Cairngorms Nation­al Park Authority

Intern­al Audit Report ²⁰²⁰⁄₂₁

Cor­por­ate Governance

Decem­ber 2020

Page 2

Cairngorms Nation­al Park Authority Intern­al Audit Report ²⁰²⁰⁄₂₁ Cor­por­ate Governance

Exec­ut­ive Sum­mary 1 Man­age­ment Action Plan 4 Appendix A – Defin­i­tions 14

Audit Spon­sor	Key Con­tacts	Audit team
Dav­id Camer­on, Dir­ect­or of Cor­por­ate Services	Xan­der McDade, Board Con­vener Car­o­lyn Cad­dick, Deputy Board Con­vener Grant Moir, Chief Exec­ut­ive Judith Webb, Non-exec­ut­ive Dir­ect­or Gaen­er Rodgers, Non-exec­ut­ive Dir­ect­or Alix Hark­ness, Board Clerk	Chris Brown, Audit Part­ner Stephanie Hume, Audit Man­ager Maria Wright, Assist­ant Manager

Page 3

Exec­ut­ive Summary

Con­clu­sion

We have iden­ti­fied many areas of good prac­tice in rela­tion to cor­por­ate gov­ernance arrange­ments at Cairngorms Nation­al Park Author­ity (CNPA). The over­all gov­ernance struc­ture com­plies with the Scot­tish Government’s ​‘On Board’ guid­ance and is pro­por­tion­ate to the organisation’s need. There are effect­ive strategy set­ting and plan­ning pro­cesses in place and these are aligned with the legis­lat­ive require­ments of the Nation­al Parks (Scot­land) Act 2000. We acknow­ledge that there is a rel­at­ively small staff resource and that capa­city has impacted on some of the gov­ernance con­trols not being pro­gressed as expec­ted. We were advised that a review of the man­age­ment struc­ture is being con­duc­ted to help address this.

The fol­low­ing improve­ments would strengthen gov­ernance con­trols: roles and respons­ib­il­it­ies for decision mak­ing should be agreed and form­al­ised in a Gov­ernance Respons­ib­il­ity Frame­work, com­mit­tee terms of ref­er­ence should be reg­u­larly reviewed and report­ing arrange­ments from com­mit­tees to the Board should be form­al­ised, and strengthened in rela­tion to major projects.

Back­ground and scope

Cor­por­ate gov­ernance is con­cerned with the struc­ture and pro­cesses for decision mak­ing and account­ab­il­ity, con­trols and beha­viours at the top of organ­isa­tions. These pro­cesses and struc­tures are imple­men­ted by the board to inform, dir­ect, man­age and mon­it­or the activ­it­ies of the organ­isa­tion towards the achieve­ment of its object­ives. There are vari­ous sources of guid­ance on good gov­ernance in the pub­lic sec­tor, includ­ing On Board — A Guide for Mem­bers of Stat­utory Boards pub­lished by the Scot­tish Gov­ern­ment and CIPFA’s Good Gov­ernance in the Pub­lic Sec­tor. Small pub­lic bod­ies face par­tic­u­lar chal­lenges in this area as they are expec­ted to main­tain the same stand­ards of gov­ernance as large bod­ies but with far few­er resources to sup­port the gov­ernance structure.

In accord­ance with the ²⁰²⁰⁄₂₁ Intern­al Audit plan we have reviewed the gov­ernance arrange­ments in place to ensure they fol­low best prac­tice and are pro­por­tion­ate to the needs of CNPA. This review has included inter­views with a selec­tion of seni­or man­age­ment and board members.

Page 4

Con­trol assessment

1 — Green	1. The over­all gov­ernance struc­ture com­plies with Scot­tish Gov­ern­ment ​‘On Board’ guid­ance and is pro­por­tion­ate to the organisation’s needs.
2 — Amber	2. The roles and respons­ib­il­it­ies of the board, gov­ernance com­mit­tees and man­age­ment are clearly defined and sup­por­ted through doc­u­mented policies and pro­ced­ures (e.g. Terms of Ref­er­ence, Scheme of Del­eg­a­tion), which are sub­ject to reg­u­lar review.
3 — Green	3. A clear and effect­ive strategy set­ting and plan­ning frame­work is in place involving all key stakeholders.
4 — Amber	4. An effi­cient and effect­ive per­form­ance and risk report­ing frame­work is in place between man­age­ment, gov­ernance com­mit­tees and the board.
5 — Yellow	5. The board com­pletes a robust annu­al eval­u­ation of its own per­form­ance and that of its com­mit­tees, incor­por­at­ing feed­back from key stakeholders.

