Cairngorms Nation­al Park Authority

Intern­al Audit Report

Man­age­ment Action Fol­low-up – ²⁰²²⁄₂₃

May 2023

Con­tents:

• Intro­duc­tion and back­ground (page 1)
• Sum­mary of pro­gress (page 2)
• Appendix 1: Action status by report (page 4)
• Appendix 2: Sum­mary of out­stand­ing actions past their cur­rent due date (page 6)
• Appendix 3: Audit risk cat­egor­isa­tions (page 21)

---

Intro­duc­tion and background

Intro­duc­tion:

As part of the intern­al audit pro­gramme we have under­taken a fol­low up review to provide the Audit & Risk Com­mit­tee with assur­ance that man­age­ment actions agreed in pre­vi­ous intern­al audit reports have been imple­men­ted appro­pri­ately. This report sum­mar­ises the pro­gress made by man­age­ment in imple­ment­ing agreed man­age­ment actions.

Scope:

We have reviewed all open man­age­ment actions and liaised with Cairngorm Nation­al Park Author­ity staff to obtain an update on their imple­ment­a­tion pro­gress. This included man­age­ment identi­fy­ing actions which were no longer applic­able. For recom­mend­a­tions graded pri­or­ity 3 or above, we request evid­ence to val­id­ate com­ple­tion of any actions marked for clos­ure by management.

For all actions raised by the pri­or Intern­al Aud­it­or (BDO) we have aligned their risk assess­ments to the Azets risk grad­ing struc­ture (per Appendix 3).

Action for Audit & Risk Committee:

The Com­mit­tee is asked to note the pro­gress made by man­age­ment in imple­ment­ing agreed man­age­ment actions. The Com­mit­tee is also asked to con­sider and approve those actions for which revised times­cales have been provided by man­age­ment (these are detailed at Appendix 2).

---

Sum­mary of progress:

The table below shows the move­ment in the audit actions in the peri­od from Novem­ber 2022 to May 2023:

Num­ber of Actions
Open actions brought forward	41
Actions com­plete pending evid­ence (not yet received)	3
Actions added to tracker	2
Total actions to follow-up	46
Actions closed	5
Actions super­seded	6
Actions com­plete pending evidence	7
Open actions car­ried forward	28

Status of Actions as at May 2023:

(Pie chart show­ing the fol­low­ing data)

• Com­plete: 7
• Super­seded: 5
• Com­plete pending evid­ence: 6
• Par­tially Com­plete: 4
• Incom­plete: 17
• Not Yet Due: 7

We have con­firmed that five actions (11%) were com­peted in the peri­od to May 2023, with a fur­ther sev­en com­plete pending the pro­vi­sion of evid­ence (15%) and six super­seded (13%). Four actions (9%) have been assessed as par­tially com­plete, 17 (37%) are incom­plete and sev­en actions (15%) were not yet due at the time of our val­id­a­tion work. We did not receive updates on a num­ber of out­stand­ing actions, in these instances the actions were assessed in line with the pre­vi­ous assess­ment made or marked as incomplete.

Fur­ther detail on all actions that have passed their cur­rent due dates for com­ple­tion is included at Appendix 2.

We recom­mend that man­age­ment retain a strong focus on clear­ing aged items in the com­ing months. We recom­mend pri­or­it­ising the most aged items, dat­ing back to ²⁰¹⁶⁄₁₇, and those that are grade 3 and grade 4. Atten­tion should then be paid to those remain­ing actions that have passed their ori­gin­al due date and those which will pass their due date for com­ple­tion over the next period.

A sum­mary of the status of actions by report is shown at Appendix 1.

---

Appendix 1: Action status by report:

(Table show­ing the fol­low­ing data. The table spans two pages in the ori­gin­al doc­u­ment. Data has been com­bined here for clarity.)

