Paper 3 - Annex 1 Internal Audit Planning

wby Cairngorms Nation­al Park Author­ity Audit Needs Assess­ment ²⁰²⁵⁄₂₆ to ²⁰²⁷⁄₂₈ June 2025 Audit and Risk Com­mit­tee Paper 3 Annex 1 15 June 2025

Table of Con­tents Sec­tion Page num­ber Intro­duc­tion 3 Approach 4 Oper­a­tion­al Plan ²⁰²⁵⁄₂₆ 8 Report­ing 15 Ini­tial 3‑year Audit Needs Assess­ment ²⁰²⁵⁄₂₆ to ²⁰²⁷⁄₂₈ 16

Appen­dices: A. Grad­ing Struc­ture B. Key Per­form­ance Indic­at­ors C. Train­ing Top­ics D. Assur­ance Map E. Audit Uni­verse 18 19 20 21 28

Intro­duc­tion wbg Back­ground Wbg Ser­vices LLP (Wbg) have been appoin­ted as Intern­al Aud­it­ors by Cairngorms Nation­al Park Author­ity (the Organ­isa­tion) Audit & Risk Com­mit­tee for an ini­tial one year peri­od from 1 April 2025 to 31 March 2026 with the option to extend for a fur­ther two years.

Intern­al Audit The prime respons­ib­il­ity of the Intern­al Audit Ser­vice (IAS) is to provide the Board, via the Audit & Risk Com­mit­tee with an object­ive assess­ment of the adequacy and effect­ive­ness of management’s intern­al con­trol systems.

The IAS object­ively exam­ines, eval­u­ates and reports on the adequacy of intern­al con­trol thus con­trib­ut­ing to the eco­nom­ic, effi­cient and effect­ive use of resources and to the reduc­tion of the poten­tial risks faced by the Organisation.

The oper­a­tion and con­duct of the IAS must com­ply with the stand­ards and guidelines set down by the Insti­tute of Intern­al Aud­it­ors, includ­ing the Glob­al Intern­al Audit Stand­ards which came into effect from Janu­ary 2025, as well as the Pub­lic Sec­tor Intern­al Audit Standards.

Terms of Ref­er­ence — Intern­al Audit The pro­vi­sion of the IAS by Wbg is covered by the let­ter of engage­ment dated 28 April 2025.

Form­al Approv­al The Audit Needs Assess­ment (ANA) will be presen­ted to Audit & Risk Com­mit­tee for dis­cus­sion and approv­al on 20 June 2025.

Approach Plan­ning pro­cess and review wbg

Approach The Audit Needs Assess­ment (“ANA”) has been pro­duced based on the fol­low­ing: Con­sid­er­a­tion of the risks noted with­in the Organisation’s Stra­tegic Risk Register; Con­sid­er­a­tion of pre­vi­ous intern­al audit cov­er­age and the key find­ings from these reports; wby An ini­tial meet­ing held with the Seni­or Man­age­ment Team (SMT), with a fol­low up meet­ing with the Deputy CEO / Dir­ect­or of Cor­por­ate Oper­a­tions and the Head of Fin­ance and Cor­por­ate Operations.

Meet­ing with the Chair of the Audit & Risk Com­mit­tee. Pre­par­a­tion of an Assur­ance Map; The iden­ti­fic­a­tion of key con­trols and asso­ci­ated risks for each sys­tem and sub-sys­tem; and The determ­in­a­tion of the intern­al audit resource required to meet the iden­ti­fied audit needs.

Plan­ning Pro­cess Below is a dia­gram which details our plan­ning pro­cess: Under­stand­ing the organ­isa­tion­al context

Review­ing and revis­ing the plan Intern­al Audit plan­ning process

Eval­u­at­ing the risk man­age­ment process

Com­mu­nic­at­ing and agree­ing the plan Design­ing the audit plan wbg

Revis­it­ing the ANA wbg The ANA will be reviewed con­tinu­ously through­out our appoint­ment and will take account of the res­ults of audit work, the devel­op­ment of new sys­tems and any oth­er risk factors iden­ti­fied. Any pro­posed changes to the ANA will be presen­ted to the the Audit & Risk Com­mit­tee on at least an annu­al basis for dis­cus­sion and approv­al. We have set out below the pro­posed Audit Team. Gra­ham Gillespie Peter Clark Scott McCready Andrew Thom­son Kev­in McDer­mott Part­ner and Head of Dir­ect­or of Intern­al Intern­al Audit Intern­al Audit gg@​wbg.​co.​uk Audit pcc@​wbg.​co.​uk Intern­al Audit Seni­or Seni­or IT Aud­it­or Man­ager smc@​wbg.​co.​uk at@​wbg.​co.​uk kmd@​wbg.​co.​uk

