AV AZETS

Cairngorms Nation­al Park Authority

Intern­al Audit Report

Man­age­ment Action Fol­low-up – ²⁰²⁰⁄₂₁

March 2021

---

Intro­duc­tion and background

Intro­duc­tion

As part of the intern­al audit pro­gramme we have under­taken a fol­low up review to provide the Audit & Risk Com­mit­tee with assur­ance that man­age­ment actions agreed in pre­vi­ous intern­al audit reports have been imple­men­ted appro­pri­ately. This report sum­mar­ises the pro­gress made by man­age­ment in imple­ment­ing agreed man­age­ment actions.

Scope

We have reviewed all open man­age­ment actions and liaised with Cairngorms Nation­al Park Author­ity staff to obtain an update on their imple­ment­a­tion pro­gress. For recom­mend­a­tions graded pri­or­ity 3 or above, we request evid­ence to val­id­ate com­ple­tion of any actions marked for clos­ure by management.

For all actions raised by the pri­or Intern­al Aud­it­or (BDO) we have aligned their risk assess­ments to the Azets risk grad­ing struc­ture (per Appendix 3).

Action for Audit & Risk Committee

The Com­mit­tee is asked to note the pro­gress made by man­age­ment in imple­ment­ing agreed man­age­ment actions. The Com­mit­tee is also asked to con­sider and approve those actions for which revised times­cales have been provided by man­age­ment (these are detailed at Appendix 2).

---

Sum­mary of progress

The table below shows the move­ment in the audit actions in the peri­od from March 2020 to Feb­ru­ary 2021:

Num­ber of Actions
Open actions brought forward	54
Actions added to tracker	9
Total actions to follow-up	63
Actions closed	17
Open actions car­ried forward	46

Status of Actions as at Feb­ru­ary 2021

[Dia­gram show­ing the status of actions]

We have con­firmed that 10 (16%) actions were com­pleted in the peri­od to Feb­ru­ary 2021. 18 actions (29%) have been assessed as par­tially com­plete, 15 (23%) marked as incom­plete, 7 (11%) marked as no longer applic­able and 13 actions (21%) were not yet due at the time of our val­id­a­tion work.

We under­stand that pro­gress in imple­ment­ing a num­ber of ​“par­tially com­plete” actions has been delayed by the impact of COV­ID-19. We have con­firmed with man­age­ment that work is now ongo­ing to pro­gress these actions although revised due dates have not been provided in all cases. Fur­ther detail on all actions that have passed their ori­gin­al due dates for com­ple­tion is included at Appendix 2.

Par­tic­u­lar atten­tion should be paid to those actions that have passed their ori­gin­al due date for com­ple­tion over the next quarter, par­tic­u­larly the aged items.

A sum­mary of the status of actions by report is shown at Appendix 1.

---

Status by Grading

[Dia­gram show­ing status by grading]

Appendix 2 sets out the cur­rent status of actions classed as ​“par­tially com­plete” and ​“incom­plete” based on updates provided by management.

Open Intern­al audit actions

The total num­ber of out­stand­ing actions is 46, 33 of which have passed their ori­gin­al com­ple­tion date.

All 33 actions have been assessed as a grade 1 or 2 (lim­ited or mod­er­ate risk expos­ure). As a res­ult, man­age­ment should take a view on wheth­er the organ­isa­tion has the appro­pri­ate resource in place to move these actions for­ward, or are will­ing to accept the risk in place, in par­tic­u­lar for those assessed as grade 1.

