Skip to content
Please be aware the content below has been generated by an AI model from a source PDF.

ARC Draft Minutes13 March 2026

Cairngorms Nation­al Park Author­ity Ugh­dar­ras Pàirc Nàiseanta a’ Mhon­aidh Ruaidh

13 March 2026 Page 1 of 12

Draft minutes of the Audit and Risk Com­mit­tee meeting

Held at Cairngorms Nation­al Park Author­ity office, Grant­own-on-Spey Hybrid 13 March 2026 at 2.00pm

Present Fiona McLean (Chair) Duncan Miller Ian McLar­en (Vice Chair) Paul Gibb

Vir­tu­al Tom Reid, For­vis Maz­ars LLP Caleb Oguche, For­vis Maz­ars LLP Gregor Chalmers, For­vis Maz­ars LLP Peter Clark, wbg Dav­id Camer­on, Dir­ect­or of Cor­por­ate Ser­vices and Deputy CEO Alix Hark­ness, Clerk to the Board

In attend­ance Grant Moir, Chief Exec­ut­ive Officer

Apo­lo­gies Geva Black­ett Louise Allen, Head of Fin­ance and Cor­por­ate Oper­a­tions Bill Lobban

Wel­come and apologies

  1. Fiona McLean, Chair of the Audit and Risk Com­mit­tee, wel­comed every­one to the meet­ing. Apo­lo­gies were noted.

Cairngorms Nation­al Park Author­ity Ugh­dar­ras Pàirc Nàiseanta a’ Mhon­aidh Ruaidh

13 March 2026 Page 2 of 12

Approv­al of minutes of pre­vi­ous meetings

  1. The draft minutes of the pre­vi­ous Audit and Risk Com­mit­tee meet­ing held on 14 Novem­ber 2025 were approved with no amendments

Mat­ters arising not covered elsewhere

  1. Dav­id Camer­on, Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices provided an update on the one out­stand­ing action on fin­an­cial scen­ario plan­ning: a) Com­pleted as a res­ult of pulling togeth­er the budget devel­op­ment pro­pos­al which was brought to the Board at the Board Busi­ness ses­sion in Janu­ary 2026 then brought to the Resources Com­mit­tee meet­ing in Feb­ru­ary 2026 and then will be brought to the full Board for rat­i­fic­a­tion at the end of March. He pro­posed this item be closed off as com­plete. b) | Ref | Action Detail | Who | When | Status | | — -| — -| — -| — -| — -| | 27/09/24 | At para 20i | Dav­id and Stephanie | At the end of the 24⁄25 fin­an­cial year. | Ongo­ing | | | i. Update on intern­al audit view on fin­an­cial scen­ario plan­ning to be provided to the Audit and Risk Com­mit­tee | | | Man­age­ment to report back to Com­mit­tee to give assur­ance | Update: Grant and Dav­id have been work­ing on it over the sum­mer; more work to be done before can be brought to the Committee.

  2. The Chair sought clar­ity with ref­er­ence to the intern­al audit plan fol­low up review which stated that the scen­ario plan­ning would be com­pleted by March 2027. Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices con­firmed that man­age­ment believes they have com­pleted the required work on budget scen­ario plan­ning. He explained that: a) The cur­rent approach to budgets and scen­ario plan­ning is con­sidered appro­pri­ate and com­plete. b) Scen­ario plan­ning aligns with the four year cor­por­ate plan and wider Board policy discussions.

Cairngorms Nation­al Park Author­ity Ugh­dar­ras Pàirc Nàiseanta a’ Mhon­aidh Ruaidh

13 March 2026 Page 3 of 12

c) He gave an example of scenario planning regarding vacancy savings that was updated after Board feedback, with reduced vacancy savings now reflected in the March budget.
d) He provided the reassurance that should any additional scenario planning elements need to be drawn out separately, management would do so.
  1. The Chair thanked the Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices for the explan­a­tion and the Com­mit­tee agreed to close off the action.
  2. There were no oth­er mat­ters arising not covered elsewhere.