Oper­a­tion­al Plan ²⁰²⁵⁄₂₆ wbg

Gov­ernance and New Fin­ance Sys­tem Audit area Gov­ernance High level indic­at­ive sum­mary scope The pur­pose of this review is to assess wheth­er the Organ­isa­tion has appro­pri­ate gov­ernance arrange­ments in place and that these have been embed­ded through­out. This review aims to provide assur­ance that the Organisation’s cor­por­ate gov­ernance arrange­ments are appro­pri­ate and rep­res­ent good prac­tice. Our object­ives for this review are to assess wheth­er: There is an effect­ive scheme of gov­ernance in place. There is effect­ive lead­er­ship at the Organ­isa­tion. There are effect­ive rela­tion­ships and com­mu­nic­a­tion chan­nels in place with extern­al bod­ies. Clear respons­ib­il­it­ies and report­ing arrange­ments are estab­lished and are being fol­lowed. There are effect­ive scru­tiny arrange­ments in place which are being fol­lowed. There is a form­al meet­ing struc­ture in place. The Organisation’s gov­ernance arrange­ments meet the frame­work document(s) agreed between CNPA and the Scot­tish Gov­ern­ment, guided by the Nation­al Parks (Scot­land) Act 2000.

New Fin­ance Sys­tem The pur­pose of the assign­ment will be to review the imple­ment­a­tion of the new fin­ance sys­tem to assess wheth­er the sys­tem is work­ing as anti­cip­ated. We will also review the imple­ment­a­tion pro­cess to ensure that dead­lines and costs were met, and that staff have received suf­fi­cient train­ing on the sys­tem. Our object­ives for this review are to assess wheth­er: | The new Fin­ance Sys­tem is fit for pur­pose and oper­at­ing in line with good prac­tice. Data has been accur­ately trans­ferred from the pre­vi­ous Fin­ance Sys­tem. Suf­fi­cient train­ing has been giv­en to those staff who will be using the new Fin­ance Sys­tem. | Appro­pri­ate con­trols have been put in place over the new Fin­ance Sys­tem and these are being adhered to by staff. wbg Total num­ber of days 8

8

Cyber Secur­ity Audit area Cyber Secur­ity High level indic­at­ive sum­mary scope The scope of this review is to be con­firmed fol­low­ing dis­cus­sions between the Organ­isa­tion and Wbg.

The Organ­isa­tion have achieved Cyber Essen­tials Plus accred­it­a­tion and have worked with the Scot­tish Government’s pilot pro­gramme (HEFEST­IS Path­way) to assess cyber matur­ity assess­ment and bench­mark­ing. This pro­gramme included access to Path­way tool­sets and the Pub­lic Sec­tor Cyber Resi­li­ence Frame­work (PSCRF) guidance.

Our scop­ing dis­cus­sions will con­sider under­tak­ing an assess­ment of the Cyber Essen­tials Plus cri­ter­ia, which the Organ­isa­tion has met, against the Nation­al Cyber Secur­ity Centre’s 10 steps to Cyber Secur­ity Guid­ance to help identi­fy any gaps. wbg Total num­ber of days 8

Pro­ject Ini­ti­ation Audit area High level indic­at­ive sum­mary scope Fol­low­ing the launch of the pro­ject con­trol sys­tem in June 2025, we will assess wheth­er this is work­ing as anti­cip­ated and is being com­plied with and rep­res­ents the appro­pri­ate level of con­trol. We will assess the new con­trol mech­an­isms being imple­men­ted from June 2025. We will also assess wheth­er fund­ing con­di­tions are being met. Our object­ives for this review are to assess wheth­er: Roles and respons­ib­il­it­ies for pro­ject man­age­ment are clearly defined and key staff are aware of their spe­cif­ic roles. Cri­ter­ia is in place to ensure key pro­ject decisions are fully informed at the out­set, includ­ing scope defin­i­tion, budget­ing and risk man­age­ment. Pro­ject Initiation

Decisions are made timely and at an appro­pri­ate level. Pro­ject out­comes and when bene­fits will be real­ised are iden­ti­fied at the out­set. These are meas­ur­able and pro­gress against these are repor­ted on, at agreed inter­vals. Iden­ti­fied pro­jects com­ply with reg­u­lat­ory require­ments, any fund­ing require­ments and align with the stra­tegic object­ives of the Organ­isa­tion. The Organ­isa­tion review pro­cure­ment plan­ning and com­pli­ance with pub­lic pro­cure­ment reg­u­la­tions, includ­ing early engage­ment of pro­cure­ment and adher­ence to pro­cure­ment thresholds. The pro­ject con­trol sys­tem is being adhered to. wbg Total num­ber of days 8

