Risk Register

Risk A1

• Theme: All
• Risk cat­egory: Resources — financial
• Risk descrip­tion: Pub­lic sec­tor fin­ances con­strain capa­city to alloc­ate suf­fi­cient resources to deliv­er cor­por­ate plan.
• Mitigation/​controls in place:
  • Pre­vent­at­ive: Ongo­ing liais­on with Scot­tish Gov­ern­ment through our spon­sor­ship team, Peat­land Action Team, and Rur­al Com­munit­ies Team high­light­ing achieve­ments of CNPA.
  • Pre­vent­at­ive: Cor­por­ate plan pri­or­it­ised around anti­cip­ated Scot­tish Gov­ern­ment budget alloc­a­tions, tak­ing on Board expect­a­tion of fund­ing constraints.
  • Remedi­al: Focus resource on diver­si­fic­a­tion of income streams to altern­at­ive, non-pub­lic income generation.
  • Remedi­al: Con­tinu­ing to sup­port ​“deliv­ery bod­ies” such as Cairngorms Nature, Cairngorms Trust in secur­ing inward investment.
• Cur­rent like­li­hood: 4
• Cur­rent impact: 3
• Risk score: 12
• Trend: Stat­ic
• Com­ment: Alloc­a­tions for ²⁰²⁶⁄₂₇ fin­an­cial year provide a good set­tle­ment suf­fi­cient to cov­er planned deliv­ery against cor­por­ate plan object­ives. Mit­ig­a­tion actions have sup­por­ted pos­it­ive risk man­age­ment. Risk decreas­ing while recog­nising alloc­a­tions remain sub­ject to approv­al of Scot­tish budget, with resid­ual risk around in year adjust­ments. Award of £1.045 mil­lion from NRF togeth­er with sig­ni­fic­ant NLHF fund­ing to 2029 con­firms suc­cess of mit­ig­a­tion approaches. Elec­tion res­ult sug­gests con­tinu­ation of alloc­a­tions for ²⁰²⁶⁄₂₇ fin­an­cial year, while engage­ment with new Min­is­ter and mon­it­or­ing of nation­al fin­an­cial pos­i­tion updates from Gov­ern­ment will be needed. Resource impacts of the wild­fire are still be assessed and dis­cus­sions have taken place with Scot­tish Gov­ern­ment about impacts on Park Author­ity budgets.
• Planned actions:
  • Pre­vent­at­ive: Ongo­ing liais­on with Scot­tish Gov­ern­ment through our spon­sor­ship team and the Peat­land Action Team, high­light­ing achieve­ments of CNPA.
  • Pre­vent­at­ive: pre­pare brief­ing on work and pri­or­ity invest­ment for post-elec­tion in line with devel­op­ment of new 2027 to 2032 Cor­por­ate Plan and NPPP.
  • Remedi­al: scen­ario plan­ning on for­ward budget mod­el­ling to pre­pare options for future resource alloc­a­tions with­in final alloc­a­tions, based on fund­ing para­met­ers sug­ges­ted by spon­sor­ship team.
• Due date: Ongo­ing
• Risk appet­ite: Open
• Tar­get like­li­hood: 4
• Tar­get impact: 3
• Tar­get risk score: 12
• Risk own­er: Dav­id Cameron
• Date last updated: 11/09/2026