Declar­a­tions of interest

  1. There were no declar­a­tions of interest.

Annu­al audit plan 2025/2026 (Paper 1)

  1. Tom Reid, For­vis Maz­ars LLP presen­ted the extern­al auditor’s plan for the forth­com­ing audit of the 2025⁄26 annu­al report and accounts. He added that they are run­ning an event on 24 March in their Glas­gow office for all their audited bod­ies, risk and resi­li­ence for­um to include work­shops on fin­an­cial report­ing, cyber resi­li­ence and busi­ness trans­form­a­tion. He exten­ded the invite to any mem­bers of the committee.
  2. Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices high­lighted a risk relat­ing to pen­sion bene­fits dis­clos­ures in the accounts: a) Cap­ita has taken over admin­is­tra­tion of the civil ser­vice pen­sion scheme from the pre­vi­ous pro­vider (MyC­SP). b) Cap­ita was cur­rently deal­ing with sig­ni­fic­ant back­logs and data-trans­fer issues, affect­ing day-to-day pen­sion admin­is­tra­tion. c) These issues cre­ate a mater­i­al risk that Cap­ita may not be able to provide the Author­ity with required pen­sion inform­a­tion with­in neces­sary timelines. d) The team has tried to engage early with Cap­ita, and Tom will raise the mat­ter with­in Audit Scotland’s wider net­works. e) The situ­ation is out­side the Authority’s con­trol, but the Com­mit­tee needs to be aware of the risk.
  3. The Audit and Risk Com­mit­tee dis­cussed the report and made the fol­low­ing com­ments and observations:

Cairngorms Nation­al Park Author­ity Ugh­dar­ras Pàirc Nàiseanta a’ Mhon­aidh Ruaidh

13 March 2026 Page 4 of 12

a) Chair noted that the executive summary was very useful.
b) The Chair noted that the new finance system had significant implications on the increase of fees. Tom Reid explained that the fee in the paper was indicative, pending approval by Audit Scotland.
  1. The Com­mit­tee agreed to the recom­mend­a­tions in the paper.
  2. Action Points Arising: None.

Intern­al audit plan 2025⁄26: Gov­ernance (Paper 2)

  1. Peter Clark, wbg presen­ted the intern­al auditor’s review of the Park Authority’s gov­ernance arrange­ments that was con­duc­ted as part of the agreed plan of work for 2025⁄26.
  2. Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices repor­ted that it had been a valu­able audit, he had liaised sep­ar­ately with the Board Con­vener who was con­tent. Arrange­ments are in hand to imple­ment the recom­mend­a­tions with a review of the Terms of Ref­er­ence sched­uled to take place in November.
  3. The Audit and Risk Com­mit­tee dis­cussed the report and made the fol­low­ing com­ments and obser­va­tions: a) Chair com­men­ted that she liked the approach taken with the lay­out and explan­a­tion in the paper, and the obser­va­tions. She thanked Peter for the report. b) Mem­ber asked about the stand­ard­isa­tion of meet­ings per year? CEO advised that the Terms Of Ref­er­ence will be amended as an addendum to the Stand­ing Order’s of the Board to say that the Com­mit­tees will meet at least four times annu­ally. c) Mem­ber asked what would hap­pen if we were to drop below four meet­ings per year? CEO advised as account­able officer he would have to write to our spon­sor team at Scot­tish Gov­ern­ment and explain why. d) A mem­ber asked if the third obser­va­tion in the report was refer­ring to the cur­rent Com­mit­tee Chairs depar­ture? CEO con­firmed this was the case, he repor­ted that there had been 27 applic­a­tions for that post received, inter­views would take place shortly and that there should be some cross over in appoint­ment. He added that back­ground know­ledge in audit and risk was focal point of that exercise.

