200327Paper 5 Annex 1 Governance Statement draft

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit & Risk Com­mit­tee Paper 5 Annex 1 27/03/20

Gov­ernance Statement

Scope of Responsibility

As Account­able Officer, I am respons­ible for main­tain­ing sound sys­tems of intern­al con­trol which sup­port the achieve­ment of Cairngorms Nation­al Park Authority’s policies, aims and object­ives, whilst safe­guard­ing the pub­lic funds and depart­ment­al assets for which I am per­son­ally respons­ible. These duties are in accord­ance with the Man­age­ment State­ment agreed between the Park Author­ity and Scot­tish Gov­ern­ment, and also respons­ib­il­it­ies assigned to me in the Scot­tish Pub­lic Fin­ance Manu­al (SPFM).

The SPFM, issued by the Scot­tish Min­is­ters, provides guid­ance to the Scot­tish Gov­ern­ment and oth­er rel­ev­ant bod­ies on the prop­er hand­ling of pub­lic funds, and sets out the rel­ev­ant stat­utory, par­lia­ment­ary and admin­is­trat­ive require­ments, emphas­ising the need for eco­nomy, effi­ciency and effect­ive­ness, and pro­motes good prac­tice and high stand­ards of pro­pri­ety. I am there­fore respons­ible as Account­able Officer to ensure the Park Authority’s intern­al con­trol sys­tems com­ply with the require­ments of the SPFM.

The Man­age­ment State­ment sets out the role of the Park Authority’s Board in provid­ing lead­er­ship and gov­ernance. The gov­ernance respons­ib­il­it­ies of the Board are sup­por­ted by Stand­ing Orders last revised and adop­ted in 2019 and a Code of Con­duct revised and adop­ted in 2014. A group of pro­fes­sion­al, seni­or staff advisors and appro­pri­ate Board train­ing and devel­op­ment pro­cesses sup­port the good gov­ernance arrange­ments set out in the Stand­ing Orders and Code of Con­duct. As a pub­lic body, the Park Author­ity oper­ates in an open and account­able man­ner, and is com­mit­ted to access­ib­il­ity, open­ness and account­ab­il­ity and sup­ports the highest stand­ards in cor­por­ate governance.

Oth­er than the doc­u­ments referred to above and the resource alloc­a­tion let­ters issued to me over the course of the year, there are no oth­er writ­ten author­it­ies provided to me in ²⁰¹⁹⁄₂₀.

The Oper­a­tion of the Board and Sub-Committees

The Board com­prises 19 mem­bers: 7 appoin­ted by five Coun­cils with bound­ar­ies with­in the Nation­al Park, 7 appoin­ted by Scot­tish Gov­ern­ment, and 5 dir­ectly elec­ted with­in the wards of the Park. The Board there­fore reflects a blend of dif­fer­ent exper­i­ence, back­grounds and interests. The full Board meets reg­u­larly to con­sider strategy, and per­form­ance against the cur­rent Cor­por­ate Plan. Meet­ings are sched­uled quarterly, with addi­tion­al meet­ings con­vened as required. To enable the Board to dis­charge its duties, all mem­bers receive appro­pri­ate and timely inform­a­tion in advance of meet­ings with all agen­das and papers also placed in the pub­lic domain. Meet­ings are open to the pub­lic save the occa­sion­al meet­ing held in private for vari­ous reas­ons of busi­ness and com­mer­cial confidentiality.

To ensure that the Board devel­ops an under­stand­ing of the cur­rent and emer­ging issues, mem­bers also par­ti­cip­ate in inform­al dis­cus­sion ses­sions to con­sider emer­ging policy issues and pro­pos­als, and a pre­ferred stra­tegic dir­ec­tion iden­ti­fied pri­or to fuller, open con­sid­er­a­tion at form­al meetings.

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit & Risk Com­mit­tee Paper 5 Annex 1 27/03/20

The Board has estab­lished sub-com­mit­tees: a Plan­ning Com­mit­tee (which deals with all aspects of the Park Authority’s stat­utory plan­ning respons­ib­il­it­ies), togeth­er with Com­mit­tees cov­er­ing Fin­ance and Deliv­ery, Staff­ing and Recruit­ment, and Audit and Risk. All com­mit­tees have del­eg­ated duties and respons­ib­il­it­ies set out in terms of ref­er­ence agreed by the full Board to over­see and scru­tin­ise the Park Authority’s deploy­ment and man­age­ment of resources. (The record of attend­ance at Board meet­ings can be found in Table 5.)

