Annu­al Audit Report

Cairngorms Nation­al Park Author­ity – Year ended 31 March 2023

Novem­ber 2023

Con­tents

1. Exec­ut­ive summary
2. Status of the audit
3. Audit approach
4. Sig­ni­fic­ant findings
5. Intern­al con­trol recommendations
6. Sum­mary of misstatements
7. Wider scope

Appendix A: Draft man­age­ment rep­res­ent­a­tion letter Appendix B: Draft audit report Appendix C: Independence Appendix D: Oth­er communications Appendix E: Wider scope and Best Value ratings

Our reports are pre­pared in accord­ance with Terms of Appoint­ment Let­ter from Audit Scot­land dated 18 May 2022 through which the Aud­it­or Gen­er­al for Scot­land has appoin­ted us as extern­al aud­it­or of Cairngorms Nation­al Park Author­ity (CNPA) for fin­an­cial years ²⁰²²⁄₂₃ to ²⁰²⁶⁄₂₇. We under­take our audit in accord­ance with the Pub­lic Fin­ance and Account­ab­il­ity (Scot­land) Act 2000, as amended; and our respons­ib­il­it­ies as set out with­in Audit Scotland’s Code of Audit Prac­tice 2021.

Reports and let­ters pre­pared by appoin­ted aud­it­ors and addressed to CNPA are pre­pared for the sole use of CNPA and made avail­able to Audit Scot­land and the Aud­it­or Gen­er­al for Scot­land. We take no respons­ib­il­ity to any mem­ber or officer in their indi­vidu­al capa­city or to any oth­er third party.

Maz­ars LLP is the UK firm of Maz­ars, an inter­na­tion­al advis­ory and account­ancy group. Maz­ars LLP is registered by the Insti­tute of Chartered Account­ants in Eng­land and Wales.

1. Exec­ut­ive Summary

Audit con­clu­sions and sig­ni­fic­ant findings

The detailed scope of our work as your appoin­ted aud­it­or for ²⁰²²⁄₂₃ is set out in the Audit Scotland’s Code of Audit Prac­tice 2021. Our respons­ib­il­it­ies and powers are derived from our appoint­ment by the Aud­it­or Gen­er­al under the Pub­lic Fin­ance and Account­ab­il­ity (Scot­land) Act 2000 and, as out­lined in our Audit Strategy Memor­andum, our audit has been con­duc­ted in accord­ance with Inter­na­tion­al Stand­ards on Audit­ing (UK) and means we focus on audit risks that we have assessed as res­ult­ing in a high­er risk of mater­i­al misstatement.

In sec­tion 4 of this report we have set out our con­clu­sions and sig­ni­fic­ant find­ings from our audit. This sec­tion includes our con­clu­sions on the audit risks and areas of man­age­ment judge­ment in our Audit Strategy Memor­andum, which include:

• Man­age­ment over­ride of controls;
• Fraud over expendit­ure recognition
• Fraud over recog­ni­tion of rev­en­ue; and
• IFRS 16 valuation.

Mis­state­ments and intern­al con­trol recommendations

Sec­tion 5 sets out intern­al con­trol recom­mend­a­tions and sec­tion 6 sets out audit mis­state­ments. Sec­tion 7 out­lines our work on CNPA’s arrange­ments to achieve eco­nomy, effi­ciency and effect­ive­ness in its use of resources.

Status and audit opinion

We have sub­stan­tially com­pleted our audit in respect of the fin­an­cial state­ments for the year ended 31 March 2023. At the time of pre­par­ing this report some mat­ters remain out­stand­ing as out­lined in sec­tion 2.

Con­clu­sions from our audit test­ing and audit opinion

We have sub­stan­tially com­pleted our audit in respect of the fin­an­cial state­ments for the year ended 31 March 2023. Based on our audit work com­pleted to date we have the fol­low­ing conclusions:

• Audit opin­ion: We expect to issue an unqual­i­fied opin­ion, without modi­fic­a­tion, on the fin­an­cial state­ments. Our pro­posed audit opin­ion is included in the draft auditor’s report in Appendix B.
• Reg­u­lar­ity: We expect to issue an unqual­i­fied opin­ion, without modi­fic­a­tion, that in all mater­i­al respects the expendit­ure and income in the fin­an­cial state­ments were incurred or applied in accord­ance with any applic­able enact­ments and guid­ance issued by the Scot­tish Min­is­ters. Our pro­posed audit opin­ion is included in the draft auditor’s report in Appendix B.
• Mat­ters on which we report by excep­tion: We are required to report to you if, dur­ing the course of our audit, we have found that adequate account­ing records have not been kept; the fin­an­cial state­ments and the audited part of the Remu­ner­a­tion and Staff Report are not in agree­ment with the account­ing records; or we have not received all the inform­a­tion and explan­a­tions we require for our audit. We have noth­ing to report in respect of these matters.