Risk A24

• Theme: All
• Risk cat­egory: Resources — financial
• Risk descrip­tion: Risk of C2030 match fund­ing not being secured — cur­rent match fund­ing in bid not fully com­mit­ted and/​or for one year only in many areas.
• Mitigation/​controls in place:
  • Pre­vent­at­ive: Ongo­ing liais­on with Scot­tish Gov­ern­ment through our spon­sor­ship team and the Peat­land Action Team, high­light­ing achieve­ments of CNPA and import­ance of Peat­land Res­tor­a­tion fund­ing to inward invest­ment by NLHF.
  • Remedi­al: Dis­cus­sions with Trans­port Scot­land on fund­ing for act­ive travel design work.
  • Remedi­al: con­sider off­set­ting expendit­ure reduc­tions to off­set any fund­ing gaps with­in programme
  • Remedi­al: ongo­ing explor­a­tion with part­ners to secure C2030 pro­gramme funding
• Cur­rent like­li­hood: 4
• Cur­rent impact: 4
• Risk score: 16
• Trend: Stat­ic
• Com­ment: Fund­ing for ²⁰²⁶⁄₂₇ Peat­land Res­tor­a­tion has been secured in line with require­ments. This provides a suit­able level of match fund­ing for the C2030 pro­gramme, in line with the programme’s 5‑year budget. Peat­land res­tor­a­tion deliv­ery pro­file is healthy, with expect­a­tion that suf­fi­cient will be spent with­in the year to meet required con­tri­bu­tion to C2030 deliv­ery. Con­tract­or for RIBA stages 3 and 4 design work now appoin­ted. Trans­port Scot­land annu­al fund­ing cycles do not fit the pro­ject deliv­ery require­ments and altern­ate fin­an­cial solu­tions are needed to com­plete work. Addi­tion­al award of fund­ing for ²⁰²⁶⁄₂₇ is now in applic­a­tion pro­cess, with con­tract activ­ity being main­tained through oth­er pro­gramme fin­ances. Pos­it­ive pro­gress in secur­ing extern­al fund­ing for C2030 for trans­port and nature pro­jects. Dis­cus­sions with HIE pro­gress­ing well toward secur­ing budgeted con­tri­bu­tion plus poten­tially a slight increase (to £600k).
• Planned actions:
  • Pre­vent­at­ive: con­tin­ued focus over 2026 on match fund­ing pos­i­tion and con­sequent impacts to ensure C2030 pro­gramme plans and fin­an­cing of them fully aligned by end of year.
  • Pre­vent­at­ive: high pro­file and ongo­ing focus for SMT in enga­ging in influ­en­cing to secure the match fund­ing needed from part­ners; pro­ject man­agers aware of rel­ev­ant pro­ject match fund­ing pos­i­tion and tasked with seek­ing addi­tion­al match fund­ing where appropriate.
  • Pre­vent­at­ive: con­sid­er­a­tion of new, wider match fund­ing opportunities.
  • Remedi­al: Fully updated C2030 budget devel­op­ment in Q1 of ²⁶⁄₂₇ to identi­fy any remain­ing spe­cif­ic issues or remedi­al work.
  • Remedi­al: Use of planned park author­ity con­tri­bu­tions as inter­im meas­ures to bridge tem­por­ary phas­ing shortfalls.
• Due date: Ongo­ing
• Risk appet­ite: Open
• Tar­get like­li­hood: 4
• Tar­get impact: 2
• Tar­get risk score: 8
• Risk own­er: Dav­id Cameron
• Date last updated: 11/09/2026

Risk A25

• Theme: Nature & conservation
• Risk cat­egory: Stra­tegic delivery
• Risk descrip­tion: The Authority’s range of powers com­bined with stra­tegic part­ner­ships is insuf­fi­cient to deliv­er out­comes on wild­life crime. Wild­life crime is dif­fi­cult to evid­ence and pop­u­la­tions are affected by a vari­ety of inter­re­lated factors.
• Mitigation/​controls in place:
  • Pre­vent­at­ive: licen­cing arrange­ments con­trib­ute to more effect­ive con­trol framework.
  • Pre­vent­at­ive: Tracker/​satellite mon­it­or­ing deployed for some rap­tors. Data gath­er­ing to high­light presence/​absence
  • Remedi­al: NPPP devel­op­ment pro­cesses used to explore part­ner­ship atti­tudes, engage­ment and powers. Tar­geted, tan­gible inter­ven­tion at known drivers of pop­u­la­tion decline.
• Cur­rent like­li­hood: 3
• Cur­rent impact: 4
• Risk score: 12
• Trend: Stat­ic
• Com­ment: Action on wild­life crime depends on the devel­op­ment, deliv­ery and design of stra­tegic part­ner­ships. Fin­an­cial con­straints with­in the pub­lic and third sec­tors is likely to reduce the level of resource avail­able to tackle this issue. No dir­ect cor­rel­a­tion between inter­ven­tion and pop­u­la­tion increases due to com­plex­ity of factors, but tan­gible efforts demon­strate com­mit­ment to the issue.
• Planned actions:
  • Remedi­al: Development/​strengthening of stra­tegic partnerships.
• Due date: Ongo­ing
• Risk appet­ite: Open
• Tar­get like­li­hood: 3
• Tar­get impact: 2
• Tar­get risk score: 6
• Risk own­er: Andy Ford
• Date last updated: 20/01/2025

