HER­IT­AGE HORI­ZONS RISK MAN­AGE­MENT AND RISK REGISTER

Audit & Risk Com­mit­tee Paper Annex 2 11/02/22

This risk register has been pre­pared to sup­port the man­age­ment of the Her­it­age Hori­zons Pro­ject and is drawn up with­in the scope of the Cairngorms Nation­al Park Authority’s Risk Man­age­ment Strategy and oper­ated with­in the Authority’s risk man­age­ment pro­cesses which were graded as ​“sub­stan­tial” by our inde­pend­ent intern­al aud­it­ors, BDO, in Septem­ber 2019. This rep­res­ents the highest grad­ing with­in BDO’s intern­al audit assess­ment framework.

The CNPA’s most recent stra­tegic risk register, pub­licly avail­able online and approved by the CNPA Board in Septem­ber 2020, high­lights the embed­ded nature of lead­er­ship and man­age­ment of major extern­ally fun­ded pro­grammes and out­lines mit­ig­a­tion of the stra­tegic risks asso­ci­ated as a Lead Applic­ant for such pro­grammes. The Author­ity has a wealth of accu­mu­lated know­ledge and exper­i­ence of act­ing as a lead applic­ant and account­able body for major extern­ally fun­ded and com­munity led pro­jects: for example in sup­port­ing mul­tiple EU LEAD­ER fund­ing pro­grammes; NLHF fun­ded Tomin­toul and Glen­liv­et Land­scape Part­ner­ship Pro­gramme; and NLHF fun­ded Cairngorms Caper­cail­lie Pro­ject. We have built on our exper­i­ence of stra­tegic man­age­ment of such pro­grammes in devel­op­ment of the fol­low­ing risk register will sup­port risk and oppor­tun­ity man­age­ment in con­trib­ut­ing to suc­cess­ful deliv­ery of the Her­it­age Hori­zons Programme.

The fol­low­ing table sets out the iden­ti­fied risks and their assessed impacts, togeth­er with an asso­ci­ated score of risk like­li­hood (L) and impact (I). Risk mit­ig­a­tion meas­ures are iden­ti­fied and resid­ual risk rescores to give like­li­hood of risk after suc­cess­ful pre­vent­at­ive action (ML) and impact of risk after suc­cess­ful remedi­al action (MI).

Risk appet­ite is set at a score of 15 or more. At or above such scores, mit­ig­a­tion action is required, oth­er­wise risks will be mon­itored by man­age­ment team. Review of the risk register is coordin­ated by the Man­age­ment Team and Oper­a­tion­al Man­age­ment Group. Move­ment in risk man­age­ment assess­ment is indic­ated in the body of the risk register by upward and down­ward arrows.

Key to abbreviations:

• L = Like­li­hood of risk score
• I = Impact of risk score
• ML = Mit­ig­ated Like­li­hood of risk score after effect­ive imple­ment­a­tion and pre­vent­at­ive mit­ig­a­tion action.
• MI = Mit­ig­ated Impact of risk score after effect­ive imple­ment­a­tion and remedi­al mit­ig­a­tion action.
• Scores 1 Low to 5 High