Con­clu­sions from our audit test­ing and audit opin­ion (con­tin­ued)

• Gov­ernance State­ment and Per­form­ance Report: We are required to report on wheth­er the inform­a­tion giv­en in the Gov­ernance State­ment and Per­form­ance Report is mater­i­ally incon­sist­ent with the fin­an­cial state­ments; has not been prop­erly pre­pared in accord­ance with The Nation­al Parks (Scot­land) Act 2000 and dir­ec­tions made there­un­der by the Scot­tish Min­is­ters; or is mater­i­ally mis­stated. We have no mat­ters to report in respect of the Gov­ernance State­ment or the Per­form­ance Report.
• Oth­er inform­a­tion: We are required to report on wheth­er the oth­er inform­a­tion (com­pris­ing of the Per­form­ance Report and the Account­ab­il­ity Report and the unaudited parts of the Remu­ner­a­tion and Staff Report), is mater­i­ally incon­sist­ent with the fin­an­cial state­ments; has not been prop­erly pre­pared in accord­ance with The Nation­al Parks (Scot­land) Act 2000 and dir­ec­tions made there­un­der by the Scot­tish Min­is­ters; or is mater­i­ally mis­stated. No incon­sist­en­cies have been iden­ti­fied and we have issued an unmod­i­fied opin­ion in this respect.

Wider Scope conclusions

As aud­it­ors appoin­ted by the Aud­it­or Gen­er­al of Scot­land, our wider scope respons­ib­il­it­ies are set out in the Audit Scotland’s Code of Audit Prac­tice 2021. The Code require­ments broaden the scope of the ²⁰²²⁄₂₃ audit and allows us to use a risk-based approach to report on our con­sid­er­a­tion of CNPA’s per­form­ance and make recom­mend­a­tions for improve­ment and, where appro­pri­ate, con­clude on CNPA’s performance.

The Code’s wider scope frame­work is cat­egor­ised into four areas:

• fin­an­cial management;
• fin­an­cial sustainability;
• vis­ion, lead­er­ship and gov­ernance; and
• use of resources to improve outcomes.

It remains the respons­ib­il­ity of CNPA to ensure that it makes prop­er fin­an­cial stew­ard­ship of pub­lic funds, com­plies with rel­ev­ant legis­la­tion, and estab­lishes effect­ive gov­ernance of their activ­it­ies. CNPA is also respons­ible for ensur­ing that it estab­lishes arrange­ments to secure con­tinu­ous improve­ment in per­form­ance and, in mak­ing those arrange­ments, ensures resources are being used to improve stra­tegic out­comes and demon­strate the eco­nomy, effi­ciency, and effect­ive­ness through­out the use of its resources. These arrange­ments should be pro­por­tion­ate to the size and type of the Non Depart­ment­al Pub­lic Body (NDPB), appro­pri­ate to the nature of the NDPB and the ser­vices and func­tions that it has been cre­ated to deliver.

2. Status of the audit

Our work is sub­stan­tially com­plete and there are cur­rently no mat­ters of which we are aware that would require modi­fic­a­tion of our audit opin­ion, sub­ject to the out­stand­ing mat­ters detailed below.

Audit area	Risk of mater­i­al adjust­ment or sig­ni­fic­ant change	Descrip­tion of the out­stand­ing mat­ters	High	Medi­um	Low
Audit qual­ity con­trol and com­ple­tion procedures	Low	Our audit work is under­go­ing final stages of review by the Engage­ment Lead and fur­ther qual­ity and com­pli­ance checks. In addi­tion, there are resid­ual pro­ced­ures to com­plete, includ­ing updat­ing post bal­ance sheet event con­sid­er­a­tions to the point of issu­ing the opin­ion, obtain­ing final man­age­ment rep­res­ent­a­tions and agree­ing adjust­ments to the final set of accounts.	Likely to res­ult in mater­i­al adjust­ment or sig­ni­fic­ant change to dis­clos­ures with­in the fin­an­cial statements.	Poten­tial to res­ult in mater­i­al adjust­ment or sig­ni­fic­ant change to dis­clos­ures with­in the fin­an­cial statements.	Not con­sidered likely to res­ult in mater­i­al adjust­ment or change to dis­clos­ures with­in the fin­an­cial statements.
Annu­al report and accounts and let­ter of representation	Low	We will com­plete our final review of the annu­al report and accounts upon receipt of the signed ver­sion of the accounts and let­ter of representation.