Cairngorms Nation­al Park Author­ity Ugh­dar­ras Pàirc Nàiseanta a’ Mhon­aidh Ruaidh

13 March 2026 Page 5 of 12

e) The Chair suggested refresher audit and risk committee training for new board members. Deputy CEO agreed and advised that would take place post direct elections.
f) A member noted that in the executive summary it stated only 10 of the 19 members responded to the survey which was disappointing and suggested that members collectively agree to encourage peers to complete it. This was agreed.
  1. The Audit and Risk Com­mit­tee agreed to the recom­mend­a­tions: a) Con­sider the intern­al aud­it­ors report and find­ings b) Endorse the man­age­ment responses to recom­mend­a­tions for future action and improvements
  2. Action Point Arising: i. Audit and Risk Com­mit­tee refresh­er train­ing for Board mem­bers to be organ­ised to take place after the loc­al elec­tions in March 2027.

Intern­al audit plan 2025⁄26: New fin­ance sys­tem (Paper 3)

  1. Peter Clark, wbg presen­ted the intern­al auditor’s review of the imple­ment­a­tion of the Park Authority’s new fin­ance sys­tem that was con­duc­ted as part of the agreed plan of work for 2025⁄26.
  2. Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices made the fol­low­ing points: a) He expressed great sat­is­fac­tion with the suc­cess­ful imple­ment­a­tion of the new fin­ance sys­tem, not­ing it is a major under­tak­ing for any organ­isa­tion. b) Intern­al audit find­ings con­firm the organisation’s own exper­i­ence that the sys­tem went live smoothly and without dis­rup­tion to oper­a­tions. c) The new sys­tem was already enabling great­er digit­isa­tion, sim­pli­fic­a­tion, and intern­al effi­cien­cies. d) He wel­comed the inde­pend­ent assur­ance from intern­al audit that val­id­ates management’s pos­it­ive assess­ment. e) The team has already imple­men­ted the recom­men­ded action, and although it would be reviewed as part of fol­low-up audit work, a fix was in place and is oper­a­tion­al now.

Cairngorms Nation­al Park Author­ity Ugh­dar­ras Pàirc Nàiseanta a’ Mhon­aidh Ruaidh

13 March 2026 Page 6 of 12

  1. The Audit and Risk Com­mit­tee dis­cussed the report and made the fol­low­ing com­ments and obser­va­tions: a) A mem­ber asked if a spe­cif­ic policy to pre­vent del­eg­ated author­ity being assigned to someone who was resign­ing, retir­ing, or poten­tially sub­ject to dis­cip­lin­ary action was needed? For example, should we record a rule pre­vent­ing del­eg­a­tion to someone on notice or garden leave? Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices advised:
    i. Anyone still employed retains their delegated rights until their final day; once they leave, authority automatically escalates to the next level.
ii. If someone is under investigation and placed on garden leave, management can temporarily suspend their approval rights in the system.
iii. The system allows delegation changes to be made quickly, including for long-term sickness or similar situations.
iv. The new system provides stronger controls than the old paper-based arrangements

    b) Mem­ber asked giv­en what happened in a pre­vi­ous audit, do we now need to have this pro­cess (e.g., sus­pen­sion of del­eg­ated author­ity for staff on leave or under invest­ig­a­tion) doc­u­mented in our fin­an­cial pro­ced­ures? Deputy CEO con­firmed that fin­an­cial pro­ced­ures must be writ­ten down and accur­ately reflect prac­tise. He advised this was already an out­stand­ing recom­mend­a­tion in the fol­low up report. Peter Clark added that intern­al audit will not only check that the pro­ced­ure is doc­u­mented but also that it is oper­a­tion­ally effect­ive, includ­ing stress-test­ing it. c) The Chair in ref­er­ence to the second obser­va­tion on the list, asked if the staff expenses func­tion would be imple­men­ted in the new fin­an­cial year? Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices con­firmed that it would not be ready to imple­ment in the new fin­an­cial year. He added that the delay was due to pri­or­it­ies, resources and capa­city and that team does not yet have that ele­ment ready for rollout.

  2. The Audit and Risk Com­mit­tee agreed to the recom­mend­a­tions: a) Con­sider the intern­al aud­it­ors report and findings

Cairngorms Nation­al Park Author­ity Ugh­dar­ras Pàirc Nàiseanta a’ Mhon­aidh Ruaidh

13 March 2026 Page 7 of 12

b) Endorse the management responses to recommendations for future action and improvements
  1. Action Point Arising: None.

