Cairngorms Nation­al Park Authority

Intern­al Audit Annu­al Report ²⁰²⁰⁄₂₁

March 2021

---

Con­tents

• Intro­duc­tion 2
• Over­all Intern­al Audit Opin­ion 3
• Intern­al Audit Work Per­formed 4
• Appendix 1 – Planned v actu­al days ²⁰²⁰⁄₂₁ 9
• Appendix 2 – Sum­mary of Intern­al Qual­ity Assur­ance Assess­ment 10

---

Intro­duc­tion

The Pub­lic Sec­tor Intern­al Audit Stand­ards (PSI­AS) state that:

“The Chief Audit Exec­ut­ive must deliv­er an annu­al intern­al audit opin­ion and report that can be used by the organ­isa­tion to inform its gov­ernance statement.”

“The annu­al intern­al audit opin­ion must con­clude on the over­all adequacy and effect­ive­ness of the organisation’s frame­work of gov­ernance, risk man­age­ment and control.”

To meet the above require­ments, this Annu­al Report sum­mar­ises our con­clu­sions and key find­ings from the intern­al audit work under­taken at the Cairngorms Nation­al Park Author­ity (CNPA) dur­ing the year ended 31 March 2021, includ­ing our over­all opin­ion on CNPA’s intern­al con­trol system.

Acknow­ledge­ment

We would like to take this oppor­tun­ity to thank all mem­bers of man­age­ment and staff for the help, cour­tesy and co-oper­a­tion exten­ded to us dur­ing the year.

---

Over­all Intern­al Audit Opinion

Basis of Opinion

As the Intern­al Aud­it­or of CNPA, we are required to provide the Audit and Risk Com­mit­tee with assur­ance on the whole sys­tem of intern­al con­trol. In giv­ing our opin­ion it should be noted that assur­ance can nev­er be abso­lute. The most that the intern­al audit ser­vice can provide is reas­on­able assur­ance that there are no major weak­nesses in the whole sys­tem of intern­al control.

In assess­ing the level of assur­ance to be giv­en, we have taken into account:

• All reviews under­taken as part of the ²⁰²⁰⁄₂₁ intern­al audit plan;
• Any scope lim­it­a­tions imposed by management;
• Mat­ters arising from pre­vi­ous reviews and the extent of fol­low-up action taken includ­ing in year audits;
• Expect­a­tions of seni­or man­age­ment, the Audit and Risk Com­mit­tee and oth­er stakeholders;
• The extent to which intern­al con­trols address the client’s risk management/​control framework;
• The effect of any sig­ni­fic­ant changes in CNPA’s object­ives or sys­tems; and
• The intern­al audit cov­er­age achieved to date.

In my pro­fes­sion­al judge­ment as Head of Intern­al Audit, suf­fi­cient and appro­pri­ate audit pro­ced­ures have been con­duc­ted and evid­ence gathered to sup­port the basis and the accur­acy of the con­clu­sions reached and con­tained in this report. The con­clu­sions were based on a com­par­is­on of the situ­ations as they exis­ted at the time against the audit cri­ter­ia. The con­clu­sions are only applic­able for the entity examined. The evid­ence gathered meets pro­fes­sion­al audit stand­ards and is suf­fi­cient to provide seni­or man­age­ment with proof of the con­clu­sions derived from the intern­al audit work.

Intern­al Audit Opinion

In our opin­ion CNPA has a frame­work of con­trols in place that provides reas­on­able assur­ance regard­ing the organisation’s gov­ernance frame­work, intern­al con­trols, effect­ive and effi­cient achieve­ment of object­ives and the man­age­ment of key risks, sub­ject to the imple­ment­a­tion of spe­cif­ic high risk actions raised in rela­tion to cor­por­ate gov­ernance pro­cesses and data man­age­ment con­trol improve­ments through­out ²⁰²⁰⁄₂₁.

