CAIRNGORMS NATION­AL PARK AUTHORITY

Form­al Board Paper 4 Annex I 28 May 2021

AUDIT & RISK COM­MIT­TEE ANNU­AL REPORT

Back­ground

1. The Audit & Risk Com­mit­tee is required to report to the full Board on its activ­it­ies over the year, and on the reports presen­ted to the Com­mit­tee by the Authority’s intern­al and extern­al auditors.

2. This Annu­al Report is presen­ted on behalf of the Audit & Risk Com­mit­tee to cov­er the peri­od of its oper­a­tions from Octo­ber 2019 to March 2021. The exten­ded peri­od of this report reflects delays in devel­op­ment of the report as a con­sequence of pri­or­it­isa­tion of oth­er areas of work dur­ing the Authority’s imple­ment­a­tion of its COVID19 Busi­ness Con­tinu­ity Plan and devel­op­ment of intern­al and extern­al responses to the impacts of the pandemic.

Over­view

1. The peri­od of this Annu­al Report cov­ers con­sid­er­a­tion of final accounts for ²⁰¹⁹⁄₂₀ (at the Committee’s meet­ing of August 2020), togeth­er with asso­ci­ated reports from Grant Thornton, the Authority’s extern­al auditors.

2. The Com­mit­tee has also con­tin­ued to have over­sight of the work of the Authority’s intern­al aud­it­ors and con­sider reports issued by them.

3. The peri­od of this report cov­ers the com­ple­tion of deliv­ery of intern­al audit ser­vices by BDO, and com­mence­ment of a new intern­al audit ser­vice by Scott-Mon­crieff which sub­sequently renamed to Azets. Both intern­al audit con­tracts were pro­cured jointly under a con­tract let jointly by NatureScot in con­junc­tion with the Cairngorms and a num­ber of oth­er pub­lic bodies.

