DRAFT MINUTES OF THE AUDIT AND RISK COM­MIT­TEE MEET­ING of THE CAIRNGORMS NATION­AL PARK AUTHORITY

held via Lifes­ize Video Con­fer­en­cing on 10^th Septem­ber 2021 at 2pm

PRESENT

• Judith Webb (Chair)
• John Kirk
• John Lath­am
• Elean­or Mackintosh
• Fiona McLean
• Gaen­er Rodger

In Attend­ance:

• Dav­id Camer­on, Dir­ect­or of Cor­por­ate Services
• Grant Moir, CEO
• Vicky Walk­er, Gov­ernance and Report­ing Manager
• John Boyd, Grant Thornton
• Chris Brown, Azets

Apo­lo­gies:

• Danie Ral­ph, Fin­ance Manager,
• Kate Christie, Head of Organ­isa­tion­al Development

Wel­come and Apologies

1. The Chair wel­comed every­one to the meeting.

Minutes of Last Meet­ing – Approval

1. The draft Minutes of the meet­ings on 13 August 2021 were approved with no amendments.

Action points arising from pre­vi­ous meeting:

a) At Para 3b) In Hand — Risk Appet­ite has been raised at Gov­ernance group but await­ing date for fur­ther dis­cus­sion at full board.

b) At Para 11i) In Hand — Dir­ect­or of Cor­por­ate Ser­vices to review incor­por­a­tion of gen­er­ic terms of ref­er­ence for each com­mit­tee in each indi­vidu­al committees

c) At Para Ilii) In Hand — Dir­ect­or of Cor­por­ate Ser­vices com­mit­ted to review quor­um, mem­ber­ship and fre­quency of meet­ings as part of the annu­al Audit and Risk Com­mit­tee review.

d) At Para 18i) In Hand — Dir­ect­or of Cor­por­ate Ser­vices to provide Com­mit­tee with an over­sight of work for the com­mit­tee over the next 12 months and to include a timetable of indic­at­ive intern­al audit reports. Mem­bers to have oppor­tun­ity to input into the intern­al audit plan. Con­firmed will come to next sched­uled meet­ing in October.

Declar­a­tion of Interests

1. There were no interests declared.

Intern­al Audit ²⁰²¹⁄₂₂ Pro­gress Report (Paper 1)

1. Chris Brown, Azets intro­duced the report which presents a sum­mary of intern­al audit activ­ity since its last meet­ing and con­firms the reviews planned for the com­ing quarter. He high­lighted the fol­low­ing areas:

a) Field­work on one audit has been com­pleted since the last Audit and Risk Com­mit­tee meet­ing on Lead­er admin­is­tra­tion and this will come to the Octo­ber Committee.

b) Field­work on fol­low up part one has com­menced and is on track.

c) The deliv­ery of the Intern­al Audit plan remains on track.

1. The Audit and Risk Com­mit­tee dis­cussed the paper and made the fol­low­ing comment:

a) The Com­mit­tee cla­ri­fied that fol­low up part one related to val­id­a­tion that agreed audit actions have been under taken and takes place twice a year.

1. The Audit and Risk Committee:

a) Con­sidered the intern­al audit 2021 – 22 Pro­gress Report.

1. Action Point Arising:

i. None

²⁰²⁰⁄₂₁ Final Accounts (Paper 2)

1. Dav­id Camer­on, Dir­ect­or of Cor­por­ate Ser­vices intro­duced the paper which presents and seeks approv­al to the final accounts for 2020 – 21 pri­or to their being sub­mit­ted to Audit Scot­land for final cer­ti­fic­a­tion. He high­lighted the fol­low­ing points:

a) Fin­an­cial mon­it­or­ing has taken place through­out the year through Fin­ance and Deliv­ery Com­mit­tee with a tar­get to achieve a break-even pos­i­tion. Deliv­ery of the budget was agreed by the board in March 2020.

