240621ARCPaper7Annex1_Strategic risk register

Risk Register

Risk ref­er­ence	Old ref­er­ence	Theme	Risk cat­egory	Risk descrip­tion	Mitigation/​con­trols in place	Cur­rent impact	Cur­rent like­li­hood	Risk score	Trend	Com­ment	Planned actions	Due date	Risk appet­ite	Tar­get impact	Tar­get like­li­hood	Tar­get risk score	Risk own­er	Date last updated
1	A1	All Resources	fin­an­cial	Pub­lic sec­tor fin­ances con­strain capa­city to alloc­ate suf­fi­cient resources to deliv­er cor­por­ate plan.	Pre­vent­at­ive: Ongo­ing liais­on with Scot­tish Gov­ern­ment through our spon­sor­ship team and the Peat­land Action Team, high­light­ing achieve­ments of CNPA. Pre­vent­at­ive: Cor­por­ate plan pri­or­it­ised around anti­cip­ated Scot­tish Gov­ern­ment budget alloc­a­tions, tak­ing on Board expect­a­tion of fund­ing con­straints. Remedi­al: Focus resource on diver­si­fic­a­tion of income streams to altern­at­ive, non-pub­lic income gen­er­a­tion. Remedi­al: Con­tinu­ing to sup­port ​“deliv­ery bod­ies” such as Cairngorms Nature, Cairngorms Trust in secur­ing inward investment.	5	4	20	Stat­ic	Risk escal­a­tion reflects Scot­tish Government’s con­tin­ued and heightened con­cerns on for­ward sta­bil­ity of cur­rent fin­an­cial alloc­a­tions; risk of in-year adjust­ments, and risk over future year fund­ing levels. Des­pite a good set­tle­ment for 2024 – 25, the risk of in-year adjust­ments remains a con­cern. All mit­ig­at­ing actions in place and operational.	Ongo­ing liais­on with Scot­tish Gov­ern­ment through our spon­sor­ship team and the Peat­land Action Team, high­light­ing achieve­ments of CNPA.	Ongo­ing	Open	5	2	10	Dav­id Cameron	30/01/2024
2		All Resources	fin­an­cial	Risk of C2030 match fund­ing not being secured — cur­rent match fund­ing in bid not fully com­mit­ted and/​or for one year only in many areas.	Pre­vent­at­ive: rep­res­ent­a­tions to SG to estab­lish peat­land res­tor­a­tion fund­ing as an essen­tial ele­ment in secur­ing NLHF invest­ment in the park	5	3	15	Stat­ic	Fund­ing for 2024 – 25 has been secured at £3.5m. This provides a suit­able level of match fund­ing for the C2030 pro­gramme, in line with the programme’s 5‑year budget.	Pre­vent­at­ive: high pro­file and ongo­ing focus for SMT in enga­ging in influ­en­cing to secure the match fund­ing needed from part­ners; pro­ject man­agers aware of rel­ev­ant pro­ject match fund­ing pos­i­tion and tasked with seek­ing addi­tion­al match fund­ing where appropriate.	Ongo­ing	Open	5	2	10	Dav­id Cameron	30/01/2024
3		All Resources	staff­ing	There are per­ceived gaps in our skill set with respect to: pro­cure­ment pro­cesses, recruit­ment of tech­nic­al staff, abil­ity to under­take neces­sary due dili­gence on out­put from con­sult­ants and con­tract­ors. — Risks that pro­cure­ment and wider skill set capa­cit­ies are insuf­fi­cient to meet the evolving needs of the organ­isa­tion. — Lack of expert­ise and exper­i­ence in man­aging con­struc­tion pro­jects may com­prom­ise the effect­ive­ness and effi­ciency of planned deliv­ery. — Fin­an­cial risks asso­ci­ated with the let­ting of con­tracts where part­ner­ship fund­ing is likely to be depend­ent on the achieve­ment of sat­is­fact­ory standards.		