| A1 | All | Resources — financial | Public sector finances constrain capacity to allocate sufficient resources to deliver corporate plan. | Preventative: Ongoing liaison with Scottish Government through our sponsorship team, highlighting achievements of CNPA. Preventative: Corporate plan prioritised around anticipated Scottish Government budget allocations, taking on Board expectation of funding constraints. Remedial: Focus resource on diversification of income streams to alternative, non-public income generation. Remedial: Continuing to support “delivery bodies” such as Cairngorms Nature, Cairngorms Trust in securing inward investment. | 4 | 3 | 12 | Managed | Mitigation actions have supported positive risk management. Risk decreasing while recognising allocations remain subject to approval of Government through our sponsorship team. Scottish budget, with residual risk around in year adjustments. Award of £1.045 million from NRF together with significant NLHF funding to 2029 confirms success of mitigation approaches. Election result suggests continuation of allocations for 2026⁄27 financial year, while engagement with new Minister and monitoring of national financial position updates from Government will be needed. | Preventative: Ongoing liaison with Scottish Government through our sponsorship team, Peatland Action Team, and Rural Communities Team highlighting achievements of CNPA. Preventative: prepare briefing on work and priority investment for post-election in line with development of new 2027 to 2032 Corporate Plan and NPPP. Remedial: scenario planning on forward budget modelling to prepare options for future resource allocations within final allocations, based on funding parameters suggested by sponsorship team. | Ongoing | Open | 4 | 2 | 8 | David Cameron | 11/05/2026 |
| 2 | All | Resources — financial | Risk of C2030 match funding not being secured — current match funding in bid not fully committed and/or Transport Scotland annual funding cycles do not fit the project delivery requirements and alternate financial solutions are needed for one year only in many areas. | Preventative: Ongoing liaison with Scottish Government through our sponsorship team and the Peatland Action Team, highlighting achievements of CNPA and importance of Peatland Restoration funding to inward investment by NLHF. Remedial: Discussions with Transport Scotland on funding for active travel design work. Remedial: consider offsetting expenditure reductions to offset any funding gaps within programme Remedial: ongoing exploration with partners to secure C2030 programme funding to complete work. Additional award of funding for 2026⁄27 is now in application process, with contract activity being maintained through other programme finances. Discussions with HIE progressing well toward securing budgeted contribution plus potentially a slight increase. Remedial: Use of planned park authority contributions as interim measures to bridge temporary phasing shortfalls. | 4 | 3 | 12 | Static | Allocations for 2026⁄27 financial year provide a good settlement sufficient to cover planned delivery against corporate plan objectives. Funding for 2026⁄27 Peatland Restoration has been secured in line with requirements. This provides a suitable level of match funding for the C2030 programme, in line with the programme’s 5‑year budget. Peatland restoration delivery profile is healthy, with expectation that sufficient will be spent within the year to meet required contribution to C2030 delivery. Contractor for RIBA stages 3 and 4 design work now appointed. | Preventative: continued focus over 2026 on match funding position and consequent impacts to ensure C2030 programme plans and financing of them fully aligned by end of year. Preventative: high profile and ongoing focus for SMT in engaging in influencing to secure the match funding needed from partners; project managers aware of relevant project match funding position and tasked with seeking additional match funding where appropriate. Prevantative: consideration of new, wider match funding opportunities. Remedial: Fully updated C2030 budget development in Q1 of 26⁄27 to identify any remaing specific issues or remedial work. | Ongoing | Open | 4 | 2 | 8 | David Cameron | 11/05/2026 |
