MAR/JUN 2021 – NCCP

Suggested Answer by Sir Hasan Dossani

(1A) Assesses NCCP’s internal and external stakeholders and recommends
appropriate ways of managing them.

REPORT
TO: BOARD OF DIRECTORS
FROM: CONSULTANT
SUBJECT: STAKEHOLDERS AND COMPETITIVE ADVANTAGE
DATE: 7 DEC 2021

INTRODUCTION
This report Assesses NCCP’s internal and external stakeholders and critically assesses NCCP’s sources
of competitive advantage.

INTERNAL STAKEHOLDERS
Board of Trustees
NCCP was setup up 20 years ago by Richard Tempest through a generous donation. NCCP is governed
by its board of trustees, of which Richard was a member until he retired.

BOT has high power as all key decisions are approved by BOT. They also have high interest in the
running of NCCP. Hence BOT is KEY PLAYERS and their consent is required for all major decisions.

Executive Board
There is an Executive Board of four members comprising chief executive officer (CEO), finance
director, marketing director and operations director.

They have low power as their main role is to execute the decisions of BOT. however they have high
interest hence they can be classified as KEEP INFORMED. Their
Employees / Volunteers
There are 12 paid employees and several unpaid volunteers. They have low power but have high
interest hence they can be classified as KEEP INFORMED.

EXTERNAL STAKEHOLDERS
Ceeville Council
NCCP relies heavily on Ceeville Council which provides financial support. Funding from Ceeville
Council is expected to fall significantly in the coming year due to a reduction in funding from central
government.

The Council attaches specific conditions to its funding which change from year to year. From
20X4 onwards the funding has been conditional on NCCP running a Business Skills course as
part of the council’s initiative to encourage people to develop business skills.

Since NCCP has high dependency on Council funding, which is attached to specific conditions, Council
has high power. However, Council has low interest in day to day operations of NCCP. Hence Council
should be KEEP SATISFIED.

Corporate Donors
The average corporate donation in 20X5 was $47,000. All corporate donors are based in Ceeville
and many have long-standing relationships with NCCP which date back to Richard Tempest’s
time. These corporate donors, who were approached on a personal basis, are friends or colleagues
of trustees or executive directors.

Since NCCP has high dependency on corporate donations, Corporate Donors have high power.
However, since they have low interest in day to day operations of NCCP, they should be KEEP
SATISFIED.

Personal Donors
The average personal donation in 20X5 was $24. Personal donations come mainly from members of
the North Ceeville local community, but also from other individuals in Ceeville who do not use NCCP’s
services but want to support its mission.

Since the overall contribution of personal donation is quite small, Personal Donors can be MINIMUM
EFFORT.
Course Participants
Course fees are payable by participants who attend the course. The contribution of course fees
income in your total income is increasing showing that it is slowly becoming an important income
source.

Further, the core purpose of NCCP is to provide education and training to economic and socially
deprived people of the community. Their feedback and satisfaction is important to achieve the
mission of NCCP. Hence course participants should be KEEP SATISFIED.

(1B) Critically assesses NCCP’s sources of competitive advantage.

Volunteers
Alongside four directors and twelve paid employees, each department benefits from the work of
unpaid volunteers. Having volunteers is an important source of competitive advantage as it directly
reduces costs.

However, the motivation level of volunteers are changing. As one volunteer commented in the staff
survey “I used to love volunteering at NCCP because I felt I could make a difference to people who
really needed help. I don’t feel this any longer and am seriously thinking about leaving.” This could
become a big issue as it is difficult to find dedicated volunteers.

Employees
The survey is showing some alarming results.
- 31% of staff re unhappy (last year: 0%)
- 18% of staff may leave within one year (last year: 0%)
- 88% staff feel that executive board is not fulfilling its mission (last year: 13%)

All these shows that there is severe dissatisfaction and demotivation in staff which needs to be looked
into on an urgent basis.

Financial position
Although NCCP has no long-term debt, its cash reserves are now down to $48,000. Its main
asset is the building itself, which it owns outright and is worth $1·8M.

Total income of NCCP is almost constant. However, there is steady rise in expenditure. Due to this,
the profit are converting into losses. If this situation continues, then NCCP might face going concern
issues.
Brand
NCCP was established 20 years ago. NCCP is well-respected in Ceeville for its good value courses
and lively social environment, both of which were designed to support disadvantaged members
of the North Ceeville community.

However the recent article in newspaper has been a source of controversy across the city.

Strong relationship with Council and Donors

NCCP has been getting government funding for so many years. Also it has long standing relationship
with Corporate Donors most of whom date back to Richard Tempest’s time. these relationship are
important to ensure continuity of funding and donations to run the charity without any interruption.

SINCERELY
CONSULTANT
(2A) Evaluate the executive board’s approach to risk management and
recommend how it could be improved.
Exhibit 5

BRIEFING NOTE
TO: CEO
FROM: CONSULTANT
SUBJECT: RISK MANAGEMENT AND INTERNAL CONTROL INFORMATION
DATE: 7 DEC 2021

This briefing note evaluate the executive board’s approach to risk management and Identify the
external stakeholders with an interest in NCCP’s internal controls and justify why information on
internal controls should be shared with them.

