Exhibit 6 - Memoranum on Internal Control — Alameda City Council, July 12, 2022

CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL
FOR THE YEAR ENDED JUNE 30, 2021
This Page Left Intentionally Blank

CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL
For the Year Ended June 30, 2021
Table of Contents
Page
Memorandum on Internal Control. ...1
City:

Schedule of Material Weaknesses ... ...3
Schedule of Significant Deficiencies. ...5
Schedule of Other Matters ...7
City:

Current Status of Prior Year Material Weaknesses .. 17
Current Status of Prior Year Significant Deficiencies. ..19 Current Status of Prior Year Other Matters ..27
Alameda Municipal Power:

Current Status of Prior Year Significant Deficiencies. ...39 This Page Left Intentionally Blank
M MAZE
& ASSOCIATES

MEMORANDUM ON INTERNAL CONTROL
To the City Council of
the City of Alameda, California
In planning and performing our audit of the basic financial statements of the City as of and for the year City's internal control.

Our consideration of internal control was for the limited purpose described in the preceding paragraph and was not designed to identify all deficiencies in internal control that might be material weaknesses or significant deficiencies and, therefore material weaknesses or significant deficiencies may exist that were not identified. In addition, because of inherent limitations in internal control, including the possibility of management override of controls, misstatements due to error or fraud may occur and not be detected by such controls. However, as discussed below, we identified certain deficiencies in internal control that we consider to be material weaknesses and other deficiencies that we consider to be significant deficiencies.

A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the City's financial statements will not be prevented, or detected and corrected, on a timely basis. We consider the deficiencies in internal control included on the Schedule of Material Weaknesses to be material weaknesses.

A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. We consider the deficiencies in internal control included on the Schedule of Significant Deficiencies to be significant deficiencies.

Included in the Schedule of Other Matters are recommendations not meeting the above definitions that we believe are opportunities for strengthening internal controls and operating efficiency.

Management's written responses included in this report have not been subjected to the audit procedures applied in the audit of the financial statements and, accordingly, we express no opinion on them. т 925.930.0902
Accountancy Corporation = 925.930.0135
3478 Buskirk Avenue, Suite 215 « [email protected] Pleasant Hill, CA 94523 w mazeassociates.com
1 This communication is intended solely for the information and use of management, City Council, others within the organization, and agencies and pass-through entities requiring compliance with Government Auditing Standards, and is not intended to be and should not be used by anyone other than these specified parties.

Maye &Associates
Pleasant Hill, California
February 9, 2022
2 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF MATERIAL WEAKNESSES
2021-01 Timeliness and Accuracy of Year-End Close
balances and activities.
closing adjustment entries. City staff had difficulty completing material closing entries prior to providing the general ledger for audit for areas including deferred rents receivable, unavailable revenue, unearned revenue, long-term debt, pension expenditures, pension liabilities and related deferred outflows/inflows of resources, and OPEB liabilities and related deferred outflows/inflows of resources. In addition, during our audit of the City's pension and OPEB transactions, we noted that there were errors in three actuary reports and the OPEB Trust PARS statement that were not detected by City staff. Finally, we also noted that the City had not billed Alameda Municipal Power for its share of pension costs or claims payable during the fiscal year and over $2 million was due from the Alameda Municipal Power Enterprise Fund to the General Fund as of June 30, 2021. These areas affected the year-end closing process and many of the City's funds.

The above condition again delayed the completion of the year-end closing process, which increases the risk that errors or misstatements may go undetected by staff and corrections may not be made in a timely manner. Audit effort was substantially increased in response to these increased risks.

Although we did note that the City hired a Controller in January 2022, the Finance Director position was vacant as of February 2022. The City should analyze staff resources to determine what plans can or should be made to ensure that the financial data is processed properly and timely during staffing transitions. The City must also develop procedures to ensure that accounts are analyzed throughout the fiscal year and after the year end close to ensure that additional closing entries are not required prior to providing the general ledger for audit. This process will also be significantly impacted by the City's system implementation that started in fiscal year 2021 and continued into fiscal year 2022, which will put an additional strain on staff resources and require the need for additional planning and procedures to ensure a smooth year end closing process.

Management's Response:

In addition to the new Controller position that has been filled in January 2022, a new Finance Director has been recruited and hired in April 2022. The City has budgeted to contract consultants during FY 2023 to enhance accounting policies and procedures throughout the Finance Department. A new comprehensive review procedure has been put in place to detect errors in third-party reports during our year-end review process. While we understand the new ERP implementation has strained and continues to strain our current staff, efforts to bolster our staff by this fiscal year end are in progress, including recruitment of a new Accountant II, bringing on part-time help and contracting outside accounting services. 3 This Page Left Intentionally Blank

CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF SIGNIFICANT DEFICIENCIES
2021-02 Prior Year Recommendations Not Yet Implemented
During the current year audit, we followed up on the status of Significant Deficiencies identified on the Status of Prior Year Significant Deficiencies. We found that the following deficiencies had either been partially or not mitigated at June 30, 2021. Therefore, they are deemed to be current year Significant Deficiencies. Details of these deficiencies and associated management's responses are listed in the Status of Prior Year Significant Deficiencies.
2019-02 Segregation of Duties in Major Control Areas
• 2019-03 Timely Review of Bank Reconciliations
2019-04 Timely Preparation and Review of Quarterly Investment Reports 2018-01 Segregation of Duties in Major Control Areas
Management's Response:

See Management's Response to Current Year Status for each of the above deficiencies as listed in the Status of Prior Year Significant Deficiencies.
2021-03 Transportation Development Act Grant Drawdown
Grant reimbursement requests should be prepared periodically after grant-eligible expenditures are incurred.

The City received a grant allocation from the Metropolitan Transportation Commission (MTC) in August 2019 in the amount of $81,800 for the bicycle and pedestrian Active Transportation Plan. The City identified. After we indicated the grant-eligible costs had been identified in the prior fiscal year, City staff determined that the reimbursement request had not yet been filed.

We understand the reimbursement request had not been filed due to workloads placed on City staff.

Failure to file timely reimbursement requests could jeopardize grant funding.

The City should file the reimbursement request with MTC as soon as possible, since the grant award expires in June 2022. In addition, the City should develop procedures to ensure that grant reimbursements are filed at least quarterly to improve cash flow and ensure that the reimbursement occurs prior to the grant expiration.

Management's Response:

The reimbursement request discussed was filed May 17, 2022 and thus filed within granting guidelines. The Senior Transportation Coordinator had not yet filed for reimbursement as the due date was June 30, 2022 and other, more pressing matters took precedence. 5 This Page Left Intentionally Blank

CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS

NEW GASB PRONOUNCEMENTS OR PRONOUNCEMENTS NOT YET EFFECTIVE The following comment represents new pronouncements taking affect in the next few years. We have cited them here to keep you informed of developments:

EFFECTIVE FISCAL YEAR 2021/22:

GASB 87 - Leases
The objective of this Statement is to better meet the information needs of financial statement users by resources or outflows of resources based on the payment provisions of the contract. It establishes a single model for lease accounting based on the foundational principle that leases are financings of the right to use an underlying asset. Under this Statement, a lessee is required to recognize a lease liability and an intangible right-to-use lease asset, and a lessor is required to recognize a lease receivable and a deferred inflow of resources, thereby enhancing the relevance and consistency of information about governments' leasing activities.

A lease is defined as a contract that conveys control of the right to use another entity's nonfinancial asset (the underlying asset) as specified in the contract for a period of time in an exchange or exchange-like transaction. Examples of nonfinancial assets include buildings, land, vehicles, and equipment. Any contract that meets this definition should be accounted for under the leases guidance, unless specifically excluded in this Statement.

