Audit and Risk Committee - Minutes 210325
Cairngorms National Park Authority Ughdarras Pàirc Nàiseanta a’ Mhonaidh Ruaidh
Page 1 of 14
Draft minutes of the Audit and Risk Committee meeting
Held at Cairngorms National Park Authority office, Grantown-on-Spey [Online] 21 March 2025 at 09.30am
Present online Fiona McLean (Chair) Kenny Deans (Sub) Bill Lobban Peter Cosgrove (Deputy Chair) Paul Gibb
In attendance Elizabeth Young, Azets Tom Reid. Mazars Ishna Singh. Mazars Grant Moir, Chief Executive Officer David Cameron, Deputy Chief Executive Officer and Director of Corporate Services Louise Allen, Head of Finance and Corporate Operations Mikko Saari, Procurement Officer Alix Harkness, Clerk to the Board
Apologies Geva Blackett Duncan Miller
Welcome and introduction
- Fiona McLean, Chair of the Audit and Risk Committee, welcomed everyone to the meeting. Apologies were noted.
Cairngorms National Park Authority Ughdarras Pàirc Nàiseanta a’ Mhonaidh Ruaidh
Page 2 of 14
Approval of minutes of previous meetings
- The draft minutes of the previous Audit and Risk Committee meeting held on 8 November 2024 were approved with no amendments
Matters arising not covered elsewhere
- There were no matters arising.
Ref | Action Detail | Who | When | Status |
---|---|---|---|---|
27/09/24 | At para 20i iv. Update on internal audit view on financial scenario planning to be provided to the Audit and Risk Committee | David and Stephanie | At the end of the 24⁄25 financial year. | Ongoing |
27/09/24 | At para 36ii vi. CEO to mention the impact the Procurement Officer is making in the organisation within his next CEO report for Board meeting on 22 November 2024. | Grant | Next Formal Board meeting on 22 November 2024 | Complete |
From today’s meeting | ||||
08/11/24 | At para 10a i. A meeting between Azets and Head of Finance and Corporate Operations to discuss examples of what evidence Is required to complete outstanding actions. | Louise/Stephanie | On Agenda today |
Cairngorms National Park Authority Ughdarras Pàirc Nàiseanta a’ Mhonaidh Ruaidh
Page 3 of 14
| |At para 10b i. Stephanie Hume, Azets to look at potentially changing the wording “incomplete” and “partially complete” to something more transparent.|Stephanie| | | |08/11/24|At para 10c i. Officers to carry out a recruitment audit and a financial planning audit within the current financial year.|David/ Louise| |complete| |08/11/24|At para 18b i. Update the risk register to show upskilling and training Is being delivered.|David/ Louise| |complete| |08/11/24|At para 26b i. Information manager to provide Committee members with the number of requestees for FOISA.|Paul|20 June 2025 meeting|open|
Declarations of interest
- There were no declarations of interest.
External Audit Plan 2024⁄25 (Paper 1)
- Ishana Singh, Mazars presented the paper which sets out the external auditor’s plan for the forthcoming audit of the 2024⁄25 Annual Report and Accounts.
Bill Lobban joined the meeting at 9.36am
Cairngorms National Park Authority Ughdarras Pàirc Nàiseanta a’ Mhonaidh Ruaidh
Page 4 of 14
David Cameron, Deputy CEO and Director of Corporate Services advised that he had had a good discussion with the audit team and agreed with approaches set out in the report. Louise Allen, Head of Finance and Corporate Operations welcomed the slight adjustment to the timetabling to accommodate Daniel Ralph, Financial Accountant’s retirement at the end of April 2025.