Azets

March 2021

---

Intern­al Audit Work Performed

Scope and Responsibilities

Man­age­ment

It is management’s respons­ib­il­ity to estab­lish a sound intern­al con­trol sys­tem. The intern­al con­trol sys­tem com­prises the whole net­work of sys­tems and pro­cesses estab­lished to provide reas­on­able assur­ance that organ­isa­tion­al object­ives will be achieved, with par­tic­u­lar ref­er­ence to:

• Risk man­age­ment;
• The effect­ive­ness of operations;
• The eco­nom­ic and effi­cient use of resources;
• Com­pli­ance with applic­able policies, pro­ced­ures, laws and regulations;
• Safe­guards against losses, includ­ing those arising from fraud, irreg­u­lar­ity or cor­rup­tion; and
• The integ­rity and reli­ab­il­ity of inform­a­tion and data.

Intern­al Auditor

The Intern­al Aud­it­or assists man­age­ment by examin­ing, eval­u­at­ing and report­ing on the con­trols in order to provide an inde­pend­ent assess­ment of the adequacy of the intern­al con­trol sys­tem. To achieve this, the Intern­al Aud­it­or should:

• Ana­lyse the intern­al con­trol sys­tem and estab­lish a review programme;
• Identi­fy and eval­u­ate the con­trols which are estab­lished to achieve object­ives in the most eco­nom­ic and effi­cient manner;
• Report find­ings and con­clu­sions and, where appro­pri­ate, make recom­mend­a­tions for improvement;
• Provide an opin­ion on the reli­ab­il­ity of the con­trols in the sys­tem under review; and
• Provide an assur­ance based on the eval­u­ation of the intern­al con­trol sys­tem with­in the organ­isa­tion as a whole.

Plan­ning Process

Our stra­tegic and annu­al intern­al audit plans are designed to provide the Audit and Risk Com­mit­tee with assur­ance that CNPA’s intern­al con­trol sys­tem is effect­ive in man­aging the key risks and best value is being achieved. The plans are there­fore informed by CNPA’s risk man­age­ment sys­tem and linked to the Cor­por­ate Risk Register.

The Stra­tegic Intern­al Audit Plan was agreed in con­sulta­tion with seni­or man­age­ment and form­ally approved by the Audit and Risk Committee.

The Annu­al Intern­al Audit Plan is sub­ject to revi­sion through­out the year to reflect changes in CNPA’s risk profile.

We planned our work so that we have a reas­on­able expect­a­tion of detect­ing sig­ni­fic­ant con­trol weak­nesses. How­ever, intern­al audit can nev­er guar­an­tee to detect all fraud or oth­er irreg­u­lar­it­ies and can­not be held respons­ible for intern­al con­trol failures.

Cov­er Achieved

The ²⁰²⁰⁄₂₁ Intern­al Audit Plan com­prised 73 days of audit work and we have com­pleted 54.3 days, defer­ring audit work in agree­ment with man­age­ment and the Audit and Risk Com­mit­tee. A com­par­is­on of actu­al cov­er­age against the ²⁰²⁰⁄₂₁ plan is attached at Appendix 1.

We con­firm that there were no resource lim­it­a­tions that impinged on our abil­ity to meet the full audit needs of the CNPA and no restric­tions were placed on our work by management.

We did not rely on the work per­formed by a third party dur­ing the period.

Reports

We pre­pared a report from each review and presen­ted these reports to the Audit and Risk Com­mit­tee. The reports are sum­mar­ised in the table below.

Where rel­ev­ant, all reports con­tained action plans detail­ing respons­ible officers and imple­ment­a­tion dates. The reports were fully dis­cussed and agreed with man­age­ment pri­or to sub­mis­sion to the Audit and Risk Committee.

We made no sig­ni­fic­ant recom­mend­a­tions that were not accep­ted by management.

Sum­mary of reports by con­trol assess­ment and action grade

Review	Con­trol object­ive assess­ment	No. of issues per grading
A4. VAT Health Check	N/A	4, 3, 2, 1
B1. Cor­por­ate Governance		2, 4
C1. COV­ID Recovery		2, 1
D4. Data Management		3, 2
E1. LEAD­ER Administration
E2. Fol­low Up	N/A

Con­trol object­ive assess­ment definitions

• R: Fun­da­ment­al absence or fail­ure of key controls.
• A: Con­trol object­ive not achieved – con­trols are inad­equate or ineffective.
• Y: Con­trol object­ive achieved – no major weak­nesses but scope for improvement.
• G: Con­trol object­ive achieved – con­trols are adequate, effect­ive and efficient.