GASB 89 - Accounting for Interest Cost Incurred before the End of a Construction Period The objectives of this Statement are (1) to enhance the relevance and comparability of information about capital assets and the cost of borrowing for a reporting period and (2) to simplify accounting for interest cost incurred before the end of a construction period.

This Statement establishes accounting requirements for interest cost incurred before the end of a construction period. Such interest cost includes all interest that previously was accounted for in accordance with the requirements of paragraphs 5-22 of Statement No. 62, Codification of Accounting and Financial Reporting Guidance Contained in Pre-November 30, 1989 FASB and AICPA Pronouncements, which are superseded by this Statement. This Statement requires that interest cost incurred before the end of a construction period be recognized as an expense in the period in which the cost is incurred for financial statements prepared using the economic resources measurement focus. As a result, interest cost incurred before the end of a construction period will not be included in the historical cost of a capital asset reported in a business-type activity or enterprise fund.

This Statement also reiterates that in financial statements prepared using the current financial resources measurement focus, interest cost incurred before the end of a construction period should be recognized as an expenditure on a basis consistent with governmental fund accounting principles. 7 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 92 - Omnibus 2020
The objectives of this Statement are to enhance comparability in accounting and financial reporting and to improve the consistency of authoritative literature by addressing practice issues that have been identified during implementation and application of certain GASB Statements. This Statement addresses a variety of topics and includes specific provisions about the following:
• The effective date of Statement No. 87, Leases, and Implementation Guide No. 2019-3, Leases, for interim financial reports
• Reporting of intra-entity transfers of assets between a primary government employer and a component unit defined benefit pension plan or defined benefit other postemployment benefit (OPEB) plan
• The applicability of Statements No. 73, Accounting and Financial Reporting for Pensions and Related Assets That Are Not within the Scope of GASB Statement 68, and Amendments to Certain Provisions of GASB Statements 67 and 68, as amended, and No. 74, Financial Reporting for Postemployment Benefit Plans Other Than Pension Plans, as amended, to reporting assets accumulated for postemployment benefits
• The applicability of certain requirements of Statement No. 84, Fiduciary Activities, to postemployment benefit arrangements
• Measurement of liabilities (and assets, if any) related to asset retirement obligations (AROs) in a government acquisition
• Reporting by public entity risk pools for amounts that are recoverable from reinsurers or excess insurers
• Reference to nonrecurring fair value measurements of assets or liabilities in authoritative literature
• Terminology used to refer to derivative instruments
GASB 93 - Replacement of Interbank Offered Rates
Some governments have entered into agreements in which variable payments made or received depend on an interbank offered rate (IBOR)-most notably, the London Interbank Offered Rate (LIBOR). As a result of global reference rate reform, LIBOR is expected to cease to exist in its current form at the end of 2021, prompting governments to amend or replace financial instruments for the purpose of replacing LIBOR with other reference rates, by either changing the reference rate or adding or changing fallback provisions related to the reference rate.

Statement No. 53, Accounting and Financial Reporting for Derivative Instruments, as amended, requires a government to terminate hedge accounting when it renegotiates or amends a critical term of a hedging derivative instrument, such as the reference rate of a hedging derivative instrument's variable payment.

In addition, in accordance with Statement No. 87, Leases, as amended, replacement of the rate on which variable payments depend in a lease contract would require a government to apply the provisions for lease modifications, including remeasurement of the lease liability or lease receivable. 8 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 93 - Replacement of Interbank Offered Rates (Continued) The objective of this Statement is to address those and other accounting and financial reporting implications that result from the replacement of an IBOR. This Statement achieves that objective by:
• Providing exceptions for certain hedging derivative instruments to the hedge accounting termination provisions when an IBOR is replaced as the reference rate of the hedging derivative instrument's variable payment
• Clarifying the hedge accounting termination provisions when a hedged item is amended to replace the reference rate
• Clarifying that the uncertainty related to the continued availability of IBORs does not, by itself affect the assessment of whether the occurrence of a hedged expected transaction is probabl • Removing LIBOR as an appropriate benchmark interest rate for the qualitative evaluation of the effectiveness of an interest rate swap
• Identifying a Secured Overnight Financing Rate and the Effective Federal Funds Rate as appropriate benchmark interest rates for the qualitative evaluation of the effectiveness of an interest rate swap
• Clarifying the definition of reference rate, as it is used in Statement 53, as amended Providing an exception to the lease modifications guidance in Statement 87, as amended, for certain lease contracts that are amended solely to replace an IBOR as the rate upon which variable payments depend.

GASB 97 - Certain Component Unit Criteria, and Accounting for and Financial Reporting for Internal Revenue Code Section 457 Deferred Compensation Plans The primary objectives of this Statement are to (1) increase consistency and comparability related to the reporting of fiduciary component units in circumstances in which a potential component unit does not have a governing board and the primary government performs the duties that a governing board typically would perform; (2) mitigate costs associated with the reporting of certain defined contribution pension plans, defined contribution other postemployment benefit (OPEB) plans, and employee benefit plans other than pension plans or OPEB plans (other employee benefit plans) as fiduciary component units in fiduciary fund financial statements; and (3) enhance the relevance, consistency, and comparability of the accounting and financial reporting for Internal Revenue Code (IRC) Section 457 deferred compensation plans (Section 457 plans) that meet the definition of a pension plan and for benefits provided through those plans.

This Statement requires that for purposes of determining whether a primary government is financially accountable for a potential component unit, except for a potential component unit that is a defined contribution pension plan, a defined contribution OPEB plan, or an other employee benefit plan (for example, certain Section 457 plans), the absence of a governing board should be treated the same as the appointment of a voting majority of a governing board if the primary government performs the duties that a governing board typically would perform.

This Statement also requires that the financial burden criterion in paragraph 7 of Statement No. 84, Fiduciary Activities, be applicable to only defined benefit pension plans and defined benefit OPEB plans that are administered through trusts that meet the criteria in paragraph 3 of Statement No. 67, Financial Reporting for Pension Plans, or paragraph 3 of Statement No. 74, Financial Reporting for Postemployment Benefit Plans Other Than Pension Plans, respectively. 9 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 97 - Certain Component Unit Criteria, and Accounting for and Financial Reporting for Internal Revenue Code Section 457 Deferred Compensation Plans (Continued) This Statement supersedes the remaining provisions of Statement No. 32, Accounting and Financia eporting for Internal Revenue Code Section 457 Deferred Compensation Plans, as amended, regardin investment valuation requirements for Section 457 plans. As a result, investments of all Section 457 plans should be measured as of the end of the plan's reporting period in all circumstances.

The requirements of this Statement that (1) exempt primary governments that perform the duties that a governing board typically performs from treating the absence of a governing board the same as the appointment of a voting majority of a governing board in determining whether they are financially accountable for defined contribution pension plans, defined contribution OPEB plans, or other employee benefit plans and (2) limit the applicability of the financial burden criterion in paragraph 7 of Statement 84 to defined benefit pension plans and defined benefit OPE plans that are administered through trusts that meet the criteria in paragraph 3 of Statement 67 or paragraph 3 of Statement 74, respectively, are effective immediately.

The requirements of this Statement that are related to the accounting and financial reporting for Section 457 plans are effective for fiscal years beginning after June 15, 2021. For purposes of determining whether a primary government is financially accountable for a potential component unit, the requirements of this Statement that provide that for all other arrangements, the absence of a governing board be treated the same as the appointment of a voting majority of a governing board if the primary government performs the duties that a governing board typically would perform, are effective for reporting periods beginning after June 15, 2021. Earlier application of those requirements is encouraged and permitted by requirement as specified within this Statement.