b) The attached report out­lines the fin­an­cial per­form­ance nar­rat­ive and high­lights break-even pos­i­tion has been achieved. The deliv­ery of grant and aid res­ul­ted in £21,000 under­spend rep­res­ent­ing 0.4% of the total budget. Cap­it­al fund­ing has an under­spend of £44,000 rep­res­ent­ing 9% of cap­it­al alloc­a­tion. The delay in con­firm­a­tion of the peat­land grant and sub­sequent delays due to COV­ID and weath­er has impacted on this pos­i­tion. Over­all per­form­ance is with­in agreed envel­ope of 2 per­cent vari­ance against total income £7.750 million.

c) Grant Moir, Chief Exec­ut­ive reit­er­ated unique chal­lenges through­out the year and com­men­ted the under­spend positon was cred­it to hard work of all staff deliv­er­ing cor­por­ate plan.

d) Dir­ect­or of Cor­por­ate Ser­vices con­firmed there was noth­ing from man­age­ment accounts that needed the Committee’s atten­tion. Dur­ing the sum­mer the major­ity of pay­ments for debt­or bal­ances have been made.

1. The Audit and Risk Com­mit­tee dis­cussed the paper and made the fol­low­ing com­ments and observations:

a) Recog­nised the efforts of the staff team in ensur­ing good annu­al report and out­turn of the year end position.

b) Con­firmed that Fin­ance and Deliv­ery Com­mit­tee are con­tent with out­come and had a good dis­cus­sion through­out the year. Reit­er­ated that pos­i­tion is reflect­ive of hard work from staff espe­cially giv­en com­plex­ity of some pro­jects. Well done to the team from Fin­ance and Deliv­ery Com­mit­tee. The final pos­i­tion of 0.4% under­spend is an incred­ible achievement.

c) Plan­ning Con­vener resigned but remains Board Mem­ber request this is cla­ri­fied in the report.

1. The Audit and Risk Com­mit­tee approved the final accounts pri­or to sub­mis­sion to Grant Thornton and Audit Scot­land for final certification.

2. Action Point Arising:

i. Cla­ri­fy that former Plan­ning Con­vener and Deputy Con­vener remain Board Mem­bers on page 2.

Final Accounts Let­ter of Rep­res­ent­a­tion (Paper 3)

1. Dav­id Camer­on, Dir­ect­or of Cor­por­ate Ser­vices intro­duced the paper which presen­ted the Let­ter of Rep­res­ent­a­tion which accom­pan­ies the audit of the fin­an­cial state­ments of Cairngorms Nation­al Park Author­ity for the year ended 31 March 2021. ARC mem­bers oppor­tun­ity to ask ques­tions and see the require­ments of Chief Exec­ut­ive as account­able officer.

2. From a Man­age­ment per­spect­ive both Dir­ect­or of Cor­por­ate Ser­vices and Chief Exec­ut­ive were happy with the contents.

3. The Audit & Risk Com­mit­tee agreed the Final Accounts Let­ter of Representation.

4. Action Point Arising:

i. None

Extern­al Audit Report (Paper 4)

1. John Boyd, Grant Thornton intro­duced the paper which presents the Extern­al Audit Report. He made the fol­low­ing points:

a) The focus of the report is on fin­an­cial sus­tain­ab­il­ity and to high­light any mis­state­ments iden­ti­fied dur­ing the audit. The audit was con­duc­ted remotely due to Cov­id restrictions.

b) He passed thanks to both Dav­id Camer­on, Dir­ect­or of Cor­por­ate Ser­vices and Danie Ral­ph, Fin­ance Man­ager for sup­port dur­ing the audit.

c) He con­firmed there were no areas of con­cern in rela­tion to mater­i­al mis­state­ment through fraud or error or in any man­age­ment over­ride of con­trols. Gov­ernance arrange­ments focussed on Cov­id 19 arrange­ments and these were not cause for concern.

d) The Audit recom­mend­a­tions were in recog­ni­tion of the sig­ni­fic­ant value of the Her­it­age Hori­zons grant and level of fin­ance admin­is­tra­tion and over­sight required to admin­is­ter these funds.

e) Over­all fin­an­cial state­ments are of a good standard.

