Annu­al Audit Report

Cairngorms Nation­al Park Author­ity – year ended 31 March 2024

Septem­ber 2024

Page 2

Audit and Risk Committee Cairngorms Nation­al Park Author­ity 14 The Square Grant­own on Spey PH26 3HG

Septem­ber 2024

For­vis Mazars 100 Queen Street Glas­gow G1 3DN

Dear Com­mit­tee Mem­bers and the Aud­it­or Gen­er­al for Scotland,

Annu­al Audit Report – Year ended 31 March 2024

We are pleased to present our Annu­al Audit Report for the year ended 31 March 2024. The pur­pose of this doc­u­ment is to sum­mar­ise our audit con­clu­sions and find­ings from our con­sid­er­a­tions of the wider scope audit spe­cified in the Code of Audit Prac­tice 2021, namely; fin­an­cial man­age­ment; fin­an­cial sus­tain­ab­il­ity; vis­ion, lead­er­ship and gov­ernance; and use of resources to improve outcomes.

The scope of our work, includ­ing iden­ti­fied sig­ni­fic­ant audit risks, and oth­er key judge­ment areas, was out­lined in our Annu­al Audit Plan, which we presen­ted to you on 19 April 2024. We have reviewed our Annu­al Audit Plan and con­cluded that the sig­ni­fic­ant audit risks and oth­er key judge­ment areas set out in that report remain appropriate.

We would like to express our thanks for the assist­ance of Cairngorms Nation­al Park Authority’s team dur­ing our audit.

If you would like to dis­cuss any mat­ters in more detail then please do not hes­it­ate to con­tact me on +44 7816354994.

Yours faith­fully,

Tom Reid (Audit Dir­ect­or) For­vis Maz­ars LLP

For­vis Maz­ars LLP – 100 Queen Street, Glas­gow, G1 3DN Tel: 0131 313 7900 – www​.for​v​is​maz​ars​.com/uk

For­vis Maz­ars LLP is the UK firm of For­vis Maz­ars Glob­al, a lead­ing glob­al pro­fes­sion­al ser­vices net­work. For­vis Maz­ars LLP is a lim­ited liab­il­ity part­ner­ship registered in Eng­land and Wales with registered num­ber OC308299 and with its registered office at 30 Old Bailey, Lon­don, EC4M 7AU. Registered to carry on audit work in the UK by the Insti­tute of Chartered Account­ants in Eng­land and Wales. Details about our audit regis­tra­tion can be viewed at www​.auditre​gister​.org​.uk under ref­er­ence num­ber C001139861. VAT num­ber: GB 839 8356 73

Page 3

Con­tents

01 Exec­ut­ive sum­mary 02 Status of the audit 03 Audit approach 04 Sig­ni­fic­ant find­ings 05 Intern­al con­trol con­clu­sions 06 Sum­mary of mis­state­ments 07 Wider Scope and Best Value A Appendix A: Draft man­age­ment rep­res­ent­a­tion let­ter B Appendix B: Draft audit report C Appendix C: Con­firm­a­tion of our inde­pend­ence D Appendix D: Oth­er com­mu­nic­a­tions E Appendix E: Wider scope ratings

Our reports are pre­pared in accord­ance with Terms of Appoint­ment Let­ter from Audit Scot­land dated 18 May 2022 through which the Aud­it­or Gen­er­al for Scot­land has appoin­ted us as extern­al aud­it­or of the Cairngorms Nation­al Park Author­ity (CNPA) for fin­an­cial years ²⁰²²⁄₂₃ to ²⁰²⁶⁄₂₇. We under­take our audit in accord­ance with the Pub­lic Fin­ance and Account­ab­il­ity (Scot­land) Act 2000, as amended; and our respons­ib­il­it­ies as set out with­in Audit Scotland’s Code of Audit Prac­tice 2021.

Reports and let­ters pre­pared by appoin­ted aud­it­ors and addressed to CNPA are pre­pared for the sole use of CNPA and made avail­able to Audit Scot­land and the Aud­it­or Gen­er­al for Scot­land. We take no respons­ib­il­ity to any mem­ber or officer in their indi­vidu­al capa­city or to any oth­er third party.

Page 5

Exec­ut­ive summary

Audit con­clu­sions and sig­ni­fic­ant findings

The detailed scope of our work as your appoin­ted aud­it­or for ²⁰²³⁄₂₄ is set out in Audit Scotland’s Code of Audit Prac­tice 2021. Our respons­ib­il­it­ies and powers are derived from our appoint­ment by the Aud­it­or Gen­er­al under the Pub­lic Fin­ance and Account­ab­il­ity (Scot­land) Act 2000 and as out­lined in our Annu­al Audit Plan, our audit has been con­duc­ted in accord­ance with Inter­na­tion­al Stand­ards on Audit­ing (UK) and means we focus on audit risks that we have assessed as res­ult­ing in a high­er risk of mater­i­al misstatement.

In sec­tion 4 of this report we have set out our con­clu­sions and sig­ni­fic­ant find­ings from our audit. This sec­tion includes our con­clu­sions on the audit risks and areas of man­age­ment judge­ment in our Annu­al Audit Plan, which include:

• Man­age­ment over­ride of controls;
• Fraud over expendit­ure recog­ni­tion; and
• Fraud over recog­ni­tion of revenue.

Mis­state­ments and intern­al con­trol recommendations

Sec­tion 5 sets out intern­al con­trol recom­mend­a­tions and sec­tion 6 sets out audit mis­state­ments. Sec­tion 7 out­lines our work on Cairngorms Nation­al Park Author­ity (CNPA)’s arrange­ments to achieve eco­nomy, effi­ciency and effect­ive­ness in its use of resources.

Status and audit opinion

We have sub­stan­tially com­pleted our audit in respect of the fin­an­cial state­ments for the year ended 31 March 2024. At the time of pre­par­ing this report, there are mat­ters remain­ing out­stand­ing as out­lined in sec­tion 2. We will provide an update to you in rela­tion to the mat­ters out­stand­ing through issu­ing our final annu­al audit report.