The Audit and Risk Committee discussed the report and made the following comments and observations: α) Fiona McLean, the Audit and Risk Committee Chair thanked Daniel Ralph on behalf of the Committee for his valuable contribution over the years and wished him a very enjoyable retirement. b) On Paper 1 Annex 1, could the name of the organisation be spelled correctly? The ‘s’ at the end of Cairngorms was missing. Ishana Singh, Mazars apologised and agreed to correct it. c) With reference to IT Policies on page 17 of the Annex to the paper, there was a follow on recommendation concerning IT change management and user access to which no management update had been provided. Louise Allen, Head of Finance and Corporate Operations advised that the IT team were currently undergoing a government cyber health check and that the need for better documentation had also been raised during this work. As a result, documentation is being prepared. However, she reassured the Committee that while there was a lack of documentation„ the team are exercising appropriate change management and user access procedures. d) Deputy CEO and Director of Corporate Services added that management were content with the fee quoted in the report and had recently received Audit Scotland’s fee structure for the year, which provided the reassurance that the fee quoted by Mazars was midpoint in that. e) With reference to page 18 of the Annex to the paper, bullet point one how many companies does the organisation have in the current accounting system? Head of Finance and Corporate Operations clarified that the point raised by the auditors relates to the way the Cairngorms National Park Authority are recording in the existing finance system the transactions within the various projects it undertakes; Cairngorms 2030, Capercaillie project, Tomintoul and Glenlivet Landscape Partnership etc were being treated as separate companies. This was our Finance Manager’s way of keeping separate the transactions relating to different funding streams within our
Cairngorms National Park Authority Ughdarras Pàirc Nàiseanta a’ Mhonaidh Ruaidh
Page 5 of 14
f) Sage accounting system. She acknowledged that this approach is difficult for the auditors and that it results in the need to manipulate transactions outside the finance system in Excel spreadsheets, with all the potential for human error associated with extensive spreadsheet use. On page 25 of the Annex to the Paper, ‘Significant risks’ what potential is there for error and fraud? Tom Reid, Mazars explained that this risk is standard on all public sector audit plans and it is as a result of the position that management are in, where they can override controls merely by the nature of their being in a management position. Head of Finance and Corporate Operations advised that monthly monitoring and scrutiny of the accounts being presented to management team monthly reduces the risk of that happening.
The Audit and Risk Committee noted the paper and agreed the recommendations.
- Action Points Arising: None.
Internal audit progress report (Paper 2)
Elizabeth Young, Azets presented the paper which sets out progress against the internal audit programme for 2024⁄25 prepared by Azets.
The Audit and Risk Committee noted the paper and agreed the recommendations.
Action Points Arising: None.
Strategic risk registers (Paper 3)
Louise Allen, Head of Finance and Corporate Operations presented the paper which sets out a review by the Committee of the Park Authority’s strategic risk management position.
David Cameron, Deputy CEO and Director of Corporate Services advised that the Strategic Risk register also formed part of Budget and Operational Plan paper to be presented to the Board at its meeting on 28 March. He explained that risk 11 had been amended to reflect the element of reputational risk arising from disinformation. This change had been reflected in the Board paper annex but the papers for this Committee had already been issued and did not include this change.
The Audit and Risk Committee discussed the report and made the following comments and observations:
Cairngorms National Park Authority Ughdarras Pàirc Nàiseanta a’ Mhonaidh Ruaidh
Page 6 of 14
α) Audit and Risk Committee Convener reported that it was good to see the risk score improving of 1,2,3, 9 and noted that there were 13 active risks. a) Question posed around risk 13 that it may be fits within risk 1 however noted that the Board had been keen to keep it as a separate risk. Deputy CEO and Director of Corporate Services advised that the separation of risks 1 and 13 had been his attempt to distil the conversations the Board had had at the horizon scanning discussion. Risk 13 is more around policy development and potential impact on finances, with the Scottish parliamentary election taking place next year, it seems important to have it separately on the register. b) The Convener raised her concern around shoehorning risk 13 on policy development into the category of financial risk, when the risk also relates to operational activity. Deputy CEO agreed to look into the wording; he explained there is a risk to our funding position as it gets squeezed as a result of other competing Scottish Government priorities such as a new National Park. It is important to ensure that our priorities as set out in the National Park Partnership Plan match the priorities at a Scottish Government level. The Committee agreed that the Convener raise this at the Board meeting next week.
