Cairngorms Nation­al Park Authority

Assur­ance Mapping

Septem­ber 2022

A AZETS CAIRNGORMS NATION­AL PARK AUTHOR­ITY Audit & Risk Com­mit­tee Paper 5 Annex 2 30/09/22

Out­line

Back­ground and scope

The Scot­tish Gov­ern­ment Audit Com­mit­tee Hand­book sug­gests that in order to prop­erly ful­fil their role, Audit Com­mit­tees should be provided with an assur­ance framework.

Assur­ance Frame­works build on the ​‘three lines of defence’ mod­el by con­sid­er­ing the role of all the assur­ance pro­viders under each line and the level of com­fort that their work provides. In oth­er words, the devel­op­ment of an assur­ance frame­work will clearly demon­strate to the audit and risk com­mit­tee members:

• The breadth of assur­ance they receive
• The strength or qual­ity of that assurance
• Any area where they need more assur­ance that they cur­rently receive (or are receiv­ing assur­ance they don’t need)

Account­able officers can also use the assur­ance frame­work when con­sid­er­ing the sys­tems of intern­al con­trol, gov­ernance and risks man­age­ment and pre­par­ing their annu­al gov­ernance statement.

Meth­od­o­logy

Our assur­ance map­ping meth­od­o­logy breaks the pro­cess down into five key stages:

1. Assur­ance Areas: Identi­fy all the key areas of your organ­isa­tion where assur­ance may be required.
2. Assur­ance Pro­viders: Con­firm and doc­u­ment your cur­rent sources of assurance.
3. Qual­ity of Assur­ance: Assess the qual­ity of assur­ance activ­it­ies iden­ti­fied and rate these accord­ing to pre-agreed cri­ter­ia includ­ing con­sid­er­a­tion of the fre­quency and scope of the activ­ity, as well as the expert­ise of the assur­ance provider.
4. Assur­ance Need: Identi­fy your cur­rent ​‘assur­ance need’ for each area of your organisation.
5. Assur­ance Map: Con­sol­id­ate all of the inform­a­tion gathered through­out our review and present you with an assur­ance map.

Work Under­taken to Date

Over the course of the past few months we have cre­ated a detailed draft list of assur­ance areas and shared these with man­age­ment. Util­ising the detailed list agreed with man­age­ment we have cre­ated a high level list of areas for Audit Com­mit­tee comment.

Audit Com­mit­tee Action

We ask the Audit Com­mit­tee to review the draft list of assur­ance areas at Appendix 1 to ensure it cov­ers all key areas of the organ­isa­tion and approve the list sub­ject to any change.

The second stage of this pro­cess is for the Audit Com­mit­tee to define the level of assur­ance they feel is required to assure mem­bers that activ­it­ies are tak­ing place to ensure the deliv­ery of the organ­isa­tions stra­tegic object­ives and stat­utory oblig­a­tions. This should be assessed as ​‘high’, ​‘medi­um’ or ​‘low’. In con­sid­er­ing this need mem­bers should con­sider the risks asso­ci­ated with the areas being reviewed, the oblig­a­tions on the organ­isa­tion for each area e.g., stat­utory oblig­a­tions and the fre­quency of dis­cus­sions related to the areas and at what level e.g. oper­a­tion­al vs strategic.

In order to sup­port this we have pro­posed assur­ance need levels for each of the areas for con­sid­er­a­tion and dis­cus­sion at Appendix 1, these have been developed from a review of the stra­tegic risk register, and insights from intern­al audits under­taken and pre­vi­ous Audit Com­mit­tee attendance.

Next Steps

Fol­low­ing approv­al of the assur­ance areas we will:

1. Con­firm and doc­u­ment your cur­rent sources of assurance.
2. Assess the qual­ity of assur­ance activ­it­ies iden­ti­fied and rate these accord­ing to pre-agreed cri­ter­ia includ­ing con­sid­er­a­tion of the fre­quency and scope of the activ­ity, as well as the expert­ise of the assur­ance provider.
3. Con­sol­id­ate all of the inform­a­tion gathered through­out our review and present you with an assur­ance map.

We will under­take this work with a view to present­ing the final out­put to the Audit Com­mit­tee at the Novem­ber 2022 meeting.

© Azets 2022. All rights reserved. Azets refers to Azets Audit Ser­vices Lim­ited. Registered in Eng­land & Wales Registered No. 09652677. VAT Regis­tra­tion No. 219 0608 22.

Registered to carry on audit work in the UK and reg­u­lated for a range of invest­ment busi­ness activ­it­ies by the Insti­tute of Chartered Account­ants in Eng­land and Wales.