3. Audit approach

Changes to our audit approach

We provided details of our inten­ded audit approach in our Audit Strategy Memor­andum in June 2023. We have not made any changes to our audit approach since we presen­ted our Audit Strategy Memorandum.

Mater­i­al­ity

Our pro­vi­sion­al mater­i­al­ity at the plan­ning stage of the audit was set at £206k using a bench­mark of 2% of total expendit­ure. Our final assess­ment of mater­i­al­ity, based on the final fin­an­cial state­ments, is £263k using the same benchmark.

Ser­vice organisations

There has been one change to the use of ser­vice organ­isa­tions as set out below.

Item of account	Ser­vice organ­isa­tion	Audit approach
Cash equi­val­ent trans­fer val­ues of pen­sions as dis­closed in the Remu­ner­a­tion and Staff Report	MyC­SP	We reviewed the source data CNPA provided to MyC­SP and agreed this to CNPA payroll records. We reviewed reports provided by MyC­SP to CNPA and agreed these to the pen­sion dis­clos­ures included in the Remu­ner­a­tion and Staff Report.

4. Sig­ni­fic­ant findings

In this sec­tion we out­line the sig­ni­fic­ant find­ings from our audit. These find­ings include:

• our audit con­clu­sions regard­ing oth­er sig­ni­fic­ant risks and key areas of man­age­ment judge­ment out­lined in the Audit Strategy Memorandum;
• our com­ments in respect of the account­ing policies and dis­clos­ures that you have adop­ted in the fin­an­cial state­ments. On page 18 we have con­cluded wheth­er the fin­an­cial state­ments have been pre­pared in accord­ance with the fin­an­cial report­ing frame­work and com­men­ted on any sig­ni­fic­ant account­ing policy changes that have been made dur­ing the year;
• any fur­ther sig­ni­fic­ant mat­ters dis­cussed with man­age­ment; and
• any sig­ni­fic­ant dif­fi­culties we exper­i­enced dur­ing the audit.

Sig­ni­fic­ant risks

Man­age­ment over­ride of controls

Descrip­tion of the risk: Man­age­ment at vari­ous levels with­in an organ­isa­tion are in a unique pos­i­tion to per­pet­rate fraud because of their abil­ity to manip­u­late account­ing records and pre­pare fraud­u­lent fin­an­cial state­ments by over­rid­ing con­trols that oth­er­wise appear to be oper­at­ing effect­ively. Due to the unpre­dict­able way in which such over­ride could occur there is a risk of mater­i­al mis­state­ment due to fraud on all audits.

How we addressed this risk: We addressed this risk by:

• review­ing the key areas with­in the fin­an­cial state­ments where man­age­ment has used judge­ment and estim­a­tion tech­niques and con­sider wheth­er there is evid­ence of unfair bias;
• examin­ing any account­ing policies that vary from the Gov­ern­ment Fin­an­cial Report­ing Manual;
• test­ing the appro­pri­ate­ness of journ­al entries recor­ded in the gen­er­al ledger and oth­er adjust­ments made in pre­par­ing the fin­an­cial state­ments; and
• con­sid­er­ing and test­ing any sig­ni­fic­ant trans­ac­tions out­side the nor­mal course of busi­ness or oth­er­wise unusual.

Audit con­clu­sion: Our work has provided the assur­ance we sought in each of these areas and has not high­lighted any mater­i­al issues to bring to your attention.

Key areas of man­age­ment judgement

Fraud over expendit­ure recognition

Descrip­tion of the risk: Prac­tice Note 10: Audit of fin­an­cial state­ments and reg­u­lar­ity of pub­lic sec­tor bod­ies in the United King­dom high­lights that, as most pub­lic-sec­tor bod­ies are net spend­ing bod­ies, the risk of fraud related to expendit­ure may be great­er than the risk relat­ing to rev­en­ue recognition.

A sig­ni­fic­ant amount of CNPA’s expendit­ure relates to salar­ied staff costs. Staff costs are well con­trolled and made up of low value indi­vidu­al trans­ac­tions. Depre­ci­ation and impair­ment are fun­ded by agreed fore­cast Scot­tish Gov­ern­ment fund­ing and there is there­fore less incent­ive to manip­u­late. How­ever, CNPA has mater­i­al oper­a­tion­al plan expendit­ure. The nature of this expendit­ure means there is an increased risk of fraud in its recog­ni­tion which could res­ult in a mater­i­al mis­state­ment in the fin­an­cial state­ments. This risk is par­tic­u­larly pre­val­ent around the year end.

