ARC Paper 5 Annex 1 Letter 25-26 TCWG

Paper 5 Annex 1 Audit and Risk Com­mit­tee 19 June 2026 2

for­vis mazars

100 Queen Street 2^nd Floor Glas­gow G1 3DN

Tel: +44 (0)141 227 2400 www​.maz​ars​.co​.uk

Audit and Risk Com­mit­tee Cairngorms Nation­al Park Author­ity 14 The Square Grant­own on Spey PH26 3HG

Date: 06 Feb­ru­ary 2026

Dir­ect line: 07816 354 994

Email: tom.​reid@​mazars.​co.​uk

Dear Audit and Risk Com­mit­tee Members,

Cairngorms Nation­al Park Author­ity (CNPA) – ²⁰²⁵⁄₂₆: Audit and Risk Com­mit­tee brief­ing note – ISA 240 (Fraud), ISA 250 (laws and reg­u­la­tions), ISA 501 (lit­ig­a­tion and claims) & ISA 570 (going concern)

Intro­duc­tion

This let­ter aims to sum­mar­ise for the Audit and Risk Com­mit­tee (the Com­mit­tee) the require­ments under Inter­na­tion­al Audit­ing Stand­ards, in respect of pre­vent­ing fraud in the annu­al accounts, com­pli­ance with laws and reg­u­la­tions, lit­ig­a­tion and claims, and going con­cern. This let­ter requests an update from the Com­mit­tee in order to inform our con­tinu­ous audit plan­ning as we move into the final stage of our audit of CNPA’s ²⁰²⁵⁄₂₆ accounts.

Inter­na­tion­al Stand­ard for Audit­ing 240 — The auditor’s respons­ib­il­ity to con­sider fraud in an audit of fin­an­cial statements

Back­ground

Under the ISA, the primary respons­ib­il­ity for pre­vent­ing and detect­ing fraud rests with both man­age­ment and ​‘those charged with gov­ernance’, which for CNPA is the Audit and Risk Committee.

This includes fraud that could impact on the accur­acy of the annu­al accounts.

The ISA requires us, as extern­al aud­it­ors, to obtain an under­stand­ing of how the Com­mit­tee exer­cises over­sight of management’s pro­cesses for identi­fy­ing and respond­ing to the risks of fraud and the intern­al con­trols estab­lished to mit­ig­ate them.

What is ​‘fraud’ in the con­text of the ISA?

The ISA views fraud as either:

• the inten­tion­al mis­ap­pro­pri­ation of CNPA’s assets (cash, prop­erty, etc); or
• the inten­tion­al manip­u­la­tion or mis­state­ment of the fin­an­cial state­ments. 2

What are aud­it­ors required to do?

We have to obtain evid­ence of how man­age­ment and those charged with gov­ernance are dis­char­ging their respons­ib­il­it­ies, if we are to prop­erly dis­charge our respons­ib­il­it­ies under ISA 240. We are there­fore mak­ing requests from the Com­mit­tee and man­age­ment on the fol­low­ing, or sim­il­ar, issues:

1) How does the Com­mit­tee, in its role as those charged with gov­ernance, exer­cise over­sight of management’s pro­cesses in rela­tion to:

• under­tak­ing an assess­ment of the risk that the fin­an­cial state­ments may be mater­i­ally mis­stated due to fraud or error (includ­ing the nature, extent and fre­quency of these assessments);
• identi­fy­ing and respond­ing to risks of fraud in the organ­isa­tion, includ­ing any spe­cif­ic risks of fraud which man­age­ment have iden­ti­fied or that have been brought to its atten­tion, or classes of trans­ac­tions, account bal­ances, or dis­clos­ure for which a risk of fraud is likely to exist;
• com­mu­nic­at­ing to employ­ees of views on busi­ness prac­tice and eth­ic­al beha­viour (for example by updat­ing, com­mu­nic­at­ing and mon­it­or­ing against the organisation’s code of con­duct); and
• com­mu­nic­at­ing to those charged with gov­ernance the pro­cesses for identi­fy­ing and respond­ing to fraud or error?

