CAIRNGORMS NATION­AL PARK AUTHORITY

Draft MINUTES AUDIT & RISK COM­MIT­TEE 27/11/2020

Draft MINUTES of MEET­ING of the AUDIT & RISK COM­MIT­TEE of THE CAIRNGORMS NATION­AL PARK AUTHORITY

held via Lifes­ize Video Con­fer­ence on 27 Novem­ber 2020

Present:

• Judith Webb (Chair)
• Peter Argyle

• Pippa Had­ley

• Janet Hunter

• John Lath­am
• Gaen­er Rodger (Vice Chair)

In Attend­ance:

• Chris Brown, Azets
• Stephanie Hume, Azets
• John Boyd, Grant Thornton
• Grant Moir, Chief Executive
• Dav­id Camer­on, Cor­por­ate Ser­vices Director
• Danie Ral­ph, Fin­ance Manager
• Alix Hark­ness, Clerk to Board

Apo­lo­gies: None.

1. Wel­come and Apologies

The Chair noted there had been an ini­tial meet­ing between mem­bers and aud­it­ors to review pro­gress of work and any issues arising, and thanked aud­it­ors and com­mit­tee mem­bers for attending.

2. Minutes of Pre­vi­ous Meeting

The Chair wel­comed every­one to the meet­ing and apo­lo­gies were noted.

3. The draft minutes of the 11^th Septem­ber 2020 meet­ing were approved with no amendments.

4. Com­ment made that there was an incon­sist­ency refer­ring to Scott Mon­crief now Azets and to ensure this rec­ti­fied going for­ward. Chris Brown advised that the name change happened on 7^th Septem­ber 2020 which was after the meet­ing papers were published.

5. Mat­ters Arising

Dav­id Camer­on, Dir­ect­or of Cor­por­ate Ser­vices, repor­ted that move­ment on the out­stand­ing actions lis­ted at the end of the 12 June 2020 Audit & Risk Com­mit­tee Minutes were:

a) At Para 23i): — Closed — Thanks to be giv­en to the Fin­ance team for their hard work des­pite chal­len­ging times (work­ing remotely) to get the Annu­al Accounts ready for sign off.

b) At Para 32i) – Open — Dir­ect­or of Cor­por­ate Ser­vices to cir­cu­late the most up to date ver­sion of the Extern­al Audit Report to the Committee.

c) At Para 34i) –In Hand – Dir­ect­or of Cor­por­ate Ser­vices to invest­ig­ate the £6 work­ing from home allow­ance from HMRC. He repor­ted that around 10 staff had signed up, people will get tax rebate from the sum rather than £6/ week. A Mem­ber sug­ges­ted that the Staff­ing & Recruit­ment Com­mit­tee con­sider wheth­er the Author­ity do pay staff that £6. Dir­ect­or of Cor­por­ate Ser­vices provided reas­sur­ance that this was being look­ing at not just as an Author­ity but across all Scot­tish NDPB’s.

d) At Para 34ii) – In Hand – Dir­ect­or of Cor­por­ate Ser­vices poten­tially through the Staff­ing & Recruit­ment Com­mit­tee to mon­it­or the fin­an­cial bur­den of work­ing from home on staff in the winter months. He provided reas­sur­ance that while staff are being sup­por­ted to make claims, any indi­vidu­al staff hard­ships are also on the Authority’s radar.

e) At Para 34iii) – In Hand – CEO to weave the need for Board cohe­sion and the chal­lenges that work­ing from home brings to the Board. CEO picked up on Board sur­vey, and look­ing at staff sur­vey inter­ac­tion with the Board.

f) At Para 41i) – Closed — Clerk to the Board sched­uled 15mins pri­or to this Audit & Risk Com­mit­tee meet­ing for the Com­mit­tee to have some time with the Auditors.

6. Declar­a­tions of Interest

There were no interests declared.

7. Risk Man­age­ment (Paper 1)

Dav­id Camer­on, Dir­ect­or of Cor­por­ate Ser­vices presen­ted a Paper which presents an update of the Authority’s stra­tegic risk register. The paper also sets out a spe­cif­ic con­sid­er­a­tion of the stra­tegic risks around repu­ta­tion­al man­age­ment, fol­low­ing the Board’s con­sid­er­a­tion of these mat­ters in Septem­ber, with a view to update and ration­al­ise the risks included in the risk register

8. The Audit & Risk Com­mit­tee made the fol­low­ing comment:

a) Fol­low­ing dis­cus­sion agreed the revi­sion to repu­ta­tion­al risks as sug­ges­ted in the paper was appro­pri­ate for amend­ment in the stra­tegic risk register;

b) Mem­bers sought clar­ity on the rationale for risk A19 (Resources & Staff­ing) also presen­ted as greyed out and pro­posed to be removed. Dir­ect­or of Cor­por­ate Ser­vices con­firmed that it was anoth­er risk with an ongo­ing down­ward trend over a few review cycles and a staff resource review tak­ing place at present meant that it could reas­on­ably come out at this stage.