How we addressed this risk: We addressed this risk by under­tak­ing sub­stant­ive pro­ced­ures to ensure pro­gramme and pro­ject expendit­ure and oth­er oper­at­ing costs are recor­ded appro­pri­ately in the fin­an­cial statements.

Audit con­clu­sion: Man­age­ment aler­ted us to a fraud which occurred dur­ing ²⁰²²⁄₂₃, affect­ing oper­a­tion­al plan expendit­ure. CNPA sus­pect this was caused by an unknown and hos­tile act­or gain­ing access to a staff member’s email account. The act­or sent instruc­tions to pay sup­pli­er invoices from the staff member’s email address to the Fin­ance team, includ­ing a noti­fic­a­tion of change in bank details. CNPA made five pay­ments totalling £15,665 to this bank account. We note that CNPA enhanced con­trols over changes to sup­pli­er bank details fol­low­ing this incident.

We did not identi­fy any fur­ther incid­ents of proven or sus­pec­ted fraud from our sub­stant­ive pro­ced­ures on oper­a­tion­al plan expendit­ure. We recom­mend that man­age­ment ensure its new con­trols over con­firm­a­tion of pay­ment requests and changes in bank details are oper­at­ing effectively.

We have sub­mit­ted a fraud return to Audit Scot­land as required by its guidelines.

Fraud over recog­ni­tion of revenue

Descrip­tion of the risk: As set out in Inter­na­tion­al Stand­ard on Audit­ing (UK) 240: The auditor’s respons­ib­il­it­ies relat­ing to fraud in an audit of fin­an­cial state­ment, there is a pre­sumed risk of fraud over the recog­ni­tion of rev­en­ue. There is a risk that rev­en­ue may be mis­stated res­ult­ing in a mater­i­al mis­state­ment in the fin­an­cial statements.

CNPA has mater­i­al oper­a­tion­al plan income. The nature of this income means there is an increased risk of fraud in its recog­ni­tion which could res­ult in a mater­i­al mis­state­ment in the fin­an­cial state­ments. There is a risk that CNPA could over or under­state this income to manip­u­late its year end position.

How we addressed this risk: We addressed this risk by under­tak­ing sub­stant­ive pro­ced­ures to ensure pro­gramme and pro­ject income is recor­ded appro­pri­ately in the fin­an­cial statements.

Audit con­clu­sion: We did not identi­fy any errors from our sub­stant­ive procedures.

IFRS 16 Valuation

Descrip­tion of the risk: The ²⁰²²⁄₂₃ Gov­ern­ment Fin­an­cial Report­ing Manu­al (FReM) requires bod­ies to account for leases in accord­ance with IFRS 16 Leases. Under IFRS 16, where a body is a less­ee there is no dis­tinc­tion between fin­ance leases and oper­at­ing leases. Less­ees are required to recog­nise a right-of-use asset and any lease liab­il­ity in their fin­an­cial statements.

CNPA assessed the likely impact of IFRS 16 and dis­closed this in its ²⁰²¹⁄₂₂ fin­an­cial state­ments. It expec­ted that applic­a­tion of this stand­ard would res­ult in a right-of-use asset of £2.6 mil­lion and an asso­ci­ated lease liab­il­ity of £2.6 mil­lion. There is a risk that CNPA does not prop­erly meas­ure right-of-use assets and lease liab­il­it­ies. There is also a risk that it does not cor­rectly identi­fy all its leases.

How we addressed this risk: We addressed this risk by:

• eval­u­at­ing wheth­er right-of-use assets as at 31 March 2023 are prop­erly valued;
• eval­u­at­ing wheth­er the lease liab­il­ity at 31 March 2023 is prop­erly measured;
• review­ing wheth­er CNPA has prop­erly presen­ted and dis­closed leases in the fin­an­cial statements;
• review­ing CNPA’s pro­cess for identi­fy­ing its leases.

Audit con­clu­sion: We did not identi­fy any errors from our audit procedures.

Qual­it­at­ive aspects of CNPA’s account­ing practices

We have reviewed CNPA’s account­ing policies and dis­clos­ures and con­cluded they com­ply with the Gov­ern­ment Fin­an­cial Report­ing Manu­al (FReM) ²⁰²²⁄₂₃, appro­pri­ately tailored to CNPA’s circumstances.

The unaudited annu­al report and accounts were received from CNPA on 18 Septem­ber 2023 and were of a good quality.