Risk A26

• Theme: All
• Risk cat­egory: Sys­tems development
• Risk descrip­tion: Sup­port­ing speed of organ­isa­tion­al change pre­vents required devel­op­ment and embed­ding of effect­ive sup­port sys­tems. The speed / scale of oper­a­tion­al demand for sup­port from cor­por­ate sys­tems is such that we are more react­ive and focused on pro­ject spe­cif­ic issues rather than pro­act­ively design­ing effect­ive, gen­er­ic sup­port sys­tems. How­ever, that ongo­ing fire-fight­ing and imme­di­ate advice pre­vents us hav­ing suf­fi­cient time to design, devel­op and imple­ment new sys­tems to bet­ter suit the new organisation.
• Mitigation/​controls in place:
  • Remedi­al: recruit­ment of addi­tion­al staff to cor­por­ate func­tion dur­ing ²²⁄₂₃ and ²³⁄₂₄.
  • Remedi­al: pro­ject man­age­ment train­ing provided
  • Remedi­al: devel­op­ment of improved systems/​ways of work­ing through bet­ter use of M365 applications
  • Remedi­al: Imple­ment new fin­ance sys­tem to sup­port wider digit­isa­tion of sys­tems and effect­ive fin­an­cial reporting.
  • Pre­vent­at­ive: design and imple­ment pro­ject ini­ti­ation con­trols sup­port­ing more man­aged timelines and fuller, earli­er con­sid­er­a­tion of pro­ject plans.
• Cur­rent like­li­hood: 3
• Cur­rent impact: 3
• Risk score: 9
• Trend: Stat­ic
• Com­ment: Ini­tial mit­ig­a­tion actions now in place and embed­ding, includ­ing pro­ject ini­ti­ation con­trols. New fin­ance sys­tem installed on sched­ule by 31/03/25; new pro­ject ini­ti­ation con­trol sys­tem imple­men­ted dur­ing 2025. Fur­ther rein­force­ment of oper­a­tion of con­trols now under­way for ²⁶⁄₂₇ oper­a­tion­al plan. Man­agers group also review­ing future stream­lin­ing approaches.
• Planned actions:
  • Remedi­al: apply resource to devel­op­ment of improved systems/​ways of work­ing includ­ing stream­lin­ing and cla­ri­fy­ing systems
  • Remedi­al: provide train­ing — pro­cure­ment and in wider assess­ment of pro­ject impacts at ini­ti­ation stage.
  • Remedi­al: ongo­ing roll-out and embed­ding of pro­ject ini­ti­ation guidance.
• Due date: 31/03/2027
• Risk appet­ite: Open
• Tar­get like­li­hood: 3
• Tar­get impact: 2
• Tar­get risk score: 6
• Risk own­er: Dav­id Cameron
• Date last updated: 11/05/2026

Risk A13/A18

• Theme: All
• Risk cat­egory: Tech­nic­al
• Risk descrip­tion: CNPA IT ser­vices are not suf­fi­ciently robust/​secure/​or well enough spe­cified to sup­port effect­ive and effi­cient ser­vice deliv­ery. Increas­ing demand for know­ledge around Microsoft 365 and cyber secur­ity is out­strip­ping the team’s knowledge/​skill-set.
  • Increas­ing ICT depend­ency for effect­ive and effi­cient oper­a­tions is not adequately backed up by ICT sys­tems support.
  • Use of AI increases risk of cyber secur­ity threats such as spear-phishing.
• Mitigation/​controls in place:
  • Pre­vent­at­ive: Daily review of Scot­tish Cyber Coordin­a­tion Centre threat sum­mar­ies, with fol­low up action taken (eg patch­ing) as appropriate.
  • Preventative/​remedi­al: Col­lab­or­a­tion with LL&TNPA provides support.
  • Pre­vent­at­ive: advis­ory intern­al audit com­mis­sioned Jan 26 to sup­port plan­ning of future sys­tems development
  • Pre­vent­at­ive: Trans­ition to Share­point com­plete; R‑drive now a read-only repos­it­ory, redu­cing risk of threats from out­side the organisation.
  • Pre­vent­at­ive: imple­ment Cyber Secur­ity Plus controls
  • Con­sid­er­a­tion giv­en to effect­ive­ness of shared ser­vices with LL&TNPA.
• Cur­rent like­li­hood: 5
• Cur­rent impact: 3
• Risk score: 15
• Trend: Escal­at­ing
• Com­ment: Move­ment into Microsoft 365 deploy­ment and cloud based sys­tems con­tin­ues to evolve and become embed­ded. Cyber Essen­tials accred­it­a­tion now in place and sys­tems oper­at­ing to those stand­ards. Devel­op­ment of the IT oper­a­tion­al risk register has iden­ti­fied poten­tial for struc­tur­al improve­ment. These con­sid­er­a­tions to be developed fur­ther: action to be taken on advis­ory audit and busi­ness con­tinu­ity plan­ning once advice is received. Cyber essen­tials accred­it­a­tion has been renewed.
• Planned actions:
  • Action to be taken on advis­ory audit and busi­ness con­tinu­ity plan­ning: report now in place which high­lights a sig­ni­fic­ant action plan to be addressed.
  • A review of IT staff role descrip­tions now com­pleted; renewed focus on IT action plans will flow from that.
  • Work on the inform­a­tion man­age­ment plan will pro­duce great­er resi­li­ence of data and access to key inform­a­tion when complete.
• Due date: Ongo­ing
• Risk appet­ite: Cau­tious
• Tar­get like­li­hood: 4
• Tar­get impact: 2
• Tar­get risk score: 8
• Risk own­er: Dav­id Cameron
• Date last updated: 11/05/2026