9. The Audit & Risk Committee:

a) reviewed the updated stra­tegic risk register and com­ment on any ele­ment of the Authority’s stra­tegic risk man­age­ment position;

b) con­sidered wheth­er there are any stra­tegic risks poten­tially impact­ing on deliv­ery of the Authority’s stra­tegic object­ives not covered by cur­rent risk man­age­ment approaches;

c) agreed pro­posed amend­ments to the stra­tegic risks on repu­ta­tion­al man­age­ment as set out in para­graph 7;

d) agreed that oth­er risks flagged for dele­tion in Annex 1 are removed from the risk register.

10. Action Point Arising: None.

11. Busi­ness Con­tinu­ity Plan­ning Risk Register Review (Paper 2)

Dav­id Camer­on, Dir­ect­or of Cor­por­ate Ser­vices presen­ted a Paper which presents an update of the Authority’s risk man­age­ment activ­it­ies dur­ing the busi­ness con­tinu­ity response to the COVID19 pan­dem­ic, with­in the con­text of the Authority’s approach to stra­tegic risk man­age­ment. He advised that Vicky Walk­er, Office Man­ager, who had helped pre­pare the paper, would be in attend­ance at the next meeting.

12. The Audit & Risk Com­mit­tee made the fol­low­ing obser­va­tions and comments:

a) New busi­nesses ven­tures mainly in the food sec­tor had cropped up as a res­ult of cov­id, were these being cap­tured? CEO advised that this work was being done through the Cairngorms Busi­ness Part­ner­ship and the Cairngorms Eco­nom­ic For­um and was not appro­pri­ate for this register. He advised that the num­ber of new busi­nesses does not off­set the num­ber of busi­nesses espe­cially in the Hos­pit­al­ity sec­tor that are strug­gling. He added that work was being done through Grow­biz and the CBP to sup­port them.

b) Query around resources becom­ing over­stretched. The CEO con­firmed that the demands across the organ­isa­tion were cer­tainly exacer­bated by a com­bin­a­tion of the organisation’s intern­al responses to COV­ID restric­tions, wider demands and pro­act­ive work led by the Author­ity to help address COV­ID and oth­er impacts and for­ward plan­ning for poten­tial relax­a­tion of restric­tions in the Spring of 2021. A great deal of atten­tion is being giv­en to staff wel­fare and work­loads and to pri­or­it­isa­tion of activ­it­ies and pro­jects. Mem­bers noted that the longer high pres­sure work­ing goes on, people would get worn down by the con­tin­ued pres­sure. Dir­ect­or of Cor­por­ate Ser­vices agreed that the past few months had been hec­tic for many staff and there was a need to ensure a line was drawn in the capa­city to con­tin­ue with the range and extent of work­loads and the need to rein­force with man­agers to be sup­port­ive of their teams in estab­lish­ing reas­on­able, attain­able work­loads. The CEO also com­men­ted that an intent behind the man­age­ment restruc­ture is to bring added pri­or­it­isa­tion into the Authority’s workloads.

c) The Chair asked about risk appet­ite to identi­fy which we can take on, some things need to be real­ist­ic and where can really make a dif­fer­ence in mit­ig­a­tion. Dir­ect­or of Cor­por­ate Ser­vices agreed that this was a long stand­ing action, to draw a risk appet­ite policy to take to com­mit­tee. Risk appet­ite was also a factor rel­ev­ant to the Authority’s engage­ment with and sup­port of the Her­it­age Hori­zons bid. The Dir­ect­or of Cor­por­ate Ser­vices con­firmed he will come back at a later date with thoughts on Risk Appet­ite for con­sid­er­a­tion by the Committee.

