Cairngorms Nation­al Park Authority

Intern­al Audit Report ²⁰²⁰⁄₂₁

Data Man­age­ment

Feb­ru­ary 2021

---

A AZETS

Con­tents:

• Exec­ut­ive Sum­mary — 1
• Man­age­ment Action Plan — 4
• Appendix A – Defin­i­tions — 12

Audit Spon­sor:

Dav­id Camer­on, Dir­ect­or of Cor­por­ate Services

Key Con­tacts:

Vicky Walk­er, Office Ser­vices Man­ager Sandy Allan, IT Ser­vices Manager

Audit team:

Fraser Nicol, Part­ner Paul Kelly, Dir­ect­or Rachel Wilson, Assist­ant Manager

---

Exec­ut­ive Summary

Con­clu­sion

In 2018, the Author­ity took steps to improve their data man­age­ment pro­ced­ures. A policy update and file re-struc­ture was planned to be car­ried out in May 2020 to improve fur­ther on the pro­ced­ures imple­men­ted in 2018 how­ever this has been delayed as a res­ult of COVID-19.

We recom­mend that now the ini­tial response to the pan­dem­ic has been addressed, the Author­ity should resume the activ­ity ini­ti­ated in Janu­ary 2020. Spe­cific­ally, we recom­mend that the Author­ity focuses on review­ing exist­ing policies to ensure they are up to date, under­take activ­it­ies to mon­it­or com­pli­ance with policies, lim­it file struc­ture modi­fic­a­tion rights to those who require it, and amend the file struc­ture to reflect find­ings from the staff sur­vey car­ried out in Janu­ary 2020.

We have included an advis­ory sec­tion at the end of this report detail­ing our recom­men­ded approach for identi­fy­ing the Authority’s future IT needs and imple­ment­ing cloud solutions.

Back­ground and scope

It is import­ant that organ­isa­tions man­age struc­tured and unstruc­tured data in an effect­ive and effi­cient man­ner that sup­port con­sist­ency of pro­cess. Struc­tured data is typ­ic­ally iden­ti­fied as data that exists in tables and can be eas­ily searched and ana­lysed. Unstruc­tured data is data that can­not be con­tained in a row/​column mod­el and which is dif­fi­cult to search and ana­lyse e.g. Word, Excel, Power­Point, pic­ture, video files etc.

It is par­tic­u­larly import­ant to pub­lic bod­ies as there is a need to com­ply with sev­er­al legis­lat­ive require­ments (GDPR, FoISA and EIR) that relies on the abil­ity to be able to loc­ate data and inform­a­tion in a timely manner.

The organ­isa­tion has been using its cur­rent net­work file share struc­ture for approx­im­ately 5 – 6 years and, the work­ing arrange­ments in response to COV­ID-19 has res­ul­ted in a renewed focus on hav­ing data and inform­a­tion eas­ily and quickly access­ible, ideally via cloud solu­tions such as SharePoint.

The Author­ity sought a review to provide assur­ance over the cur­rent approach to data man­age­ment as well as an advisory/​critical friend review of the planned pro­cesses for review­ing and chan­ging file structures.

Our review con­sidered the adequacy of cur­rent data man­age­ment pro­cesses that sup­port the organ­isa­tion in respond­ing to requests for inform­a­tion in rela­tion to GDPR, FoISA and EIR.

The review also crit­ic­ally appraised the effect­ive­ness of cur­rent data man­age­ment struc­tures at a key point in the change process.

---

Con­trol assessment

4 — N/A Advis­ory Point	1 — Amber
3 — Yellow	2 — Amber

1. There is agreed cor­por­ate policy / pro­ced­ure for the stor­age of data and inform­a­tion on the cor­por­ate network.
2. Access con­trols to the net­work file shares are suf­fi­cient to pre­vent agreed file shar­ing struc­tures being amended without authorisation.
3. The data struc­ture are appro­pri­ate in sup­port­ing the agreed struc­tures and these are adequate to allow the organ­isa­tion to respond to requests for inform­a­tion in rela­tion to data pro­tec­tion, free­dom of inform­a­tion and envir­on­ment­al inform­a­tion requests.
4. Through dis­cus­sion with man­age­ment, we will crit­ic­ally appraise pro­posed approaches to changes in rela­tion to data struc­tures and migra­tion to cloud ser­vices and how Brexit may impact on these.