Improve­ment actions by type and priority

Six improve­ment actions have been iden­ti­fied from this review, all of which relate to the design of con­trols. We have also raised one advis­ory find­ing relat­ing to the design of the con­trols in place. See Appendix A for defin­i­tions of col­our coding.

Page 5

Key find­ings

Good prac­tice

• Board mem­bers informed us that they were very sat­is­fied with the qual­ity of induc­tion provided.
• A skills mat­rix has been developed to cap­ture board mem­ber skill­sets and identi­fy devel­op­ment needs.
• Over the last 18 months sys­tems and pro­cesses have been put in place to strengthen con­trols around cor­por­ate gov­ernance as follows;
  • Increas­ing resi­li­ence and suc­ces­sion plan­ning for the board com­mit­tees by cre­at­ing a Deputy Com­mit­tee Chair role.
  • Increas­ing board mem­ber attend­ance at com­mit­tee meetings.
  • All board mem­bers now receive minutes for all Board Committees.
  • Pre-meet­ings have been intro­duced for board com­mit­tees to ensure the papers can be viewed and dis­cussed by the chairs pri­or to the meetings.

Areas for improvement

Improve­ment oppor­tun­it­ies include:

• Form­al­ising roles and respons­ib­il­it­ies for decision mak­ing between the Board and Exec­ut­ive Man­age­ment in the Gov­ernance Respons­ib­il­ity Framework.
• Review­ing com­mit­tee terms of ref­er­ence annually.
• Pro­du­cing an annu­al report from each committee.
• Con­duct­ing assur­ance map­ping in rela­tion to major pro­jects to val­id­ate and address assur­ance gaps for the Board.
• Ensur­ing that all Board mem­bers receive risk man­age­ment training.
• Com­plet­ing annu­al board and com­mit­tee effect­ive­ness reviews and mon­it­or­ing any improve­ment actions through the Audit and Risk Committee.

These are fur­ther dis­cussed in the Man­age­ment Action Plan below.

Impact on risk register

This review is linked to all risks on the Cor­por­ate Risk Register.

Acknow­ledge­ments

We would like to thank all staff con­sul­ted dur­ing this review for their assist­ance and co-operation.

Page 6

Man­age­ment Action Plan

Con­trol Object­ive 1: The over­all gov­ernance struc­ture com­plies with Scot­tish Gov­ern­ment ​‘On Board’ guid­ance and is pro­por­tion­ate to the organisation’s needs.

Green

No report­able weak­nesses identified

The fol­low­ing board com­mit­tees have been established;

• Audit & Risk Committee
• Fin­ance & Deliv­ery Committee
• Staff­ing & Recruit­ment Committee

When decid­ing on the board com­mit­tees to put in place, man­age­ment reviewed the ​‘On Board’ Scot­tish Gov­ern­ment guid­ance and the Scot­tish Pub­lic Fin­ance Manu­al (SPFM). The Terms of Ref­er­ence were then drawn up and report­ing was mapped against the guid­ance. We con­firmed, for example, that risk man­age­ment and intern­al con­trol frame­work reviews are repor­ted to the Audit & Risk Com­mit­tee, fin­an­cial per­form­ance and deliv­ery against cor­por­ate and oper­a­tion­al plans is repor­ted via the Fin­ance & Deliv­ery Com­mit­tee and HR sys­tems, recruit­ment and annu­al pay awards are dealt with by the Staff­ing & Recruit­ment Committee.

In our opin­ion, this approach is pro­por­tion­ate to the size of the organ­isa­tion and in line with Scot­tish Gov­ern­ment guidance.

