Cairngorms Nation­al Park Authority

Intern­al Audit Report ²⁰²¹⁄₂₂

Assur­ance Map­ping of Major Projects

Janu­ary 2022

A AZETS CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit & Risk Com­mit­tee Paper 3 Annex 1 11/02/22

---

Page 2

Cairngorms Nation­al Park Authority Intern­al Audit Report ²⁰²¹⁄₂₂ Assur­ance Map­ping of Major Projects

Exec­ut­ive Summary	1
Man­age­ment Action Plan	5
Appendix A – Definitions	10

Audit Spon­sor: Dav­id Camer­on, Dir­ect­or of Cor­por­ate Ser­vices and Deputy Chief Executive

Key Con­tacts:

• Wil­li­am Mun­ro, Board Member
• Car­o­lyn Cad­dick, Board Member
• Vicky Walk­er, Gov­ernance and Report­ing Manager
• Andy Ford, Dir­ect­or of Nature and Cli­mate Change
• Car­o­lyn Robertson, Cairngorms Caper­cail­lie Pro­ject Manager

Audit Team:

• Eliza­beth Young, Engage­ment Lead
• Stephanie Hume, Seni­or Manager
• Lor­na Mun­ro, Intern­al Auditor

---

Page 3

Exec­ut­ive Summary

Con­clu­sion

We have con­firmed that Cairngorms Nation­al Park Author­ity (CNPA) has iden­ti­fied all major pro­jects and pro­grammes and that assur­ance is being provided to the Board through the Per­form­ance Com­mit­tee and the Resources Committee.

How­ever, we have iden­ti­fied that CNPA had only par­tially imple­men­ted its major project/​programme approach with a num­ber of key actions still to be com­pleted, includ­ing the devel­op­ment of tem­plates, tools to improve mon­it­or­ing and report­ing (includ­ing fin­an­cial assur­ance) and pro­vi­sion of Pro­gramme Office sup­port. Fur­ther­more, we noted a pro­ject plan for the imple­ment­a­tion of this new approach is yet to be documented.

Back­ground and scope

The Cairngorms Nation­al Park Author­ity (CNPA) is the account­able body fin­an­cially for four out of five of the major pro­jects taken for­ward by the organ­isa­tion in the past five years, with a total fund­ing for these pro­jects of £15 mil­lion. Whilst the Author­ity is the account­able body fin­an­cially, the deliv­ery of these pro­jects is spread across mul­tiple part­ners who also con­trib­ute fin­an­cially and provide pro­ject staff resources.

In accord­ance with the ²⁰²¹⁄₂₂ Intern­al Audit Plan, we reviewed the assur­ance of major pro­jects with­in Cairngorms Nation­al Park Authority.

---

Page 4

Con­trol assessment

1. There is an agreed gov­ernance and report­ing frame­work in place for major pro­jects, with com­pre­hens­ive and reg­u­lar updates provided to the Board on pro­jects’ pro­gress and per­form­ance. (Yel­low)
2. Fin­an­cial mon­it­or­ing reports provide the Board with suf­fi­cient inform­a­tion on pro­ject costs and how each indi­vidu­al pro­ject is per­form­ing in rela­tion to its alloc­ated budget. (Yel­low)
3. Board mem­bers sit on Pro­gramme Boards for all major pro­jects and there are clear roles and respons­ib­il­it­ies for Board mem­bers in terms of excep­tion report­ing and escal­at­ing issues of con­cern to the Board. (Green)
4. An assur­ance map­ping exer­cise has been car­ried out for major pro­jects to con­firm that appro­pri­ate and risk-based assur­ance is being received across the organ­isa­tion. (Yel­low)

Improve­ment actions by type and priority

(Chart show­ing 2 actions under ​“Con­trol Design”)

Two improve­ment actions have been iden­ti­fied from this review, both of which relate to the design of con­trols. See Appendix A for defin­i­tions of col­our coding.