Man­age­ment action pri­or­it­isa­tion definitions

• 4: Very high risk expos­ure – major con­cerns requir­ing imme­di­ate seni­or atten­tion that cre­ate fun­da­ment­al risks with­in the organisation.
• 3: High risk expos­ure – absence / fail­ure of key con­trols that cre­ate sig­ni­fic­ant risks with­in the organisation.
• 2: Mod­er­ate risk expos­ure – con­trols are not work­ing effect­ively and effi­ciently and may cre­ate mod­er­ate risks with­in the organisation.
• 1: Lim­ited risk expos­ure – con­trols are work­ing effect­ively, but could be improved. Typ­ic­ally these are the cor­rec­tion of minor risks or address gen­er­al house-keep­ing issues.

Key Find­ings – Grade 3 Actions

Cor­por­ate Governance

• Man­age­ment and the Board should agree a com­ple­tion date for the Gov­ernance Respons­ib­il­ity Framework.
• Man­age­ment should pro­gress with the review and imple­ment­a­tion of the updated Frame­work Agree­ment with­in the first half of 2021.
• Man­age­ment should work with Board mem­bers to review the assur­ance arrange­ments for major pro­jects and address any per­ceived gaps, includ­ing pro­ject financials.

Data Man­age­ment

• We recom­mend that the Author­ity ensure that data audits are con­duc­ted annu­ally in line with the policy. These audits should sample vari­ous dir­ect­or­ates to ensure that stor­age and man­age­ment of files adhere to the Records Man­age­ment Policy. Spe­cific­ally, this audit should con­sider com­pli­ance with data reten­tion and dis­pos­al require­ments, ver­sion con­trol require­ments and access and secur­ity require­ments. The out­put of this audit should be doc­u­mented and the Head of Ser­vice for each area should be giv­en recom­men­ded actions as necessary.
• We also recom­mend that the Author­ity eval­u­ates the approach to own­er­ship of folders and how com­pli­ance checks against the Records Man­age­ment Policy are performed.
• We recom­mend that the Author­ity reviews the list of users who can make modi­fic­a­tion to the file struc­ture. The top level of folders i.e. folders for each dir­ect­or­ate, should be locked down so that only a small num­ber of users who require amend­ment rights can modi­fy them. To sup­port bet­ter man­age­ment of file per­mis­sions for lower-level folders with­in each dir­ect­or­ate, we recom­mend that each dir­ect­or­ate is provided with access to cre­ate sub-folders with­in their respect­ive top-level folder without hav­ing to ask IT or the Admin Team for permission.
• We also recom­mend that requests for amend­ments to the top-level the file struc­ture are sub­mit­ted to the Office Ser­vice Man­ager who can make a decision on their justification.
• We recom­mend that once the Author­ity have received the feed­back from their DPOaaS pro­vider, they cre­ate a sub­ject access request pro­ced­ure, or doc­u­ment the pro­cess with­in an exist­ing pro­ced­ure, if appro­pri­ate. The pro­ced­ure should out­line the fol­low­ing aspects:
  • Roles and respons­ib­il­it­ies when respond­ing to requests
  • Ini­tial steps for acknow­ledging the request and veri­fy­ing the iden­tity of the individual
  • Identi­fy­ing what data is with­in scope
  • How to search for data
  • How data should be sent to the individual
  • How requests will be logged and mon­itored by the Authority

Pro­gress in Imple­ment­ing Pre­vi­ous Intern­al Audit Actions

We reviewed the 63 actions on the action track­er and obtained suf­fi­cient evid­ence to close 10 (16%) actions, 18 (29%) actions have been assessed as par­tially com­plete, 15 (23%) marked as incom­plete, 7 (11%) marked no longer applic­able and 13 (21%) were not yet due.

Inde­pend­ence

PSI­AS require us to com­mu­nic­ate on a timely basis all facts and mat­ters that may have a bear­ing on our independence.

We can con­firm that the staff mem­bers involved in each ²⁰²⁰⁄₂₁ intern­al audit review were inde­pend­ent of CNPA and their objectiv­ity was not com­prom­ised in any way.