2) How does the Com­mit­tee over­see man­age­ment pro­cesses to identi­fy and respond to the risk of fraud and pos­sible breaches of intern­al con­trol? Is the Com­mit­tee aware of any breaches of intern­al con­trol dur­ing ²⁰²⁵⁄₂₆? Please provide details.

3) Has the Com­mit­tee know­ledge of any actu­al, sus­pec­ted or alleged fraud dur­ing the peri­od 1 April 2025 — 31 March 2026? Where appro­pri­ate please provide details.

4) Has the Com­mit­tee any sus­pi­cion that fraud may be occur­ring with­in the organ­isa­tion? Please provide details.

• Has the Com­mit­tee iden­ti­fied any spe­cif­ic fraud risks with­in the organ­isa­tion? Please provide details.
• Does the Com­mit­tee have any con­cerns that there are areas with­in the organ­isa­tion that are at risk of fraud? Please provide details.
• Are there par­tic­u­lar loc­a­tions with­in the organ­isa­tion where fraud is more likely to occur? Please provide details.

5) Is the Com­mit­tee sat­is­fied that intern­al con­trols, includ­ing segreg­a­tion of duties, exist and work effect­ively? Please provide details.

• If not, where are the risk areas?
• What oth­er con­trols are in place to help pre­vent, deter or detect fraud? 3

6) Is the Com­mit­tee sat­is­fied that staff are encour­aged to report their con­cerns about fraud, and the types of con­cerns they are expec­ted to report? Please provide details.

7) From a fraud and cor­rup­tion per­spect­ive, what are con­sidered by the Com­mit­tee to be high risk posts with­in the organ­isa­tion? Please provide details.

• How are the risks relat­ing to these posts iden­ti­fied, assessed and managed?

8) Is the Com­mit­tee aware of any related party rela­tion­ships or trans­ac­tions that could give rise to instances of fraud? Please provide details.

• How are the risks asso­ci­ated with fraud related to such rela­tion­ships and trans­ac­tions mitigated?

9) Is the Com­mit­tee aware of any entries made in the account­ing records of the organ­isa­tion that it believes or sus­pects are false or inten­tion­ally mis­lead­ing? Please provide details.

• Are there par­tic­u­lar bal­ances where fraud is more likely to occur? Please provide details.
• Is the Com­mit­tee aware of any assets, liab­il­it­ies or trans­ac­tions that it believes were improp­erly included or omit­ted from the accounts of the organ­isa­tion? Please provide details.
• Could a false account­ing entry escape detec­tion? If so, how?
• Are there any extern­al fraud risk factors which are high risk of fraud? Please provide details.

10) Is the Com­mit­tee aware of any organ­isa­tion­al, or man­age­ment pres­sure to meet fin­an­cial or oper­at­ing tar­gets? Please provide details.

• Is the Com­mit­tee aware of any inap­pro­pri­ate organ­isa­tion­al or man­age­ment pres­sure being applied, or incent­ives offered, to you or col­leagues to meet fin­an­cial or oper­at­ing tar­gets? Please provide details.

Inter­na­tion­al Stand­ard for Audit­ing 250 – Con­sid­er­a­tion of laws and reg­u­la­tions in an audit of fin­an­cial statements

Back­ground

Under the ISA, in the UK and Ire­land, the primary respons­ib­il­ity for ensur­ing that the entity’s oper­a­tions are con­duc­ted in accord­ance with laws and reg­u­la­tions and the respons­ib­il­ity for the pre­ven­tion and detec­tion of non-com­pli­ance rests with man­age­ment and ​‘those charged with gov­ernance’, which for CNPA is the Audit and Risk Com­mit­tee. The ISA requires us, as extern­al aud­it­ors, to obtain an under­stand­ing of how the Com­mit­tee gains assur­ance that all rel­ev­ant laws and reg­u­la­tions have been com­plied with. 4

What are aud­it­ors required to do?