The Audit and Risk Committee

The Audit and Risk Committee’s role is to provide effect­ive gov­ernance over all aspects of the Park Authority’s intern­al man­age­ment con­trol sys­tems and the annu­al fin­an­cial accounts and audit. It also takes a lead in stra­tegic risk man­age­ment ensur­ing that risks impact­ing on stra­tegic object­ives are iden­ti­fied and mit­ig­ated and that risk man­age­ment is embed­ded through­out the Park Authority’s oper­a­tions. It is sup­por­ted by the Park Authority’s intern­al audit func­tion (BDO LLP) and extern­al aud­it­ors (Grant Thornton LLP), who both have inde­pend­ent access to the Com­mit­tee and to its Con­vener. The Com­mit­tee is tasked with mon­it­or­ing the oper­a­tion of the intern­al con­trol func­tion and bring­ing any mater­i­al mat­ters to the atten­tion of the full Board. Detailed reports of all audit reviews are made avail­able to both man­age­ment and the Committee.

The Com­mit­tee meets at least quarterly and reports annu­ally to the Board on the adequacy and effect­ive­ness of the Park Authority’s intern­al con­trols, and more widely on its work in the pre­ced­ing year.

The Board has con­tin­ued a pro­cess of self-eval­u­ation of effect­ive­ness and gov­ernance over the course of ²⁰¹⁹⁄₂₀ which were ori­gin­ally ini­ti­ated under the ​“Lead­er­ship” ele­ment of the first Organ­isa­tion­al Devel­op­ment Strategy in ²⁰¹⁵⁄₁₆. The Board com­pleted a revi­sion of its skills mat­rix in Feb­ru­ary 2020 and, through this pro­cess, estab­lished a pri­or­ity for con­tinu­ing pro­fes­sion­al devel­op­ment of mem­bers over the com­ing years. Oth­er ele­ments of Board gov­ernance and effect­ive­ness are reviewed and sup­por­ted by seni­or officers as required.

The Board has agreed a set of Cor­por­ate Per­form­ance Indic­at­ors so it may improve its over­sight of deliv­ery against key stra­tegic object­ives and the Park Authority’s Cor­por­ate Plan. A detailed per­form­ance report is sub­mit­ted to the Board twice yearly on deliv­ery key per­form­ance indic­at­ors, con­sidered at each June and Decem­ber meet­ing along­side a review of stra­tegic risk man­age­ment. These mon­it­or­ing and con­trol mech­an­isms sup­port Board scru­tiny over deliv­ery of the Cor­por­ate Plan and Nation­al Park Part­ner­ship Plan priorities.

Peri­od­ic reports from inde­pend­ent intern­al and extern­al aud­it­ors form a key and essen­tial ele­ment in inform­ing my review as Account­able Officer of the effect­ive­ness of the sys­tems of intern­al con­trol with­in the Park Author­ity. The Board’s Audit and Risk Com­mit­tee also plays a vital role in this regard, through its con­sid­er­a­tion of audit recom­mend­a­tions arising from reviews of intern­al con­trol sys­tems and its scru­tiny of pro­posed man­age­ment action to address any improve­ments required. The Audit and Risk Com­mit­tee also con­siders both a three year plan for intern­al audit cov­er­age and annu­ally agrees an intern­al audit plan flow­ing from that three year plan.

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit & Risk Com­mit­tee Paper 5 Annex 1 27/03/20

Shared Ser­vices Delivery

The Park Author­ity plays an import­ant role in provid­ing sup­port over a range of activ­it­ies to loc­al com­munit­ies and organ­isa­tion to help deliv­er the Nation­al Park Part­ner­ship Plan’s pri­or­it­ies. In the last year we have sup­por­ted Cairngorms LEAD­ER Pro­gramme Loc­al Action Group, the Tomin­toul and Glen­liv­et Land­scape Part­ner­ship, the Great Place Badenoch Pro­ject as well as the Caper­cail­lie Frame­work. Our man­age­ment and intern­al con­trol struc­tures ensure that sup­port for these com­munity deliv­ery entit­ies are sep­ar­ated from the core activ­it­ies of the Author­ity, while ensur­ing that our sup­port helps them achieve ​“best prac­tice” in their operations.

