Cairngorms Nation­al Park Author­ity — Intern­al Audit Report: LEAD­ER Review

May 2019

CAIRNGORMS NATION­AL PARK AUTHORITY Audit & Risk Com­mit­tee Paper I Annex I 06/09/19

BDO

---

Level of Assurance

	Design	Oper­a­tion­al Effectiveness
Level of Assurance	Sub­stan­tial	Sub­stan­tial

---

Con­tents

• Exec­ut­ive Sum­mary — 3
• Obser­va­tions — 8
• Appen­dices:
  • I. Staff Inter­viewed — 9
  • II. Defin­i­tions — 10
  • III. Terms of Ref­er­ence — 11

---

Report Status

• Aud­it­ors: Mark Foley
• Dates work per­formed: 29 April 2019 — 03 May 2019
• Draft report issued: 21 May 2019
• Final report issued: 24 May 2019

Dis­tri­bu­tion List

• Dav­id Camer­on — Dir­ect­or of Cor­por­ate Services
• Audit Com­mit­tee

Restric­tions of use: The mat­ters raised in this report are only those which came to our atten­tion dur­ing the course of our audit and are not neces­sar­ily a com­pre­hens­ive state­ment of all the weak­nesses that exist or all improve­ments that might be made. The report has been pre­pared solely for the man­age­ment of the organ­isa­tion and should not be quoted in whole or in part without our pri­or writ­ten con­sent. BDO LLP neither owes nor accepts any duty to any third party wheth­er in con­tract or in tort and shall not be liable, in respect of any loss, dam­age or expense which is caused by their reli­ance on this report.

---

Exec­ut­ive Summary

Level of Assur­ance (See Appendix II for definitions)

• Design: There is a sound sys­tem of intern­al con­trol designed to achieve sys­tem objectives.
• Effect­ive­ness: The con­trols that are in place are being con­sist­ently applied.

Sum­mary of Recom­mend­a­tions (See Appendix II)

• High: ▲
• Medi­um: ▲
• Low:
• Total num­ber of recom­mend­a­tions: 0

Over­view

Back­ground: As part of the 2019 – 20 Intern­al Audit plan, it was agreed that Intern­al Audit would assess the pro­cesses in place to ensure com­pli­ance with the require­ments of the Ser­vice Level Agree­ment (SLA) for the Lead­er Pro­gramme. The LEAD­ER pro­gramme is a European Uni­on ini­ti­at­ive which aims to increase sup­port to loc­al rur­al com­munity and busi­ness net­works to build know­ledge and skills, and encour­age innov­a­tion and co-oper­a­tion in order to tackle loc­al devel­op­ment object­ives. LEAD­ER is part of the Scot­tish Rur­al Devel­op­ment Pro­gramme 2014 – 2020, for which Cairngorms Nation­al Park Author­ity (CNPA) is an Account­able Body. The Ser­vice Level Agree­ment (SLA) between Scot­tish Gov­ern­ment and Account­able Bod­ies for LEAD­ER Loc­al Action Groups (LAGs) requires an annu­al intern­al audit of the func­tions and ser­vices under­taken by each Account­able Body in ful­fil­ment of their role, includ­ing an intern­al audit assess­ment of the extent of observ­ance by the Account­able Body of the require­ments of the SLA. In the case of Cairngorms LEAD­ER, the SLA was signed on 14 August 2015, sup­ple­men­ted by a side let­ter from the Author­ity set­ting out its inten­tion to vary inform­a­tion man­age­ment ele­ments of the SLA dated 11 Septem­ber 2015.

The SLA defines the respons­ib­il­it­ies and oblig­a­tions, duties and account­ab­il­it­ies of both the Scot­tish Gov­ern­ment and CNPA as a res­ult of CNPA’s role as Account­able Body and deliv­ery part­ner in the Scot­tish Rur­al Devel­op­ment Pro­gramme for the peri­od 2014 – 20. The oblig­a­tions of CNPA as Account­able Body are cat­egor­ised into a num­ber of sec­tions on the SLA, includ­ing reten­tion of doc­u­ment­a­tion, per­form­ance tar­gets, con­flicts of interest, gifts and hos­pit­al­ity, data shar­ing and fin­an­cial arrange­ments. With­in the fin­an­cial arrange­ments, for example, the SLA out­lines that CNPA is obliged to make claims for eli­gible expendit­ure in accord­ance with the format set out in rel­ev­ant guid­ance with­in 20 work­ing days of the end of the quarter. How­ever, Scot­tish Gov­ern­ment has issued guid­ance to Account­able Bod­ies explain­ing that draw­downs may be sub­mit­ted more fre­quently than quarterly, although there must be at least one draw­down per quarter as per the SLA. CNPA cur­rently sub­mits monthly draw­down claims to Scot­tish Government.