How the Changes in this Statement will Improve Financial Reporting The requirements of this Statement will result in more consistent financial reporting of defined contribution pension plans, defined contribution OPEB plans, and other employee benefit plans, while mitigating the costs associated with reporting those plans. The requirements also will enhance the relevance, consistency, and comparability of (1) the information related to Section 457 plans that meet the definition of a pension plan and the benefits provided through hose plans and (2) investment information for all 457 plans.
10 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
EFFECTIVE FISCAL YEAR 2022/23:

GASB 91 - Conduit Debt Obligations
The primary objectives of this Statement are to provide a single method of reporting conduit debt obligations by issuers and eliminate diversity in practice associated with (1) commitments extended by issuers, (2) arrangements associated with conduit debt obligations, and (3) related note disclosures. This tatement achieves those objectives by clarifying the existing definition of a conduit debt obligatior stablishing that a conduit debt obligation is not a liability of the issuer; establishing standards fo accounting and financial reporting of additional commitments and voluntary commitments extended by issuers and arrangements associated with conduit debt obligations; and improving required note disclosures.

A conduit debt obligation is defined as a debt instrument having all of the following characteristics:
• There are at least three parties involved:
(1) an issuer
(2) a third-party obligor, and
(3) a debt holder or a debt trustee.
• The issuer and the third-party obligor are not within the same financial reporting entity. • The debt obligation is not a parity bond of the issuer, nor is it cross-collateralized with other debt of the issuer.
• The third-party obligor or its agent, not the issuer, ultimately receives the proceeds from the debt • The third-party obligor, not the issuer, is primarily obligated for the payment of all amounts associated with the debt obligation (debt service payments).

All conduit debt obligations involve the issuer making a limited commitment. Some issuers extend additional commitments or voluntary commitments to support debt service in the event the third party is, or will be, unable to do so.

An issuer should not recognize a conduit debt obligation as a liability. However, an issuer should recognize a liability associated with an additional commitment or a voluntary commitment to support debt service if certain recognition criteria are met. As long as a conduit debt obligation is outstanding, an issuer that has made an additional commitment should evaluate at least annually whether those criteria are met. An issuer that has made only a limited commitment should evaluate whether those criteria are met when an event occurs that causes the issuer to reevaluate its willingness or ability to support the obligor's debt service through a voluntary commitment.

This Statement also addresses arrangementsoften characterized as leases that are associated with conduit debt obligations. In those arrangements, capital assets are constructed or acquired with the proceeds of a conduit debt obligation and used by third-party obligors in the course of their activities.

Payments from third-party obligors are intended to cover and coincide with debt service payments.

During those arrangements, issuers retain the titles to the capital assets. Those titles may or may not pass to the obligors at the end of the arrangements.
11 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 91 - Conduit Debt Obligations (Continued)
Issuers should not report those arrangements as leases, nor should they recognize a liability for the related conduit debt obligations or a receivable for the payments related to those arrangements. In addition, the following provisions apply:
• If the title passes to the third-party obligor at the end of the arrangement, an issuer should not recognize a capital asset.
• If the title does not pass to the third-party obligor and the third party has exclusive use of the entire capital asset during the arrangement, the issuer should not recognize a capital asset until the arrangement ends.
• If the title does not pass to the third-party obligor and the third party has exclusive use of only portions of the capital asset during the arrangement, the issuer, at the inception of the arrangement, should recognize the entire capital asset and a deferred inflow of resources. The deferred inflow of resources should be reduced, and an inflow recognized, in a systematic and rational manner over the term of the arrangement.

This Statement requires issuers to disclose general information about their conduit debt obligations, organized by type of commitment, including the aggregate outstanding principal amount of the issuers' conduit debt obligations and a description of each type of commitment. Issuers that recognize liabilities related to supporting the debt service of conduit debt obligations also should disclose information about the amount recognized and how the liabilities changed during the reporting period.

How the Changes in this Statement will Improve Financial Reporting The requirements of this Statement will improve financial reporting by eliminating the existing option for issuers to report conduit debt obligations as their own liabilities, thereby ending significant diversity in practice. The clarified definition will resolve stakeholders' uncertainty as to whether a given financing is, in fact, a conduit debt obligation. Requiring issuers to recognize liabilities associated with additional commitments extended by issuers and to recognize assets and deferred inflows of resources related to certain arrangements associated with conduit debt obligations also will eliminate diversity, thereby improving comparability in reporting by issuers. Revised disclosure requirements will provide financial statement users with better information regarding the commitments issuers extend and the likelihood that they will fulfill those commitments. That information will inform users of the potential impact of such commitments on the financial resources of issuers and help users assess issuers' roles in conduit debt obligations.
12 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 94 - Public-Private and Public-Public Partnerships and Availability Payment Arrangements The primary objective of this Statement is to improve financial reporting by addressing issues related to public-private and public-public partnership arrangements (PPPs). As used in this Statement, a PPP is an arrangement in which a government (the transferor) contracts with an operator (a governmental or nongovernmental entity) to provide public services by conveying control of the right to operate or use a nonfinancial asset, such as infrastructure or other capital asset (the underlying PPP asset), for a period of time in an exchange or exchange-like transaction. Some PPPs meet the definition of a service concession arrangement (SCA), which the Board defines in this Statement as a PPP in which (I) the operator collects and is compensated by fees from third parties; (2) the transferor determines or has the ability to modify or approve which services the operator is required to provide, to whom the operator is required to provide the services, and the prices or rates that can be charged for the services; and (3) the transferor is entitled to significant residual interest in the service utility of the underlying PPP asset at the end of the arrangement.

This Statement also provides guidance for accounting and financial reporting for availability payment arrangements (APAs). As defined in this Statement, an APA is an arrangement in which a government compensates an operator for services that may include designing, constructing, financing, maintaining, or operating an underlying nonfinancial asset for a period of time in an exchange or exchange-like transaction.

PPPs - This Statement requires that PPPs that meet the definition of a lease apply the guidance in Statement No. 87, Leases, as amended, if existing assets of the transferor that are not required to be improved by the operator as part of the PPP arrangement are the only underlying PPP assets and the PPP does not meet the definition of an SCA. This Statement provides accounting and financial reporting requirements for all other PPPs: those that either (1) meet the definition of an SCA or (2) are not within the scope of Statement 87, as amended (as clarified by this Statement). The PPP term is defined as the period during which an operator has a noncancellable right to use an underlying PPP asset, plus, if applicable, certain periods if it is reasonably certain, based on all relevant factors, that the transferor or the operator either will exercise an option to extend the PPP or will not exercise an option to terminate the PPP.

A transferor generally should recognize an underlying PPP asset as an asset in financial statements prepared using the economic resources measurement focus. However, in the case of an underlying PPP asset that is not owned by the transferor or is not the underlying asset of an SCA, a transferor should recognize a receivable measured based on the operator's estimated carrying value of the underlying PPP asset as of the expected date of the transfer in ownership. In addition, a transferor should recognize a receivable for installment payments, if any, to be received from the operator in relation to the PPP.

Measurement of a receivable for installment payments should be at the present value of the payments expected to be received during the PPP term. A transferor also should recognize a deferred inflow of resources for the consideration received or to be received by the transferor as part of the PPP. Revenue should be recognized by a transferor in a systematic and rational manner over the PPP term.

This Statement requires a transferor to recognize a receivable for installment payments and a deferred inflow of resources to account for a PPP in financial statements prepared using the current financial resources measurement focus. Governmental fund revenue would be recognized in a systematic and rational manner over the PPP term.
13 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 94 - Public-Private and Public-Public Partnerships and Availability Payment Arrangements. (Continued)
This Statement also provides specific guidance in financial statements prepared using the economic resources measurement focus for a government that is an operator in a PPP that either (1) meets the definition of an SCA or (2) is not within the scope of Statement 87, as amended (as clarified in this Statement). An operator should report an intangible right-to-use asset related to an underlying PPP asset that either is owned by the transferor or is the underlying asset of an SCA. Measurement of the right-to- use asset should be the amount of consideration to be provided to the transferor, plus any payments made to the transferor at or before the commencement of the PPP term, and certain direct costs. For an underlying PPP asset that is not owned by the transferor and is not the underlying asset of an SCA, an operator should recognize a liability measured based on the estimated carrying value of the underlying PPP asset as of the expected date of the transfer in ownership. In addition, an operator should recognize a liability for installment payments, if any, to be made to the transferor in relation to the PPP.

