CAIRNGORMS NATION­AL PARK AUTHORITY

Audit & Risk Com­mit­tee Paper 6 Annex 1 | 11/09/2020

CAIRNGORMS NPA: BUSI­NESS CON­TINU­ITY PLANNING

COV­ID-19 LOCK­DOWN AND EXIT PLAN­NING: RISK REGISTER

This risk register has been pre­pared to sup­port the man­age­ment of the Authority’s Busi­ness Con­tinu­ity Plan­ning (BCP) oper­a­tions while the Author­ity remains at stages of ​“lock­down” as a con­sequence of our BCP meas­ures imple­men­ted to help in con­trol of the COVID19 pandemic.

The risk register sits under the Authority’s exist­ing and remain­ing stra­tegic risk register, which con­tin­ues to set out the wider stra­tegic risks around the Authority’s deliv­ery of its stra­tegic object­ives. The Author­ity in deploy­ment of its BCP remains in an emer­gency situ­ation while react­ing to nation­al con­trol of the COVID19 pan­dem­ic. How­ever, the Author­ity has not yet taken the step to entirely reori­ent its exist­ing stra­tegic object­ives. This risk register there­fore rep­res­ents an inter­im addi­tion­al lay­er of risk man­age­ment focus for seni­or man­age­ment in con­tinu­ing to lead oper­a­tions while also man­aging the addi­tion­al risks to deliv­ery posed by the cur­rent BCP led mode of operations.

The fol­low­ing table sets out the iden­ti­fied risks and their assessed impacts, togeth­er with an asso­ci­ated score of risk like­li­hood (L) and impact (I). Risk mit­ig­a­tion meas­ures are iden­ti­fied and resid­ual risk rescores to give like­li­hood of risk after suc­cess­ful pre­vent­at­ive action (ML) and impact of risk after suc­cess­ful remedi­al action (MI).

Risk appet­ite is set at a score of 16 or more, or 15 where impact is above 3. At or above such scores, mit­ig­a­tion action is required, oth­er­wise risks will be mon­itored by man­age­ment team. Review of the risk register is coordin­ated by the Man­age­ment Team and Oper­a­tion­al Man­age­ment Group.

Key to abbreviations:

• L = Like­li­hood of risk score
• I = Impact of risk score
• ML = Like­li­hood of risk score after effect­ive imple­ment­a­tion and pre­vent­at­ive mit­ig­a­tion action.
• MI = Impact of risk score after effect­ive imple­ment­a­tion and remedi­al mit­ig­a­tion action. Scores 1 Low to 5 High