Intern­al audit plan: Pro­ject ini­ti­ation (Paper 4)

  1. Peter Clark, wbg presen­ted the intern­al auditor’s review of the imple­ment­a­tion of the Park Authority’s pro­ject ini­ti­ation pro­ced­ures that was con­duc­ted as part of the agreed plan of work for 2025⁄26.
  2. Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices provided an over­view and made the fol­low­ing points: a) The audit report and pro­cess were con­sidered very help­ful for assess­ing the new pro­ject ini­ti­ation sys­tem. b) The sys­tem was intro­duced to address stra­tegic risks arising from the expand­ing range and com­plex­ity of the Authority’s activ­it­ies. c) Its pur­pose is to ensure early involve­ment of the right expert­ise in pro­ject devel­op­ment, redu­cing late-stage issues. d) The audit recom­mend­a­tions provided use­ful guid­ance for fur­ther devel­op­ment and embed­ding of the sys­tem. e) The sys­tem remains new and is not yet fully embed­ded across the organ­isa­tion. f) A fol­low-up audit is planned in around 12 months to assess embed­ding and effect­ive­ness. g) Middle man­agers would review the sys­tem, recom­mend­a­tions, and improve­ments in line with man­age­ment response timelines. h) He high­lighted uncer­tainty around set­ting a pro­ject approv­al time­frame until there was clear­er defin­i­tion of what qual­i­fies as a ​“pro­ject.” i) He acknow­ledged the sug­ges­tion of con­sid­er­ing an approv­al timetable as help­ful for future refinement.
  3. The Chair wel­comed the help­ful­ness of the audit pro­cess and agreed it would be valu­able to under­take a fol­low up review once the new pro­ject ini­ti­ation sys­tem becomes more fully embed­ded. Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices con­firmed that this aligns with man­age­ment think­ing and sug­ges­ted a fol­low up audit not in the com­ing fin­an­cial year but the fol­low­ing year to ensure enough time had passed for mean­ing­ful test­ing of embed­ded con­trols. This was agreed by the Committee.

Cairngorms Nation­al Park Author­ity Ugh­dar­ras Pàirc Nàiseanta a’ Mhon­aidh Ruaidh

13 March 2026 Page 8 of 12

  1. The Audit and Risk Com­mit­tee agreed to the recommendations:
  2. Action Point Arising: i. Fol­low up audit on pro­ject ini­ti­ation to be car­ried out in 2027/2028.

Intern­al audit plan 2025⁄26: Fol­low up review (Paper 5)

  1. Peter Clark, wbg presen­ted the intern­al auditor’s review of the imple­ment­a­tion of recom­mend­a­tions made in pre­vi­ous intern­al audit reviews that was con­duc­ted as part of the agreed plan of work for 2025⁄26.
  2. Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices advised there were a num­ber of out­stand­ing recom­mend­a­tions there which reflec­ted the ongo­ing pri­or­it­isa­tion of work with­in avail­able staff capa­city on the fin­ance sys­tem, grants admin­is­tra­tion and pro­ject ini­ti­ation. He added that most of the work was in pro­gress. He explained that work has begun on the busi­ness con­tinu­ity plan, through the advis­ory audit on IT and back up arrange­ments which have moved to cloud based services.
  3. The Audit and Risk Com­mit­tee dis­cussed the report and made the fol­low­ing com­ments and obser­va­tions: a) A mem­ber com­men­ted that giv­en the volume of doc­u­ment­a­tion and admin­is­trat­ive work, and not­ing that many actions fall to the Head of Fin­ance, who already has a heavy work­load, was there any short-term need for addi­tion­al admin­is­trat­ive sup­port to help her com­plete this work? Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices con­firmed that there was pres­sure on cor­por­ate ser­vices in bal­an­cing oper­a­tion­al deliv­ery with admin­is­trat­ive pro­cess work. Some sup­port has already been added through the recruit­ment of the fin­an­cial account­ant, who has been doc­u­ment­ing fin­an­cial pro­ced­ures as part of her role. He went on to explain that wider staff­ing con­straints imposed by the Scot­tish Gov­ern­ment lim­it the abil­ity to bring in fur­ther resources. b) Mem­ber asked what KPIs are used for pro­cure­ment, and what do they typ­ic­ally meas­ure? Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices explained that Pro­cure­ment KPI’s focus on wheth­er pro­cure­ments attract bids and res­ult in awar­ded con­tracts, are delivered with­in agreed budgets and timelines, and meet expec­ted qual­ity out­comes. They may also include mon­it­or­ing where