5	3	15	Escal­at­ing	Recruit­ment to new Pro­cure­ment Offider post. Pro­gramme of improve­ment in pro­cure­ment pro­cesses, pro­ced­ures and con­trols. Con­struc­tion pro­jects of the size anti­cip­ated with­in the C2030 pro­gramme are new to the organ­isa­tion. We need to improve our know­ledge of Con­struc­tion Design Man­age­ment Reg­u­la­tions (CDM) and con­tracts (NEC4). We lack exper­i­ence in pro­du­cing briefs and review­ing tenders of this size and type. Improve­ments in our skill set will also bene­fit: peat­land res­tor­a­tion, river res­tor­a­tion, con­struc­tion of paths, act­ive travel projects.	Pre­vent­at­ive: Con­sid­er­a­tion of approaches to gain­ing required expert­ise and resource, includ­ing poten­tial access to Cent­ral Gov­ern­ment Pro­cure­ment Shared Ser­vices (CGPSS) and Scot­land Excel. Ongo­ing dis­cus­sion with CGPSS and Scot­land Excel. Pre­vent­at­ive: Recruit­ment of Pro­cure­ment Officer/​addi­tion­al sup­port from LL&TNPA	Ongo­ing	Cau­tious	5	1	5	Dav­id Cameron	07/06/2024
4	A24	Nature & conservation	Stra­tegic delivery	The Authority’s range of powers com­bined with stra­tegic part­ner­ships is insuf­fi­cient to deliv­er out­comes on wild­life crime.	Pre­vent­at­ive: licen­cing arrange­ments con­trib­ute to more effect­ive con­trol frame­work. Tracker/​satel­lite mon­it­or­ing deployed for some rap­tors. Remedi­al: NPPP devel­op­ment pro­cesses used to explore part­ner­ship atti­tudes, engage­ment and powers.	4	4	16	Decreas­ing	Action on wild­life crime depends on the devel­op­ment, deliv­ery and design of stra­tegic part­ner­ships. Fin­an­cial con­straints with­in the pub­lic and third sec­tors is likely to reduce the level of resource avail­able to tackle this issue.	Development/​strength­en­ing of stra­tegic partnerships.	Ongo­ing	Open	4	3	12	Andy Ford	30/01/2024
5	A29	All Resources	staff­ing	Increas­ingly com­pet­it­ive and restric­ted recruit­ment cli­mate pre­vents staff with the required exper­i­ence and skill sets being secured. Plan­ning and oth­er spe­cial­ist staff (IT, pro­cure­ment, fin­ance) require­ments impacted by nation­al labour/​skills short­ages and/​or salary struc­tures not suf­fi­ciently com­pet­it­ive to attract or retain key staff.	Pre­vent­at­ive: focus on train­ing and devel­op­ment and intern­al suc­ces­sion plan­ning, in turn bring­ing recruit­ment into less experienced/​less highly skilled mar­kets and devel­op­ing pipeline of qual­i­fied staff Pre­vent­at­ive: con­sid­er­a­tion giv­en to job design, cre­at­ing roles with more seni­or­ity (high­er grades), and flex­ib­il­ity of offer regard­ing part-time/ job share.	4	4	16	Stat­ic	Evid­ence of redu­cing num­ber of applic­ants and can­did­ate lists for vacan­cies ongo­ing, while trend in unsuc­cess­ful recruit­ment exer­cises has been acted on with no recent unsuc­cess­ful recruitment.	Pre­vent­at­ive: Review our salary struc­tures and bench­mark these against organ­isa­tions with whom we might com­pete for staff, par­tic­u­larly in the loc­al area. Use this evid­ence to inform future pay structure/​awards. Remedi­al: con­tin­gency plan­ning for example around out sourcing of aspects of deliv­ery eg estab­lish call-off frame­work for con­sult plan­ning services.	31/03/2025	Open	3	3	9	Dav­id Cameron	30/01/2024
