Cairngorms Nation­al Park Author­ity Ügh­dar­ras Pàirc Nàiseanta a’ Mhon­aidh Ruaidh

Paper 5 Annex 1 13 March 2026

Paper 5

Annex 1

---

Cairngorms Nation­al Park Authority

Intern­al Audit ²⁰²⁵⁄₂₆

Fol­low Up Review Decem­ber 2025

Over­all Conclusion

Weak

---

Table of Contents

Sec­tion	Page num­ber
1. Exec­ut­ive Summary	4
2. Audit Arrangements	9

Appen­dices: A. Not Imple­men­ted Recom­mend­a­tions 11 B. Par­tially Imple­men­ted Recom­mend­a­tions 19 A. Grad­ing Struc­ture 28 B. Assign­ment Plan 30

2

---

Dis­claim­er

The mat­ters raised in this report came to our atten­tion dur­ing the course of our audit and are not neces­sar­ily a com­pre­hens­ive state­ment of all weak­nesses that exist or all improve­ments that might be made.

This report has been pre­pared solely for Cairngorms Nation­al Park Authority’s indi­vidu­al use and should not be quoted in whole or in part without pri­or writ­ten con­sent. No respons­ib­il­ity to any third party is accep­ted as the report has not been pre­pared, and is not inten­ded, for any third party.

We emphas­ise that the respons­ib­il­ity for a sound sys­tem of intern­al con­trol rests with man­age­ment and work per­formed by intern­al audit should not be relied upon to identi­fy all sys­tem weak­nesses that may exist. Neither should intern­al audit be relied upon to identi­fy all cir­cum­stances of fraud or irreg­u­lar­ity should there be any although our audit pro­ced­ures are designed so that any mater­i­al irreg­u­lar­ity has a reas­on­able prob­ab­il­ity of dis­cov­ery. Even sound sys­tems of con­trol may not be proof against col­lus­ive fraud. Intern­al audit pro­ced­ures are designed to focus on areas that are con­sidered to be of greatest risk and significance.

3

---

1. Exec­ut­ive Summary

Pur­pose of Review

The effect­ive­ness of the intern­al con­trol sys­tem may be com­prom­ised if Cairngorms Nation­al Park Author­ity (the Organ­isa­tion) Man­age­ment fails to imple­ment agreed audit recom­mend­a­tions. Our fol­low up provides the Audit & Risk Com­mit­tee with assur­ance that pri­or year recom­mend­a­tions were imple­men­ted with­in the expec­ted timescales.

This review formed part of our ²⁰²⁵⁄₂₆ Intern­al Audit Annu­al Plan.

Scope of Review

Our object­ive for this review was to assess whether:

• The Organ­isa­tion has appro­pri­ately imple­men­ted any out­stand­ing intern­al audit recom­mend­a­tions made in pri­or years.

Our approach to this assign­ment took the form of dis­cus­sion with rel­ev­ant staff, review of doc­u­ment­a­tion, and where appro­pri­ate sample testing.

4

---

1. Exec­ut­ive Summary

Con­clu­sion

Over­all Con­clu­sion: Weak

Fol­low­ing our review, we can provide a weak level of assur­ance that the Organ­isa­tion has endeav­oured to imple­ment intern­al audit recom­mend­a­tions raised in ²⁰²⁴⁄₂₅ and the pre­vi­ous years. This is high­lighted as three out of 12 recom­mend­a­tions were con­cluded to be fully imple­men­ted, five recom­mend­a­tions were found to be par­tially imple­men­ted, and the remain­ing four recom­mend­a­tions were not yet implemented.

Sum­mary of Recommendations

Grad­ing of Recom­mend­a­tions	High	Medi­um	Low	Total
Appendix A — Not Imple­men­ted Recommendations		4		4
Appendix B — Par­tially Imple­men­ted Recommendations	1	4		5
Fully Imple­men­ted Recommendations		2	1	3

We have not included fully imple­men­ted recom­mend­a­tions as an appendix; how­ever details of these recom­mend­a­tions are avail­able upon request.