Risk A22

• Theme: All
• Risk cat­egory: Tech­nic­al
• Risk descrip­tion: Busi­ness Con­tinu­ity Plans (BCP) are inad­equate to deal with sig­ni­fic­ant impacts to nor­mal work­ing arrange­ments and res­ult in ser­vice failure.
• Mitigation/​controls in place:
  • Pre­vent­at­ive: Devel­op­ment of hybrid work­ing meth­ods and cloud com­put­ing approaches have improved the organisation’s resilience.
  • Remedi­al: devel­op updated busi­ness con­tinu­ity plan and embed its provisions
• Cur­rent like­li­hood: 5
• Cur­rent impact: 4
• Risk score: 20
• Trend: Stat­ic
• Com­ment: Advis­ory audit on IT pro­vi­sion now com­mis­sioned and report under con­sid­er­a­tion. Out­puts from this will plug into wider BCP which will be com­pleted by ²⁰²⁶⁄₂₇ year end.
• Planned actions:
  • Pre­vent­at­ive: pro­posed con­sultancy to devel­op new BCP
• Due date: 31/03/2027
• Risk appet­ite: Open
• Tar­get like­li­hood: 3
• Tar­get impact: 1
• Tar­get risk score: 3
• Risk own­er: Dav­id Cameron
• Date last updated: 11/05/2026

Risk A23

• Theme: All
• Risk cat­egory: Repu­ta­tion
• Risk descrip­tion: Repu­ta­tion­al dam­age may res­ult from:
  • Unreal­ist­ic expect­a­tions of what the Park Author­ity and its part­ners can achieve in the face of the sig­ni­fic­ant risks presen­ted by cli­mate change, spe­cies extinc­tion, flood man­age­ment and fire; and/​or
  • Dis­agree­ment between the Park Author­ity and stake­hold­er groups with­in the Park.
  • Dis­in­form­a­tion cir­cu­lated about the Park Authority’s actions
• Mitigation/​controls in place:
  • Pre­vent­at­ive: Exist­ing stra­tegic part­ner­ships and stake­hold­er rela­tion­ships help to cre­ate a wider under­stand­ing of the factors that are with­in, and those that are out­side the con­trol of the Park Author­ity and its partners.
  • Pre­vent­at­ive: com­mu­nic­a­tions strategy devel­op­ment and imple­ment­a­tion to ensure Park Authority’s mes­sages and inform­a­tion are widely received and under­stood by appro­pri­ate audiences
• Cur­rent like­li­hood: 3
• Cur­rent impact: 3
• Risk score: 9
• Trend: Stat­ic
• Com­ment: Scor­ing reviewed fol­low­ing over­view of NPPP deliv­ery to be sub­mit­ted to board in Septem­ber, with like­li­hood decreased from 4 to 3. Stake­hold­er rela­tion­ship data­base now designed and under devel­op­ment. Effect­ive Wild­fire Byelaw com­mu­nic­a­tions with strongly pos­it­ive reac­tions to those com­mu­nic­a­tions help­ing enhance pos­it­ive repu­ta­tion. ‑Ongo­ing assess­ment of oper­a­tion­al risk sense repu­ta­tion­al man­age­ment man­age­ment and mit­ig­a­tion in our. Over­all of risks cur­rently in a man­aged pos­i­tion. Future con­sulta­tion in next NPPP for 2027 to 2032 will open fur­ther dia­logue with all stake­hold­ers. Need to con­sider resources needed to deliv­er on wild­fire man­age­ment post Aber­nethy and the poten­tial for expect­a­tions on the Park Author­ity to fix nation­al issues.
• Planned actions:
  • Pre­vent­at­ive: Man­age­ment of expect­a­tions through:
    • Tar­geted communications
    • Fur­ther devel­op­ment of stake­hold­er relationships.
    • Development/​strengthening of stra­tegic communications.
    • Devel­op­ment of stake­hold­er rela­tion­ship database
    • Clear pos­i­tion­ing on the Park Authority’s role/​level of involve­ment in sig­ni­fic­ant issues
• Due date: Ongo­ing
• Risk appet­ite: Min­im­al
• Tar­get like­li­hood: 3
• Tar­get impact: 3
• Tar­get risk score: 9
• Risk own­er: Grant Moir
• Date last updated: 11/09/2026

Risk A27

• Theme: All
• Risk cat­egory: Stra­tegic delivery
• Risk descrip­tion: The Park Author­ity does not adequately respond or adapt to changes in fund­ing or policy envir­on­ment at Scot­tish Gov­ern­ment policy levels; from extern­al fund­ing sources; or in evol­u­tion of private fin­ance investment.
• Mitigation/​controls in place:
  • Pre­vent­at­ive: alloc­ate seni­or time to engage­ment with Scot­tish Gov­ern­ment in policy dis­cus­sion and devel­op­ment, identi­fy­ing and respond­ing to risk implications.
  • Pre­vent­at­ive: pro­act­ively identi­fy oppor­tun­it­ies for private invest­ment and struc­tures to sup­port their invest­ment to com­ple­ment and sup­port NPPP and cor­por­ate objectives.
  • Pre­vent­at­ive: pri­or­it­ise time alloc­a­tion to policy evol­u­tion, such as Pub­lic Ser­vice Reform
• Cur­rent like­li­hood: 3
• Cur­rent impact: 2
• Risk score: 6
• Trend: Decreas­ing
• Com­ment: Pos­it­ive rela­tion­ships developed at seni­or levels on engage­ment with the Park Author­ity and our fin­an­cial require­ments. Work pro­gress­ing on devel­op­ment of a private fin­ance frame­work. Need iden­ti­fied to begin plan­ning for end of C2030 fin­an­cing peri­od and replace­ment of NLHF fund­ing with­in the Park Authority’s resource mix. Seni­or staff are fully engaged at a lead­er­ship level in Pub­lic Ser­vice Reform and wider policy evolution.
• Planned actions:
  • Final­ise private fin­ance framework
  • Pub­lic Ser­vice Reform actions on place based action and staff deploy­ment flex­ib­il­ity; action on cor­por­ate ser­vices costs base.
• Due date: 31.03.26
• Risk appet­ite: Cau­tious
• Tar­get like­li­hood: 2
• Tar­get impact: 2
• Tar­get risk score: 4
• Risk own­er: Dav­id Cameron
• Date last updated: 11/05/2026