Grants Admin­is­tra­tion & Man­age­ment and Fol­low Up Review Audit area Grants Admin­is­tra­tion & Man­age­ment Fol­low Up Review High level indic­at­ive sum­mary scope The pur­pose of the review is to ensure that the Organ­isa­tion is oper­at­ing effi­ciently and effect­ively in respect of its grants admin­is­tra­tion and man­age­ment. We will under­take test­ing of the pro­cess to assess if the Organisation’s pro­ced­ures are being adhered to. Our review will con­sider the new expres­sion of interest sys­tem and the new grants pro­gramme. This review seeks to provide assur­ance to the Board, via the Audit & Risk Com­mit­tee, that the Organisation’s arrange­ments are adequate. Our object­ives for this review are to assess wheth­er: The Organ­isa­tion has robust arrange­ments in place for admin­is­ter­ing and man­aging grants. The Organ­isa­tion is con­sist­ent in its approach to nego­ti­at­ing, record­ing, and mon­it­or­ing grants. Staff are aware of these arrange­ments and are adher­ing to these. The Organ­isa­tion has the effect­ive qual­ity assur­ance arrange­ments in place for grants. The Organ­isa­tion has suf­fi­cient mon­it­or­ing and track­ing of grants. The Organ­isa­tion has appro­pri­ate report­ing mech­an­isms sur­round­ing the Organisation’s pro­vi­sion where robust per­form­ance meas­ures have been iden­ti­fied and are repor­ted against.

The effect­ive­ness of the intern­al con­trol sys­tem may be com­prom­ised if man­age­ment fails to imple­ment agreed audit recom­mend­a­tions. Our fol­low up work will provide Audit & Risk Com­mit­tee with assur­ance that pri­or year recom­mend­a­tions are imple­men­ted with­in the expec­ted times­cales. Our object­ive for this review is to assess wheth­er: | The Organ­isa­tion has appro­pri­ately imple­men­ted any out­stand­ing intern­al audit recom­mend­a­tions made in pri­or years. wby Total num­ber of days 8

5

Assign­ment Plans & Dates Assign­ment Plans wbg A detailed assign­ment plan will be pre­pared for each audit under­taken, set­ting out the scope and object­ives of the work, alloc­at­ing resources and estab­lish­ing tar­get dates for the com­ple­tion of the work. Each assign­ment plan will be agreed and signed off by an appro­pri­ate spon­sor from the the Organisation.

Key Dates Vis­it Name No. of audit days Key per­son­nel Pro­vi­sion­al start date for vis­it Pro­vi­sion­al date of issue of draft report Pro­vi­sion­al date for report­ing to Audit & Risk Com­mit­tee Gov­ernance Dir­ect­or of 8 Cor­por­ate Ser­vices 1 10 Novem­ber 2025 28 Novem­ber 2025 March 2026 New Fin­ance Sys­tem 8 Head of Fin­ance & Cor­por­ate Oper­a­tions Dir­ect­or of Pro­ject Ini­ti­ation 8 Cor­por­ate Ser­vices 2 1 Decem­ber 2025 19 Decem­ber 2025 March 2026 Dir­ect­or of Fol­low Up Review 5 Cor­por­ate Ser­vices 4 Grants Admin­is­tra­tion & Man­age­ment 8 Com­munity Grants Man­ager 12 Janu­ary 2026 30 Janu­ary 2026 March 2026 Head of Fin­ance & 3 Cyber Secur­ity 8 Cor­por­ate Oper­a­tions 16 Feb­ru­ary 2026 6 March 2026 June 2026

Report­ing & Ini­tial 3‑year Audit Needs Assess­ment wbg

wbg Report­ing The report­ing arrange­ments for intern­al audit will be dis­cussed and agreed with the Audit & Risk Committee.

The fol­low­ing reports will be pro­duced by intern­al audit: | An Audit Needs Assess­ment; A report on each audit assign­ment; An annu­al report on Intern­al Audit Service’s activities.

For each audit report we will have an over­all level of assur­ance. For each recom­mend­a­tion, a tar­get date for remedi­al action will be set tak­ing into account the degree of pri­or­ity asso­ci­ated with the recom­mend­a­tion. The draft report for each assign­ment will be dis­cussed with the audit­ees and the fac­tu­al accur­acy agreed pri­or to issue of the report in its final form. The audit­ees will be required to respond to the recom­mend­a­tions stat­ing their pro­posed action and nom­in­at­ing the per­son respons­ible for each action point.