Sig­ni­fic­ant mat­ters dis­cussed with management

Dur­ing our audit we com­mu­nic­ated the fol­low­ing sig­ni­fic­ant mat­ters to management:

• First year audit pro­ced­ures. Audit­ing stand­ards require us to carry out addi­tion­al spe­cif­ic pro­ced­ures in the first year of an audit. These include: seek­ing pro­fes­sion­al clear­ance con­firm­a­tions from the pre­de­cessor aud­it­or, review­ing the pre­de­cessor auditor’s work­ing papers and reports and spe­cif­ic addi­tion­al pro­ced­ures over brought for­ward bal­ances. As part of this work, we dis­cussed con­trols in place for key inform­a­tion sys­tems with management.
• IFRS 16 Leases. We dis­cussed the account­ing treat­ment of oper­at­ing leases under IFRS 16 with officers. We did not identi­fy any issues and we con­cluded that CNPA’s account­ing treat­ment is appropriate.

Sig­ni­fic­ant dif­fi­culties dur­ing the audit

Dur­ing the course of the audit we did not encounter any sig­ni­fic­ant dif­fi­culties and we have had the full co-oper­a­tion of management.

Wider respons­ib­il­it­ies – stat­utory reporting

We are required to noti­fy the Aud­it­or Gen­er­al when cir­cum­stances indic­ate that a stat­utory report may be required.

• Sec­tion 22 of the Pub­lic Fin­ance and Account­ab­il­ity (Scot­land) Act 2000 allows us to pre­pare a report to bring to the atten­tion of the Scot­tish Par­lia­ment and the pub­lic, mat­ters of pub­lic interest arising dur­ing the audit of CNPA.
• Sec­tion 23 of the Pub­lic Fin­ance and Account­ab­il­ity (Scot­land) Act 2000 allows us to ini­ti­ate an exam­in­a­tion into the eco­nomy, effi­ciency and effect­ive­ness with which CNPA and its office­hold­ers have used their resources in dis­char­ging their functions.

We con­firm that no such reports have been pre­pared or any exam­in­a­tions have been initiated.

5. Intern­al con­trol recommendations

As part of our audit of the fin­an­cial state­ments, we obtained an under­stand­ing of intern­al con­trols suf­fi­cient to plan our audit and determ­ine the nature, tim­ing and extent of test­ing per­formed. Although our audit was not designed to express an opin­ion on the effect­ive­ness of intern­al con­trol, we are required to com­mu­nic­ate to the Audit and Risk Com­mit­tee any sig­ni­fic­ant defi­cien­cies iden­ti­fied dur­ing the course of our work.

The pur­pose of our audit was to express an opin­ion on the fin­an­cial state­ments. As part of our audit we have con­sidered the intern­al con­trols in place rel­ev­ant to the pre­par­a­tion of the fin­an­cial state­ments in order to design audit pro­ced­ures to allow us to express an opin­ion on the fin­an­cial state­ments but not for the pur­pose of express­ing an opin­ion on the effect­ive­ness of intern­al con­trol or to identi­fy any sig­ni­fic­ant defi­cien­cies in their design or operation.

The mat­ters repor­ted are lim­ited to those defi­cien­cies and oth­er con­trol recom­mend­a­tions that we have iden­ti­fied dur­ing our nor­mal audit pro­ced­ures and that we con­sider to be of suf­fi­cient import­ance to mer­it being repor­ted. If we had per­formed more extens­ive pro­ced­ures on intern­al con­trol we might have iden­ti­fied more defi­cien­cies to be repor­ted or con­cluded that some of the repor­ted defi­cien­cies need not in fact have been repor­ted. Our com­ments should not be regarded as a com­pre­hens­ive record of all defi­cien­cies that may exist or improve­ments that could be made.

Our find­ings and recom­mend­a­tions are set out below. We have assigned pri­or­ity rank­ings to each of them to reflect the import­ance that we con­sider each poses to your organ­isa­tion and, hence, our recom­mend­a­tion in terms of the urgency of required action. In sum­mary, the mat­ters arising fall into the fol­low­ing categories:

Pri­or­ity rank­ing	Descrip­tion	Num­ber of issues
1 (high)	In our view, there is poten­tial for fin­an­cial loss, dam­age to repu­ta­tion or loss of inform­a­tion. This may have implic­a­tions for the achieve­ment of busi­ness stra­tegic object­ives. The recom­mend­a­tion should be taken into con­sid­er­a­tion by man­age­ment immediately.	1
2 (medi­um)	In our view, there is a need to strengthen intern­al con­trol or enhance busi­ness effi­ciency. The recom­mend­a­tions should be actioned in the near future.	2
3 (low)	In our view, intern­al con­trol should be strengthened in these addi­tion­al areas when practicable.	0

Sig­ni­fic­ant defi­cien­cies in intern­al con­trol – Level 1

Descrip­tion of defi­ciency: CNPA was the vic­tim of fraud in ²⁰²²⁄₂₃ due to inad­equate pro­ced­ures for con­firm­ing changes in sup­pli­er bank details.