4. The Com­mit­tee met sev­en times over the peri­od covered by this report.

Key Activ­it­ies

1. In addi­tion to man­age­ment reports from the Authority’s Intern­al and Extern­al Aud­it­ors, con­sidered in fur­ther detail below, the Com­mit­tee con­sidered the fol­low­ing issues dur­ing the course of the year:
   • a) Risk man­age­ment: the Audit & Risk Com­mit­tee has con­tin­ued to take a stra­tegic over­sight of the Authority’s risk man­age­ment strategy and reg­u­larly con­sidered the stra­tegic risk register. The Com­mit­tee has con­sidered the appro­pri­ate­ness of cov­er­age of the stra­tegic risk register sup­port­ing deliv­ery of the Cor­por­ate Plan for ²⁰¹⁸⁄₂₀₂₂ through­out the year, and scru­tin­ised adequacy of mit­ig­a­tion action, in peri­ods between full Board con­sid­er­a­tions of risk management.
   • b) Busi­ness Con­tinu­ity Plan (BCP) Deploy­ment, Adapt­a­tion and Risk Man­age­ment: the Com­mit­tee has taken over­sight through­out ²⁰²⁰⁄₂₁ of man­age­ments deploy­ment of the Authority’s BCP and has under­taken reg­u­lar reviews of the BCP Risk Register to ensure appro­pri­ate mit­ig­a­tion of risks in BCP deploy­ment had been designed and imple­men­ted, and that pos­it­ive effects of risk man­age­ment have been real­ised as intended.
   • c) Detailed Risk Ana­lys­is: the Com­mit­tee has con­tin­ued the prac­tice in the year of con­sid­er­ing more in depth ana­lys­is of key risks from seni­or man­age­ment. This prac­tice has been adop­ted at the sug­ges­tion on the intern­al aud­it­ors from their exper­i­ence with oth­er cli­ents, and provides an oppor­tun­it­ies to explore key or increas­ing stra­tegic risks in more detail and eval­u­ate the adequacy of mit­ig­a­tion actions. The Com­mit­tee has con­sidered a detailed ana­lys­is of the risks asso­ci­ated with the Authority’s busi­ness con­tinu­ity arrange­ments on a num­ber of occa­sions dur­ing the BCP imple­ment­a­tion peri­od. The Com­mit­tee has also con­sidered a detailed ana­lys­is of our repu­ta­tion­al risks, refin­ing the stra­tegic risk register as a con­sequence this deep dive risk ana­lys­is; and has under­taken a detailed review of the risks asso­ci­ated with the Her­it­age Hori­zons pro­gramme should that bid prove to be successful.
   • d) LEAD­ER: the Author­ity, as lead body for the man­age­ment and admin­is­tra­tion of EU LEAD­ER fund­ing with­in Cairngorms, has a respons­ib­il­ity to arrange for appro­pri­ate intern­al audit of its LEAD­ER activ­it­ies under the terms of the ser­vice level agree­ment with the Scot­tish Gov­ern­ment. The Com­mit­tee has con­sidered intern­al audit reports on the LEAD­ER pro­gramme. The Com­mit­tee can provide assur­ance on the effect­ive admin­is­tra­tion of the LEAD­ER grants from these intern­al audit reports, and of the man­age­ment of the Authority’s poten­tial fin­an­cial liab­il­it­ies arising from our Account­able Body role from scru­tiny of report­ing on stra­tegic risk management.
   • e) Account­ing Policy: the Com­mit­tee reviews and agrees account­ing policies as part of its con­sid­er­a­tion of final accounts pri­or to their sig­na­ture by the Account­able Officer. There were no sig­ni­fic­ant vari­ations to account­ing policy required in the year.
   • f) Gov­ernance State­ment: review and approv­al of this state­ment, pri­or to its inclu­sion in the annu­al accounts and pri­or to sig­na­ture by the Account­able Officer.
   • g) Gov­ernance con­sid­er­a­tions: with­in the Committee’s respons­ib­il­it­ies for Gov­ernance, we have begun con­sid­er­a­tion of actions around gov­ernance changes toward the end of this report­ing peri­od. In addi­tion to the con­sid­er­a­tion of hand­ling com­plaints made which refer to gov­ernance issues referred to else­where, the Com­mit­tee has begun con­sid­er­a­tion of the Scot­tish Gov­ern­ment Frame­work Agree­ment and on actions fol­low­ing up recom­mend­a­tions made in the intern­al audit of the Authority’s gov­ernance arrangements.
   • h) Updates on pro­gress in imple­ment­ing pre­vi­ous audit recom­mend­a­tions: the intern­al aud­it­ors have under­taken a form­al fol­low-up review of action taken on pre­vi­ous audit recom­mend­a­tions and repor­ted pro­gress on this to Com­mit­tee at its meet­ing on 12 March 2021. This most recent report high­lighted a num­ber of out­stand­ing actions and recom­mend­a­tions in pro­gress or not yet imple­men­ted. How­ever, the intern­al aud­it­ors and Com­mit­tee noted their sat­is­fac­tion on the atten­tion giv­en to audit recom­mend­a­tions and pro­gress made par­tic­u­larly in the con­text of resource pres­sures cre­ated by COV­ID responses since March 2020.
   • i) Con­sid­er­a­tion and agree­ment of for­ward audit activ­ity plans: the Com­mit­tee, has agreed a for­ward plan of intern­al audit activ­ity and has mon­itored pro­gress in deliv­ery of the intern­al audit plan for ²⁰²⁰⁄₂₁ with a plan for ²⁰²¹⁄₂₂ togeth­er with for­ward intern­al audit plans and ana­lys­is of the audit uni­verse agreed at the meet­ing of 12 March 2021.
   • j) Best Value: the Com­mit­tee has agreed a set out cri­ter­ia developed by man­age­ment to sup­port apprais­al of any private fin­ance invest­ments offered to sup­port work in the Cairngorms Nation­al Park.
   • k) Best Value and Com­plaints Hand­ling: the Com­mit­tee has also under­taken a reg­u­lar over­view of the Authority’s com­plaints hand­ling to ensure improved ser­vice pro­vi­sion in this area fol­low­ing on from an intern­al audit review high­light­ing some areas of improve­ment in prac­tice was required. The Committee’s over­sight of com­plaints hand­ling and gov­ernance also covered tak­ing respons­ib­il­ity for over­sight of hand­ling of a num­ber of com­plaints against a Board mem­ber over the peri­od, togeth­er with approv­ing a les­sons learned review of that pro­cess and for­ward action in amend­ments to the Authority’s com­plaints pro­ced­ure. This high­lights that once again the Com­mit­tee has sought to ensure that the work of the Com­mit­tee on intern­al con­trols is fully integ­rated with the Authority’s wider com­mit­ment to Best Value and con­tinu­ous improve­ment in ser­vice provision.
   • l) Let­ter of rep­res­ent­a­tion: the Com­mit­tee con­sidered the draft let­ter of rep­res­ent­a­tion from the Author­ity to Grant Thornton, the extern­al aud­it­or, pri­or to its sig­na­ture by the Account­able Officer as an appro­pri­ate reflec­tion of the Authority’s pos­i­tion for pre­par­a­tion of the accounts for ²⁰¹⁹⁄₂₀ and con­duct of the Authority’s fin­an­cial and wider con­trol pro­ced­ures over the course of the year.
   • m) Free­dom of Inform­a­tion (Scot­land) Act (FOISA) and Data Sub­ject Access Requests (DSAR): the Com­mit­tee has provided over­sight of the Authority’s man­age­ment and hand­ling of inform­a­tion requests made under FOISA and DSAR reg­u­la­tions, includ­ing the out­come of a small num­ber of refer­rals made by applic­ant to the Scot­tish Inform­a­tion Com­mis­sion­er. With both an assur­ance and Best Value focus, the Committee’s over­sight of these mat­ters has provided con­firm­a­tion on behalf of the Board of the adequacy and effic­acy of arrange­ments imple­men­ted by man­age­ment to handle inform­a­tion requests and con­tinu­ally learn from exper­i­ence and out­comes of processes.