Fin­an­cial Con­trols Payroll Pro­cure­ment Ini­tial 3‑year Audit Needs Assess­ment 1 April 2025 to 31 March 2028 Sys­tem Fin­an­cial Sys­tems Audit Area New Fin­ance Sys­tem Oper­at­ing Plan (No. Of days) ²⁰²⁵⁄₂₆ 8 ²⁰²⁶⁄₂₇ ²⁰²⁷⁄₂₈ 8

8

Stra­tegic and Gov­ernance Gov­ernance C2030 Mid Pro­gramme Review Risk Man­age­ment 8

8 8 Oper­a­tion­al Pro­ject Ini­ti­ation 8 Grants Admin­is­tra­tion & Man­age­ment 8 Busi­ness Con­tinu­ity & Dis­aster Recov­ery 8 Work­force Man­age­ment 8 CRM Sys­tem 8 Oper­a­tion­al Plan­ning 8 Inform­a­tion Tech­no­logy Cyber Secur­ity 8 Inform­a­tion Man­age­ment Con­trols or IT Strategy 8 Required Fol­low Up Review 5 5 5 Audit Man­age­ment 5 5 5 Total 50 50 50 wbg

Appen­dices A – Grad­ing Struc­ture B – Key Per­form­ance Indicators

C – Train­ing Topics

D – Assur­ance Map

E – Audit Universe

wbg

A – Grad­ing Struc­ture For each area of review, we assign a grad­ing in accord­ance with the fol­low­ing clas­si­fic­a­tion: wbg Assur­ance Clas­si­fic­a­tion Strong Sub­stan­tial Weak No Con­trols sat­is­fact­ory, no major weak­nesses found, some minor recom­mend­a­tions identified

Con­trols largely sat­is­fact­ory although some weak­nesses iden­ti­fied, recom­mend­a­tions for improve­ment made

Con­trols unsat­is­fact­ory and major sys­tems weak­nesses iden­ti­fied that require to be addressed immediately

No or very lim­ited con­trols in place leav­ing the sys­tem open to sig­ni­fic­ant error or abuse, recom­mend­a­tions made require to be imple­men­ted imme­di­ately For each recom­mend­a­tion we make we assign a grad­ing either as High, Medi­um or Low pri­or­ity depend­ing upon the degree of risk assessed as out­lined below: Grad­ing High Medi­um Risk Clas­si­fic­a­tion High Risk Major weak­ness that we con­sider needs to be brought to the atten­tion of the Audit & Risk Com­mit­tee and addressed by Seni­or Man­age­ment of the Cairngorms Nation­al Park Author­ity as a mat­ter of urgency

Medi­um Risk Sig­ni­fic­ant issue or weak­ness which should be addressed by the Museums as soon as possible

Low Low Risk Minor issue or weak­ness repor­ted where man­age­ment may wish to con­sider our recommendation

B – Key Per­form­ance Indic­at­ors wby For each area of review, we assign a grad­ing in accord­ance with the fol­low­ing clas­si­fic­a­tion: Per­form­ance Indic­at­or Tar­get Intern­al audit days com­pleted in line with agreed timetable and days alloc­a­tion 100% Draft scopes provided no later than 10 work­ing days before the intern­al audit start date and final scopes no later than 5 work­ing days before each start date 100% Draft reports issued with­in 10 work­ing days of exit meet­ing 100% Man­age­ment provide responses to draft reports with­in 15 work­ing days of receipt of draft reports 100% Final reports issued with­in 5 work­ing days of receipt of man­age­ment responses 100% Recom­mend­a­tions accep­ted by man­age­ment 100% Draft annu­al intern­al audit report to be provided by 30 April each year 100% Attend­ance Audit & Risk Com­mit­tee meet­ings by a seni­or mem­ber of staff 100% Suit­ably exper­i­enced staff used on all assign­ments 100%

C – Train­ing Top­ics wbg As a firm we offer a wide range of train­ing top­ics to our cli­ents and we have lis­ted below some of the top­ics which we would be able to offer Cairngorms Nation­al Park Author­ity. Top­ic Risk Man­age­ment Sum­mary This can cov­er risk aware­ness, assess­ment of risks, respons­ib­il­it­ies for mon­it­or­ing risks, risk appet­ite and the scor­ing of risks. This is usu­ally done as a work­shop to ensure buy-in from man­age­ment and com­mit­tee mem­bers to the risk man­age­ment process.