Poten­tial effects: Hos­tile act­ors could exploit this con­trol weak­ness lead­ing to fin­an­cial loss for CNPA.

Recom­mend­a­tion: CNPA has enhanced its con­trols for con­firm­a­tion of sup­pli­er bank details, includ­ing requests for change of details. This includes intro­du­cing call-back pro­ced­ures and a new sup­pli­er set up form. We recom­mend that man­age­ment ensure its new con­trols over con­firm­a­tion of pay­ment requests and changes in bank details are oper­at­ing effectively.

Man­age­ment response: This was a soph­ist­ic­ated fraud that we under­stand to have been per­pet­rated when a hos­tile act­or gained access to our email com­mu­nic­a­tions through an unse­cured Wi-Fi sys­tem at a pub­lic meet­ing. We have since set up the pro­cesses described above, and these are, to our know­ledge, work­ing well. In addi­tion, we require that staff use the data pro­vi­sion on their mobile devices to access Wi-Fi rather than using ser­vices provided by out­side venues.

Oth­er defi­cien­cies in intern­al con­trol – Level 2

Descrip­tion of defi­ciency: Com­plex and time-con­sum­ing gen­er­al ledger struc­tures and account­ing pro­cesses cur­rently exist with­in the entity, as evid­enced by the fol­low­ing features:

• Use of mul­tiple ​‘com­pan­ies’, which means CNPA per­forms manu­al con­sol­id­a­tion to pro­duce a res­ult for the whole organ­isa­tion from the five com­pan­ies set up in the SAGE fin­an­cial ledger system
• Incon­sist­en­cies in the Chart of Accounts for the five companies
• Requis­i­tions for pro­cure­ment pre­pared in Excel
• Report­ing and payroll pro­cessing require manu­al input into the SAGE system.

Poten­tial effects: The pro­cesses cur­rently in place res­ult in duplic­a­tion of efforts, are time-con­sum­ing and strenu­ous for the fin­ance team, and could lead to errors in inform­a­tion processing.

Recom­mend­a­tion: Man­age­ment has pre­pared a paper out­lining the improve­ments required to the ledger sys­tem. We recom­mend that CNPA imple­ments new account­ing sys­tems that sim­pli­fy processes.

Man­age­ment response: We agree with your assess­ment of our needs in respect of improve­ments to our fin­ance sys­tem and are work­ing on a busi­ness case and spe­cific­a­tion for a replace­ment sys­tem. You com­ment on incon­sist­en­cies with­in the chart of accounts. While we agree that our approach is uncon­ven­tion­al, it does provide appro­pri­ate inform­a­tion. The dif­fer­ent struc­tures with­in each of the five com­pan­ies reflect the dif­fer­ent report­ing require­ments for core activ­it­ies and the vari­ous activ­it­ies with­in our pro­ject work. We will undoubtedly refine this approach in any new sys­tem, but we are con­fid­ent that the cur­rent ledger struc­ture meets our needs and the needs of funders.

Respons­ible Officer — Head of Fin­ance and Cor­por­ate Oper­a­tions. Timeline – Septem­ber 2024

Oth­er defi­cien­cies in intern­al con­trol – Level 2

Descrip­tion of defi­ciency: Weak­ness in cyber secur­ity gov­ernance and con­trols in that there is an absence of robust pro­cesses in place at CNPA to assess vul­ner­ab­il­ity to cyber secur­ity risk.

Poten­tial effects: Hos­tile act­ors could exploit this con­trol weak­ness lead­ing to loss of inform­a­tion or fin­an­cial loss for CNPA sim­il­ar to the incid­ent that occurred with­in the fin­an­cial year under review.

Recom­mend­a­tion: We recom­mend that CNPA design and imple­ment form­al gov­ernance and risk man­age­ment func­tions over cyber risk.