1. The Dir­ect­or of Cor­por­ate Ser­vices con­firmed the action point was val­id and gave assur­ance that Chief Exec­ut­ive and Dir­ect­or of Cor­por­ate Ser­vices were look­ing at the deliv­ery of Her­it­age Hori­zons and the require­ment for cor­por­ate sup­port and cor­por­ate resources. Addi­tion­al sup­port to the fin­ance team has been identified.

2. The Dir­ect­or of Cor­por­ate Ser­vices thanked the extern­al audit team for sup­port dur­ing the audit and pro­du­cing the report for the com­mit­tee today.

3. The Audit and Risk Com­mit­tee dis­cussed the paper and made the fol­low­ing com­ments and observations:

a) There were les­sons learned from the Tomin­toul and Glen­liv­et Land­scape Part­ner­ship (TGLP) pro­gramme and the dif­fer­ence in account­ing meth­ods and dif­fi­culty for the pro­ject board mon­it­or­ing fin­ances. The Dir­ect­or Cor­por­ate Ser­vices con­firmed les­sons had been taken into account and the approach of main­stream­ing Her­it­age Hori­zons with­in the Nation­al Park Author­ity rather than cre­at­ing a sep­ar­ate pro­ject struc­ture addresses some of these points.

b) The Com­mit­tee were pleased to hear pro­gres­sion with­in the staff team.

c) The Com­mit­tee com­men­ted that it was great to see clean bill of health and pleased to see report.

1. The Audit & Risk Committee:

a) Con­sidered the extern­al auditor’s annu­al report on the ²⁰²⁰⁄₂₁ audit;

b) Reviewed an endorsed the man­age­ment responses to actions raised in the report.

1. Action Point Arising:

i. None

Stra­tegic Risk Man­age­ment and Man­aging Her­it­age Hori­zons Risks (Paper 5)

1. Dav­id Camer­on, Dir­ect­or of Cor­por­ate Ser­vices intro­duced the paper which sup­ports the Audit and Risk Committee’s review of the stra­tegic risk man­age­ment pos­i­tion of the Author­ity. He explained the paper con­tin­ues to review the hand­ling of risks around the Her­it­age Hori­zons pro­gramme, fol­low­ing on from the Board meet­ing in Feb­ru­ary 2021 and from the announce­ment by Nation­al Lot­tery Her­it­age Fund of the alloc­a­tion of funds to this pro­gramme in July 2021.

2. Dir­ect­or of Cor­por­ate Ser­vices reit­er­ated the les­sons learned from TGLP in rela­tion to suc­ces­sion plan­ning and loss of key staff hence main­stream­ing the pro­gramme into the Park Author­ity. The team were still await­ing start date and he advised that once star­ted addi­tion­al risks may be reflec­ted in the risk man­age­ment structure.

3. The Audit and Risk Com­mit­tee dis­cussed the paper and made the fol­low­ing com­ments and observations:

a) The Com­mit­tee quer­ied wheth­er it was pos­sible to group risks togeth­er and stream­line the Risk Register. It would be help­ful to review the present­a­tion of the risk register to sup­port dis­cus­sion at Audit and Risk Com­mit­tee and also at board level. Dir­ect­or of Cor­por­ate ser­vices out­line two types of risk artic­u­lated in the risk register; the stra­tegic risk man­age­ment of the Nation­al Park and those rel­ev­ant to the Nation­al Park Author­ity as an organ­isa­tion. The cur­rent risk register reflects a blur­ring of stra­tegic and oper­a­tion­al risks. The over­all the pos­i­tion was pos­it­ive with 2 of 19 risks to close leav­ing 17 risks in total. Dis­cus­sions should focus on wheth­er risk man­age­ment approach is organ­isa­tion­ally effect­ive. He felt con­tent cur­rent risk register serves its pur­pose and meets needs but organ­isa­tion and present­a­tion of risks could be improved.

b) The Com­mit­tee quer­ied at what stage do risks get removed from the risk register. Dir­ect­or of Cor­por­ate Ser­vices con­firmed these are high­lighted to Audit and Risk Com­mit­tee as appro­pri­ately mit­ig­ated and for remov­al today.

c) The com­mit­tee asked wheth­er there was link­age and cor­rel­a­tion between com­plaints and repu­ta­tion­al risk. Dir­ect­or of Cor­por­ate Ser­vices con­firmed that repu­ta­tion­al risk is on the register and com­plaints are reg­u­larly monitored.