The Author­ity also under­takes a range of shared ser­vice arrange­ments with oth­er pub­lic body part­ners. Over the course of the year we have provided human resource advice and organ­isa­tion­al devel­op­ment sup­port to both the Scot­tish Land Com­mis­sion and Bord na Gaidh­lig, while col­lab­or­at­ing on a range of shared ser­vice deliv­ery with Loch Lomond and the Trossachs Nation­al Park Author­ity (LLT­NPA). We receive key sup­port from LLT­NPA on IT infra­struc­ture main­ten­ance, devel­op­ment and shared licence agree­ments for plan­ning sys­tems and data back-up and secur­ity arrange­ments. In addi­tion to these more form­al shared ser­vices with LLT­NPA, both Nation­al Park Author­it­ies con­tin­ue to col­lab­or­ate closely on areas of shared policy interest.

Intern­al Audit

The intern­al audit func­tion is an integ­ral ele­ment of scru­tiny of the Park Authority’s intern­al con­trol sys­tems. BDO LLP was appoin­ted fol­low­ing an open pro­cure­ment pro­cess as the Park Authority’s intern­al aud­it­ors in 2016 and have under­taken a com­pre­hens­ive review of key intern­al con­trol sys­tems since their appoint­ment. Dur­ing the year to 31 March 2020, BDO has repor­ted to the Audit and Risk Com­mit­tee on the fol­low­ing reviews:

Gov­ernance & risk Free­dom of Inform­a­tion (Scot­land) Act Risk man­age­ment Fol­low up review of pri­or recommendations

Intern­al con­trol sys­tems Staff apprais­al and object­ive set­ting LEAD­ER admin­is­tra­tion Expenses man­age­ment Payroll admin­is­tra­tion Pro­ject management

All recom­mend­a­tions made by BDO are con­sidered and imple­men­ted as appropriate.

Our intern­al audits over the course of the year have gen­er­ally res­ul­ted in pos­it­ive reports, with ​“sub­stan­tial” or at least ​“mod­er­ate” rat­ings on the design and imple­ment­a­tion of intern­al con­trol systems.

Extern­al Audit

Extern­al aud­it­ors are appoin­ted for us by the Aud­it­or Gen­er­al for Scot­land through Audit Scot­land. Audit Scot­land appoin­ted Grant Thornton LLP to the role for a five year peri­od com­men­cing in ²⁰¹⁶⁄₁₇. We work well with Grant Thornton, who review key sys­tems so

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit & Risk Com­mit­tee Paper 5 Annex 1 27/03/20

they can form a view on the effect­ive­ness of con­trol arrange­ments which in turn sup­ports their audit opin­ion on the fin­an­cial statements.

The fees paid to Audit Scot­land for the inde­pend­ent stat­utory audit for ²⁰¹⁹⁄₂₀ is £11,350. No fees were paid for non-audit work.

Best Value

The Audit and Risk Com­mit­tee con­tin­ues to mon­it­or the Authority’s adher­ence to Scot­tish Gov­ern­ment Best Value guidelines and our approach to con­tinu­ous improve­ment. We launched phase three of our Organ­isa­tion­al Devel­op­ment Strategy in the year to con­tin­ue to improve our work pro­cesses, organ­isa­tion­al envir­on­ment, and deliv­ery of services.

Risk Man­age­ment

We have a risk man­age­ment strategy in accord­ance with guid­ance issued by Scot­tish Min­is­ters to identi­fy actu­al and poten­tial threats which may pre­vent us from deliv­er­ing our stat­utory pur­pose and also to identi­fy appro­pri­ate mit­ig­a­tion actions.

The Board recog­nises the import­ance of risk man­age­ment and con­tin­ues to mon­it­or the Park Authority’s Stra­tegic Risk Register. The Stra­tegic Risk Register records risks, action taken to mit­ig­ate the iden­ti­fied risks and seni­or management’s respons­ib­il­ity for lead­ing on mit­ig­a­tion gen­er­ally. The Stra­tegic Risk Register is reviewed by Man­age­ment Team four times each year and updated by the full Board twice and by the Audit and Risk Com­mit­tee twice a year.