A tech­nic­al check­list requires to be com­pleted which assesses all applic­a­tions on a num­ber of cri­ter­ia, includ­ing stra­tegic fit, return on invest­ment and equal­ity. The inclu­sion of sup­port­ing doc­u­ments in the applic­a­tion, such as fin­an­cial state­ments and cash flow fore­casts, is recor­ded on the check­list, which requires to be approved by the Pro­gramme Man­ager or Chair of the Account­able Body.

A Scor­ing Sub-Group has been estab­lished to review pro­ject applic­a­tions against a defined scor­ing mat­rix in advance of Cairngorms Loc­al Action Group (CLAG) meet­ings. The CLAG is respons­ible for the over­sight of the Loc­al Devel­op­ment Strategy (LDS) and the Busi­ness Plan to ensure that LEAD­ER invest­ments are made in accord­ance with the Busi­ness Plan to achieve the out­comes defined in the LDS. The Sub-Group is com­prised of five mem­bers of the CLAG and is respons­ible for provid­ing scores to the CLAG in order to form the basis of dis­cus­sion and fund­ing decisions on pro­ject applic­a­tions. The CLAG holds the final respons­ib­il­ity for determ­in­ing pro­ject scores, either agree­ing the scores for each ele­ment sug­ges­ted by the Scor­ing Sub-Group or agree­ing vari­ations from those scores sug­ges­ted by the Sub-Group. The scores adop­ted by the CLAG rep­res­ent the final approved scores for each project.

A pro­ject assess­ment scor­ing sheet is com­pleted for each applic­a­tion and cat­egor­ises assess­ment cri­ter­ia between Eli­gib­il­ity and Tech­nic­al cri­ter­ia. The Eli­gib­il­ity cri­ter­ia assesses pro­ject applic­a­tions on a num­ber of areas, such as stra­tegic fit and return on invest­ment, and the Tech­nic­al cri­ter­ia assesses pro­ject applic­a­tions on areas such as organ­isa­tion­al com­pet­ence and robust deliv­ery plans. Addi­tion­al guid­ance is provided on the scor­ing mat­rix for the scores which can be awar­ded for each assess­ment cri­ter­ia. For example, a score of ​‘0’ for organ­isa­tion­al com­pet­ence rep­res­ents no evid­ence being avail­able to sup­port the rel­ev­ant cri­ter­ia, where­as a score of ​‘3’ rep­res­ents that the organ­isa­tion has a well estab­lished track record of pro­ject deliv­ery in this area.

The LAG Pro­gramme Claims Guid­ance out­lines a num­ber of eli­gib­il­ity cri­ter­ia which must be sat­is­fied by CNPA when sub­mit­ting a claim to Scot­tish Gov­ern­ment for run­ning costs and anim­a­tion costs. Run­ning costs can include the following:

• Dir­ect staff costs
• Travel and subsistence
• Office run­ning ser­vice costs
• Insur­ance
• Office run­ning mater­i­al costs

Anim­a­tion costs can include the following:

• Pub­lic­a­tions includ­ing news­let­ters, leaf­lets and signage
• Events includ­ing work­shops, net­work­ing and conferences
• Stake­hold­er Engagement

Applic­ants are required to com­plete a LEAD­ER Grant Claim and Mile­stone report when request­ing funds from CNPA in rela­tion to pro­ject expendit­ure. Pro­gress against approved mile­stones is recor­ded on the report, in addi­tion to nar­rat­ive detail­ing the pro­ject activ­it­ies dur­ing the report­ing peri­od which sup­port the mile­stone pro­gress. Doc­u­ments such as bank state­ments, receipts and timesheets are required to be attached to the form where rel­ev­ant in order to evid­ence the expenditure.