---

Appendix 1: Action status by report

Report title	Com­plete	Par­tially com­plete	Incom­plete	Not Yet Due	No Longer Applic­able	Total
Risk Man­age­ment	1	1	-	-	1	2
Fin­an­cial Processes	-	-	-	1	1	2
Grant Fund­ing & Management	-	-	2	-	-	2
Tomin­toul & Glen­liv­et Part­ner­ship Management	1	-	-	1	-	2
IT Gen­er­al Controls	1	1	-	1	-	3
2016⁄17 sub-total	3	3	1	1	3	10
Pro­ject Management	-	1	-	1	-	2
Com­mu­nic­a­tions & Social Media Strategy	-	1	-	-	1	2
2017⁄18 sub-total	1	2	1	-	1	3
Part­ner­ship Management	-	2	-	-	-	2
Resource Plan­ning	-	1	-	1	-	2
Busi­ness Con­tinu­ity Planning	4	2	-	-	1	7
2018⁄19 sub-total	4	4	1	-	2	11
Payroll Admin­is­tra­tion	2	3	1	-	-	6
Risk Man­age­ment	1	2	4	1	-	7
Expense Claims Process	1	1	1	-	1	4
Staff Object­ive Set­ting & Appraisal	1	1	1	-	1	4
FOISA and EIR Requests	-	2	1	2	-	5
Pro­ject Finance	2	2	1	-	-	5
2019⁄20 sub-total	6	10	10	3	1	30
COV­ID Recovery	-	-	-	3	-	3
Cor­por­ate Governance	-	-	-	6	-	6
2020⁄21 sub-total	-	-	-	6	-	9
Grand totals	10	18	15	13	7	63

