Cairngorms Nation­al Park Authority

Intern­al Audit Report ²⁰²⁴⁄₂₅

Oper­a­tion­al and Fin­an­cial Planning

August 2024

Audit and Risk Com­mit­tee Paper 4 Annex 1 27 Septem­ber 2024

A AZETS

---

Con­tents

• Exec­ut­ive Sum­mary — 1
• Man­age­ment Action Plan — 5
• Appendix A – Defin­i­tions — 13

Key Con­tacts

• Audit Spon­sor: Dav­id Camer­on, Deputy Chief Executive
• Key Con­tacts: Louise Allen, Head of Fin­ance and Cor­por­ate Operations
• Audit team: Eliza­beth Young, Part­ner; Stephanie Hume, Dir­ect­or; Kath­ryn Daley, Intern­al Auditor

---

Exec­ut­ive Summary

Con­clu­sion

Cairngorms Nation­al Park Author­ity (CNPA) has clear pro­cesses in place for fin­an­cial and oper­a­tion­al plan­ning that ensure approved plans are in place pri­or to the start of the fin­an­cial year. We con­firmed that fin­an­cial and oper­a­tion­al plans ref­er­ence the rel­ev­ant Cor­por­ate Plan object­ives and that the fin­an­cial and staff­ing require­ments of object­ives has been assessed.

We also con­firmed that annu­al scen­ario plan­ning is per­formed at the request of the Scot­tish Gov­ern­ment based on expec­ted budgets, with three sep­ar­ate scen­ari­os con­sidered. We noted how­ever that these are not repor­ted intern­ally to those charged with gov­ernance and CNPA does not reg­u­larly update for­ward-look­ing fin­an­cial pro­jec­tions for longer term object­ives to reflect the Cor­por­ate Plan 2023 – 27 and Nation­al Park Part­ner­ship Plan 2022 – 27.

Reg­u­lar updates on pro­gress and per­form­ance against oper­a­tion­al and fin­an­cial object­ives are provided to Board and Com­mit­tees. CNPA could strengthen arrange­ments in this area by put­ting in place action logs to track actions until complete.

Back­ground and scope

Effect­ive fin­an­cial and oper­a­tion­al plan­ning is import­ant to ensur­ing Cairngorms Nation­al Park Author­ity (CNPA) deliv­ers its over­arch­ing object­ives, whilst remain­ing fin­an­cially sus­tain­able. The organ­isa­tion sets dir­ec­tion through its cor­por­ate strategy, that in turn is sup­por­ted by cos­ted annu­al plans out­lining the actions and mile­stones that will be delivered in the year in ques­tion. As such, it is vital that these are robustly developed and clearly aligned.

Effect­ive plan­ning and report­ing is par­tic­u­larly import­ant in the cur­rent fin­an­cial cli­mate, and the increase in scale of deliv­ery being required of CNPA for example Cairngorms 2030.

In accord­ance with the ²⁰²⁴⁄₂₅ Intern­al Audit Plan, we reviewed the annu­al oper­a­tion­al plan­ning pro­cess includ­ing how oper­a­tion­al plans are developed and the extent to which they are integ­rated with­in the annu­al fin­an­cial plan. This con­sidered the cycle of spend­ing and mon­it­or­ing of spend through­out the year to achieve the oper­a­tion­al plan and the link to the deliv­ery of cor­por­ate out­comes, includ­ing the use of scen­ario planning.

Con­trol assessment

1. Oper­a­tion­al plan­ning and fin­an­cial plan­ning pro­cesses are in place that are clearly aligned and adequately reflect the struc­ture and oper­a­tions of CNPA.
2. The oper­a­tion­al plans are sup­por­ted by a fin­an­cial plan that ensures that adequate resources are in place to sup­port the deliv­ery and achieve­ment of stra­tegic objectives.
3. The fin­an­cial plan includes scen­ario plan­ning on the pos­sible out­comes for deliv­ery of the oper­a­tion­al plans through­out the year.
4. There is reg­u­lar report­ing to man­age­ment and the Board on deliv­ery against the oper­a­tion­al and fin­an­cial plans, includ­ing any inter­de­pend­en­cies, and implic­a­tions for deliv­ery of cor­por­ate outcomes.