---

Page 5

Key find­ings

Good prac­tice

CNPA’s pro­ced­ures reflect good prac­tice in a num­ber of areas:

• CNPA iden­ti­fied the need for a con­sist­ent approach to pro­ject and pro­gramme man­age­ment and have taken action to address this.
• All extant major pro­jects and pro­grammes with­in CNPA have been iden­ti­fied, and all new pro­jects and pro­grammes will be approved by the Seni­or Man­age­ment Team.
• The Board has alloc­ated respons­ib­il­ity to one of its sub-com­mit­tees, the Per­form­ance Com­mit­tee, to provide over­see major projects/​programme per­form­ance, with updates being provided to each meet­ing. This ensures suf­fi­cient scru­tiny is tak­ing place at a seni­or level.
• CNPA has estab­lished pro­gramme boards for all cur­rent major pro­grammes, that con­sist of LEAD­ER Pro­gramme, Caper­cail­lie Pro­ject and Peat­land Action. These boards review pro­gress and per­form­ance, ensur­ing that timely cor­rect­ive action is taken in rela­tion to any issues.
• Although not man­dat­ory, we noted that cur­rently a Board mem­ber sits on the pro­gramme board for all the cur­rent major programmes.

Areas for improvement

We have iden­ti­fied a small num­ber of areas for improve­ment which, if addressed, would strengthen CNPA’s con­trol frame­work. These include:

• Fully imple­ment­ing the major project/​programme man­age­ment approach, includ­ing pro­vi­sion of tem­plates and cla­ri­fy­ing key terminology.
• Devel­op­ing a tool to sup­port pro­ject (includ­ing fin­an­cial) assur­ance for the Per­form­ance Committee.

These are fur­ther dis­cussed in the Man­age­ment Action Plan below.

Impact on risk register

The CNPA cor­por­ate risk register included the fol­low­ing risks rel­ev­ant to this review:

• Risk A11.1: Resourcing: Role as Lead / Account­able body for major pro­grammes (e.g. LEAD­ER, Land­scape Part­ner­ship) has risk of sig­ni­fic­ant fin­an­cial claw­back should expendit­ure prove to be not eli­gible for fund­ing, while CNPA car­ries respons­ib­il­it­ies as employ­er for pro­gramme staff.
• Risk A11.2: Resourcing: the end of major pro­gramme invest­ments (Tomin­toul and Glen­liv­et, LEAD­ER) requires sig­ni­fic­ant ongo­ing staff­ing to man­age audit and leg­acy which the Author­ity finds dif­fi­cult to resource.

The res­ults of our review will not affect the impact or like­li­hood of either of these risks.

---

Page 6

Acknow­ledge­ments

We would like to thank all staff con­sul­ted dur­ing this review for their assist­ance and co-operation.

---

Page 7

Man­age­ment Action Plan

Con­trol Object­ive 1: There is an agreed gov­ernance and report­ing frame­work in place for major pro­jects, with com­pre­hens­ive and reg­u­lar updates provided to the Board on pro­jects’ pro­gress and per­form­ance. (Yel­low)

1.1 Pro­ject man­age­ment approach

At the time of field­work man­age­ment were in the pro­cess of devel­op­ing an out­line pro­gramme man­age­ment approach that can be tailored to each pro­ject. The most sig­ni­fic­ant change to date has been the intro­duc­tion of the Per­form­ance Com­mit­tee, who main­tain over­sight of all major pro­jects and pro­grammes through reg­u­lar assur­ance reports. They will be sup­por­ted by the Resources Com­mit­tee who has over­sight of the over­all CNPA budget. In addi­tion, work remains ongo­ing to devel­op pro­ject devel­op­ment doc­u­ment­a­tion includ­ing pro­ject ini­ti­ation doc­u­ments and assur­ance reports.

The pro­ject plan for this work has not been fully scoped or doc­u­mented and there­fore pro­gress and out­comes will be dif­fi­cult to mon­it­or and report on.

Fur­ther, dur­ing dis­cus­sions with staff and Board mem­bers we also noted that ​‘pro­ject’ and ​‘pro­gramme’ was used inter­change­ably, when spe­cif­ic mean­ings apply.