5

---

1. Exec­ut­ive Summary

Sum­mary of Recom­mend­a­tions by Grade

Fully Imple­men­ted

• High: 0
• Medi­um: 2
• Low: 1

Par­tially Implemented

• High: 1
• Medi­um: 4
• Low: 0

Not Imple­men­ted

• High: 0
• Medi­um: 4
• Low: 0

6

---

1. Exec­ut­ive Summary

Imple­ment­a­tion of Recom­mend­a­tions – Sum­mary of Implementation

Audit Area	Total	Not Imple­men­ted	Par­tially Imple­men­ted	Fully Imple­men­ted
Man­age­ment Action Fol­low-Up Part 2 2024⁄25	12	4	5	3
Per­cent­age of Total	100%	33%	42%	25%

7

---

1. Exec­ut­ive Summary

Break­down of Recom­mend­a­tions by status of imple­ment­a­tion, from ²⁰²⁵⁄₂₆

Man­age­ment Action Fol­low-Up Part 2 2024⁄25	Num­ber of Recommendations
Not Imple­men­ted	4
Par­tially Implemented	5
Fully Imple­men­ted	3

8

---

2. Audit Arrangements

The table below details the dates of our field­work and the report­ing of the audit area under review.

Audit Stage	Date
Field­work start	1 Decem­ber 2025
Clos­ing Meeting	11 Decem­ber 2025
Draft report issued	18 Decem­ber 2025
Receipt of man­age­ment responses	5 Janu­ary 2026
Final report issued	12 Janu­ary 2026
Audit & Risk Committee	13 March 2026
No of audit day	5

9

---

2. Audit Arrangements

We detail below our staff who under­took the review togeth­er with the Organ­isa­tion staff we spoke to dur­ing our review.

Wbg

	Name	Role	Email
Part­ner	Gra­ham Gillespie	Part­ner & Head of Intern­al Audit	gg@​wbg.​co.​uk
Dir­ect­or	Peter Clark	Dir­ect­or of Intern­al Audit	pcc@​wbg.​co.​uk
Seni­or Manager	Scott McCready	Seni­or Intern­al Audit Manager	smc@​wbg.​co.​uk
Assist­ant Manager	CJ Scott	Intern­al Audit Assist­ant Manager	cjs@​wbg.​co.​uk
Aud­it­or	Domin­ic McCarthy	Intern­al Auditor	dmc@​wbg.​co.​uk

Cairngorms Nation­al Park Authority

	Name	Role	Email
Key Con­tacts:	Dav­id Cameron	Dir­ect­or of Cor­por­ate Services	davidcameron@​cairngorms.​co.​uk
	Louise Allen	Head of Fin­ance and Cor­por­ate Operations	louiseallen@​cairngorms.​co.​uk

Wbg appre­ci­ates the time provided by all the indi­vidu­als involved in this review and would like to thank them for their assist­ance and co-operation.

10

---

Appendix A

Not Imple­men­ted Recommendations

---

A. Not Imple­men­ted Recommendations

Busi­ness Con­tinu­ity Plan­ning, Man­age­ment Action Fol­low-Up Part 2 ²⁰²⁴⁄₂₅, March 2025

Ori­gin­al Finding In order to gain assur­ance that the BCP and DRP are effect­ive in the event of a busi­ness dis­rup­tion, it is import­ant that the plans are tested on a reg­u­lar basis.

The BCP states that test­ing of the BCP and DRP should be annu­al, with con­sid­er­a­tion giv­en to a daily ​‘table top’ exer­cise. How­ever, these have not yet been sub­ject to form­al test­ing, and there are cur­rently no plans in place to test the BCP and DRP on a reg­u­lar basis.

There is the risk that the BCP and DRP may not be effect­ive, and that this will only become appar­ent when a dis­rup­tion to a busi­ness crit­ic­al pro­cess occurs.

Ori­gin­al Recommendation We recom­mend that CNPA devel­ops a test­ing plan/​schedule for BCP which should be reviewed reg­u­larly to ensure a stra­tegic approach to test­ing is developed and imple­men­ted. This plan should ensure that vary­ing cat­egor­ies of events are sched­uled to be tested on a reg­u­lar basis based upon like­li­hood and over­all risk. A form­al test­ing sched­ule should also be developed for the DRP. We note that the BCP states that test­ing of the BCP and DRP should be annu­al, with con­sid­er­a­tion giv­en to a daily ​‘tab­letop’ exer­cise. How­ever, from dis­cus­sions with man­age­ment, it is under­stood that this is not achiev­able due to the size of the Organ­isa­tion. There­fore, Man­age­ment should decide on the most suit­able fre­quency of test­ing, and this should be detailed with­in the BCP. In addi­tion, we recom­mend that the out­comes, les­sons learned and required actions are form­ally doc­u­mented and there­after reflec­ted with­in the plan for each test.