| 3 | All | Resources — staffing | There are perceived gaps in our skill set with respect to : — Risks that procurement and wider skill set capacities are insufficient to meet the evolving needs of the organisation. — Lack of expertise and experience in managing construction projects may compromise the effectiveness and efficiency of planned delivery. Financial risks associated with the letting of contracts where partnership funding is likely to be dependent on the achievement of satisfactory standards. Improvements in our skill set will also benefit: peatland restoration, river restoration, construction of paths, active travel projects. | This risk now appears under effective management. As a relatively small organisation, staff turnover will have significant impacts on procurement processes, recruitment of technical staff, ability to undertake necessary due diligence on output specifications. Preventative: Recruitment of Procurement Officer Recruitment to new Procurement Officer post achieved. Preventative: explore back up from consultants and contractors. Preventative: Support secured from Scotland Excel (and from Central Government Procurement Shared Services (CGPSS) if required). Programme of improvement in procurement processes, procedures and arrangements — shared services and commercial back up including increasing controls well underway, including establishment of new Procurement Strategy. Construction projects of the size anticipated within the C2030 programme are new to the organisation. We need to improve our knowledge of Construction Design and Management Regulations (CDM) and contracts (NEC4). We lack experience in producing briefs and reviewing tenders of this size and type. Preventative: Consider delivery through partners with construction project delivery experience where appropriate to delivery objectives. Remedial: use of legal support or other outsourced support where required | 4 | 2 | 8 | Managed | | Preventative: Staff retention approaches and link to organisational devevlopment. Remedial: Continued focus on training and development of staff Preventative: licencing arrangements contribute to more effective control framework. | 31/03/2026 | Cautious | 4 | 2 | 8 | David Cameron | 11/05/2026 |
| A24 | 4 | Nature & conservation | Strategic delivery | Action on wildlife crime depends on the development, delivery and design of strategic partnerships. Financial constraints within the public and third sectors is likely to reduce the level of resource available to tackle this issue. No direct correlation between intervention and population increases due to complexity of factors, but tangible efforts demonstrate commitment to the issue. | The Authority’s range of powers combined with strategic partnerships is insufficient to deliver outcomes on wildlife crime. Wildlife crime is difficult to evidence and populations are affected by a variety of interrelated factors. Tracker/satellite monitoring deployed for some raptors. Data gathering to highlight presence/absence | 4 | 4 | 16 | Static | | Remedial: Development/strengthening of strategic partnerships. Remedial: NPPP development processes used to explore partnership attitudes, engagement and powers. Targeted, tangible intervention at known drivers of population decline. | Ongoing | Open | 4 | 3 | 12 | Andy Ford | 20/01/2025 |
| 6 | All | Systems development | Supporting speed of organisational change prevents required development and embedding of effective corporate support systems. The speed / scale of operational demand for support from corporate systems is such that we are more reactive and focused on project specific issues rather than proactively designing effective, generic support systems. However, that ongoing fire-fighting and immediate advice prevents us having sufficient time to design, develop and implement new systems to better suit the new organisation. | Remedial: recruitment of additional staff to corporate function during 22⁄23 and 23⁄24. Remedial: development of improved systems/ways of working through better use of M365 applications Remedial: Implement new finance system to support wider digitisation of systems and effective financial reporting. Preventative: design and implement project initiation controls supporting more managed timelines and fuller, earlier consideration of project plans. | 3 | 3 | 9 | Static | Initial mitigation actions now in place and embedding, including project initiation controls. New finance system installed on schedule by 31/03/25; new project initiation control system implemented during 2025. Further reinforcement of operation of controls now underway for 26⁄27 operational plan. Managers group also reviewing future streamlining approaches. | Remedial: apply resource to development of improved systems/ways of working including streamlining and clarifying systems Remedial: provide training — procurement and in wider assessment of project impacts at initiation stage. Remedial: ongoing roll-out and embedding of project initiation guidance. | 31/03/2027 | Open | 3 | 2 | 6 | David Cameron | 11/05/2026 |
