funds remain uncer­tain, and risk escal­a­tion now indic­ated to reflect this stra­tegic future fund­ing risk.	→	→	→
Staff­ing: addi­tion­al extern­ally fun­ded pro­jects strains staff work­load capa­city with increased risks of stress and reduced morale.	A9.3	DC	Pre­vent­at­ive: Ongo­ing review of Oper­a­tion­al Plan with expli­cit iden­ti­fic­a­tion of pro­jects which can/​must slip to accom­mod­ate suc­cess­ful fund­ing bids. Import­ance of staff man­age­ment and task pri­or­it­isa­tion rein­forced through lead­er­ship meetings.	Ini­tial 2019 staff sur­vey sug­gests some ongo­ing mat­ters on work­load man­age­ment to be addressed while well­being res­ults improv­ing. Low risk how­ever retail risk for time being.	↓	↓	↓
Resourcing: Role as Lead / Account­able body for major pro­grammes (e.g. LEAD­ER, Land­scape Part­ner­ship) has risk of sig­ni­fic­ant fin­an­cial claw­back should expendit­ure prove to be not eli­gible for fund­ing, while CNPA car­ries respons­ib­il­it­ies as employ­er for pro­gramme staff.	AII.	DC	Pre­vent­at­ive: Ensure fin­an­cial con­trols in place for pro­gramme man­age­ment include effect­ive eli­gib­il­ity checks. Test pro­cesses with fun­ders if required and also under­take early intern­al audit checks. Work­force man­age­ment plans must incor­por­ate pro­gramme staff con­sid­er­a­tions. Ensure TGLP Man­age­ment and Main­ten­ance con­tracts are all in place to ensure eli­gib­il­ity of invest­ment. Remedi­al: Util­ise intern­al audit resources	Very pos­it­ive move­ment in res­ol­u­tion of mon­it­or­ing and eli­gib­il­ity issues over sum­mer 2018. Enhanced by full accept­ance of all CNPA inter­pret­a­tions dur­ing 2019 with no eli­gib­il­ity issues out­stand­ing at pro­gramme level. Resid­ual risk around dis­pute res­ol­u­tion pro­cesses and uncer­tainty over eli­gib­il­ity judge­ments and inter­pret­a­tion made by SG audit. Some work on TGLP needed to ensure man­age­ment and main­ten­ance agree­ments are all in place.	→	→	→
Resourcing: the end of major pro­gramme invest­ments (Tomin­toul and Glen­liv­et, LEAD­ER) requires sig­ni­fic­ant ongo­ing staff­ing to man­age audit and leg­acy which the Author­ity finds dif­fi­cult to resource.	AII.2	DC	Pre­vent­at­ive: Early iden­ti­fic­a­tion of post-pro­gramme audit and leg­acy man­age­ment and resourcing require­ments and plan­ning for those. Early engage­ment with Cairngorms Trust for LEAD­ER and Land­scape Part­ner­ship Pro­gramme Board to identi­fy and final­ise long term man­age­ment arrangements.	Added by Man­age­ment Team Novem­ber 2019 An intern­al work­ing group has been estab­lished to pro­gress pre­vent­at­ive mit­ig­a­tion actions.	→	→	→
Tech­nic­al: Increas­ing ICT depend­ency for effect­ive and effi­cient oper­a­tions is not adequately backed up by ICT sys­tems support.	A17	DC	Remedi­al: ICT Advis­ory review com­mis­sioned from intern­al audit. Con­sultancy work also under­way through Think­Where for GIS and Avendris for cus­tom­er man­age­ment and elec­tron­ic records management.	Added April 2018 Oper­a­tion­al Man­age­ment Group review. Cyber secur­ity and wider ICT func­tion­al­ity reviews com­pleted. Some ongo­ing delays around IT ele­ments of pro­ject delivery.	→	→	→
Tech­nic­al: Cyber secur­ity is inad­equate to address risk of cyber-attack on systems	A18	DC	Pre­vent­at­ive: Imple­ment­a­tion of Scot­tish Gov­ern­ment Cyber Secur­ity Action Plans and intern­al audit recom­mend­a­tions on IT secur­ity. Ongo­ing review of sys­tems and pro­ced­ures in tan­dem with LLTNPA.	Added by MT / OMG April 18. Cyber secur­ity plus accred­it­a­tion received. Work under­way to com­plete resid­ual intern­al audit actions.	↓	↓	↓
Resourcing: CNPA IT ser­vices are not suf­fi­ciently robust / secure / or well enough spe­cified to sup­port effect­ive and effi­cient ser­vice delivery.	A13	DC	Pre­vent­at­ive: We will devel­op and con­sult on the for­ward plans for ICT ser­vice devel­op­ment to ensure these meet ser­vice require­ments. Com­mis­sioned extern­al review of our IT and data man­age­ment pro­cesses to be imple­men­ted to give assurance.	Risk added through staff con­sulta­tion with Staff Con­sultat­ive For­um Sep 2016. Actions imple­men­ted on Cyber Secur­ity. Very high levels of ser­vice avail­ab­il­ity. Some out­stand­ing improve­ment actions and IT pro­ject imple­ment­a­tion to be delivered, how­ever, over­all level of risk declining.	→	→	→