The Audit and Risk Committee noted the paper and agreed the recommendations: α) Consider the coverage and adequacy of the Park Authority’s strategic risk management position and advise on any gaps or amendments required to the current strategic risk register. b) Consider the coverage and adequacy of the Cairngorms 2030 programme risk management position and advise on any gaps or amendments required to the current programme risk register.
Action Points Arising: None.
Draft Governance statement (Paper 4)
Louise Allen, Head of Finance and Corporate Operations presented the paper setting out the draft Governance Report, which forms part of the Annual Report and Accounts, to the Committee for review and comment prior to inclusion in the draft accounts submitted for external audit.
The Audit and Risk Committee noted the paper and agreed the recommendations:
Cairngorms National Park Authority Ughdarras Pàirc Nàiseanta a’ Mhonaidh Ruaidh
Page 7 of 14
α) Reviewed the draft Governance Statement presented with this paper. b) Subject to any agreed amendments, approved the Governance Statement for inclusion in the Park Authority’s draft Annual Report and Accounts for 2024⁄25.
- Action Points Arising: None.
Mikko Saari joined the meeting at 10am
Procurement Action Plan (Paper 5)
Louise Allen, Head of Finance and Corporate Operations presented the paper, which sets out an action plan towards improvement of the Park Authority’s procurement processes, procedures and internal controls. It has been developed in response to the Internal Audit review of procurement carried out by Azets as part of the approved 2023⁄24 audit programme.
The Audit and Risk Committee discussed the report and made the following comments and observations: α) The Convener expressed her thanks to Mikko Saari, Procurement Officer for being on board and for creating a culture shift within the organisation, and thanked Louise Allen, Head of Finance and Corporate Operations. b) Peter Cosgrove, Audit and Risk Committee Deputy Convener reported that he had reflected on concerns on this area last year together with the recommendations as stated in the paper and reported that he could see that good and steady progress had been made and is therefore more comfortable with where we are now. Peter reflected that the next meeting may be an appropriate point to consider removing this matter as a standing item from the Committee’s agenda. c) The Convener praised the transformation in position from last year.
The Audit and Risk Committee reviewed the progress made against each activity in the programme for improvement developed by management.
Action Points Arising: None.
Cairngorms National Park Authority Ughdarras Pàirc Nàiseanta a’ Mhonaidh Ruaidh
Page 8 of 14
Procurement guidance (Paper 6)
Louise Allen, Head of Finance and Corporate Operations presented the paper which sets out recently developed guidance for colleagues, outlining the Park Authority’s procurement processes. It has been developed in response to the Internal Audit review of procurement and is delivered in satisfaction of the Procurement Action Plan. Mikko Saari presented the work being done on developing new procurement processes within the organisation to the Committee.
The Audit and Risk Committee discussed the report and made the following comments and observations: a) Question raised around declaring interests such as friendships and associations: those working in peatland restoration for example would establish good working relationships with contractors. Mikko Saari, Procurement Officer advised that he mitigates any bias as he compiles the tender evaluations prepared by the operational team, and gives recommendations based on the scores alone; everyone in evaluation team has to agree on the winning bidder. David Cameron, Deputy CEO and Director of Corporate Services advised that he is aware of the levels of connection staff may have with contractors, fine for staff to build relationships and advised that the National Park Authority also have a staff register of interests whereby any significant connections can be reviewed and tested by senior staff prior to involvement of staff in procurement activity. b) How did the procurement work for cycle paths? Procurement Officer advised that it split into smaller parts, to allow local contractors to bid as well. c) Comment made that it was a clear paper and praised the oversight and loop back. d) Discussion around how to put locality as a criterion for bids. Could put standard criteria, eg sustainability by way of community benefit carbon impact/climate impact, retention of jobs/creation of jobs apprenticeships. Agreement in carrying out an analysis over a year, of the contracts awarded how many companies were based in the Cairngorms National Park, how many around and how many out with Cairngorms, to the extent that data held allows this analysis. This is to be brought back to the Committee. e) With reference to page 6 on Annex 1 of the Paper, the use of conflict of interest instead of declarations of interest. Head of Finance and Corporate Operations agreed to add an additional bullet point to differentiate it.