1. The Audit & Risk Committee:

a) Reviewed the Authority’s stra­tegic risk register and agreed to remove the risks highlighted.

b) Agreed any stra­tegic risk man­age­ment implic­a­tions and their poten­tial mit­ig­a­tion arising from the Her­it­age Hori­zons pro­gramme development.

1. Action Point arising:

i. Future Com­mit­tee to focus on Her­it­age Hori­zons once pro­gramme had commenced.

Inform­a­tion Requests 202 — 21 & Quarter 2021 – 22 Per­form­ance Score­cards (Paper 6)

1. Vicky Walk­er, Gov­ernance and Report­ing Man­ager intro­duced the paper which provides an update on per­form­ance on inform­a­tion requests received under FOISA and GDPR for 2020 – 21 per­form­ance and year to date per­form­ance for 2021 – 22 at the end of quarter 1. She explained that Inform­a­tion is provided in the form of score­cards for quarter 4 of 2020 – 21representing the per­form­ance for fin­an­cial year 2020 – 21 and per­form­ance for the year to date at the end of quarter I 2021 – 22.

2. The Audit and Risk Com­mit­tee dis­cussed the paper and made the fol­low­ing com­ments and observations:

a) Wheth­er there was any increase in organ­isa­tion­al time in rela­tion to increased request and what cir­cum­stances the organ­isa­tion could refuse requests. Gov­ernance and Report­ing Man­ager out­lined that there were pro­vi­sions with­in legis­la­tion to refuse requests on the length of time it would take to respond but to date no requests had met this criteria.

b) The Com­mit­tee asked wheth­er there were any actions which could be taken to pro­act­ively man­age requests. Gov­ernance and Report­ing Man­ager con­firmed that pro­act­ive pub­lic­a­tion of inform­a­tion is shown to reduce requests and the time taken to respond. This approach has been taken with some suc­cess in the Caper­cail­lie pro­ject. She con­firmed that requests are reviewed to see wheth­er there are any emer­ging themes or pat­terns to requests.

1. The Audit & Risk Committee:

a) Noted per­form­ance and activ­ity to date

1. Action Point Arising:

i. None

Com­plaints Log (Paper 7)

1. Dav­id Camer­on, Dir­ect­or of Cor­por­ate Ser­vices intro­duced the paper which presents inform­a­tion on the num­ber and nature of com­plaints received by the Author­ity since the last update on this sub­ject in Septem­ber 2020.

2. The Audit and Risk Com­mit­tee dis­cussed the paper and made the fol­low­ing com­ments and observations:

a) The Com­mit­tee con­firmed that the paper presen­ted was in the pub­lic domain and were con­tent with the increase as it ensures sys­tem is working.

b) The Com­mit­tee con­firmed that com­plaints should be made with­in 6 months but ombuds­man will pick up com­plaint up to 12 months,

c) The Com­mit­tee com­men­ted that in rela­tion to the increase in num­bers access­ing the Nation­al Park the num­ber of com­plaints was pretty good

d) The Com­mit­tee sought clar­ity on when CNPA makes com­plaints to oth­ers for example when the park is mis­rep­res­en­ted. The Chief Exec­ut­ive con­firmed that they will when it’s a worth­while respond­ing for example when inac­curacies are reported.

1. The Audit & Risk Com­mit­tee con­sidered the inform­a­tion on com­plaints made to the Authority.

2. Action Point Arising:

i. None

AOCB

1. There were no items raised.

Date of Next Meeting

1. The next sched­uled Audit and Risk Com­mit­tee meet­ing will take place on Fri­day 29^th Octo­ber 2021.

2. The meet­ing fin­ished at 15:35 hours.

3. Fol­low­ing the meet­ing the com­mit­tee had a private ses­sion with both the intern­al and extern­al auditors.