Cairngorms Nation­al Park Authority

Intern­al Audit Report ²⁰²⁰⁄₂₁

COV­ID-19 Recovery

Decem­ber 2020

---

Con­tents:

• Exec­ut­ive Summary
• Man­age­ment Action Plan
• Appendix A – Definitions

Audit Spon­sor:

Dav­id Camer­on, Dir­ect­or of Cor­por­ate Services

Key Con­tacts:

• Vicky Walk­er, Office Ser­vices Manager
• Kate Christie, Head of Organ­isa­tion­al Development
• Fran­coise van Buuren, Head of Com­mu­nic­a­tions and Engagement

Audit Team:

• Chris Brown, Partner
• Stephanie Hume, Audit Manager
• Lor­na Mun­ro, Intern­al Auditor

---

Exec­ut­ive Summary

Con­clu­sion

We have con­firmed that the Cairngorms Nation­al Park Author­ity (CNPA) was able to adapt quickly and mobil­ise its staff before lock­down came into effect and has engaged with staff reg­u­larly to ensure both prac­tic­al issues related to remote work­ing and men­tal health are addressed.

How­ever, we iden­ti­fied that CNPA had only par­tially imple­men­ted its busi­ness con­tinu­ity plan­ning approach, with a num­ber of key steps still to be com­pleted, and whilst CNPA has respon­ded quickly to issues being raised, les­sons are not cur­rently being cap­tured in a single doc­u­ment to ensure all neces­sary actions are being taken.

Back­ground and Scope

All pub­lic sec­tor organ­isa­tions have been required to act decis­ively in response to COV­ID-19 to enable core oper­a­tions to con­tin­ue with min­im­al dis­rup­tion. This has included enact­ing busi­ness con­tinu­ity plans, increas­ing remote work­ing and use of tech­no­logy, revis­ing budgets and com­mu­nic­at­ing with stake­hold­ers. This review con­sidered the approach to the trans­ition and any les­sons learned, includ­ing in com­par­is­on to oth­er organisations.

Con­trol Assessment

• 1. Busi­ness Con­tinu­ity Plans: Were enacted at the out­set of COV­ID-19 with man­age­ment effect­ively trans­ition­ing staff to a remote work­ing envir­on­ment. (Yel­low)
• 2. Com­mu­nic­a­tion with Staff: Is being under­taken in a timely and effect­ive man­ner to ensure their ongo­ing well­being, and that key mes­sages are being shared timeously. (Green)
• 3. Les­sons Learned: Are iden­ti­fied and doc­u­mented with rel­ev­ant pro­cesses and work­ing arrange­ments updated accord­ingly. (Yel­low)

Improve­ment Actions by Type and Priority

(Dia­gram show­ing improve­ment actions by type and pri­or­ity – Grade 1, 2, 3 & 4)

Three improve­ment actions have been iden­ti­fied from this review, two of which relate to the oper­a­tion of the con­trols in place. See Appendix A for defin­i­tions of col­our coding.

Key Find­ings

Good Prac­tice

• CNPA were in a strong pos­i­tion to respond to the emer­ging pan­dem­ic as they had recently planned for remote work­ing as part of the BCP devel­op­ment process.
• A gov­ernance group was quickly ini­ti­ated at the begin­ning of the pan­dem­ic, com­pris­ing key staff from oper­a­tion­al sup­port func­tions such as HR and IT.
• Appro­pri­ate escal­a­tion routes are in place to ensure that issues were raised with the Man­age­ment Team in a timely manner.
• There has been respons­ive and flex­ible decision-mak­ing, with a focus on staff wellbeing.
• Man­age­ment have com­mu­nic­ated with staff on a fre­quent basis using a range of form­al and inform­al routes, lat­terly react­ing to feed­back from staff regard­ing over-com­mu­nic­a­tion by stream­lin­ing inform­a­tion through the ​‘all staff weekly’ Fri­day update and the Well­being Wed­nes­day email.