Measurement of a liability for installment payments should be at the present value of the payments expected to be made during the PPP term. An operator also should recognize a deferred outflow of resources for the consideration provided or to be provided to the transferor as part of the PPP. Expense should be recognized by an operator in a systematic and rational manner over the PPP term.

This Statement also requires a government to account for PPP and non-PPP components of a PPP as separate contracts. If a PPP involves multiple underlying assets, a transferor and an operator in certain cases should account for each underlying PPP asset as a separate PPP. To allocate the contract price to different components, a transferor and an operator should use contract prices for individual components as long as they do not appear to be unreasonable based on professional judgment or use professional judgment to determine their best estimate if there are no stated prices or if stated prices appear to be unreasonable. If determining the best estimate is not practicable, multiple components in a PPP should be accounted for as a single PPP.

This Statement also requires an amendment to a PPP to be considered a PPP modification, unless the operator's right to use the underlying PPP asset decreases, in which case it should be considered a partial or full PPP termination. A PPP termination should be accounted for by a transferor by reducing, as applicable, any receivable for installment payments or any receivable related to the transfer of ownership of the underlying PPP asset and by reducing the related deferred inflow of resources. An operator should account for a termination by reducing the carrying value of the right-to-use asset and, as applicable, any liability for installment payments or liability to transfer ownership of the underlying PPP asset. A PPP modification that does not qualify as a separate PPP should be accounted for by remeasuring PPP assets and liabilities.

APAs - An APA that is related to designing, constructing, and financing a nonfinancial asset in which ownership of the asset transfers by the end of the contract should be accounted for by a government as a financed purchase of the underlying nonfinancial asset. This Statement requires a government that engaged in an APA that contains multiple components to recognize each component as a separate arrangement. An APA that is related to operating or maintaining a nonfinancial asset should be reported by a government as an outflow of resources in the period to which payments relate. 14 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 96 - Subscription-Based Information Technology Arrangements This Statement provides guidance on the accounting and financial reporting for subscription-based information technology arrangements (SBITAs) for government end users (governments). This Statement (1) defines a SBITA; (2) establishes that a SBITA results in a right-to-use subscription asset-an tangible ascha nd a corresponding subscription limblem (3) provides the pital in erie in mays omer man suoscrocon Davments. u
note disclosures regarding a SBITA. To the extent relevant, the standards for SBITAs are based on the standards established in Statement No. 87, Leases, as amended.

The subscription term includes the period during which a government has a noncancelable right to use the underlying IT assets. The subscription term also includes periods covered by an option to extend (if it is reasonably certain that the government or SBITA vendor will exercise that option) or to terminate (if it is reasonably certain that the government or SBITA vendor will not exercise that option).

Under this Statement, a government generally should recognize a right-to-use subscription asset-an intangible asset- -and a corresponding subscription liability. A government should recognize the subscription liability at the commencement of the subscription term, —which is when the subscription asset is placed into service. The subscription liability should be initially measured at the present value of subscription payments expected to be made during the subscription term. Future subscription payments should be discounted using the interest rate the SBITA vendor charges the government, which may be implicit, or the government's incremental borrowing rate if the interest rate is not readily determinable. A government should recognize amortization of the discount on the subscription liability as an outflow of resources (for example, interest expense) in subsequent financial reporting periods.

The subscription asset should be initially measured as the sum of (1) the initial subscription liability amount, (2) payments made to the SBITA vendor before commencement of the subscription term, and (3) capitalizable implementation costs, less any incentives received from the SBITA vendor at or before the commencement of the subscription term. A government should recognize amortization of the subscription asset as an outflow of resources over the subscription term.

Activities associated with a SBITA, other than making subscription payments, should be grouped into the following three stages, and their costs should be accounted for accordingly:
• Preliminary Project Stage, including activities such as evaluating alternatives, determining needed technology, and selecting a SBITA vendor. Outlays in this stage should be expensed as incurred. • Initial Implementation Stage, including all ancillary charges necessary to place the subscription asset into service. Outlays in this stage generally should be capitalized as an addition to the subscription asset.
• Operation and Additional Implementation Stage, including activities such as subsequent implementation activities, maintenance, and other activities for a government's ongoing operations related to a SBITA. Outlays in this stage should be expensed as incurred unless they meet specific capitalization criteria.
15 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 96 - Subscription-Based Information Technology Arrangements (Continued) In classifying certain outlays into the appropriate stage, the nature of the activity should be the determining factor. Training costs should be expensed as incurred, regardless of the stage in which they are incurred.

If a SBITA contract contains multiple components, a government should account for each component as a separate SBITA or nonsubscription component and allocate the contract price to the differe mponents. If it is not practicable to determine a best estimate for price allocation for some or a components in the contract, a government should account for those components as a single SBITA.

This Statement provides an exception for short-term SBITAs. Short-term SBITAs have a maximum possible term under the SBITA contract of 12 months (or less), including any options to extend, regardless of their probability of being exercised. Subscription payments for short-term SBITAs should be recognized as outflows of resources.

This Statement requires a government to disclose descriptive information about its SBITAs other than short-term SBITAs, such as the amount of the subscription asset, accumulated amortization, other payments not included in the measurement of a subscription liability, principal and interest requirements for the subscription liability, and other essential information.

How the Changes in this Statement will Improve Financial Reporting The requirements of this Statement will improve financial reporting by establishing a definition for SBITAs and providing uniform guidance for accounting and financial reporting for transactions that meet that definition. That definition and uniform guidance will result in greater consistency in practice.

Establishing the capitalization criteria for implementation costs also will reduce diversity and improve comparability in financial reporting by governments. This Statement also will enhance the relevance and reliability of a government's financial statements by requiring a government to report a subscription asset and subscription liability for a SBITA and to disclose essential information about the arrangement. The disclosures will allow users to understand the scale and important aspects of a government's SBITA activities and evaluate a government's obligations and assets resulting from SBITAs. 16 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

MATERIAL WEAKNESSES
2020-01 Timeliness and Accuracy of Year-End Close
As noted in prior year comment 2019-01, well-managed organizations should develop a plan to ensure accounting processes and procedures continue and allow time for analysis of account balances and activities.
post-closing journal entries, including a number of material post-closing adjustment entries. City staff had difficulty completing material closing entries prior to providing the general ledger for audit for areas including the fair value adjustment for cash and investments, capital assets, unavailable revenue, claims payable, long-term debt, pension liabilities and related deferred outflows/inflows of resources, and OPEB liabilities and related deferred outflows/inflows of resources. We also noted that the revenue budget for one fund had been recorded in an incorrect account, and during our audit of the City's OPEB transactions, we noted that there were errors in the amortization schedules in the two actuary reports that were not detected by City staff. These areas affected the year-end closing process and most of the City's funds.

The City should analyze staff resources to determine what plans can or should be made to ensure that the financial data is processed properly and timely during staffing transitions. The City must also develop procedures to ensure that accounts are analyzed throughout the fiscal year and after the year end close to ensure that additional closing entries are not required prior to providing the general ledger for audit. This process will also be significantly impacted by the City's planned system implementation in fiscal year 2021, which will put an additional strain on staff resources and require the need for additional planning and procedures to ensure a smooth year end closing process.

