220930AuCtteePaper6Annex1InternalAuditFollowUpJul22Overview

CAIRNGORMS NATION­AL PARK AUTHORITY

Audit & Risk Com­mit­tee Paper 6 | 30/09/22

Table:

Audit Find­ing	Recom­mend­a­tion	Revised Date	July 2022 Review Update And Action	Respons­ible Officer(s)	Update / Com­ment	Risk Man­age­ment
Staff involved in risk man­age­ment do not receive man­dat­ory risk man­age­ment train­ing. Man­age­ment and staff are provided with the oppor­tun­ity to identi­fy any train­ing needs as part of the form­al apprais­al pro­cess. Whilst a require­ment for risk man­age­ment train­ing could be raised as part of this pro­cess, staff with risk man­age­ment respons­ib­il­it­ies are not routinely required to con­firm wheth­er they are aware of the organisation’s risk man­age­ment prin­ciples and prac­tices. There is a risk that Cairngorms NPA may not be provid­ing appro­pri­ate risk man­age­ment training.	We recom­mend that, on devel­op­ment of a risk man­age­ment policy, staff with risk man­age­ment respons­ib­il­it­ies are required to sign a check­list to con­firm wheth­er they are aware of the organisation’s risk man­age­ment approach or require fur­ther train­ing in this area.	Remove	Not being taken for­ward. Counter to CNPA cul­ture to have staff sign off on indi­vidu­al job respons­ib­il­ity ele­ments. Per­form­ance Devel­op­ment Con­ver­sa­tions always open to identi­fy any train­ing needs or uncer­tainty on processes.	n/​a

Audit Find­ing	Recom­mend­a­tion	Revised Date	July 2022 Review Update And Action	Respons­ible Officer(s)	Update / Com­ment	Risk Man­age­ment
CNPA’s Fin­an­cial reg­u­la­tions are sup­por­ted by a num­ber of fin­an­cial policies and pro­cess notes. The Fin­ance Man­age­ment Excel sched­ule is being developed by man­age­ment to provide detailed policies and guid­ance to staff on all key fin­an­cial pro­cesses. How­ever, a num­ber of fin­an­cial pro­cesses, includ­ing debt­ors recon­cili­ations, pur­chase ledger recon­cili­ations, requis­i­tions and petty cash, still require to be doc­u­mented with­in the Fin­ance Man­age­ment Excel sched­ule. In addi­tion, step-by-step pro­ced­ure notes are provided for a num­ber of fin­an­cial pro­cesses with­in CNPA’s Fin­an­cial Man­age­ment Pro­ced­ures and our walk­through test­ing con­firmed that key fin­an­cial pro­cesses are oper­at­ing as described by man­age­ment. How­ever, there is an oppor­tun­ity to out­line roles and respons­ib­il­it­ies with­in the guid­ance notes for all pro­cesses to clearly doc­u­ment the segreg­a­tion of duties. There is a risk that pro­ced­ures and con­trols in place for key fin­an­cial pro­cesses, includ­ing roles and respons­ib­il­it­ies, have not been doc­u­mented appropriately.	We recom­mend that the Fin­ance Man­age­ment sched­ule is updated to provide detailed policies and guid­ance on all fin­an­cial pro­cesses. These should be reviewed on an annu­al basis. We also recom­mend that clear roles and respons­ib­il­it­ies demon­strat­ing segreg­a­tion of duties are doc­u­mented with­in the guid­ance notes for all fin­an­cial pro­cesses. We recog­nise that man­age­ment have made pro­gress in devel­op­ing the sched­ule and that com­ple­tion of this was delayed due to the imple­ment­a­tion of the new Sage system.	Oct-22	Fin­ance Manu­al to be com­pleted by Oct 22	Fin­ance Manager