---

Appendix 2: Sum­mary of out­stand­ing actions past their cur­rent due date

Report / Action	Recom­mend­a­tion	Action Own­er	Grade	Ori­gin­al times­cale	Revised times­cale	Update 2020⁄21 Fol­low Up	Status
2016⁄17 Risk Management	We recom­mend that, on devel­op­ment of a risk man­age­ment policy, staff with risk man­age­ment respons­ib­il­it­ies are required to sign a check­list to con­firm wheth­er they are aware of the organisation’s risk man­age­ment approach or require fur­ther train­ing in this area.	Gov­ernance and Inform­a­tion Officer	Medi­um (Grade 2)	31-Mar-17	Aug-21	From 2021⁄22 we will intro­duce a sched­ule of key areas of oper­a­tions, includ­ing pro­ject man­age­ment and risk man­age­ment, which all man­agers are expec­ted to go through annu­ally with their dir­ect reports as a prompt to wheth­er any train­ing require­ments have aris­en in these areas. This is designed and will be launched shortly.	Par­tially Complete
2016⁄17 Grant Fund­ing & Management	We recom­mend that the Grant Toolkit is com­pleted, encom­passing all pro­cesses in place for the award­ing, record­ing, and mon­it­or­ing of grant fund­ing. The toolkit should also clearly define the fol­low­ing: — Actions to be taken when grant con­di­tions are not being met or terms and con­di­tions are breached; — The pro­cess for con­sid­er­a­tion of the risk and value of grant fund­ing applic­a­tions to determ­ine the pro­por­tion of resource required to eval­u­ate these; and — Review and scru­tiny arrange­ments for pro­gress reports provided by grantees.	Dir­ect­or of Cor­por­ate Services	Medi­um (Grade 2)	30-Sep-17	Sep-21	This work remains out­stand­ing. Inten­ded focus on this in 20⁄21 was over­taken by COV­ID responses and oth­er asso­ci­ated high pri­or­ity activity	Incom­plete
2016⁄17 Grant Fund­ing & Management	We recom­mend that man­age­ment devel­ops and main­tains a grant register which records all grant fund­ing provided. The per­form­ance require­ments detailed with­in each grant award terms and con­di­tions should be recor­ded and mon­itored with­in the track­er. The register should be reviewed on a reg­u­lar basis to ensure funds are used effect­ively and agreed object­ives are achieved.	Fin­ance Manager	Low (Grade 1)	30-Nov-17	Jun-21	We will seek to ini­ti­ate a grant register for com­mence­ment from 2021⁄22 fin­an­cial year.	Incom­plete
2016⁄17 Tomin­toul & Glen­liv­et Part­ner­ship Management	We recom­mend that changes in spend pro­file exceed­ing an agreed threshold are repor­ted to the TGLP Board on a monthly basis.	CNPA Fin­ance Manager	Low (Grade 1)	30-Sep-17		Reports are now pro­duced for the Pro­ject man­ager and the board on pro­jec­ted out­turn (T&G 1 report) and move­ments since the last report (T&G 2) The pro­ject is now wind­ing down and will be largely com­plete by 31 03 21 oth­er than delayed tree plant­ing. Since Jan 2021 a cash flow pro­jec­tion is also included.	Par­tially Complete
2016⁄17 IT Gen­er­al Controls	We recom­mend that, as per the require­ments of the Secur­ity Policy, there is reg­u­lar full restore test­ing of backups i.e. the full recov­ery of sys­tems on a bare-met­al serv­er using backup media. We also recom­mend that a form­al backup plan/​policy is developed to ensure a con­sist­ent approach is taken to man­aging backups includ­ing imple­ment­a­tion, mon­it­or­ing over their success/​failure, rerun­ning failed backups and reg­u­lar testing.	Gov­ernance and Cor­por­ate Per­form­ance Man­ager with IT Manager	Medi­um (Grade 2)	31-Jan-18	Jun-21	We do indi­vidu­al restores peri­od­ic­ally but do not have the resource to com­plete sys­tem back up.	Par­tially Complete
2016⁄17 IT Gen­er­al Controls	We recom­mend that all net­work devices are con­figured with ref­er­ence to recog­nised secur­ity baselines to ensure that all act­ive net­work com­pon­ents have met a min­im­um-secur­ity standard.	IT Man­ager	Low (Grade1)	31-Mar-18	Dec-21	As hard­ware is being replaced, we will look into baselin­ing equip­ment where pos­sible and tak­ing into con­sid­er­a­tion avail­able resource constraints.	Incom­plete