Intern­al Audit

1. The Com­mit­tee agree an annu­al intern­al audit work pro­gramme presen­ted by the intern­al auditor.

2. Table One presents a sum­mary of the num­ber and degree of sig­ni­fic­ance of intern­al audit find­ings over the peri­od of this report and com­pares this with his­tor­ic levels. The defin­i­tions used for sig­ni­fic­ance of intern­al audit recom­mend­a­tions have changed slightly with the change in intern­al audit pro­vider from BDO to Azets. These defin­i­tions are giv­en after the table. The areas audited are also clas­si­fied in terms of over­all effect­ive­ness of the intern­al audit con­trol sys­tems reviews and these clas­si­fic­a­tions are also explained below the table.

Table One: Sum­mary of Intern­al Audit Findings

Intern­al Audit Study	Num­ber of Recommendations
	Crit­ic­al High Mod­er­ate Low
2011⁄12 Total (7 studies)	0 3 4 9
2012⁄13 Total (4 studies)	0 0 0 10
2013⁄14 Total (7 studies)	0 1 9 11
2014⁄15 Total (4 studies)	0 0 5 13
2015⁄16 Total (9 studies)	0 0 9 10
2016⁄17 Total (8 studies)	n/​a 0 1 11
2017⁄18 Total (3 studies)	n/​a 0 3 7
2018⁄19 Total (9 studies)	n/​a 1 6 10
2019⁄21 Total (9 studies)	0 5 16 21

	High Medi­um Low
The 2019⁄21 stud­ies were:
By BDO
Payroll Admin­is­tra­tion (Dec 19)	0 2 4
Expense Claim Pro­cesses (Dec 19)	0 2 5
Staff Object­ive Set­ting and Apprais­al (Mar 20)	0 1 3
Free­dom of Inform­a­tion (Mar 20)	0 1 5
Pro­ject Fin­an­cing (Mar 20)	0 2 3

	Very High	High	Mod­er­ate	Lim­ited
By Azets
LEAD­ER Admin­is­tra­tion (Sep 20)	0	0	0	0
Cor­por­ate Gov­ernance (Feb 21)	0	2	4	0
COVID19 BCP Recov­ery (Feb 21)	0	0	2	1
Data Man­age­ment (Mar 21)	0	3	2	0

Total for period	0	5	16	21

Key — BDO defin­i­tion of sig­ni­fic­ance of audit recommendations:

• a) High: A weak­ness where there is sub­stan­tial risk of loss, fraud, impro­pri­ety, poor value for money, or fail­ure to achieve organ­isa­tion­al object­ives. Such risk could lead to an adverse impact on the busi­ness. Remedi­al action must be taken urgently.
• b) Mod­er­ate: A weak­ness in con­trol which, although not fun­da­ment­al, relates to short­com­ings which expose indi­vidu­al busi­ness sys­tems to a less imme­di­ate level of threat­en­ing risk or poor value for money. Such a risk could impact on oper­a­tion­al object­ives and should be of con­cern to seni­or man­age­ment and requires prompt spe­cif­ic action.
• c) Low: Areas that indi­vidu­ally have no sig­ni­fic­ant impact, but where man­age­ment would bene­fit from improved con­trols and/​or have the oppor­tun­ity to achieve great­er effect­ive­ness and/​or effi­ciency. Azets defin­i­tion of grades for man­age­ment action recommendations:
• d) Very High Risk Expos­ure: major con­cerns requir­ing imme­di­ate seni­or atten­tion that cre­ate fun­da­ment­al risks with­in the organisation
• e) High Risk Expos­ure: absence / fail­ure of key con­trols that cre­ate sig­ni­fic­ant risks with­in the organisation
• f) Mod­er­ate Risk Expos­ure: con­trols are not work­ing effect­ively and effi­ciently and may cre­ate mod­er­ate risks with­in the organisation
• g) Lim­ited Risk Expos­ure: con­trols are work­ing effect­ively, but could be strengthened to pre­vent the cre­ation of minor risks or address gen­er­al house-keep­ing issues.

1. The Com­mit­tee wel­comes the fact that once again there have been highest grade recom­mend­a­tions raised by intern­al audit over the course of the peri­od covered by this report on either of the risk cat­egor­isa­tions used. The Com­mit­tee has noted a num­ber of high risk expos­ure recom­mend­a­tions in the more recent reports and is aware that these reflect areas where either there is already some intern­al aware­ness of improve­ment require­ments and work in under­way to address mat­ters, or our intern­al risk man­age­ment has detec­ted the devel­op­ment of mat­ters requir­ing res­ol­u­tion with delay in action caused by COV­ID disruptions.

2. In line with the Authority’s val­ues of trans­par­ency, the Com­mit­tee is made aware of all recom­mend­a­tions made by the intern­al aud­it­ors, through con­sid­er­a­tion of full man­age­ment reports fol­low­ing each audit review.

3. The Com­mit­tee has agreed man­age­ment responses to all recom­mend­a­tions made and con­tin­ues to mon­it­or pro­gress made. The intern­al aud­it­ors have also con­duc­ted fol­low-up reports and report back to the Com­mit­tee on their findings.

4. The Com­mit­tee has con­sidered the Intern­al Aud­it­ors’ Annu­al Report for ²⁰²⁰⁄₂₁. The intern­al auditor’s annu­al report for the year gives the fol­low­ing over­all opin­ion: ​“In our opin­ion CNPA has a frame­work of con­trols in place that provides reas­on­able assur­ance regard­ing the organisation’s gov­ernance frame­work, intern­al con­trols, effect­ive and effi­cient achieve­ment of object­ives and the man­age­ment of key risks, sub­ject to the imple­ment­a­tion of spe­cif­ic high risk actions raised in rela­tion to cor­por­ate gov­ernance pro­cesses and data man­age­ment con­trol improve­ments through­out ²⁰²⁰⁄₂₁.”

Extern­al Audit

1. The Authority’s accounts for ²⁰¹⁹⁄₂₀ received a clear, unqual­i­fied extern­al auditor’s report and opin­ion from Grant Thornton, our extern­al auditors.

2. The accounts and extern­al auditor’s report for ²⁰¹⁹⁄₂₀ were con­sidered and approved by the Com­mit­tee at its meet­ing on 11 Septem­ber 2020. The accounts were signed by the Chief Exec­ut­ive as Account­able Officer on 21 Octo­ber 2020, and passed to Audit Scot­land for sig­na­ture and onward sub­mis­sion to Aud­it­or Gen­er­al and Scot­tish Parliament.

3. The Audit & Risk Com­mit­tee con­sidered Audit Scotland’s report to those charged with gov­ernance on the audit of the ²⁰¹⁹⁄₂₀ accounts at its meet­ing of II Septem­ber 2020. The report high­lighted only one action point, ref­er­en­cing the require­ment to revis­it longer term fin­an­cial plan­ning scen­ari­os in the con­text of COVID19 impacts and recov­ery actions from COVID19 impacts. This action was accep­ted by man­age­ment and the Com­mit­tee and was an action which man­age­ment were already pro­gress­ing and had been the sub­ject of spe­cif­ic reports to the Board in terms of the Green Recov­ery Plan and asso­ci­ated budget discussions.

