CAIRNGORMS NATION­AL PARK AUTHOR­ITY STRA­TEGIC RISK REGISTER

Audit and Risk Com­mit­tee Paper 3 Annex 1 5^th Decem­ber 2022

Risk	Ref	Resp	Mit­ig­a­tion	Com­ments	Trend Jan 22	Trend May 22	Trend Nov 22
Resources: pub­lic sec­tor fin­ances con­strain capa­city to alloc­ate suf­fi­cient resources to deliv­er cor­por­ate plan.	A1	DC	Pre­vent­at­ive: Ongo­ing liais­on with Scot­tish Gov­ern­ment high­light­ing achieve­ments of CNPA. Pre­vent­at­ive: Cor­por­ate plan pri­or­it­ised around anti­cip­ated Scot­tish Gov­ern­ment budget alloc­a­tions, tak­ing on Board expect­a­tion of fund­ing con­straints. Remedi­al: Focus resource on diver­si­fic­a­tion of income streams to altern­ate, non-pub­lic income gen­er­a­tion. Remedi­al: Con­tinu­ing to sup­port ​“deliv­ery bod­ies” such as Cairngorms Nature, Cairngorms Trust in secur­ing inward investment.	2022⁄23 budget approved by board on 25 March high­lighted a sig­ni­fic­ant step change in fund­ing levels for CNPA across both gov­ern­ment and extern­al sources. Remedi­al mit­ig­a­tion on diver­si­fic­a­tion of income par­tic­u­larly suc­cess­ful with regard to Nation­al Lot­tery Her­it­age Funds (NLHF) secured. Risk escal­a­tion reflects Scot­tish Government’s con­tin­ued and heightened con­cerns on for­ward sta­bil­ity of cur­rent fin­an­cial alloc­a­tions; risk of in-year adjust­ments, and risk over future year fund­ing levels.	⬇️	⬇️	⬆️
Resourcing: future com­munity led loc­al devel­op­ment (CLLD) fund­ing cur­rently delivered through LEAD­ER, togeth­er with wider fund­ing pre­vi­ously from EU struc­tur­al and agri­cul­tur­al sources is lost and cre­ates a sig­ni­fic­ant gap in our capa­city to deliv­er against our devel­op­ment priorities	A12	2	DC	Pre­vent­at­ive: pri­or­it­ise engage­ment in con­sulta­tions and events around the future devel­op­ment of struc­tur­al and com­munity fund­ing. Remedi­al: con­tin­ue to sup­port work of Cairngorms Trust in attract­ing vol­un­tary dona­tions toward com­munity action – although this is likely to remain at a much smal­ler scale for some time. Remedi­al: con­tin­ue to review oppor­tun­it­ies for fund­ing bids to oth­er non-gov­ern­ment­al fund­ing sources.	Pos­it­ive move­ment con­tinu­ing across policy devel­op­ment areas with­in Scot­tish Gov­ern­ment around the con­tinu­ity of some form of CLLD with fur­ther fund­ing alloc­a­tions expec­ted for 2022⁄23. How­ever, oppor­tun­ity to access UK Gov­ern­ment fund­ing to replace EU losses still very unclear. Wider changes to agri-envir­on­ment schemes and impact of change also remains highly uncertain.	➡️	➡️	➡️
Staff­ing: addi­tion­al extern­ally fun­ded pro­jects strains staff work­load capa­city with increased risks of stress and reduced morale.	A9.3	DC	Pre­vent­at­ive: Stra­tegic and oper­a­tion­al plans for 2022⁄23 will be developed with extern­ally fun­ded pro­ject deliv­ery as intrins­ic ele­ments of plans to ensure deliv­ery capa­city is con­sidered fully. Import­ance of staff man­age­ment and task pri­or­it­isa­tion rein­forced through lead­er­ship meet­ings. Focus on few­er, lar­ger impact projects.	Addi­tion­al recruit­ment in 22⁄23 to alle­vi­ate key staff pres­sure points com­plete. Like­li­hood of risk there­fore declin­ing and risk pro­file there­fore redu­cing. Impact of meas­ures and risk pro­file will con­tin­ue to be closely mon­itored through staff man­age­ment processes.	⬆️	⬇️	⬇️