2017⁄18 Pro­ject Management	We recom­mend that roles and respons­ib­il­it­ies are fully doc­u­mented for all key people and groups with respons­ib­il­it­ies for each project.	Dir­ect­or of Cor­por­ate Services	Low (Grade1)	31-Jul-18	Sep-21	Work pres­sures in 2020⁄21 have not allowed the issues around role defin­i­tion in pro­ject ini­ti­ation doc­u­ments to be taken fur­ther forward.	Incom­plete
2017⁄18 Com­mu­nic­a­tions & Social Media Strategy	We recom­mend that feed­back on the effect­ive­ness of key digit­al com­mu­nic­a­tions is sought and respon­ded to from stake­hold­ers. We recom­mend that the Com­mu­nic­a­tions and Engage­ment team con­siders con­duct­ing a stake­hold­er sur­vey cam­paign to gain feed­back on the digit­al plat­forms and accounts which are cur­rently in use by CNPA. We also recom­mend that man­age­ment con­sider con­duct­ing this pro­cess pri­or to the com­ple­tion of the com­mu­nic­a­tions and social media strategy.	Sian Jam­ieson	Low (Grade 1)	30-Apr-18	Dec-21	The sur­vey was con­duc­ted and an ini­tial col­la­tion of the data was con­duc­ted by Mail Chimp, the sur­vey soft­ware, which gen­er­ated an intern­al report for the Digit­al Cam­paigns Officer – how­ever due to the COV­ID Pan­dem­ic the ana­lys­is was put on hold in March 2020 and due to the ongo­ing cir­cum­stances pri­or­it­ies have focused on deliv­er­ing essen­tial CNPA com­mu­nic­a­tions. How­ever, reg­u­lar ana­lys­is of social media and digit­al data is con­duc­ted and there is a high level of con­fid­ence in the deliv­ery of effect­ive con­tent and there­fore an effect­ive com­mu­nic­a­tions strategy being imple­men­ted by the CNPA. Evid­ence of Ana­lys­is: 2020 Digit­al Pan­dem­ic Communications	Par­tially Complete
2018⁄19 Part­ner­ship Management	We recom­mend that the Author­ity issue a ques­tion­naire or feed­back request on an annu­al basis to all key part­ners to seek feed­back and thoughts on how the part­ner­ship, com­mu­nic­a­tion meth­ods and ways of work­ing could be fur­ther improved. We fur­ther recom­mend that feed­back provided is col­lated and actions recorded.	Chief Exec­ut­ive with Head of Plan­ning and Rur­al Development	Low (Grade 1)	30-Jun-19	Mar-21	While a sig­ni­fic­ant amount of part­ner­ship work has taken place over 2020, includ­ing vis­it­or man­age­ment responses to relax­a­tion of COV­ID restric­tions in the sum­mer of 2020 and the devel­op­ment of the Her­it­age Hori­zons bid, we have not had the oppor­tun­ity to form­ally review the effect­ive­ness of our stake­hold­er engage­ment pro­cesses. The appoint­ment of a new Head of Com­mu­nic­a­tions gives the oppor­tun­ity to pro­gress this work over 2021⁄22 with a fresh perspective.	Par­tially Complete
2018⁄19 Part­ner­ship Management	We under­stand that there are already plans to improve the engage­ment pro­cess fur­ther by imple­ment­ing a Cus­tom­er Rela­tion­ship Man­age­ment Sys­tem (CRM). We recom­mend that the Author­ity con­tin­ues with plans for imple­ment­ing a CRM.	Dir­ect­or of Cor­por­ate Services	Low (Grade 1)	30-Jun-19	Mar-22	The full imple­ment­a­tion of the CRM remains on hold pending the relax­a­tion of the COV­ID Busi­ness Con­tinu­ity Plan and abil­ity for staff laptops and desktops to be upgraded with rel­ev­ant software.	Par­tially Complete
2018⁄19 Resource Planning	We recom­mend that a form­al frame­work is put in place for identi­fy­ing crit­ic­al roles and devel­op­ing suc­ces­sion plans for crit­ic­al roles identified.	Dir­ect­or of Cor­por­ate Ser­vices and Head of Organ­isa­tion­al Development	Low (Grade 1)	30-May-19	Sep-21	This remains a key focus for us in 2020⁄21. With the man­age­ment and staff restruc­ture in con­sulta­tion since Octo­ber / Novem­ber 2020, it makes sense to wait for the com­ple­tion of the new struc­ture and to imple­ment this suc­ces­sion plan­ning work on the basis of the new structure	Incom­plete