The SLA out­lines a num­ber of require­ments in rela­tion to use of the Scot­tish Government’s LARC IT sys­tem when pro­cessing applic­a­tions. Require­ments include the stor­ing of all records, doc­u­ments and elec­tron­ic data relat­ing to any pro­jects con­sidered on the sys­tem, includ­ing scor­ing sheets, which must be com­pleted, signed and filed on LARC.

Scope and Approach

The scope of our review was to assess whether:

• Effi­cient, effect­ive and well con­trolled pro­cesses have been developed to ensure com­pli­ance with the ser­vice level agreement;
• Pro­ject and fund­ing applic­a­tions are con­sidered and scored in accord­ance with a clearly defined process;
• Applic­a­tions are approved appro­pri­ately and on a timely basis;
• Claims sub­mit­ted to Scot­tish Gov­ern­ment by CNPA are in line with eli­gib­il­ity criteria;
• Claims sub­mit­ted to CNPA by applic­ants are reviewed and approved appro­pri­ately pri­or to payment;
• Grant claim reg­u­la­tions are being com­plied with; and
• Scot­tish Government’s LARC IT sys­tem is being used effect­ively in accord­ance with the SLA.

Our approach was to review key doc­u­ment­a­tion in rela­tion to LEAD­ER and inter­view key staff to assess wheth­er the design of the con­trols is appro­pri­ate and these con­trols are oper­at­ing effect­ively and as described. As part of our test­ing, we selec­ted a sample of pro­jects and test that the key con­trols are oper­at­ing effect­ively. We also per­formed a detailed walk­through of a form­ally approved LEAD­ER pro­ject from ini­tial applic­a­tion through to the claim­ing of the grant.

Good Prac­tice

We are pleased to report that effi­cient, effect­ive and well con­trolled pro­cesses have been developed to ensure com­pli­ance with the SLA. Pro­ject and fund­ing applic­a­tions are con­sidered and scored in accord­ance with the pro­cess clearly defined in the tech­nic­al check­list and scor­ing sheet. Claims sub­mit­ted to CNPA by applic­ants are recor­ded on a LEAD­ER Grant Claim and Mile­stone report and are reviewed and approved appro­pri­ately pri­or to pay­ment, in accord­ance with the Scot­tish Government’s LEAD­ER Claims Guid­ance. Our detailed walk­through of a form­ally approved LEAD­ER pro­ject con­firmed that the applic­a­tion had been assessed and approved in accord­ance with the clearly defined pro­cess. The sample test­ing indic­ated that the pro­cess out­lines in the SLA were fol­lowed appropriately.

Con­clu­sion

We are able to provide sub­stan­tial assur­ance over the design and oper­a­tion­al effect­ive­ness of the con­trols in place to ensure com­pli­ance with the require­ments of the SLA.

Risks Reviewed Giv­ing Rise to No Find­ings of a High or Medi­um Significance

• Effi­cient, effect­ive and well con­trolled pro­cesses may not have been developed to ensure com­pli­ance with the ser­vice level agreement.
• Pro­ject and fund­ing applic­a­tions may not be con­sidered and scored in accord­ance with a clearly defined process.
• Applic­a­tions may not be approved appro­pri­ately and on a timely basis.
• Claims sub­mit­ted to Scot­tish Gov­ern­ment by CNPA may not be in line with eli­gib­il­ity criteria.
• Claims sub­mit­ted to CNPA by applic­ants may not be reviewed and approved appro­pri­ately pri­or to payment.
• Grant claim reg­u­la­tions may not be com­plied with.
• Scot­tish Government’s LARC IT sys­tem may not be used effect­ively in accord­ance with the SLA.