Improve­ment actions by type and priority

(Chart show­ing improve­ment actions by type and pri­or­ity — Grade 1, Grade 2, Grade 3, Grade 4)

Five improve­ment actions have been iden­ti­fied from this review, three of which relate to com­pli­ance with exist­ing pro­ced­ures, rather than the design of con­trols them­selves. See Appendix A for defin­i­tions of col­our coding.

---

Key find­ings

Good prac­tice

The Authority’s pro­ced­ures reflect good prac­tice in the fol­low­ing area:

• The Office Ser­vices Man­ager con­duc­ted a staff sur­vey in Janu­ary 2020 to bet­ter under­stand how staff cur­rently use the file struc­ture and what they would like to be changed. Sur­vey responses were col­lated, and the out­put was used by the Office Ser­vices Man­ager to cre­ate a pro­posed new struc­ture for the shared file drive. This activ­ity was put on hold because of COV­ID-19 how­ever the responses gained from the sur­vey will be help­ful when the Author­ity resumes this activity.

Areas for improvement

We have iden­ti­fied areas for improve­ment which, if addressed, would strengthen the Authority’s con­trol frame­work. These include:

• Update of exist­ing policies to ensure they are cur­rent and consistent
• Imple­ment­a­tion of com­pli­ance activ­it­ies to meas­ure staff com­pli­ance with policies
• Update of exist­ing file modi­fic­a­tion per­mis­sions to lim­it this action to a small num­ber of staff
• Cre­ation of a sub­ject access request response procedure

These are fur­ther dis­cussed in the Man­age­ment Action Plan below.

---

Acknow­ledge­ments

We would like to thank all staff con­sul­ted dur­ing this review for their assist­ance and co-operation.

---

Man­age­ment Action Plan

Con­trol Object­ive 1: There is agreed cor­por­ate policy / pro­ced­ure for the stor­age of data and inform­a­tion on the cor­por­ate network.

1.1 Update of data man­age­ment policies (Amber)

There are three policies which make up the cor­por­ate policy for data man­age­ment: the Records Man­age­ment Policy, the Inform­a­tion Secur­ity Policy, and the Data Pro­tec­tion Policy. The Records Man­age­ment Policy doc­u­ments roles and respons­ib­il­it­ies of rel­ev­ant staff, man­age­ment of records, ver­sion con­trol, data reten­tion and disposal.

How­ever, we found that although policies are required to be reviewed annu­ally, the Records Man­age­ment Policy had not been updated since Feb­ru­ary 2017 and the Inform­a­tion Secur­ity Policy was last updated in Octo­ber 2016. There­fore, neither of these policies have been updated to ensure they reflect GDPR requirements.

There are also incon­sist­en­cies between the Records Man­age­ment Policy and the Inform­a­tion Secur­ity Policy. For example, the Records Man­age­ment Policy states that elec­tron­ic records are avail­able on an ​“open to all: need to know” basis mean­ing records are avail­able for view­ing to all staff unless spe­cific­ally des­ig­nated as sens­it­ive. How­ever, the Inform­a­tion Secur­ity Policy states that user access will be gran­ted on a role-based, least priv­ilege basis mean­ing that access is based upon the min­im­um level of inform­a­tion needed to ful­fil your role.

Risk:

There is a risk that, without up-to-date policies, there will be a lack of clar­ity for staff of what data man­age­ment prac­tices they should be fol­low­ing. This could lead to fail­ure to com­ply with reg­u­lat­ory require­ments and organ­isa­tion­al controls.

Recom­mend­a­tion:

We recom­mend that the organ­isa­tion reviews and updates all three policies to ensure that they reflect the latest data pro­tec­tion legis­la­tion as well as cur­rent and planned organ­isa­tion­al prac­tices. Spe­cific­ally, the Author­ity should ensure that inform­a­tion con­tained with­in each policy is con­sist­ent. The Author­ity should ensure that the own­er for each policy is updated and going for­ward, it should ensure that policies are reviewed in line with the review fre­quency documented.

Man­age­ment Action:

Recom­mend­a­tion accepted.

Action own­er: Office Ser­vices Manager

Due date: 31 Decem­ber 2021

Grade 2 (Design)

1.2 Com­pli­ance with policy

The Records Man­age­ment Policy states that the Author­ity will under­take an annu­al audit of both elec­tron­ic and paper files to ensure com­pli­ance with records man­age­ment best prac­tice guid­ance; how­ever we found that since the policy was imple­men­ted in 2017, this annu­al audit has not been conducted.

