Cairngorms Nation­al Park Author­ity Intern­al Audit Report ²⁰²³⁄₂₄

Her­it­age Horizons

Novem­ber 2023

---

Page 1:

(Image of Azets logo and report title)

---

Page 2:

Cairngorms Nation­al Park Authority Intern­al Audit Report ²⁰²³⁄₂₄ Her­it­age Horizons

• Exec­ut­ive Sum­mary: 1
• Man­age­ment Action Plan: 4
• Appendix A – Defin­i­tions: 9

Audit Spon­sor	Key Con­tacts	Audit team
Dav­id Camer­on, Deputy Chief Executive	Dav­id Clyne, Head of Programme	Eliza­beth Young, Partner
	Jenny Allen, Pro­gramme Manager	Stephanie Hume, Seni­or Audit Manager
		Hatice Kiz­il, Assist­ant Manager

---

Page 3:

Exec­ut­ive Summary

Con­clu­sion

We have con­firmed the Cairngorms Nation­al Park Author­ity Her­it­age Hori­zons Pro­gramme has clear gov­ernance and report­ing arrange­ments in place, with estab­lished report­ing struc­tures to provide timely updates to man­age­ment and to the board. We also note man­age­ment are in the pro­cess of mov­ing to MS pro­ject to ensure all pro­ject inform­a­tion is in one place.

We iden­ti­fied some oppor­tun­it­ies to improve report­ing by provid­ing fur­ther details on risks, assump­tions, issues and depend­en­cies, KPIs and pro­gress against budget. This is par­tic­u­larly key with the pro­gramme poten­tially mov­ing into the deliv­ery phase from Janu­ary 2024.

Back­ground and scope

The Her­it­age Hori­zons pro­gramme has been cre­ated to put the power to tackle the cli­mate and nature crises in the hands of people who live, vis­it and work in the nation­al park.

Across 20 long-term pro­jects, Her­it­age Hori­zons will bring about trans­form­a­tion­al change in the Cairngorms, bene­fit­ting people’s health and well­being, deliv­er­ing on cli­mate change and enhan­cing nature across the Nation­al Park. The pro­gramme is on a lar­ger scale than any­thing pre­vi­ously attemp­ted in the UK through Nation­al Lot­tery Her­it­age Fund­ing sup­port and aims to inspire rur­al and urb­an com­munit­ies through­out Scot­land and bey­ond to take action and make a difference.

In par­tic­u­lar Her­it­age Hori­zons will focus on:

• Pro­jects for empower­ing communities.
• Pro­jects for improv­ing travel connectivity.
• Pro­jects for restor­ing land­scapes; and
• Pro­jects for improv­ing people’s health and wellbeing.

Her­it­age Hori­zons uses Nation­al Lot­tery Her­it­age Funds to sup­port over 45 part­ner­ships. In order to ensure that the Her­it­age Hori­zons pro­gramme is suc­cess­fully launched and delivered, it is cru­cial that there are suit­able gov­ernance and report­ing over­sight in place.

In accord­ance with the 2023/2024 Intern­al Audit Plan, we reviewed the gov­ernance and report­ing arrange­ments for the Her­it­age Hori­zons pro­gramme. This included ensur­ing pro­cesses are suit­able for the deliv­ery phase of the pro­gramme and that les­sons learned from the devel­op­ment phase have been implemented.

---

Page 4:

Con­trol assessment

1. The gov­ernance and report­ing arrange­ments for all stages of the Her­it­age Hori­zons pro­gramme are clearly doc­u­mented, with reg­u­lar report­ing to man­age­ment and the Board. (Green)
2. Pro­gramme report­ing includes updates on over­all pro­gress and part­ner­ship activ­it­ies along­side budget, actu­al spend, fore­cast out­turn and risk iden­ti­fic­a­tion. (Amber)
3. There is a clear pro­ject plan in place for the deliv­ery phase of the pro­gramme that has been reviewed and approved through the gov­ernance struc­ture. (Green)
4. CNPA has pro­cesses which to cap­ture les­sons learned for inclu­sion in the deliv­ery phase of the Her­it­age Hori­zons pro­gramme. (Yel­low)

(Image of a traffic light chart)

Improve­ment actions by type and priority

(Image of a bar chart)

Two improve­ment actions have been iden­ti­fied from this review, one of which relates to com­pli­ance with exist­ing pro­ced­ures, rather than the design of con­trols them­selves. See Appendix A for defin­i­tions of col­our coding.