Role of the Board This would cov­er the roles and respons­ib­il­it­ies of Board mem­bers, includ­ing the Chair. This has been par­tic­u­larly use­ful when new Board mem­bers have been appoin­ted and allows mem­bers to obtain some know­ledge on what the expect­a­tion of a Board mem­ber is and what they should be look­ing out for. Role of Intern­al Audit We would provide a short ses­sion on what the intern­al audit func­tion should be deliv­er­ing to the Cairngorms Nation­al Park Author­ity and the added value which we would bring. Fin­ance for Non- Fin­an­cials This is use­ful for com­mit­tee mem­bers who do not have a fin­ance back­ground and cov­ers areas such as the man­age­ment accounts, budget report­ing and the stat­utory accounts. Fraud Aware­ness We would cov­er the import­ance of a hav­ing a strong con­trol envir­on­ment and areas to be aware of in rela­tion to fraud. We would dis­cuss some real-life examples of where we have iden­ti­fied or been asked to invest­ig­ate alleg­a­tions of fraud and the res­ults of these investigations.

D – Assur­ance Map

We have mapped out below, assur­ances from your Stra­tegic Risk Register and intern­al audit reviews. Risk Theme Resid­ual Risk Pub­lic sec­tor fin­ances con­strain capa­city to alloc­ate suf­fi­cient resources to deliv­er cor­por­ate plan. Risk of C2030 match fund­ing not being secured cur­rent match fund­ing in bid not fully com­mit­ted and/​or for one year only in many areas. wby Mit­ig­at­ing actions Planned Actions Intern­al Audit Assur­ance Pre­vent­at­ive: Ongo­ing liais­on with Scot­tish Gov­ern­ment through our spon­sor­ship team and the Peat­land Action Team, high­light­ing achieve­ments of CNPA. Pre­vent­at­ive: Cor­por­ate plan pri­or­it­ised around anti­cip­ated Scot­tish Gov­ern­ment budget alloc­a­tions, tak­ing Remedi­al: scen­ario plan­ning on for­ward budget mod­el­ling to Pre­vent­at­ive: Ongo­ing liais­on with Scot­tish Gov­ern­ment through our spon­sor­ship team and the Peat­land Action Team, high­light­ing achieve­ments of CNPA. Fin­an­cial Con­trols Grants 15 on Board expect­a­tion of fund­ing con­straints. Remedi­al: Focus resource on diver­si­fic­a­tion of income streams to altern­at­ive, non-pub­lic income gen­er­a­tion. Remedi­al: Con­tinu­ing to sup­port ​“deliv­ery bod­ies” such as Cairngorms Nature, Cairngorms Trust in secur­ing inward invest­ment. pre­pare options for future resource alloc­a­tions with­in final alloc­a­tions, based on fund­ing para­met­ers sug­ges­ted by spon­sor­ship team. Admin­is­tra­tion & Man­age­ment | C2030 Mid Pro­gramme Review Pre­vent­at­ive: focus over 2025 on match fund­ing pos­i­tion and con­sequent impacts to ensure C2030 pro­gramme plans and Pre­vent­at­ive: Ongo­ing liais­on with Scot­tish Gov­ern­ment fin­an­cing of them fully aligned by end of year. through our spon­sor­ship team and the Peat­land Action Pre­vent­at­ive: high pro­file and ongo­ing focus for SMT in 15 Team, high­light­ing achieve­ments of CNPA and import­ance of Peat­land Res­tor­a­tion fund­ing to inward invest­ment by NLHF. Remedi­al: Dis­cus­sions with Trans­port Scot­land on fund­ing for act­ive travel design work. enga­ging in influ­en­cing to secure the match fund­ing needed from part­ners; pro­ject man­agers aware of rel­ev­ant pro­ject match fund­ing pos­i­tion and tasked with seek­ing addi­tion­al match fund­ing where appro­pri­ate. Pre­vant­at­ive: con­sid­er­a­tion of new, wider match fund­ing oppor­tun­it­ies. Grants Admin­is­tra­tion & Man­age­ment | C2030 Mid Pro­gramme Review