The policy also states that all elec­tron­ic records folders and paper records folders will be appro­pri­ately marked with reten­tion sched­ules and reviewed and dis­posed of accord­ingly. A data reten­tion sched­ule is in place which details how long each type of file with­in each dir­ect­or­ate should be held. Staff are required to include the reten­tion with­in the folder name by adding “+YEAR”. We sampled four dir­ect­or­ate folders and found that whilst two of them had the reten­tion included with­in folder names, two of them did not include reten­tion times with­in file names.

Risk:

Seni­or man­age­ment is unaware that staff are not adher­ing to the policy which could lead to fail­ure to delete data in line with the data reten­tion policy and there­fore fail­ure to com­ply with data pro­tec­tion legislation.

Recom­mend­a­tion:

We recom­mend that the Author­ity ensure that data audits are con­duc­ted annu­ally in line with the policy. These audits should sample vari­ous dir­ect­or­ates to ensure that stor­age and man­age­ment of files adhere to the Records Man­age­ment Policy. Spe­cific­ally, this audit should con­sider com­pli­ance with data reten­tion and dis­pos­al require­ments, ver­sion con­trol require­ments and access and secur­ity require­ments. The out­put of this audit should be doc­u­mented and the Head of Ser­vice for each area should be giv­en recom­men­ded actions as necessary.

We also recom­mend that the Author­ity eval­u­ates the approach to own­er­ship of folders and how com­pli­ance checks against the Records Man­age­ment Policy are performed.

Man­age­ment Action:

Recom­mend­a­tion agreed. While we note this is a high level, grade 3 recom­mend­a­tion, time is required to first imple­ment oth­er actions required by oth­er recom­mend­a­tions pri­or to imple­ment­ing data audits and com­pli­ance checks. There­fore an unusu­ally long peri­od to the due date for a grade 3 recom­mend­a­tion has been allowed for.

Action own­er: Head of Organ­isa­tion­al Development

Due date: 30 June 2022

Grade 3 (Oper­a­tion)

---

Con­trol Object­ive 2: Access con­trols to the net­work file shares are suf­fi­cient to pre­vent agreed file shar­ing struc­tures being amended without authorisation.

2.1 Access con­trol (Amber)

The Author­ity under­took a review of their shared net­work file struc­ture in 2017 and this included a review of users who had amend­ment rights and as a res­ult, only 3 or 4 users were giv­en this level of access. Staff who wanted to cre­ate or amend folders were required to sub­mit a request to the Admin Team via email.

How­ever, we found that the num­ber of indi­vidu­als giv­en this level of access has increased since 2017 and when the Author­ity moved to home work­ing, it was decided that there should be one user per depart­ment with this level of access. As a res­ult, there are now 26 users who have this level of access, out of a total staff of 67.

Risk:

Users with inap­pro­pri­ate rights to make amend­ments may make modi­fic­a­tions to the Authority’s file struc­ture that cause issues when search­ing for data to respond to sub­ject access, free­dom of inform­a­tion and envir­on­ment­al inform­a­tion requests. This could impact the organisation’s abil­ity to com­ply with reg­u­lat­ory requirements.

Recom­mend­a­tion:

We recom­mend that the Author­ity reviews the list of users who can make modi­fic­a­tion to the file struc­ture. The top level of folders i.e. folders for each dir­ect­or­ate, should be locked down so that only a small num­ber of users who require amend­ment rights can modi­fy them. To sup­port bet­ter man­age­ment of file per­mis­sions for lower-level folders with­in each dir­ect­or­ate, we recom­mend that each dir­ect­or­ate is provided with access to cre­ate sub-folders with­in their respect­ive top-level folder without hav­ing to ask IT or the Admin Team for permission.

We also recom­mend that requests for amend­ments to the top-level the file struc­ture are sub­mit­ted to the Office Ser­vice Man­ager who can make a decision on their justification.

Man­age­ment Action:

We agree with the over­all thrust of the recom­mend­a­tion. We will review the struc­ture and make a decision at which level of the folder hier­archy the folder struc­ture will be locked down, and design / imple­ment access pro­ced­ures for teams to cre­ate lower level folders.

Action own­er: Office Ser­vices Manager

Due date: 30 June 2021

Grade 3 (Oper­a­tion)

---

Con­trol Object­ive 3: The data struc­tures are appro­pri­ate in sup­port­ing the agreed struc­tures and these are adequate to allow the organ­isa­tion to respond to requests for inform­a­tion in rela­tion to data pro­tec­tion, free­dom of inform­a­tion and envir­on­ment­al inform­a­tion requests.