Con­form­ance with Pub­lic Sec­tor Intern­al Audit Standards

We con­firm that our intern­al audit ser­vice con­forms to the Pub­lic Sec­tor Intern­al Audit Stand­ards, which are based on the Inter­na­tion­al Stand­ards for the Pro­fes­sion­al Prac­tice of Intern­al Audit­ing. This is con­firmed through our qual­ity assur­ance and improve­ment pro­gramme, which includes cyc­lic­al intern­al and extern­al assess­ments of our meth­od­o­logy and prac­tice against the standards.

A sum­mary of the res­ults of our most recent intern­al assess­ment is provided at Appendix 2.

---

Appendix 1 – Planned v actu­al days ²⁰²⁰⁄₂₁

Ref and Name of report	Planned Days	Actu­al Days
A4. VAT Health Check	8	8
B1. Cor­por­ate Governance	8	8
C1. Cov­id Recovery	8	8
C2. Leg­acy Liab­il­it­ies (deferred)	7	0.2
C3. Out­door Access Infra­struc­ture (removed)	6	0.9
D1. ICT Strategy (deferred)	7	0.2
D4. Data Management	8	6
E1. LEAD­ER Administration	7	7
E2. Fol­low Up	3	0
Intern­al Audit Man­age­ment and Administration	2	2
Audit and Risk Com­mit­tee plan­ning report­ing and attendance	3	3
Audit needs ana­lys­is – stra­tegic and oper­a­tion­al IA planning	3	3
Con­tract Management	2	2
Annu­al Intern­al Audit Report	1	1
Total	73	54.3

---

Appendix 2 – Sum­mary of Intern­al Qual­ity Assur­ance Assessment

We are pleased to dis­close the out­come of our reg­u­lar intern­al and extern­al qual­ity assess­ments with our cli­ents to provide you with assur­ance that the ser­vice you receive is of high qual­ity and fully com­pli­ant with intern­al audit standards.

The table below sum­mar­ises the out­come of our most recent intern­al qual­ity assess­ment (com­pleted August 2020), in which we have assessed the extent to which our intern­al audit meth­od­o­logy con­forms to the stand­ards. Com­pli­ance with the meth­od­o­logy is mon­itored through an annu­al review of a sample of audit files and we review our com­pli­ance with the IPPF/PSIAS through a wider review of our meth­od­o­logy. In addi­tion, every five years we com­mis­sion a full Extern­al Qual­ity Assess­ment, the most recent of which was com­pleted in July 2018.

