CAIRNGORMS NATION­AL PARK AUTHORITY

Audit & Risk Com­mit­tee Paper 6 11/02/22

CAIRNGORMS NATION­AL PARK AUTHORITY AUDIT & RISK COMMITTEE

FOR DECISION

Title: STRA­TEGIC RISK MAN­AGE­MENT OVERVIEW

Pre­pared by: DAV­ID CAMER­ON, DIR­ECT­OR OF COR­POR­ATE SERVICES

Pur­pose

This paper sup­ports the Audit and Risk Committee’s review of the stra­tegic risk man­age­ment pos­i­tion of the Authority.

The paper presents the most recent update to the Authority’s stra­tegic risk register, fol­low­ing review of risk man­age­ment action and pos­i­tion by the Seni­or Man­age­ment Team in Janu­ary 2022.

The paper also presents an update on hand­ling the risks in deliv­ery of the Her­it­age Hori­zons pro­gramme, togeth­er with an update on man­age­ment of COV­ID-19 busi­ness con­tinu­ity risks to allow the Com­mit­tee to take assur­ance over the man­age­ment of these pro­gramme-spe­cif­ic risks and adequacy of cov­er­age of the stra­tegic risk register with regard to these stra­tegic programmes.

Recom­mend­a­tions

The Audit & Risk Com­mit­tee is asked to:

a) Review the Authority’s stra­tegic risk register, agree­ing any required amend­ments or mit­ig­a­tion actions; b) Agree any stra­tegic risk man­age­ment implic­a­tions and their poten­tial mit­ig­a­tion arising from the Her­it­age Hori­zons pro­gramme devel­op­ment phase; c) Agree that the COV­ID-19 Busi­ness Con­tinu­ity Risk Register may be reduced to oper­a­tion­al man­age­ment and mon­it­or­ing status.

Cairngorms NPA Stra­tegic Risk Management

1. The Park Authority’s cur­rent stra­tegic risk register is attached at Annex I to this paper. This has been revised to imple­ment changes agreed by the Seni­or Man­age­ment Team in Janu­ary 2022.
2. The Com­mit­tee is invited to review the pos­i­tion on stra­tegic risk man­age­ment as set out in the risk register and: a) Con­sider the adequacy of cov­er­age stra­tegic risk man­age­ment around achieve­ment of the Authority’s cur­rent stra­tegic object­ives; b) Con­sider the adequacy and effect­ive­ness of mit­ig­a­tion actions set out in the risk register.
3. Man­age­ment con­sider that one stra­tegic risk on a con­sist­ent down­ward trend should be closed as a stra­tegic risk to the Author­ity at this time.
4. While three fur­ther stra­tegic risks are assessed as con­tinu­ing on a down­ward trend for some time, the view of man­age­ment team is that these risks should be retained as open for the time being.
5. One new risk high­light­ing increas­ingly com­pet­it­ive recruit­ment mar­kets and con­sequent risks around secur­ing appro­pri­ately exper­i­enced and qual­i­fied staff has been added by the Seni­or Man­age­ment Team.

Her­it­age Hori­zons Pro­gramme Risk Management

1. The Her­it­age Hori­zons: Cairngorms 2030 Pro­gramme Board has respons­ib­il­ity for risk man­age­ment of the pro­gramme which is cur­rently in its devel­op­ment phase cycle with­in the Nation­al Lot­tery Her­it­age Fund system.
2. The Cairngorms NPA Board has reques­ted that the Com­mit­tee con­sider the implic­a­tions of the Her­it­age Hori­zons pro­pos­als, includ­ing gov­ernance and risk man­age­ment of the pro­gramme and their poten­tial implic­a­tions for the Authority’s wider risk man­age­ment. The risk man­age­ment report to the Her­it­age Hori­zons Pro­gramme Board meet­ing of 3 Feb­ru­ary 2022 is repro­duced at Annex 2 to this paper.
3. The Com­mit­tee is reques­ted to con­sider the risk man­age­ment implic­a­tions for the Author­ity arising from the cur­rent Her­it­age Hori­zons Pro­gramme risk management.

COV­ID-19 Busi­ness Con­tinu­ity Risk Management

1. The Com­mit­tee has also received updates over the last two years on the Authority’s risk man­age­ment of our busi­ness con­tinu­ity approaches to the COV­ID-19 pandemic.
2. The busi­ness con­tinu­ity team have reviewed the risk man­age­ment pos­i­tion of the busi­ness con­tinu­ity approaches over Decem­ber 2021 and Janu­ary 2022. The report from this review is repro­duced at Annex 3 to this paper.
3. The busi­ness con­tinu­ity team are of the opin­ion that the man­age­ment of risk in imple­ment­ing COV­ID-19 busi­ness con­tinu­ity plans may be removed from stra­tegic focus. As indic­ated in Annex 3, many of the risks recog­nised are now assessed as under effect­ive mit­ig­a­tion man­age­ment and may be removed from the risk register and placed under mon­it­or­ing (those shaded in grey in Annex 3). Remain­ing risks with­in the busi­ness con­tinu­ity risk register appear to map well onto stra­tegic risks retained with­in the Authority’s main stra­tegic risk register and there­fore con­tin­ue under risk man­age­ment through those processes.
4. Con­sequently, it is sug­ges­ted that the Audit and Risk Com­mit­tee may now remove this aspect of the Authority’s risk man­age­ment work from its stra­tegic level scru­tiny on the basis that the busi­ness con­tinu­ity team con­tin­ue to mon­it­or the risks remain­ing under man­age­ment and assess effect­ive­ness of mit­ig­a­tion. Any points of escal­a­tion will be brought through the Seni­or Man­age­ment Team to the atten­tion of the Com­mit­tee under nor­mal risk man­age­ment process.

Dav­id Cameron 31 Janu­ary 2022 davidcameron@​cairngorms.​co.​uk