6		All Resources	staff­ing	Sup­port­ing speed of organ­isa­tion­al change pre­vents required devel­op­ment and embed­ding of effect­ive sup­port sys­tems. The speed / scale of oper­a­tion­al demand for sup­port from cor­por­ate sys­tems is such that we are always fire-fight­ing and giv­ing the best advice and sup­port we can. How­ever, that ongo­ing fire-fight­ing and imme­di­ate advice pre­vents us hav­ing suf­fi­cient time to design, devel­op and imple­ment new sys­tems to bet­ter suit the new organisation.	Remedi­al: recruit­ment of addi­tion­al staff to cor­por­ate func­tion dur­ing 22⁄23 and 23⁄24.	4	4	16	Stat­ic	Assess­ment of the impact of new/​addi­tion­al activ­it­ies on cor­por­ate sys­tems and resources should be part of the ini­tial con­sid­er­a­tions of these activities.	Remedi­al: apply resource to devel­op­ment of improved systems/​ways of work­ing — bet­ter use of M365 applic­a­tions — improved fin­an­cial sys­tems Remedi­al: provide train­ing — pro­ject man­age­ment, pro­cure­ment etc.	31/12/2024	Open	3	3	9	Dav­id Cameron	30/01/2024
7		All Resources	staff­ing	Scot­tish Gov­ern­ment Main Group award 2023⁄25 cre­ates sig­ni­fic­ant fin­an­cial pres­sure on the Park Authority’s resource budget for 2024⁄25, with the poten­tial to affect pos­it­ive rela­tion­ships with the Uni­on, staff mor­ale and motiv­a­tion, recruit­ment and retention.	Pre­vent­at­ive: devel­op­ment of pay mod­els to identi­fy the poten­tial cost to the Park Author­ity of fol­low­ing the Main Group pos­i­tion & con­sider the impact of poten­tial pay strategies on the devel­op­ing budget pos­i­tion for 2024⁄25; con­sider pay award dates and staged awards as tools to meet expect­a­tions while main­tain­ing affordability	4	4	16	Stat­ic	Pay mod­els developed have been accom­mod­ated with­in the budget­for 2024⁄25.	Pre­vent­at­ive: Busi­ness case in sup­port of pay pro­pos­als sub­mit­ted to Scot­tish Gov­ern­ment — await­ing response.	30/09/2024	Open	3	3	9	Dav­id Cameron	07/06/2024
8	A9.3	All Resources	staff­ing	Our Cor­por­ate and Oper­a­tion­al Plan­ning sys­tems do not adapt to deliv­ery of major fun­ded pro­grammes along­side deliv­er­ing ​‘core’ nation­al park object­ives. This leads to work­force stretch between 3rd party fund­ing deliv­ery and ​‘core’ cor­por­ate plan activ­it­ies with increased risks of stress and reduced morale.	Pre­vent­at­ive: Stra­tegic and oper­a­tion­al plans developed with extern­ally fun­ded pro­ject deliv­ery as intrins­ic ele­ments of plans to ensure deliv­ery capa­city is con­sidered fully. Preventative:Importance of staff man­age­ment and task pri­or­it­isa­tion rein­forced through lead­er­ship meet­ings. Preventative:Focus on few­er, lar­ger impact pro­jects (C2030). Remedi­al: Per­form­ance Devel­op­ment Con­ver­sa­tions (PDCs) being deployed reg­u­larly with all staff to check on staff work­loads, with 2 way flows of com­mu­nic­a­tions enabled through that pro­cess on staff work­load and capacity.	3	5	15	Stat­ic	Addi­tion­al recruit­ment has alle­vi­ated key staff pres­sure points. Fixed term staff con­tracts reviewed through­out the year. Staff sur­vey res­ults (23÷24) pos­it­ive. Impact score of 3 reflects the risks inher­ent in the likely intens­ity of work dur­ing ini­tial stages of C2030.Likelihood of risk there­fore held stat­ic. Impact of meas­ures and risk pro­file will con­tin­ue to be closely mon­itored through staff man­age­ment processes.	Pre­vent­at­ive: Staff and fin­an­cial resources for C2030 con­sidered along­side oper­a­tion­al plan activ­ity as part of budget devel­op­ment pro­cess for 24⁄25.	31/03/2024	Open	3	3	9	Dav­id Cameron	30/01/2024