---

Page 5:

Key find­ings

Good prac­tice

• The gov­ernance and report­ing arrange­ments for the Her­it­age Hori­zons Pro­gramme are clearly doc­u­mented with­in the full pro­gramme report, detail­ing roles and respons­ib­il­it­ies of rel­ev­ant parties. This ensures that updates on indi­vidu­al pro­jects pro­gress are fed into the over­all pro­gramme reporting.
• Her­it­age Hori­zons Pro­gramme con­sists of 20 pro­jects. We con­firmed that all the indi­vidu­al pro­ject plans have been developed, reviewed and were included in the bid sub­mis­sion to Nation­al Lot­tery Her­it­age Fund in August 2023.
• Quarterly pro­gramme update reports are used to mon­it­or pro­gramme pro­gress and risks. There is a clear review approv­al pro­ced­ure in place to provide scru­tiny of inform­a­tion cascaded.

Areas for improvement

We have iden­ti­fied two areas for improve­ment which, if addressed, would strengthen the Cairngorm Nation­al Park Authority’s con­trol frame­work. These are:

• Updat­ing pro­ject reports to include pro­gress updates on risks, assump­tions, issues and depend­en­cies, pro­ject spend­ing again budget and KPIs.
• Devel­op­ing pro­cesses and tem­plates to ensure les­sons learned at pro­ject level are doc­u­mented and shared with key internal/​external stake­hold­ers through­out the deliv­ery phase.

These are fur­ther dis­cussed in the Man­age­ment Action Plan below.

Impact on risk register

The Cairngorm Nation­al Park Author­ity cor­por­ate risk register (as at Janu­ary 2023) included the fol­low­ing risks rel­ev­ant to this review:

• Risk A1: Resources- pub­lic sec­tor fin­ances con­strain capa­city to alloc­ate suf­fi­cient resources to deliv­er cor­por­ate plan.

We have not iden­ti­fied any issues dur­ing the course of our field­work which would require an update to the cur­rent risk register.

Acknow­ledge­ments

We would like to thank all staff con­sul­ted dur­ing this review for their assist­ance and co-operation.

---

Page 6:

Man­age­ment Action Plan

Con­trol Object­ive 1: The gov­ernance and report­ing arrange­ments for all stages of the Her­it­age Hori­zons pro­gramme are clearly doc­u­mented, with reg­u­lar report­ing to man­age­ment and the board. (Green)

No weak­nesses identified

We were provided with a copy of the full Her­it­age Hori­zons Pro­gramme report which clearly details the gov­ernance and report­ing arrange­ments in place for the programme.

The Cairngorms 2030 pro­gramme has a six-tier gov­ernance struc­ture as follows:

• Park Author­ity Board and Per­form­ance Committee
• Cairngorms 2030 Pro­gramme Board (meet­ing quarterly): reports on a quarterly basis to the Cairngorm Nation­al Park Author­ity Per­form­ance Com­mit­tee and annu­ally to the full Board. It will also report as required to the Audit and Risk Committee.
• Pro­gramme Man­age­ment Group (meet­ing monthly): con­sists of the Park Authority’s Exec­ut­ive Man­age­ment Team. It mon­it­ors stra­tegic and oper­a­tion­al per­form­ance and risk.
• Theme Leads (meet­ing monthly): con­sists of Park Author­ity man­agers with line man­age­ment respons­ib­il­ity for co-ordin­at­ing pro­ject delivery.
• Com­mu­nic­a­tions and Engage­ment Group (meet­ing monthly): con­sists of the Park Author­ity man­agers and staff respons­ible for effect­ively co-ordin­at­ing Cairngorms 2030 com­mu­nic­a­tions and engage­ment activ­it­ies. It will meet at least monthly and more fre­quently dur­ing peak engage­ment periods.
• Pro­ject teams (meet­ing bi-weekly): con­sist of Park Author­ity man­agers and pro­ject staff respons­ible for pro­ject delivery.

We con­firmed man­age­ment have con­sidered the work­force require­ments for the deliv­ery phase and new posts were iden­ti­fied to deliv­er from Janu­ary 2024. We were advised that there will be an intern­al round of recruit­ment in Novem­ber 2023 and if all posts can’t be filled intern­ally, then an extern­al recruit­ment will take place in Janu­ary to ensure all staff­ing needs addressed by March 2024.

We were provided examples of reports includ­ing a copy of quarterly update report to the Theme Leads and a copy of report to Pro­gramme Board. The Head of Pro­gramme advised that ongo­ing mon­it­or­ing will remain broadly sim­il­ar to the devel­op­ment phase, how­ever, will refine report­ing using Microsoft Pro­ject report­ing tools. This is expec­ted to include integ­ra­tion with fin­an­cial sys­tem and records man­age­ment sys­tem to stream­line cor­por­ate reporting.