| A13/A1 | 9 | All | Technical | CNPA IT services are not sufficiently robust/secure/or well enough specified to support effective and efficient service delivery. Increasing demand for knowledge around Microsoft 365 and cyber security is outstripping the team’s knowledge/skill-set. Increasing ICT dependency for effective and efficient operations is not adequately backed up by ICT systems support. Use of AI increases risk of cyber security threats such as spear-phishing. | Preventative: Daily review of Scottish Cyber Coordination Centre threat summaries, with follow up action taken (eg patching) as appropriate. Preventative/remedial: Collaboration with LL&TNPA provides support. Cyber Security Plus accreditation now in place and systems operating to those standards. Movement into Microsoft 365 deployment and cloud based systems continues to evolve and become embedded. Preventative: advisory internal audit commissioned Jan 26 to support planning of future systems development Cyber essentials accreditation is in the process of being renewed. Preventative: Transition to Sharepoint complete; R‑drive now a read-only repository, reducing risk of threats from outside the organisation. | 5 | 3 | 15 | Escalating | Development of the IT operational risk register has identified potential for structural improvement. These considerations to be developed further: action to be taken on advisory audit and business continuity planning once advice is received. Consideration given to effectiveness of shared services with LL&TNPA Action to be taken on advisory audit and business continuity planning: draft report now in place which highlights a significant action plan to be addressed. A review of IT staff role descriptions now completed; renewed focus on IT action plans will flow from that. Work on the information management plan will produce greater resilience of data and access to key information when complete. | Preventative: implement Cyber Security Plus controls | Ongoing | Cautious | 4 | 2 | 8 | David Cameron | 11/05/2026 |
| 10 | All | Technical | Business Continuity Plans (BCP) are inadequate to deal with significant impacts to normal working arrangements and result in service failure. | Preventative: Development of hybrid working methods and cloud computing approaches have improved the organisation’s resilience. Remedial: develop updated business continuity plan and embed its provisions | 5 | 4 | 20 | Static | Advisory audit on IT provision now commissioned and draft report under consideration. Outputs from this will plug into wider BCP which will be completed by 2026⁄27 year end. | Preventative: proposed consultancy to develop new BCP | 31/03/2027 | Minimal | 1 | 3 | 5 | David Cameron | 11/05/2026 |
| 11 | All | Reputation | Reputational damage may result from: — Unrealistic expectations of what the Park Authority and its partners can achieve in the face of the significant risks presented by climate change, species extinction, flood management and fire; and/or — Disagreement between the Park Authority and stakeholder groups within the Park. Disinformation circulated about the Park Authority’s actions | Preventative: Existing strategic partnerships and stakeholder relationships help to create a wider understanding of the factors that are within, and those that are outside the control of the Park Authority and its partners. Preventative: communications strategy development and implementation to ensure Park Authority’s messages and information are widely received and understood by appropriate audiences . — Development of stakeholder relationship database — Clear positioning on the Park Authority’s role / level of involvement in significant issues | 3 | 3 | 9 | Managed | Scoring reviewed following overview of NPPP delivery to be submitted to board in September, with likelihood decreased from 4 to 3. Stakeholder relationship database now designed and under development. Effective Wildfire Byelaw communications with strongly positive reactions to those communications helping enhance positive reputation. Overall sense of reputational management risks currently in a managed position. Future consultation in next NPPP for 2027 to 2032 will open further dialogue with all stakeholders. | Preventative: Management of expectations through: — Targeted communications — Further development of stakeholder relationships. — Development/strengthening of strategic partnerships. — Ongoing assessment of operational risk management and mitigation in our actions | Ongoing | Open | 3 | 3 | 9 | Grant Moir | 11/05/2026 |
| 13 | All | Strategic delivery | The Park Authority does not adequately respond or adpat to changes in funding or policy environment at Scottish Government policy levels; from external funding sources; or in evolution of private finance investment. | Preventative: allocate senior time to engagement with Scottish Government in policy discussion and development, identifying and responding to risk implications. Preventative: proactively identify opportunities for private investment and structures to support their investment to complement and support NPPP and corporate objectives. Preventative: prioritise time allocation to policy evolution, such as Public Service Reform | 3 | 2 | 6 | Decreasing | Positive relationships developed at senior levels on engagement with the Park Authority and our financial requirements. Multi-year workforce management and financial forecasts established to guide actions Work progressing on development of a private finance framework. Need identified to begin planning for end of C2030 financing period and replacement of NLHF funding within the Park Authority’s resource mix. Senior staff are fully engaged at a leadership level in Public Service Reform and wider policy evolution | Finalise private finance framework Public Service Reform actions on place based action and staff deployment flexibility; action on corporate services costs base. | 31.03.26 | Cautious | 2 | 2 | 4 | David Cameron | 11/05/2026 |