D – Assur­ance Map Risk Theme There are per­ceived gaps in our skill set with respect to: pro­cure­ment pro­cesses, recruit­ment of tech­nic­al staff, abil­ity to under­take neces­sary due dili­gence on out­put from con­sult­ants and con­tract­ors.- Risks that pro­cure­ment and wider skill set capa­cit­ies are insuf­fi­cient to meet the evolving needs of the organ­isa­tion.- Lack of expert­ise and exper­i­ence in man­aging con­struc­tion pro­jects may com­prom­ise the effect­ive­ness and effi­ciency of planned deliv­ery.- Fin­an­cial risks asso­ci­ated with the let­ting of con­tracts where part­ner­ship fund­ing is likely to be depend­ent on the achieve­ment of sat­is­fact­ory stand­ards. Resid­ual Risk Mit­ig­at­ing actions Planned Actions wby 8 Pre­vent­at­ive: Recruit­ment of Pro­cure­ment Officer Pre­vent­at­ive: Sup­port secured from Scot­land Excel (and from Cent­ral Gov­ern­ment Pro­cure­ment Shared Ser­vices (CGPSS) if required). Pre­vent­at­ive: Con­sider deliv­ery through part­ners with con­struc­tion pro­ject deliv­ery exper­i­ence where appro­pri­ate to deliv­ery object­ives. Pre­vent­at­ive: addi­tion­al sup­port from LL&TNPA reques­ted Pre­vent­at­ive: Options for train­ing of wider staff group under invest­ig­a­tion — sup­por­ted by Scot­land Excel. Rem­di­al: pro­cure­ment action plan developed from intern­al audit recom­mend­a­tions; reviewed monthly by Chair / Vice Chair of ARC. Tar­get date for com­ple­tion of key improve­ments 31.03.25 (exten­ded from 31/12/24). SG budget con­trols may delay train­ing until the first quarter of ²⁰²⁵⁄₂₆. Intern­al Audit Assur­ance | Procurement

D — Assur­ance Map Risk Theme The Authority’s range of powers com­bined with stra­tegic part­ner­ships is insuf­fi­cient to deliv­er out­comes on wild­life crime. Increas­ingly com­pet­it­ive and restric­ted recruit­ment cli­mate pre­vents staff with the required exper­i­ence and skill sets being secured. Plan­ning and oth­er Resid­ual Risk 16 Mit­ig­at­ing actions Pre­vent­at­ive: licen­cing arrange­ments con­trib­ute to more effect­ive con­trol frame­work. Tracker/​satel­lite mon­it­or­ing deployed for some rap­tors. Remedi­al: NPPP devel­op­ment pro­cesses used to part­ner­ships. explore part­ner­ship atti­tudes, engage­ment and powers. Planned Actions wby Intern­al Audit Assur­ance Remedi­al: Development/​strength­en­ing of stra­tegic | Oper­a­tion­al Plan­ning Pre­vent­at­ive: focus on train­ing and devel­op­ment and intern­al suc­ces­sion plan­ning, in turn bring­ing recruit­ment into less experienced/​less highly skilled mar­kets and devel­op­ing pipeline Remedi­al: con­tin­gency plan­ning for example of qual­i­fied staff around out-sourcing of aspects of deliv­ery eg Pre­vent­at­ive: con­sid­er­a­tion giv­en to job design, estab­lish call-off frame­work for con­sult plan­ning cre­at­ing roles with more seni­or­ity (high­er grades), ser­vices. spe­cial­ist staff (IT, pro­cure­ment, fin­ance) require­ments impacted by nation­al labour/​skills short­ages and/​or salary struc­tures not suf­fi­ciently com­pet­it­ive to attract or retain key staff. 9 and flex­ib­il­ity of offer regard­ing part-time/ job share. | Covered in pre­vi­ous IA Plan

D — Assur­ance Map Risk Theme Sup­port­ing speed of organ­isa­tion­al change pre­vents required devel­op­ment and embed­ding of effect­ive sup­port sys­tems. The speed / scale of oper­a­tion­al demand for sup­port from cor­por­ate sys­tems is such that we are always fire-fight­ing and giv­ing the best advice and sup­port we can. How­ever, that ongo­ing fire-fight­ing and imme­di­ate advice pre­vents us hav­ing suf­fi­cient time to design, devel­op and imple­ment new sys­tems to bet­ter suit the new organ­isa­tion. Resid­ual Risk 16 Mit­ig­at­ing actions Remedi­al: recruit­ment of addi­tion­al staff to cor­por­ate func­tion dur­ing ²²⁄₂₃ and ²³⁄₂₄. Remedi­al: pro­ject man­age­ment train­ing provided. Remedi­al: devel­op­ment of improved systems/​ways of work­ing through bet­ter use of M365 applic­a­tions Remedi­al: Imple­ment new fin­ance sys­tem to sup­port wider digit­isa­tion of sys­tems and effect­ive fin­an­cial report­ing. Planned Actions wby Intern­al Audit Assur­ance Remedi­al: apply resource to devel­op­ment of improved systems/​ways of work­ing — new fin­ance sys­tem due to be installed by 31/12/24; new pro­ject ini­ti­ation con­trol under devel­op­ment Remedi­al: provide train­ing — pro­cure­ment and in wider assess­ment of pro­ject impacts at ini­ti­ation stage. Remedi­al: final­isa­tion and roll-out of pro­ject ini­ti­ation ini­ti­ationguid­anance, includ­ing assess­ment of any new leg­al implic­a­tions arising from pro­ject deliv­ery inten­tions. Pre­vent­at­ive: design and imple­ment pro­ject con­trols sup­port­ing more man­aged timelines and fuller, earli­er con­sid­er­a­tion of pro­ject plans. | Pro­ject Initiation