The Head of Pro­gramme con­firmed that the above struc­ture and report­ing iden­ti­fied above will con­tin­ued to be imple­men­ted dur­ing the deliv­ery phase.

---

Page 7:

Con­trol Object­ive 2: Pro­gramme report­ing includes updates on over­all pro­gress and part­ner­ship activ­it­ies along­side budget, actu­al spend, fore­cast out­turn and risk iden­ti­fic­a­tion. (Amber)

2.1 Pro­gramme reporting

The Head of Pro­gramme advised that ongo­ing mon­it­or­ing dur­ing the pro­gramme deliv­ery phase will remain broadly sim­il­ar to the devel­op­ment phase, how­ever they pro­pose to refine the report­ing using MS Pro­ject report­ing tools. This is expec­ted to include integ­ra­tion with the fin­ance sys­tem and records man­age­ment sys­tem to stream­line cor­por­ate reporting.

We reviewed an example of the quarterly report Pro­ject Leads util­ise to provide pro­gress updates to Theme Leads and the Head of Pro­gramme. The con­tent included past activ­it­ies, planned activ­it­ies, changes to scope, suc­cesses, chal­lenges, key pro­ject risks and pro­ject per­form­ance with a rag status.

We found that report­ing would fur­ther bene­fit from includ­ing a Risks, Assump­tions, Issues and Depend­en­cies (RAID) sec­tion where risks, assump­tions, issues and depend­en­cies are clearly detailed, and each risk is scored for sever­ity and iden­ti­fies a trend ana­lys­is on the risk in the last quarter. Fur­ther, we iden­ti­fied that cur­rently the quarterly reports do not provide an update on budget, out­lining spend in the last quarter, spend to date and spend against budget.

We found that although cur­rent reports allow the pro­ject man­agers to reflect on suc­cesses, chal­lenges and learn­ing points for their pro­ject, the pro­gramme and their per­son­al per­form­ance, there are no ref­er­ences made to KPIs for the pro­ject. Mov­ing into the deliv­ery phase will require clear iden­ti­fic­a­tion and report­ing on KPIs that are linked to the deliv­ery of pro­gramme out­comes. This will enable pro­ject man­agers to under­stand the pro­ject per­form­ance bet­ter so that they can make crit­ic­al adjust­ments in their exe­cu­tion to achieve pro­gramme outcomes.

Risk

There is a risk that pro­ject pro­gress report­ing does not provide suf­fi­cient inform­a­tion on risks, budget and KPIs which may lead to fail­ures to provide key inform­a­tion on pro­ject pro­gress, res­ult­ing in action not being taken in a timely manner.

Recom­mend­a­tion

We recom­mend man­age­ment update pro­ject reports to include pro­gress updates on:

• RAID where each risk is scored, and risk trend ana­lys­is noted.
• Pro­ject budget includ­ing spend in the last quarter, spend to date and spend against budget.
• KPIs and how are they linked to the deliv­ery of pro­gramme outcomes.

---

Page 8:

Man­age­ment Action (Grade 3 (Oper­a­tion))

Recom­mend­a­tion agreed. We will amend pro­ject report­ing pro­ced­ures to incor­por­ate these ele­ments which we agree will enhance the over­all report­ing and con­trol envir­on­ment estab­lished through pro­ject report­ing arrangements.

Action own­er: Head of C2030 Pro­gramme with C2030 Pro­gramme Manager

Due date: End March 2024

---

Page 9:

Con­trol Object­ive 3: There is a clear pro­ject plan in place for the deliv­ery phase of the pro­gramme that has been reviewed and approved through the gov­ernance struc­ture. (Green)

No weak­nesses identified

The Cairngorms 2030 Pro­gramme received £1.7 mil­lion from NLHF Her­it­age Hori­zons to com­plete the devel­op­ment phase from 7 July 2021 – 17 August 2023. An NLHF Inter­im Review was held on 20 April 2023 — 21 April 2023. The pur­pose of the review was to assess devel­op­ment phase pro­gress and read­i­ness for sub­mit­ting the second phase fund­ing application.

Through review­ing the NLHF feed­back and hav­ing dis­cus­sions with rel­ev­ant staff, it was con­firmed that pro­ject plans includ­ing pro­ject briefs, action plans and cost plan have been reviewed and updated to reflect feed­back received from NLHF.