Page 7

Con­trol Object­ive 2: The roles and respons­ib­il­it­ies of the board, gov­ernance com­mit­tees and man­age­ment are clearly defined and sup­por­ted through doc­u­mented policies and pro­ced­ures (e.g. Terms of Ref­er­ence, Scheme of Del­eg­a­tion), which are sub­ject to reg­u­lar review.

Amber

2.1 Roles and responsibilities

There is no Scheme of Del­eg­ated Author­ity or equi­val­ent doc­u­ment in place to cla­ri­fy decision-mak­ing respons­ib­il­it­ies between the Board and Exec­ut­ive Man­age­ment. This has mani­fes­ted itself as follows:

• Board mem­bers and man­age­ment have advised they feel respons­ib­il­it­ies are not clear and the right bal­ance is not being achieved with regards to decision making.
• There is a lack of mutu­al under­stand­ing between the Board Mem­bers and Exec­ut­ive Man­age­ment on the level of assur­ance required by the Board.
• Com­mit­tee Chairs advised they felt there is a heavy reli­ance on Exec­ut­ive Man­age­ment to drive com­mit­tee agendas.

We note that the Board agreed for a Gov­ernance Respons­ib­il­ity Frame­work to be developed in March 2018, how­ever this has not yet been com­pleted with the delays caused by a num­ber of factors such as key per­son depend­ency, capa­city chal­lenges and COV­ID-19. We were advised that the Deputy Board Con­vener and Dir­ect­or of Cor­por­ate Ser­vices are cur­rently in the pro­cess of devel­op­ing this scheme which will be referred to as the Gov­ernance Respons­ib­il­ity Framework.

Fur­ther, we iden­ti­fied the Man­age­ment Statement/​Financial Memor­andum (MS/FM) states that it shall be reviewed and updated peri­od­ic­ally by the Scot­tish Gov­ern­ment nor­mally at least every 2 – 3 years. We noted that it has not been updated since Septem­ber 2010. How­ever, there has also been no intern­al review of the doc­u­ment con­duc­ted to ensure that the roles and respons­ib­il­it­ies are aligned with cur­rent organ­isa­tion­al prac­tices. Man­age­ment advised that work is ongo­ing in rela­tion to the frame­work agree­ment tem­plate from the Scot­tish Gov­ern­ment which will replace the MS/FM in the first half of 2021. The Dir­ect­or of Cor­por­ate Ser­vices advised us that a first set of com­ments on the tem­plate Frame­work Agree­ment has been sub­mit­ted from a CNPA perspective.

Risk

There is a risk that decisions are made inef­fi­ciently or at inap­pro­pri­ate levels, due to a lack of clar­ity over where author­ity sits with­in the organisation.

Recom­mend­a­tions

Man­age­ment and the Board should agree a com­ple­tion date for the Gov­ernance Respons­ib­il­ity Frame­work. Man­age­ment should pro­gress with the review and imple­ment­a­tion of the updated Frame­work Agree­ment with­in the first half of 2021.

Page 8

Man­age­ment Action

Grade 3 (Design)

Recom­mend­a­tion agreed. We will work over the first half of 2021 to estab­lish a Gov­ernance Respons­ib­il­ity Frame­work in tan­dem with work to imple­ment a Frame­work Agree­ment with Scot­tish Government.

Action own­er: Dir­ect­or of Cor­por­ate Ser­vices Due date: 30 June 2021

Page 9

2.2 Com­mit­tee terms of reference

There is cur­rently no form­al sched­ule in place to ensure that the Terms of Ref­er­ence (TOR) for Board com­mit­tees are reviewed reg­u­larly. We were advised by man­age­ment and board mem­bers that they are reviewed at the end of the three-year cycle of the Com­mit­tee or when any changes to com­mit­tee remits are made, how­ever this is not doc­u­mented. It is noted that the TOR were last reviewed in March 2019.

Fur­ther, we iden­ti­fied the fol­low­ing gaps in the Board com­mit­tee TORs:

• The Audit and Risk Com­mit­tee TOR does not refer to the Committee’s respons­ib­il­it­ies for anti-fraud, whis­tleblow­ing, spe­cial invest­ig­a­tions and complaints.
• The Staff­ing and Recruit­ment Com­mit­tee TOR does not refer to the Committee’s respons­ib­il­it­ies for assur­ance around Health & Safety.
• The com­mit­tees’ report­ing respons­ib­il­it­ies to the Board and the com­mit­tee inform­a­tion require­ments are not doc­u­mented with­in the TOR.