Audit Find­ing	Recom­mend­a­tion	Revised Date	July 2022 Review Update And Action	Respons­ible Officer(s)	Update / Com­ment	Risk Man­age­ment
A well doc­u­mented and up to date pro­ced­ure is cru­cial for ensur­ing that cur­rent and future staff have guid­ance on how to per­form their roles in line with best prac­tice. Whilst man­age­ment are in the pro­cess of devel­op­ing a Grant Toolkit to provide guid­ance to staff on the award­ing, record­ing and mon­it­or­ing of grants, this is not yet in place. In addi­tion, whilst a Grant Risk Assess­ment Mat­rix tem­plate is provided as an appendix to the grant toolkit which is used to the determ­ine the level of eval­u­ation and due dili­gence required for fund­ing applic­a­tions, this had not been com­pleted for 9 out of the 10 grant awards tested. There is a risk that the pro­cess for eval­u­at­ing and award­ing applic­a­tions for grant fund­ing may not be clearly doc­u­mented, and staff may not be fol­low­ing the pro­cess as a result.	We recom­mend that the Grant Toolkit is com­pleted, encom­passing all pro­cesses in place for the award­ing, record­ing and mon­it­or­ing of grant fund­ing. The toolkit should also clearly define the fol­low­ing: — Actions to be taken when grant con­di­tions are not being met or terms and con­di­tions are breached; — The pro­cess for con­sid­er­a­tion of the risk and value of grant fund­ing applic­a­tions to determ­ine the pro­por­tion of resource required to eval­u­ate these; and — Review and scru­tiny arrange­ments for pro­gress reports provided by grantees.	Dec-22	Draw togeth­er grant toolkit info plus asso­ci­ated doc­u­ments, e.g. sub­sidy con­trol guid­ance. Com­plete by Dec 22	Fin­ance Man­ager & Dir­ect­or Cor­por­ate Services

Audit Find­ing	Recom­mend­a­tion	Revised Date	July 2022 Review Update And Action	Respons­ible Officer(s)	Update / Com­ment	Risk Man­age­ment
Our audit found that the pro­cess for data backups can be fur­ther improved to ensure the resi­li­ence and avail­ab­il­ity of the net­work and busi­ness data. We noted that cur­rently there is no test­ing of data backups in line with require­ments set out in the IT Secur­ity Policy. This requires that backups should be tested ​“reg­u­larly in accord­ance with an agreed backup plan”. How­ever a form­al backup plan has not been defined and there has been no full restore test­ing of backups from tape media. Also, our test­ing iden­ti­fied more than one instance of repeat failed backups over a peri­od of sev­er­al days. There is cur­rently no form­al pro­cess in place to ensure repeat fail­ures are root-cause invest­ig­ated and re run to ensure there are no gaps in data backup avail­ab­il­ity. There is a risk that busi­ness sys­tems and data may not be recov­er­able fol­low­ing sys­tem fail­ure or data cor­rup­tion. The risk in this area has increased giv­en the grow­ing threat from ransom­ware attacks. Ransom­ware works by encrypt­ing files/​directories that can then only be unlocked by an attack­er. In this situ­ation, an organ­isa­tion will gen­er­ally have to default to their off­line backups to recov­er their systems.	We recom­mend that, as per the require­ments of the Secur­ity Policy, there is reg­u­lar full-restore test­ing of backups i.e. the full recov­ery of sys­tems on a bare-met­al serv­er using backup media. We also recom­mend that a form­al backup plan/​policy is developed to ensure a con­sist­ent approach is taken to man­aging backups includ­ing imple­ment­a­tion, mon­it­or­ing over their success/​failure, rerun­ning failed backups and reg­u­lar testing.	Mar-23	IT Policies to be revised to reflect cloud based ser­vices as ele­ments of ICT infra­struc­ture, with back up arrange­ments and test­ing pro­ced­ures incor­por­ated into those updates.	IT Man­ager, liais­ing with Gov­ernance, Data and Report­ing Manager

(Table con­tin­ues for mul­tiple pages with sim­il­ar struc­ture. Due to the length of the table, I will not repro­duce the entire table here. The provided OCR text con­tains the com­plete table data.)