Report Title	Com­plete	Com­plete Pending Evid­ence	NLA	Par­tially Com­plete	Incom­plete	Not Yet Due	Total
Fin­an­cial Processes	1	0	0	0	0	0	1
Grant Fund­ing & Management	1	0	0	0	0	0	1
2016⁄17 sub total	2	0	0	0	0	0	2
Part­ner­ship Management	1	0	0	0	0	1	2
Busi­ness Con­tinu­ity Planning	0	0	0	0	1	1	2
2018⁄19 sub total	1	0	0	0	1	1	3
Payroll Admin­is­tra­tion	2	0	0	0	0	0	2
Risk Man­age­ment	0	0	0	0	1	0	1
Expense Claims Process	1	0	0	0	0	0	1
Staff Object­ives Set­ting & Appraisal	0	0	0	0	1	0	1
FOISA and FIR Requests	0	0	0	0	1	1	2
2019⁄20 sub total	2	0	0	0	2	2	7
COV­ID Recovery	0	2	0	0	0	0	2
Cor­por­ate Governance	1	0	0	0	0	0	1
Data Man­age­ment	0	0	0	0	1	1	3
2020⁄21 sub total	1	2	0	0	1	1	6
LEAD­ER Programme	1	0	0	0	0	0	1
Fin­an­cial Man­age­ment and Reporting	0	0	0	1	1	0	2
Assur­ance Map­ping of Major Projects	1	0	0	0	0	0	1
Cyber Secur­ity Review	1	0	0	0	2	0	3
ICT Strategy	0	0	0	0	3	1	4
Peat­land Action Pro­gramme Set Up	1	4	3	0	1	0	9
2021⁄22 sub- total	2	4	3	1	9	1	20
LEAD­ER Programme	0	0	0	0	1	1	2
Per­form­ance Management	0	0	0	0	2	0	2
Work­force Man­age­ment and Planning	0	0	0	0	2	0	2
Data Man­age­ment	0	0	0	0	1	1	2
2022⁄23 sub- total	0	0	0	0	4	2	8
Grand totals	5	7	6	4	17	7	46

---

Appendix 2: Sum­mary of out­stand­ing actions past their cur­rent due date:

(Table show­ing the fol­low­ing data. The table spans sev­er­al pages in the ori­gin­al doc­u­ment. Data has been com­bined here for clarity.)