Risk A28

• Theme: All
• Risk cat­egory: Resources — staffing
• Risk descrip­tion: The Park Authority’s work­force is not adequately flex­ible to respond to chan­ging stra­tegic pri­or­it­ies or to chan­ging oper­a­tion­al scale
• Mitigation/​controls in place:
  • Pre­vent­at­ive: work­force man­age­ment strategy updated and reg­u­larly reviewed to take a 5+ year for­ward view.
  • Pre­vent­at­ive: con­tin­ued invest­ment in train­ing and devel­op­ment for staff sup­port­ing per­form­ance in cur­rent roles and succession/​development plans.
  • Pre­vent­at­ive: estab­lish an appro­pri­ate mix of per­man­ent and fixed term staff to allow for flex­ib­il­ity in future structures.
  • Remedi­al: retain scru­tiny of all vacan­cies and iden­ti­fic­a­tion of oppor­tun­it­ies to adapt vacan­cies toward future needs.
• Cur­rent like­li­hood: 3
• Cur­rent impact: 3
• Risk score: 9
• Trend: Stat­ic
• Com­ment: Work­force man­age­ment strategy reviewed by board at busi­ness ses­sion, Octo­ber 2025. This will now guide asso­ci­ated policy devel­op­ment work fol­low­ing full intern­al con­sulta­tion. Mit­ig­a­tion actions pro­gress­ing to plan. Resources Com­mit­tee review of Work­force Man­age­ment and wider Organ­isa­tion­al Devel­op­ment and People Strategy 15 May, fol­lowed by staff con­sulta­tion through remainder of May and June 2026.
• Planned actions:
  • Con­sulta­tion on work­force man­age­ment strategy.
  • Devel­op­ment of organ­isa­tion­al policies sup­port­ing deliv­ery of work­force man­age­ment objectives.
• Due date: 31.12.26
• Risk appet­ite: Open
• Tar­get like­li­hood: 3
• Tar­get impact: 3
• Tar­get risk score: 9
• Risk own­er: Dav­id Cameron
• Date last updated: 11/05/2026

Risk A29

• Theme: All
• Risk cat­egory: Sys­tems development
• Risk descrip­tion: NPPP deliv­ery respons­ib­il­it­ies are not suf­fi­ciently clear across the part­ner­ship and Park Author­ity is expec­ted to address more than it is cap­able to deliver.
• Mitigation/​controls in place:
  • Pre­vent­at­ive: rein­force spe­cif­ic part­ner deliv­ery respons­ib­il­it­ies through per­form­ance man­age­ment sys­tems and reporting.
  • Pre­vent­at­ive: rein­force NPPP deliv­ery link­ages through grant con­tract terms.
• Cur­rent like­li­hood: 3
• Cur­rent impact: 4
• Risk score: 12
• Trend: Stat­ic
• Com­ment: NPPP Per­form­ance Man­age­ment dash­board now complete.
• Planned actions:
  • Part­ner engage­ment and clar­ity of respons­ib­il­ity to be addressed as aspect of devel­op­ment of 27 – 32 NPPP.
• Due date: 31.12.26
• Risk appet­ite: Open
• Tar­get like­li­hood: 3
• Tar­get impact: 2
• Tar­get risk score: 6
• Risk own­er: Gav­in Miles
• Date last updated: 11/05/2026

Risk A30

• Theme: All
• Risk cat­egory: Tech­nic­al
• Risk descrip­tion: Evol­u­tion of the Park Authority’s range of activ­it­ies and pro­jects res­ults in uniden­ti­fied and unmit­ig­ated expos­ure to leg­al implic­a­tions and asso­ci­ated liabilities
• Mitigation/​controls in place:
  • Pre­vent­at­ive: under­take risk ana­lys­is over­view of ²⁰²⁵⁄₂₆ oper­a­tion­al plan to identi­fy any deliv­ery areas with poten­tial expos­ure; devel­op and deliv­er mit­ig­a­tion action plan
• Cur­rent like­li­hood: 2
• Cur­rent impact: 4
• Risk score: 8
• Trend: Decreas­ing
• Com­ment: Evid­ence that pro­ject ini­ti­ation pro­cesses is work­ing in draw­ing out poten­tial leg­al implic­a­tions of pro­ject plans. Con­tin­ued evid­ence of widen­ing scope of activ­ity and innov­a­tion in find­ing deliv­ery solu­tions which con­tin­ues to require atten­tion. Impact of risk assessed as down while like­li­hood increased. Intern­al review under­taken and pro­ject ini­ti­ation approach embed­ding with­in the organisation.
• Planned actions:
  • Mon­it­or effect­ive­ness of sys­tem and level of any issues arising. New actions on this risk are embed­ded with­in the actions on pro­ject ini­ti­ation and intern­al con­trol sys­tems noted against oth­er risks.
• Due date: 31.12.26
• Risk appet­ite: Open
• Tar­get like­li­hood: 3
• Tar­get impact: 1
• Tar­get risk score: 3
• Risk own­er: Dav­id Cameron
• Date last updated: 11/09/2026