The Audit and Risk Com­mit­tee, with the Seni­or Man­age­ment Team, leads on embed­ding risk man­age­ment pro­cesses through­out the Park Author­ity. Both groups con­sider the man­age­ment of stra­tegic risk in line with the Risk Strategy to ensure that the required actions are appro­pri­ately reflec­ted and incor­por­ated in oper­a­tion­al deliv­ery plans. A revised Risk Man­age­ment Strategy was adop­ted by the Audit and Risk Com­mit­tee in 2016, and sub­sequently reviewed by the Board in 2019, with the Com­mit­tee also receiv­ing an intern­al audit report on the effect­ive­ness of oper­a­tions of risk man­age­ment with­in the organ­isa­tion in that year.

The Stra­tegic Risk Register was refreshed with ref­er­ence to the cur­rent Cor­por­ate Plan, cov­er­ing I April 2018 to 31 March 2022 and con­tin­ues to be mon­itored and revised when appropriate.

Data Secur­ity

Pro­ced­ures are in place to ensure that inform­a­tion is being man­aged in accord­ance with legis­la­tion and that data is held accur­ately and securely. The Park Author­ity has no repor­ted nor recor­ded instances of data loss in the year to 31 March 2020.

The second iter­a­tion of Cyber Essen­tials + accred­it­a­tion was achieved in the year. We con­tin­ue to review our digit­al prac­tices and infra­struc­ture to ensure they remain fit for pur­pose and that all reas­on­able steps are taken to min­im­ise the risk of data loss or

CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit & Risk Com­mit­tee Paper 5 Annex 1 27/03/20

com­prom­ise of sys­tems due to Cyber Attacks. Work is cur­rently under­way on a Cyber Secur­ity Policy and Digit­al Work­ing Strategy with both to be adop­ted in ²⁰²⁰⁄₂₁.

Con­clu­sion

As Account­able Officer I am respons­ible for review­ing the effect­ive­ness of the sys­tem of intern­al con­trol. In order to do this my review is informed by:

a) The exec­ut­ive man­agers with­in the organ­isa­tion who have respons­ib­il­ity for the devel­op­ment and main­ten­ance of the intern­al con­trol frame­work and who provide assur­ance on sys­tems with­in reg­u­lar Seni­or Man­age­ment Team meet­ings; b) Intern­al mon­it­or­ing of con­trol sys­tems by staff against SPFM require­ments; c) The work of the intern­al aud­it­ors, who sub­mit reg­u­lar reports to the Audit and Risk Com­mit­tee which include the Head of Intern­al Audit’s inde­pend­ent and object­ive opin­ion on the adequacy and effect­ive­ness of our sys­tems of intern­al con­trol togeth­er with recom­mend­a­tions for improve­ment; and d) Com­ments made by the extern­al aud­it­ors in their man­age­ment let­ter and oth­er reports.

I am sup­por­ted by a Cor­por­ate Ser­vices Dir­ect­or, who in turn is sup­por­ted by the Cor­por­ate Ser­vices staff group, and provides seni­or man­age­ment lead­er­ship on the fin­an­cial man­age­ment, intern­al con­trols and gov­ernance arrange­ments. I take assur­ance from the effect­ive­ness of intern­al con­trol sys­tems, fin­an­cial man­age­ment and plan­ning pro­cesses, and risk man­age­ment from the assur­ances received from the Cor­por­ate Ser­vices Director.

I have also been advised on the effect­ive­ness of the sys­tem of intern­al con­trol by the Board and its Audit and Risk Com­mit­tee. Appro­pri­ate action is taken against any weak­nesses iden­ti­fied and to ensure con­tinu­ous improve­ment of our sys­tems. The intern­al auditor’s annu­al report for ²⁰²⁰⁄₂₁ states that, [based on the work under­taken over the course of the year, and in the con­text of mater­i­al­ity, the Park Authority’s intern­al con­trol pro­cesses provides reas­on­able, but not abso­lute assur­ance that the related risk man­age­ment, con­trol and gov­ernance object­ives were achieved in the peri­od under review, in all areas except busi­ness con­tinu­ity where fur­ther work is required – to be updated on receipt and approv­al of intern­al audit annu­al report].