Cairngorms Nation­al Park Authority

Intern­al Audit Report

Man­age­ment Action Fol­low-up Part 1 – ²⁰²⁴⁄₂₅

Novem­ber 2024

Con­tents:

• Intro­duc­tion and back­ground — 1
• Sum­mary of pro­gress — 2
• Appendix 1: Action status by report — 4
• Appendix 2: Sum­mary of out­stand­ing actions — 6
• Appendix 3: Audit risk cat­egor­isa­tions — 21

Intro­duc­tion and background

Intro­duc­tion

As part of the intern­al audit pro­gramme we have under­taken a fol­low up review to provide the Audit & Risk Com­mit­tee with assur­ance that man­age­ment actions agreed in pre­vi­ous intern­al audit reports have been imple­men­ted appro­pri­ately. This report sum­mar­ises the pro­gress made by man­age­ment in imple­ment­ing agreed man­age­ment actions.

Scope

We have reviewed all open man­age­ment actions and liaised with Cairngorm Nation­al Park Author­ity staff to obtain an update on their imple­ment­a­tion pro­gress. This included man­age­ment identi­fy­ing actions which were no longer applic­able. For recom­mend­a­tions graded pri­or­ity 3 or above, we request evid­ence to val­id­ate com­ple­tion of any actions marked for clos­ure by management.

For all actions raised by the pri­or Intern­al Aud­it­or (BDO) we have aligned their risk assess­ments to the Azets risk grad­ing struc­ture (per Appendix 3).

Action for Audit & Risk Committee

The Com­mit­tee is asked to note the pro­gress made by man­age­ment in imple­ment­ing agreed man­age­ment actions. The Com­mit­tee is also asked to con­sider and approve those actions for which revised times­cales have been provided by man­age­ment (these are detailed at Appendix 2).

Sum­mary of progress

The table below shows the move­ment in the audit actions in the peri­od from April 2024 to Novem­ber 2024:

Num­ber of Actions
Open actions brought forward	28
Actions added to tracker	7
Total actions to follow-up	35
Actions closed	10
Actions Super­seded	1
Open actions car­ried forward	24

Status of Actions as at Novem­ber 2024

(Pie chart show­ing 5 Com­plete, 10 Par­tially Com­plete, 1 Super­seded, and 19 Incom­plete actions)

We have con­firmed that 10 actions (29%) were com­peted in the peri­od to Novem­ber 2024. In addi­tion, one action is recom­men­ded for clos­ure as it has been super­seded (3%).

19 actions (54%) have been assessed as par­tially com­plete and five (14%) are incom­plete. Fur­ther detail on all out­stand­ing actions is included at Appendix 2.

We recom­mend that man­age­ment take a strong focus on clear­ing aged items in the com­ing months. We recom­mend pri­or­it­ising the most aged items and those that are grade 3 and grade 4. Atten­tion should then be paid to those remain­ing actions that have passed their ori­gin­al due date and those which will pass their due date for com­ple­tion over the next period.

A sum­mary of the status of actions by report is shown at Appendix 1.

Status by Grading

(Bar chart show­ing the num­ber of com­plete, incom­plete, par­tially com­plete, and super­seded actions for each grade (1−4))

Appendix 1: Action status by report

Report title	Com­plete	Par­tially com­plete	Incom­plete	Super­seded	Total
Grant Fund­ing & Management		1			1
2016⁄17 sub-total	1	1			1
Busi­ness Con­tinu­ity Planning	1				1
2018⁄19 sub-total	1		1		1
FOISA and EIR Requests	1				1
2019⁄20 sub-total	1		1		1
Data Man­age­ment	1	1			2
2020⁄21 sub-total	1	1	1		2
LEAD­ER Programme		1			1
Fin­an­cial Man­age­ment and Reporting	1				1
Assur­ance Map­ping of Major Projects		2			2
Cyber Secur­ity Review	2				2
ICT Strategy	4				4
Peat­land Action Pro­gramme Set Up	1				1
2021⁄22 sub-total	1	8			9
Per­form­ance Management	1	1			2
Data Man­age­ment	1		1		2
Payroll and Expenses	1				1
2022⁄23 sub-total	3	2	1		6
Expendit­ure and Creditors	1	1			2
Risk Man­age­ment	1		1		2
Health and Safety	3	1			4
Her­it­age Horizons	2				2
Pro­cure­ment		3	4		7
2023⁄24 sub-total	6	6	4	1	16
Grand totals	10	19	5	1	35