Risk

There is a risk that gov­ernance doc­u­ment­a­tion is not aligned with good prac­tice guid­ance, which could res­ult in Board/​Committee arrange­ments under­min­ing the qual­ity of the gov­ernance exercised.

Recom­mend­a­tions

In line with good prac­tice, Board com­mit­tee TOR should be reviewed on an annu­al basis and as and when any changes are made to com­mit­tee remits.

The Com­mit­tee TOR should be updated to ensure they out­line the key area of respons­ib­il­it­ies as noted above, inform­a­tion require­ments and report­ing to the Board.

Man­age­ment Action

Grade 2 (Design)

Recom­mend­a­tion agreed. We will adapt the Terms of Ref­er­ences to update for the omis­sions help­fully iden­ti­fied through this review and to include any oth­er required amend­ments. We will also sched­ule an annu­al review of the terms of ref­er­ence thereafter.

Action own­er: Dir­ect­or of Cor­por­ate Ser­vices with Clerk to the Board Due date: 30 Septem­ber 2021

Page 10

2.3 Com­mit­tee report­ing to the Board

It is good prac­tice for all com­mit­tees to provide an annu­al report sum­mar­ising their activ­it­ies and attend­ance at meet­ings to provide assur­ance to the Board that they are per­form­ing in line with their del­eg­ated remit. While we con­firmed that the Audit and Risk Com­mit­tee provides an annu­al report to the Board, the Fin­ance and Deliv­ery Com­mit­tee and the Staff­ing and Recruit­ment Com­mit­tee do not. Fur­ther, we iden­ti­fied that in Septem­ber 2019 the Audit and Risk Com­mit­tee provided an annu­al report for ²⁰¹⁸⁄₁₉, how­ever at the time of field­work the annu­al report for ²⁰¹⁹⁄₂₀ had not yet been written.

In addi­tion, we reviewed Board meet­ing minutes and agen­das and con­firmed that com­mit­tee chair updates and com­mit­tee minutes are not included as a stand­ing agenda item for Board meet­ings. Com­mit­tee minutes are how­ever shared with all board mem­bers and they can raise ques­tions from the minutes under any oth­er busi­ness at the Board meeting.

Risk

There is a risk the Board does not receive suf­fi­cient evid­ence that gov­ernance com­mit­tees are oper­at­ing as expec­ted, res­ult­ing in a lack of over­sight of key issues.

Recom­mend­a­tions

In line with good prac­tice, all gov­ernance com­mit­tees should provide an annu­al report to the Board to provide assur­ance that they are oper­at­ing as expec­ted, in line with their del­eg­ated remit.

The Board agenda should include a stand­ing item for com­mit­tee chair updates. This should not be a dis­cus­sion on the meet­ing minutes but rather an oppor­tun­ity for the com­mit­tee chair to provide a brief report on the committee’s key activ­it­ies, decisions and outcomes.

Man­age­ment Action

Grade 2 (Design)

Recom­mend­a­tion agreed. We aim to com­plete the Audit and Risk Com­mit­tee Annu­al Report and Chair updates on Board agen­das by March 21 and act on oth­er Com­mit­tee Annu­al Reports in the first half of ²⁰²¹⁄₂₂.

Action own­er: Dir­ect­or of Cor­por­ate Ser­vices with Clerk to the Board Due date: 30 Septem­ber 2021

Page 11

Con­trol Object­ive 3: A clear and effect­ive strategy set­ting and plan­ning frame­work is in place involving all key stakeholders.

Green

No report­able weak­nesses identified

We con­firmed there is a five-year col­lect­ive Nation­al Park Part­ner­ship Plan (2017−2022) in place. In addi­tion, CNPA has its own spe­cif­ic cor­por­ate plan which links to the nation­al part­ner­ship plan. We con­firmed that there are tar­gets asso­ci­ated with these plans which link to the stra­tegic objectives.