Resourcing: Role as Lead / Account­able body for major pro­grammes (e.g. LEAD­ER, Land­scape Part­ner­ship) has risk of sig­ni­fic­ant fin­an­cial claw­back should expendit­ure prove to be not eli­gible for fund­ing, while CNPA car­ries respons­ib­il­it­ies as employ­er for pro­gramme staff.	A11	1	DC	Pre­vent­at­ive: Ensure fin­an­cial con­trols in place for pro­gramme man­age­ment include effect­ive eli­gib­il­ity checks. Test pro­cesses with fun­ders if required and also under­take early intern­al audit checks. Work­force man­age­ment plans must incor­por­ate pro­gramme staff con­sid­er­a­tions. Ensure TGLP Man­age­ment and Main­ten­ance con­tracts are all in place to ensure eli­gib­il­ity of invest­ment. Remedi­al: Util­ise intern­al audit resources	Work has pro­gressed well on clos­ure of LEAD­ER, Tomin­toul and Glen­liv­et and on Badenoch pro­grammes with no issues arising to date. Some extern­al audit work con­tinu­ing on LEAD­ER and worth retain­ing sight of this as a stra­tegic risk to reflect scale of expos­ure des­pite long term low risk trend.	⬇️	⬇️	⬇️
Tech­nic­al: Increas­ing ICT depend­ency for effect­ive and effi­cient oper­a­tions is not adequately backed up by ICT sys­tems support.	A17	DC	Pre­vent­at­ive: invest in addi­tion­al staff resource. Deploy timetabled action plan against approved ICT Strategy. Enhance pro­ject man­age­ment approaches sup­port­ing ICT. Remedi­al: New ICT Strategy to be developed to reappraise pos­i­tion on IT depend­en­cies and estab­lish a focus for future digit­al devel­op­ment across the Author­ity. Clear action plan­ning to evolve from final ICT stra­tegic dir­ec­tion once agreed.	Added April 2018 Oper­a­tion­al Man­age­ment Group Move­ment into Microsoft 365 deploy­ment and cloud based sys­tems has involved sig­ni­fic­ant work and some dis­rup­tion to staff oper­a­tions. Intern­al audit work rein­forces need to focus on pro­ject man­age­ment of activ­it­ies both for man­age­ment of pro­cesses and improved organ­isa­tion­al communications.	➡️	➡️	➡️
Tech­nic­al: Cyber secur­ity is inad­equate to address risk of cyber-attack on systems	A18	DC	Pre­vent­at­ive: Imple­ment­a­tion of Scot­tish Gov­ern­ment Cyber Secur­ity Action Plans and intern­al audit recom­mend­a­tions on IT secur­ity. Ongo­ing review of sys­tems and pro­ced­ures in tan­dem with LLT­NPA. Rescope arrange­ments through IT Strategy. Invest in cyber secur­ity soft­ware Renewed staff training	Added by MT / OMG April 18. Addi­tion­al cyber secur­ity meas­ures inves­ted in and imple­men­ted. Aware of increased risks high­lighted by nation­al agen­cies dur­ing COV­ID response. Cyber secur­ity plus accred­it­a­tion being reapplied for. Review­ing options for fur­ther increased secur­ity measures.	⬆️	⬆️	⬆️