Own­er	Risk	Impact	L	I	Pre­vent	ML	Remedi­al	MI
DC	Unpre­pared to respond to BCP relax­a­tion opportunities	Oppor­tun­it­ies to escal­ate ser­vice deliv­ery lost; inef­fi­cient ser­vice delivery	4	5	Estab­lish and man­age risks; pri­or­it­ise seni­or resource to Gov­ern­ment groups and inform­a­tion mon­it­or­ing; Plan for stages of response	1	Pre-estab­lish levels of respons­ive­ness to sup­port quick reaction;	2
DC	Nation­al strategies for exit do not align with assessed Cairngorms priorities	Peri­od of below optim­um deliv­ery is exten­ded; delay in assessed key and time sens­it­ive services	4	5	Pri­or­it­ise seni­or resource to Gov­ern­ment groups and influ­ence think­ing Mon­it­or gov­ern­ment responses and map CNPA strategies accordingly	1	Pro­mote ser­vices to devel­op ser­vice spe­cif­ic oper­a­tion­al deliv­ery options fit­ting vary­ing levels of oper­a­tions; MT / OMG reg­u­lar meet­ings to sup­port quick response / adapt­ive man­age­ment; reg­u­lar gov­ernance check ins.	3
DC	Oper­a­tion­al Plans and budget alloc­a­tions do not fit emer­ging cir­cum­stances and priorities.	Organ­isa­tion­al activ­it­ies are not best dir­ec­ted toward emer­ging pri­or­it­ies; resources not inves­ted in highest pri­or­ity areas.	3	5	Ongo­ing monthly review of oper­a­tion­al plan pos­i­tion­ing; ensure staff per­form­ance devel­op­ment con­ver­sa­tions are a man­age­ment pri­or­ity; Com­mit­tee and Board review.	2	Budget review and refine­ment; estab­lish sec­tor­al response plans	2
DC	Gov­ernance struc­tures do not give adequate lead­er­ship / over­sight / scru­tiny of operations.	Inef­fect­ive lead­er­ship; lack of chal­lenge and scru­tiny over organ­isa­tion­al operations.	5	5	Twice weekly and wider man­age­ment meet­ings; daily lead­er­ship con­ver­sa­tions with Con­ven­or; fort­nightly Gov­ernance Group meet­ings; pri­or­ity invest­ment in main­tain­ing Com­mit­tee meet­ings; clar­ity in gov­ernance hier­archy in case of illness.	2	Ongo­ing review of effect­ive­ness of oper­a­tions and risk man­age­ment action; review of com­mu­nic­a­tions struc­tures; staff sur­veys for feedback.	3
DC	Exist­ing and remain­ing key object­ives are obscured by pri­or­ity of BCP responses.	Key deliv­ery object­ives (e.g. TGLP deliv­ery, Her­it­age Hori­zons bid) are not achieved.	4	4	Oper­a­tion­al plan­ning review to (re) estab­lish pri­or­it­ies; MT over­sight of pri­or­ity actions; seni­or lead­er­ship of key pro­jects established.	2	Estab­lish MT/OMG stand­ing items check­list of key pro­ject pro­gress and repri­or­it­ise resource if slip­page detected.	3
DC	Lack of coordin­ated activ­it­ies res­ult­ing from remote operations	Key pri­or­it­ies are missed; work is duplic­ated by dif­fer­ing staff / groups	4	4	Coordin­a­tion through more reg­u­lar man­age­ment meet­ings; increase time and pri­or­ity to intern­al communications.	2	Estab­lish MT/OMG review of activ­it­ies and imple­ment fur­ther pro­ject man­age­ment con­trols where required; BCP Steer­ing Group weekly meet­ings reviews and responds to feedback.	2
GM	Intern­al com­mu­nic­a­tions with remote work­ing arrange­ments are ineffective.	Lack of coordin­a­tion around activ­it­ies; staff group as a whole are not engaged with organ­isa­tion and do not	5	4	Cent­ral coordin­a­tion of com­mu­nic­a­tions through more reg­u­lar, broad based management	2	Under­take staff sur­vey and imple­ment bot­tom up improve­ment recommendations;	2
GM / PVB	Repu­ta­tion of CNPA is impacted by inap­pro­pri­ate extern­al com­mu­nic­a­tion / coms which do not fit with Nation­al messaging.	Mixed mes­saging from Author­ity and Board con­fuses audi­ences and dam­ages CNPA reputation.	4	4	Cent­ral coordin­a­tion of com­mu­nic­a­tions through more reg­u­lar, broad based man­age­ment meet­ings; clear respons­ib­il­ity for coordin­a­tion of coms; clear Board mem­ber brief­ings and lines to take on policy positions.	2	Par­ti­cip­ate in rel­ev­ant nation­al groups, includ­ing UKNP & EELG Com­mu­nic­a­tions, and respond / adapt to emer­ging mes­saging; reg­u­lar review of Board mes­saging and pos­i­tion through Gov­ernance Group.	2
DC	Inform­a­tion Tech­no­logy and adapt­a­tions are inad­equate to meet organ­isa­tion­al require­ments dur­ing revised work­ing arrangements.	Inef­fect­ive organ­isa­tion­al oper­a­tions through inab­il­ity to sup­port remote work­ing / communications.	3	5	Pri­or­it­ise key sys­tems to ensure adequate invest­ment made in cor­rect oper­a­tion­al sup­port areas: email, VC, plan­ning and fin­ance sys­tems; agree ongo­ing pri­or­ity action plans (shared work­spaces etc.); cloud based solu­tions to pre­serve serv­er capa­city. IT Strategy in devel­op­ment to support	2	Review feed­back from MT and through staff groups, adapt, invest where required, and respond.	4