	Gen­er­ally Con­forms	Par­tially Con­forms	Does Not Con­form	Improve­ment actions
Defin­i­tion of Intern­al Auditing	✓
Code of Ethics
Integ­rity	✓
Objectiv­ity	✓
Con­fid­en­ti­al­ity	✓
Com­pet­ence				We are work­ing on a skills mat­rix for the team that is aligned to the IIA’s Glob­al Intern­al Audit Com­pet­ency Framework.
Attrib­ute Standards
Pur­pose, Author­ity and Responsibility	✓
Recog­nising Man­dat­ory Guid­ance in the Intern­al Audit Charter	✓
Inde­pend­ence and Objectivity	✓
Organ­isa­tion­al Independence
Dir­ect Inter­ac­tion with the Board	✓
Chief Audit Exec­ut­ive Roles Bey­ond Intern­al Auditing	✓
Indi­vidu­al Objectivity	✓
Impair­ments to Inde­pend­ence or Objectivity	✓
Pro­fi­ciency and Due Pro­fes­sion­al Care (The sum of Stand­ards 1210 – 1230)	✓
Pro­fi­ciency	✓
Due Pro­fes­sion­al Care	✓
Con­tinu­ing Pro­fes­sion­al Development	✓
Qual­ity Assur­ance and Improve­ment Pro­gramme (The sum of Stand­ards 1310 – 1320)		✓		We are in the pro­cess of con­sol­id­at­ing our qual­ity and con­tinu­ous improve­ment pro­cesses with­in a single Qual­ity Assur­ance and Improve­ment Plan.
Require­ments of the Qual­ity Assur­ance and Improve­ment Programme	✓
Intern­al Assessments	✓
Extern­al Assessments	✓
Report­ing on the Qual­ity Assur­ance and Improve­ment Programme	✓
Use of Con­forms with the Inter­na­tion­al Stand­ards for the Pro­fes­sion­al Prac­tice of Intern­al Auditing	✓
Dis­clos­ure of Non-conformance	✓
Per­form­ance Standards
Man­aging the Intern­al Audit Activ­ity (Sum total of Stand­ards 2010 – 2060)	✓
Plan­ning	✓
Com­mu­nic­a­tion and Approval	✓
Resource Man­age­ment Policies and Procedures	✓
Coordin­a­tion and Reliance		✓		Ensur­ing full co-ordin­a­tion with oth­er assur­ance pro­viders remains chal­len­ging for all intern­al audit func­tions. We have developed a robust meth­od­o­logy for assur­ance map­ping that enables us to sup­port our cli­ents in this import­ant area. In addi­tion, wherever pos­sible we work closely with both extern­al audit and key reg­u­lat­ors to min­im­ise any duplic­a­tion in the scope of our work plans. In addi­tion, we recently refreshed the risk matur­ity check­list that we use dur­ing stra­tegic audit plan­ning to ensure we place an appro­pri­ate level of reli­ance on the risk man­age­ment process.
Report­ing to Seni­or Man­age­ment and the Board	✓
Extern­al Ser­vice Pro­vider and Organ­isa­tion­al Respons­ib­il­ity for Intern­al Audit	✓
Nature of Work (Sum of Stand­ards 2110 – 2130)	✓
Gov­ernance	✓
Risk Man­age­ment	✓
Con­trol
Engage­ment Plan­ning (Sum of Stand­ards 2201 – 2240)	✓			We iden­ti­fied the need to provide refresh­er train­ing to staff on the appro­pri­ate con­duct of and attend­ance at audit scop­ing and open­ing meetings.
Plan­ning Considerations
Engage­ment Objectives	✓
Engage­ment Scope	✓
Engage­ment Resource Allocation	✓
Engage­ment Work Programme	✓
Per­form­ing the Engage­ment (The sum of Stand­ards 2300 – 2340)				We have included a focus in this year’s train­ing on the use of sample test­ing. This is being rolled out across all levels of staff with­in our team to cov­er both plan­ning, exe­cu­tion and review. We also iden­ti­fied the need to provide refresh­er train­ing for aud­it­ors cov­er­ing the appro­pri­ate doc­u­ment­a­tion of con­trol assessments.
Identi­fy­ing Information	✓
Ana­lys­is and Evaluation	✓
Doc­u­ment­ing Information				We recently updated our IA Meth­od­o­logy in rela­tion to the Azets Pro­fes­sion­al Record Reten­tion Policy to ensure that we con­tin­ue to retain only essen­tial inform­a­tion on audit files and securely des­troy con­fid­en­tial info.
Engage­ment Supervision	✓			Timely sign-off of file com­ple­tion remains a per­vas­ive chal­lenge; we have reminded all staff of the
Com­mu­nic­at­ing Res­ults (Sum of Stand­ards 2410 – 2440)				We iden­ti­fied the need to provide refresh­er train­ing to staff on the appro­pri­ate con­duct of and attend­ance at audit close out meetings.
Cri­ter­ia for Communicating	✓
Qual­ity of Communications	✓
Errors and Omissions	✓
Use of ​‘con­duc­ted in con­form­ance with the Inter­na­tion­al Stand­ards for the Pro­fes­sion­al Prac­tice of Intern­al Auditing’	✓
Engage­ment Dis­clos­ure of Non-conformance	✓
Dis­sem­in­at­ing Results	✓
Over­all Opinions	✓
Mon­it­or­ing Progress	✓
Res­ol­u­tion of Seni­or Management’s Accept­ance of Risks	✓

Over­all, our ser­vice con­forms to the require­ments of the PSI­AS. Our assess­ment is based on the over­all ser­vice that is delivered to each cli­ent. We are happy to provide CNPA’s mem­bers with fur­ther details of the inform­a­tion set out above and the assess­ment pro­cess, if required.

---

© Azets 2021. All rights reserved. Azets refers to Azets Audit Ser­vices Lim­ited. Registered in Eng­land & Wales Registered No. 09652677. VAT Regis­tra­tion No. 219 0608 22. Registered to carry on audit work in the UK and reg­u­lated for a range of invest­ment busi­ness activ­it­ies by the Insti­tute of Chartered Account­ants in Eng­land and Wales.