Current Status:

See current year comment 2021-01.
17 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

MATERIAL WEAKNESSES
2019-01 Timeliness of Year-End Close
Well-managed organizations should develop a plan to ensure that adequate resources will remain avid on the ento to ply gade pinue posit of, as pensly in there are reso Des avainable the be resources need to be in place throughout the fiscal year to ensure accounting processes and procedures continue and allow time for analysis of account balances and activities.

Due to the staff turnover during the year, there is a significant strain on the City's ability to maintain a completing material closing entries prior to providing the general ledger for audit for areas including cash and investments, accounts receivable, interfund transactions, capital assets, pension liabilities and related deferred outflows/inflows of resources, and OPEB liabilities and related deferred outflows/inflows of resources. These areas affected the year-end closing process and most of the City's funds.

The above condition delayed the completion of the year-end closing process, which increases the risk that errors or misstatements may go undetected by staff and corrections may not be made in a timely manner.

Audit effort was substantially increased in response to these increased risks.

See comment 2021-01
18 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

SIGNIFICANT DEFICIENCIES
2020-02 Prior Year Recommendations Not Yet Implemented
During the current year audit, we followed up on the status of Significant Deficiencies identified on the of Prior Year Significant Deficiencies.
2019-02 Segregation of Duties in Major Control Areas
2019-03 Timely Review of Bank Reconciliations
2019-04 Timely Preparation and Review of Quarterly Investment Reports 2018-01 Segregation of Duties in Major Control Areas
• 2018-03 Purchasing Policy Compliance
Current Status:

See Management's Response to Current Year Status for each of the above deficiencies as listed in the Status of Prior Year Significant Deficiencies.
2019-02 Segregation of Duties in Major Control Areas
During our review of the City's internal controls for proper segregation of duties and procedures and as noted in prior year Memorandum on Internal Control comment 2018-01, we noted areas in which controls need to be improved and employee's access and/or duties revised. Good internal controls require that employees with access to the City's assets not have access to edit the City's accounting records for the same assets. Inappropriate access could potentially result in undetected errors or unauthorized transactions.
a) Access to Customer Database and Cash Receipts/ Non-Sufficient Funds Checks City staff that is involved in the cash receipts process should not normally be allowed to have ccess to make changes to the customer database. And, employees that generate account eceivable billings should not be involved with the collection of cash receipts or processing o non-sufficient funds checks and ability to adjust the general ledger.

The Finance Supervisor and the Accounting Technician handle cash receipts and have access to does ust mpedatabash angesuf the customer dacks are areviewed thn acher, gee Acide it Clerks that handle cash receipts also have access to the customer database, and, the Accounting Technician generates accounts receivable billings.

We understand the Finance Department was understaffed, which resulted in a need to reallocate certain employee duties.

CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

SIGNIFICANT DEFICIENCIES
2019-02 Segregation of Duties in Major Control Areas (Continued) involved with both billings and collections and if the Accounting Technician continues to prepare Current Status:

The Finance Supervisor reviews daily cash receipts entry and posts the activity to the general ledger. She does not update or enter the information as she can only query the customer database.

The Accounting Technician has provided training to the two Account Clerks on the Accounts Receivable and cash receipts system. However, the Accounting Technician is no longer a backup to these two Account Clerks. The Accounting Technician is a backup to the Finance Supervisor. b) Finance Staff with General Ledger Super User Rights
A system super-user is an individual who has full access over the City's financial system including all modules and all functions. Accounting staff should not normally be allowed to have super-user rights in the City's general ledger system.

We noted that the City's Finance Supervisor has super-user access to the City's general ledger system.

When accounting staff have super-user rights, there is a potential risk of restricting or allowing access to other user's abilities to access the different modules in the accounting system. In addition, unauthorized transactions and misstatements may occur without timely detection and correction.

We understand that City staff believes sufficient controls are in place to mitigate the risk.

The City should consider restricting super user rights to as few employees as possible, preferably to those outside of the Finance Department, such as Information Technology personnel, since they are not involved with processing or approving general ledger transactions. Until that is possible, the City should implement mitigating controls such as a review and approval of changes made to the system by the above employee.

Current Status:

We agree with the finding on super-user access and have re-assigned super-user responsibility to the Finance Director. A new procedure has been implemented where staff must request authorization from the Finance Director before any user access changes can be made in the Financial System.

The Finance Director is now responsible for the review and sign-off on all user access requests in the Financial System.
20 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

SIGNIFICANT DEFICIENCIES
2019-02 Segregation of Duties in Major Control Areas (Continued) City staff must develop procedures to review the City's internal controls to ensure there is proper segregation of duties and that there is documentation of the review and approval of transactions and reconciliations in key control areas. Where internal control conflicts exist, if mitigating controls cannot be put in place to reduce the internal control risk, then either the ability to process the transaction or the access to the asset should be transferred to another appropriate employee.

In response to the prior year comments on the same topic, City staff indicated that it is not feasible to remove or revise super-user and customer database access from all Finance Department staff and that the City has implemented other review and approval internal controls.

Although we agree that the City has other controls in place to mitigate the super-user risk, the City should consider implementing procedures to review/approve any system changes initiated by the Finance Supervisor and the other employees.
2019-03 Timely Review of Bank Reconciliations
Bank reconciliations are one of the most important internal controls the City can have, and the bank reconciliation cannot be considered complete until it has been reviewed and approved. To be an effective control, bank reconciliations and the associated review should be completed in their entirety as soon as reasonably possible after each month-end, usually within thirty to forty-five days of the bank statement date. The dates of preparation and performance of review of the monthly Bank Reconciliations should be documented to clearly indicate proper internal controls are in place and the bank reconciliation process was completed timely.

During our review of the January 2019 and March 2019 bank reconciliations for the general checking account, we noted that although the preparer and reviewer signed off on the bank reconciliations, the date of preparation for the January 2019 bank reconciliation is not documented, and the January 2019 and March 2019 bank reconciliations were not reviewed until April 5, 2019 and May 24, 2019, respectively. y not completing and reviewing the bank reconciliations timely, accounting errors, misstatements and/ authorized activities may not be identified or corrected in a timely mann We understand the review of the bank reconciliations was delayed due to the Finance Department being understaffed, and the missing review documentation was due to staff oversight.

We did note that the June 2019 bank reconciliations were prepared and reviewed timely, but the City should document the dates of preparation and review on the face of bank reconciliations and the bank reconciliation process should be completed within 30 to 45 days of month end throughout the fiscal year.

Update for June 30, 2020:

During our review of the January 2020 and March 2020 bank reconciliations, we noted that the reconciliations were not prepared and reviewed until May 2020 and June 2020, respectively. Although we did note that the June 2020 bank reconciliations were prepared and reviewed timely in August 2020, the City should develop procedures to ensure the bank reconciliation process should be completed within 30 to 45 days of month end throughout the fiscal year.
21 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

SIGNIFICANT DEFICIENCIES
2019-03 Timely Review of Bank Reconciliations (Continued) Update for June 30, 2021:

During our review of the November 2020 General Checking account bank reconciliation, we noted that the preparer and reviewer signed off on the reconciliations, by evidence of the employee's initials.

However, the preparation and review were not completed until February 1, 2021, and February 3, 2021, respectively.

We did note that the March 2021 and June 2021 bank reconciliations were prepared and reviewed timely, however due to staff turnover, some tasks during the fiscal year were delayed.

Current Status:

Preparation of timely bank reconciliations are assigned to an Accountant II, which are subsequently reviewed and signed by both the Financial Services Manager and the Controller.