Improve­ment actions by type and priority

(Chart show­ing improve­ment actions by type and priority)

We have iden­ti­fied five improve­ment actions from this review, all of which relate to the design of con­trols in place. See Appendix A for defin­i­tions of col­our coding.

Key find­ings

Good prac­tice

• CNPA has clear oper­a­tion­al and fin­an­cial plan­ning pro­cesses in place, which we con­firmed oper­ate in line with expec­ted times­cales. We con­firmed there is a Budget Mon­it­or­ing and Man­age­ment doc­u­ment in place to sup­port these pro­cesses which sets out these pro­cesses, includ­ing those involved in pre­par­a­tion and review.
• We con­firmed CNPA’s oper­a­tion­al and fin­an­cial plans are approved by the Board pri­or to the start of the fin­an­cial year. We reviewed Board Meet­ing minutes and con­firmed that approv­al of the Oper­a­tion­al Plan and Budget was provided in March of each year.
• From our review of the Cairngorms Nation­al Park Author­ity ²⁰²⁴⁄₂₅ Budget and Oper­a­tion­al Plan, we con­firmed that this con­tains ref­er­ence to stra­tegic and cor­por­ate object­ives, includ­ing the required fin­an­cial and work­force resources and related risks.
• We con­firmed CNPA per­forms scen­ario plan­ning based on vari­ous budget scen­ari­os as com­mis­sioned by the Scot­tish Gov­ern­ment each year. We reviewed the Budget Mod­el ²⁴⁄₂₅ and con­firmed it con­tains move­ment scen­ari­os for three dif­fer­ent budget reduc­tion pro­jec­tions 0%, 10% and 20%.
• We con­firmed man­age­ment provide reg­u­lar updates to the Resources Com­mit­tee and Per­form­ance Com­mit­tee of per­form­ance against fin­an­cial and oper­a­tion­al object­ives, respect­ively. We have con­firmed through review of meet­ing minutes from March 2023 to May 2024 that pro­gress updates are provided on budget pos­i­tion, pro­ject deliv­ery and stra­tegic expectations.

Areas for improvement

We have iden­ti­fied a num­ber of areas for improve­ment which, if addressed, would strengthen CNPA’s con­trol frame­work. These include:

• Updat­ing the Budget Man­age­ment and Mon­it­or­ing doc­u­ment to include roles, respons­ib­il­it­ies, times­cales, and doc­u­ment­a­tion requirements.
• Devel­op­ing scen­ario plans for all future years of the Cor­por­ate Plan 2023 – 27.
• Ensur­ing that scen­ario plans are repor­ted to rel­ev­ant com­mit­tees at least annu­ally as part of the fin­an­cial plan­ning process.
• Cre­at­ing and main­tain­ing a log of actions arising from meet­ings, to assist in mon­it­or­ing and report­ing on progress.

These are fur­ther dis­cussed in the Man­age­ment Action Plan below.

Impact on risk register

The Cairngorms Nation­al Park Author­ity cor­por­ate risk register (dated April 2024) included the fol­low­ing risks rel­ev­ant to this review:

• Risk A1: Pub­lic Sec­tor fin­ances con­strain capa­city to alloc­ate suf­fi­cient resources to deliv­er cor­por­ate plan.

The con­clu­sions from this review high­light con­trol improve­ments which – if made – will sup­port the above risks around fin­an­cial con­straints faced by pub­lic sec­tor organ­isa­tions and their abil­ity to deliv­er cor­por­ate object­ives. Reg­u­lar mon­it­or­ing, scen­ario plan­ning and clear roles and respons­ib­il­it­ies will help CNPA to more effect­ively mit­ig­ate the chal­lenges faced in fin­an­cial and oper­a­tion­al planning.

Acknow­ledge­ments

We would like to thank all staff con­sul­ted dur­ing this review for their assist­ance and co-operation.

---

Man­age­ment Action Plan

Con­trol Object­ive 1: Oper­a­tion­al plan­ning and fin­an­cial plan­ning pro­cesses are in place that are clearly aligned and adequately reflect the struc­ture and oper­a­tions of CNPA.