Ref	Find­ing from our 2025⁄26 Fol­low Up	Grade	Recom­mend­a­tion
1.	The Organ­isa­tion estab­lished and adap­ted busi­ness con­tinu­ity plans dur­ing its response to COV­ID-19, how­ever these have not been reviewed since after the pan­dem­ic. These plans are now out­dated and require to be fully revised.	Medi­um	We reit­er­ate the ori­gin­al recommendation.

12

---

A. Not Imple­men­ted Recommendations

Man­age­ment Response	Respons­ib­il­ity and Imple­ment­a­tion Date
The Authority’s BCP is in need of update. It is the inten­tion that con­sultancy will be engaged to devel­op and embed pro­cesses and pro­ced­ures. Budget alloc­a­tion will be provided for this in the 2026⁄27 budget.	Dav­id Camer­on / Louise Allen: Septem­ber 2026

13

---

A. Not Imple­men­ted Recommendations

Cyber Secur­ity 1, Man­age­ment Action Fol­low-Up Part 2 ²⁰²⁴⁄₂₅, March 2025

Ori­gin­al Finding Our audit found that CNPA could enhance the cyber risk man­age­ment prac­tices and that the organ­iz­a­tion would bene­fit from great­er form­al­ity in con­trols and pro­cesses to sup­port more effect­ive man­age­ment of its cyber secur­ity risks.

Whilst we acknow­ledge that the organ­isa­tion has taken pos­it­ive steps to improve man­age­ment of its cyber secur­ity risks, by record­ing high level cyber related risks on the Stra­tegic Risk Register, there is no pro­cess for doc­u­ment­ing and man­aging lower-level cyber risks.

Ori­gin­al Recommendation We recom­mend that CNPA should per­form a risk assess­ment as well as a gap ana­lys­is of the cur­rent tech­no­logy, policy and busi­ness envir­on­ment, to identi­fy the key cyber secur­ity risks. In con­duct­ing that risk assess­ment and gap ana­lys­is, CNPA should refer to recog­nised lead­ing cyber secur­ity frame­works includ­ing the Scot­tish Gov­ern­ment Cyber Resi­li­ence Frame­work. We recom­mend the intro­duc­tion of a cyber risk register informed by the risk assess­ment and gap ana­lys­is, which includes input from all rel­ev­ant stakeholders.

We recom­mend that there is a pro­cess estab­lished for the ongo­ing iden­ti­fic­a­tion and man­age­ment of cyber secur­ity risks. We recom­mend that there is reg­u­lar form­al report­ing of the Organisation’s cyber secur­ity pos­ture to appro­pri­ate gov­ernance groups. This should include inform­a­tion on incid­ents that have occurred (ideally on a sum­mary or them­at­ic basis to avoid the risk of weak­nesses being widely pub­li­cised), actions being taken in response to incid­ents as well as assur­ance activ­ity that has taken place, includ­ing the res­ults of these.

Ref	Find­ing from our 2025⁄26 Fol­low Up	Grade	Recom­mend­a­tion
2.	We note that form­al risk assess­ments and gap ana­lys­is have not yet taken place. We do note that the Organ­isa­tion has achieved Cyber­se­cur­ity+ accred­it­a­tion and fur­ther con­tin­ues to devel­op and improve the IT arrangements.	Medi­um	We reit­er­ate the ori­gin­al recommendation.