Man­age­ment response: We have recently com­pleted a review of oper­a­tion­al risks with our IT team. Amongst the iden­ti­fied risks are cloud com­put­ing vul­ner­ab­il­it­ies and daily extern­al threats. Mit­ig­a­tion meas­ures cur­rently in place include:

• Pro­act­ive mon­it­or­ing using Dark Trace software.
• Use of daily threat sum­mar­ies provided by the Scot­tish Cyber Coordin­a­tion Centre and oth­er industry pub­lic­a­tions to keep up to date with poten­tial threats.
• A sched­ule of reg­u­lar soft­ware updates to mit­ig­ate Zero Day risks.
• Reg­u­lar com­mu­nic­a­tion with know­ledge con­tacts, includ­ing Dark Trace and IT col­leagues at Loch Lomond and the Trossachs Nation­al Park.
• Gain­ing the Cyber Secur­ity Essen­tials Plus accreditation
• Stream­lin­ing the use of 3^rd party soft­ware by using built-in tools from Microsoft Intune and End­point Security

The out­put from this risk assess­ment will be con­sol­id­ated into an IT/ Cyber secur­ity risk register provid­ing a vehicle for reg­u­lar mon­it­or­ing and report­ing on risk.

Respons­ible Officer — Head of Fin­ance and Cor­por­ate Oper­a­tions. Timeline – March 2024

Fol­low up on pre­vi­ous intern­al con­trol recom­mend­a­tion (repor­ted in ²⁰²¹⁄₂₂ Extern­al Audit Report)

Descrip­tion of defi­ciency: CNPA uses a com­plex gen­er­al ledger struc­ture to segreg­ate incom­ing and out­go­ing funds for vari­ous pro­grammes being delivered. The use of the com­pany group struc­ture func­tion with­in the fin­an­cial account­ing pack­age requires six ledgers to be col­lated to pro­duce the inform­a­tion dis­closed in the fin­an­cial statements.

Poten­tial effects: Sig­ni­fic­ant strain is placed on the CNPA Fin­ance Team through­out the accounts pro­duc­tion process.

Recom­mend­a­tion: We recom­mend that altern­at­ive func­tion­al­ity with­in the account­ing pack­age is imple­men­ted to main­tain the segreg­a­tion of funds and, while there are likely to be a num­ber of rel­ev­ant func­tions avail­able, exploit­ing Cost Centre func­tion­al­ity is one that may provide an adequate solution.

²⁰²²⁄₂₃ update: See intern­al con­trol recom­mend­a­tion 2 on page 22.

Fol­low up on pre­vi­ous intern­al con­trol points (repor­ted in ²⁰²¹⁄₂₂ Extern­al Audit Report)

Descrip­tion of defi­ciency: Fol­low­ing our assess­ment of gen­er­al IT con­trols, we have iden­ti­fied weak­nesses in the IT con­trol envir­on­ment. We iden­ti­fied an absence of robust pro­cesses in place at CNPA to assess vul­ner­ab­il­ity to cyber secur­ity risk and detect adverse cyber events.

Poten­tial effects: As a pub­lic body with respons­ib­il­ity for pro­cessing of pub­lic funds CNPA is sub­ject to an inflated risk pro­file and is likely to be a tar­get for cyber-crim­in­al activity.

Recom­mend­a­tion: We recom­mend that CNPA design and imple­ment form­al gov­ernance and risk man­age­ment func­tions over cyber risk.

²⁰²²⁄₂₃ update: CNPA is plan­ning to intro­duce an ICT Risk Register and intro­duce Share­Point. See intern­al con­trol recom­mend­a­tion 3 on page 23.

6. Sum­mary of misstatements

This sec­tion out­lines the dis­clos­ure adjust­ments pro­posed to and taken up by man­age­ment over the course of the audit. There were no mis­state­ments iden­ti­fied dur­ing the course of the audit above the trivi­al threshold for adjust­ment of £7,900.

Dis­clos­ure amendments

We iden­ti­fied the fol­low­ing adjust­ments dur­ing our audit that have been cor­rec­ted by management:

• Per­form­ance report:- Inclu­sion of addi­tion­al inform­a­tion to cov­er dis­clos­ures required by the FReM:
  • Details of organ­isa­tion­al stra­tegic object­ives and goals, per­form­ance apprais­al and analysis
  • Sum­mary of prin­cip­al risks faced and how they have affected the deliv­ery of objectives
  • Effects of emer­ging risks on expec­ted future performance.
  • Detail on pro­gress against stra­tegic aims.
• Gov­ernance state­ment:- Amend­ments to ensure com­pli­ance with the Scot­tish Pub­lic Fin­ance Manual:-
  • Includ­ing a state­ment that the sys­tems have been in place for the year under review and up to the date of approv­al of the annu­al report and accounts.
• Remu­ner­a­tion and staff report:- Amend­ments made in response to the fol­low­ing points:-
  • Cap­ping neg­at­ive accrued pen­sion bene­fits at £0 to com­ply with FReM.
  • Dis­clos­ure of Board mem­bers’ fees in bands of £5,000.