1.1 Oper­a­tion­al and Fin­an­cial Plan­ning Pro­cess Documentation

We con­firmed through our dis­cus­sions with man­age­ment and review of the Oper­a­tion­al and Fin­an­cial Plan­ning cycle doc­u­ment­a­tion that the oper­a­tion­al and fin­an­cial pro­cesses are suit­ably aligned with regards to times­cales, those involved and report­ing through the gov­ernance structure.

CNPA cre­ates annu­al oper­a­tion­al plans by pri­or­it­ising object­ives included with­in the Cor­por­ate Plan 2023 – 27 and Nation­al Park Part­ner­ship Plan 2022 – 27, which were pro­duced in con­sulta­tion with Scot­tish Gov­ern­ment. Once CNPA receives con­firm­a­tion of its budget alloc­a­tion from Scot­tish Gov­ern­ment in Decem­ber of each year the Heads of Ser­vice pro­duce draft oper­a­tion­al and fin­an­cial plans for the year ahead, which are reviewed and approved by the Board in March in advance of the start of the fin­an­cial year.

In addi­tion, we reviewed the Budget Man­age­ment and Mon­it­or­ing doc­u­ment which was writ­ten by the Head of Fin­ance and Cor­por­ate Oper­a­tions and reviewed by Dir­ect­or of Cor­por­ate Ser­vices and Deputy Chief Exec­ut­ive in Novem­ber 2023. This doc­u­ment sets out at a high level the above annu­al budget and oper­a­tion­al pro­cess. How­ever, the doc­u­ment does not clearly dic­tate the timelines for com­ple­tion, roles and respons­ib­il­it­ies of all parties involved, and expec­ted doc­u­ment­a­tion to be pro­duced at each stage of the process.

Risk: There is a risk oper­a­tion­al and fin­an­cial plan­ning pro­cesses do not oper­ate in line with expect­a­tions, due to a lack of clar­ity around roles, respons­ib­il­it­ies and dead­lines, lead­ing to delays in review, approv­al and imple­ment­a­tion of plans, and impact­ing per­form­ance against objectives.

Recom­mend­a­tion: CNPA should ensure that oper­a­tion­al and fin­an­cial plan­ning pro­cess doc­u­ment­a­tion clearly defines the roles and respons­ib­il­it­ies of those involved, includ­ing timelines for com­ple­tion and doc­u­ment­a­tion requirements.

Man­age­ment Action: (Grade 2 (Design)) Devel­op­ment of the ²⁰²⁴⁄₂₅ budget rep­res­en­ted the first full deliv­ery year of the Cairngorms 2030 Pro­gramme and its integ­ra­tion into the Park Authority’s budget set­ting pro­cesses. This peri­od also rep­res­en­ted the first full budget cycle delivered under our new Cor­por­ate Man­age­ment struc­ture, includ­ing a Head of Fin­ance and Oper­a­tions. As such the budget devel­op­ment was evol­u­tion­ary and roles not fully embed­ded. We will incor­por­ate roles, respons­ib­il­it­ies and timelines into our budget plan­ning and devel­op­ment doc­u­ment­a­tion as recom­men­ded. It is worth not­ing how­ever that timelines will need to adapt to Scot­tish Gov­ern­ment budget timetables which are not always con­sist­ent each year. Vari­ab­il­ity in nation­al budget timetables will impact on the value of hav­ing timetables set out for devel­op­ment of the Park Authority’s budget.

Action own­er: Head of Fin­ance and Cor­por­ate Oper­a­tions Due date: 31 March 2025

Con­trol Object­ive 2: The oper­a­tion­al plans are sup­por­ted by a fin­an­cial plan that ensures that adequate resources are in place to sup­port deliv­ery and the achieve­ment of stra­tegic objectives.