Cairngorms National Park Authority Ughdarras Pàirc Nàiseanta a’ Mhonaidh Ruaidh
Page 9 of 14
f) Head of Finance and Corporate Operations added that with smaller procurement contracts we are able to support smaller businesses as legal rules are less onerous. g) The Convener praised the work noting that significant progress was being made.
The Audit and Risk Committee noted the paper and: a) Reviewed the guidance and consider its suitability to support the Authority’s staff in carrying out procurement in the public sector environment. b) Considered whether the document meets the Internal Audit recommendations noted on the Procurement Action Plan.
Action Points Arising: i. Statistical analysis to be brought back to the Committee showing of the contracts awarded how many companies were based in the Cairngorms National Park, how many around and how many out with over the course of one year. ii. Head of Finance and Corporate Operations to differentiate between conflict and declaration of interest on page 6 of the Procurement Action Plan.
Internal Audit Report Management Action Follow up (Paper 7)
Louise Allen, Head of Finance and Corporate Operations presented the paper which sets out the internal auditor’s independent overview of management action taken on previous internal audit recommendations raised and agreed (Annex 1). The follow up review work reported here is part of the internal audit programme agreed for 2024⁄25.
Elizabeth Young, Azets made the observation that more than half of the actions were more than two years old and asked the Audit and Risk Committee to consider whether they were still relevant and they wanted to continue to pursue them?
The Audit and Risk Committee discussed the report and made the following comments and observations: α) The organisation name on page 2 of the Annex was spelled wrongly. Elizabeth Young, Azets apologised and agreed to correct it.
Cairngorms National Park Authority Ughdarras Pàirc Nàiseanta a’ Mhonaidh Ruaidh
Page 10 of 14
b) Appendix 1 action by report — the totals at the bottom do not match the numbers in the table. Reading the progress made on some of the recommendations, it seemed inaccurate to categorise them as partially complete? Azets apologised for the inaccuracy in the numbers and advised that ‘partially complete’ is a standard phrase used. Actions are assessed and only marked as complete once the auditors have seen all the documentation. It was suggested that the assessment could be changed to ‘substantially complete’ where appropriate. c) Deputy CEO and Director of Corporate Services advised that the follow up report provided a good start point to establish the position with the remaining recommendations. Given the number of linked operational strands in many cases, for example IT strategy, cyber security, information management he suggested an overview report in each subject area setting out where we are on all the remaining linked items and detailing the outstanding actions the Committee should sign off on going forward. and any impact in context of the Strategic Risk Register would be an approach to update the position and clarify future action. He suggested bringing two or three reports to the Committee under different topics: IT management strands, grant funding and program management. The Committee supported this approach. They commented that this seemed proportionate and reasonable. d) Head of Finance and Corporate Operations reported that she did not want to undermine any recommendations the auditors had made. She recalled in December 2022 the finance team were working with paper documents and that the changes made to digitize records since that time mean that we are now a completely different organisation. A number of recommendations have sat for a long time and have been stuck as there were a number of sequential improvements required to achieve completion on the recommendation; despite the remaining outstanding recommendations where we are now reflects considerable progress. The Convener acknowledged that, and the significance of the internal audit reports and Deputy CEO and Director of Corporate Services echoed both this and the huge organisational improvement. e) A member asked if it would be possible to have a workshop over a one- or two-hour window on an already scheduled board day. Deputy CEO and Director of Corporate Services advised that the capacity to do this would depend on priorities. He agreed to liaise with the Head of Finance and
Cairngorms National Park Authority Ughdarras Pàirc Nàiseanta a’ Mhonaidh Ruaidh
Page 11 of 14
Corporate Operations and the internal auditors to assess the staff capacity to review all of these things in a timely way. He agreed to come back to the Committee in June with an assessment of priorities and the key risk areas, and then bring a paper to a subsequent meeting, depending on staff capacity
The Audit and Risk Committee noted the paper and agreed the recommendations: α) Noted the progress made by management in implementing agreed management actions; and b) Noted the actions planned in respect of those recommendations that remain outstanding.