| 14 | All | Resources — staffing | The Park Authority’s workforce is not adequately flexible to respond to changing strategic priorities or to changing operational scale | Preventative: workforce management strategy updated and regularly reviewed to take a 5+ year forward view. Preventative: continued investment in training and development for staff supporting performance in current roles and succession/development plans. Preventative: establish an appropriate mix of permanent and fixed term staff to allow for flexibility in future structures. Remedial: retain scrutiny of all vacancies and identification of opportunities to adapt vacancies toward future needs. | 3 | 3 | 9 | Static | Workforce management strategy reviewed by board at busiess session, October 2025. This will now guide associated policy development work following full internal consultation. Mitigation actions progressing to plan. Resources Committee review of Workforce Management and wider Organisational Development and People Strategy 15 May, followed by staff consultation through remaindre of May and June 2026. | Consultation on workforce management strategy. Development of organisational policies supporting delivery of workforce management objectives. | 31.12.26 | Cautious | 3 | 1 | 3 | David Cameron | 11/05/2026 |
| 15 | All | Systems development | NPPP delivery responsibilities are not sufficiently clear across the partnership and Park Authority is expected to address more than it is capable to deliver. | Preventative: reinforce specific partner delivery responsibilities through performance management systems and reporting. Preventative: reinforce NPPP delivery linkages through grant contract terms. | 3 | 4 | 12 | Static | NPPP Performance Management dashboard now complete. | Partner engagement and clarity of responsibility to be addressed as aspect of development of 27 – 32 NPPP. | 31.12.26 | Open | 3 | 3 | 9 | Gavin Miles | 11/05/2026 |
| 16 | All | Technical | Evolution of the Park Authority’s range of activities and projects results in unidentified and unmitigated exposure to legal implications and associated liabilities | Preventative: undertake risk analysis overview of 2025⁄26 operational plan to identify any delivery areas with potential exposure; develop and deliver mitigation action plan | 2 | 4 | 8 | Decreasing | Evidence that prpoject initiation processes is working in drawing out potential legal implications of project plans. Continued evidence of widening scope of activitiy and innovation in finding delivery solutions which continues to require attention. Impact of risk assessed as down while likelihood increased. | Monitor effectiveness of system and level of any issues arising. New actions on this risk are embedded within the actions on project initiation and internal control systems noted against other risks. | TBC | Open | 3 | 2 | 6 | David Cameron | 11/05/2026 |
| 17 | Place | Strategic delivery | Uncertainties on finance, procurement, contractor capcity and partnership development combine to prevent achievement of key Cairngorms 2030 community transport infrastructure enhancements. | Preventative: pressure on external funders to make decisions within necessary timetable Preventative: revised procurement approach to simplify requirements and minimise perceived contractor risk Preventative: establish over-arching agreements with partners | 4 | 3 | 12 | Decreasing | Progress over 2025 in managing these external risks to programme delivery has been generally successful with consequential declining risk profile. | Preventative: Ongoing contact with external funders to secure funding for 2026⁄27. Development of memorandum of agreement with key local authority partner Preventative: Management Team Policy Day overview of programme status; evaluation of 2029 outcomes; identification of key actions and risk mitigations | Ongoing March 2026 | Cautious | 3 | 2 | 6 | Gavin Miles | 18/02/2026 |
| 18 | All | Resources — staffing | Delivery opportunities and external funding offers are lost as a consequence of constraints on staffing levels imposed by public policy and workforce management controls underpinned by external and non-core income. | Preventative: engage at senior levels with Scottish Government to ensure there is clarity in public policy with regard to workforce management actions and staffing levels Preventative: ensure internal workforce management policy and management procedure operates appropriately within the agreed national policy position Preventative: seek to move to a more dynamic and flexible staffing position allowing deployment of staff resource toward emerging priorities | 4 | 3 | 12 | Decreasing | Staffing levels managed against committed full time equivalent figure provided to Scottish Government in 2025 return. Monitoring of quarterly employment statistics against target figure. | | Ongoing | Cautious | 2 | 2 | 4 | David Cameron | 11/05/2026 |