DC	Resources become over-stretched through seek­ing to both main­tain ser­vices while work­ing to recov­er pos­i­tion through BCP response levels.	Key require­ments / pri­or­it­ies are not achieved through staff over-stretch.	5	5	Oper­a­tion­al plan­ning review to (re) estab­lish pri­or­it­ies; MT over­sight of pri­or­ity actions; seni­or lead­er­ship of key pro­jects estab­lished includ­ing clear terms of ref­er­ence to high­light com­pet­ing pri­or­it­ies and to resolve on behalf of staff.	4	Estab­lish MT/OMG stand­ing items check­list of key pro­ject pro­gress and repri­or­it­ise resource if slip­page detec­ted. Ensure SCF and HR feed­back loops are in place, while ensur­ing these do not replace man­age­ment structures.	3
KC	Men­tal health impacts on staff caused by BCP actions have impacts on organ­isa­tion­al effect­ive­ness over medi­um to long term.	Impacts on staff well­being and men­tal health lead to long term impacts on effect­ive­ness through absence; reduced motiv­a­tion; burn-out	4	4	Pro­act­ive focus on men­tal health; lead­er­ship on bal­ance to private and work life; lead­er­ship on tak­ing reg­u­lar breaks, exer­cise and leave. Adapt HR policies. Reg­u­lar intern­al com­mu­nic­a­tions. pro­act­ive work through SCF; and HR policy adaptation.	3	Put in place feed­back mech­an­isms across organ­isa­tion (staff sur­vey) and with­in teams and respond to feed­back; review and adapt policies and coms where needed.	3
DC	BCP respons­ive­ness cre­ates an overly short term focus with sight of long term implic­a­tions on organ­isa­tion and also the staff group lost.	Long-term impacts and revi­sions to dir­ec­tion are not iden­ti­fied as a con­sequence of short-term BCP recov­ery focus; long term impacts on	2	5	Reg­u­lar Board report­ing and adapt­a­tion to feed­back; Close involve­ment with a range of stakeholder	1	Review feed­back from stake­hold­er groups and fora to identi­fy any gaps in long term focus.	2
DC	Cyber secur­ity arrange­ments become com­prom­ised through adapt­a­tions to facil­it­ate exten­ded peri­od of remote working.	Increased risk of hack­ing, data loss, cor­rup­tion of key sys­tems and data, net­work loss	3	5	Min­im­ise any adapt­a­tions to sys­tems and pro­ced­ures; mon­it­or impacts of actions on secur­ity and pri­or­it­ise remedi­al actions on IT pro­to­cols as part of staff return to office; mon­it­or updates from cent­ral gov­ern­ment teams. Longer term IT strategy in devel­op­ment to meet future organ­isa­tion­al IT needs.	2	Ensure back up arrange­ments con­tin­ue to func­tion as planned.	5
DC	Integ­rity of records man­age­ment is lost as a con­sequence of high volumes of data and records being stored on dis­persed hard­ware and without integ­ra­tion into cent­ral network.	Incom­plete records held by Author­ity; loss of key inform­a­tion either as a loss from hard­ware fail­ure and data not able to be recovered or loss of stor­age devices which can­not be accoun­ted for.	5	4	Design and imple­ment data man­age­ment guid­ance for man­age­ment of inform­a­tion while work­ing remotely; imple­ment secure shared work­ing plat­form; pri­or­it­ise records man­age­ment actions for staff return to office.	4	Estab­lish ​‘over­lap’ record stor­age in remote devices pending safe stor­age in cent­ral sys­tems (i.e. mul­tiple own­ers of records store the same inform­a­tion pending safe and secure cent­ral filing.)	3
DC	Pre­pared­ness for Infec­tious Disease	Work­place trans­mis­sion of infec­tious dis­ease. RIDDOR	4	5	Office pro­to­cols estab­lished reflecting	2	Sup­pli­er for deep clean of premises sourced and	2
	out­break among staff group.	report­able trans­mis­sion. Unne­ces­sary expos­ure lead­ing to staff ill­ness and poten­tially death. Repu­ta­tion­al risk for volun­teer­ing groups and com­munity activ­it­ies led by CNPA.			pub­lic health advice in rela­tion to social dis­tan­cing and hygiene meas­ures. Lim­ited num­bers with office access for busi­ness crit­ic­al reas­ons only. Com­munity and volun­teer­ing guid­ance developed and activ­it­ies under­taken in line with gov­ern­ment guid­ance and nation­al lead organ­isa­tions. Test­ing of organ­isa­tion­al response planned.		con­tin­gency estab­lished. Pro­to­cols for man­aging out­break or staff mem­ber with pos­it­ive test in devel­op­ment. Gov­ern­ment guid­ance for non-essen­tial offices due pri­or to phase 4 of lock­down road map being imple­men­ted. Staff aware of and sup­por­ted to adhere to isol­a­tion pro­ced­ures for them­selves and house­hold members.
DC / KC	Dis­pro­por­tion­ate impact of pan­dem­ic response on Equal­ity and Socio-eco­nom­ic Groups with­in staff group and loc­al community.	Fail­ure to meet stat­utory respons­ib­il­it­ies under equal­ity act 2010. Fur­ther widen­ing of equal­ity gap, poten­tial gen­er­a­tion­al impact.	3	4	Estab­lished Equal­ity Advis­ory For­um dur­ing BCP response peri­od. Remit to include review and sup­port mit­ig­a­tion of impact of pan­dem­ic from an equal­it­ies per­spect­ive. Man­age­ment dir­ec­tion and train­ing to focus on staff well­being and equal­it­ies con­sid­er­a­tions over autumn	2	Green recov­ery fund to offer sup­port to loc­al eco­nomy with equal­it­ies focus integ­rated. Reg­u­lar staff sur­vey to review impact on range of areas includ­ing some equal­ity strands. Sup­port and 1:1 dis­cus­sion with staff high­lighted as high risk and/​or shield­ing. Flex­ible applic­a­tion of leave and carers policy	2