Audit opin­ion

We expect to issue an unqual­i­fied opin­ion, without modi­fic­a­tion, on the fin­an­cial state­ments. Our pro­posed audit opin­ion is included in the draft auditor’s report in Appendix B.

Reg­u­lar­ity

We expect to issue an unqual­i­fied opin­ion, without modi­fic­a­tion, that in all mater­i­al respects, the expendit­ure and income in the fin­an­cial state­ments were incurred or applied in accord­ance with any applic­able enact­ments and guid­ance issued by the Scot­tish Min­is­ters. Our pro­posed audit opin­ion is included in the draft auditor’s report in Appendix B.

Page 6

Exec­ut­ive sum­mary (con­tin­ued)

Con­clu­sions from our audit test­ing and audit opin­ion (con­tin­ued)

Mat­ters on which we report by exception

We are required by the Aud­it­or Gen­er­al for Scot­land to report to you if, dur­ing the course of our audit, we have found that adequate account­ing records have not been kept; the fin­an­cial state­ments and the audited part of the Remu­ner­a­tion and Staff Report are not in agree­ment with the account­ing records; or we have not received all the inform­a­tion and explan­a­tions we require for our audit. We have noth­ing to report in respect of these matters.

Gov­ernance State­ment and Per­form­ance Report

We are required to report on wheth­er the inform­a­tion giv­en in the Gov­ernance State­ment and Per­form­ance Report is con­sist­ent with the fin­an­cial state­ments; and has been prop­erly pre­pared in accord­ance with the Nation­al Parks (Scot­land) Act 2000 and dir­ec­tions made there­un­der by the Scot­tish Min­is­ters. We have no mat­ters to report in respect of the Gov­ernance State­ment or the Per­form­ance Report.

Oth­er information

We are required to report on wheth­er the oth­er inform­a­tion (com­pris­ing of the Per­form­ance Report and the Account­ab­il­ity Report and the unaudited parts of the Remu­ner­a­tion and Staff Report), is mater­i­ally incon­sist­ent with the fin­an­cial state­ments; is mater­i­ally incon­sist­ent with our know­ledge obtained in the course of the audit; or is mater­i­ally mis­stated. No incon­sist­en­cies have been iden­ti­fied and we have issued an unmod­i­fied opin­ion in this respect.

Page 7

Exec­ut­ive sum­mary (con­tin­ued)

Wider Scope conclusions

As aud­it­ors appoin­ted by the Aud­it­or Gen­er­al of Scot­land, our wider scope respons­ib­il­it­ies are set out in Audit Scotland’s Code of Audit Prac­tice 2021. The Code require­ments broaden the scope of the ²⁰²³⁄₂₄ audit and allows us to use a risk-based approach to report on our con­sid­er­a­tion of the CNPA’s per­form­ance and make recom­mend­a­tions for improve­ment and, where appro­pri­ate, con­clude on CNPA’s performance.

The Code’s wider scope frame­work is cat­egor­ised into four areas:

• fin­an­cial management;
• fin­an­cial sustainability;
• vis­ion, lead­er­ship and gov­ernance; and
• use of resources to improve outcomes.

It remains the respons­ib­il­ity of CNPA to ensure prop­er fin­an­cial stew­ard­ship of pub­lic funds, it com­plies with rel­ev­ant legis­la­tion and estab­lishes effect­ive gov­ernance of their activ­it­ies. CNPA is also respons­ible for ensur­ing that it estab­lishes arrange­ments to secure con­tinu­ous improve­ment in per­form­ance and, in mak­ing those arrange­ments, ensures resources are being used to improve stra­tegic out­comes and demon­strate the eco­nomy, effi­ciency, and effect­ive­ness through­out the use of its resources. These arrange­ments should be pro­por­tion­ate to the size and type of the NDPB, appro­pri­ate to the nature of the NDPB and the ser­vices and func­tions that it has been cre­ated to deliver.

Wider Scope

We anti­cip­ate hav­ing no risks in arrange­ments to report in rela­tion to the fin­an­cial man­age­ment; fin­an­cial sus­tain­ab­il­ity; vis­ion, lead­er­ship and gov­ernance; and use of resources to improve out­comes arrange­ments that CNPA has in place. Fur­ther detail on our Wider Scope work is provided in sec­tion 7 of this report includ­ing any sig­ni­fic­ant risks identified.

Page 9

Status of our audit

Our audit work is sub­stan­tially com­plete and there are cur­rently no mat­ters of which we are aware that would require modi­fic­a­tion of our audit opin­ion, sub­ject to the sat­is­fact­ory res­ol­u­tion of the out­stand­ing mat­ters set out below.

Audit area	Risk of mater­i­al adjust­ment or sig­ni­fic­ant change	Descrip­tion of the out­stand­ing mat­ters	Status
Cash equi­val­ent trans­fer val­ues of pen­sions as dis­closed in the Remu­ner­a­tion and Staff Report	Medi­um	We are com­plet­ing the audit pro­ced­ures for this area set out in our Annu­al Audit Plan. We could not com­plete this work earli­er in the audit due to a delay in MyC­SP provid­ing the required inform­a­tion to CNPA.	High — Likely to res­ult in a mater­i­al adjust­ment or a sig­ni­fic­ant change to dis­clos­ures in the fin­an­cial statements.
Audit qual­ity con­trol and com­ple­tion procedures	Medi­um	Our audit work is under­go­ing final stages of review by the Engage­ment Lead and fur­ther qual­ity and com­pli­ance checks. In addi­tion, there are resid­ual pro­ced­ures to com­plete, includ­ing updat­ing post bal­ance sheet event con­sid­er­a­tions to the point of issu­ing the opin­ion, obtain­ing final man­age­ment rep­res­ent­a­tions and agree­ing adjust­ments to the final set of accounts. The main areas where reviews are ongo­ing are journ­als and income and expendit­ure test­ing, and con­clu­sions on IT Gen­er­al Controls.	Medi­um — Poten­tial to res­ult in a mater­i­al adjust­ment or a sig­ni­fic­ant change to dis­clos­ures in the fin­an­cial statements.
Annu­al Report and Accounts and let­ter of representation	Low	We will com­plete our final review of the annu­al report and accounts upon receipt of the signed ver­sion of the accounts and let­ter of representation.	Low — Not con­sidered likely to res­ult in a mater­i­al adjust­ment or a change to dis­clos­ures in the fin­an­cial statements.