Appendix 2: Sum­mary of out­stand­ing actions

Report / Action	Recom­mend­a­tion	Action Own­er	Grade	Ori­gin­al times­cale	Revised times­cale	Update Novem­ber 2024	Status
2016⁄17 Grant Fund­ing and Management	We recom­mend that the Grant Toolkit is com­pleted, encom­passing all pro­cesses in place for the award­ing, record­ing and mon­it­or­ing of grant funding.	Dir­ect­or of Cor­por­ate Services	Medi­um (Grade 2)	Sep 2017	Mar 25	Grant tem­plates have been developed, includ­ing an award doc­u­ment and terms & conditions.	Par­tially Complete
2018⁄19 Busi­ness Con­tinu­ity Planning	We recom­mend that CNPA devel­ops a test­ing plan/​schedule for BCP which should be reviewed reg­u­larly to ensure a stra­tegic approach to test­ing is developed and implemented.	Dir­ect­or of Cor­por­ate Services	Medi­um (Grade 2)	Nov 2019	Mar 25	BCP is in need of update.	Incom­plete
2019⁄20 FOISA and EIR Requests	We recom­mend CNPA review and update its Pub­lic­a­tion Scheme.	Inform­a­tion Manager	Low (Grade 1)	Dec 20	Mar 25	Pub­lic­a­tion scheme will be updated in par­al­lel with the web devel­op­ment project.	Par­tially Complete
2020⁄21 Data Management	We recom­mend that once the Author­ity have received the feed­back from their DPOaaS pro­vider, they cre­ate a sub­ject access request pro­ced­ure, or doc­u­ment the pro­cess with­in an exist­ing procedure.	Office Ser­vices Manager	Medi­um (Grade 3)	Jun-21	Dec 24	This work is with­in the remit of Inform­a­tion Manager.	Par­tially Complete
2021⁄22 Assur­ance Map­ping of Major Projects	Man­age­ment should put in place a pro­ject plan for imple­ment­a­tion of the new pro­ject man­age­ment approach.	Dir­ect­or of Cor­por­ate Services	Medi­um (Grade 2)	Sep-22	Sep 25	We have developed and imple­men­ted a new pro­ject man­age­ment and report­ing system.	Par­tially Complete
2021⁄22 Cyber Secur­ity Review	We recom­mend that CNPA should per­form a risk assess­ment as well as a gap ana­lys­is of the cur­rent tech­no­logy, policy and busi­ness environment.	Inform­a­tion Sys­tems Manager	Medi­um (Grade 3)	Aug 22	Apr 25	While we are mind­ful of risks as part of the course of our day-to-day man­age­ment of our IT resources.	Par­tially Complete
2021⁄22 Cyber Secur­ity Review	We recom­mend that CNPA estab­lish pro­ced­ures for hand­ling cyber secur­ity events.	Inform­a­tion Sys­tems Manager	Medi­um (Grade 2)	Dec-22	Aug 25	While we are mind­ful of risks as part of the course of our day-to-day man­age­ment of our IT resources.	Par­tially Complete
2021⁄22 ICT Strategy	We recom­mend that the next devel­op­ment of the IT and Data Strategy includes a fin­an­cial strategy.	Dir­ect­or of Cor­por­ate Services	Medi­um (Grade 2)	Sept 23	Dec 25	The Authority’s stra­tegic approach to ICT is under consideration.	Par­tially Complete
2021⁄22 ICT Strategy	We recom­mend that man­age­ment expli­citly doc­u­ment approvals of strategies with­in minutes of meetings.	Dir­ect­or of Cor­por­ate Services	Medi­um (Grade 2)	Mar-23	Dec 25	All strategy and policy doc­u­ments are presen­ted to both the Seni­or Man­age­ment Team and the Board.	Par­tially Complete
2021⁄22 ICT Strategy	We recom­mend that the action plan with­in the IT and Data Strategy is updated to include action own­ers and deliv­ery dates.	Inform­a­tion Sys­tems Manager	Medi­um (Grade 3)	Jun-22	Dec 25	The IT oper­a­tion­al plan will, in future, fol­low nat­ur­ally from the ICT strategy.	Par­tially Complete
2021⁄22 Peat­land Action Pro­gramme Set Up	Man­age­ment should doc­u­ment the risks asso­ci­ated with the full-ser­vice approach and put mit­ig­at­ing con­trols in place.	Dir­ect­or of Nature and Cli­mate Change	High (Grade 4)	Dec-22	Mar 25	The SLA developed by our law­yers has been cir­cu­lated and tested with land managers.	Par­tially Complete