| 7 | All | Resources — staffing | Scottish Government Main Group award 2023⁄25 creates significant financial pressure on the Park Authority’s resource budget for 2024⁄25, with the potential to affect positive relationships with the Union, staff morale and motivation, recruitment and retention. | Preventative: development of pay models to identify the potential cost to the Park Authority of following the Main Group position & consider the impact of potential pay strategies on the pay award dates and staged awards as tools to meet expectations while maintaining affordability Preventative: Staff and financial resources considered during budget development process for 24⁄25. | 3 | 3 | 9 | Managed | Pay models developed are being accommodated within the budget, based on indicative Grant-in-Aid funding for 2024⁄25. | | Open | 3 | 3 | 9 | David Cameron | 20/01/2025 |
| A9.3 | 8 | All | Resources — staffing | Our Corporate and Operational Planning systems do not adapt to delivery of major funded programmes alongside delivering ‘core’ national park objectives. This leads to workforce stretch between 3rd party funding delivery and ‘core’ corporate plan activities with increased risks of stress and reduced morale. | Preventative: Strategic and operational plans developed with externally funded project delivery as intrinsic elements of plans to ensure delivery capacity is considered fully. Preventative:Importance of staff management and task prioritisation reinforced through leadership meetings. Additional recruitment has alleviated key staff pressure points. Fixed term staff contracts reviewed throughout the year. Staff survey results (23÷24) positive. Preventative:Focus on fewer, larger impact projects (C2030). Remedial: Performance Development Conversations (PDCs) being deployed regularly with all staff to check on staff workloads, with 2 way flows of communications enabled through that process on staff workload and capacity. Preventative: Staff and financial resources for C2030 considered alongside operational plan activity as part of budget development process for 24⁄25. | 3 | 3 | 9 | Managed | Impact score of 3 reflects the risks inherent in the likely intensity of work during initial stages of C2030.Likelihood of risk therefore held static. Impact of measures and risk profile will continue to be closely monitored through staff management processes. | | Open | 3 | 3 | 9 | David Cameron | 20/01/2025 |
| A29 | 12 | All | Resources — staffing | Scottish Government pay remit for 24⁄25 is lower than desired pay award. Pay expectations of staff may not be met, leading to issues with pay alignment with other NDPBs and consequent effect on staff morale and motivation | Preventative: Development and submission of business case for pay alignment in keeping with SG national two-year sectoral pay award. | 1 | 2 | 2 | Managed | SG remuneration Group turned down initial business case. Amended business case submitted and approval received end Aug 24. Staff consultation underway to end Oct. Seasonal staff position resolved satisfactorily. Awards for coming three years agreed | | 31/12/2024 | Open | 1 | 2 | 2 | David Cameron | 20/01/2025 |
| 5 | All | Resources — staffing | Increasingly competitive and restricted recruitment climate prevents staff with the required experience and skill sets being secured. Planning and other specialist staff (IT, procurement, finance) requirements impacted by national labour/skills shortages and/or salary structures not sufficiently competitive to attract or retain key staff. | Preventative: focus on training and development and internal succession planning, in turn bringing recruitment into less experienced/less highly skilled markets and developing pipeline of qualified staff Preventative: consideration given to job design, creating roles with more seniority (higher grades), and flexibility of offer regarding part- time/job share. | 2 | 2 | 4 | Managed | Evidence of reducing number of applicants and candidate lists for vacancies ongoing, while trend in unsuccessful recruitment exercises has been acted on with no recent unsuccessful recruitment. Successful recent recruitment in difficult sectors including procurement and planning.Salary structures reviewed with three year pay position now agreed. | Remedial: contingency planning for example around out-sourcing of aspects of delivery eg establish call-off framework for consult planning services. | 31/03/2025 | Open | 2 | 3 | 6 | David Cameron | 12/05/2025 |