Report / Action	Recom­mend­a­tion	Action Own­er	Grade	Ori­gin­al Times­cale	Revised Times­cale	Update May 2023	Status
2016⁄17 Fin­an­cial Processes	We recom­mend that the Fin­ance Man­age­ment sched­ule is updated to provide detailed policies and guid­ance on all fin­an­cial pro­cesses. These should be reviewed on an annu­al basis. (etc.)	Fin­ance Manager	Low (1)	Jun-17	Dec-22	No update provided.	Incom­plete
2016⁄17 Grant Fund­ing and Management	We recom­mend that the Grant Toolkit is com­pleted, encom­passing all pro­cesses in place for the award­ing, record­ing and mon­it­or­ing of grant fund­ing. (etc.)	Dir­ect­or of Cor­por­ate Services	Medi­um (2)	Sep-2017	Mar-23	No update provided.	Incom­plete
2019⁄20 Payroll Administration	We recom­mend that CNPA con­duct a reg­u­lar peer review of the desk instruc­tions to ensure that they remain accur­ate and up to date. (etc.)	Dir­ect­or of Cor­por­ate Ser­vices or Head of Organ­isa­tion­al Development	Low (1)	Apr-20	Dec-22	Com­pleted.	Com­plete pending evidence
2019⁄20 Payroll Administration	It is our recom­mend­a­tion that the Author­ity invest­ig­ate the poten­tial for mak­ing use of auto­mat­ic excep­tion report­ing. (etc.)	Payroll and Fin­ance Officer	Low (1)	Mar-20	Dec-22	Com­pleted.	Com­plete pending evidence
2019⁄20 Staff Object­ive Set­ting and Appraisal	We recom­mend that line man­agers are reminded of the import­ance of prop­erly record­ing their review and approv­al of job plans. (etc.)	Head of Organ­isa­tion­al Development	Low (1)	Ongo­ing	Mar-23	No update provided.	Incom­plete
2020⁄21 Data Management	We recom­mend that the Author­ity ensure that data audits are con­duc­ted annu­ally in line with the policy. (etc.)	Head of Organ­isa­tion­al Development	Medi­um (3)	May-21	Mar-24	The appoint­ment of our new Inform­a­tion Man­ager provides the oppor­tun­ity to revis­it this work. (etc.)	Incom­plete
2020⁄21 Data Management	We recom­mend that once the Author­ity have received the feed­back from their DPOaaS pro­vider, they cre­ate a sub­ject access request pro­ced­ure, (etc.)	Office Ser­vices Manager	Medi­um (3)	Jun-21		Updated and imple­men­ted. No fur­ther DSAR requests received.	Com­plete pending evidence
2021⁄22 Assur­ance Map­ping of Major Projects	Man­age­ment should put in place a pro­ject plan for imple­ment­a­tion of the new pro­ject man­age­ment approach. (etc.)	Gov­ernance and Report­ing Manager	Medi­um (2)	Sep-22		No update provided.	Incom­plete
2021⁄22 Cyber Secur­ity Review	We recom­mend that CNPA should per­form a risk assess­ment as well as a gap ana­lys­is of the cur­rent tech­no­logy, policy and busi­ness envir­on­ment, to identi­fy the key cyber secur­ity risks. (etc.)	Inform­a­tion Sys­tems Manager	Medi­um (3)	Aug-22	Sept 23	While we are mind­ful of risks as part of the course of our day-to-day man­age­ment of our IT resources, there has been a lack of form­al­ity in record­ing these risks. (etc.)	Incom­plete
2021⁄22 Cyber Secur­ity Review	We recom­mend that CNPA estab­lish pro­ced­ures for hand­ling cyber secur­ity events. (etc.)	Inform­a­tion Sys­tems Manager	Medi­um (2)	Dec-22		No update provided.	Incom­plete
2021⁄22 Fin­an­cial Man­age­ment and Reporting	Man­age­ment should doc­u­ment and com­mu­nic­ate the fin­an­cial respons­ib­il­it­ies of staff with fin­an­cial author­ity, ensur­ing that all staff form­ally acknow­ledge their responsibilities.	Fin­ance Man­ager and Fin­an­cial Accountant	Medi­um (2)	Jun-22	Mar-23	No update provided.	Par­tially Complete
2021⁄22 Budget Man­age­ment Policy	Recom­mend­a­tion agreed. Will be developed, approved and cir­cu­lated to rel­ev­ant staff.	Fin­ance Man­ager and Fin­an­cial Accountant	Medi­um (2)	Sep-22		No update provided.	Incom­plete
2021⁄22 ICT Strategy	We recom­mend that annu­al oper­a­tion­al plans are developed which sets out a work­plan for each fin­an­cial year. (etc.)	Inform­a­tion Sys­tems Man­ager and Head of Finance	Medi­um (3)	Jun-22	June 23	The IT oper­a­tion­al plan will, in future, fol­low nat­ur­ally from the ICT strategy. (etc.)	Incom­plete
2021⁄22 ICT Strategy	We recom­mend that man­age­ment expli­citly doc­u­ment approvals of strategies with­in minutes of meet­ings. (etc.)	Dir­ect­or of Cor­por­ate Services	Medi­um (2)	Mar-23		No update provided.	Incom­plete
2021⁄22 ICT Strategy	We recom­mend that the action plan with­in the IT and Data Strategy is updated to include action own­ers and deliv­ery dates. (etc.)	Pro­ject plan = Inform­a­tion Sys­tems Man­ager, New IT Data Strategy = Dir­ect­or of Cor­por­ate Services	Medi­um (3)	Pro­ject Plan — Jun-22, Data Strategy — Sep-22	Dec 23	The Authority’s stra­tegic approach to ICT is under con­sid­er­a­tion. (etc.)	Incom­plete
2021⁄22 LEAD­ER Programme	Man­age­ment should ensure that feed­back on CNPA intern­al pro­cesses is obtained and, where appro­pri­ate, fed into Scot­tish Gov­ern­ment reviews on pro­gramme pro­cesses. (etc.)	LEAD­ER Pro­gramme Manager	Medi­um (2)	Mar-22	Apr-23	No update provided.	Incom­plete
2021⁄22 Peat­land Action Pro­gramme Set Up	Man­age­ment should doc­u­ment the scheme require­ments, ensur­ing that this is rep­res­ent­at­ive of the arrange­ments cur­rently in place or in devel­op­ment, and com­mu­nic­ate these clearly to staff.	Head of Ser­vice, Land Man­age­ment, with Peat­land Action Pro­gramme Managers	Medi­um (3)	Nov-22	Aug 23	This require­ment is par­tially imple­men­ted. (etc.)	Par­tially Complete