3.1 Imple­ment­a­tion of the pro­posed file struc­ture (Yel­low)

The Office Ser­vices Man­ager star­ted work in Janu­ary 2020 to review and restruc­ture the R drive to meet users’ needs. A sur­vey was con­duc­ted to under­stand staff per­spect­ive on the ease of use of the cur­rent struc­ture which revealed the staff would like to see the fol­low­ing be implemented:

• Use of con­sist­ent nam­ing conventions
• Guide map of filing
• Easy access to templates

As a res­ult, the Office Ser­vices Man­ager cre­ated a pro­pos­al for a new file struc­ture. How­ever, this activ­ity was put on hold as a res­ult of COV­ID-19. A risk was added to the cor­por­ate risk register to reflect the increased risk in data man­age­ment as a res­ult of the pan­dem­ic, how­ever it is unclear when this activ­ity will be resumed.

Risk:

The cur­rent file struc­ture does not reflect staff require­ments which could res­ult in frus­tra­tion and an increased risk of work­arounds being used which are not com­pli­ant with the cor­por­ate policy.

Recom­mend­a­tion:

We recom­mend that the Author­ity resumes this activ­ity to ensure that work to improve the man­age­ment of data is not unne­ces­sar­ily delayed fol­low­ing the Authority’s ini­tial response to the pan­dem­ic. The Author­ity should alloc­ate resources to ensure that this activ­ity can be car­ried out with­in a reas­on­able timescale.

Man­age­ment Action:

Recom­mend­a­tion agreed. We will design and imple­ment a data integ­rity action plan and integ­rate that with our plan­ning around staff phased return to the office to secure the integ­rity of our data.

Action own­er: Office Ser­vices Man­ager with Busi­ness Con­tinu­ity Steer­ing Group

Due date: 31 August 2021

Grade 2 (Oper­a­tion)

3.2 Cre­ation of a sub­ject access request procedure

There are cur­rently pro­ced­ure doc­u­ments in place out­lining the pro­cess to be fol­lowed when respond­ing to free­dom of inform­a­tion requests and envir­on­ment­al inform­a­tion requests. How­ever, there is no pro­ced­ure out­lining the pro­cess to be fol­lowed when respond­ing to a sub­ject access request for GDPR com­pli­ance purposes.

The Author­ity received a com­plex sub­ject access request in Sum­mer 2020 and asked their data pro­tec­tion officer as a ser­vice (DPOaaS) pro­vider to review their response to that request to allow them to identi­fy any oppor­tun­it­ies for improve­ment. At the time of our audit work in Janu­ary 2021, the Author­ity had received the response and was review­ing this.

Risk:

Staff are unaware of the pro­cess they should fol­low when respond­ing to a sub­ject access request which could lead to fail­ure to meet the one-month response dead­line. This could res­ult in non-com­pli­ance with regulation.

Recom­mend­a­tion:

We recom­mend that once the Author­ity have received the feed­back from their DPOaaS pro­vider, they cre­ate a sub­ject access request pro­ced­ure, or doc­u­ment the pro­cess with­in an exist­ing pro­ced­ure, if appro­pri­ate. The pro­ced­ure should out­line the fol­low­ing aspects:

• Roles and respons­ib­il­it­ies when respond­ing to requests
• Ini­tial steps for acknow­ledging the request and veri­fy­ing the iden­tity of the individual
• Identi­fy­ing what data is with­in scope
• How to search for data
• How data should be sent to the individual
• How requests will be logged and mon­itored by the Authority

Man­age­ment Action:

Recom­mend­a­tion agreed and underway.

Action own­er: Office Ser­vices Manager

Due date: 30 June 2021

Grade 3 (Design)

---

Advis­ory: Through dis­cus­sion with man­age­ment, we will crit­ic­ally appraise pro­posed approaches to changes in rela­tion to data struc­tures and migra­tion to cloud ser­vices and how Brexit may impact on these.

Cur­rent Position

Remote Access

When the Author­ity first moved to a work­ing from home envir­on­ment as a res­ult of the pan­dem­ic, their options for remote access were very lim­ited. Lim­ited licenses for the VMWare solu­tion (12 licenses) were in place to allow staff to con­nect remotely to the cor­por­ate net­work. This meant that there were a num­ber of staff who could not access the R drive. The Author­ity there­fore decided to imple­ment a tem­por­ary cloud stor­age solu­tion called ZoHo. All staff can access ZoHo and store doc­u­ments there whilst they are work­ing from home. A select num­ber of staff can still access the R drive through the VMWare and there­fore act as a liais­on point to provide cop­ies of files for those staff who do not have access to the R drive. The Author­ity plans to migrate any data stored on ZoHo back on to the R drive once all staff regain access.