Page 11

Audit Approach

Changes to our audit approach

We have made the fol­low­ing change to the audit approach we com­mu­nic­ated in our Annu­al Audit Plan, issued on 31 March 2024 and presen­ted to the Audit and Risk Com­mit­tee on 19 April 2024:

In the Annu­al Audit Plan we iden­ti­fied fraud over expendit­ure recog­ni­tion as a sig­ni­fic­ant risk. How­ever, fur­ther audit pro­ced­ures and inquir­ies and con­sid­er­a­tion of res­ults from our pri­or year test­ing, has led us to rebut this sig­ni­fic­ant risk. We have iden­ti­fied an enhanced risk for oper­a­tion­al plan expendit­ure due to the risk of error or judge­ment in the recog­ni­tion of this type of expenditure.

Mater­i­al­ity

Our pro­vi­sion­al mater­i­al­ity at the plan­ning stage of the audit was set at £0.263m using a bench­mark of 2% of total expendit­ure. Our Per­form­ance mater­i­al­ity was set at £0.184m. Based on the final fin­an­cial state­ment fig­ures and oth­er qual­it­at­ive factors, the final over­all mater­i­al­ity we applied was £0.291m, our final per­form­ance mater­i­al­ity was £0.203m, and our final clearly trivi­al threshold was £9k.

Use of experts

There have been no changes to our use of experts out­lined in our Annu­al Audit Plan, with no issues arising which we are required to report to you.

Ser­vice organisations

There have been no changes to CNPA’s use of ser­vice organ­isa­tions out­lined in our Annu­al Audit Plan, with no issues arising we are required to report to you.

Page 13

Sig­ni­fic­ant findings

Sig­ni­fic­ant find­ings, includ­ing key areas of man­age­ment judgement

The sig­ni­fic­ant find­ings from our audit include:

• our audit con­clu­sions regard­ing sig­ni­fic­ant risks and key areas of man­age­ment judge­ment out­lined in the Annu­al Audit Plan;
• our com­ments in respect of the account­ing policies and dis­clos­ures that you have adop­ted in the fin­an­cial state­ments. On page 17 we have con­cluded wheth­er the fin­an­cial state­ments have been pre­pared in accord­ance with the fin­an­cial report­ing frame­work and com­men­ted on any sig­ni­fic­ant account­ing policy changes that have been made dur­ing the year;
• any fur­ther sig­ni­fic­ant mat­ters dis­cussed with management;
• any sig­ni­fic­ant dif­fi­culties we exper­i­enced dur­ing the audit.

Page 14

Sig­ni­fic­ant findings

Man­age­ment over­ride of controls

Descrip­tion of the risk

Man­age­ment at vari­ous levels with­in an organ­isa­tion are in a unique pos­i­tion to per­pet­rate fraud because of their abil­ity to manip­u­late account­ing records and pre­pare fraud­u­lent fin­an­cial state­ments by over­rid­ing con­trols that oth­er­wise appear to be oper­at­ing effect­ively. Due to the unpre­dict­able way in which such over­ride could occur there is a risk of mater­i­al mis­state­ment due to fraud on all audits.

How we addressed this risk

We addressed this risk by:

• review­ing the key areas with­in the fin­an­cial state­ments where man­age­ment has used judge­ment and estim­a­tion tech­niques and con­sid­er­ing wheth­er there is evid­ence of unfair bias;
• examin­ing any account­ing policies that vary from the Gov­ern­ment Fin­an­cial Report­ing Manual;
• test­ing the appro­pri­ate­ness of journ­al entries recor­ded in the gen­er­al ledger and oth­er adjust­ments made in pre­par­ing the fin­an­cial state­ments; and
• con­sid­er­ing and test­ing any sig­ni­fic­ant trans­ac­tions out­side the nor­mal course of busi­ness or oth­er­wise unusual.

Audit con­clu­sion

We are com­plet­ing our review pro­ced­ures, but at this stage have no issues to report.

Page 15

4. Sig­ni­fic­ant find­ings (con­tin­ued)

Fraud over recog­ni­tion of revenue

Descrip­tion of the risk

As set out in Inter­na­tion­al Stand­ard on Audit­ing (UK) 240: The auditor’s respons­ib­il­it­ies relat­ing to fraud in an audit of fin­an­cial state­ment, there is a pre­sumed risk of fraud over the recog­ni­tion of rev­en­ue. There is a risk that rev­en­ue may be mis­stated res­ult­ing in a mater­i­al mis­state­ment in the fin­an­cial state­ments. CNPA has mater­i­al oper­a­tion­al plan income. The nature of this income means there is an increased risk of fraud in its recognition.

How we addressed this risk

We addressed this risk by under­tak­ing sub­stant­ive pro­ced­ures, spe­cific­ally test­ing a sample of trans­ac­tions and examin­ing rel­ev­ant sup­port­ing doc­u­ments, to ensure oper­a­tion­al plan income is recor­ded appro­pri­ately in the fin­an­cial statements.

Audit con­clu­sion

Our review pro­ced­ures in this area are ongo­ing, but at this stage we have no issues to report.