Resourcing: CNPA IT ser­vices are not suf­fi­ciently robust / secure / or well enough spe­cified to sup­port effect­ive and effi­cient ser­vice delivery.	A13	DC	Pre­vent­at­ive: We will devel­op and con­sult on the for­ward plans for ICT ser­vice devel­op­ment to ensure these meet ser­vice require­ments. Com­mis­sioned extern­al review of our IT and data man­age­ment pro­cesses to be imple­men­ted to give assur­ance, with recom­mend­a­tions arising acted upon.	Retained as a risk rather than merged into oth­er IT risks fol­low­ing May 2022 ARC review. Intern­al audit report on IT Strategy sets out key actions in this area of risk man­age­ment around IT Strategy devel­op­ment, pro­ject man­age­ment and cost­ing of IT action plans to be implemented.	➡️	➡️	➡️
Repu­ta­tion: One-off, high pro­file incid­ents and / or voci­fer­ous social media cor­res­pond­ents have an undue influ­ence on the Authority’s pos­it­ive reputation.	A14	GM	Pre­vent­at­ive: Engage­ment and com­mu­nic­a­tions strategy, and stake­hold­er engage­ment will seek to take the front foot on man­aging the Authority’s pos­it­ive, pub­lic repu­ta­tion Pre­vent­at­ive: pro­act­ive com­mu­nic­a­tions ini­ti­ated to address any poten­tial incid­ents Remedi­al: involve­ment in emer­ging NPUK col­lect­ive com­mu­nic­a­tions strategy and cam­paigns which will pro­duce addi­tion­al high pro­file pos­it­ive repu­ta­tion­al impact Remedi­al: Social media pro­file rep­res­ents an oppor­tun­ity to boost reputation.	Adop­ted by ARC Novem­ber 20 to con­sol­id­ate all repu­ta­tion­al risks. Recruit­ment now com­plete to sup­port this work with­in the com­mu­nic­a­tions team. Over­all sense of cur­rent pos­i­tion is a decline in this risk area, fol­low­ing responses to NPPP approv­al and wider com­mu­nic­a­tions work over sum­mer and autumn.	⬇️	⬇️	⬇️
Resourcing: scale of asset respons­ib­il­it­ies such as for paths, out­door infra­struc­ture is not adequately recog­nised and does not secure adequate for­ward main­ten­ance funding.	A16	DC	Remedi­al: Review of account­ing pro­ced­ures and asset recog­ni­tion policy; review of forth­com­ing account­ing tech­nic­al guid­ance. Ensure full con­sid­er­a­tion is giv­en in budget reviews. Pre­vent­at­ive: Cap­it­al bids to gov­ern­ment; altern­ate fund­ing sources such as vol­un­tary giv­ing to be explored more act­ively. Work on Stra­tegic Tour­ism Vis­it­or Infra­struc­ture Plan to focus action.	Added by MT / OMG April 18. Infra­struc­ture main­ten­ance issues exacer­bated by end of exist­ing agree­ments over key routes and by addi­tion­al COVID19 related vis­it­or pres­sures, while COV­ID has also dis­rup­ted plans around imple­ment­a­tion of vol­un­tary giv­ing schemes. Sig­ni­fic­ant increase in cap­it­al alloc­a­tion has allowed scope for increased pro­gram­ming of main­ten­ance over 2021 to 2025.	➡️	➡️	➡️
Resources: change in fin­an­cing IT ser­vices and the switch from cap­it­al to rev­en­ue pro­vi­sion places an unman­age­able pres­sure on the Authority’s budget capacity.	A20	DC	Remedi­al: Mon­it­or pat­tern of IT Invest­ment costs as regards the cap­it­al and rev­en­ue split of resourcing require­ments; build impacts into ongo­ing budget delib­er­a­tions with Scot­tish Government.	Added by Audit Com­mit­tee 8 March 2019 fol­low­ing ​“deep dive” IT risk review. Risk remains live as we imple­ment a refreshed ICT Strategy and move to more cloud / ser­vice solu­tions. While there was suf­fi­cient budget cov­er for the ini­tial imple­ment­a­tion of cloud based ser­vices in 21⁄22, the final pos­i­tion will crys­tal­lise over 22⁄23 and into the 23⁄24 budget.	➡️	➡️	➡️