Cairngorms Nation­al Park Author­ity Ugh­dar­ras Pàirc Nàiseanta a’ Mhon­aidh Ruaidh

13 March 2026 Page 9 of 12

con­tract spend is geo­graph­ic­ally loc­ated, includ­ing with­in the Nation­al Park, provided this remains com­pli­ant with pro­cure­ment regulations.

  1. The Audit and Risk Com­mit­tee agreed to the recom­mend­a­tions: a) Con­sider the intern­al aud­it­ors report and find­ings b) Endorse the man­age­ment responses to recom­mend­a­tions for future action and improvements
  2. Action Point Arising: None.

Intern­al audit plan 2025⁄26: Grants admin­is­tra­tion and man­age­ment (Paper 6)

  1. Peter Clark, wbg presen­ted the intern­al auditor’s review of the imple­ment­a­tion of the Park Authority’s grants admin­is­tra­tion and man­age­ment that was con­duc­ted as part of the agreed plan of work for 2025⁄26.
  2. Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices made the fol­low­ing points: a) Com­munity Grants Man­ager who led the work with the audit team, found the pro­cess extremely help­ful and described it as the best audit pro­cess she has exper­i­enced, par­tic­u­larly not­able giv­en how often her grant admin­is­tra­tion work is audited. b) This is the second year of oper­at­ing the joined-up grant fund­ing sys­tem intro­duced last year. c) The sys­tem aims to provide a bet­ter ser­vice for applic­ants, allow­ing them to sub­mit one expres­sion of interest while staff identi­fy the most suit­able fund. d) This approach removes the need for applic­ants to nav­ig­ate mul­tiple funds them­selves. e) Early indic­a­tions show the new sys­tem is wel­comed by applic­ants. f) Intern­al audit found strong ini­tial con­trols with­in the sys­tem. g) The audit also provided use­ful insights and recom­mend­a­tions for fur­ther improve­ment. h) Over­all, the pro­cess and find­ings were positive.
  3. The Audit and Risk Com­mit­tee dis­cussed the report and made the fol­low­ing com­ments and observations:

Cairngorms Nation­al Park Author­ity Ugh­dar­ras Pàirc Nàiseanta a’ Mhon­aidh Ruaidh

13 March 2026 Page 10 of 12

a) A member commented that the climate adaptation fund appeared more accessible to the public. Deputy CEO and Director of Corporate Services agreed and said some applicants who could not be funded from their original chosen fund have been seamlessly redirected by staff to other available funds, including through the Cairngorms Trust, without needing to reapply. This has resulted in a more streamlined and improved service for applicants.
b) A member asked when the new community fund panel is set up, would the Grants team support applicants in the same way as with other grants for example assessing applications, informing applicants, coaching them, and reviewing project outcomes? And would this work be ring-fenced so it can be viewed separately from other Park Authority grant activity? Deputy CEO and Director of Corporate Services advised that the final process for community grants was still being developed by the co-design panel, but the Park Authority would remain the accountable body and ensure appropriate checks are in place. If the Grants team supports the process, it will follow the same separation of support and decision-making used in other grant schemes.
c) A member sought clarity on how will it be ensured that the community panel cannot progress projects that conflict with Board expectations or the accountable officer's responsibilities? Deputy CEO and Director of Corporate Services advised that Officers would still provide oversight to ensure proposals are appropriate, and the accountable officer retains the final authority to refuse funding that doesn't meet requirements. This provides a clear safeguard even if the community panel recommends a project.
  1. The Audit and Risk Com­mit­tee agreed to the recom­mend­a­tions: a) Con­sider the intern­al aud­it­ors report and find­ings b) Endorse the man­age­ment responses to recom­mend­a­tions for future action and improvements
  2. Action Point Arising: None.