2018⁄19 Busi­ness Con­tinu­ity Planning	We recom­mend that the Author­ity imple­ments busi­ness con­tinu­ity train­ing for all staff. Reg­u­lar refresh­er train­ing should be provided going for­ward, and the Author­ity should ensure it records all train­ing for each staff mem­ber and obtains suf­fi­cient evid­ence of attendance/​completion.	Dir­ect­or of Cor­por­ate Ser­vices to coordin­ate team	Medi­um (Grade 2)	Nov-19	Mar-22	Future train­ing require­ments will be incor­por­ated into future work on the revised BCP.	Par­tially Complete
2018⁄19 Busi­ness Con­tinu­ity Planning	We recom­mend that CNPA devel­ops a test­ing plan/​schedule for BCP which should be reviewed reg­u­larly to ensure a stra­tegic approach to test­ing is developed and imple­men­ted. This plan should ensure that vary­ing cat­egor­ies of events are sched­uled to be tested on a reg­u­lar basis based upon like­li­hood and over­all risk. A form­al test­ing sched­ule should also be developed for the DRP. We note that the BCP states that test­ing of the BCP and DRP should be annu­al, with con­sid­er­a­tion giv­en to a daily ​‘tab­letop’ exer­cise. How­ever, from dis­cus­sions with man­age­ment, it is under­stood that this is not achiev­able due to the size of the organ­isa­tion. There­fore, Man­age­ment should decide on the most suit­able fre­quency of test­ing, and this should be detailed with­in the BCP. In addi­tion, we recom­mend that the out­comes, les­sons learned and required actions are form­ally doc­u­mented, and there­after reflec­ted with­in the plan for each test.	Dir­ect­or of Cor­por­ate Ser­vices to coordin­ate team	Medi­um (Grade 2)	By end Novem­ber 2019 for incor­por­a­tion of test­ing schedule	Mar-22	The cur­rent COVID19 BCP response has giv­en a ​“full imple­ment­a­tion” BCP test. This recom­mend­a­tion is there­fore some­where between super­seded and imple­men­ted. Future test­ing arrange­ments will be taken up as part of the revised BCP and in line with any of the 2020⁄21 intern­al audit findings.	Par­tially Complete
2019⁄20 Payroll Administration	We recom­mend that in addi­tion to the payroll report and BACS reports run each month, CNPA pro­duce a post pay­ment report which should be reviewed and signed by the Dir­ect­or of Cor­por­ate Services.	Dir­ect­or of Cor­por­ate Services/​Payroll & Fin­ance Officer	Low (Grade 1)	Nov-19	Sep-21	Con­trol sys­tems were designed and put in place to imple­ment this recom­mend­a­tion. How­ever, remote work­ing over 20⁄21, with con­sid­er­a­tion of data secur­ity and lim­it­ing volumes of sens­it­ive inform­a­tion sent by email, have pre­ven­ted full imple­ment­a­tion to date.	Par­tially Complete
2019⁄20 Payroll Administration	We recom­mend that CNPA con­duct a reg­u­lar peer review of the desk instruc­tions to ensure that they remain accur­ate and up to date. Evid­ence of the review should be seen on the instruc­tions with ver­sion con­trol and the date reviewed noted.	Dir­ect­or of Cor­por­ate Ser­vices or Head of Organ­isa­tion­al Development	Low (Grade 1)	Apr-20	Dec-21	This has not been pro­gressed as a con­sequence of COV­ID BCP implementation	Incom­plete
2019⁄20 Payroll Administration	We recom­mend that all staff with access to payroll inform­a­tion are required to sign a con­fid­en­ti­al­ity agreement.	Dir­ect­or of Cor­por­ate Ser­vices & Head of Organ­isa­tion­al Development	Low (Grade 1)	Mar-20	Jun-21	Con­sulta­tions on this are com­plete regard­ing con­trac­tu­al changes required. The imple­ment­a­tion of the agree­ments has yet to be completed.	Par­tially Complete