Risk A31

• Theme: Place
• Risk cat­egory: Stra­tegic delivery
• Risk descrip­tion: Uncer­tain­ties on fin­ance, pro­cure­ment, con­tract­or capa­city and part­ner­ship devel­op­ment com­bine to pre­vent achieve­ment of key Cairngorms 2030 com­munity trans­port infra­struc­ture enhancements.
• Mitigation/​controls in place:
  • Pre­vent­at­ive: pres­sure on extern­al fun­ders to make decisions with­in neces­sary timetable
  • Pre­vent­at­ive: revised pro­cure­ment approach to sim­pli­fy require­ments and min­im­ise per­ceived con­tract­or risk
  • Pre­vent­at­ive: estab­lish over-arch­ing agree­ments with partners
  • Pre­vent­at­ive: engage at seni­or levels with Scot­tish Gov­ern­ment to ensure there is clar­ity in pub­lic policy with regard to work­force man­age­ment actions and staff­ing levels
• Cur­rent like­li­hood: 3
• Cur­rent impact: 4
• Risk score: 12
• Trend: Decreas­ing
• Com­ment: Pro­gress over 2025 in man­aging these extern­al risks to pro­gramme deliv­ery has been gen­er­ally suc­cess­ful with con­sequen­tial declin­ing risk pro­file. Ongo­ing con­tact with extern­al fun­ders to secure fund­ing for ²⁰²⁶⁄₂₇. Devel­op­ment of memor­andum of agree­ment with key loc­al author­ity partner.
• Planned actions:
  • Pre­vent­at­ive: Man­age­ment Team Policy Day over­view of pro­gramme status; eval­u­ation of 2029 out­comes; iden­ti­fic­a­tion of key actions and risk mitigations
• Due date: March 2026
• Risk appet­ite: Cau­tious
• Tar­get like­li­hood: 3
• Tar­get impact: 2
• Tar­get risk score: 6
• Risk own­er: Gav­in Miles
• Date last updated: 18/02/2026

Risk A32

• Theme: All
• Risk cat­egory: Resources — staffing
• Risk descrip­tion: Deliv­ery oppor­tun­it­ies and extern­al fund­ing offers are lost as a con­sequence of con­straints on staff­ing levels imposed by pub­lic policy and work­force man­age­ment con­trols under­pinned by extern­al and non-core income.
• Mitigation/​controls in place:
  • Pre­vent­at­ive: ensure intern­al work­force man­age­ment policy and man­age­ment pro­ced­ure oper­ates appro­pri­ately with­in the agreed nation­al policy position
  • Pre­vent­at­ive: seek to move to a more dynam­ic and flex­ible staff­ing pos­i­tion allow­ing deploy­ment of staff resource toward emer­ging priorities
• Cur­rent like­li­hood: 4
• Cur­rent impact: 3
• Risk score: 12
• Trend: Decreas­ing
• Com­ment: Staff­ing levels man­aged against com­mit­ted full time equi­val­ent fig­ure provided to Scot­tish Gov­ern­ment in 2025 return. Multi-year work­force man­age­ment and fin­an­cial fore­casts estab­lished to guide actions.
• Planned actions:
  • Mon­it­or­ing of quarterly employ­ment stat­ist­ics against tar­get figure.
• Due date: Ongo­ing
• Risk appet­ite: Cau­tious
• Tar­get like­li­hood: 2
• Tar­get impact: 2
• Tar­get risk score: 4
• Risk own­er: Dav­id Cameron
• Date last updated: 11/05/2026