4. The extern­al audit report noted that com­plete draft fin­an­cial state­ments, includ­ing the Per­form­ance Report, Account­ab­il­ity Report and Gov­ernance State­ment with­in the agreed timescales.

Stra­tegic Risk Management

1. The Authority’s stra­tegic risk register has now been revised dur­ing the year by the Com­mit­tee and full Board, ensur­ing it reflects the deliv­ery pri­or­it­ies and stra­tegic envir­on­ment of the Author­ity in its deliv­ery of our new Cor­por­ate Plan for 2018 to 2022. The Board has sight of the stra­tegic risk register and is able to com­ment on it twice each year, while con­sid­er­ing wider cor­por­ate per­form­ance reports. The Audit & Risk Com­mit­tee will con­tin­ue to review the cov­er­age and adequacy of the stra­tegic risk register in those quar­ters where it is not presen­ted to the full Board.

Con­clu­sions

1. The Audit & Risk Com­mit­tee con­siders that it has been suc­cess­ful in pro­gress­ing the Board’s gov­ernance and intern­al con­trol pri­or­it­ies dur­ing the peri­od covered by this annu­al report.

2. The Com­mit­tee wel­comes the work of the Authority’s fin­ance team in main­tain­ing a high qual­ity and pro­fes­sion­al fin­an­cial account­ing ser­vice with­in agreed audit times­cales des­pite the var­ied pres­sures of remote work­ing and oth­er BCP and COVID19 impacts. The Com­mit­tee also greatly appre­ci­ates the work of the intern­al and extern­al aud­it­ors in adapt­ing their work­ing prac­tices to deal with the impacts of COVID19 over the last year.

3. The Com­mit­tee has engaged through the year with issues iden­ti­fied by the Authority’s intern­al and extern­al aud­it­ors, and also by the Authority’s officers. The Com­mit­tee has received full reports on issues raised; con­sidered recom­mend­a­tions made; and approved responses and actions. The Com­mit­tee has shaped and approved the over­all audit plan and guided the dir­ec­tion and approach of the intern­al aud­it­ors and their pro­gramme of work. The Com­mit­tee has also mon­itored deliv­ery against approved action plans.

4. Both the intern­al and extern­al aud­it­ors’ find­ings provide assur­ance to the Com­mit­tee and Board that the Authority’s intern­al con­trol and gov­ernance object­ives are being met effect­ively by management.

5. It is also reas­sur­ing for Com­mit­tee mem­bers to see once again that audit recom­mend­a­tions have typ­ic­ally been of a low or mod­er­ate risk level. It is accep­ted that there will always be a range of improve­ments than can be made to ser­vices and con­trols; that these con­trols must con­tin­ue to adapt to chan­ging oper­at­ing and stra­tegic envir­on­ments; and as such a num­ber of recom­mend­a­tions for improve­ment from intern­al audit will always be expec­ted. The Com­mit­tee warmly wel­comes the evid­ence of gen­er­ally effect­ive con­trol sys­tems evid­enced by the reports and very low level of improve­ment recom­mend­a­tions arising from audits over the year.

6. The Com­mit­tee will con­tin­ue to address key, basic issues of intern­al con­trol and the devel­op­ment of appro­pri­ate pro­cesses with­in the Authority.

7. The Com­mit­tee will also seek to con­tin­ue to have over­sight of the Authority’s approach to and hand­ling of risk man­age­ment, and of wider aspects of cor­por­ate gov­ernance such as the approach to Best Value and value for money. In par­tic­u­lar, mem­bers will seek to ensure that les­sons are learned from oper­a­tion­al exper­i­ence and that wherever pos­sible reviews of work­ing prac­tices and learn­ing from them lead to improve­ments in our systems.

Dav­id Camer­on, for Audit & Risk Com­mit­tee mem­bers: Judith Webb (Chair) Gaen­er Rodger (Vice Chair) Peter Argyle Pippa Had­ley Janet Hunter John Latham

20 April 2021 davidcameron@​cairngorms.​co.​uk