Page 16

4. Sig­ni­fic­ant find­ings (con­tin­ued)

Enhanced Risk/​Key areas of man­age­ment judgement

Expendit­ure recognition

Descrip­tion of the risk

Prac­tice Note 10: Audit of fin­an­cial state­ments and reg­u­lar­ity of pub­lic sec­tor bod­ies in the United King­dom high­lights that, as most pub­lic-sec­tor bod­ies are net spend­ing bod­ies, the risk of fraud related to expendit­ure may be great­er than the risk relat­ing to rev­en­ue recog­ni­tion. A sig­ni­fic­ant amount of CNPA’s expendit­ure is salar­ied staff costs, depre­ci­ation and impair­ment. Staff costs are well con­trolled and made up of low value indi­vidu­al trans­ac­tions. How­ever, CNPA has mater­i­al oper­a­tion­al plan expendit­ure. The nature of this expendit­ure means there is an increased risk that it is incor­rectly recog­nised which could res­ult in a mater­i­al mis­state­ment in the fin­an­cial statements.

How we addressed this risk

We addressed this risk by under­tak­ing sub­stant­ive pro­ced­ures, spe­cific­ally test­ing a sample of trans­ac­tions and examin­ing rel­ev­ant sup­port­ing doc­u­ments, to ensure oper­a­tion­al plan expendit­ure is recor­ded appro­pri­ately in the fin­an­cial statements.

Audit con­clu­sion

Our review pro­ced­ures in this area are ongoing.

Page 17

Sig­ni­fic­ant find­ings (con­tin­ued)

Qual­it­at­ive aspects of CNPA’s account­ing practices

We have reviewed CNPA’s account­ing policies and dis­clos­ures and con­cluded they com­ply with the Gov­ern­ment Fin­an­cial Report­ing Manu­al (FReM) ²⁰²³⁄₂₄, appro­pri­ately tailored to CNPA’s cir­cum­stances. The unaudited annu­al report and accounts received from CNPA were of a good quality.

Sig­ni­fic­ant mat­ters dis­cussed with management

Dur­ing our audit no sig­ni­fic­ant mat­ters arose for dis­cus­sion with management.

Sig­ni­fic­ant dif­fi­culties dur­ing the audit

Dur­ing the course of the audit we did not encounter any sig­ni­fic­ant dif­fi­culties and we had the full cooper­a­tion of man­age­ment. We will hold a les­sons learned meet­ing with officers fol­low­ing the con­clu­sion of the audit to identi­fy how we can improve the audit pro­cess in ²⁰²⁴⁄₂₅.

Page 18

Sig­ni­fic­ant find­ings (con­tin­ued)

Wider respons­ib­il­it­ies – stat­utory reporting

We are required to noti­fy the Aud­it­or Gen­er­al when cir­cum­stances indic­ate that a stat­utory report may be required.

• Sec­tion 22 of the Pub­lic Fin­ance and Account­ab­il­ity (Scot­land) Act 2000 allows us to pre­pare a report to bring to the atten­tion of the Scot­tish Par­lia­ment and the pub­lic, mat­ters of pub­lic interest arising dur­ing the audit of CNPA. We con­firm no such reports have been prepared.
• Sec­tion 23 of the Pub­lic Fin­ance and Account­ab­il­ity (Scot­land) Act 2000 allows us to ini­ti­ate an exam­in­a­tion into the eco­nomy, effi­ciency and effect­ive­ness with which CNPA and their office­hold­ers have used their resources in dis­char­ging their func­tions. We con­firm that no such exam­in­a­tions have been initiated.

Page 20

Intern­al con­trol conclusions

Over­view of engagement

As part of our audit, we obtained an under­stand­ing of CNPA’s intern­al con­trol envir­on­ment and con­trol activ­it­ies rel­ev­ant to the pre­par­a­tion of the fin­an­cial state­ments, which was suf­fi­cient to plan our audit and determ­ine the nature, tim­ing, and extent of our audit pro­ced­ures. Although our audit was not designed to express an opin­ion on the effect­ive­ness of CNPA’s intern­al con­trols, we are required to com­mu­nic­ate to the Audit and Risk Com­mit­tee any sig­ni­fic­ant defi­cien­cies in intern­al con­trols that we iden­ti­fied dur­ing our audit.

Defi­cien­cies in intern­al control

A defi­ciency in intern­al con­trol exists if:

• A con­trol is designed, imple­men­ted, or oper­ated in such a way that it is unable to pre­vent, detect, and/​or cor­rect poten­tial mis­state­ments in the fin­an­cial state­ments; or
• A neces­sary con­trol to pre­vent, detect, and/​or cor­rect mis­state­ments in the fin­an­cial state­ments on a timely basis is missing.

The pur­pose of our audit was to express an opin­ion on the fin­an­cial state­ments. As part of our audit, we have con­sidered CNPA’s intern­al con­trols rel­ev­ant to the pre­par­a­tion of the fin­an­cial state­ments to design audit pro­ced­ures to allow us to express an opin­ion on the fin­an­cial state­ments, but not for the pur­pose of express­ing an opin­ion on the effect­ive­ness of CNPA’s intern­al con­trols or to identi­fy any sig­ni­fic­ant defi­cien­cies in their design or operation.

The mat­ters repor­ted in this sec­tion of our report are lim­ited to those defi­cien­cies and oth­er con­trol recom­mend­a­tions that we have iden­ti­fied dur­ing our nor­mal audit pro­ced­ures and which we con­sider to be of suf­fi­cient import­ance to mer­it being repor­ted. If we had per­formed more extens­ive pro­ced­ures on intern­al con­trol, we might have iden­ti­fied more defi­cien­cies to report or con­cluded that some of the repor­ted defi­cien­cies need not in fact have been reported.

Our com­ments in this sec­tion should not be regarded as a com­pre­hens­ive record of all defi­cien­cies that may exist or improve­ments that could be made.

The defi­cien­cies in CNPA’s intern­al con­trols that we have iden­ti­fied as at the date of this report are in set out on the fol­low­ing pages.