---

Obser­va­tions

1. LARC System

Man­age­ment noted that there has been no changes to the LARC sys­tem since the intern­al audit in 2018 there­fore the below obser­va­tion remains rel­ev­ant from the pri­or year. The SLA out­lines a num­ber of require­ments in rela­tion to use of Scot­tish Government’s LARC sys­tem when pro­cessing applic­a­tions, includ­ing the stor­ing of all records, doc­u­ments and elec­tron­ic data relat­ing to any pro­jects con­sidered on LARC, includ­ing scor­ing sheets, which should be com­pleted, signed and filed on LARC. Whilst we noted that the sys­tem is not being used in accord­ance with aspects of the SLA (as CNPA LEAD­ER staff are manu­ally assess­ing and sign­ing all records pri­or to stor­ing these on LARC), sec­tion 4.3 of the SLA states that: ​“All admin­is­trat­ive func­tions, mon­it­or­ing checks and case man­age­ment must be recor­ded via the Lead­er Actions in Rur­al Com­munit­ies sys­tem (LARCs) or equi­val­ent until such time as LARCs is oper­a­tion­al”. CNPA out­lined lim­it­a­tions of the LARC sys­tem to deliv­er aspects of the pro­gramme loc­ally in a let­ter to the Scot­tish Gov­ern­ment, includ­ing that a num­ber of applic­ants can­not use the sys­tem as their own broad­band access is lim­ited, and are depend­ent on the CNPA LEAD­ER team act­ing on their behalf in upload­ing doc­u­ments onto LARCs. Scot­tish Gov­ern­ment is there­fore aware of these issues. The Account­able Body Group also pre­pared a paper in March 2017 which expands on the lim­it­a­tions of LARC and the lim­it­a­tions of the SLA. The lim­it­a­tions dis­cussed by the group include the lack of print and PDF func­tion­al­ity of the sys­tem, in addi­tion to the inab­il­ity of all LAG mem­bers to access the sys­tem sim­ul­tan­eously when assess­ing applic­a­tions at LAG meet­ings as a res­ult of vari­able broad­band pro­vi­sion at the ven­ues used for meet­ings. Man­age­ment believe that, as a res­ult of these lim­it­a­tions, the LARC sys­tem is not yet oper­a­tion­al and that the Author­ity there­fore is in com­pli­ance with sec­tion 4.3 of the SLA.

2. Out of Date Mile­stone and Cash Flow Planner

One approved pro­ject has an out-of-date Mile­stone Plan­ner on file with the first mile­stone fall­ing due in April 2019. How­ever, some time elapsed between LAG approv­al and Offer of Grant which meant the first mile­stones in the applic­a­tion had passed. A new Mile­stone and Cash flow plan­ner will be agreed with the applic­ant pri­or to Let­ter of Offer. The LEAD­ER man­ager will cre­ate a signed file note con­firm­ing the pro­cess, con­firm­ing that the Account­able Body and LAG were con­tent with the update and will issue the Let­ter of Offer with the updated cash flow and mile­stone dates with­in the offer. If the mile­stones had not already elapsed, CNPA would have used the Change Request Pro­cess to update the pro­ject once the Let­ter of Offer had been issued and accep­ted. In either case, an up to date Mile­stone and Cash flow would be in place pri­or to any claim­ing pro­cess starting.

---

Appendix I — Staff Interviewed

Name	Job Title
Dav­id Cameron	Dir­ect­or of Cor­por­ate Services
Brid­get Trussell	LEAD­ER Pro­gramme Manager
Daniel Ral­ph	Fin­ance Manager
Kirsty MacK­en­zie	Pro­ject Devel­op­ment & Sup­port Officer

BDO LLP appre­ci­ates the time provided by all the indi­vidu­als involved in this review and would like to thank them for their assist­ance and cooperation.

---

Appendix II — Definitions

Design of Intern­al Con­trol Framework

Level of Assur­ance	Find­ings from review	Design Opin­ion
Sub­stan­tial	Appro­pri­ate pro­ced­ures and con­trols in place to mit­ig­ate key risks.	There is a sound sys­tem of intern­al con­trol designed to achieve sys­tem objectives.
Mod­er­ate	In the main there are appro­pri­ate pro­ced­ures and con­trols in place to mit­ig­ate the key risks reviewed albeit with some that are not fully effective.	Gen­er­ally a sound sys­tem of intern­al con­trol designed to achieve sys­tem object­ives with some exceptions.
Lim­ited	A num­ber of sig­ni­fic­ant gaps iden­ti­fied in the pro­ced­ures and con­trols in key areas. Where prac­tic­al, efforts should be made to address in-year.	Sys­tem of intern­al con­trols is weakened with sys­tem object­ives at risk of not being achieved.
No	For all risk areas there are sig­ni­fic­ant gaps in the pro­ced­ures and con­trols. Fail­ure to address in-year affects the qual­ity of the organisation’s over­all intern­al con­trol framework.	Poor sys­tem of intern­al control.