d) A mem­ber com­men­ted on the pos­sible men­tal health impacts, were man­age­ment aware how staff were cop­ing with the huge work­load while not being sur­roun­ded by col­leagues or work­ing in teams as part of their using cop­ing mech­an­isms? Was staff wel­fare dur­ing the pan­dem­ic being tak­ing into con­sid­er­a­tion and the impacts being mon­itored? CEO agreed that people sit­ting at home and not being part of team was recog­nised and had been addressed extens­ively in com­mu­nic­a­tion and action plan­ning. For example, there was man­age­ment sup­port encour­aging staff to have a chat with someone through­out the day; ​‘Well­being Wed­nes­days’ com­mu­nic­a­tions; staff pub quizzes; a VC room for cof­fee breaks; diary man­age­ment for home­work­ing guidelines had all been put in place. Man­age­ment recog­nised that some people have thrived with home work­ing and some people haven’t. Recog­ni­tion that work­load pres­sures was at times not evenly dis­trib­uted with Cor­por­ate Ser­vices and Vis­it­or ser­vices sides of the organ­isa­tion per­haps feel­ing more pres­sur­ised than the Con­ser­va­tion side. The mem­ber observed that diary con­trol was really import­ant as was ensur­ing adequate gaps between meetings.

13. The Audit & Risk Committee:

a) Noted the update on the Authority’s risk man­age­ment on our COVID19 busi­ness con­tinu­ity responses as set out in this paper;

b) Reviewed the cov­er­age of the risk register estab­lished in sup­port of the Authority’s Busi­ness Con­tinu­ity Plan­ning and Management;

c) Con­sidered the con­tin­ued appro­pri­ate­ness of the approach to and focus of risk man­age­ment while in the cur­rent BCP led oper­a­tion­al circumstances.

14. Action Point Arising: None.

15. Intern­al Audit Pro­gress Report (Paper 3)

Chris Brown, Azets presen­ted a Paper which presents the Intern­al Audit Pro­gress Report. He high­lighted the fol­low­ing points:

a) They were a little bit behind where they had hoped to be, as a con­sequence of reviews being under­taken remotely and also start­ing the work for the year later than they would nor­mally be start­ing because of the con­tract han­dover period.

b) The gov­ernance health check work and ongo­ing COV­ID busi­ness con­tinu­ity man­age­ment review will come to the next Com­mit­tee meet­ing and as a res­ult the agenda for the next Com­mit­tee sched­uled meet­ing would be very heavy.

c) A review of what would be reas­on­able and achiev­able by the end of the year would need to be car­ried out. Chris pro­posed send­ing com­pleted reviews out to Com­mit­tee mem­bers as they are final­ised rather than all one week in advance of the next meet­ing. The under­ly­ing issued were around capa­city prob­lems for the staff team to sup­port audit work in addi­tion to ongo­ing work com­mit­ments; that there were far more reviews than in nor­mal pro­grammes pre­vi­ously agreed; there­fore we are try­ing to do more with a stat­ic resource, or in fact less resource giv­en the added pres­sures of home work­ing and COV­ID responses.

d) Some pri­or­it­isa­tion of where the Com­mit­tee needs most assur­ance may be needed in final­ising the audit plan for the year and scop­ing plans for ²¹⁄₂₂.

16. The Audit & Risk Com­mit­tee made the fol­low­ing obser­va­tions and comments:

a) The Chair com­men­ted that it would be help­ful to have sight of the reports as and when they come out.

b) Com­ment made that it was good to have real­ist­ic expect­a­tions of what is likely to come to the Com­mit­tee and it was import­ant to have suf­fi­cient time for a meet­ing to go over papers.

c) Sug­ges­tion made to sched­ule an addi­tion­al Audit & Risk Com­mit­tee meet­ing at the end of January/​early Feb­ru­ary 2021. Dir­ect­or of Cor­por­ate Ser­vices agreed with this sug­ges­tion and agreed to liaise with Azets regard­ing when they expect reports to be ready before seek­ing a date.

d) Dir­ect­or of Cor­por­ate Ser­vices added that he would also be bring papers on the les­sons learned from the review on com­plaints hand­ling pro­cess against board members.

e) CEO added that intern­al audits on out­door access infra­struc­ture could be pushed back into next year, so will need to look at the list with the aud­it­ors. The Dir­ect­or of Cor­por­ate Ser­vices also noted that it had been flagged at the out­set of the year that a few of the intern­al audit plans would be budget and capa­city depend­ent, not­ably on VAT review which had been split into two phases and out­door access infra­struc­ture. Again, there was scope to reduce the amount of work to be under­taken before the end of March.

f) Chris Brown advised that he was happy with that way forward.

17. The Audit & Risk Com­mit­tee noted the recom­mend­a­tions in the report.

18. Action Point Arising:

i. Clerk to the Board to can­vas for a date late January/​early Feb­ru­ary 2021 to sched­ule an addi­tion­al Audit & Risk Com­mit­tee meeting.