The Nation­al Park Part­ner­ship Plan is writ­ten in stat­ute and the legis­la­tion (Sec­tion 12 of the Nation­al Parks (Scot­land) Act 2000) instructs CNPA on what is required with regards to stake­hold­er con­sulta­tion and engage­ment. We con­firmed that the plan­ning approach taken by CNPA is aligned with the legislation.

Plan­ning for the stat­utory park plan usu­ally starts 18 months pri­or to the report being pub­lished. There are work­shop ses­sions where the Board dis­cuss which themes they would like to see in the plan. Man­age­ment advised they also reflect on the review of the cur­rent plan to see where they are in rela­tion to over­all deliv­ery and take that into account in decision mak­ing. The draft plan is then developed with part­ners and it goes out for pub­lic con­sulta­tion then back to the board mul­tiple times dur­ing the plan­ning pro­cess. Pub­lic con­sulta­tion is car­ried out via a vari­ety of means such as online pub­lic meet­ings, present­a­tions at com­munity coun­cils and social media.

We con­firmed plan­ning has com­menced for the new Part­ner­ship Plan and that a paper was presen­ted to the Board in Novem­ber 2020 with a timetabled plan of work.

Page 12

Con­trol Object­ive 4: An effi­cient and effect­ive per­form­ance and risk report­ing frame­work is in place between man­age­ment, gov­ernance com­mit­tees and the board.

Amber

4.1 Assur­ance on major projects

Board mem­bers con­firmed they are sat­is­fied with the level of detail in reports on stra­tegic risks, per­form­ance against stra­tegic object­ives and fin­an­cial tar­gets. How­ever, board mem­bers noted there may be an assur­ance gap in rela­tion to major pro­jects and that there should be more Board over­sight of large scale, extern­ally fun­ded pro­jects includ­ing those where CNPA is the Account­able Body.

We con­firmed that pro­gramme boards are put in place for the gov­ernance of major pro­jects and the role of the CNPA Board is to gain assur­ance that the Authority’s fin­an­cial and risk man­age­ment pos­i­tions are not adversely impacted by major pro­jects. How­ever, pro­gramme boards only report dir­ectly to the Board on an excep­tion basis and there is no reg­u­lar, expli­cit assur­ance report­ing to the Board. We noted that the fin­an­cial mon­it­or­ing reports from the Fin­ance and Deliv­ery Com­mit­tee to the Board provide inform­a­tion on pro­ject costs, how­ever the costs are aggreg­ated and as such assur­ance on how each indi­vidu­al pro­ject is per­form­ing in rela­tion to its alloc­ated budget is not provided. There is also no report­ing to the Fin­ance & Deliv­ery Com­mit­tee in rela­tion to how pro­jects are pro­gress­ing regard­ing the agreed deliv­ery objectives.

Risk

There is a risk that the Board may not have prop­er vis­ib­il­ity of major pro­jects, ham­per­ing their abil­ity to effect­ively scru­tin­ise and chal­lenge and lead­ing to the organisation’s stra­tegic object­ives not being met.

Recom­mend­a­tions

Man­age­ment should work with Board mem­bers to review the assur­ance arrange­ments for major pro­jects and address any per­ceived gaps, includ­ing pro­ject financials.

Man­age­ment Action

Grade 3 (Design)

Recom­mend­a­tion agreed. We will devel­op an assur­ance review of major pro­ject report­ing and gov­ernance and estab­lish appro­pri­ate scru­tiny and assur­ance measures.

Action own­er: Dir­ect­or of Cor­por­ate Ser­vices Due date: 30 Septem­ber 2021

Page 13

4.2 Risk man­age­ment and fin­ance training

We con­firmed that, while the induc­tion pro­gramme cov­ers roles and respons­ib­il­it­ies of the Board and board mem­bers, stand­ards of con­duct and ​‘On Board’ train­ing, it does not spe­cific­ally cov­er risk man­age­ment or fin­an­cial reporting.

We noted that all Board Mem­bers were invited to a risk man­age­ment train­ing ses­sion at the begin­ning of 2020, how­ever we were informed that it was pre­dom­in­antly mem­bers of the Audit and Risk Com­mit­tee who attended.