While we agree some tasks during the fiscal year were delayed due to staff turnover, bank reconciliation preparation and review submission time improved dramatically from fiscal year 2020 and into fiscal year 2021, as evidenced by the timely March and June 2021 bank reconciliations.
2019-04 Timely Preparation and Review of Quarterly Investment Reports Investment account reconciliations are an important element of the City's internal controls. In order to be an effective control, reconciliations should be completed as soon as reasonably possible after each month- end, usually within 30-45 days if receipt of statements, and subsequently reviewed for accuracy. Errors and unreconciled differences should be researched, understood and corrected immediately, to prevent additional errors and a decrease in efficiency. In addition, Section XIV, Investment Advisory Committee/Reporting Requirements, requires that quarterly information "be submitted to the City Manager and City Council within 30 days following the end of the quarter, or as soon as practicable after the data is available to the City," and California Government Code Section 53646(b)(1) also requires filing of the report with City Council within 30 days of quarter end.

During our review of the four quarterly Investment Reports for fiscal year 2019, we noted that the starsion ta decil. (shich i below lorained tram City Treasurer's review process and the subsequent Date Days Council Days
TR Month Reviewed Elapsed Approval Elapsed
9/30/2018 12/3/18 64 days 12/18/18 79 days
12/31/2018 10/31/19 304 days 11/19/19
3/31/2019 11/4/19 218 days 11/19/19 338 days
6/30/2019 11/4/19 127 days 11/19/19 142 days
As a result, the City is not in compliance with the requirements of the Investment Policy and the California Government Code, and any errors may not be detected in a timely manner. 22 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

SIGNIFICANT DEFICIENCIES
2019-04 Timely Preparation and Review of Quarterly Investment Reports (Continued) We understand City staff is working to perform investment reconciliations in a timely manner, however due to staff turnover, some tasks have been delayed
The City should develop procedures to ensure quarterly investment reports are completed, reviewed and submitted to Council in a timely manner in accordance with the reporting requirements of the Investment Policy and the California Government Code.

Update for June 30, 2020:

We again selected quarterly Investment Reports for testing of timely preparation and review and noted that the September 2019 and December 2019 quarterly Investment Reports included documentation of the preparer and reviewer, but neither included documentation as to when they had taken place. And, as of June 2020, neither quarterly Investment Report had been submitted to the City Council Update for June 30, 2021:

We again selected quarterly Investment Reports for testing of timely preparation and review and noted that the preparation was delayed for two of the reports, which in turn delayed the City Treasurer's review process and the subsequent submission to Council. (see table below for timeframes):

Date Signed Days Council Days
TR Month by Treasurer Elapsed Approval Elapsed
9/30/2020 2/9/2021 132 days 3/16/2021 167 days
12/31/2020 3/9/2021 68 days 4/20/21 110 days
3/31/2021 5/5/2021 35 days 6/15/2021 76 days
We did note that the June 2021 Investment Report was prepared timely, however the City should develop procedures to ensure quarterly investment reports are completed, reviewed and submitted to Council in a timely manner in accordance with the reporting requirements of the Investment Policy and the California Government Code throughout the fiscal year. And, the dates of the preparation and review of the reports should be documented in some formal manner.

Current Status:

We have identified efficiencies and prioritized the quarterly investment report in the current fiscal year. We are currently up-to-date as of May 2022.
23 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

SIGNIFICANT DEFICIENCIES
2018-01 Segregation of Duties in Major Control Areas
a) Access to Customer Database and Cash Receipts/ Non-Sufficient Funds Checks City staff that is involved in the cash receipts process should not normally be allowed to have access to make changes to the customer database. And, employees that generate accounts receivable billings should not be involved with the collection of cash receipts or processing of non-sufficient funds checks and ability to adjust the general ledger.

The Finance Supervisor and the Accounting Technician handle cash receipts and have access to the customer database, non-sufficient funds checks and can adjust the general ledger, while it does not appear that changes to the customer database are reviewed. And, the Accounting Technician generates accounts receivable billings.

We understand the Finance Department was understaffed, which resulted in a need to reallocate certain employee duties.

The access to make changes to the customer database should be removed from the Finance Supervisor and the Accounting Technician and in the event the system does not allow such a change, there should be a review and approval of all changes to the customer database on a gular basis to ensure all changes were authorized. In addition, the processing of non-sufficie inds checks should be transferred to an emplovee that is not involved with both billings an collections and if the Accounting Technician continues to prepare accounts receivable billings, she should not be involved with cash collections.
b) Finance Staff with General Ledger Super User Rights
A system super-user is an individual who has full access over the City's financial system including all modules and all functions. Accounting staff should not normally be allowed to have super-user rights in the City's general ledger system.

We noted that the City's Finance Supervisor has super-user access to the City's general ledger system.

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

SIGNIFICANT DEFICIENCIES
2018-01 Segregation of Duties in Major Control Areas (Continued) The City should consider restricting super user rights to as few employees as possible, preferably made to the system by the above employee.

City staff must develop procedures to review the City's internal controls to ensure there is proper Segregation of duties and blares is deemental on of the revies and i mina or consens can de be put in place to reduce the internal control risk, then either the ability to process the transaction or the Current Status:

See comment 2019-02.
2018-03 Purchasing Policy Compliance
The City's Purchasing Policy Appendix A states that Materials and Services over $25,000, and Professional and Personal services for $5,000 to $75,000, and over $75,000 require a standard contract approved by City Council. In addition, the City should process invoices and scheduled payments in a timely manner.

We selected forty-six disbursements to test for supporting documentation and compliance with the City's purchasing policy and noted the following:
• One payment was comprised of three vendor invoices totaling $1,774 that were individually below the threshold requiring a contract, but the City used the vendor throughout the fiscal year for various door repairs/replacements totaling $129,830. • One payment was for landscape services in the amount of $1,325, which does not individually require a contract, but payments to the vendor for the fiscal year totaled $296,284. • One payment for truck repairs that was comprised of two vendor invoices totaling S46,637 that were individually below the threshold requiring a contract, so only a purchase order was used. • One payment for operating expenses (utility, trash/compost, & water service charges) in a landscaping and lighting district for which there is no contract. We understand the City took over the responsibilities from another entity dating back to 1986, but a contract was not established with the City and instead a purchase order is used. We also understand a formal agreement is in process.
• There were two payments to vendors whose contracts had expired - one for cell phone services and one for psychological services.
25 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

SIGNIFICANT DEFICIENCIES
2018-03 Purchasing Policy Compliance (Continued)
It appears contracts should have been in place for all of the disbursements noted above. Without valid thresholds require the use of purchase orders, two of the vendors noted above were used for ongoing services.
develop a procedure to review the services throughout the year for the same vendor rather than just looking at one individual invoice to determine if a contract should be in place.

Finally, the City should clarify in the Purchasing Policy for whether the use of one vendor throughout the fiscal year for which disbursements cumulatively exceed the authorization thresholds trigger the need to comply with the contract requirements of the Policy.

Current Status:

The Administrative Policies and Procedures covering the Citywide Purchasing Policy was updated on January 30, 2020 to include specific language under Responsibilities of Departments that departments shall "not split" orders for the purpose of avoiding procurement requirements.

Furthermore, language in the Purchasing Policy specifically states under Requisitioning Authority that Departments must have proper requisition authority and that requisitioning authority and purchasing authority are different and each has a specific purpose. Requisitioning authority authorizes the expenditure of funds for specific requirements in specific budget areas. A requisition is the written document that contains the reason for the need of a purchased material/service. Requisitioning authority is delegated by the Council to the City Manager and the City Attorney, as appropriate, and then from the City Manager to Department Heads.

We agree that the contracts should be in place for disbursements that meet the thresholds in the purchasing policy and payments to vendors are made only when a current contract is in place.

We have been reviewing the contracts often throughout the year to make sure they are in effect and in compliance. We will update the Purchasing Policy to reflect that the use of one vendor throughout the fiscal year for which disbursements cumulatively exceed the authorization thresholds would trigger the need to comply with the contract requirements of the Policy.