Sig­ni­fic­ant defi­cien­cies in intern­al control

A sig­ni­fic­ant defi­ciency in intern­al con­trol is one which, in our pro­fes­sion­al judge­ment, has the poten­tial for fin­an­cial loss, dam­age to repu­ta­tion, or a loss of inform­a­tion which may have implic­a­tions on the achieve­ment of busi­ness stra­tegic object­ives. Our view is that obser­va­tions cat­egor­ised as a sig­ni­fic­ant defi­ciency is of suf­fi­cient import­ance to mer­it the atten­tion of the Audit and Risk Com­mit­tee. We have not iden­ti­fied any sig­ni­fic­ant defi­cien­cies in CNPA’s intern­al con­trols as at the date of this report.

Oth­er observations

We also record our obser­va­tions on CNPA’s intern­al con­trols where, in our pro­fes­sion­al judge­ment, there is a need to strengthen intern­al con­trol or enhance busi­ness effi­ciency that do not con­sti­tute sig­ni­fic­ant defi­cien­cies in intern­al con­trol but which we view as being import­ant for con­sid­er­a­tion by management.

Page 21

Intern­al con­trol con­clu­sions (con­tin­ued)

Oth­er defi­cien­cies in intern­al control

In our view, there is a need to address the defi­cien­cies in intern­al con­trol set out in this sec­tion (which are not deemed to be sig­ni­fic­ant defi­cien­cies) to strengthen intern­al con­trol or enhance busi­ness effi­ciency. Our recom­mend­a­tions should be actioned by man­age­ment in the near future.

Descrip­tion of deficiency

Inform­a­tion and Data Secur­ity – Level 3

CNPA has not obtained Cyber Essen­tials Plus accred­it­a­tion for 2024. Cyber Essen­tials is a Gov­ern­ment backed scheme designed to help pro­tect organ­isa­tions against a range of the most com­mon cyber-attacks. Cyber Essen­tials Plus includes a hands-on tech­nic­al verification.

Poten­tial effects

CNPA may be exposed to attempts to harm or exploit its com­puter systems.

Recom­mend­a­tion

CNPA should work to obtain Cyber Essen­tials Plus accreditation.

Man­age­ment response

Work towards accred­it­a­tion is almost com­plete. The basic Cyber Essen­tials accred­it­a­tion has been achieved; audit of the Authority’s sys­tems toward Cyber Essen­tials Plus accred­it­a­tion is underway.

Page 22

Intern­al con­trol con­clu­sions (con­tin­ued)

Descrip­tion of deficiency

Com­plex Gen­er­al Ledger Structures

CNPA has com­plex and time-con­sum­ing gen­er­al ledger struc­tures and account­ing pro­cesses, as evid­enced by the fol­low­ing features:

• Use of mul­tiple ​‘com­pan­ies’, which means CNPA per­forms manu­al con­sol­id­a­tion to pro­duce a res­ult for the whole organ­isa­tion from the six com­pan­ies set up in the SAGE fin­an­cial ledger system
• Incon­sist­en­cies in the Chart of Accounts for the five companies
• Requis­i­tions for pro­cure­ment pre­pared in Excel
• Report­ing and payroll pro­cessing require manu­al input into the SAGE system.

We note that man­age­ment have sought and received approv­al for the acquis­i­tion of a new account­ing sys­tem, with approv­al provided in June 2024.

Poten­tial effects

The pro­cesses cur­rently in place res­ult in duplic­a­tion of efforts, are time-con­sum­ing and strenu­ous for the fin­ance team, and could lead to errors in inform­a­tion processing.

Recom­mend­a­tion

We recom­mend that CNPA ensures that any new account­ing sys­tem meets its needs and addresses the issues iden­ti­fied above. CNPA should also ensure there is a clear pro­ject plan for imple­ment­ing the new system.

Man­age­ment response

The sys­tem chosen, Access Fin­an­cials, will meet the needs of the Author­ity. Cur­rently we are work­ing through the imple­ment­a­tion pro­ject plan with the aim of going live on the new sys­tem in Janu­ary 2025.

Page 23

Intern­al con­trol con­clu­sions (con­tin­ued)

Fol­low up on pre­vi­ous intern­al con­trol points (repor­ted in ²⁰²²⁄₂₃ Annu­al Audit Report)

Descrip­tion of defi­ciency	Fol­low up on pre­vi­ous intern­al con­trol points (repor­ted in 2022⁄23 Annu­al Audit Report)
CNPA was the vic­tim of fraud in 2022⁄23 due to inad­equate pro­ced­ures for con­firm­ing changes in sup­pli­er bank details.	Com­plex and time-con­sum­ing gen­er­al ledger struc­tures and account­ing pro­cesses cur­rently exist with­in the entity, as evid­enced by the fol­low­ing fea­tures: • Use of mul­tiple ​‘com­pan­ies’, which means CNPA per­forms manu­al con­sol­id­a­tion to pro­duce a res­ult for the whole organ­isa­tion from the five com­pan­ies set up in the SAGE fin­an­cial ledger sys­tem • Incon­sist­en­cies in the Chart of Accounts for the five com­pan­ies • Requis­i­tions for pro­cure­ment pre­pared in Excel • Report­ing and payroll pro­cessing require manu­al input into the SAGE system.
Poten­tial effects: Hos­tile act­ors could exploit this con­trol weak­ness lead­ing to fin­an­cial loss for CNPA.	Poten­tial effects: The pro­cesses cur­rently in place res­ult in duplic­a­tion of efforts, are time-con­sum­ing and strenu­ous for the fin­ance team, and could lead to errors in inform­a­tion processing.
Recom­mend­a­tion: CNPA has enhanced its con­trols for con­firm­a­tion of sup­pli­er bank details, includ­ing requests for change of details. This includes intro­du­cing call-back pro­ced­ures and a new sup­pli­er set up form. We recom­mend that man­age­ment ensure its new con­trols over con­firm­a­tion of pay­ment requests and changes in bank details are oper­at­ing effectively.	Recom­mend­a­tion: Man­age­ment has pre­pared a paper out­lining the improve­ments required to the ledger sys­tem. We recom­mend that CNPA imple­ments new account­ing sys­tems that sim­pli­fy processes.
2023⁄24 update: Com­plete. We reviewed the changes intro­duced by CNPA in the plan­ning and inter­im phase of the 2023⁄24 audit and con­firmed that the new con­trols were operating.	2023⁄24 update: Ongo­ing. Man­age­ment sought and received approv­al for the acquis­i­tion of a new account­ing sys­tem, with approv­al provided in June 2024. CNPA plans to imple­ment the new sys­tem in 2024⁄25. See intern­al con­trol recom­mend­a­tion on page 22.