A skills mat­rix has been recently developed to cap­ture board mem­ber skill­sets and identi­fy devel­op­ment needs. Man­age­ment advised us that this mat­rix will be used to ensure that risk man­age­ment train­ing is com­pleted where it is iden­ti­fied as a train­ing need.

Fur­ther, to date, there has been no spe­cif­ic board devel­op­ment provided in rela­tion to fin­an­cial report­ing. How­ever, we noted in the minutes of the most recent Fin­ance and Deliv­ery Com­mit­tee that a pro­posed pro­gramme has been developed for fin­ance train­ing cov­er­ing gov­ernance, Scot­tish Gov­ern­ment fund­ing, Account­able Body role in sig­ni­fic­ant pro­jects, budget­ing, expendit­ure and con­trols and procurement.

Risk

There is a risk that Board mem­bers may not have adequate skills and know­ledge on risk man­age­ment and fin­an­cial report­ing to provide effect­ive scru­tiny and chal­lenge and to set the board’s risk appetite

Recom­mend­a­tions

Man­age­ment should ensure that all Board mem­bers have received risk man­age­ment training.

We sup­port the pro­posed fin­ance train­ing pro­gramme by the Fin­ance and Deliv­ery Com­mit­tee and recom­mend that all board mem­bers attend this training.

Man­age­ment Action

Grade 2 (Design)

Recom­mend­a­tion agreed. We note with regard to train­ing that mem­bers often are involved with a range of pub­lic bod­ies and may have received appro­pri­ate train­ing through those routes. We will com­bine our skills mat­rix work with annu­al feed­back from our mem­bers on the need for bespoke train­ing on our spe­cif­ic approaches to risk man­age­ment and fin­an­cial management.

Action own­er: Dir­ect­or of Cor­por­ate Ser­vices Due date: 30 Septem­ber 2021

Page 14

4.3 Deep dives on key stra­tegic risks

The Chair of the Audit and Risk Com­mit­tee expressed a con­cern that the schedul­ing of the Com­mit­tee meet­ings may be impact­ing on the abil­ity of the mem­bers to under­take a thor­ough and detailed dis­cus­sion of the agenda items. The Audit and Risk Com­mit­tee is cur­rently sched­uled to take place quarterly, imme­di­ately before the full board meet­ing, there­fore there is a lim­ited abil­ity for in depth dis­cus­sion on items which may cause the meet­ing to over­run. How­ever, it is noted the mem­bers have the abil­ity to call addi­tion­al meet­ings at any time should items not be covered.

We did note from our review of the Audit and Risk Com­mit­tee minutes and evid­ence provided that stra­tegic risks are being dis­cussed by the Com­mit­tee and man­age­ment have provided deep dives into spe­cif­ic risks or pro­jects, how­ever com­mit­tee mem­bers advised us that there is an appet­ite to do more deep dives and that the meet­ing schedul­ing res­ults in them not under­tak­ing as many deep dives of key stra­tegic risks as they would like.

Risk

There is a risk that the Board does not have full vis­ib­il­ity of the man­age­ment of cor­por­ate risks, ham­per­ing the abil­ity to achieve the organisation’s stra­tegic objectives

Recom­mend­a­tion

Man­age­ment should:

• Review the schedul­ing of the Audit and Risk Com­mit­tee to ensure the meet­ings are of suf­fi­cient length to allow a detailed discussion.
• Under­take a dis­cus­sion with Audit and Risk Com­mit­tee mem­bers on what addi­tion­al inform­a­tion is required on stra­tegic risks. We recom­mend this dis­cus­sion also con­siders the staff resources required to provide any addi­tion­al assur­ance requested.
• Ensure mem­bers are reminded of the import­ance of reg­u­larly con­sid­er­ing wheth­er they have had suf­fi­cient time to con­sider each agenda item, agree key issues for report­ing up to the board and the abil­ity to call addi­tion­al meet­ings if required.