2.1 For­ward-look­ing fin­an­cial plans

We con­firmed the Cor­por­ate Plan 2023 – 27 sets out the out­line budget and for­ward fin­an­cial pro­jec­tions for its object­ives, includ­ing oper­a­tion­al areas, spe­cif­ic pro­jects and staff­ing resources. How­ever, through dis­cus­sions with man­age­ment and review of the fin­an­cial plan­ning pro­cess, we noted that as CNPA receives an annu­al budget from Scot­tish Gov­ern­ment man­age­ment only cre­ate detailed fin­an­cial plans on an annu­al basis and the for­ward fin­an­cial pro­jec­tions included with­in the Cor­por­ate Plan have not been updated since its devel­op­ment to take account of any known changes.

Fur­ther, we con­firmed that as part of the fin­an­cial plan­ning pro­cess, CNPA is required to pro­duce fin­an­cial plans for a range of budget scen­ari­os for the Scot­tish Gov­ern­ment. We reviewed the Budget Mod­el ²⁴⁄₂₅ work­pa­per and con­firmed that it sets out three budget move­ment scen­ari­os, con­sid­er­ing the impact of a 0%, 10% and 20% reduc­tion in budget. How­ever, the scen­ario plans are only developed for the forth­com­ing year and have not been cre­ated for the life­time of the Cor­por­ate Plan 2023 – 27.

It is con­sidered good prac­tice to devel­op medi­um to long term fin­an­cial plans that out­line a range of clear assump­tions and the implic­a­tions of these on future activities.

Risk: There is a risk that CNPA does not have for­ward-look­ing fin­an­cial pro­jec­tions, lead­ing to inab­il­ity to achieve oper­a­tion­al plan object­ives and deliv­ery against the Cor­por­ate and Nation­al Park Part­ner­ship Plan.

Recom­mend­a­tion: CNPA should con­sider devel­op­ing scen­ario plans for all future years of the Cor­por­ate Plan 2023 – 27 object­ives and review­ing these as part of fin­an­cial plan­ning pro­cesses to ensure con­tin­ued rel­ev­ance. This could include util­ising key assump­tions and adjust­ing these to account for dif­fer­ent scen­ari­os, this may also assist in advan­cing plan­ning pro­cesses and improv­ing the spend­ing cycle.

Man­age­ment Action: (Grade 2 (Design)) As dis­cussed with the Resources Com­mit­tee in August, we plan to bring for­ward some high-level for­ward budget scen­ari­os for ²⁰²⁵⁄₂₆ to help illus­trate the fin­an­cial issues that the fol­low­ing budget may need to address and to allow early con­ver­sa­tion with mem­bers on approaches to man­aging future budget decisions. We will devel­op longer term fin­an­cial pro­jec­tions over a 3 to 4 year peri­od to help under­stand and guide stra­tegic dir­ec­tion while recog­nising the lim­it­a­tions of any assump­tions while with­in a strictly annu­al­ised fund­ing environment.

Action own­er: Head of Fin­ance and Cor­por­ate Oper­a­tions Due date: 30 Novem­ber 2024

Con­trol Object­ive 3: The fin­an­cial plan includes scen­ario plan­ning on the pos­sible out­comes for deliv­ery of the oper­a­tion­al plans through­out the year.

3.1 Report­ing and review of scen­ario plans

We con­firmed with man­age­ment that at present there is no report­ing of scen­ario plans against CNPA’s future fin­an­cial pro­jec­tions to the Board and Gov­ernance Com­mit­tees. This is due to the sens­it­ive, hypo­thet­ic­al nature of the pro­jec­tions which man­age­ment feel may unne­ces­sar­ily raise con­cerns due to CNPA’s busi­ness being con­duc­ted in the pub­lic domain.

Man­age­ment noted that where a scen­ario becomes real­ised it will be repor­ted with­in the gov­ernance struc­ture. We con­firmed that report­ing to the Resources Com­mit­tee on for­ward scen­ario plans that became real­ised in terms of a 2% expec­ted reduc­tion in ori­gin­al grant-in-aid fund­ing took place in June 2022. This paper con­tained an out­line of the fin­an­cial pos­i­tion and quan­ti­fied the reduc­tion in funding.