To increase the num­ber of staff who can access the R drive remotely, the Author­ity has piloted use of a product called ZScaler, a remote net­work access solu­tion which uses multi-factor authen­tic­a­tion. There are cur­rently about 15 mem­bers of staff using ZScaler. IT and the Dir­ect­or of Cor­por­ate Ser­vices are cur­rently con­sid­er­ing rolling this out to all staff how­ever there are a num­ber of devices which are not com­pat­ible with the product. There are there­fore con­sid­er­a­tions to roll out new devices, as neces­sary, which are com­pat­ible with the ZScaler product to allow all staff remote access to the network.

Cloud Solu­tion

IT has writ­ten a paper on decisions to be con­sidered to allow the Author­ity to migrate to cloud ser­vices where appro­pri­ate. The paper is cur­rently in draft format and is high level, how­ever it con­tains a sec­tion on decisions to be made with­in the next 6 – 12 months and pos­sible options for the Wide Access Net­work (WAN) and Microsoft Office — the Author­ity cur­rently uses Microsoft Office 2013. The paper is not yet fin­ished but it is clear each option will include fin­an­cial and organ­isa­tion impact.

Recom­mend­a­tion:

The past 10 months have high­lighted that the organ­isa­tion would bene­fit from improved oper­a­tion­al resi­li­ence and tech­no­logy solu­tions that sup­port effect­ive and effi­cient remote work­ing. Tak­ing into con­sid­er­a­tion the small num­ber of IT staff with­in the organ­isa­tion, it would be prudent to max­im­ise tech­no­logy ​“as a ser­vice” offer­ings in the medi­um and longer term. This includes mov­ing spe­cif­ic ser­vices to man­aged service/​cloud pro­vi­sion where it is cost effect­ive to do so. This will reduce the tech­nic­al skills needs and over-reli­ance on indi­vidu­al know­ledge as this is trans­ferred to third parties.

We recom­mend that the Author­ity takes the fol­low­ing steps when mov­ing to a struc­ture with a high­er reli­ance on cloud solutions.

1. Under­stand Busi­ness Requirements
2. Options Apprais­al & Busi­ness Case
3. Select Solu­tion & Implement

4. Per­form Con­tinu­ous Monitoring

5. Under­stand the require­ments of the busi­ness: The Author­ity should look at what the needs of the busi­ness are in the fol­low­ing areas for their future IT environment:

   • Volume of data required to be held on a cloud solution
   • Col­lab­or­a­tion needs of the busi­ness i.e. if they require the option to share data extern­ally through the cloud solution
   • Identi­fy the avail­ab­il­ity and recov­ery needs of the organisation
   • Identi­fy the level of secur­ity and data pro­tec­tion needs of data that will be stored on the sys­tem. E.g. if per­son­al data will be stored on the sys­tem, the organ­isa­tion will need to con­sider reg­u­lat­ory require­ments. The sec­tion on Brexit below, expands on this.
   • Identi­fy the long-term goals for the Author­ity. i.e. is there the expect­a­tion that the Author­ity will move to Microsoft 365 and when would they want / expect this to happen?

6. Options Apprais­al and Busi­ness Case: Once the Author­ity has iden­ti­fied the needs of the busi­ness, it should look for cloud solu­tions which meet these needs and com­pare them in a sim­il­ar man­ner to the high-level draft paper pro­duced by IT. The options apprais­al should out­line how each pro­posed solu­tion meets the busi­ness needs in areas such as avail­ab­il­ity, stor­age space, secur­ity, as well as costs. The options apprais­al should be included with­in a busi­ness case which should be go through the rel­ev­ant gov­ernance struc­ture for author­isa­tion, i.e. to the Dir­ect­or of Cor­por­ate Ser­vices, and if appro­pri­ate, the Fin­ance and Audit Committee.