We con­firmed the indi­vidu­al pro­ject plans are reviewed and the latest ver­sions cov­er­ing 20 pro­jects were included in the bid sub­mis­sion to Nation­al Lot­tery Her­it­age Fund in August 2023.

We were advised that all the plans are in the pro­cess of being moved to MS Pro­ject. This will provide one point of access to all plans with­in the pro­gramme. Each pro­ject will have its own tab with details on activ­it­ies and mile­stones. The Head of Pro­gramme advised there will also be a tab for a pro­gramme wide plan which will provide an over­view of key mile­stones and any depend­en­cies across the projects.

We note the team are work­ing to ensure licences are secured for MS Pro­ject and rel­ev­ant train­ing provided by Decem­ber 2023.

---

Page 10:

Con­trol Object­ive 4: CNPA has pro­cesses which to cap­ture les­sons learned for inclu­sion in the deliv­ery phase of the Her­it­age Hori­zons pro­gramme. (Yel­low)

4.1 Les­sons learned

We were advised that dur­ing the deliv­ery phase, the Know­ledge and Research Exchange officer will be respons­ible for cap­tur­ing les­sons learned across pro­jects to share intern­ally and externally.

The Pro­gramme Man­ager advised that the quarterly reports that have been com­pleted by each Pro­ject Man­ager have sec­tions on suc­cesses, chal­lenges and learn­ing, allow­ing the pro­ject man­agers to reflect on these points for their pro­ject. Part of the Pro­gramme Manager’s role is to read the quarterly reports and attend bi-weekly meet­ings with pro­ject staff to dis­cuss their pro­jects, and share ideas and strategies that could help others.

We con­firmed that dur­ing the devel­op­ment phase, pro­gramme level les­sons learned were cap­tured and doc­u­mented by an extern­al con­sult­ant, how­ever we were not able to con­firm that rel­ev­ant pro­cesses and tem­plates are in place to doc­u­ment pro­ject level les­sons learned dur­ing the deliv­ery phase.

Risk

There is a risk that pro­ject level les­sons learned are not doc­u­mented dur­ing the deliv­ery phase due to lack of pro­cesses around cap­tur­ing pro­ject level les­sons learned, lead­ing to fail­ures in shar­ing exper­i­ence and know­ledge gained dur­ing the deliv­ery phase of the programme.

Recom­mend­a­tion

We recom­mend the Know­ledge and Research Exchange Officer devel­ops appro­pri­ate pro­cesses and tem­plates to ensure les­sons learned at pro­ject level are doc­u­mented and shared with key internal/​external stake­hold­ers through­out the deliv­ery phase.

Man­age­ment Action (Grade 2 (Design))

Recom­mend­a­tion agreed. Due date for imple­ment­a­tion reflects uncer­tainty around pro­gramme start and recruit­ment timetable for rel­ev­ant officer.

Action own­er: C2030 Pro­gramme Man­ager with Know­ledge and Research Exchange Officer

Due date: End June 2024

---

Page 11:

Appendix A – Definitions

Con­trol assessments

• R: Fun­da­ment­al absence or fail­ure of key controls.
• A: Con­trol object­ive not achieved — con­trols are inad­equate or ineffective.
• Y: Con­trol object­ive achieved — no major weak­nesses but scope for improvement.
• G: Con­trol object­ive achieved — con­trols are adequate, effect­ive and efficient.

Man­age­ment action grades

• 4: Very high risk expos­ure — major con­cerns requir­ing imme­di­ate seni­or atten­tion that cre­ate fun­da­ment­al risks with­in the organisation.
• 3: High risk expos­ure — absence / fail­ure of key con­trols that cre­ate sig­ni­fic­ant risks with­in the organisation.
• 2: Mod­er­ate risk expos­ure — con­trols are not work­ing effect­ively and effi­ciently and may cre­ate mod­er­ate risks with­in the organisation.
• 1: Lim­ited risk expos­ure — con­trols are work­ing effect­ively, but could be strengthened to pre­vent the cre­ation of minor risks or address gen­er­al house-keep­ing issues.

---

Page 12:

© Azets 2023. All rights reserved. Azets refers to Azets Audit Ser­vices Lim­ited. Registered in Eng­land & Wales Registered No. 09652677. VAT Regis­tra­tion No. 219 0608 22.

Registered to carry on audit work in the UK and reg­u­lated for a range of invest­ment busi­ness activ­it­ies by the Insti­tute of Chartered Account­ants in Eng­land and Wales.