Areas for Improvement

We have iden­ti­fied some areas for improve­ment which, if addressed, would strengthen CNPA’s con­trol framework:

• Com­plet­ing the BCP cycle, to ensure that suf­fi­cient inform­a­tion is avail­able to man­age­ment and staff to enable a smooth­er trans­ition to and from ​‘emer­gency working’.
• Imple­ment­ing a cent­ral­ised and co-ordin­ated meth­od to cap­ture, record, risk assess and pri­or­it­ise les­sons learned.

These are fur­ther dis­cussed in the Man­age­ment Action Plan below.

Impact on Risk Register

The CNPA cor­por­ate risk register (Novem­ber 2020) included the fol­low­ing risks rel­ev­ant to this review:

• A22: Busi­ness Con­tinu­ity Plans are inad­equate to deal with sig­ni­fic­ant impacts to nor­mal work­ing arrange­ments and res­ult in ser­vice failure.

Acknow­ledge­ments

We would like to thank all staff con­sul­ted dur­ing this review for their assist­ance and co-operation.

---

Man­age­ment Action Plan

Con­trol Object­ive 1: Busi­ness Con­tinu­ity Plans were enacted at the out­set of COV­ID-19 with man­age­ment effect­ively trans­ition­ing staff to a remote work­ing envir­on­ment. (Yel­low)

1.1 BCP Cycle

The CNPA Busi­ness Con­tinu­ity Plan iden­ti­fies an eight-stage imple­ment­a­tion pro­cess; how­ever, at the com­mence­ment of the COV­ID-19 pan­dem­ic, CNPA was still work­ing through stages two to five with vari­ous key functions/​services, where focus was on identi­fy­ing min­im­um ser­vice deliv­ery, under­tak­ing risk assess­ments, identi­fy­ing con­tin­gen­cies, and refin­ing the draft Busi­ness Con­tinu­ity Plan. As such, the plan had not been fully tested with staff pri­or to the pandemic.

From dis­cus­sions with man­age­ment and review of evid­ence provided, we noted that hav­ing the BCP not fully in place pri­or to the pan­dem­ic is one of the main root causes of sev­er­al issues iden­ti­fied dur­ing fieldwork:

• Remote work­ing prac­tic­al­it­ies had not been suf­fi­ciently scoped and tested, includ­ing IT and communication.
• The BCP did not suf­fi­ciently address recov­ery plans and timelines.
• The under­stand­ing by staff under­tak­ing risk assess­ments was not wholly suf­fi­cient, as evid­enced by the appar­ent con­fu­sion between a recov­ery and con­tinu­ity plan, and pre­sump­tion that all ser­vices had deliv­ery plans in place and reli­ance could be placed on these. The under­pin­ning ser­vice plans were not fully developed and this impacted the effect­ive­ness of the planned response.
• The BCP does not include any links to or iden­ti­fic­a­tion of key policies, forms and tem­plates to be used. In addi­tion, the exist­ing policies reviewed did not include suf­fi­cient inform­a­tion to sup­port the enacted BCP, e.g. no min­im­um stand­ards of com­mu­nic­a­tion in the Work Life Bal­ance Policy.
• The terms of ref­er­ence for the steer­ing group did not provide suf­fi­cient detail or the word­ing was ambiguous:
  • The scope word­ing did not have suf­fi­cient detail to determ­ine which activ­it­ies would be under­taken by the group and which by oth­er ser­vices in the organisation.
  • It does not define the group’s role in provid­ing assur­ance to the Board, on the man­age­ment of the incid­ent and the steps to be taken towards full or par­tial busi­ness recovery.
  • There was no indic­a­tion of the fre­quency of meetings.
  • There was no indic­a­tion of who must be present to rat­i­fy any decisions/​actions.
  • Resources being provided by the group were not suf­fi­ciently detailed.