7. Select a solu­tion and pro­gress with imple­ment­a­tion: When select­ing a pro­vider, the Author­ity should ensure that the neces­sary due dili­gence has been per­formed on the supplier(s). For example, the Author­ity should com­plete a Data Pro­tec­tion Impact Assess­ment, which con­siders where per­son­al data will be stored, and a Secur­ity Assess­ment, which will assess wheth­er the supplier’s level of secur­ity meets the Authority’s secur­ity require­ments. Once a solu­tion has been selec­ted, an imple­ment­a­tion plan should be cre­ated which details how the Author­ity plans to move to the selec­ted solu­tion. The imple­ment­a­tion plan should doc­u­ment times­cales and own­ers for tasks, including:

   • Clean up of the cur­rent file struc­ture pri­or to migra­tion to the cloud solution
   • Cre­ation of a pro­posed struc­ture for stor­age of files on the new solution
   • Cre­ation of rel­ev­ant policies and guid­ance doc­u­ments for the new solution

8. Con­tinu­ous Mon­it­or­ing: Once the solu­tion has been imple­men­ted, the Author­ity should con­tin­ue to mon­it­or use of the solu­tion to ensure that staff com­ply with rel­ev­ant intern­al guid­ance and oper­at­ing pro­ced­ures. The Author­ity should estab­lish form­al con­tract man­age­ment pro­cesses for all third party ser­vices provided.

Brexit

The trans­ition peri­od for Brexit ended on 31 Decem­ber 2020. The EU has agreed to delay data trans­fer restric­tions for at least four months although this might be exten­ded to six months. The UK Gov­ern­ment is cur­rently seek­ing an adequacy decision. If the EU agrees to an adequacy decision, EU per­son­al data will be allowed to be trans­ferred and stored with­in the UK without the need for fur­ther action by indi­vidu­al organ­isa­tions. How­ever, if the EU does not agree to the adequacy decision, the Author­ity will need to ensure that the per­son­al data of any EU indi­vidu­als is either:

1. Stored with­in one of the coun­tries that has been deemed adequate by EU GDPR; or
2. There is an appro­pri­ate solu­tion in place with a coun­try resid­ing in a non-adequate coun­try to ensure they com­ply with EU GDPR, e.g. stand­ard con­trac­tu­al clauses.

What this means for the Author­ity is that if they pro­cess the per­son­al data of EU indi­vidu­als, they will need to take steps to ensure that any cloud ser­vices pro­vider com­plies with EU GDPR. Depend­ing on an adequacy decision, this could mean tak­ing addi­tion­al steps if the cloud ser­vice pro­vider stores data with­in the UK.

If the Author­ity only pro­cesses the per­son­al data of UK cit­izens, which we cur­rently under­stand to be the case, the Author­ity only needs to com­ply with UK Data Pro­tec­tion Act. This means that the Author­ity will need to ensure that data stored by cloud ser­vice pro­viders resides with­in one of the coun­tries deemed adequate by the UK, which cur­rently includes coun­tries with­in the EEA and those already covered by exist­ing EU adequacy decisions. If the cloud pro­vider does not store data with­in one of these coun­tries, safe­guards such as stand­ard con­trac­tu­al clauses or bind­ing cor­por­ate rules will need to be in place.

Most cloud ser­vice pro­viders are aware of these require­ments and have options in place to allow cli­ents to select that they wish for their data to be stored with­in the EEA for these pur­poses, how­ever this is some­thing that the Author­ity will need to con­sider when select­ing a ser­vice provider.

---

Appendix A – Definitions

Con­trol assessments

• R: Fun­da­ment­al absence or fail­ure of key controls.
• A: Con­trol object­ive not achieved — con­trols are inad­equate or ineffective.
• Y: Con­trol object­ive achieved — no major weak­nesses but scope for improvement.
• G: Con­trol object­ive achieved — con­trols are adequate, effect­ive and efficient.

Man­age­ment action grades

• 4: Very high risk expos­ure — major con­cerns requir­ing imme­di­ate seni­or atten­tion that cre­ate fun­da­ment­al risks with­in the organisation.
• 3: High risk expos­ure — absence / fail­ure of key con­trols that cre­ate sig­ni­fic­ant risks with­in the organisation.
• 2: Mod­er­ate risk expos­ure — con­trols are not work­ing effect­ively and effi­ciently and may cre­ate mod­er­ate risks with­in the organisation.
• 1: Lim­ited risk expos­ure — con­trols are work­ing effect­ively, but could be strengthened to pre­vent the cre­ation of minor risks or address gen­er­al house-keep­ing issues.

---

© Azets 2021. All rights reserved. Azets refers to Azets Audit Ser­vices Lim­ited. Registered in Eng­land & Wales Registered No. 09652677. VAT Regis­tra­tion No. 219 0608 22.

Registered to carry on audit work in the UK and reg­u­lated for a range of invest­ment busi­ness activ­it­ies by the Insti­tute of Chartered Account­ants in Eng­land and Wales.