ARC Paper 4 Audit Progress Report June 2026

Cairngorms Nation­al Park Author­ity Ugh­dar­ras Pàirc Nàiseanta a’ Mhon­aidh Ruaidh

Audit and Risk Com­mit­tee Paper 4 19 June 2026

Paper 4

---

Audit Pro­gress Report Cairngorms Nation­al Park Authority

June 2026

for­vis mazars

---

Con­tents

1. Audit pro­gress
2. Nation­al publications

for­vis mazars

---

1. Audit pro­gress

Pur­pose of this report

This report provides an update on pro­gress in deliv­er­ing our extern­al audit respons­ib­il­it­ies for Cairngorms Nation­al Park Author­ity (CNPA). We plan to com­plete the ²⁰²⁵⁄₂₆ audit and present the draft Annu­al Audit Report to the Audit and Risk Com­mit­tee sched­uled for 2 Octo­ber 2026.

We car­ried out our plan­ning, risk assess­ment, and inter­im audit work dur­ing Feb­ru­ary and March 2026. We presen­ted our Annu­al Audit Plan, set­ting out our audit approach and sig­ni­fic­ant risks, to the Audit and Risk Com­mit­tee on 13 March 2026.

We plan to com­mence the fin­an­cial state­ments audit on 6 July 2026 upon receipt of the unaudited annu­al report and accounts. We have main­tained com­mu­nic­a­tion with officers and will con­tin­ue reg­u­lar engage­ment through­out the audit.

Sum­mary of work for the plan­ning and inter­im phase:

Areas	Descrip­tion	Status
Plan­ning and risk assessment	We have com­pleted our detailed under­stand­ing of CNPA and its busi­ness envir­on­ment, assess­ment of its intern­al con­trol and risk frame­work, under­stand­ing of fraud and the related risk factors, and set our ini­tial mater­i­al­ity levels.	Com­pleted
Eval­u­ation of the design and imple­ment­a­tion of con­trols around key busi­ness processes	We have the remain­ing key busi­ness pro­cess walk­throughs to per­form at the field­work phase of the audit: Prop­erty, plant and equip­ment reclas­si­fic­a­tion and impairment Leases Year-end fin­an­cial state­ments close pro­cess includ­ing related party trans­ac­tions and disclosures Expendit­ure pro­cess (year end accruals). We have com­pleted our review of key busi­ness pro­cesses and walk­throughs for: Treas­ury, bank and cash Payroll Accounts pay­able Accounts receiv­ables	In Pro­gress
Wider scope	CNPA is a less com­plex body for wider scope report­ing pur­poses. We have com­pleted our plan­ning assess­ment on the fin­an­cial sus­tain­ab­il­ity of CNPA and the ser­vices it deliv­ers over the medi­um to longer term. As planned, we will com­plete our remain­ing pro­ced­ures, includ­ing fol­low-up of pri­or year recom­mend­a­tions, as part of the final fieldwork.	In Pro­gress

for­vis mazars

---

1. Recent events and publications

For­vis Maz­ars Scot­tish Pub­lic Sec­tor Resi­li­ence and Read­i­ness Forum

Seni­or fig­ures from across Scotland’s pub­lic sec­tor have warned that many organ­isa­tions lack the capa­city to deliv­er mean­ing­ful trans­form­a­tion unless they accel­er­ate the use of shared ser­vices and rein­vest the res­ult­ing sav­ings into long term change programmes.

The mes­sage emerged from the inaug­ur­al Scot­tish Pub­lic Sec­tor Resi­li­ence and Read­i­ness For­um, hos­ted in Glas­gow on Tues­day 24 March by For­vis Maz­ars, which brought togeth­er seni­or lead­ers and fin­ance pro­fes­sion­als from across loc­al gov­ern­ment, cent­ral gov­ern­ment and edu­ca­tion; includ­ing rep­res­ent­at­ives from Loch Lomond and the Trossachs Nation­al Park Authority.