2019⁄20 Payroll Administration	It is our recom­mend­a­tion that the Author­ity invest­ig­ate the poten­tial for mak­ing use of auto­mat­ic excep­tion report­ing. This may be with­in the cap­ab­il­it­ies of the cur­rent payroll sys­tem; a report would be gen­er­ated of all the dif­fer­ences from the pre­vi­ous months payroll which could be reviewed and authorised.	Dir­ect­or of Cor­por­ate Ser­vices and Head of Organ­isa­tion­al Development	Low (Grade 1)	Mar-20	Sep-21	Con­trol sys­tems were designed and put in place to imple­ment this recom­mend­a­tion. How­ever, remote work­ing over 20⁄21, with con­sid­er­a­tion of data secur­ity and lim­it­ing volumes of sens­it­ive inform­a­tion sent by email, have pre­ven­ted full imple­ment­a­tion to date.	Par­tially Complete
2019⁄20 Risk Management	We recom­mend that a risk man­age­ment pro­ced­ure is developed or that the risk man­age­ment strategy is updated to include the fol­low­ing best prac­tice areas: Risk man­age­ment pro­cess, includ­ing iden­ti­fic­a­tion, assess­ment, ana­lys­is, response, mit­ig­a­tion, and escal­a­tion. Risk register format. Risk prompts and tools. Risk impact and like­li­hood descriptions.	Dir­ect­or of Cor­por­ate Services	Low (Grade 1)	31-May-20	Mar-21	No pro­gress on this low-level recom­mend­a­tion dur­ing BCP response period.	Incom­plete
2019⁄20 Risk Management	We recom­mend that on a peri­od­ic basis, for example every two years to align with the start and mid-point of the Cor­por­ate Plan cycle, for man­age­ment to carry out a full-scale risk iden­ti­fic­a­tion pro­cess for the risk register.	Dir­ect­or of Cor­por­ate Services	Low (Grade 1)	31-May-20	Mar-24	No pro­gress on this low-level recom­mend­a­tion dur­ing BCP response period	Incom­plete
2019⁄20 Expense Claims Process	We recom­mend that the Travel & Sub­sist­ence Policy is fur­ther developed to include the ele­ments noted with­in our finding.	Dir­ect­or of Cor­por­ate Services	Medi­um (Grade 2)	Jan-20	Sep-21	Approved through Staff­ing and Recruit­ment Com­mit­tee and Staff Con­sultat­ive For­um. Not yet imple­men­ted as a con­sequence of home­work­ing / travel restrictions	Par­tially Complete
2019⁄20 Expense Claims Process	To address the issues noted and to gain assur­ance on the con­sist­ent applic­a­tion of the policy, we recom­mend that CNPA reviews and revises the policy to more clearly define the approv­al pro­ced­ures that are required pri­or to incur­ring costs and the evid­ence of author­isa­tion required for seek­ing re-imbursement.	Dir­ect­or of Cor­por­ate Services	Medi­um (Grade 2)	Jan-20	Sep-21	Policy has been revised and reviewed by both Staff­ing and Recruit­ment Com­mit­tee and Staff Con­sultat­ive For­um. Imple­ment­a­tion of revised policy due from 1 April 2020.	Par­tially Complete
2019⁄20 Expense Claims Process	We recom­mend that that the Fin­ance team’s review of expense claims and cred­it card doc­u­ment­a­tion is enhanced and evid­enced, for example, via sig­na­ture. This will sup­port a two-step approv­al pro­cess, which is good practice.	Fin­ance Manager	Low (Grade 1)	Apr-20	Sep-21	No action pending exit from BCP status.	Incom­plete
2019⁄20 Expense Claims Process	We recom­mend that CNPA signs up to the Scot­tish Gov­ern­ment Nation­al Travel Frame­work. This will ensure that Clyde Travel Man­age­ment can be used by CNPA, through a pro­cured meth­od as required by the Pro­cure­ment Policy. CNPA should ensure going for­ward that it pro­cures travel pro­viders in line with the Pro­cure­ment Policy, where estim­ated expendit­ure meets the rel­ev­ant thresholds.	Fin­ance Manager	Low (Grade 1)	Jun-20	Mar-22	Low level recom­mend­a­tion with very low value con­sequences. Not a pri­or­ity giv­en vari­ous oth­er pressures.	Incom­plete