Repu­ta­tion: the Authority’s repu­ta­tion is impacted by a small num­ber of voci­fer­ous social media opin­ion leaders	A14	GM	Pre­vent­at­ive: Staff and Board train­ing on use of social media to best sup­port organ­isa­tion­al aims in com­mu­nic­a­tions and repu­ta­tion man­age­ment. Ongo­ing deliv­ery of com­mu­nic­a­tions strategy. Remedi­al: Social media pro­file also rep­res­ents an oppor­tun­ity to boost repu­ta­tion. Remedi­al: involve­ment in emer­ging NPUK col­lect­ive com­mu­nic­a­tions strategy and cam­paigns which will pro­duce addi­tion­al high pro­file pos­it­ive repu­ta­tion­al impact.	Added by Board Dec 16. Imple­ment­a­tion of com­mu­nic­a­tions strategy and wider organ­isa­tion­al deliv­ery, includ­ing pro­mo­tion of recent suc­cesses, effect­ive in main­tain­ing organ­isa­tion­al pro­file. Ongo­ing down­ward trend in risk. How­ever, main­tain on register for time being recog­nising some ongo­ing pres­sures being managed.	↓	↓	↓
Repu­ta­tion: high pro­file incid­ents or one off stor­ies, such as those asso­ci­ated with wild­life crime, moun­tain hares, afford­able hous­ing can have an undue influ­ence on the Authority’s wider reputation.	A15	GM	Remedi­al: Main­tain good bal­ance of tra­di­tion­al and social media releases. Remedi­al: Close part­ner­ship work­ing to seek to bal­ance incid­ent report­ing and appro­pri­ately reflect Authority’s pos­i­tion and work.	Added by MT Jan 18. Wild­life crime ini­ti­at­ive now launched. Oth­er pos­it­ive media around Snow Roads and Cairngorms as a des­tin­a­tion. This risk dimin­ish­ing in impact as wider bal­an­cing inform­a­tion becomes more widespread.	↓	↓	↓
Resourcing: scale of asset respons­ib­il­it­ies such as for paths, out­door infra­struc­ture is not adequately recog­nised and does not secure adequate for­ward main­ten­ance funding.	A16	DC	Remedi­al: Review of account­ing pro­ced­ures and asset recog­ni­tion policy; review of forth­com­ing account­ing tech­nic­al guid­ance. Ensure full con­sid­er­a­tion is giv­en in budget reviews. Pre­vent­at­ive: Altern­ate fund­ing sources such as vis­it­or giv­ing to be explored more actively.	Added by MT / OMG April 18. Infra­struc­ture main­ten­ance issues exacer­bated by end of exist­ing agree­ment over Spey­side Way Long Dis­tance Route and end of main­ten­ance peri­od for some large scale invest­ments – East Cairngorms Access Pro­ject (ECAP) for example.	↑	↑	↑
Resources / Staff­ing: fail­ure to effect­ively man­age staff­ing num­bers with a view to the long term busi­ness need will reduce the capa­city for the Author­ity to deploy adequate fin­an­cial invest­ment toward pri­or­ity pro­jects in the Nation­al Park.	A19	DC	Pre­vent­at­ive: Work­force Man­age­ment Strategy developed and in place. Ana­lys­is of staff­ing con­tract pos­i­tion over three year peri­od com­pleted with actions estab­lished. Review of all vacan­cies as they arise.	Added by Staff­ing and Recruit­ment and Audit and Risk Com­mit­tees Feb / Mar 2019. Staff con­tract pos­i­tion now estab­lished and sub­ject to ongo­ing mon­it­or­ing through HR, with review at point of any vacan­cies arising. Ongo­ing man­age­ment of staff num­bers under­way with some high­lighted areas now resolved. Budget 20⁄21 shows pos­it­ive pic­ture on staffing.	↓	↓	↓
Resources: change in fin­an­cing IT ser­vices and the switch from cap­it­al to rev­en­ue pro­vi­sion places an unman­age­able pres­sure on the Authority’s budget capacity.	A20	DC	Remedi­al: Mon­it­or pat­tern of IT Invest­ment costs as regards the cap­it­al and rev­en­ue split of resourcing require­ments; build impacts into ongo­ing budget delib­er­a­tions with Scot­tish Government.	Added by Audit Com­mit­tee 8 March 2019 fol­low­ing ​“deep dive” IT risk review. 2020⁄21 budget estim­ates give bal­anced pos­i­tion between cap­it­al and rev­en­ue costs.	→	→	↓
Repu­ta­tion: the Author­ity is not per­ceived to be appro­pri­ately address­ing the poten­tial for con­flict between 4 stat­utory aims.	A21	GM	Pre­vent­at­ive: Ensure Board policy papers and Plan­ning Com­mit­tee papers are expli­cit in recog­nising stra­tegic policy con­flicts between 4 stat­utory aims and in address­ing the eval­u­ation of the conflict.	Added by Audit Com­mit­tee 8 March 2019 fol­low­ing intern­al audit report on stra­tegic plan­ning pro­cesses. May have to increase pro­file of this mov­ing forward.	→	→	→
Tech­nic­al: Busi­ness Con­tinu­ity Plans (BCP) are inad­equate to deal with sig­ni­fic­ant impacts to nor­mal work­ing arrange­ments and res­ult in ser­vice failure.	A22	DC	Pre­vent­at­ive: Over­haul of BCP developed in 2014 with report­ing on devel­op­ment of plans through Man­age­ment Team and Audit and Risk Com­mit­tee. Test BCP arrange­ments once plan in place and communicated.	Added by Audit Com­mit­tee May 2019 fol­low­ing intern­al audit review of BCP. Some delay in final­isa­tion of BCP itself. How­ever, work on BCP has con­sid­er­ably assisted in roll out of ini­tial responses to Coronavir­us pandemic.	→	→	→