2021⁄22 Peat­land Action Pro­gramme Set Up	Man­age­ment should doc­u­ment the risks asso­ci­ated with the full-ser­vice approach and put mit­ig­at­ing con­trols in place to man­age this with­in the risk appetite/​tolerance of the CNPA Board. (etc.)	Dir­ect­or of Nature and Cli­mate Change	High (4)	Leg­al advice — Dec-22, Risk Map and action plan — Dec-22		This require­ment is par­tially imple­men­ted. (etc.)	Par­tially Complete
2021⁄22 Peat­land Action Pro­gramme Set Up	CNPA should ensure the con­sist­ent treat­ment of Pri­or Noti­fic­a­tion costs, mean­ing that those should be reim­bursed if incurred by CNPA and appro­pri­ately reflec­ted in grant offer letters.	Peat­land Action Pro­gramme Managers	Medi­um (2)	Nov-22		No update provided.	Incom­plete
2021⁄22 Peat­land Action Pro­gramme Set Up	Man­age­ment should devel­op a com­mu­nic­a­tions strategy for the pro­gramme, includ­ing a review of the CNPA web­site and aware­ness rais­ing activ­it­ies for the Peat­land Action Pro­gramme and con­sider how the work to identi­fy peat­land sites will inform the com­mu­nic­a­tion activ­it­ies under­taken. (etc.)	Head of Land Management	Medi­um (3)	Apr-23		This require­ment has been fully implemented.	Com­plete Pending Evidence
2021⁄22 Peat­land Action Pro­gramme Set Up	Man­age­ment should final­ise and imple­ment the fund­ing cri­ter­ia for applic­a­tion apprais­als. (etc.)	Peat­land Action Pro­gramme Managers	Medi­um (3)	Mar-23		This require­ment has been fully implemented.	Com­plete Pending Evidence
2021⁄22 Peat­land Action Pro­gramme Set Up	CNPA should ensure that the min­im­um con­trols, pro­cesses and doc­u­ment­a­tion iden­ti­fied below are in place and being used. Detail in report.	Head of Ser­vice with Peat­land Action Managers	High (4)	Feb-22	Aug 23	This require­ment has been par­tially imple­men­ted. (etc.)	Par­tially Complete
2021⁄22 Peat­land Action Pro­gramme Set Up	Man­age­ment should imple­ment a gov­ernance struc­ture which is able to dir­ect the stra­tegic dir­ec­tion of the pro­gramme and provide assur­ance over the deliv­ery of pro­gramme. (etc.)	Dir­ect­or of Nature and Cli­mate Change with Head of Land Management	Medi­um (2)	Nov-22		This require­ment is fully implemented.	Com­plete Pending Evidence
2021⁄22 Peat­land Action Pro­gramme Set Up	Man­age­ment should update the pro­gramme mon­it­or­ing tools to provide suf­fi­cient inform­a­tion to man­age the pro­gramme effect­ively includ­ing detail­ing pro­gress with each of the stages with­in the core grant pro­cess for each pro­ject. (etc.)	Peat­land Action Pro­gramme Managers	Medi­um (3)	Oct-22		This require­ment is fully implemented.	Com­plete Pending Evidence
2022⁄23 Data Management	In line with the update of policies and iden­ti­fic­a­tion of require­ments recom­men­ded in MAP 1.1, we recom­mend that CNPA estab­lishes a cloud migra­tion strategy or plan which takes into account how these require­ments will be met by Share­Point and the actions required to con­fig­ure the solu­tion to do so. (etc.)	Deputy Chief Exec­ut­ive, as seni­or spon­sor of the Share­Point Trans­ition Pro­ject and over­sight of wider organ­isa­tion­al devel­op­ment work required	Medi­um (3)	Apr-23		No update provided.	Incom­plete
2022⁄23 LEAD­ER Programme	For oth­er grant pro­grammes CNPA should ensure that decisions taken which vary from stand­ard pro­cesses are clearly doc­u­mented includ­ing the approv­al route for the decision being made. (etc.)	Com­munity Grants Manager	Medi­um (2)	Dec-22		No update provided.	Incom­plete
2022⁄23 Per­form­ance Management	We sup­port management’s approach to devel­op­ing a dash­board to sup­port more fre­quent scru­tiny and chal­lenge by seni­or man­age­ment. (etc.)	Gov­ernance, Data and Report­ing Manager	Medi­um (2)	Dec-22		No update provided.	Incom­plete
2022⁄23 Per­form­ance Management	Whilst devel­op­ing the new cor­por­ate plan, man­age­ment should ensure that this is sup­por­ted by a suf­fi­cient mix of qual­it­at­ive and quant­it­at­ive meas­ures and indic­at­ors that clearly define the pro­posed out­come of the activ­it­ies being under­taken. (etc.)	Gov­ernance, Data and Report­ing Manager	Medi­um (2)	Mar-23		No update provided.	Incom­plete

---

Appendix 3: Audit risk categorisations

Man­age­ment action grades:

• 4: Very high risk expos­ure — major con­cerns requir­ing imme­di­ate seni­or atten­tion that cre­ate fun­da­ment­al risks with­in the organisation.
• 3: High risk expos­ure — absence / fail­ure of key con­trols that cre­ate sig­ni­fic­ant risks with­in the organisation.
• 2: Mod­er­ate risk expos­ure — con­trols are not work­ing effect­ively and effi­ciently and may cre­ate mod­er­ate risks with­in the organisation.
• 1: Lim­ited risk expos­ure — con­trols are work­ing effect­ively, but could be strengthened to pre­vent the cre­ation of minor risks or address gen­er­al house­keep­ing issues.

---

Azets 2023. All rights reserved. Azets refers to Azets Audit Ser­vices Lim­ited. Registered in Eng­land & Wales Registered No. 09652677. VAT Regis­tra­tion No. 219 0608 22.

Registered to carry on audit work in the UK and reg­u­lated for a range of invest­ment busi­ness activ­it­ies by the Insti­tute of Chartered Account­ants in Eng­land and Wales.