19. Com­plaints Review includ­ing les­sons learned review of hand­ling Board Com­plaints (Oral)

Dav­id Camer­on, Dir­ect­or of Cor­por­ate Ser­vices presen­ted the com­plaints review includ­ing the les­sons learned review of hand­ling Board com­plaints. He made the fol­low­ing points:

a) No com­plaints had been logged in the last quarter.

b) As covered pre­vi­ously, his aim is to devel­op a paper early in New Year on the hand­ling of com­plaints against Board mem­bers with­in the umbrella of the Authority’s com­plaints hand­ling pro­ced­ure and les­son learned.

c) Was work­ing with the Chairs of both this Com­mit­tee and Staff­ing & Recruit­ment Com­mit­tee as regards impact on the Code of Con­duct and the Authority’s approach to clear­er defin­i­tion of respect­ive respons­ib­il­it­ies of Exec­ut­ive and Non-Exec­ut­ive leaders.

20. The Audit & Risk Com­mit­tee made the fol­low­ing obser­va­tions and comments:

a) The Chair praised that there had been no com­plaints in the last quarter.

b) A mem­ber com­men­ted that they had been asked to provide tran­scripts of emails and oth­er records held which made ref­er­ence to a spe­cif­ic indi­vidu­al and then had not heard any­thing more. Dir­ect­or of Cor­por­ate Ser­vices advised that what was being described was the data sub­ject request. He explained that under data pro­tec­tion reg­u­la­tion, every­one has a right to request access inform­a­tion about them held by an organ­isa­tion. Nor­mally we would respond to the requester and that ends the pro­cess. How­ever we ought to have gone back and thanked every­one for help and informed them that the data request had been sub­mit­ted. He reas­sured the Com­mit­tee that an intern­al review of our pro­cesses around that would be car­ried out.

21. The Audit & Risk Com­mit­tee noted the oral report.

22. Action Point Arising: None.

23. FOISA Hand­ling Stat­ist­ics (Oral)

Dav­id Camer­on, Dir­ect­or of Cor­por­ate Ser­vices, presen­ted an oral update on Free­dom of Inform­a­tion and Sub­ject Access Request Hand­ling Stat­ist­ics. He made the fol­low­ing points:

a) 13 requests had been made under Free­dom of Inform­a­tion (FOI)

b) 15 requests under Envir­on­ment­al Inform­a­tion Requests (EIR).

c) 1 data sub­ject access request.

d) 1 inform­a­tion request was not met in full, as we didn’t hold the inform­a­tion reques­ted. This had been fur­ther appealed by the requester to the Scot­tish Inform­a­tion Com­mis­sion­er (SIC) fol­low­ing intern­al review by the Author­ity. Fur­ther inform­a­tion on the out­come of this appeal would be presen­ted to the Com­mit­tee on decision by the SIC.

24. The Audit & Risk Com­mit­tee noted the update.

25. Action Point Arising:

26. AOCB

Dir­ect­or of Cor­por­ate Ser­vices repor­ted that last week the web hosts had been sub­jec­ted to a cyber-attack. Some records people had left on our web con­tact form, some 2,500 email addresses, may have been accessed by the hack­er. Of those roughly half were spam emails and the oth­er half were val­id. The staff team have used the self-assess­ment tool provided by the Inform­a­tion Com­mis­sion­er and found that there was no need to report this incid­ent. The Authority’s staff con­tin­ued to invest­ig­ate the mat­ter intern­ally, look­ing at wheth­er we need to inform the people whose data was accessed. The CEO advised that this was not the CNPA serv­ers, our web­site sits on a sep­ar­ate serv­er and provided reas­sur­ance that this was noth­ing to do with the CNPA server.

27. A Mem­ber quer­ied a recent spam email which only went to board mem­bers, was there thought to be a link to the recent cyber-attack? CEO advised that all Board emails are pub­lished and the recent phish­ing email was not linked to the web serv­er hack.

28. The Vice-Chair com­men­ted that a couple of board mem­bers had issues access­ing their cnpa­board email and sug­ges­ted that we high­light the chan­ging of pass­words reg­u­larly as a good thing to do.

29. The Chair thanked the Com­mit­tee for their con­tri­bu­tion today and exten­ded her thanks to the CNPA Staff and Aud­it­ors teams for the work presen­ted at the meeting.

30. The meet­ing ended 10.40am.

Audit & Risk Com­mit­tee: Out­stand­ing Actions

Action	Status
Audit and Risk Com­mit­tee induc­tion pack	Open
Risk mit­ig­a­tion for LEAD­ER Account­able Body role	Open