17 live stra­tegic risks (pre­vi­ously 19); of which 0 risks iden­ti­fied for clos­ure with 2 risks on con­sist­ent down­ward trend.

The risks in this sec­tion of the risk register relate to spe­cif­ic sec­tions or ser­vices of the organ­isa­tion. As such they are oper­a­tion­al or tac­tic­al risks rather than stra­tegic risks. They are presen­ted along­side the stra­tegic risk register as an aid in risk man­age­ment prac­tices, where from time to time risks may be escal­ted to a stra­tegic risk if they are deemed to begin to impact on the deliv­ery of stra­tegic objectives.

Risk	Ref	Resp	Mit­ig­a­tion	Com­ments	Trend Aug 19	Trend Nov 19	Trend Feb 20
Spe­cif­ic Ser­vice Risks Part­ner­ships: Con­ser­va­tion part­ner­ships, cru­cial to deliv­ery of pri­or­it­ies across land owned by oth­ers, are not formed or suf­fi­ciently developed to deliv­er con­ser­va­tion priorities.	CI	PM	Pri­or­it­ise invest­ment of time in estab­lish­ing and main­tain­ing work­ing rela­tion­ships; devel­op clear focus on require­ments of part­ner­ships, their pur­pose, object­ives and resources.	Moor­land Part­ner­ship and Cairngorms Con­nect pro­gress­ing well; grow­ing rela­tion­ships with indi­vidu­al estates re wood­land expan­sion pro­pos­als; recent input to engage more widely with keep­ers and rap­tor study groups.	→	→	→
Staff and com­mu­nic­a­tions: part­ners’ staff are not engaged with or do not buy into the Authority’s con­ser­va­tion NPPP priorities.	C2	PM	Clear and con­sist­ent mes­saging of CNPA pri­or­ity and inten­ded out­comes / impacts; clear, prompt and focused responses to part­ner concerns.	Increased levels of joint work­ing with FCS and SNH on pri­or­ity issues of wood­land expan­sion and des­ig­nated sites; Part­ner­ship Plan com­ple­tion reaf­firmed shared pri­or­it­ies among part­ner agen­cies. Audit and Risk Cttee agreed to retain this risk May 2018.	↓	↓	↓
Repu­ta­tion­al: the Authority’s lead­er­ship repu­ta­tion will be dam­aged if East Cairngorms Moor­land Part­ner­ship fails as a con­sequence of fail­ure or per­ceived fail­ure to deliv­er objectives.	C3	PM	Estab­lish and com­mu­nic­ate clear part­ner­ship object­ives. Main­tain clar­ity with­in part­ner­ship on actions and their asso­ci­ated deliv­ery responsibilities.	Added through Man­age­ment review April 2018. Work ongo­ing in this area, with no evid­ence as yet of changes to like­li­hood or impact.	→	→	→
Part­ner­ships: trans­fer of Crown Estates may res­ult in sig­ni­fic­ant dis­rup­tion to estab­lished pat­terns of part­ner­ship work­ing with key land-own­ers and reduced effect­ive­ness in deliv­ery with this key stake­hold­er group	C4	PM	Mon­it­or pro­gress of Crown Estates trans­fer and poten­tial impacts on CNP Part­ner­ship oper­a­tions, tak­ing pre­vent­at­ive actions as required.	Added at Board meeting		Decem­ber 2015. Moved to ser­vice spe­cif­ic risk from gen­er­al risk through man­age­ment review April 18	→	→	→