Risk: There is a risk the organ­isa­tion does not imple­ment BCP actions effect­ively as a res­ult of plans not being fully developed or tested, lead­ing to staff mem­bers hav­ing dif­fi­culty work­ing remotely and unex­pec­ted and/​or neg­at­ive impacts on busi­ness operations.

Recom­mend­a­tion: Man­age­ment should:

• Con­tin­ue to work through the BCP cycle.
• Ensure staff have a suf­fi­cient know­ledge of the BCP pro­cess and ter­min­o­logy to adequately com­plete the stages asso­ci­ated with risk assessments.
• Expand the BCP con­tent in rela­tion to the gov­ernance struc­ture and scope, in line with the points iden­ti­fied above.

Man­age­ment Action: Recom­mend­a­tion agreed. We will work through the BCP cycle and adapt doc­u­ment­a­tion to cov­er the points raised in this find­ing. (Grade 2 — Operation)

• Action own­er: Office Ser­vices Manager
• Due date: 31 July 2021

Con­trol Object­ive 2: Com­mu­nic­a­tion with staff is being under­taken in a timely and effect­ive man­ner to ensure their ongo­ing well­being, and that key mes­sages are being shared timeously. (Green)

2.1 Com­mu­nic­a­tions Strategy

As the CNPA Busi­ness Con­tinu­ity Plan was not suf­fi­ciently developed, the com­mu­nic­a­tions strategy evolved as the pan­dem­ic progressed:

• In the week pri­or to lock­down an all-staff meet­ing was held, with 70% of staff able to attend. An all-staff email was issued to ensure the remain­ing staff were advised on the actions tak­ing place.
• Ini­tially, there was no spe­cif­ic format or fre­quency of com­mu­nic­a­tions, with each Ser­vice and Line Man­ager com­mu­nic­at­ing as they thought appro­pri­ate. Fol­low­ing a staff sur­vey in May 2020, a more stream­lined approach to com­mu­nic­a­tions was taken with a single weekly e‑Bulletin issued to all staff. This covered a range of ser­vices includ­ing HR and cross-organ­isa­tion­al oper­a­tion­al related issues such as policies on leave, sick­ness and build­ing access. We note these are high­lighted at the start of each bulletin.
• Staff receive a Well­being Wed­nes­day email, which focuses on men­tal and per­son­al health aspects. The email dir­ects staff to sup­port across a range of top­ics includ­ing money man­age­ment, men­tal health and keep­ing in touch with col­leagues. The staff sur­vey indic­ated that these had been well received.
• The staff sur­vey also indic­ated that there were incon­sist­en­cies in the approach to keep­ing in touch with Line Man­agers. With no baseline stand­ard and remote work­ing being new for many, the need for train­ing was iden­ti­fied. An on-line ses­sion was organ­ised to sup­port man­agers in man­aging remotely.
• In addi­tion to the staff sur­vey there have been a range of meth­ods for staff to high­light issues with man­age­ment includ­ing vir­tu­al drop-in ses­sions, a staff sug­ges­tion scheme, Employ­ee Assist­ance Scheme and a Staff Con­sultat­ive For­um con­tinu­ing to operate.

As out­lined, we note that CNPA has been very respons­ive and have been quick to imple­ment decisions and new policies. How­ever, whilst the approach has been flex­ible, had the BCP cycle been com­pleted then these issues may not have aris­en or have been addressed more quickly (Linked to MAP 1.1).

Risk: There is a risk the organ­isa­tion does not imple­ment BCP actions effect­ively as a res­ult of plans not being fully developed or tested, lead­ing to staff mem­bers hav­ing dif­fi­culty work­ing remotely and unex­pec­ted and/​or neg­at­ive impacts on busi­ness operations.

Recom­mend­a­tion: An out­line com­mu­nic­a­tion strategy should be developed, which includes cent­ral­ised and non-cent­ral­ised chan­nels, as well as sup­port for staff who are unable to access systems.