Page 24

Intern­al con­trol con­clu­sions (con­tin­ued)

Fol­low up on pre­vi­ous intern­al con­trol points (repor­ted in ²⁰²²⁄₂₃ Annu­al Audit Report)

Descrip­tion of deficiency

Weak­ness in cyber secur­ity gov­ernance and con­trols in that there is an absence of robust pro­cesses in place at CNPA to assess vul­ner­ab­il­ity to cyber secur­ity risk.

Poten­tial effects

Hos­tile act­ors could exploit this con­trol weak­ness lead­ing to loss of inform­a­tion or fin­an­cial loss for CNPA sim­il­ar to the incid­ent that occurred with­in the fin­an­cial year under review.

Recom­mend­a­tion

We recom­mend that CNPA design and imple­ment form­al gov­ernance and risk man­age­ment func­tions over cyber risk.

²⁰²³⁄₂₄ update

In pro­gress. See intern­al con­trol recom­mend­a­tion on page 21.

Page 26

Sum­mary of misstatements

We set out below and on the fol­low­ing pages a sum­mary of the mis­state­ments we iden­ti­fied dur­ing our audit, above the trivi­al threshold for adjust­ment of £9k. Our over­all mater­i­al­ity, per­form­ance mater­i­al­ity, and clearly trivi­al (report­ing) threshold were repor­ted in our Annu­al Audit Plan, issued on 31 March 2024. Any sub­sequent changes to those fig­ures are set out in the sec­tion 3 of this report.

Unad­jus­ted misstatements

None iden­ti­fied

Adjus­ted misstatements

None iden­ti­fied.

Dis­clos­ure misstatements

We iden­ti­fied the fol­low­ing adjust­ments dur­ing our audit that have been cor­rec­ted by management:

Per­form­ance report:- Inclu­sion of addi­tion­al inform­a­tion to cov­er dis­clos­ures required by the FReM:-

• Detail on indic­at­ors (includ­ing trend inform­a­tion), quant­it­at­ive inform­a­tion, and pri­or year inform­a­tion in rela­tion to per­form­ance against key deliverables.
• Sum­mary of the prin­cip­al risks faced by the CNPA and how these indi­vidu­al risks have been mitigated.

Gov­ernance State­ment:- Amend­ments made in response to the fol­low­ing points:-

• Addi­tion­al com­ment­ary in the Gov­ernance State­ment to indic­ate wheth­er any sig­ni­fic­ant find­ings or weak­nesses have been iden­ti­fied from the sources rel­ev­ant for review­ing effect­ive­ness of risk management.

Remu­ner­a­tion and Staff Report:- Amend­ments made in response to the fol­low­ing points:-

• Provid­ing addi­tion­al nar­rat­ive to explain the restate­ment of con­sultancy costs.

There were also adjust­ments to the annu­al report and accounts for oth­er minor dis­clos­ure, con­sist­ency or present­a­tion­al matters.

Page 29

Com­ment­ary on Wider Scope

Wider scope summary

As aud­it­ors appoin­ted by the Aud­it­or Gen­er­al for Scot­land, our wider scope respons­ib­il­it­ies are set out in the Code of Audit Prac­tice 2021. The Code require­ments broaden the scope of the ²⁰²³⁄₂₄ audit and allow us to use a risk-based approach to report on our con­sid­er­a­tion of CNPA’s per­form­ance and make recom­mend­a­tions for improve­ment and, where appro­pri­ate, con­clude on CNPA’s performance.

The Code’s wider scope frame­work is cat­egor­ised into four areas:

• fin­an­cial management;
• fin­an­cial sustainability;
• vis­ion, lead­er­ship and gov­ernance; and
• use of resources to improve outcomes.

The Code of Audit Prac­tice allows an altern­at­ive audit approach where an audited body is con­sidered less com­plex due its size and lim­ited fin­an­cial activ­ity. In the Annu­al Audit Plan, we doc­u­mented our judge­ment that CNPA is a less com­plex body. We have reviewed this assess­ment and con­firmed that it remains appro­pri­ate. We there­fore restric­ted our wider scope work to:

• a review of the Gov­ernance Statement
• con­clud­ing on the fin­an­cial sus­tain­ab­il­ity of CNPA and the ser­vices that it deliv­ers in the medi­um to longer term.

Over­all sum­mary by report­ing criteria

Report­ing cri­ter­ia	Com­ment­ary page ref­er­ence	Iden­ti­fied risks?	Actu­al risks iden­ti­fied?	Oth­er recom­mend­a­tions made?
Fin­an­cial sustainability	31	No	No	No
Gov­ernance Statement	33	No	No	No

Page 31

Fin­an­cial sus­tain­ab­il­ity (con­tin­ued)

Our over­all assessment

Area assessed	Our find­ings	Our judge­ments	Risks iden­ti­fied
Fin­an­cial planning	CNPA repor­ted net expendit­ure for 2023⁄24 of £11.8 mil­lion (2022÷23: £10.4 mil­lion). This reflects a cash under­spend of £53k against the Scot­tish Gov­ern­ment resource lim­it for the year, and included under­spends of £480k and £859k on oper­a­tion­al plan costs and Peat­land spend respect­ively. CNPA has also worked to achieve effi­ciency sav­ings through work­force man­age­ment by review­ing recruit­ment needs and mak­ing use of fixed term con­tracts where appro­pri­ate. Cur­rently staff costs account for approx­im­ately 38% of CNPA’s budget. In this regard CNPA had in-budget sav­ings of £248k for the year 23⁄24. CNPA oper­ates under yearly budgets, although it also sub­mits longer term (5 year) fore­casts to the Scot­tish Gov­ern­ment and responds to spend­ing review com­mis­sions from the Scot­tish Gov­ern­ment on an ongo­ing basis.	CNPA has a clear approach to determ­ine its budget require­ments. CNPA oper­ated with­in its budget in 2023⁄24. CNPA responds to spend­ing review com­mis­sions from the Scot­tish Gov­ern­ment on an ongo­ing basis.	No sig­ni­fic­ant issues identified.