Risks Under Monitoring

The risks in this sec­tion of the risk assess­ment either have ini­tial risk scores of under 15, or 15 where impact is 3. Risks fall­ing into these risk scores will con­tin­ue to be mon­itored by man­age­ment and any escal­a­tion will require remedi­al action to be taken. At present, risks are accep­ted without the need for imme­di­ate (with­in the next 3 to 6 month peri­od) remedi­al action being taken.

Risk	Impact	L	I	Pre­vent	ML	Remedi­al	MI
Dis­persed records hold­ing res­ults in inab­il­ity to meet FOISA responsibilities.	Com­mit­ment to meet or exceed FOISA respons­ib­il­it­ies not upheld.	5	3	Mon­it­or – to date FOISA requests able to be met	4	Mon­it­or	3
Equal­it­ies impact assess­ments are not under­taken pri­or to imple­ment­a­tion as a con­sequence of speed of policy devel­op­ment dur­ing phases of BCP	Com­mit­ments to equal­it­ies duties not discharged.	5	3	Mon­it­or Work ongo­ing in devel­op­ing a new Equal­it­ies Forum	3	Mon­it­or	3
Loss of high num­bers of staff at one time through ill­ness due to COVID19	Loss of key ser­vices; sig­ni­fic­ant ser­vice deliv­ery object­ives missed; break­down in staff com­mu­nic­a­tion systems	5	2	Revised to Mon­it­or Remote work­ing in line with gov­ern­ment guidelines; ensure back up arrange­ments are iden­ti­fied; pri­or­it­isa­tion of activ­it­ies to ensure com­ple­tion with max­im­um like­li­hood of staff com­ple­ment in place.	3	Revised to Mon­it­or Ongo­ing review and repri­or­it­isa­tion of tasks / object­ives as mon­it­or­ing of staff situ­ation directs	4

Ver­sion Control

• 0 Draft­ing
• 0.1 DC first draft pos­i­tion state­ment as at 11 May 2020
• 0.2 DC Board com­mu­nic­a­tions ele­ments in extern­al com­mu­nic­a­tions fol­low­ing Gov­ernance Group dis­cus­sions 12 May 2020
• 0.3 DC Updates from mul­tiple dis­cus­sions pri­or to A&R Committee
• 1 Septem­ber 2020 Audit and Risk Com­mit­tee / Board Cycle
• 1.1 DC Review and update 25 August.
• 1.2 VW edits and addi­tion­al risks 27 August 2020.