2019⁄20 Expense Claims Process	We recom­mend that CNPA assesses the costs vs bene­fits of intro­du­cing an elec­tron­ic expense sys­tem, which will allow for expense claims to be effect­ively pro­cessed. An expense sys­tem should allow for the full pro­cess to be handled elec­tron­ic­ally, from cre­at­ing claims and attach­ing sup­port­ing doc­u­ment­a­tion (photos/​scans/​electronic ver­sions) to the approv­al and pay­ment of claims. Approvals can also be provided remotely, which would reduce delays in obtain­ing approv­al on hard copy claim forms. CNPA should con­sider pur­chas­ing a sys­tem which has user-friendly report­ing and auto­mated alerts, for example, when an expense claim has been sub­mit­ted for review, or for when sup­port­ing evid­ence has not been attached. The elec­tron­ic sys­tem could also auto­mat­ic­ally cal­cu­late miles included in a busi­ness jour­ney, which would there­fore reduce the risk of busi­ness mileage being inflated.	Fin­ance Manager	Low (Grade 1)	April-20	Mar-23	No action pending exit from BCP status	Incom­plete
2019⁄20 Expense Claims Process	We recom­mend that CNPA ensures a travel & subsistence/​expenses Policy is developed which form­ally applies to Board mem­bers. As the cur­rent Travel & Sub­sist­ence Policy applies to Board mem­bers in prac­tice, man­age­ment may con­sider amend­ing the cur­rent Policy to ensure the applic­a­tion to Board mem­bers is form­ally doc­u­mented. Author­ity to approve Board mem­ber expenses should also be clearly documented.	Dir­ect­or of Cor­por­ate Services	Low (Grade1)	Jan-20	Sep-21	No action pending exit from BCP status	Incom­plete
2019⁄20 Staff Object­ive Set­ting & Appraisal	We recom­mend that line man­agers are reminded of the import­ance of prop­erly record­ing their review and approv­al of job plans. Ran­dom spot checks should be car­ried out by HR to check that job plans are in place and have been appro­pri­ately reviewed and signed off by man­age­ment, includ­ing the date of sign off.	Kate Christie	Low (Grade 1)	Imme­di­ate and on-going	Dec-21	Giv­en the impact of lock­down on staff, par­tic­u­larly those with caring respons­ib­il­it­ies and inef­fi­cient WIFI, staff and man­agers have been advised to revis­it job plans to ensure they cov­er only work that can real­ist­ic­ally be achieved. So, job plans have been revis­ited at least at 6‑month inter­vals, but HR have not had capa­city dur­ing the last 10 months to carry out at these spot checks.	Par­tially Complete
2019⁄20 Staff Object­ive Set­ting & Appraisal	It is our recom­mend­a­tion that the Seni­or Man­age­ment Team out­line what their expect­a­tions are in respect of the out­comes of the per­form­ance man­age­ment pro­cess and pro­duce an annu­al report on the out­comes of the object­ive set­ting and apprais­al pro­cess for present­a­tion to the Recruit­ment Com­mit­tee. This report should cov­er the degree of com­pli­ance with the pro­cess and details of any con­cerns iden­ti­fied in order to assess the ongo­ing effect­ive­ness of the per­form­ance man­age­ment process.	Kate Christie	Low (Grade 1)	Decem­ber will be the report schedule	Mar-21	Coved and lock­down has res­ul­ted in job plans and tar­gets to be amended to accur­ately reflect the jobs that are achiev­able giv­en addi­tion­al pres­sures on staff. We have not yet had the oppor­tun­ity to mon­it­or the effect­ive­ness of the revised per­form­ance man­age­ment pro­cess giv­en that it was only in a place for less than a year before Cov­id and lockdown.	Incom­plete
2019⁄20 FOISA and EIR Requests	CNPA should con­sider the use of flow charts to out­line its pro­cesses and require­ments and com­mu­nic­at­ing these to ensure con­sist­ent applic­a­tion of the pro­cesses. We recom­mend refresh­er GDPR train­ing to under­stand the nuances between GDPR and FOI	Vicky Walk­er	Medi­um (Grade 2)	July-20	Dec-21	This has been delayed due to Cov­id and will be picked up as part of the recom­mend­a­tions from the Data Man­age­ment audit. This should be com­pleted by May 2021 and will include flow­charts and guid­ance to sup­port staff in hand­ling these require­ments. We have sought leg­al advice on hand­ling sub­ject access requests and will also incor­por­ate this into revised guidance.	Par­tially Complete