The event focused on resi­li­ence, read­i­ness and transformation:

• Fin­an­cial report­ing updates – explor­ing the latest changes and what they mean for pub­lic bodies.
• Trans­form­a­tion in prac­tice – les­sons from deliv­er­ing major change pro­grammes in loc­al government.
• Cyber resi­li­ence – a pan­el dis­cus­sion on respond­ing to evolving cyber threats and strength­en­ing organ­isa­tion­al read­i­ness. Speak­ers argued that, amid sus­tained fisc­al pres­sure, incre­ment­al cost-cut­ting is no longer suf­fi­cient to future-proof pub­lic ser­vices. The for­um also fea­tured extens­ive dis­cus­sion on the human cost of major cyber incid­ents, with par­ti­cipants shar­ing first-hand accounts of the per­son­al and organ­isa­tion­al trauma that can fol­low a pro­longed loss of systems.

The event reflects the firm’s con­tin­ued expan­sion of its pub­lic sec­tor cap­ab­il­it­ies in Scot­land. We are plan­ning to hold our next for­um in late Summer/​early Autumn and will share fur­ther details in due course.

Nav­ig­at­ing cyber risks: How loc­al author­it­ies can build resi­li­ence against emer­ging threats

The recent cyber-attack on loc­al author­it­ies in Novem­ber 2025 high­lights the urgent need for robust resi­li­ence strategies. From ransom­ware to leg­acy sys­tems, pub­lic bod­ies face grow­ing risks that can dis­rupt essen­tial ser­vices and com­prom­ise cit­izen trust. In this art­icle, For­vis Maz­ars high­lights the increas­ing import­ance of cyber­se­cur­ity for loc­al author­it­ies, out­lining the key cyber risks they face and set­ting out recog­nised good-prac­tice meas­ures to strengthen resi­li­ence and mit­ig­ate these threats. Whilst the report relates most spe­cific­ally to loc­al author­it­ies, there are ele­ments of learn­ing which will be rel­ev­ant to all pub­lic sec­tor bod­ies, includ­ing Loch Lomond and the Trossachs Nation­al Park Authority.

for­vis mazars

---

1. Recent events and pub­lic­a­tions (con­tin­ued)

Trans­form­ing the approach to cli­mate change: Les­sons from pub­lic audit | Audit Scotland

Audit Scotland’s report high­lights that achiev­ing Scotland’s net zero ambi­tions requires a fun­da­ment­al trans­form­a­tion in how the pub­lic sec­tor plans, col­lab­or­ates and deliv­ers action on cli­mate change. Draw­ing on recent audit find­ings, it iden­ti­fies five inter­con­nec­ted chal­lenges — lead­er­ship and col­lab­or­a­tion, plan­ning for deliv­ery, fin­an­cial plan­ning, gov­ernance, and pub­lic engage­ment — and con­cludes that pro­gress to date has been hindered by weak stra­tegic lead­er­ship, insuf­fi­ciently detailed deliv­ery plans, unclear gov­ernance arrange­ments, fund­ing uncer­tainty, and incon­sist­ent engage­ment with communities.

The report emphas­ises that pub­lic bod­ies must adopt a whole-sys­tem approach, embed­ding cli­mate con­sid­er­a­tions into all decision-mak­ing, align­ing long-term strategies with real­ist­ic fund­ing and deliv­ery plans, strength­en­ing cross-sec­tor part­ner­ships, and improv­ing trans­par­ency, account­ab­il­ity, and pub­lic involve­ment. Over­all, it provides prac­tic­al insights and reflect­ive ques­tions to help Boards and seni­or lead­ers assess their organisation’s read­i­ness and accel­er­ate effect­ive action on cli­mate change.

for­vis mazars

---

Con­tact

For­vis Mazars Tom Reid Dir­ect­or Tom.​Reid@​mazars.​co.​uk

For­vis Mazars Caleb Oguche Seni­or Man­ager Caleb.​Oguche@​mazars.​co.​uk

For­vis Maz­ars LLP is the UK firm of For­vis Maz­ars Glob­al, a lead­ing glob­al pro­fes­sion­al ser­vices net­work. For­vis Maz­ars LLP is a lim­ited liab­il­ity part­ner­ship registered in Eng­land and Wales with registered num­ber OC308299 and with its registered office at 30 Old Bailey, Lon­don, EC4M 7AU. Registered to carry on audit work in the UK by the Insti­tute of Chartered Account­ants in Eng­land and Wales. Details about our audit regis­tra­tion can be viewed at www​.auditre​gister​.org​.uk under ref­er­ence num­ber C001139861. VAT num­ber: GB 839 8356 73

© For­vis Maz­ars 2026. All rights reserved.

for­vis mazars