14

---

A. Not Imple­men­ted Recommendations

Man­age­ment Response	Respons­ib­il­ity and Imple­ment­a­tion Date
While we are mind­ful of risks as part of the course of our day-to-day man­age­ment of IT resources, there has been a lack of form­al­ity in record­ing these risks. We are work­ing to enhance the matur­ity of our cyber-secur­ity approach and as part of this pro­cess we will work to improve doc­u­ment­a­tion and report­ing. We have an inform­al register of oper­a­tion­al risks used by the IT team, which will be developed and refined for wider review. Con­sid­er­a­tion will be giv­en to the report­ing chan­nels appro­pri­ate to the ongo­ing risk pos­i­tion, the nature and safety of this report­ing, togeth­er with the pro­vi­sion of inform­a­tion on responses to incidents.	Respons­ible Officer: Louise Allen
	Imple­ment­a­tion date: June 2026

15

---

A. Not Imple­men­ted Recommendations

Cyber Secur­ity 2, Man­age­ment Action Fol­low-Up Part 2 ²⁰²⁴⁄₂₅, March 2025

Ori­gin­al Finding Our high-level review in this area iden­ti­fied that CNPA has imple­men­ted tech­nic­al solu­tions that assist in the mit­ig­a­tion and pro­tec­tion against cyber threats. Solu­tions have been imple­men­ted at a net­work and a device level. Fire­walls are in place with the sup­port of a third party for main­ten­ance. Anti-vir­us is also in place which scans and updates reg­u­larly. A log­ging solu­tion has been intro­duced to enhance the abil­ity to under­stand what has happened in the event of an attack.

How­ever, we found that while there are defens­ive meas­ures in place, the cur­rent approach to cyber secur­ity is react­ive in nature. A form­al cyber secur­ity incid­ent response plan is not in place to sup­port the response to and man­age­ment of ser­vice con­tinu­ity in the event of an incident.

Ori­gin­al Recommendation We recom­mend that CNPA estab­lish pro­ced­ures for hand­ling cyber secur­ity events. These pro­ced­ures may take the form of play­books that spe­cific­ally detail which actions should be taken in the event of a cyber-attack. We also recom­mend that fol­low­ing the devel­op­ment of the pro­ced­ures CNPA should test the pro­ced­ures to con­firm that they enable an effect­ive and effi­cient response to an event. We also recom­mend that man­age­ment reg­u­larly reviews its tech­nic­al cyber­se­cur­ity pos­ture. This should include ongo­ing assess­ment of the adequacy of tech­nic­al solu­tions as well as their con­fig­ur­a­tion to ensure that secur­ity risk from intern­al and extern­al threats is minimised.

Ref	Find­ing from our 2025⁄26 Fol­low Up	Grade	Recom­mend­a­tion
3.	We note that form­al pro­ced­ures for hand­ling cyber secur­ity events have not yet been developed. We do note that the Organ­isa­tion has achieved Cyber­se­cur­ity+ accred­it­a­tion and fur­ther con­tin­ues to devel­op and improve the IT arrangements.	Medi­um	We reit­er­ate the ori­gin­al recommendation.

Man­age­ment Response	Respons­ib­il­ity and Imple­ment­a­tion Date
We have under­taken sig­ni­fic­ant work to improve our secur­ity pos­i­tion over the past 18 months. We will con­tin­ue to devel­op our approaches to include the estab­lish­ment of pro­ced­ures to handle cyber secur­ity events along with the reg­u­lar test­ing and review of these procedures.	Respons­ible Officer: Louise Allen
	Imple­ment­a­tion date: Septem­ber 2026

16

---

A. Not Imple­men­ted Recommendations

Fin­an­cial and Oper­a­tion­al Plan­ning 1, Man­age­ment Action Fol­low-Up Part 2 ²⁰²⁴⁄₂₅, March 2025

Ori­gin­al Finding We con­firmed through our dis­cus­sions with man­age­ment and review of the Oper­a­tion­al and Fin­an­cial Plan­ning cycle doc­u­ment­a­tion that the oper­a­tion­al and fin­an­cial pro­cesses are suit­ably aligned with regards to times­cales, those involved and report­ing through the gov­ernance structure.

CNPA cre­ates annu­al oper­a­tion­al plans by pri­or­it­ising object­ives included with­in the Cor­por­ate Plan 2023 – 27 and Nation­al Park Part­ner­ship Plan 2022 – 27, which were pro­duced in con­sulta­tion with Scot­tish Gov­ern­ment. Once CNPA receives con­firm­a­tion of its budget alloc­a­tion from Scot­tish Gov­ern­ment in Decem­ber of each year the Heads of Ser­vice pro­duce draft oper­a­tion­al and fin­an­cial plans for the year ahead, which are reviewed and approved by the Board in March in advance of the start of the fin­an­cial year.