Repu­ta­tion: Caper­cail­lie pro­ject and the Authority’s repu­ta­tion more widely is impacted by a small num­ber of voci­fer­ous social media opin­ion leaders	C5	PM	Remedi­al: seek to meet with those cri­ti­cising pro­ject to address issues where they are will­ing to take up this oppor­tun­ity. Pre­vent­at­ive: pro­act­ive pos­it­ive com­mu­nic­a­tions by both Author­ity and range of com­munity part­ners on pro­ject achievements.	Added fol­low­ing Board dis­cus­sion Dec 19. Actions ongoing	→

Risk	Ref	Resp	Mit­ig­a­tion	Com­ments	Trend Aug 19	Trend Nov 19	Trend Feb 20
Part­ner­ships: com­pet­ing pri­or­it­ies act to pre­vent or delay deliv­ery of Cairngorm and Glen­more Strategy.	VI.I	MF	Pre­vent­at­ive: Re-ini­ti­ate momentum on pro­ject. Reg­u­lar part­ner con­tact and early joint plan­ning for deliv­ery pri­or­it­ies, seek to expose poten­tial con­flicts at early stages and col­lab­or­ate to identi­fy remedi­ation. Remedi­al: pro­gress spe­cif­ic pro­ject ini­ti­at­ives in area in line with stra­tegic aspirations.	Cairngorm & Glen­more Strategy was agreed among part­ners but chan­ging part­ner capa­city risks less joined-up, less ambi­tious deliv­ery. Prob­lems with Cairngorm Funicu­lar are res­ult­ing in heightened risk. Some work is now pro­gress­ing around mas­ter­plan for HIE Estate and deliv­ery of Rur­al Tour­ism Infra­struc­ture Fund project.	↑	↑	↑
Resources and Part­ner­ships: HLF fun­ded Tomin­toul and Glen­liv­et Land­scape Part­ner­ship and Caper­cail­lie Frame­work fail to fully deliv­er to the expect­a­tions of fun­ders and communities.	LI	PM	Ensure suf­fi­cient staff resources are ded­ic­ated to sup­port­ing pro­ject boards. Ensure reg­u­lar pro­ject mon­it­or­ing and evaluation.	Broad range and scale of TGLP pro­jects com­bined with wide diversity of part­ner input is chal­len­ging to man­age and TGLP staff team at full stretch. How­ever mon­it­or­ing of work­loads and pro­ject pro­gress is in place and respon­ded to. These risks will be rep­lic­ated with­in new Caper­cail­lie pro­ject and need equi­val­ent management.	→	→	→
Gov­ernance: Board and stake­hold­ers do not adequately under­stand and appre­ci­ate land­scape scale land man­age­ment issues	L2	PM	At Board level, con­tin­ue to use Board self-assess­ment and skills mat­rix to guide mem­ber recruit­ment, train­ing and inform­al brief­ing ses­sions. Use part­ner­ship mech­an­isms to ensure stake­hold­er under­stand­ing and appreciation.	Added by Audit and Risk Com­mit­tee May 2018 Work ongo­ing and no change in risk assess­ment at this stage. Board skills mat­rix has iden­ti­fied areas for focus in devel­op­ment activities	→	→	→
Resources and Part­ner­ships: the broad part­ner­ship, policy com­bin­a­tion and fin­an­cial resources required to address chal­lenges of hous­ing deliv­ery are not sufficient.	RI	MF	Stra­tegic focus on estab­lish­ment of the part­ner­ship approach, policy changes and resources required in devel­op­ment of next NPPP.	Nation­al Park Part­ner­ship Plan con­sulta­tion suc­cess­ful. Loc­al Devel­op­ment Plan pro­gress­ing well. Mit­ig­a­tion actions there­fore pro­gress­ing well, but over­all no change to risk trend as yet.	→	→	→