Oper­a­tion­al Effect­ive­ness of Intern­al Controls

Find­ings from review	Effect­ive­ness Opinion
No, or only minor, excep­tions found in test­ing of the pro­ced­ures and controls.	The con­trols that are in place are being con­sist­ently applied.
A small num­ber of excep­tions found in test­ing of the pro­ced­ures and controls.	Evid­ence of non-com­pli­ance with some con­trols, that may put some of the sys­tem object­ives at risk.
A num­ber of reoc­cur­ring excep­tions found in test­ing of the pro­ced­ures and con­trols. Where prac­tic­al, efforts should be made to address in-year.	Non-com­pli­ance with key pro­ced­ures and con­trols places the sys­tem object­ives at risk.
Due to absence of effect­ive con­trols and pro­ced­ures, no reli­ance can be placed on their oper­a­tion. Fail­ure to address in-year affects the qual­ity of the organisation’s over­all intern­al con­trol framework.	Non-com­pli­ance and/​or com­pli­ance with inad­equate controls.

Recom­mend­a­tion Significance

• High: A weak­ness where there is sub­stan­tial risk of loss, fraud, impro­pri­ety, poor value for money, or fail­ure to achieve organ­isa­tion­al object­ives. Such risk could lead to an adverse impact on the busi­ness. Remedi­al action must be taken urgently.
• Medi­um: A weak­ness in con­trol which, although not fun­da­ment­al, relates to short­com­ings which expose indi­vidu­al busi­ness sys­tems to a less imme­di­ate level of threat­en­ing risk or poor value for money. Such a risk could impact on oper­a­tion­al object­ives and should be of con­cern to seni­or man­age­ment and requires prompt spe­cif­ic action.
• Low: Areas that indi­vidu­ally have no sig­ni­fic­ant impact, but where man­age­ment would bene­fit from improved con­trols and/​or have the oppor­tun­ity to achieve great­er effect­ive­ness and/​or efficiency.

---

Appendix III — Terms of Reference

Back­ground

The Ser­vice Level Agree­ment (SLA) between Scot­tish Gov­ern­ment and Account­able Bod­ies for LEAD­ER Loc­al Action Groups (LAGs) requires an annu­al intern­al audit of the func­tions and ser­vices under­taken by each Account­able Body (AB) in ful­fil­ment of their role, includ­ing an intern­al audit assess­ment of the extent of observ­ance by the Account­able Body of the require­ments of the SLA. In the case of Cairngorms LEAD­ER, the SLA was signed on 14 August 2015, sup­ple­men­ted by a side let­ter set­ting out its inten­tion to vary inform­a­tion man­age­ment ele­ments of the SLA dated 11 Septem­ber 2015. Cairngorms Nation­al Park Author­ity (CNPA) has sub­sequently out­lined its views of the lim­it­a­tions of the LEAD­ER LARCS IT sys­tem to deliv­er aspects of the pro­gramme loc­ally in a let­ter to the Scot­tish Gov­ern­ment. The Account­able Body Group has also pre­pared a paper which expands on the lim­it­a­tions of LARCS and the lim­it­a­tions of the SLA.

Pur­pose of Review

The pur­pose of this review is to provide man­age­ment and the Audit Com­mit­tee with a level of assur­ance that CNPA is main­tain­ing effect­ive pro­cesses and is com­ply­ing with the require­ments of the ser­vice level agreement.

Key Risks

Based upon the risk assess­ment under­taken dur­ing the devel­op­ment of the intern­al audit oper­a­tion­al plan, through dis­cus­sions with man­age­ment, and our col­lect­ive audit know­ledge and under­stand­ing the key risks asso­ci­ated with the area under review are:

• Effi­cient, effect­ive and well con­trolled pro­cesses may not have been developed to ensure com­pli­ance with the ser­vice level agreement;
• Pro­ject and fund­ing applic­a­tions may not be con­sidered and scored in accord­ance with a clearly defined process;
• Applic­a­tions may not be approved appro­pri­ately and on a timely basis;
• Claims sub­mit­ted to Scot­tish Gov­ern­ment by CNPA may not be in line with eli­gib­il­ity criteria;
• Claims sub­mit­ted to CNPA by applic­ants may not be reviewed and approved appro­pri­ately pri­or to payment;
• Grant claim reg­u­la­tions may not be com­plied with; and
• Scot­tish Government’s LARC IT sys­tem may not be used effect­ively in accord­ance with the SLA.

---

(Page 13 con­tains BDO LLP con­tact inform­a­tion and is omit­ted here for brevity.)