Risk A3

• Theme: All
• Risk cat­egory: Resources — staffing
• Risk descrip­tion: There are per­ceived gaps in our skill set with respect to: pro­cure­ment pro­cesses, recruit­ment of tech­nic­al staff, abil­ity to under­take neces­sary due dili­gence on out­put from con­sult­ants and contractors.
  • Risks that pro­cure­ment and wider skill set capa­cit­ies are insuf­fi­cient to meet the evolving needs of the organisation.
  • Lack of expert­ise and exper­i­ence in man­aging con­struc­tion pro­jects may com­prom­ise the effect­ive­ness and effi­ciency of planned delivery.
  • Fin­an­cial risks asso­ci­ated with the let­ting of con­tracts where part­ner­ship fund­ing is likely to be depend­ent on the achieve­ment of sat­is­fact­ory standards.
• Mitigation/​controls in place:
  • Pre­vent­at­ive: Recruit­ment of Pro­cure­ment Officer
  • Pre­vent­at­ive: Sup­port secured from Scot­land Excel (and from Cent­ral Gov­ern­ment Pro­cure­ment Shared Ser­vices (CGPSS) if required).
  • Pre­vent­at­ive: Con­sider deliv­ery through part­ners with con­struc­tion pro­ject deliv­ery exper­i­ence where appro­pri­ate to deliv­ery objectives.
  • Remedi­al: use of leg­al sup­port or oth­er out­sourced sup­port where required
• Cur­rent like­li­hood: 4
• Cur­rent impact: 2
• Risk score: 8
• Trend: Man­aged
• Com­ment: This risk now appears under effect­ive man­age­ment. As a rel­at­ively small organ­isa­tion, staff turnover will have sig­ni­fic­ant impacts on pos­i­tion. Recruit­ment to new Pro­cure­ment Officer post achieved. Pro­gramme of improve­ment in pro­cure­ment pro­cesses, pro­ced­ures and con­trols well under­way, includ­ing estab­lish­ment of new Pro­cure­ment Strategy. Con­struc­tion pro­jects of the size anti­cip­ated with­in the C2030 pro­gramme are new to the organ­isa­tion. We need to improve our know­ledge of Con­struc­tion Design Man­age­ment Reg­u­la­tions (CDM) and con­tracts (NEC4). We lack exper­i­ence in pro­du­cing briefs and review­ing tenders of this size and type. Improve­ments in our skill set will also bene­fit: peat­land res­tor­a­tion, river res­tor­a­tion, con­struc­tion of paths, act­ive travel projects.
• Planned actions:
  • Pre­vent­at­ive: explore back up arrange­ments — shared ser­vices and com­mer­cial back up includ­ing increas­ing scale of our oper­a­tions if sup­por­ted by shared ser­vice income from third parties
  • Pre­vent­at­ive: Staff reten­tion approaches and link to organ­isa­tion­al development.
  • Remedi­al: Con­tin­ued focus on train­ing and devel­op­ment of staff
• Due date: 31/03/2026
• Risk appet­ite: Cau­tious
• Tar­get like­li­hood: 4
• Tar­get impact: 2
• Tar­get risk score: 8
• Risk own­er: Dav­id Cameron
• Date last updated: 11/05/2026

Risk A4

• Theme: All
• Risk cat­egory: Resources — staffing
• Risk descrip­tion: Increas­ingly com­pet­it­ive and restric­ted recruit­ment cli­mate pre­vents staff with the required exper­i­ence and skill sets being secured. Plan­ning and oth­er spe­cial­ist staff (IT, pro­cure­ment, fin­ance) require­ments impacted by nation­al labour/​skills short­ages and/​or salary struc­tures not suf­fi­ciently com­pet­it­ive to attract or retain key staff.
• Mitigation/​controls in place:
  • Pre­vent­at­ive: focus on train­ing and devel­op­ment and intern­al suc­ces­sion plan­ning, in turn bring­ing recruit­ment into less experienced/​less highly skilled mar­kets and devel­op­ing pipeline of qual­i­fied staff
  • Pre­vent­at­ive: con­sid­er­a­tion giv­en to job design, cre­at­ing roles with more seni­or­ity (high­er grades), and flex­ib­il­ity of offer regard­ing part-time/­job share.
• Cur­rent like­li­hood: 3
• Cur­rent impact: 2
• Risk score: 6
• Trend: Man­aged
• Com­ment: Evid­ence of redu­cing num­ber of applic­ants and can­did­ate lists for vacan­cies ongo­ing, while trend in unsuc­cess­ful recruit­ment exer­cises has been acted on with no recent unsuc­cess­ful recruit­ment. Suc­cess­ful recent recruit­ment in dif­fi­cult sec­tors includ­ing pro­cure­ment and plan­ning. Salary struc­tures reviewed with three year pay pos­i­tion now agreed.
• Planned actions:
  • Remedi­al: con­tin­gency plan­ning for example around out-sourcing of aspects of deliv­ery eg estab­lish call-off frame­work for con­sult plan­ning services.
• Due date: 31/03/2025
• Risk appet­ite: Open
• Tar­get like­li­hood: 3
• Tar­get impact: 2
• Tar­get risk score: 6
• Risk own­er: Dav­id Cameron
• Date last updated: 12/05/2025