D — Assur­ance Map Risk Theme CNPA IT ser­vices are not suf­fi­ciently robust/​secure/​or well enough spe­cified to sup­port effect­ive and effi­cient ser­vice deliv­ery. Increas­ing demand for know­ledge around Microsoft 365 and cyber secur­ity is out­strip­ping the team’s knowledge/​skill-set. Increas­ing ICT depend­ency for effect­ive and effi­cient oper­a­tions is not adequately backed up by ICT sys­tems support.Use of AI increases risk of cyber secur­ity threats such as spear-phish­ing. Busi­ness Con­tinu­ity Plans (BCP) are inad­equate to deal with sig­ni­fic­ant impacts to nor­mal work­ing arrange­ments and res­ult in ser­vice fail­ure. Resid­ual Risk Mit­ig­at­ing actions Pre­vent­at­ive: Daily review of Scot­tish Cyber Coordin­a­tion Centre threat sum­mar­ies, with fol­low up action taken (eg patch­ing) as appropriate.Preventative/ remedi­al: Col­lab­or­a­tion with LL&TNPA provides 10 sup­port. Pre­vent­at­ive: Trans­ition to Share­point com­plete; R‑drive now a read-only Planned Actions wby Intern­al Audit Assur­ance Devel­op­ment of the IT oper­a­tion­al risk register has iden­ti­fied poten­tial for struc­tur­al improve­ment. These con­sid­er­a­tions to be developed fur­ther (poten­tial for extern­al con­sultancy to devel­op our IT strategy organ­isa­tion­al devel­op­ment, tech­nic­al improve­ments and upskilling).

Cyber essen­tials accred­it­a­tion achieved; audit towards essen­tials plus accred­it­a­tion under­way (11÷09÷24). | Cyber Secur­ity out­side the organ­isa­tion. renewed focus on IT actions plans will flow from that. Work on the inform­a­tion man­age­ment plan will pro­duce great­er resi­li­ence of data and access to key inform­a­tion when com­plete. 20 repos­it­ory, redu­cing risk of threats from A review of IT staff role descrip­tions now com­pleted; Pre­vent­at­ive: imple­ment Cyber Secur­ity Plus con­trols Pre­vent­at­ive: Devel­op­ment of hybrid work­ing meth­ods and cloud com­put­ing approaches have improved the organisation’s resi­li­ence. Remedi­al: devel­op updated busi­ness con­tinu­ity plan and embed its pro­vi­sions Pre­vent­at­ive: pro­posed con­sultancy to devel­op new BCP Busi­ness Con­tinu­ity & Dis­aster Recovery

D — Assur­ance Map Risk Theme Repu­ta­tion­al dam­age may res­ult from:- Unreal­ist­ic expect­a­tions of what the Park Author­ity and its part­ners can achieve in the face of the sig­ni­fic­ant risks presen­ted by cli­mate change, spe­cies extinc­tion, flood man­age­ment and fire; and/​or- Dis­agree­ment between the Park Author­ity and stake­hold­er groups with­in the Park. The Park Author­ity does not adequately respond or adapt to changes in fund­ing envir­on­ment at Scot­tish Gov­ern­ment policy levels or in evol­u­tion of private fin­ance invest­ment. Resid­ual Risk Mit­ig­at­ing actions Pre­vent­at­ive: Exist­ing stra­tegic part­ner­ships and stake­hold­er rela­tion­ships help to cre­ate a wider under­stand­ing of the factors that are with­in, and those that are out­side the con­trol of the Park Author­ity and its part­ners. 12 Planned Actions wby Intern­al Audit Assur­ance Pre­vent­at­ive: Man­age­ment of expect­a­tions through: Tar­geted com­mu­nic­a­tions Fur­ther devel­op­ment of stake­hold­er rela­tion­ships. Development/​strength­en­ing of stra­tegic part­ner­ships. Ongo­ing assess­ment of oper­a­tion­al risk man­age­ment and mit­ig­a­tion in our com­mu­nic­a­tions. Devel­op­ment of stake­hold­er rela­tion­ship data­base | C2030 Mid Pro­gramme Review | Oper­a­tion­al Plan­ning Pre­vent­at­ive: alloc­ate seni­or time to engage­ment with Scot­tish Gov­ern­ment in policy dis­cus­sion and devel­op­ment, identi­fy­ing and respond­ing to risk implic­a­tions. 12 Pre­vent­at­ive: pro­act­ively identi­fy oppor­tun­it­ies for private invest­ment and struc­tures to sup­port their invest­ment to For devel­op­ment com­ple­ment and sup­port NPPP and cor­por­ate object­ives. | Grant Admin­is­tra­tion & Man­age­ment | Fin­an­cial Con­trols | C2030 Mid Pro­gramme Review