Man­age­ment Action: Recom­mend­a­tion agreed. We will design and imple­ment a com­mu­nic­a­tions strategy and plan with­in the Busi­ness Con­tinu­ity Plan com­ple­tion pro­cess, draw­ing from extens­ive learn­ing over the last 9 months. (Grade 1 — Operation)

• Action own­er: Office Ser­vices Manager
• Due date: 31 July 2021

Con­trol Object­ive 3: Les­sons learned are iden­ti­fied and doc­u­mented with rel­ev­ant pro­cesses and work­ing arrange­ments updated accord­ingly. (Yel­low)

3.1 Les­sons Learned Meth­od­o­logy and Framework

From the evid­ence provided it was clear that les­sons learned are being reg­u­larly iden­ti­fied, addressed and imple­men­ted with­in the organ­isa­tion. How­ever, there is cur­rently no cent­ral­ised and coordin­ated meth­od to cap­ture these les­sons to ensure they are recor­ded, risk assessed, pri­or­it­ised, actioned, and com­mu­nic­ated. Fur­ther, we note that a lack of an action log will res­ult in man­age­ment being unable to review all changes made dur­ing the pan­dem­ic once over to ensure all policies and pro­ced­ures are updated accordingly.

In addi­tion, although the approach taken has been respons­ive and we iden­ti­fied one example where an issue was trans­ferred to the BCP risk register, we were unable to con­firm wheth­er there were any gaps, wheth­er resources were used effi­ciently and risks were being adequately addressed.

Risk: There is a risk that iden­ti­fied les­sons learned are not man­aged and doc­u­mented in an effect­ive man­ner, res­ult­ing in a lack of over­sight of all changes made at the end of the incid­ent, policies and pro­ced­ures not being updated and poten­tially issues being repeated in the future.

Recom­mend­a­tion: Man­age­ment should:

• Seek to doc­u­ment the les­sons learned to date and any future les­sons learned to inform the end of event de-briefing.
• Devel­op a les­sons learned action log tem­plate for inclu­sion in the final BCP.

Man­age­ment Action: Recom­mend­a­tion agreed. We will devel­op a les­sons learned action log for inclu­sion in the BCP and pop­u­late a les­sons learned log from an early review of the COV­ID BCP response peri­od. (Grade 2 — Design)

• Action own­er: Office Ser­vices Manager
• Due date: 31 March 2021

---

Appendix A – Definitions

Con­trol Assessments

• R: Fun­da­ment­al absence or fail­ure of key controls.
• A: Con­trol object­ive not achieved – con­trols are inad­equate or ineffective.
• Y: Con­trol object­ive achieved – no major weak­nesses but scope for improvement.
• G: Con­trol object­ive achieved – con­trols are adequate, effect­ive and efficient.

Man­age­ment Action Grades

• 4: Very high risk expos­ure – major con­cerns requir­ing imme­di­ate seni­or atten­tion that cre­ate fun­da­ment­al risks with­in the organisation.
• 3: High risk expos­ure – absence/​failure of key con­trols that cre­ate sig­ni­fic­ant risks with­in the organisation.
• 2: Mod­er­ate risk expos­ure – con­trols are not work­ing effect­ively and effi­ciently and may cre­ate mod­er­ate risks with­in the organisation.
• 1: Lim­ited risk expos­ure – con­trols are work­ing effect­ively, but could be strengthened to pre­vent the cre­ation of minor risks or address gen­er­al house-keep­ing issues.

---

© Azets 2021. All rights reserved. Azets refers to Azets Audit Ser­vices Lim­ited. Registered in Eng­land & Wales Registered No. 09652677. VAT Regis­tra­tion No. 219 0608 22. Registered to carry on audit work in the UK and reg­u­lated for a range of invest­ment busi­ness activ­it­ies by the Insti­tute of Chartered Account­ants in Eng­land and Wales.