Risk A5

• Theme: All
• Risk cat­egory: Resources — staffing
• Risk descrip­tion: Scot­tish Gov­ern­ment Main Group award ²⁰²³⁄₂₅ cre­ates sig­ni­fic­ant fin­an­cial pres­sure on the Park Authority’s resource budget for ²⁰²⁴⁄₂₅, with the poten­tial to affect pos­it­ive rela­tion­ships with the Uni­on, staff mor­ale and motiv­a­tion, recruit­ment and retention.
• Mitigation/​controls in place:
  • Pre­vent­at­ive: devel­op­ment of pay mod­els to identi­fy the poten­tial cost to the Park Author­ity of fol­low­ing the Main Group pos­i­tion & con­sider the impact of poten­tial pay strategies on the devel­op­ing budget pos­i­tion for ²⁰²⁴⁄₂₅;
  • Pre­vent­at­ive: con­sider pay award dates and staged awards as tools to meet expect­a­tions while main­tain­ing affordability
  • Pre­vent­at­ive: Staff and fin­an­cial resources con­sidered dur­ing budget devel­op­ment pro­cess for ²⁴⁄₂₅.
• Cur­rent like­li­hood: 3
• Cur­rent impact: 3
• Risk score: 9
• Trend: Man­aged
• Com­ment: Pay mod­els developed are being accom­mod­ated with­in the budget based on indic­at­ive Grant-in-Aid fund­ing for ²⁰²⁴⁄₂₅.
• Planned actions: N/A
• Due date: Open
• Risk appet­ite: Open
• Tar­get like­li­hood: 3
• Tar­get impact: 3
• Tar­get risk score: 9
• Risk own­er: Dav­id Cameron
• Date last updated: 20/01/2025

Risk A9.3

• Theme: All
• Risk cat­egory: Resources — staffing
• Risk descrip­tion: Our Cor­por­ate and Oper­a­tion­al Plan­ning sys­tems do not adapt to deliv­ery of major fun­ded pro­grammes along­side deliv­er­ing ​‘core’ nation­al park object­ives. This leads to work­force stretch between 3^rd party fund­ing deliv­ery and ​‘core’ cor­por­ate plan activ­it­ies with increased risks of stress and reduced morale.
• Mitigation/​controls in place:
  • Pre­vent­at­ive: Stra­tegic and oper­a­tion­al plans developed with extern­ally fun­ded pro­ject deliv­ery as intrins­ic ele­ments of plans to ensure deliv­ery capa­city is con­sidered fully.
  • Pre­vent­at­ive: Import­ance of staff man­age­ment and task pri­or­it­isa­tion rein­forced through lead­er­ship meetings.
  • Pre­vent­at­ive: Focus on few­er, lar­ger impact pro­jects (C2030).
  • Remedi­al: Per­form­ance Devel­op­ment Con­ver­sa­tions (PDCs) being deployed reg­u­larly with all staff to check on staff work­loads, with 2 way flows of com­mu­nic­a­tions enabled through that pro­cess on staff work­load and capacity.
  • Pre­vent­at­ive: Staff and fin­an­cial resources for C2030 con­sidered along­side oper­a­tion­al plan activ­ity as part of budget devel­op­ment pro­cess for ²⁴⁄₂₅.
• Cur­rent like­li­hood: 3
• Cur­rent impact: 3
• Risk score: 9
• Trend: Man­aged
• Com­ment: Addi­tion­al recruit­ment has alle­vi­ated key staff pres­sure points. Fixed term staff con­tracts reviewed through­out the year. Staff sur­vey res­ults (23÷24) pos­it­ive. Impact score of 3 reflects the risks inher­ent in the likely intens­ity of work dur­ing ini­tial stages of C2030. Like­li­hood of risk there­fore held stat­ic. Impact of meas­ures and risk pro­file will con­tin­ue to be closely mon­itored through staff man­age­ment processes.
• Planned actions: N/A
• Due date: Open
• Risk appet­ite: Open
• Tar­get like­li­hood: 3
• Tar­get impact: 3
• Tar­get risk score: 9
• Risk own­er: Dav­id Cameron
• Date last updated: 20/01/2025

Risk A12

• Theme: All
• Risk cat­egory: Resources — staffing
• Risk descrip­tion: Scot­tish Gov­ern­ment pay remit for ²⁴⁄₂₅ is lower than desired pay award. Pay expect­a­tions of staff may not be met, lead­ing to issues with pay align­ment with oth­er NDPBs and con­sequent effect on staff mor­ale and motivation
• Mitigation/​controls in place:
  • Pre­vent­at­ive: Devel­op­ment and sub­mis­sion of busi­ness case for pay align­ment in keep­ing with SG nation­al two-year sec­tor­al pay award.
• Cur­rent like­li­hood: 2
• Cur­rent impact: 2
• Risk score: 4
• Trend: Man­aged
• Com­ment: SG remu­ner­a­tion Group turned down ini­tial busi­ness case. Amended busi­ness case sub­mit­ted and approv­al received end Aug 24. Staff con­sulta­tion under­way to end Oct. Sea­son­al staff pos­i­tion resolved sat­is­fact­or­ily. Awards for com­ing three years agreed.
• Planned actions: N/A
• Due date: 31/12/2024
• Risk appet­ite: Open
• Tar­get like­li­hood: 2
• Tar­get impact: 1
• Tar­get risk score: 2
• Risk own­er: Dav­id Cameron
• Date last updated: 20/01/2025