Own­er	Risk	Impact	L	I	Pre­vent	ML	Remedi­al	MI
DCS / PM	Gov­ernance: the pro­gramme gov­ernance is not clearly defined as regards respons­ib­il­ity for lead­er­ship and deliv­ery of stra­tegic outcomes.	Poten­tial for cre­ation of con­flict and com­pet­i­tion between pro­gramme lead­ers and man­agers and those of oth­er organ­isa­tions and entities.	4	5	Extens­ive con­sulta­tion with part­ners through bid devel­op­ment and sub­sequently after approv­al. Estab­lish clear and agreed lines of gov­ernance and reporting.	2	Ensure clear lines of two way com­mu­nic­a­tion is in place to make early iden­ti­fic­a­tion and res­ol­u­tion of any issues possible.	1	2
DCS / PM	Gov­ernance: the focus on innov­a­tion and cre­ativ­ity in design­ing and imple­ment­ing step change solu­tions is impeded by a risk averse leadership.	Fail­ure to real­ise the object­ives around a trans­form­at­ive and innov­at­ive pro­gramme through lack of lead­er­ship will­ing­ness to embrace new ideas and innov­a­tion. Key oppor­tun­it­ies are not taken up.	4	5	Spe­cif­ic Pro­gramme Risk appet­ite will be drawn up and agreed by Pro­gramme Lead­er­ship at early phase of devel­op­ment, giv­ing clar­ity of pur­pose and clear basis for innov­a­tion and embra­cing oppor­tun­ity. Imple­ment form­al oppor­tun­ity apprais­al meth­od to fit with risk appetite.	2	Pro­gramme Board and Pro­gramme Man­ager will reg­u­larly review feed­back on pro­ject and oppor­tun­ity apprais­als to test for decisions which are con­trary to agreed risk appetite.	3
PM / HC	Engage­ment: scale of pro­ject acts to pro­hib­it engage­ment of people and com­munit­ies where per­cep­tion is their impact will be too small to matter.	Pro­gramme fails to attract levels of engage­ment with people and com­munit­ies and does not achieve ​“People” objectives	3	5	Com­mu­nic­a­tion focus on the poten­tial dir­ect bene­fit of pro­grammes of work to people and their com­munit­ies and the mean­ing­ful con­tri­bu­tions that can be make.	2	Estab­lish effect­ive feed­back loops to gath­er, ana­lyse and respond to incid­ences of lack of expec­ted engage­ment and adverse feedback.	2
PM / DPMs	Engage­ment: pro­pos­als to estab­lish com­munity empower­ment cut across and / or con­flict with exist­ing com­munity and wider decision mak­ing structures.	Pro­gramme pro­pos­als cre­ate con­flict with exist­ing struc­tures and pro­cesses, and gen­er­ates sig­ni­fic­ant adverse feed­back or sen­ti­ment amongst some stakeholders.	3	5	Ensure clear map­ping of exist­ing rel­ev­ant decision mak­ing struc­tures and place of empower­ment pro­pos­als with­in that. Under­take full and effect­ive con­sulta­tions dur­ing design and implementation.	2	Ensure clear and trans­par­ent con­sid­er­a­tion of feed­back received; clear ana­lys­is and pub­lic­a­tion of rationale for actions.	4
PM / HC	Repu­ta­tion: high pro­file incid­ents or one off stor­ies, can have an undue influ­ence on the Programme’s wider reputation	Pro­gramme achieve­ments are lost amongst neg­at­ive pub­li­city. Resources con­sumed in man­aging neg­at­ive pub­li­city are inap­pro­pri­ate to scale of incidents.	4	4	Estab­lish and imple­ment a clear, pro­act­ive com­mu­nic­a­tions strategy which estab­lishes appro­pri­ate reflec­tion of programme’s respons­ib­il­it­ies and oper­a­tions, gives con­sist­ent responses and builds pos­it­ive image.	3	Main­tain good bal­ance of tra­di­tion­al and social media releases present­ing pos­it­ive out­comes and gen­er­at­ing pos­it­ive over­all pro­file balance.	2
Bd / CEO	Part­ner­ships: key part­ner­ships are not formed or not suf­fi­ciently developed to deliv­er priorities.	Lack of clar­ity on part­ner­ship respons­ib­il­it­ies and / or lack of part­ner com­mit­ment to pro­gramme object­ives pre­vent achieve­ment of key outcomes	4	5	Estab­lish clear Memor­anda of Under­stand­ing which are author­ised at seni­or level to estab­lish part­ner­ship frame­works. Estab­lish clear deliv­ery tar­gets and part­ner con­tri­bu­tions to those.	2	Imple­ment reg­u­lar per­form­ance and deliv­ery mon­it­or­ing with early iden­ti­fic­a­tion of deliv­ery gaps and pro­cesses of remedi­al action clear and effective.	2
PM / DCS	Fin­ance: Sus­trans and NLHF applic­a­tion pro­cesses and fund­ing award timelines do not marry up	Dif­fer­ing fund­ing award timetables leaves gaps in coher­ence of fund­ing pack­ages and lack of cer­tainty in match fund­ing sup­port­ing applic­a­tions, impact­ing on strength of bids and poten­tial fail­ure of rel­ev­ant projects.	5	5	Early engage­ment with all rel­ev­ant fund­ing bod­ies to raise aware­ness of issues and syn­chron­ise fund­ing timetables. Design of pro­ject deliv­ery around fund­ing timetables.	2	Some redesign of work plans may be pos­sible to move out­comes from devel­op­ment into deliv­ery phase. Liais­on with NLHF on outcomes.	4	3
DCS	Fin­ance: pro­gramme deliv­ery and resource man­age­ment is not suf­fi­ciently sep­ar­ated from that of the lead applic­ant / account­able partner.	Deliv­ery and fin­an­cial man­age­ment lacks trans­par­ency and the spe­cif­ic invest­ment and bene­fits of the pro­gramme are lost	3	5	Clear design of sep­ar­ate cash and man­age­ment account­ing pro­cesses. Clear design of sep­ar­ate oper­a­tion­al and per­form­ance man­age­ment and report­ing processes.	2	Test all fin­an­cial and oper­a­tion­al report­ing to ensure there is trans­par­ency around pro­gramme man­age­ment and clear sep­ar­a­tion from the report­ing of the lead applic­ant / account­able partner.	1	3
PM	Pro­gramme Man­age­ment: COV­ID Pan­dem­ic con­tin­ues to impact on oper­a­tion­al deliv­ery possibilities	Com­mu­nic­a­tions, engage­ment and deliv­ery pos­sib­il­it­ies are lim­ited through restric­ted activ­ity and face to face contact.	4	5	Design COV­ID adapt­a­tions into all rel­ev­ant pro­ject plans.	3	Mon­it­or pro­ject impacts and use feed­back loops to inform ongo­ing adaptations.	3
DCS / PM	Pro­gramme Man­age­ment: Times­cales for devel­op­ment phase are not suf­fi­cient to real­ise full ambi­tions and object­ives of devel­op­ment phase application	Evid­ence base not as com­pre­hens­ive as inten­ded to sup­port Deliv­ery Phase applic­a­tion. Deliv­ery Phase applic­a­tion not as strong as expec­ted by NLHF. Ele­ments of Devel­op­ment Phase plans not delivered.	2	5	[No spe­cif­ic pre­vent­at­ive mit­ig­a­tion avail­able giv­en cur­rent spe­cif­ic timetable as set by grant award. Risk shown as escal­at­ing as 3 months in expec­ted timetable lost between NLHF award and approv­al to start.]	5	Instruc­tions to Deliv­ery Pro­ject Man­agers to be aware of time con­straints in review and redevel­op­ment of pro­ject plans. Liaise with NLHF on pro­ject timelines and deliv­ery phase applic­a­tion deadline.	4
PM / DCS	Deliv­ery: Pro­cure­ment timetables over­run expec­ted pro­ject plans and timeframes	Inten­ded out­comes of devel­op­ment phase are not realised.	3	4	Pri­or­it­ise pro­cure­ment require­ments at out­set of devel­op­ment phase. Con­sider tender briefs and spe­cific­a­tions with an aware­ness of poten­tial timelines. Devel­op tem­plate approaches to pro­cure­ment to min­im­ise devel­op­ment time.	3	Review pro­ject timetables; estab­lish pro­ject deliv­ery con­tin­gency plans around longer than expec­ted pro­cure­ment timetables.	3
PM / DCS	Deliv­ery: Con­tract­or sup­ply in insuf­fi­cient to meet demands of the programme	Inten­ded out­comes of devel­op­ment phase are not realised.	2	4	Test mar­ket as early as pos­sible in timetable. Con­sider struc­ture of pro­cure­ment to allow range of con­tract­or scales to tender – may be capa­city through a mix of small, medi­um and lar­ger scale tenders to access dif­fer­ing busi­ness sectors.	2	Con­tin­gency plan­ning around pro­ject deliv­ery meth­ods which are less reli­ant on con­tract­or input.	2