It is good prac­tice how­ever to ensure that the Board and Gov­ernance Com­mit­tees are clear as to the impact of poten­tial changes to income and both pay/non-pay expendit­ure on the achieve­ment of cor­por­ate object­ives. Scen­ari­os should be pro­duced to illus­trate poten­tial out­comes, with clearly artic­u­lated assump­tions around key areas such as infla­tion, pay set­tle­ments and fund­ing, and the range of decisions that may have to be made in response. This should allow those charged with gov­ernance to have more informed and stra­tegic dis­cus­sions around budgets and any longer-term com­mit­ments that may be entered into through­out the year.

Risk: There is a risk the Board does not have suf­fi­cient over­sight of scen­ario plan­ning and is unable to quickly respond to changes in fund­ing, due to a lack of report­ing arrange­ments in place, lead­ing to poten­tially non-achieve­ment of cor­por­ate, stra­tegic and fin­an­cial objectives.

Recom­mend­a­tion: CNPA should ensure that scen­ario plans are repor­ted to rel­ev­ant com­mit­tees at least annu­ally as part of the fin­an­cial plan­ning pro­cess. Man­age­ment should con­sider the sens­it­iv­ity of dis­cus­sions and take appro­pri­ate action to pro­tect inform­a­tion which is of a com­mer­cially sens­it­ive nature.

Man­age­ment Action: (Grade 2 (Design)) Recom­mend­a­tion not agreed. No action pro­posed. This recom­mend­a­tion presents a very high risk of adverse pub­lic reac­tion to scen­ari­os that are very unlikely to hap­pen, as such scen­ario plans can­not be restric­ted from being put into the pub­lic domain. Over­all this recom­mend­a­tion adds little con­trol value while pos­ing sig­ni­fic­ant addi­tion­al repu­ta­tion­al risk to the Park Author­ity. The report recog­nises else­where the work under­taken by the Exec­ut­ive in scen­ario plan­ning as part of the wider assur­ance frame­work. We also report any vari­ations in cur­rent or anti­cip­ated future year budget pos­i­tions to the Resources Com­mit­tee and present actions to address these vari­ations as scen­ari­os crys­tal­ise. The over­sight of stra­tegic risk man­age­ment and mit­ig­a­tion also cov­ers much of the risk inher­ent in this area. Arrange­ments have worked well to main­tain bal­anced budget and out­turn over uncer­tain fin­an­cial fund­ing envir­on­ments dur­ing the last 20 years. This recom­mend­a­tion is assessed as pos­ing high­er new risk around repu­ta­tion­al man­age­ment and dam­age than is offered by any lim­ited addi­tion­al value of act­ing on this recommendation.

Con­trol Object­ive 4: There is reg­u­lar report­ing to man­age­ment and the Board on deliv­ery against the oper­a­tion­al and fin­an­cial plans, includ­ing any inter­de­pend­en­cies, and implic­a­tions for deliv­ery of cor­por­ate outcomes.

4.1 Action track­ing and resolution

We reviewed meet­ing minutes across the Board, Resources and Per­form­ance Com­mit­tees and con­firmed that reg­u­lar dis­cus­sion and chal­lenge of pro­gress against fin­an­cial and oper­a­tion­al object­ives takes place. We con­firmed that where actions are pro­posed, these are noted and taken for­ward to form ini­tial dis­cus­sions at sub­sequent meet­ings where updates can be provided.

We noted that there are no clear action logs main­tained where actions arising from dis­cus­sions are doc­u­mented and tracked to ensure that these are com­pleted in a timely man­ner. With ref­er­ence to Board Meet­ing Minutes from 14^th March 2023, we iden­ti­fied that there were long-term out­stand­ing actions from June 2022 and Janu­ary 2023 which had not yet been completed.

Risk: There is a risk action points arising from dis­cus­sions in meet­ings are not com­pleted in a timely man­ner, due to a lack of mon­it­or­ing and review, impact­ing CNPA’s abil­ity to resolve issues iden­ti­fied and deliv­er against its cor­por­ate outcomes.

Recom­mend­a­tion: Man­age­ment should con­sider cre­at­ing action logs, which are updated fol­low­ing the vari­ous com­mit­tee meet­ings where pro­gress updates are provided. These should include action own­ers, status indic­at­ors and tar­geted times­cales for completion.