Intern­al audit pro­gress report (Paper 7)

  1. Peter Clark, wbg presen­ted the intern­al auditor’s pro­gress report.
  2. The Audit and Risk Com­mit­tee agreed to the recommendations:

Cairngorms Nation­al Park Author­ity Ugh­dar­ras Pàirc Nàiseanta a’ Mhon­aidh Ruaidh

13 March 2026 Page 11 of 12

a) Consider the internal auditors report and findings
b) Endorse the management responses to recommendations for future action and improvements
  1. Action Point Arising: None.

Intern­al audit plan 2025⁄26 (Paper 8)

  1. Dav­id Camer­on, Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices presen­ted the paper which informs the Com­mit­tee of arrange­ments made for intern­al audit ser­vices for the com­ing two fin­an­cial years. He repor­ted that the rela­tion­ship with wbg had developed pos­it­ively and their audit reports have been well received by the Committee.
  2. The Audit and Risk Com­mit­tee expressed their appre­ci­ation for wbg’s work and wel­comed the con­tinu­ation of the relationship.
  3. Action Point Arising: None.

Intern­al audit plan 2026⁄27 and Stra­tegic Risk Registers (Paper 9)

  1. Dav­id Camer­on, Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices presen­ted the report on a pro­posed intern­al audit plan for 2026⁄27 pre­pared by the intern­al aud­it­or, wbg.
  2. The Audit and Risk Com­mit­tee dis­cussed the report and made the fol­low­ing com­ments and obser­va­tions: a) Chair wel­comed the improved spread of audit papers planned for the Committee’s meet­ings not­ing it would bene­fit both staff and the com­mit­tee. She expressed con­tent­ment with the pro­posed plan and par­tic­u­larly pleased to see cyber­se­cur­ity included as a pri­or­ity area. b) Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices high­lighted that the upcom­ing com­plaints audit would assess the robust­ness of both the organisation’s stand­ard com­plaints hand­ling pro­cesses and its approach to man­aging more com­plex, high-level gov­ernance com­plaints. He went on to explain that the audit would ensure such com­plaints were handled appro­pri­ately while also con­sid­er­ing value-for-money implic­a­tions in how pub­lic funds are used when respond­ing to them. c) A mem­ber asked if there was a risk register for indi­vidu­al pro­jects with­in the Cairngorms 2030 pro­gramme and would these be included in the audit?

Cairngorms Nation­al Park Author­ity Ugh­dar­ras Pàirc Nàiseanta a’ Mhon­aidh Ruaidh

13 March 2026 Page 12 of 12

Deputy CEO and Dir­ect­or of Cor­por­ate Ser­vices advised that there is a pro­gramme-wide Cairngorms 2030 risk register cov­er­ing all pro­jects, with indi­vidu­al pro­ject risk registers cre­ated only where neces­sary (e.g., high­er-risk pro­jects such as the com­munity grants pro­ject). This avoids unne­ces­sary work on low-risk pro­jects, and these registers are audited as part of the programme.

  1. The Audit and Risk Com­mit­tee con­sidered the report and assessed the plan for 2026⁄27 with­in the con­text of the stra­tegic risk registers cur­rently live on the stra­tegic risk registers (main register and Cairngorms 2030 pro­gramme register) and con­sidered wheth­er the focus of work meets the Park Authority’s need for assurance.
  2. Action Points Arising: None.

AOCB

  1. There were no items of business.
  2. Motion to take the next items in con­fid­en­tial session.

Date of Next Meeting

  1. The date of the next meet­ing is 19 June 2026 online.
  2. The pub­lic part of the meet­ing con­cluded at 3.26 pm
RefAction DetailWhoWhenStatus
13/03/26At Para 18iDav­id CameronFol­low­ing dir­ectly elec­ted elec­tions March 2027
Refresh­er Audit & Risk Com­mit­tee train­ing to be organised
13/03/26At Para 28i)Intern­al auditors2027⁄28
Fol­low up audit on pro­ject ini­ti­ation to be car­ried out in 2027/2028.