There were also adjust­ments to the annu­al report and accounts for oth­er minor dis­clos­ure, con­sist­ency or present­a­tion­al matters.

7. Wider scope

Over­all summary

As aud­it­ors appoin­ted by the Aud­it­or Gen­er­al for Scot­land, our wider scope respons­ib­il­it­ies are set out in the Audit Scotland’s Code of Audit Prac­tice 2021. The Code require­ments broaden the scope of the ²⁰²²⁄₂₃ audit and allows us to use a risk-based approach to report on our con­sid­er­a­tion of CNPA’s per­form­ance and make recom­mend­a­tions for improve­ment and, where appro­pri­ate, con­clude on CNPA’s performance.

The Code’s wider scope frame­work is cat­egor­ised into four areas:

• fin­an­cial management;
• fin­an­cial sustainability;
• vis­ion, lead­er­ship and gov­ernance; and
• use of resources to improve outcomes.

The Code of Audit Prac­tice per­mits an altern­at­ive audit approach where an audited body is con­sidered less com­plex due its size and lim­ited fin­an­cial activ­ity. In the Audit Strategy Memor­andum, we doc­u­mented our judge­ment that CNPA is a less com­plex body. We have reviewed this assess­ment and con­firmed that it remains appro­pri­ate. We there­fore restric­ted our wider scope work to:

• a review of the Gov­ernance Statement
• con­clud­ing on the fin­an­cial sus­tain­ab­il­ity of CNPA and the ser­vices that it deliv­ers in the medi­um to longer term.

Over­all sum­mary by report­ing criteria

From the sat­is­fact­ory con­clu­sion of our audit work, we have the fol­low­ing conclusions:

Report­ing cri­ter­ia	Com­ment­ary page ref­er­ence	Iden­ti­fied risks?	Actu­al risks iden­ti­fied?	Oth­er recom­mend­a­tions made?
Fin­an­cial sustainability	30	No	No	No
Gov­ernance Statement	32	No	No	No

Fin­an­cial sustainability

Fin­an­cial sus­tain­ab­il­ity looks for­ward to the medi­um and longer term to con­sider wheth­er the body is plan­ning effect­ively to con­tin­ue to deliv­er its ser­vices or the way in which they should be delivered.

Our over­all assessment

Area assessed	Our find­ings	Our judge­ments	Risks iden­ti­fied
Fin­an­cial planning	CNPA repor­ted net expendit­ure for 2022⁄23 of £10.4 mil­lion (2021÷22: £8.9 mil­lion). This reflects a small cash under­spend of £18k against the Scot­tish Gov­ern­ment resource lim­it for the year. It repor­ted a more sig­ni­fic­ant under­spend of £269k against the cap­it­al resource lim­it due to Peat­land res­tor­a­tion activ­ity being less than planned.	CNPA oper­ated with­in its budget in 2022⁄23. CNPA responds to resource spend­ing review com­mis­sions from the Scot­tish Gov­ern­ment on an ongo­ing basis.	No sig­ni­fic­ant risks identified.

Gov­ernance Statement

Area assessed	Our find­ings	Our judge­ments	Risks iden­ti­fied
Gov­ernance Statement	We con­firmed that the Gov­ernance State­ment: is con­sist­ent with the fin­an­cial state­ments; includes the inform­a­tion required by the FReM and the Scot­tish Pub­lic Fin­ance Manu­al (SPFM); is con­sist­ent with our know­ledge obtained through the audit; does not con­tain any mis­lead­ing information.	We are required to report on wheth­er the inform­a­tion giv­en in the Gov­ernance State­ment is mater­i­ally incon­sist­ent with the fin­an­cial state­ments; has not been prop­erly pre­pared in accord­ance with The Nation­al Parks (Scot­land) Act 2000 and dir­ec­tions made there­un­der by the Scot­tish Min­is­ters; or is mater­i­ally mis­stated. We have no mat­ters to report in respect of the Gov­ernance Statement.	No sig­ni­fic­ant risks identified.

Appen­dices

Appendix A: Draft man­age­ment rep­res­ent­a­tion letter

Appendix B: Draft audit report

Appendix C: Independence

Appendix D: Oth­er communications

Appendix E: Wider scope and Best Value ratings