Key Risk Mit­ig­a­tion Actions Out­stand­ing At Report­ing Date

Own­er	Action	Update
DCS	Spe­cif­ic Pro­gramme Risk appet­ite will be drawn up and agreed by Pro­gramme Lead­er­ship at early phase of devel­op­ment, giv­ing clar­ity of pur­pose and clear basis for innov­a­tion and embra­cing opportunity	Action to be worked on over Q1 of 2022 once imme­di­ate pri­or­ity of pro­cure­ment of devel­op­ment phase con­sultan­cies is complete.
PM / HC	Com­mu­nic­a­tion focus on the poten­tial dir­ect bene­fit of pro­grammes of work to people and their com­munit­ies and the mean­ing­ful con­tri­bu­tions that can be make.	Engage­ment Strategy being presen­ted to cur­rent round of Pro­gramme Advis­ory Board and Pro­gramme Board. Once agreed and adop­ted this will provide plat­form to deliv­er risk mitigation.
PM / HC	Estab­lish and imple­ment a clear, pro­act­ive com­mu­nic­a­tions strategy which estab­lishes appro­pri­ate reflec­tion of programme’s respons­ib­il­it­ies and oper­a­tions, gives con­sist­ent responses and builds pos­it­ive image.	Con­sider work required on this action fol­low­ing agree­ment of engage­ment strategy dur­ing Q1 of 2022
PM	Estab­lish clear Memor­anda of Under­stand­ing which are author­ised at seni­or level to estab­lish part­ner­ship frameworks.	Fol­low­ing devel­op­ment of pro­ject plans at ini­tial stage of devel­op­ment phase, con­sid­er­a­tion to be giv­en by Pro­gramme Man­ager of estab­lish­ing Memor­anda or exchan­ging let­ters with part­ners to ensure clar­ity of under­stand­ing of rela­tion­ships and expect­a­tions around input and deliv­ery over course of remainder of devel­op­ment phase.
PM	Design COV­ID adapt­a­tions into all rel­ev­ant pro­ject plans	Pro­gramme Man­ager to test think­ing on pro­ject plan­ning around poten­tial COV­ID inter­rup­tions and con­tin­gency plans over next cycle of one to one meet­ings with deliv­ery pro­ject managers.
PM / DCS	Pro­cure­ment early mar­ket testing	While first pro­cure­ment has been suc­cess­ful in secur­ing a Her­it­age Con­sult­ant advisor, noted this only returned a single tender pro­pos­al with some poten­tial con­firm­a­tion of restric­tions on sup­ply side. Focus in Janu­ary 22 in launch­ing oth­er key pro­cure­ments, includ­ing Act­ive Travel. Pro­gramme Man­ager with sup­port of DCS to emphas­ise need for con­tin­gency plan­ning with deliv­ery pro­ject managers.