Repu­ta­tion: the Author­ity is not per­ceived to be appro­pri­ately address­ing the poten­tial for con­flict between 4 stat­utory aims.	A21	GM	Pre­vent­at­ive: Ensure Board policy papers and Plan­ning Com­mit­tee papers are expli­cit in recog­nising stra­tegic policy con­flicts between 4 stat­utory aims and in address­ing the eval­u­ation of any poten­tial con­flict. Pre­vent­at­ive: ensure clar­ity on this mat­ter is estab­lished through high level NPPP and Cor­por­ate Plan documents	Added by Audit Com­mit­tee 8 March 2019 fol­low­ing intern­al audit report on stra­tegic plan­ning pro­cesses. NPPP devel­op­ment pro­cess now near­ing con­clu­sion where this can be under­pinned. Also part of con­sulta­tion on nation­al parks.	➡️	➡️	➡️
Tech­nic­al: Busi­ness Con­tinu­ity Plans (BCP) are inad­equate to deal with sig­ni­fic­ant impacts to nor­mal work­ing arrange­ments and res­ult in ser­vice failure.	A22	DC	Pre­vent­at­ive: Over­haul of BCP developed in 2014 with report­ing on devel­op­ment of plans through Man­age­ment Team and Audit and Risk Com­mit­tee. Test BCP arrange­ments once plan in place and com­mu­nic­ated. Remedi­al: intern­al audit review of COVID19 over winter 20⁄21 will lead into les­sons learned on wider BCP.	Added by Audit Com­mit­tee May 2019 fol­low­ing intern­al audit review of BCP. Delay in final­isa­tion of BCP doc­u­ment­a­tion itself as we focus on estab­lish­ment of hybrid work­ing arrange­ments post COV­ID. How­ever, work on BCP has con­sid­er­ably assisted in roll out of ini­tial and ongo­ing responses to Coronavir­us pan­dem­ic with evid­ence, includ­ing very pos­it­ive staff feed­back, that BCP imple­ment­a­tion has been effective.	➡️	➡️	➡️
Tech­nic­al: the Authority’s range of powers com­bined with stra­tegic part­ner­ships is insuf­fi­cient to deliv­er out­comes on wild­life crime	A24	AF	Remedi­al: use NPPP devel­op­ment pro­cesses to explore part­ner­ship atti­tudes, engage­ment and powers which they may add to the cur­rent con­trols. Pre­vent­at­ive: explore poten­tial for licen­cing or oth­er reg­u­lat­ory arrange­ments to con­trib­ute to more effect­ive con­trol frame­work; Track­er / satel­lite mon­it­or­ing deployment;	Added by SMT risk review May 2021 Mit­ig­a­tion actions still in devel­op­ment stages and risk pro­file retained.	⬇️	⬇️	⬇️
Tech­nic­al: The Authority’s Peat­land Pro­gramme out­comes may be adversely impacted by a lack of con­tract­or capacity	A25	AF	Pre­vent­at­ive: inter­ac­tion with skills and eco­nom­ic devel­op­ment agen­cies to high­light the prob­lems of con­tract­or capa­city and scale of future pro­gramme; Remedi­al: phas­ing of works to act on more straight­for­ward, less tech­nic­al areas to assist new con­tract­ors enter mar­ket and devel­op skills and under­stand­ing; repro­file cap­it­al expendit­ure to recog­nise more expens­ive, more com­plex pro­jects com­ing toward end of fund­ing period.	Added by SMT risk review May 2021 Recent evid­ence sug­gests increased level of response to peat­land tenders and evid­ence of some new entrants to this mar­ket. Some ongo­ing evid­ence of suc­cess of risk mit­ig­a­tion meas­ures, with pro­gramme on tar­get for deliv­ery of area of res­tor­a­tion for second year in succession.	⬆️	⬇️	⬇️