Man­age­ment Action: (Grade 2 (Design)) Agreed. Action logs are being added as a stand­ard ele­ment to all board and com­mit­tee minutes to enhance con­trol over agreed actions.

Action own­er: Exec­ut­ive Sup­port Man­ager Due date: 31 Decem­ber 2024

4.2 Spend­ing Cycle

Man­age­ment con­firmed that at present the spend­ing cycle is skewed towards the end of the fin­an­cial year. This is due to the annu­al nature of the budget which CNPA receives from Scot­tish Gov­ern­ment, mean­ing that pro­jects can­not be ini­ti­ated until fund­ing is in place. Addi­tion­ally, pro­cure­ment and pro­ject plan­ning pro­cesses can be time con­sum­ing to man­age and gain approv­al for.

We note that the Vis­it­or Infra­struc­ture Improve­ment Pro­gramme, presen­ted to Seni­or Man­age­ment Team in June 2024, out­lined that CNPA are tak­ing steps to improve the spend­ing cycle, as dis­cus­sions are tak­ing place related to seek­ing applic­a­tions in the final quarter of the year to allow awards to be made in the first quarter of the fol­low­ing year. This will help to increase oppor­tun­it­ies for pro­ject and object­ive deliv­ery with­in the fin­an­cial year.

Risk: There is a risk CNPA’s cur­rent spend­ing cycle does not allow for effi­cient deliv­ery of pro­jects, due to the time taken to ini­ti­ate pro­jects, lead­ing to non-achieve­ment of oper­a­tion­al and fin­an­cial object­ives, impact­ing pro­ject delivery.

Recom­mend­a­tion: We sup­port man­age­ment review­ing the actions which can be taken to spread spend more evenly across the fin­an­cial year and recom­mend this is ongo­ing. We also note the devel­op­ment of the Pro­cure­ment Man­ager post cre­ates an oppor­tun­ity to ensure pro­cure­ment activ­ity is as effi­cient as pos­sible and con­sid­er­a­tion should be giv­en to how this post can be util­ised to sup­port early plan­ning with­in the oper­a­tion­al and fin­an­cial plan­ning cycle.

Man­age­ment Action: (Advis­ory (Design)) We wel­come this recog­ni­tion of these changes imple­men­ted by man­age­ment. We will con­tin­ue to roll out changes to work­ing prac­tices which help bring for­ward the com­mit­ment of activ­it­ies and spread fin­an­cial impacts more evenly across the fin­an­cial year, where per­mit­ted by gov­ernance considerations.

Action own­er: N/​a Due date: Already underway

---

Appendix A – Definitions

Con­trol assessments

• R: Fun­da­ment­al absence or fail­ure of key controls.
• A: Con­trol object­ive not achieved — con­trols are inad­equate or ineffective.
• Y: Con­trol object­ive achieved — no major weak­nesses but scope for improvement.
• G: Con­trol object­ive achieved — con­trols are adequate, effect­ive and efficient.

Man­age­ment action grades

• 4: Very high risk expos­ure — major con­cerns requir­ing imme­di­ate seni­or atten­tion that cre­ate fun­da­ment­al risks with­in the organisation.
• 3: High risk expos­ure — absence / fail­ure of key con­trols that cre­ate sig­ni­fic­ant risks with­in the organisation.
• 2: Mod­er­ate risk expos­ure — con­trols are not work­ing effect­ively and effi­ciently and may cre­ate mod­er­ate risks with­in the organisation.
• 1: Lim­ited risk expos­ure — con­trols are work­ing effect­ively, but could be strengthened to pre­vent the cre­ation of minor risks or address gen­er­al house-keep­ing issues.

---

© Azets 2024. All rights reserved. Azets refers to Azets Audit Ser­vices Lim­ited. Registered in Eng­land & Wales Registered No. 09652677. VAT Regis­tra­tion No. 219 0608 22. Registered to carry on audit work in the UK and reg­u­lated for a range of invest­ment busi­ness activ­it­ies by the Insti­tute of Chartered Account­ants in Eng­land and Wales.