2019⁄20 FOISA and EIR Requests	We recom­mend CNPA update their pro­ced­ures which include ask­ing the requestor wheth­er the request can be nar­rowed to allow the dead­line to be met.	Vicky Walk­er	Low (Grade 1)	Jul-20	Sep-21	We have used this approach on a num­ber of com­plex inform­a­tion requests dur­ing 2020. This has been suc­cess­ful in nar­row­ing the request to extract rel­ev­ant and mean­ing inform­a­tion for the requester. We have not yet incor­por­ated this approach into a refresh of the policy which has been delayed due to emer­gent work on the Cov­id pan­dem­ic. We are anti­cip­at­ing fur­ther recom­mend­a­tions as a res­ult of the data man­age­ment audit com­pleted in Janu­ary 2021 and will take these for­ward in tan­dem due to the inter­de­pend­en­cies of these two policies.	Par­tially Complete
2019⁄20 FOISA and EIR Requests	We recom­mend the FOI policy and guid­ance are updated on a reg­u­lar basis and doc­u­ment the policy own­er and when it is next due to be reviewed. We recom­mend the Policy and Guid­ance are updated, refer to job titles and explain acronyms.	Vicky Walk­er	Low (Grade 1)	Jul-20	Mar-22	This has been delayed due to Cov­id and will be picked up as part of the recom­mend­a­tions from the Data Man­age­ment audit. This should be com­pleted by May 2021 and will include an update to job titles and list of acronyms.	Incom­plete
2019⁄20 Pro­ject Finance	We recom­mend that review of man­age­ment accounts is a stand­ing agenda item for CNPA Man­age­ment Team meet­ings on a monthly basis. We recom­mend Fin­ance con­sult with the Man­age­ment team to determ­ine what fin­an­cial inform­a­tion they would find use­ful and update report­ing if necessary.	Dir­ect­or of Cor­por­ate Services	Medi­um (Grade 2)	Jun-20	Jun-21	Budget man­age­ment has been a more flu­id pro­cess than nor­mal in 2020⁄21 with need to revis­it spend­ing alloc­a­tions and plans. Some work has been done in this area. How­ever, this recom­mend­a­tion needs to be retained for review in 2021⁄22 when we hope the situ­ation will have nor­m­al­ised to a degree.	Par­tially Complete
2019⁄20 Pro­ject Finance	We recom­mend CNPA reviews its pro­ced­ures for sub­mit­ting its sup­port­ing doc­u­ment­a­tion to NLHF to ensure that all required doc­u­ment­a­tion is provided. CNPA should con­sider adding an addi­tion­al review pri­or to the sub­mis­sion, which should be evidenced.	Dani Ral­ph	Medi­um (Grade 2)	Imme­di­ate on com­ple­tion of Decem­ber claims	Jun-21	Amend­ments to the pro­cess have proven dif­fi­cult dur­ing BCP remote working	Incom­plete
2019⁄20 Pro­ject Finance	We recom­mend fore­cast­ing of CNPA’s year-end pos­i­tion is com­pleted on a reg­u­lar basis and is avail­able for man­age­ment to review.	Dani Ral­ph	Low (Grade 1)	31-Mar-20	Jun-21	We have incor­por­ated out­turn pro­jec­tions in fin­an­cial mon­it­or­ing reports pre­pared for Fin­ance and Deliv­ery Committee.	Par­tially Complete

---

Appendix 3: Audit Risk Categorisations

Man­age­ment action grades

• 4: Very high risk expos­ure — major con­cerns requir­ing imme­di­ate seni­or atten­tion that cre­ate fun­da­ment­al risks with­in the organisation.
• 3: High risk expos­ure — absence / fail­ure of key con­trols that cre­ate sig­ni­fic­ant risks with­in the organisation.
• 2: Mod­er­ate risk expos­ure — con­trols are not work­ing effect­ively and effi­ciently and may cre­ate mod­er­ate risks with­in the organisation.
• 1: Lim­ited risk expos­ure — con­trols are work­ing effect­ively, but could be strengthened to pre­vent the cre­ation of minor risks or address gen­er­al house­keep­ing issues.

---

© Azets 2021. All rights reserved. Azets refers to Azets Audit Ser­vices Lim­ited. Registered in Eng­land & Wales. Registered No. 09652677. VAT Regis­tra­tion No. 219 0608 22.

Registered to carry on audit work in the UK and reg­u­lated for a range of invest­ment busi­ness activ­it­ies by the Insti­tute of Chartered Account­ants in Eng­land and Wales.