Action Points Arising: i. Paper detailing the priority of key risk areas to include a timetable of future reports on the strands to be brought to the next meeting.
Appointment of Internal Auditor 2025 – 28 (Paper 8)
David Cameron, Deputy CEO and Director of Corporate Services presented the paper which sets out an update on the process underway to appoint an independent internal auditor for the period 2025 to 2028. He added that it had come to a conclusion in the last day or two. Azets had not been successful; the successful company were a Scottish based firm and the full detail would follow via email at a later date. He recognised the huge value Azets had contributed to the development of the Park Authority over their period of appointment.
The Audit and Risk Committee Convener thanked Elizabeth Young and team from Azets for all their work and professionalism.
The Audit and Risk Committee noted: α) the update on the appointment of internal auditor for 2025 to 2028 b) that an internal audit plan will be presented to a future committee meeting following completion of the appointment process
Action Points Arising: None.
Cairngorms National Park Authority Ughdarras Pàirc Nàiseanta a’ Mhonaidh Ruaidh
Page 12 of 14
Internal Audit Plan 2024⁄25: Cairngorms 2030 (Paper 9)
Louise Allen, Head of Finance and Corporate Operations presented the paper which sets out the review of the arrangements in place for the delivery phase of Cairngorms 2030, including whether there is a robust governance structure in place. This included consideration of the internal reporting arrangements in place, including reporting on NLHF funding claims, and the extent to which ongoing reporting and monitoring has been integrated as far as possible into wider organisational reporting.
The Audit and Risk Committee: α) Considered the internal auditors report and findings. b) Endorsed the management responses to recommendations for future action and improvements.
Action Points Arising: None. Mikko Saari left the meeting at 11.07am
AOCB
- None
Ref | Action Detail | Who | When | Status |
---|---|---|---|---|
21/06/24 | At para 341 Lessons learned briefing for the committee for the next meeting | David | Will come to meeting in June/Sept depending on staff time available | Open |
21/06/24 | At para 34m Chair and Deputy Chair to receive monthly updates of progress against the action plan | David and Louise | Monthly updates have been issued since June meeting | In Progress |
27/09/24 | At para 20i v. Update on internal audit view on financial scenario planning to be provided to the Audit and Risk Committee | David and Stephanie | At the end of the 24⁄25 financial year. | Ongoing |
Cairngorms National Park Authority Ughdarras Pàirc Nàiseanta a’ Mhonaidh Ruaidh
Page 13 of 14
|08/11/24|At para 26b ii. Information manager to provide Committee members with the number of From today’s meeting requestees for FOISA.|Paul|20 June 2025 meeting|open| |21/03/25|At para 28 i. Statistical analysis to be brought back to the Committee showing of the contracts awarded how many companies were based in the Cairngorms National Park, how many around and how many out with over the course of one year.|Louise||| ||ii. Head of Finance and Corporate Operations to differentiate between conflict and declaration of interest on page 6 of the Procurement Action Plan.|Louise||| |21/03/25|At Para 33 i. Paper detailing the priority of key risk|David|||
Cairngorms National Park Authority Ughdarras Pàirc Nàiseanta a’ Mhonaidh Ruaidh
Page 14 of 14
| | areas to include a timetable of future reports on the strands to be brought to the next meeting.||||
Date of Next Meeting
- The date of the next meeting is 20 June 2025
- The Convener moved a motion to move into confidential session.
- The meeting concluded at 11.07 am.