9	A13/ A18	All Tech­nic­al		CNPA IT ser­vices are not suf­fi­ciently robust/​secure/​or well enough spe­cified to sup­port effect­ive and effi­cient ser­vice deliv­ery. Increas­ing demand for know­ledge around Microsoft 365 and cyber secur­ity is out­strip­ping the team’s knowledge/​skill-set. Increas­ing ICT depend­ency for effect­ive and effi­cient oper­a­tions is not adequately backed up by ICT sys­tems sup­port. Use of AI increases risk of cyber secur­ity threats such as spear-phishing.	Pre­vent­at­ive: Daily review of Scot­tish Cyber Coordin­a­tion Centre threat sum­mar­ies, with fol­low up action taken (eg patch­ing) as appro­pri­ate. Preventative/​remedi­al: Col­lab­or­a­tion with LL&TNPA provides support.	5	3	15	Escal­at­ing	Intern­al audit report on IT Strategy sets out key actions in this area of risk man­age­ment around IT Strategy devel­op­ment, pro­ject man­age­ment and cost­ing of IT action plans to be imple­men­ted. Move­ment into Microsoft 365 deploy­ment and cloud based sys­tems con­tin­ues. Con­sid­er­a­tion giv­en to effect­ive­ness of shared ser­vices with LL&TNPA. Devel­op­ment of the IT oper­a­tion­al risk register has iden­ti­fied poten­tial for struc­tur­al improve­ment. These con­sid­er­a­tions to be developed fur­ther, with the poten­tial for extern­al con­sultancy to devel­op our IT strategy — organ­isa­tion­al devel­op­ment, tech­nic­al improve­ments and upskilling. Trans­ition to Share­point almost com­plete; R‑drive will become a read-only repos­it­ory, redu­cing risk of threats from out­side the organisation.	Pro­gress towards Cyber-secur­ity plus accred­it­a­tion is	30/08/2024	Cau­tious	3	2	6	Dav­id Cameron	07/06/2024
10	A22	All Tech­nic­al		Busi­ness Con­tinu­ity Plans (BCP) are inad­equate to deal with sig­ni­fic­ant impacts to nor­mal work­ing arrange­ments and res­ult in ser­vice failure.	Pre­vent­at­ive: Devel­op­ment of hybrid work­ing meth­ods and cloud com­put­ing approaches have improved the organisation’s resilience.	5	3	15	Stat­ic	Work on BCP assisted in roll out of ini­tial and ongo­ing responses to Coronavir­us pan­dem­ic. Now that hybrid work­ing arrange­ments are embed­ded, there is a need to recon­sider BCP.	Pre­vent­at­ive: pro­posed con­sultancy to devel­op new BCP	31/03/2025	Cau­tious	5	1	5	Dav­id Cameron	30/01/2024
11		All	Repu­ta­tion	Repu­ta­tion­al dam­age may res­ult from: — Unreal­ist­ic expect­a­tions of what the Park Author­ity and its part­ners can achieve in the face of the sig­ni­fic­ant risks presen­ted by cli­mate change, spe­cies extinc­tion, flood man­age­ment and fire; and/​or — Dis­agree­ment between the Park Author­ity and stake­hold­er groups with­in the Park.	Pre­vent­at­ive: Exist­ing stra­tegic part­ner­ships and stake­hold­er rela­tion­ships help to cre­ate a wider under­stand­ing of the factors that are with­in, and those that are out­side the con­trol of the Park Author­ity and its partners.	5	4	20	Escal­at­ing	Pre­vent­at­ive: Man­age­ment of expect­a­tions through: — Tar­geted com­mu­nic­a­tions — Fur­ther devel­op­ment of stake­hold­er rela­tion­ships. — Development/​strength­en­ing of stra­tegic part­ner­ships. — Ongo­ing assess­ment of oper­a­tion­al risk man­age­ment and mit­ig­a­tion in our communications		Ongo­ing	Open	3	3	9	Grant Moir	30/01/2024