Risks Under Monitoring

The risks in this sec­tion of the risk assess­ment either have ini­tial risk scores of under 15, or 15 where impact is 3. Risks fall­ing into these risk scores will con­tin­ue to be mon­itored by man­age­ment and any escal­a­tion will require remedi­al action to be taken. At present, risks are accep­ted without the need for imme­di­ate (with­in the next 3 to 6 month peri­od) remedi­al action being taken.

Own­er	Risk	Impact	L	I	Pre­vent	ML	Remedi­al	MI
PM / HC	Repu­ta­tion: the Programme’s repu­ta­tion is impacted by a small num­ber of voci­fer­ous social media opin­ion leaders	Pro­gramme achieve­ments are lost amongst neg­at­ive pub­li­city. Resources con­sumed in man­aging neg­at­ive pub­li­city are inap­pro­pri­ate to scale of incidents.	3	4	Estab­lish and imple­ment a clear, pro­act­ive social media and digit­al com­mu­nic­a­tions ele­ment of com­mu­nic­a­tions strategy.	2	Main­tain good bal­ance of tra­di­tion­al and social media releases present­ing pos­it­ive out­comes and gen­er­at­ing pos­it­ive over­all pro­file balance.	2
DCS	Fin­an­cial stew­ard­ship: the scale of cash flow man­age­ment is too great to be man­aged by the lead partner.	Pro­gramme fail­ure as a res­ult of lack of effect­ive cash flow support.	1	5	Util­ise exper­i­ence of pre­vi­ous multi-mil­lion annu­al extern­al fund­ing sup­port in devel­op­ment of treas­ury man­age­ment and cash flow sup­port arrange­ments for programme.	1	Close cash flow mon­it­or­ing of pro­gramme and impacts on lead part­ner. Close work­ing between pro­gramme lead­ers and lead part­ner stra­tegic finance.	3
PM	Staff­ing: Recruit­ment of pro­ject staff takes longer than anti­cip­ated or is unsuccessful	Pro­gramme delays or fail­ure through lack of staff resources	2	5	Util­ise exper­i­ence of lead part­ner HR and recruit­ment staff.	1	Agree con­tin­gency plans for instances of reduced recruit­ment interest. Agree	2
DCS	Fin­an­cial stew­ard­ship: match fund­ing is not secured to provide the full and expec­ted pro­gramme budget	Fail­ure to take sig­ni­fic­ant oppor­tun­it­ies tar­geted by the pro­gramme. Fail­ure to achieve sig­ni­fic­ant objectives.	3	4	Multi stage pro­cess of identi­fy­ing and con­firm­ing match fund­ing offers. Use exper­i­ence gained from sim­il­ar pri­or processes.	2	Ongo­ing man­age­ment of match fund­ing pack­age and iden­ti­fic­a­tion of any delays for quick resolution.	3

Key to Risk Owners

• Bd Pro­gramme Board
• CEO Chief Exec­ut­ive, CNPA
• DCS Dir­ect­or of Cor­por­ate Ser­vices and Deputy Chief Exec­ut­ive, CNPA
• DPMs Deliv­ery Pro­ject Managers
• HC Head of Com­mu­nic­a­tions, CNPA
• PM Pro­gramme Man­ager, CNPA

Ver­sion Control

• 0 Draft­ing
• 0.1 DC first draft pos­i­tion state­ment as at 20 Janu­ary 2021
• 1 Devel­op­ment Phase
• 1.0 DC first review dur­ing Devel­op­ment Phase for Pro­gramme Board