Repu­ta­tion­al: key com­mu­nic­a­tions activ­it­ies, mes­saging and (in some cases) brand aware­ness rais­ing can be depend­ent on part­ner col­lab­or­a­tion rather than under dir­ect con­trol, with poten­tial for inef­fect­ive com­mu­nic­a­tion outcomes.	A26	GM	Pre­vent­at­ive: agree part­ner­ship frame­works that expli­citly set out expect­a­tions and out­comes of col­lab­or­at­ive activ­it­ies and estab­lish adequate con­trol mech­an­isms; Pre­vent­at­ive: spe­cific­ally mon­it­or and feed­back on com­mu­nic­a­tions effect­ive­ness where there are part­ner­ship depend­en­cies Remedi­al: con­duct review meet­ings which track and doc­u­ment pro­gress and escal­ate and issues arising to appro­pri­ate gov­ernance groups. Remedi­al: review brand man­age­ment and approaches to part­ner­ship link­ages through brand	Added by SMT risk review May 2021. Iden­ti­fied as a stable risk at present rather than escal­at­ing, while recog­nised that work remains to be under­taken around these pre­vent­at­ive and remedi­al mit­ig­a­tion measures.	➡️	➡️	➡️
Tech­nic­al: approaches to con­ser­va­tion and pro­tec­tion of endangered spe­cies may be insuf­fi­cient to achieve asso­ci­ated stra­tegic outcomes	A27	AF	Remedi­al: review cur­rent approaches in con­text of rel­ev­ant data sources to determ­ine adequacy of cur­rent approaches. Remedi­al: use NPPP devel­op­ment pro­cesses to test poten­tial for enhanced / revised approaches to con­ser­va­tion and pro­tec­tion of endangered species	Added by SMT risk review May 2021. Iden­ti­fied as a stable risk at present rather than escal­at­ing, while recog­nised that work remains to be under­taken or is ongo­ing around these pre­vent­at­ive and remedi­al mit­ig­a­tion measures.	➡️	➡️	➡️
Staff­ing: deliv­ery of key out­comes is impacted by staff turnover, par­tic­u­larly in pro­ject teams.	A28	DC	Pre­vent­at­ive: con­sider HR solu­tions to encour­age reten­tion Remedi­al: ensure suc­ces­sion plan­ning and oper­a­tion­al risk registers cov­er this stra­tegic risk	Added fol­low­ing Board reflec­tion on impact of turnover in TGLP Pro­ject. Some ongo­ing staff turnover con­tinu­ing to impact areas of deliv­ery and risk pro­file maintained.	⬆️	⬆️	⬆️
Staff­ing: increas­ingly com­pet­it­ive and restric­ted recruit­ment cli­mate pre­vents staff with the required exper­i­ence and skill sets being secured	A29	DC	Pre­vent­at­ive: focus on train­ing and devel­op­ment and intern­al suc­ces­sion plan­ning, in turn bring­ing recruit­ment into less exper­i­enced / less highly skilled mar­kets; con­sider job design and flex­ib­il­ity of offer regard­ing part-time / job share. Remedi­al: con­tin­gency plan­ning for example around out-sourcing of aspects of delivery.	Added by SMT review 18 Jan. Evid­ence of redu­cing num­ber of applic­ants and can­did­ate lists for vacan­cies and emer­ging trend in unsuc­cess­ful recruit­ment exercises.	➡️	➡️	➡️