We have to obtain evid­ence of how man­age­ment and those charged with gov­ernance are dis­char­ging their respons­ib­il­it­ies, if we are to prop­erly dis­charge our respons­ib­il­it­ies under ISA 250. We are there­fore mak­ing requests from the Com­mit­tee, and will be mak­ing sim­il­ar enquir­ies of management:

11) How does the Com­mit­tee gain assur­ance that all rel­ev­ant laws and reg­u­la­tions have been com­plied with. For example:

• Is the Com­mit­tee aware of the pro­cess man­age­ment has in place for identi­fy­ing and respond­ing to changes in laws and reg­u­la­tions? Please provide details.
• What arrange­ments are in place for the Com­mit­tee to over­see this process?
• Is the Com­mit­tee aware of the arrange­ments man­age­ment have in place, for com­mu­nic­at­ing with employ­ees, non-exec­ut­ive dir­ect­ors, part­ners and stake­hold­ers regard­ing the rel­ev­ant laws and reg­u­la­tions that need to be fol­lowed? Please provide details.
• Does the Com­mit­tee have know­ledge of actu­al or sus­pec­ted instances where appro­pri­ate laws and reg­u­la­tions have not been com­plied with, and if so is it aware of what actions man­age­ment is tak­ing to address it? Please provide details.

Inter­na­tion­al Stand­ard for Audit­ing 501 – Spe­cif­ic con­sid­er­a­tion of the poten­tial for, and actu­al, lit­ig­a­tion and claims affect­ing the fin­an­cial statements

Back­ground

This ISA deals with spe­cif­ic con­sid­er­a­tions by the aud­it­or in obtain­ing suf­fi­cient appro­pri­ate audit evid­ence, in this instance with respect to the com­plete­ness of lit­ig­a­tion and claims involving the entity. The ISA requires us, as extern­al aud­it­ors, to design and per­form audit pro­ced­ures in order to identi­fy lit­ig­a­tion and claims involving the entity which may give rise to a risk of mater­i­al misstatement.

What are aud­it­ors required to do?

We have to obtain evid­ence of how man­age­ment and those charged with gov­ernance are dis­char­ging their respons­ib­il­it­ies, if we are to prop­erly dis­charge our respons­ib­il­it­ies under ISA 501. We are there­fore mak­ing requests from the Com­mit­tee, and will be mak­ing sim­il­ar enquir­ies of management:

12) Is the Com­mit­tee aware of any actu­al or poten­tial lit­ig­a­tion or claims that would affect the fin­an­cial state­ments? Please provide details.

Inter­na­tion­al Stand­ard for Audit­ing 570 – Con­sid­er­a­tion of the going con­cern assump­tion in an audit of fin­an­cial statements

Back­ground

Fin­an­cial state­ments are gen­er­ally pre­pared on the basis of the going con­cern assump­tion. Under the going con­cern assump­tion, an audited body is ordin­ar­ily viewed as con­tinu­ing in oper­a­tion for the fore­see­able future. Accord­ingly, assets and liab­il­it­ies are recor­ded in the fin­an­cial 5

state­ments on the basis that the audited body will be able to real­ise its assets and dis­charge its liab­il­it­ies in the nor­mal course of its operations.

What are aud­it­ors required to do?

If used, we are required to con­sider the appro­pri­ate­ness of management’s use of the going con­cern assump­tion in the pre­par­a­tion of the fin­an­cial state­ments if we are to prop­erly dis­charge our respons­ib­il­it­ies under ISA 570. We are there­fore mak­ing the fol­low­ing request from the Committee:

13) How has the Com­mit­tee assessed and sat­is­fied itself that it is appro­pri­ate to adopt the going con­cern basis in pre­par­ing the fin­an­cial statements?

14) Has the Com­mit­tee iden­ti­fied any events or con­di­tions since the assess­ment was under­taken which may cast sig­ni­fic­ant doubt on the organisation’s abil­ity to con­tin­ue as a going con­cern? Please provide details.

The way forward

The inform­a­tion you provide will help inform our under­stand­ing of CNPA and its busi­ness pro­cesses, pri­or to the start of the final stage of the audit of the ²⁰²⁵⁄₂₆ fin­an­cial statements.

I would be grate­ful for your responses, which should be form­ally con­sidered and com­mu­nic­ated to us on the Committee’s behalf to cov­er the year to 31 March 2026, by 31 May 2026. In the mean­time, if you have any quer­ies, please do not hes­it­ate to con­tact me.

Yours sin­cerely,

[Sig­na­ture]

Tom Reid Audit Dir­ect­or For­vis Maz­ars LLP