In addi­tion, we reviewed the Budget Man­age­ment and Mon­it­or­ing doc­u­ment which was writ­ten by the Head of Fin­ance and Cor­por­ate Oper­a­tions and reviewed by Dir­ect­or of Cor­por­ate Ser­vices and Deputy Chief Exec­ut­ive in Novem­ber 2023. This doc­u­ment sets out at a high level the above annu­al budget and oper­a­tion­al pro­cess. How­ever, the doc­u­ment does not clearly dic­tate the timelines for com­ple­tion, roles and respons­ib­il­it­ies of all parties involved, and expec­ted doc­u­ment­a­tion to be pro­duced at each stage of the process.

Ori­gin­al Recommendation CNPA should ensure that oper­a­tion­al and fin­an­cial plan­ning pro­cess doc­u­ment­a­tion clearly defines the roles and respons­ib­il­it­ies of those involved, includ­ing timelines for com­ple­tion and doc­u­ment­a­tion requirements.

Ref	Find­ing from our 2025⁄26 Fol­low Up	Grade	Recom­mend­a­tion
4.	Work to update fin­an­cial plan­ning pro­cess doc­u­ment­a­tion has not yet been completed.	Medi­um	We reit­er­ate the ori­gin­al recommendation.

17

---

A. Not Imple­men­ted Recommendations

Man­age­ment Response	Respons­ib­il­ity and Imple­ment­a­tion Date
The timelines for plan­ning are set in response the require­ments of Scot­tish Gov­ern­ment. The Exec­ut­ive and Seni­or Man­age­ment Team are fully aware of the rel­ev­ant dates and required doc­u­ment­a­tion. As we work through the devel­op­ment of the Nation­al Park Part­ner­ship Plan, and the ensu­ing Cor­por­ate Plan we will doc­u­ment the pro­cess under­taken, togeth­er with Roles and Respons­ib­il­it­ies and timelines.	Respons­ible Officer: Louise Allen
	Imple­ment­a­tion date: Septem­ber 2026 but depend­ent on pro­gress towards com­ple­tion of Cor­por­ate Plan 2027 – 2030

18

---

Appendix B

Par­tially Imple­men­ted Recommendations

---

B. Par­tially Imple­men­ted Recommendations

Pro­cure­ment, Man­age­ment Action Fol­low-Up Part 2 ²⁰²⁴⁄₂₅, March 2025

Ori­gin­al Finding Pri­or to 2025 intern­al audit work was under­taken by a dif­fer­ent pro­vider who fol­lowed a dif­fer­ent format which did not include details of the ori­gin­al find­ing. Instead, we have focused on the ori­gin­al recom­mend­a­tion, included below.

Ori­gin­al Recommendation CNPA should under­take a full review of the pro­cure­ment doc­u­ment­a­tion held for each sup­pli­er. This should include con­firm­ing the last date of pro­cure­ment exer­cise and determ­in­ing con­tracts which require reten­d­er­ing. Man­age­ment should seek to devel­op tem­plates which set out the stages of the pro­cure­ment jour­ney, such as a tem­plate for brief­ing, sup­pli­er eval­u­ation and ongo­ing con­tract man­age­ment, in par­tic­u­lar for routes 2 and 3 and as a min­im­um a check­list to be util­ised for route 1. There should be clear doc­u­ment­a­tion retained show­ing the cur­rent status of the pro­cure­ment exer­cise, and once con­tract­ors have been appoin­ted. As part of the work under MAP 1.1, CNPA should revise the cur­rent pro­cure­ment policy to include a step-by-step pro­cess flow for the dif­fer­ent thresholds, and a detailed explan­a­tion of the require­ments of each step in the pro­cure­ment route. This should also con­tain the required approvals and levels of author­ity required for each stage to ensure that staff are aware of their roles and respons­ib­il­it­ies. This should include the pro­cess for non­com­pet­it­ive actions includ­ing the doc­u­ment­a­tion to be held and the thresholds in place. There should be a sig­ni­fic­ant focus on train­ing all staff with the updated policies, to ensure that there is con­sist­ent under­stand­ing and approaches across the teams. A cent­ral repos­it­ory of all con­tract inform­a­tion should be maintained.