Notes:

• Aim­ing to keep stra­tegic risk register to around 15 stra­tegic risks
• Cross-cut­ting risks impact poten­tially through­out all priorities
• Stra­tegic Risks around cor­por­ate pri­or­it­ies focus on risk impacts through­out each of the three themes – hence require a coordin­ated over­view at Dir­ect­or / Exec­ut­ive level. Not expect­ing a stra­tegic risk against each spe­cif­ic Cor­por­ate Plan priority.
• More spe­cif­ic risks are expec­ted to be cap­tured in more oper­a­tion­al risk registers – e.g. risk man­age­ment around deliv­ery of office extension.

Full risk register the col­lect­ive respons­ib­il­ity of full MT to man­age, how­ever each risk alloc­ated to one spe­cif­ic mem­ber of the team to take lead responsibility.

Aim through mit­ig­a­tion to reduce Like­li­hood (LL) mul­ti­plied by Impact (IM) risk score to below 10 as accept­able risk value.

Ref­er­ence key: ​“A” items are risks impact­ing on all aspects of the Cor­por­ate Plan; ​“C” items are Con­ser­va­tion only risks; ​“V” risks relate spe­cific­ally to Vis­it­or Exper­i­ence; ​“L” risk relate to Land Man­age­ment; ​“R” risks relate to Rur­al Devel­op­ment risks.

Key

• Man­aged risk (green down­ward arrow in greyed-out field): risk assess­ment that risk is effect­ively man­aged and no longer a stra­tegic risk pos­ing poten­tial to inhib­it achieve­ment of cor­por­ate stra­tegic object­ives. Risk can be removed from risk register.
• Lower­ing risk (green down­ward arrow): risk impact and / or like­li­hood is declin­ing res­ult­ing in over­all stra­tegic risk assess­ment of mit­ig­a­tion actions effect­ive with ongo­ing mon­it­or­ing of risk envir­on­ment still required.
• Increas­ing risk low to medi­um: Stra­tegic risk pre­vi­ously assessed as low now assessed as escal­at­ing, with increased like­li­hood and / or impact as a con­sequence of change in stra­tegic envir­on­ment and / or iden­ti­fic­a­tion of new risk implic­a­tions. May mer­it revised mit­ig­a­tion action.
• Stat­ic risk (amber hori­zont­al arrow): risk impact and like­li­hood is stable. Over­all stra­tegic risk assess­ment is stable indic­at­ing that stra­tegic risk remains, requir­ing ongo­ing man­age­ment and con­tin­ued imple­ment­a­tion of pro­posed mit­ig­a­tion and controls.
• Decreas­ing risk from High to medi­um level (amber down­ward arrow). Stra­tegic risk pre­vi­ously assessed as high now assessed as hav­ing reduced like­li­hood and / or impact as a con­sequence of risk mit­ig­a­tion action.
• Increas­ing risk (red upward arrow): risk impact and / or like­li­hood is increas­ing res­ult­ing in increas­ing risk of achieve­ment of stra­tegic object­ives being inhib­ited. Man­age­ment action, and pos­sibly resource invest­ment, required to address risk envir­on­ment and pos­sibly intro­duce new mit­ig­a­tion action, in order to reduce risk impact and / or likelihood.

Ver­sion Control

3 Board Cycle Decem­ber 2019 3.0 Board adop­ted ver­sion June 2019 for MT / OMG review 3.1 Audit Com­mit­tee review 6 Septem­ber 2019 3.2 Man­age­ment Team Novem­ber 2019 4 Board Cycle Jan to Jun 2020 4.0 Draft fol­low­ing Board con­sid­er­a­tion Decem­ber 2019 4.1 To Audit and Risk Com­mit­tee March 2020 5 Board Cycle July to Sep 2020 5.1 Sep 20 Board meet­ing draft for MT / OMG review 5.2 Sep 20 Board meet­ing fol­low­ing MT / OMG edits (WBW) 6 Board Cycle Octo­ber 20 to Decem­ber 20 6.1 ARC Novem­ber 20 first draft 7 Board Cycle Janu­ary to June 2021 7.0 ARC April 2021 and SMT May 2021 7.1 Board June 2021 8 Board Cycle Decem­ber 2021 8.0 To SMT 24 Aug 21 8.1 SMT 24 Aug 21 Updates 8.2 SMT 18 Jan 22 review and updated 8.3 ARC review 11 Feb 22 9 Board Cycle March 2022 9.0 Draft for Board fol­low­ing ARC review 9.1 SMT Review May 22 10.1 SMT review Nov 22 pri­or to ARC 5 Dec 10.2 ARC present­a­tion fol­low­ing SMT review 22 Nov.