The purchasing policy was updated on January 30, 2020. The current purchasing policy thresholds were unchanged from the previous version. The 2020 version of the policy has been posted on the City's intranet.
26 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2020-03 Investment Policy - Audit of Investment Policy and Procedures Internal Controls Section V, Internal Controls, of the City's April 2020 Investment Policy includes the requirement that "The City Auditor shall establish an annual process for independent review of these controls by an external auditor. This review will help to ensure compliance with the City's investment policies and procedures."
As the City's external auditors, we cannot be part of the City's internal control structure. Although we engagement. Otherwise, the provisions should be revised, such as requiring appropriate City staff to complete the annual review of compliance with policies and procedures, or the provisions should be removed from the Investment Policy.

Current Status:

The City has engaged Maze and Associates to perform certain compliance testing procedures to satisfy this current requirement. The Finance Director will revisit this matter with the City Treasury in the current fiscal year.
2019-05 Timely Posting of Journal Entries
As noted above and in prior year Memorandum on Internal Control comment 2018-05, journal entries are an important transaction cycle that affects all aspects of accounting and financial reporting. Prudent internal control concepts dictate the journal entries should be posted within a timely manner that is usually within 35 to 45 days.

We selected forty journal entries for testing of supporting documentation and timely posting and noted three were not posted timely as follows:

1. A journal entry with an effective date in December 2018 was not posted until April 2019

2. A journal entry with an effective date in January 2019 was not posted until April 2019

3. A journal entry with an effective date in March 2019 was not posted until May 2019 We understand the delays were due to the following:
• #1 - The public works department did not provide the supporting documentation needed to prepare the journal entry to finance timely.
• #2 and #3 - Bank reconciliation review was not performed in a timely manner as discussed in comment 2019-03, which delayed the posting of the journal entries.

The delay in posting journal entries could potentially affect the timeliness of all aspects of accounting and financial reporting. In addition, year-end entries may not be recorded to the correct accounting period in a timely manner.
27 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2019-05 Timely Posting of Journal Entries (Continued)
period date for which the journal entry is to be recorded.

Update for June 30, 2020:

We again selected forty journal entries for testing of supporting documentation and timely posting and noted ten were not posted timely as follows:

1. A journal entry with an effective date in August 2019 was not posted until October 2019

2. A journal entry with an effective date in August 2019 was not posted until December 2019

3. A journal entry with an effective date in September 2019 was not posted until February 2020

4. A journal entry with an effective date in September 2019 was not posted until March 2020

5. A journal entry with an effective date in October 2019 was not posted until February 2020

6. Two journal entries with an effective date in October 2019 were not posted until March 2020

7. Two journal entries with an effective date in November 2019 were not posted until March 2020

8. A journal entry with an effective date in December 2019 was not posted until March 2020 Update for June 30, 2021:

We again selected forty journal entries and noted five were not posted timely as follows:

1. JE 1021 with a transaction date in July 2020 was not posted until October 2020.

2. JE 1024 with a transaction date in July 2020 was not posted until November 2020.

3. JE 2019 with a transaction date in August 2020 was not posted until November 2020.

4. JE 2021 with a transaction date in August 2020 was not posted until November 2020.

5. JE 2022 with a transaction date in August 2020 was not posted until November 2020.

We understand these journal entries are entries related to transactions discovered during the bank and investment reconciliation processes, which were delayed due to staff turnover and limited available staff.

The City should develop processes and procedures to ensure journal entries are prepared, reviewed and posted within 30 to 45 days after the period date for which the journal entry is to be recorded.

Current Status:

We agree processes and procedures should be in place to ensure journal entries are prepared, reviewed and posted within 30-45 days. The journal workflow feature in the new ERP system has created efficiencies in this area.
28 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2019-06 Timely Cutoff of Terminated Employees from Payroll System As noted in prior year Memorandum on Internal Control comment 2018-04, the elapsed time between an employee's final paycheck and their termination in the payroll system should be minimized to reduce fraud risks.

We selected fourteen terminated employees for testing of proper and timely cutoff in the City's payroll system and noted five employees had been terminated in the system more than 30 days subsequent to their final check date. The length of time varied from forty-six days to over two years.

We understand these five employees were seasonal employees that remained in the system in the event they returned to work the next year.

Employees that are not terminated from the payroll system in a timely manner continue to have an "active" status which could lead to unauthorized payroll payments.

The City should develop policies and procedures to ensure that an employee is removed from or inactivated in the payroll system in a timely manner after termination.

Current Status:

Implemented. In addition, there are new features in the ERP payroll system to aide in this endeavor. The City went Live with Tyler Munis Finance on October 1, 2021 and most of the City went live with Payroll in January 2022. The remaining departments are slated to go live in July 2022
2019-07 Timely Removal of Terminated Emplovees from General Ledger System Access As noted in comment 2019-06 above, the elapsed time between an employee's termination and removal of access to the City's systems, including access to the General Ledger module, should be minimized to reduce fraud risks.

When reviewing the general ledger access log dated October 22, 2019, we noted it included the former Financial Services Manager that departed the City in January 2019 and the former Acting Financial Services Manager that left the City in May 2015. We understand the respective employees' access to the City's network was removed shortly after their termination, which is needed to access to the general ledger module.

When an employee's access from the computer system is not terminated upon their departure from the City, there is a possibility of that employee gaining unauthorized access to the City records.

We understand the accounts that are still active in the system are retained as "placeholder" accounts, so City staff does not have to create a new profile for the job title once a new person fills in the position. 29 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2019-07 Timely Removal of Terminated Employees from General Ledger System Access (Continued)
Update for June 30, 2020:
departed the City in March 2020. We understand the respective employees' access to the City's network was removed shortly after their termination, which is needed to access to the general ledger module.

The City should develop policies and procedures to ensure that an employee's system access is disabled in a timely manner after termination. And, the City should not retain access in the system with a "placeholder account" and instead eliminate the terminated employees from the computer system and create a new account once the position is filled.

Current Status:

Implemented. All employees are removed from sign-in rights by IT within two weeks of their leaving the City. Without sign in rights to the City's servers, those former employees cannot enter the City's financial system. The employee separation form serves as a guide to terminate system access for the employee after his or her separation from the City. The Finance Supervisor has submitted the names of users no longer with the City to the Finance System's Administrator, and all terminated employees have been removed from the general ledger system. Without sign- in rights to the City's servers, those former employees cannot gain access to the City's financial system.
2019-09 Mastick Senior Center - Voiding Cash Receipts
Voiding of cash receipts should be performed or approved by someone who does not have access to cash receipts.

The cashiers at the Mastic Senior Center can void transactions without the approval of a second employee at the time of the void.

We understand a summary report is generated and reviewed as part of the daily closing process.

However, that review is performed by an employee with access to cash receipts.

Without a proper audit trail and review and approval of the voided transactions, the City is exposed to the risk of cash receipts interception.

An employee who does not have access to cash receipts should review and approve the voiding of cash receipts at the time of the voided transaction. Alternatively, an employee who does not have access to the cash receipts system should review and approve a report that shows the audit trail of all voided cash receipts transactions.

Current Status:

Implemented.
30 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2018-04 Timely Cutoff of Terminated Employees from Payroll System The elapsed time between an employee's final paycheck and their termination in the payroll system should be minimized to reduce fraud risks as well as with being removed from having access to the When an employee's access from the computer system is not terminated upon their departure from the City, there is a possibility of that employee gaining unauthorized access to the City records.

We understand the six accounts that are still active in the system are retained as "placeholder" accounts, so City staff does not have to create a new profile for the job title once a new person fills in the position.

Current Status:

See also comments 2019-06 and 2019-07.
2018-05 Timely Posting of Journal Entries
Journal entries are an important transaction cycle that affects all aspects of accounting and financial boring is den into to nays conces erical ha oural entics shal her so ice aid to cine.