20

---

B. Par­tially Imple­men­ted Recommendations

Ref	Find­ing from our 2025⁄26 Fol­low Up	Grade	Recom­mend­a­tion
1.	The Organ­isa­tion has a Pro­cure­ment Action Plan in place which it is cur­rently using to track pri­or Pro­cure­ment recom­mend­a­tions. In 2024, the Organ­isa­tion hired a Pro­cure­ment Officer, mov­ing from pre­vi­ous use of an extern­al pro­vider for pro­cure­ment ser­vices. This has worked to improve pro­cure­ment pro­cesses across the Organ­isa­tion. At the time of our review, the only out­stand­ing point per the Pro­cure­ment Action Track­er is the devel­op­ment of Pro­cure­ment KPIs.	High	We recom­mend that the Organ­isa­tion devel­op a set of form­al set of pro­cure­ment KPIs.

Man­age­ment Response	Respons­ib­il­ity and Imple­ment­a­tion Date
Pro­cure­ment KPIs are cur­rently under development.	Respons­ible Officer: Louise Allen
	Imple­ment­a­tion date: April 2026

21

---

B. Par­tially Imple­men­ted Recommendations

ICT Strategy, Man­age­ment Action Fol­low-Up Part 2 ²⁰²⁴⁄₂₅, March 2025

Ori­gin­al Finding The IT and Data Strategy is not sup­por­ted by a fin­an­cial strategy.

We did note that the CNPA budget for ²⁰²¹⁄₂₂ in March 2021 set out budget require­ments to deliv­er a pro­gramme of trans­form­a­tion work which developed into the New Nor­mal pro­ject. We also noted that the CNPA spend­ing review in Septem­ber 2021 set out the budget changes required to deliv­er the New Nor­mal pro­ject with this includ­ing some ele­ments of the IT and Data Strategy. These include Cyber Secur­ity soft­ware, web­site and records man­age­ment aug­ment­a­tion and cloud-based ICT licensing.

Ori­gin­al Recommendation We recom­mend that the next devel­op­ment of the IT and Data Strategy includes a fin­an­cial strategy. This should set out, at a high-level, indic­at­ive cap­it­al and rev­en­ue costs asso­ci­ated with achiev­ing expec­ted out­comes from the strategy. This should be alloc­ated for each fin­an­cial year. This will allow man­age­ment to make an informed assess­ment of the fin­an­cial viab­il­ity of the strategy and to ensure that fin­an­cial require­ments of the strategy are fed into annu­al budgeting/​spending reviews.

Ref	Find­ing from our 2025⁄26 Fol­low Up	Grade	Recom­mend­a­tion
2.	The IT Strategy was last reviewed in May 2025. The Strategy is detailed in many areas, how­ever, some sec­tions are still incom­plete. The Exec­ut­ive Sum­mary is cur­rently blank, and the Roadmap included on page 40 is an empty template.	Medi­um	We recom­mend that the Organ­isa­tion review and update the IT Strategy to ensure that all sec­tions are completed.

Man­age­ment Response	Respons­ib­il­ity and Imple­ment­a­tion Date
The IT Strategy is cur­rently under development	Respons­ible Officer: Louise Allen
	Imple­ment­a­tion date: Septem­ber 2026

22

---

B. Par­tially Imple­men­ted Recommendations

Data Man­age­ment, Man­age­ment Action Fol­low-Up Part 2 ²⁰²⁴⁄₂₅, March 2025

Ori­gin­al Finding Pri­or to 2025 intern­al audit work was under­taken by a dif­fer­ent pro­vider who fol­lowed a dif­fer­ent format which did not include details of the ori­gin­al find­ing. Instead, we have focused on the ori­gin­al recom­mend­a­tion, included below.

Ori­gin­al Recommendation We recom­mend that CNPA review the cur­rent policy suite that is in place and devel­op and imple­ment policies that address the fol­low­ing policy areas:

• Data Man­age­ment
• Data Reten­tion
• Inform­a­tion Transfer
• Cloud Secur­ity
• Data Pro­tec­tion
• Access Con­trol