Man­age­ment Action

Advis­ory

While not­ing the advis­ory status of this recom­mend­a­tion, we believe this provides a very help­ful frame­work on which to review the run­ning of the Audit and Risk Com­mit­tee, the object­ives of the Com­mit­tee for each year and also the capa­city of the staff group to sup­port those object­ives in light of oth­er pri­or­it­ies. Sug­gest this dis­cus­sion is under­taken at the same time as the Annu­al Intern­al Audit Plan dis­cus­sion to estab­lish a hol­ist­ic plan for the Com­mit­tees work over the year.

Page 15

Con­trol Object­ive 5: The board com­pletes a robust annu­al eval­u­ation of its own per­form­ance and that of its com­mit­tees, incor­por­at­ing feed­back from key stakeholders.

Yel­low

5.1 Apprais­al and self-assessment

The Scot­tish Gov­ern­ment ​‘On Board’ guid­ance states that it is the respons­ib­il­ity of the Board Chair/​Convener to ensure that the work of the Board and any com­mit­tees is sub­ject to reg­u­lar self-assess­ment to be assured that the Board is oper­at­ing stra­tegic­ally and effectively.

We were advised by Board mem­bers that there have been no annu­al reviews of com­mit­tee effect­ive­ness or board mem­ber apprais­als car­ried out to date. At the time of the audit field­work new pro­cesses for self-assess­ment and apprais­als had just been imple­men­ted and board mem­ber apprais­als were being under­taken. A ques­tion­naire for board self-assess­ment has been developed and a tem­plate doc­u­ment has been drawn up to sup­port board devel­op­ment discussions.

Con­sid­er­a­tion has not yet been giv­en to how the out­comes of self-assess­ment will be examined and how improve­ment action plans will be form­ally monitored.

Risk

The Board does not carry out self-eval­u­ation res­ult­ing in poor per­form­ance and devel­op­ment needs not being addressed.

Recom­mend­a­tions

Board mem­ber apprais­als and com­mit­tee effect­ive­ness reviews should be sched­uled to take place annually.

The out­comes of board self-assess­ment should be repor­ted to the Audit and Risk Com­mit­tee and improve­ment actions should be cap­tured and reg­u­larly monitored.

Man­age­ment Action

Grade 2 (Design)

Recom­mend­a­tion agreed. At time of response the Board ques­tion­naire has been com­pleted as has ini­tial ana­lys­is of res­ults. Board dis­cus­sions are also near com­ple­tion. Man­age­ment will work with the Board Con­vener, Board Deputy Con­vener and Chair of Audit and Risk Com­mit­tee along with oth­er mem­bers in design­ing a timetable for con­sid­er­a­tion of this and oth­er linked aspects of gov­ernance review

Action own­er: Dir­ect­or of Cor­por­ate Ser­vices Due date: 30 June 2021

Page 16

Appendix A – Definitions

Con­trol assessments

• R: Fun­da­ment­al absence or fail­ure of key controls.
• A: Con­trol object­ive not achieved — con­trols are inad­equate or ineffective.
• Y: Con­trol object­ive achieved — no major weak­nesses but scope for improvement.
• G: Con­trol object­ive achieved — con­trols are adequate, effect­ive and efficient.

Man­age­ment action grades

• 4: Very high risk expos­ure — major con­cerns requir­ing imme­di­ate seni­or atten­tion that cre­ate fun­da­ment­al risks with­in the organisation.
• 3: High risk expos­ure — absence / fail­ure of key con­trols that cre­ate sig­ni­fic­ant risks with­in the organisation.
• 2: Mod­er­ate risk expos­ure — con­trols are not work­ing effect­ively and effi­ciently and may cre­ate mod­er­ate risks with­in the organisation.
• 1: Lim­ited risk expos­ure — con­trols are work­ing effect­ively, but could be strengthened to pre­vent the cre­ation of minor risks or address gen­er­al house-keep­ing issues.

Page 17

© Azets 2021. All rights reserved. Azets refers to Azets Audit Ser­vices Lim­ited. Registered in Eng­land & Wales Registered No. 09652677. VAT Regis­tra­tion No. 219 0608 22.

Registered to carry on audit work in the UK and reg­u­lated for a range of invest­ment busi­ness activ­it­ies by the Insti­tute of Chartered Account­ants in Eng­land and Wales.