Page 33

Gov­ernance State­ment (con­tin­ued)

Our over­all assessment

Area assessed	Our find­ings	Our judge­ments	Risks iden­ti­fied
Gov­ernance Statement	We con­firmed that the Gov­ernance State­ment: • is con­sist­ent with the fin­an­cial state­ments; • includes the inform­a­tion required by the FReM and the Scot­tish Pub­lic Fin­ance Manu­al (SPFM); • is con­sist­ent with our know­ledge obtained through the audit; • does not con­tain any mis­lead­ing inform­a­tion. CNPA made minor amend­ments to the Gov­ernance State­ment fol­low­ing our review.	We are required to report on wheth­er the inform­a­tion giv­en in the Gov­ernance State­ment is mater­i­ally incon­sist­ent with the fin­an­cial state­ments; has not been prop­erly pre­pared in accord­ance with The Nation­al Parks (Scot­land) Act 2000 and dir­ec­tions made there­un­der by the Scot­tish Min­is­ters; or is mater­i­ally mis­stated. We have no mat­ters to report in respect of the Gov­ernance Statement.	No sig­ni­fic­ant issues identified.

Page 35

Best Value

Best Value in cent­ral gov­ern­ment bodies

The Scot­tish Pub­lic Fin­ance Manu­al (SPFM) explains that account­able officers have a spe­cif­ic respons­ib­il­ity to ensure that arrange­ments have been made to meet their Best Value oblig­a­tions. The duty of Best Value as set out in the SPFM is:

• To make arrange­ments to secure con­tinu­ous improve­ment in per­form­ance whilst main­tain­ing an appro­pri­ate bal­ance between qual­ity and cost; and, in mak­ing those arrange­ments and secur­ing that bal­ance; and
• To have regard to eco­nomy, effi­ciency, effect­ive­ness, the equal oppor­tun­it­ies require­ments and to con­trib­ute to the achieve­ment of sus­tain­able development.

Min­is­teri­al guid­ance for Account­able Officers in pub­lic bod­ies sets out their duty to ensure that arrange­ments are in place to secure Best Value in pub­lic ser­vices. The sev­en Best Value char­ac­ter­ist­ics have been recently regrouped to reflect the key themes which will sup­port the devel­op­ment of an effect­ive organ­isa­tion­al con­text from which pub­lic ser­vices can deliv­er key out­comes and ulti­mately achieve Best Value:

1. Vis­ion and leadership
2. Gov­ernance and accountability
3. Effect­ive use of resources
4. Part­ner­ships and col­lab­or­at­ive working
5. Work­ing with communities
6. Sus­tain­ab­il­ity
7. Fair­ness and equality

We have used a risk-based approach that is pro­por­tion­ate to the size and type of the body, to assess wheth­er CNPA has made prop­er arrange­ments for secur­ing Best Value. We have also fol­lowed up on pre­vi­ously repor­ted Best Value find­ings, where applic­able, and have assessed the pace and depth of improve­ment imple­men­ted by CNPA.

Page 36

Best Value

Best Value in cent­ral gov­ern­ment bod­ies – continued

CNPA works to oper­ate in line with Best Value prin­ciples for example in pro­mot­ing effi­cient, eco­nom­ic and effect­ive use of staff and oth­er resources as shown by its tar­geted sav­ings in these areas. In 2023/2024 CNPA launched phase four of its Organ­isa­tion­al Devel­op­ment Strategy to con­tin­ue to improve its work pro­cesses, organ­isa­tion­al envir­on­ment, and deliv­ery of ser­vices. CNPA also con­duc­ted an inde­pend­ent staff sur­vey in the course of the year and shared res­ults with the staff.

Over­all, we have con­cluded that CNPA has reas­on­able arrange­ments in place to secure Best Value.

Page 38

Appendix A: Draft man­age­ment rep­res­ent­a­tion letter

Tom Reid For­vis Maz­ars LLP 100 Queen Street Glas­gow G1 3DN

Septem­ber 2024

Dear Tom

Cairngorms Nation­al Park Author­ity — Audit for the Year Ended 31 March 2024

This rep­res­ent­a­tion let­ter is provided in con­nec­tion with your audit of the fin­an­cial state­ments of Cairngorms Nation­al Park Author­ity for the year ended 31 March 2024 for the pur­pose of express­ing an opin­ion as to wheth­er the fin­an­cial state­ments give a true and fair view in accord­ance with the Nation­al Parks (Scot­land) Act 2000 and UK adop­ted inter­na­tion­al account­ing stand­ards, as inter­preted and adap­ted by the ²⁰²³⁄₂₄ Gov­ern­ment Fin­an­cial Report­ing Manu­al (the ²⁰²³⁄₂₄ FReM).

I con­firm that the fol­low­ing rep­res­ent­a­tions are made on the basis of enquir­ies of man­age­ment and staff with rel­ev­ant know­ledge and exper­i­ence (and, where appro­pri­ate, inspec­tion of sup­port­ing doc­u­ment­a­tion) suf­fi­cient to sat­is­fy myself that I can prop­erly make each of the fol­low­ing rep­res­ent­a­tions to you.

My respons­ib­il­ity for the fin­an­cial state­ments and account­ing information

I believe that I have ful­filled my respons­ib­il­it­ies for the true and fair present­a­tion and pre­par­a­tion of the fin­an­cial state­ments in accord­ance with the Nation­al Parks (Scot­land) Act 2000 and UK adop­ted inter­na­tion­al account­ing stand­ards, as inter­preted and adap­ted by the ²⁰²³⁄₂₄ Gov­ern­ment Fin­an­cial Report­ing Manu­al (the ²⁰²³⁄₂₄ FReM).