RISK MANAGEMENT

Issues Recommendation
Lack of Involvement
The executive board has always been Risk management should be embedded in the
reluctant to get involved directly in risk culture, which means it should come from top.
management. Instead, operational staff are
expected to deal with risks as they arise, using
their experience where appropriate. The BOT and Executive Board should include
risk management as part of their regular
agenda, so that appropriate importance and
Risk management is an important function. It focus is given to this activity.
cannot be left to operational staff as they may
not have the necessary skills, experience and
decision making powers to take appropriate
decisions.

No risk assessment
A list of over 150 risks were identified and
allocated to different board members.
No risk assessment was done in which risks are
prioritized based on their impact and
probability.
Proper risk assessment should be done. The
Impact and probability of each risk should be
assessed, based on which risks should be
prioritized as high, medium and low.
This will help NCCP in focusing more on high
risks rather than focusing on all risks equally.
 Issues
Quality of Controls
A list of over 150 risks were identified and
controls were implemented within two weeks.
This short timeframe raises serious doubts on
the quality of the controls and its
implementation. It looks like this exercise was
done as a paper-formality to satisfy the BOT.
Recommendation
The quality of the risks identified and their
controls needs to be reviewed. The purpose of
risk management is to protect the organization
from any damage and hence sufficient time
should be spent in implementing the controls.

Inadequate Risk Register

The risk register contains very limited Risk register should include the following
information. Some key information is missing columns:
altogether. - Impact
- Probability
Risk register is the basic document and hence it - Expected Value / Priority
any missing information will directly affect the - Date of next review
quality of risk management activities and
controls.

Next review date missing

At the trustees’ request, the executive board The risk register should be reviewed on a
has agreed to consider repeating this process regular basis. For each risk, the frequency of
at some point in the future. next review should be documented in the risk
register. So that the risk register always
remains up to date.
There is no date or timeline mentioned
regarding next review. This could be dangerous
as risks are dynamic in nature and if the risk
register is not updated regularly, it may expose
the organization.
(2B) Identify the external stakeholders with an interest in NCCP’s internal
controls and justify why information on internal controls should be shared with
them.

Ceeville Council
NCCP relies heavily on Ceeville Council which provides financial support. The Council attaches specific
conditions to its funding which change from year to year.

The Council has indicated that future funding will be conditional on NCCP demonstrating appropriate
internal controls to make best use of any money provided.

Through report on internal controls, Council will assess whether NCCP is complying with the funding
conditions and that the funds are not being misused.

Donors
Following a series of media reports about international charities that misappropriated funds,
corporate and personal donors are taking a keener interest in how charities are being run and how
any donations are being used

Because of risk of misuse or misappropriation of funds, donors would be interested in information

relating to internal controls and that the funds are being used in accordance with the mission and
objectives of the Charity.

Course Participants
course fees are highly subsidized by Council / Donors, hence the course participant are paying a small
amount from their pocket. However they will be more interested in controls over security of their
personal data and credit card information.

There are threats of cyber attacks and this could lead to leakage of sensitive or financial data and
hence course participants would like to have some assurance regarding data and cyber security.

SINCERELY
CONSULTANT
(3A) Assesses the viability of the current range of courses offered by NCCP
Exhibit 4

REPORT
TO: CEO
FROM: CONSULTANT
SUBJECT: CURRENT COURSES AND PROPOSED ART COURSE
DATE: 7 DEC 2021

INTRODUCTION
This report Assesses the viability of the current range of courses offered by NCCP and evaluates your
proposal to offer the new art course.

Computers For Beginners

The number of course bookings is drastically fallen from 1800 to 1100 in two years’ time. this shows
that the demand for this course is falling mainly because in today’s days and time, the new generation
are aware of basic functionalities of a computer.

Website Design
This seems like a popular course as the number of course bookings has increased from 8640 to 10800
in two years’ time. mainly because there is there is high demand for online business and website is
an important component of e-business.

Finding A Job
The number of course bookings has slightly reduced from 5760 to 5600 in two years’ time. However,
since there is no space available in this course it looks like a course which is still in demand.

Business Skills
This is a new course, however but the response is not very encouraging. The number of course
bookings has reduced from 420 to 300 as compared to last year.

However, from 20X4 onwards the funding has been conditional on NCCP running a Business
Skills course as part of the council’s initiative to encourage people to develop business skills.
(3B) Evaluates the CEO’s proposal to offer the new art course.
Exhibit 6

I have reviewed your email regarding the proposed Art Course and I have the following thoughts for
your consideration:

You have mentioned that you there is a gap in the market for art courses. What is the source of your
information? Is there any statistics to back this claim?

You also mentioned that art courses are available elsewhere. How sure you are regarding people
coming to NCCP to attend these courses? Afterall, NCCP is not a art institute and is located in a poor
area of the city.