Risk: There is a risk the organ­isa­tion does not imple­ment a new pro­ject man­age­ment approach effect­ively as a res­ult of plans not being fully developed, lead­ing to the CNPA not identi­fy­ing issues early enough and there­fore not achiev­ing its objectives.

Recom­mend­a­tion: Man­age­ment should put in place a pro­ject plan for imple­ment­a­tion of the new pro­ject man­age­ment approach. This may include the use of stage plans to help with main­tain­ing flex­ib­il­ity over how the over­all approach devel­ops. In addi­tion, man­age­ment should ensure that this plan includes appro­pri­ate com­mu­nic­a­tions to explain any jar­gon or spe­cif­ic terminology.

Man­age­ment Action: Recom­mend­a­tion agreed, while not­ing the work to com­mu­nic­ate the work and its implant­a­tion and seek to improve con­sist­ency in ter­min­o­logy and lan­guage use is likely to be a sep­ar­ate action flow­ing from the pro­ject plan rather than an integ­ral part of the plan itself. (Grade 2 (Design))

Action own­er: Gov­ernance and Report­ing Man­ager Due date: 30 Septem­ber 2022

---

Page 9

Con­trol Object­ive 2: Fin­an­cial mon­it­or­ing reports provide the Board with suf­fi­cient inform­a­tion on pro­ject costs and how each indi­vidu­al pro­ject is per­form­ing in rela­tion to its alloc­ated budget. (Yel­low)

2.1 Fin­an­cial Assurance

A decision has been taken that the Per­form­ance Com­mit­tee will review the doc­u­ment­a­tion pro­duced for exist­ing Pro­gramme Boards and extern­al fun­ders (e.g. Scot­tish Gov­ern­ment, Nation­al Lot­tery) to ensure suf­fi­cient assur­ance can be taken on Pro­gramme deliv­ery on behalf of the Board.

How­ever, we noted in Per­form­ance Com­mit­tee reports that the budget fore­cast pos­i­tion was miss­ing from the Caper­cail­lie pro­ject and pro­jects at the plan­ning or devel­op­ment stage were insuf­fi­ciently detailed, with no sum­mary of budgets, actu­als, fore­cast or RAG rat­ing included even though resources are being used dur­ing these stages.

It is noted that the Resources Com­mit­tee receives reg­u­lar fin­an­cial report­ing, which is broken down by pro­ject with these reports and minutes avail­able to all Board mem­bers, includ­ing those in the Per­form­ance Com­mit­tee. CNPA are also invest­ig­at­ing a dash­board tool to sup­port present­a­tion of pro­ject assur­ance to the Per­form­ance Com­mit­tee over a num­ber of areas, includ­ing the fin­an­cial management.

Risk: There is a risk that the Board are receiv­ing insuf­fi­cient fin­an­cial assur­ance, res­ult­ing in Board mem­bers not hav­ing a clear and suf­fi­cient under­stand­ing of the fin­an­cial pos­i­tion to sup­port decision making.

Recom­mend­a­tion: Man­age­ment should ensure the budget fore­cast pos­i­tion on the Caper­cail­lie pro­ject is included in report­ing to the Per­form­ance Com­mit­tee when con­sid­er­ing the level of assur­ance which can be taken on Pro­gramme deliv­ery. In addi­tion man­age­ment should intro­duce a RAG rat­ing or state­ment on fin­an­cial per­form­ance into all high­light reports to the Per­form­ance Committee.

Man­age­ment Action: Recom­mend­a­tion agreed. We will review the tem­plate cov­er paper for the Per­form­ance Com­mit­tee with a view to ensur­ing these key ele­ments of pro­gramme and pro­ject assur­ance are made expli­cit and trans­par­ent to the Com­mit­tee. (Grade 2 (Design))

Action own­er: Dir­ect­or of Cor­por­ate Ser­vices and Clerk to the Board Due date: 30 April 2022

---

Page 10

Con­trol Object­ive 3: Board mem­bers sit on Pro­gramme Boards for all major pro­jects and there are clear roles and respons­ib­il­it­ies for Board mem­bers in terms of excep­tion report­ing and escal­at­ing issues of con­cern to the Board. (Green)

No weak­nesses identified

Each pro­posed new major pro­ject or pro­gramme is assessed by the Seni­or Man­age­ment Team who decide wheth­er there is a need for Board mem­bers to sit on the project/​programme board. The roles and respons­ib­il­it­ies will be detailed in Pro­ject Ini­ti­ation Doc­u­ments being developed by the Pro­gramme Sup­port Office.