My respons­ib­il­ity to provide and dis­close rel­ev­ant information

I have provided you with:

• access to all inform­a­tion of which I am aware that is rel­ev­ant to the pre­par­a­tion of the fin­an­cial state­ments such as records, doc­u­ment­a­tion and oth­er material;
• addi­tion­al inform­a­tion that you have reques­ted from us for the pur­pose of the audit; and
• unres­tric­ted access to indi­vidu­als with­in the Author­ity you determ­ined it was neces­sary to con­tact in order to obtain audit evidence.

I con­firm as Account­able Officer that I have taken all the neces­sary steps to make me aware of any rel­ev­ant audit inform­a­tion and to estab­lish that you, as aud­it­ors, are aware of this inform­a­tion. As far as I am aware there is no rel­ev­ant audit inform­a­tion of which you, as aud­it­ors, are unaware.

Page 39

Appendix A: Draft man­age­ment rep­res­ent­a­tion letter

Account­ing records

I con­firm that all trans­ac­tions under­taken by the Author­ity have been prop­erly recor­ded in the account­ing records and are reflec­ted in the fin­an­cial state­ments. All oth­er records and related inform­a­tion, includ­ing minutes of all man­age­ment and Board meet­ings, have been made avail­able to you.

Account­ing policies

I con­firm that I have reviewed the account­ing policies applied dur­ing the year in accord­ance with Inter­na­tion­al Account­ing Stand­ard 8 and con­sider these policies to faith­fully rep­res­ent the effects of trans­ac­tions, oth­er events or con­di­tions on the Authority’s fin­an­cial pos­i­tion, fin­an­cial per­form­ance and cash flows.

Account­ing estim­ates, includ­ing those meas­ured at fair value

I con­firm that the meth­ods, sig­ni­fic­ant assump­tions and the data used by the Author­ity in mak­ing the account­ing estim­ates, includ­ing those meas­ured at fair value are appro­pri­ate to achieve recog­ni­tion, meas­ure­ment or dis­clos­ure that is in accord­ance with the applic­able fin­an­cial report­ing framework.

Con­tin­gen­cies

There are no mater­i­al con­tin­gent losses includ­ing pending or poten­tial lit­ig­a­tion that should be accrued where:

• inform­a­tion presently avail­able indic­ates that it is prob­able that an asset has been impaired, or a liab­il­ity had been incurred at the bal­ance sheet date; and
• the amount of the loss can be reas­on­ably estimated.

There are no mater­i­al con­tin­gent losses that should be dis­closed where, although either or both the con­di­tions spe­cified above are not met, there is a reas­on­able pos­sib­il­ity that a loss, or a loss great­er than that accrued, may have been incurred at the bal­ance sheet date.

There are no con­tin­gent gains which should be disclosed.

All mater­i­al mat­ters, includ­ing unas­ser­ted claims, that may res­ult in lit­ig­a­tion against the Author­ity have been brought to your atten­tion. All known actu­al or pos­sible lit­ig­a­tion and claims whose effects should be con­sidered when pre­par­ing the fin­an­cial state­ments have been dis­closed to you and accoun­ted for and dis­closed in accord­ance with the Nation­al Parks (Scot­land) Act 2000 and UK adop­ted inter­na­tion­al account­ing stand­ards, as inter­preted and adap­ted by the ²⁰²³⁄₂₄ Gov­ern­ment Fin­an­cial Report­ing Manu­al (the ²⁰²³⁄₂₄ FReM).

Laws and regulations

I con­firm that I have dis­closed to you all those events of which I am aware which involve known or sus­pec­ted non-com­pli­ance with laws and reg­u­la­tions, togeth­er with the actu­al or con­tin­gent con­sequences which may arise there­from. We have com­plied with all aspects of con­trac­tu­al agree­ments that would have a mater­i­al effect on the accounts in the event of non-compliance.

Page 40

Appendix A: Draft man­age­ment rep­res­ent­a­tion letter

Fraud and error

I acknow­ledge my respons­ib­il­ity as Account­able Officer for the design, imple­ment­a­tion and main­ten­ance of intern­al con­trol to pre­vent and detect fraud and error. I have dis­closed to you:

• all the res­ults of my assess­ment of the risk that the fin­an­cial state­ments may be mater­i­ally mis­stated as a res­ult of fraud;
• all know­ledge of fraud or sus­pec­ted fraud affect­ing the Author­ity involving:
  • man­age­ment and those charged with governance;
  • employ­ees who have sig­ni­fic­ant roles in intern­al con­trol; and
  • oth­ers where fraud could have a mater­i­al effect on the fin­an­cial statements.

I have dis­closed to you all inform­a­tion in rela­tion to any alleg­a­tions of fraud, or sus­pec­ted fraud, affect­ing the Authority’s fin­an­cial state­ments com­mu­nic­ated by employ­ees, former employ­ees, ana­lysts, reg­u­lat­ors or others.

Related party transactions

I con­firm that all related party rela­tion­ships, trans­ac­tions and bal­ances, have been appro­pri­ately accoun­ted for and dis­closed in accord­ance with the require­ments of the Nation­al Parks (Scot­land) Act 2000 and UK adop­ted inter­na­tion­al account­ing stand­ards, as inter­preted and adap­ted by the ²⁰²³⁄₂₄ Gov­ern­ment Fin­an­cial Report­ing Manu­al (the ²⁰²³⁄₂₄ FReM). I have dis­closed to you the iden­tity of the Authority’s related parties and all related party rela­tion­ships and trans­ac­tions of which I am aware.

Impair­ment review

To the best of my know­ledge, there is noth­ing to indic­ate that there is a per­man­ent reduc­tion in the recov­er­able amount of the prop­erty, plant and equip­ment and intan­gible assets below their car­ry­ing value at the state­ment of fin­an­cial position