D — Assur­ance Map Risk Theme The Park Authority’s work­force is not adequately flex­ible to respond to chan­ging stra­tegic pri­or­it­ies or to chan­ging oper­a­tion­al scale Resid­ual Risk Mit­ig­at­ing actions Pre­vent­at­ive: work­force man­age­ment strategy updated and reg­u­larly reviewed to take a 5+ year for­ward view. Planned Actions wby Intern­al Audit Assur­ance 9 Pre­vent­at­ive: con­tin­ued invest­ment in train­ing and devel­op­ment for staff sup­port­ing per­form­ance in cur­rent roles and suc­ces­sion / devel­op­ment plans. Pre­vent­at­ive: estab­lish an appro­pri­ate mix of per­man­ent and fixed term staff to allow for flex­ib­il­ity in future struc­tures. Remedi­al: retain scru­tiny of all vacan­cies and iden­ti­fic­a­tion of oppor­tun­it­ies to adpat vacan­cies toward future needs. For devel­op­ment | Work­force Man­age­ment NPPP deliv­ery respons­ib­il­it­ies are not suf­fi­ciently clear across the part­ner­ship and Park Author­ity is expec­ted to address more than it is cap­able to deliv­er. 12 Pre­vent­at­ive: rein­force spe­cif­ic part­ner deliv­ery respons­ib­il­it­ies through per­form­ance man­age­ment sys­tems and report­ing. Pre­vent­at­ive: rein­force NPPP deliv­ery link­ages through grant con­tract terms. For devel­op­ment | C2030 Mid Pro­gramme Review Evol­u­tion of the Park Authority’s range of activ­it­ies and pro­jects res­ults in uniden­ti­fied and unmit­ig­ated expos­ure to leg­al implic­a­tions and asso­ci­ated liab­il­it­ies 12 Pre­vent­at­ive: under­take risk ana­lys­is over­view of ²⁰²⁵⁄₂₆ oper­a­tion­al plan to identi­fy any deliv­ery areas with poten­tial expos­ure; devel­op and deliv­er mit­ig­a­tion action plan For devel­op­ment | C2030 Mid Pro­gramme Review

E – Audit uni­verse We have set out below the audit­able entit­ies, pro­cesses, sys­tems and activ­it­ies, which sup­port the devel­op­ment of the intern­al audit plan, and the Intern­al Audit cov­er­age since 2022. Area ²⁰²²⁄₂₃ ²⁰²³⁄₂₄ Payroll and Expenses Expendit­ure and Cred­it­ors Fin­an­cial Sys­tems Fin­ance Sys­tem and Pro­cesses ²⁰²⁴⁄₂₅ ²⁰²⁵⁄₂₆ ²⁰²⁶⁄₂₇ ²⁰²⁶⁄₂₇ New Fin­ance Sys­tem Payroll Fin­an­cial Con­trols Per­form­ance Man­age­ment Stra­tegic and Gov­ernance Risk Man­age­ment Cairngorms 2030 Work­force Man­age­ment and Plan­ning Health & Safety Oper­a­tion­al and Fin­an­cial Plan­ning Oper­a­tion­al Pro­cure­ment Her­it­age Hori­zons Recruit­ment Gov­ernance C2030 Mid Pro­gramme Review Pro­cure­ment Risk Man­age­ment Pro­ject Ini­ti­ation Grants Admin­is­tra­tion & Man­age­ment Busi­ness Con­tinu­ity & Dis­aster Recov­ery Work­force Man­age­ment CRM Sys­tem Oper­a­tion­al Plan­ning wbg

Area E – Audit uni­verse ²⁰²²⁄₂₃ ²⁰²³⁄₂₄ ²⁰²⁴⁄₂₅ Inform­a­tion Tech­no­logy Data Man­age­ment Com­pli­ance and Reg­u­lat­ory Lead­er Admin­is­tra­tion wbg ²⁰²⁵⁄₂₆ ²⁰²⁶⁄₂₇ ²⁰²⁶⁄₂₇ Cyber Secur­ity Inform­a­tion Man­age­ment Controls