The courses would run on weekends. As weekends is a busy time for NCCP, how would you run the
art courses? Do you have class rooms? If not, would you shift other courses to weekdays to
accommodate the art classes?

You have assumed 20 participants in each course. What is the basis of this? This is an important
assumption and will directly affect the financial feasibility of the proposal.

The initial cost of designing the course book will be $12,000. In case the courses are not successful as
expected, this will be a sunk cost.

This proposal has substantial cash outflow at the start. $12k for initial designing and $9k for
purchasing a year’s worth of art materials and course books in advance. Have you considered the
impact on NCCP cash / liquidity position which is currently quite low ($48k only).

The public and media feels that the new art courses will bring in people who don’t need NCCP’s help
and push out those who do. Also the Council has threatened to cut the funding if it is felt that NCCP’s
activity is not consistent with Councils priorities. Have you considered these risks?

SINCERELY
CONSULTANT
(4A) Draft sections of a report to present to the board which explain the need
for cybersecurity at NCCP and recommend actions the board should take to
meet its cybersecurity responsibilities.

SECTION OF A REPORT

This section of a report explains the need for cybersecurity at NCCP and recommend actions the
board should take to meet its cybersecurity responsibilities:

Cybersecurity means protection of organizations IT and data from unauthorized access or hacking.

Although the operations directors feels that NCCP may not face this risk as it is a small charitable
organization. However I would like to point out that recently there was a cyber attack on a small
charity organization The Children Trust. Their IT systems were destroyed by a hacker and the
charity has ceased to operate.

Advantage / Need of Cyber security

Hence in today’s day and age cyber security is important for any organization which uses IT in any
form, regardless of the size and nature of the organization.

Cyber security will protect organizations IT systems and data. You must be carrying personal data of
course participants. There will be financial and operational data of the organization.

Cyber security will prevent any business disruption.

Also in case of any data breach or compromise, there are chances of fines by regulators and legal
cases by customers. And reputational loss is possible. All these can be avoided if effective cyber
security controls are implemented.

Recommended Actions:
Cyber security should be given priority at BOT level.

Consultant can be engaged to review the current situation and recommend proper cyber security
policy and procedures suitable for NCCP.

Physical access controls should be implemented. For e.g. servers can be kept in a secure room with
restricted access.
Logical access controls should be implemented such as mandatory password chages, one time
passwords, etc.

Lastly, latest firewalls should be installed to provide security against hackers.

SINCERELY
CONSULTANT
(4B) Draft an email on behalf of the operations director to send to the CEO
which explains why it would be appropriate for him to be the project sponsor,
but not both the sponsor and project manager for the cybersecurity project.

DRAFT EMAIL
TO: CEO
FROM: OPERATIONS DIRECTOR
SUBJECT: CYBER SECURITY PROJECT
DATE: 7 DEC 2021

This email explains why it would be appropriate for me to be the project sponsor, but not both the
sponsor and project manager for the cybersecurity project.

Segregation of duty
Project sponsor and a project manager are two different roles. Project sponsor provides guidance
and leadership to the project whereas project manager is involved in day to day execution of the
project.

There will be no segregation of duties if one person does both roles.

Expertise
Project manager requires technical skills relating to cyber security. I am not an IT professional and
have limited experience of cyber security. A separate project manger will possess the necessary skills
and experience.

More focused
I am already working as operations director. I will not eb able to devote full time to the cyber security
project otherwise my other responsibilities will suffer. A separate project manger can focus full time
on the project.

SINCERELY
OPERATIONS DIRECTOR
Mr Allen was also asked whether NCCP was concerned following the recent cyberattack on The
Children’s Trust (TCT), another small charity in Ceeville. TCT’s IT systems were destroyed by a
hacker and the charity has ceased to operate
SLIDE 1

BENEFITS OF INTEGRATED THINKING

Long term strategic focus

•

• More holistic
 • Wider stakeholders

• Includes social and environmental initiatives

SLIDE 1 - ACCOMPANYING NOTES:

An influential institutional shareholder perceives that the board is short-sighted and narrow focused as it is
adopting low cost – low price business model. An integrated thinking / report will help shareholder understand
organization’s long term strategic direction.
(i) Evaluate the appropriateness of the risk responses of the operations director and
the human resource director; and

APPROPRIATENESS OF RISK RESPONSES

OPERATIONS DIRECTOR:
• Customers are unaware
• Globally accepted practice
• Unethical

HR DIRECTOR:
• Stop immediately at all cost
• Not practical

Accompanying notes
The operations director stated that no response is needed, as 95% customers are unaware of the
issue, and 90% of chocolate companies purchase cocoa from these farmers. However, I disagree with
this approach as it seems unethical and causes doubt over our integrity.

The human resource director insisted that this risk must be removed at all costs and that Dulce must
stop using all cocoa farmers who use child-labour immediately and look for new cocoa farmers.
Although principally I agree with the HR director, it will take time to identify supplier who are not
involved in child labour. We cannot disrupt our production in the meantime.