All major pro­jects and pro­grammes are now also over­seen by the Per­form­ance Com­mit­tee. Their remit is to provide assur­ance over activ­ity of major pro­grammes and pro­jects in sup­port­ing achieve­ment of stra­tegic out­comes and not pos­ing unmit­ig­ated cor­por­ate risk.

In addi­tion to stand­ard escal­a­tion pro­cesses to the main Board, the Chair of the Per­form­ance Com­mit­tee can high­light any issues to the Gov­ernance Com­mit­tee or through inform­al dis­cus­sions with oth­er Board members.

---

Page 11

Con­trol Object­ive 4: An assur­ance map­ping exer­cise has been car­ried out for major pro­jects to con­firm that appro­pri­ate and risk-based assur­ance is being received across the organ­isa­tion. (Yel­low)

4.1 Assur­ance reporting

All new projects/​programmes will be approved by the Seni­or Man­age­ment Team and be taken for­ward through the new approach, which includes pro­ject ini­ti­ation doc­u­ment­a­tion, high­light reports and report­ing to the Per­form­ance Com­mit­tee. In addi­tion, a struc­tured assess­ment of assur­ance was under­taken for a devel­op­ing pro­gramme — Her­it­age Hori­zons, and a sim­il­ar approach to doc­u­ment­ing and agree­ing assur­ance will be taken for­ward for all major projects/​programmes.

Exist­ing live major projects/​programmes will con­tin­ue with the cur­rent doc­u­ment­a­tion and board struc­tures but provide assur­ance reports to the Per­form­ance Com­mit­tee at the agreed frequency.

The Board Mem­bers spoken to felt that inform­a­tion presen­ted was broadly suf­fi­cient for assur­ance pur­poses at this early stage of the new approach to pro­ject gov­ernance and assur­ance, though this would likely devel­op and improve over time.

How­ever as high­lighted in MAP 2.1 fin­an­cial assur­ance is not being adequately provided for all pro­jects as stand­ard to the Per­form­ance Com­mit­tee. A fur­ther recom­mend­a­tion has not been made but the con­trol is assessed as yel­low in line with MAP 2.1

---

Page 12

Appendix A – Definitions

Con­trol assessments

Rat­ing	Descrip­tion
R	Fun­da­ment­al absence or fail­ure of key controls.
A	Con­trol object­ive not achieved — con­trols are inad­equate or ineffective.
Y	Con­trol object­ive achieved — no major weak­nesses but scope for improvement.
G	Con­trol object­ive achieved — con­trols are adequate, effect­ive and efficient.

Man­age­ment action grades

Grade	Descrip­tion
4	Very high risk expos­ure — major con­cerns requir­ing imme­di­ate seni­or atten­tion that cre­ate fun­da­ment­al risks with­in the organisation.
3	High risk expos­ure — absence / fail­ure of key con­trols that cre­ate sig­ni­fic­ant risks with­in the organisation.
2	Mod­er­ate risk expos­ure — con­trols are not work­ing effect­ively and effi­ciently and may cre­ate mod­er­ate risks with­in the organisation.
1	Lim­ited risk expos­ure — con­trols are work­ing effect­ively, but could be strengthened to pre­vent the cre­ation of minor risks or address gen­er­al house-keep­ing issues.

---

Page 13

© Azets 2022. All rights reserved. Azets refers to Azets Audit Ser­vices Lim­ited. Registered in Eng­land & Wales Registered No. 09652677. VAT Regis­tra­tion No. 219 0608 22.

Registered to carry on audit work in the UK and reg­u­lated for a range of invest­ment busi­ness activ­it­ies by the Insti­tute of Chartered Account­ants in Eng­land and Wales.