2022⁄23 Data Management	We recom­mend that CNPA review the cur­rent policy suite that is in place and devel­op and imple­ment policies that address the fol­low­ing policy areas:	Deputy Chief Executive	Medi­um (Grade 3)	Dec 23	Apr 25	The Inform­a­tion Man­ager is work­ing on this as part of his review of policies.	Par­tially Complete
2022⁄23 Per­form­ance Management	We sup­port management’s approach to devel­op­ing a dash­board to sup­port more fre­quent scru­tiny and chal­lenge by seni­or management.	Gov­ernance, Data and Report­ing Manager	Medi­um (Grade 2)	Dec-22	Dec 25	Our work on cor­por­ate per­form­ance man­age­ment is ongoing.	Par­tially Complete
2022⁄23 Expendit­ure and Creditors	CNPA should pro­mote the import­ance of the stand­ard­isa­tion of doc­u­ment­a­tion kept for each pur­chase, and require that for each com­mit­ment of expendit­ure the fol­low­ing should be doc­u­mented and maintained:	Fin­ance Manager	Grade 2	Mar 24	Mar 25	The import­ance of segreg­a­tion of duties was dis­cussed dur­ing staff workshops.	Par­tially Complete
2023⁄24 Risk Management	Man­age­ment should imple­ment oper­a­tion­al risk registers to ensure that oper­a­tion­al risks related to the day-to-day activ­it­ies of the organ­isa­tion are recor­ded and mon­itored on a reg­u­lar basis.	Deputy Chief Executive	Grade 3	Dec 23	Mar 25	Risk registers are now in place for IT, Comms and C2030	Par­tially Complete
2023⁄24 Health and Safety	We recom­mend that the Health and Safety Policy and all sup­port­ing policies are sub­ject to reg­u­lar review to ensure that they reflect the cur­rent legis­lat­ive requirements.	Facil­it­ies Manager	Grade 3	Apr-24	Mar 25	This is in progress.	Par­tially Complete
2023⁄24 Pro­cure­ment	CNPA should devel­op a new Pro­cure­ment Strategy and sup­port­ing policies and pro­ced­ures as soon as possible.	Deputy Chief Exec­ut­ive with Head of Fin­ance and Cor­por­ate Operations	4	Sept 24	TBC	Pro­cure­ment strategy now refreshed and approved by ARC.	Par­tially Complete
2023⁄24 Pro­cure­ment	CNPA should pre­pare and pub­lish annu­al pro­cure­ment reports, main­tain a con­tract register and pro­duce a pro­cure­ment expendit­ure report.	Deputy Chief Exec­ut­ive with Head of Fin­ance and Cor­por­ate Operations	3	Dec 24	TBC	The pro­cure­ment strategy has now been updated and agreed, and now sets out any reporting.	Par­tially Complete
2023⁄24 Pro­cure­ment	CNPA should under­take a full review of the pro­cure­ment doc­u­ment­a­tion held for each supplier.	Head of Finance	4	Sept 2024 onward, accord­ing to the agreed action plan.	TBC	Action plan provided to ARC.	Par­tially Complete
2023⁄24 Pro­cure­ment	Man­age­ment should seek to devel­op tem­plates which set out the stages of the pro­cure­ment journey.	Head of Finance	4	Mar 25	N/A	Incom­plete	Incom­plete

Appendix 3: Audit risk categorisations

Man­age­ment action grades

• 4: Very high risk expos­ure — major con­cerns requir­ing imme­di­ate seni­or atten­tion that cre­ate fun­da­ment­al risks with­in the organisation.
• 3: High risk expos­ure — absence / fail­ure of key con­trols that cre­ate sig­ni­fic­ant risks with­in the organisation.
• 2: Mod­er­ate risk expos­ure — con­trols are not work­ing effect­ively and effi­ciently and may cre­ate mod­er­ate risks with­in the organisation.
• 1: Lim­ited risk expos­ure — con­trols are work­ing effect­ively, but could be strengthened to pre­vent the cre­ation of minor risks or address gen­er­al house­keep­ing issues.

© Azets 2024. All rights reserved. Azets refers to Azets Audit Ser­vices Lim­ited. Registered in Eng­land & Wales Registered No. 09652677. VAT Regis­tra­tion No. 219 0608 22.

Registered to carry on audit work in the UK and reg­u­lated for a range of invest­ment busi­ness activ­it­ies by the Insti­tute of Chartered Account­ants in Eng­land and Wales.