Notes:

• Aim­ing to keep stra­tegic risk register to around 12 to 15 high level stra­tegic risks
• Cross-cut­ting risks impact poten­tially through­out all priorities
• Stra­tegic Risks around cor­por­ate pri­or­it­ies focus on risk impacts through­out each of the three themes – hence require a coordin­ated over­view at Dir­ect­or / MT level. Not expect­ing a stra­tegic risk against each spe­cif­ic Cor­por­ate Plan priority.
• More spe­cif­ic risks are expec­ted to be cap­tured in more oper­a­tion­al risk registers – e.g. risk man­age­ment around deliv­ery of office extension.
• Full risk register the col­lect­ive respons­ib­il­ity of full MT to man­age, how­ever each risk alloc­ated to one spe­cif­ic mem­ber of the team to take lead responsibility.
• Aim through mit­ig­a­tion to reduce Like­li­hood (LL) mul­ti­plied by Impact (IM) risk score to below 10 as accept­able risk value.
• Ref­er­ence key: ​“A” items are risks impact­ing on all aspects of the Cor­por­ate Plan; ​“C” items are Con­ser­va­tion only risks; ​“V” risks relate spe­cific­ally to Vis­it­or Exper­i­ence; ​“L” risk relate to Land Man­age­ment; ​“R” risks relate to Rur­al Devel­op­ment risks.

Key	Descrip­tion
↓	Man­aged risk (green down­ward arrow in greyed-out field): risk assess­ment that risk is effect­ively man­aged and no longer a stra­tegic risk pos­ing poten­tial to inhib­it achieve­ment of cor­por­ate stra­tegic object­ives. Risk can be removed from risk register.
↓	Lower­ing risk (green down­ward arrow): risk impact and / or like­li­hood is declin­ing res­ult­ing in over­all stra­tegic risk assess­ment of mit­ig­a­tion actions effect­ive with ongo­ing mon­it­or­ing of risk envir­on­ment still required.
→	Stat­ic risk (amber hori­zont­al arrow): risk impact and like­li­hood is stable. Over­all stra­tegic risk assess­ment is stable indic­at­ing that stra­tegic risk remains, requir­ing ongo­ing man­age­ment and con­tin­ued imple­ment­a­tion of pro­posed mit­ig­a­tion and controls.
↑	Increas­ing risk (red upward arrow): risk impact and / or like­li­hood is increas­ing res­ult­ing in increas­ing risk of achieve­ment of stra­tegic object­ives being inhib­ited. Man­age­ment action, and pos­sibly resource invest­ment, required to address risk envir­on­ment and pos­sibly intro­duce new mit­ig­a­tion action, in order to reduce risk impact and / or likelihood.

Ver­sion Control

• 3 Board Cycle Decem­ber 2019
• 3.0 Board adop­ted ver­sion June 2019 for MT / OMG review
• 3.1 Audit Com­mit­tee review 6 Septem­ber 2019
• 3.2 Man­age­ment Team Novem­ber 2019
• 4 Board Cycle Jan to Jun 2020
• 4.0 Draft fol­low­ing Board con­sid­er­a­tion Decem­ber 2019
• 4.1 To Audit and Risk Com­mit­tee March 2020