We selected forty journal entries and noted two that were not posted timely. • One journal entry was to record fuel charges for the month of December 2017. The journal entry was prepared on March 1, 2018 and posted on March 29, 2018. • One journal entry posted in June 2018 was to record Engineering Charges for the month of March 2018.
31 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2018-05 Timely Posting of Journal Entries (Continued)
We understand the Finance department was heavily involved in preparing budget reports during the As a result, City staff has to manually enter all transactions, which can be a tedious and time consuming process.

The delay in posting journal entries could potentially affect the timeliness of all aspects of accounting and financial reporting.

The City should develop procedures to ensure that all journal entries are prepared, reviewed and posted within 30 to 45 days after the period date for which the journal entry is to be recorded, including Engineering Department's time billing.

Current Status:

See comment 2019-05
2018-06 Develop a Review Process for Deposits Pavable
To ensure that deposits payable balances are accurate, deposit payable details should be reviewed on a regular basis, such as monthly or quarterly.

We selected forty journal entries for testing and noted one was for the reclassification of a Business Improvement Area deposit that was collected in August 2017 and paid out in September 2017. The deposit payable remained in the deposit account, because the disbursement was coded to an expense account and the error was identified and corrected in December 2017.

We understand the City does not have a procedure in place to review Business Improvement Area deposits to ensure that payment activity is reconciled to the deposits payable activity. Lack of review could result inaccurate accounting for the deposits payable balances.

The City should develop a review process for the Business Improvement Area deposits payable to ensure all balances are outstanding and were not refunded in a prior period.

Current Status:

The City agrees that we should develop a process for the Business Improvement Area (BIA) deposits payable to ensure that all balances are outstanding and were not refunded in a prior period. The BIA deposit account holds the fees collected with the business licenses for the Park Street Business Association and the Webster Street Business Association. Currently a remittance is done to the associations for their fees on a quarterly basis and reconciled before the year-end close.
32 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2018-08 Review of Service Organization Reports
The City has several independent contractors which process transactions for various City activities City staff does not currently request and review SSAE 16 reports from the service organizations to ensure that findings are addressed by the entities and such findings do not involve or affect the City's transactions.

The procedures used by these service organizations are outside the scope of City oversight and staff review, nor are these controls part of the scope of an audit of the City's financial statements. Typically, cities may employ a variety of approaches to gain comfort that service organizations are performing their functions in a prudent manner and producing reliable data. For example, trust departments manage funds held pursuant to debt indentures, but cities rarely have audits performed as City staff review transactions and verify the trust data. Less frequently, special audits are performed to determine adequacy of controls and to verify the data produced. There is a third option which is to request a review and report on internal controls pursuant to the requirements of Statements on Standards for Attestation Engagements #16.

We understand that City staff was unaware that SSAE 16 reports were available for review and should be requested and reviewed on an annual basis.

The City should request a SSAE 16 report from its independent contractors. Any weaknesses or system problems disclosed by that audit should be addressed and resolved by the contractor to the satisfaction of Current Status:

As part of the year-end procedures, the City will request SSAE16 reports from identified service organizations.

The Finance Director and the Revenue Supervisor review the SSAE 16 reports. 2018-09 Alameda County Transportation Commission Timely Use of Funds Policy In December 2015, the Alameda County Transportation Commission (ACTC) approved a Timely Use of Funds Policy. This policy was adopted to encourage Measure B/Measure BB/Vehicle Registration Fee (VRF) recipients to expend voter-approved transportation dollars expeditiously on transportation improvements and operations that the public can use and benefit from immediately.

Under the terms of the Policy, a recipient of Measure B, BB or VRF cannot carry a fiscal year end fund balance greater than 40% of the direct local distribution revenue received for that same year for four consecutive fiscal years within each funding program. ACTC will monitor the recipient agencies" annual ending fund balance to revenue received ratio, cumulatively across the recipient's programmatic categories by fund program, to verify Policy compliance. 33 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2018-09 Alameda County Transportation Commission Timely Use of Funds Policy (Continued)
If the recipient does not meet the requirements of the Policy, the ACT may determine that the recipient feasure B, id or sur die focal distribution in and remind the recipiri subsequense find year.

Measure B. BB or VRF direct local distribution in
same program type.

The provisions of the Timely Use of Funds Policy begin with the Measure B, BB, or VRF funding received in coal year ely in which me is cal years of 201 l 2020, any in tram cal year 10% coth be at risk. ACTC provided the recipient agencies with a flow chart to assist in determining compliance and track the funds. In the event the recipient's fund balance for a program does exceed the maximum allowed percentage, there are provisions in the Policy for submitting a request for exemption with a justification and implementation plan, which resets the consecutive fiscal year "clock." However, ACTC will only allow exemptions under extraordinary circumstances and the recipient must provide a timely expenditure plan for use of the funds.

The City should ensure that it is using the flow chart and any other compliance tools necessary to ensure that the City is spending the funds as intended and not accumulating ending fund balance in any of the three programs in excess of the maximum allowed percentage for four consecutive fiscal years, or request an exemption, if applicable.

Current Status:

The City of Alameda continues to use Measure B, BB and VRF funding to support a variety of transportation related projects throughout the City. These funding sources currently support a dozen Capital Projects and operational programs. In response to the Timely Use of Funds Policy, the City has prioritized Measure B, BB and VRF funding towards the City's annual Pavement Management, Street Safety Improvements, Paratransit, and Bicycle Pedestrian programs to ensure compliance. For FY 2021-22, Alameda CTC granted all cities an extension to the Timely Use of Funds policy to ensure there is no disruption of funding due to the challenges faced by the pandemic. Alameda CTC revisited their Timely Use of Funds Policy for Direct Local Distribution (DLD) funds in February 2022 and presented an updated DLD Policy shortly thereafter. The City is in full compliance with this recently issued policy. 2018-10 Information Technology Best Practices Recommendations We conducted an Information Systems Review with our audit which encompassed the financial information system and the network environment that houses it. We expanded our work in previous years beyond simply looking at financial information systems as a result of greater risks of unauthorized access caused by overall industry growth of web-based commerce and internet based financial systems. Internal controls that are present in the overall network environment have become more important and relevant to understanding the internal controls over the financial system. We believe Information System controls must be continuously improved and enhanced to stay ahead of the ever-increasing sophistication of hackers and criminals.
34 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2018-10 Information Technology Best Practices Recommendations (Continued) Currently, there are no Information Systems standards to which local governments are required to Indeed, there are a wide variety of informal guidelines and suggested controls from many different organizations which local governments can use to implement appropriate controls to ensure adequate security over information technology. A voluntary risk-based Cybersecurity Framework has been developed by the National Institute of Standards and Technology (NIST) per Presidential Executive Order 13636 (12 FEB 2013). The Framework for Improving Critical Infrastructure Cybersecurity version 1.0 (12 FEB 2014) offers some appropriate standards. Our Information Systems auditors have reviewed the voluntary framework and concluded that the risk management framework developed by NIST for the Federal Information Security Management Act (FISMA) is the most appropriate for local governments. The NIST risk management framework represents the minimum security requirements for federal government agencies and recommends these controls for private industry and state and local governments. Our procedures included performing an external network scan based on NIST criteria and in determining that internal control provides for:
• Internet access defenses including hacker prevention, detection and deterrent systems • Security of data from physical or network access
• Adequately protecting data from unauthorized internal access • Reasonable measures to ensure continuation of service We again noted areas which could be improved to conform to NIST guidelines. A summary of these recommendations which we believe are "best practices" as follows:

Payment Card Industry Compliance
The City is not in compliance with the Payment Card Industry Data Security Standard (PCI-DSS). Any organization that processes credit cards is required to comply with PCI-DSS, even if the processing is outsourced. Failure to meet compliance requirements results in higher transaction fees and liability if a security breach is found. Because the City accepts credit cards as a form of payment, the City must be compliant with the applicable controls.

Audit/Event Logging
The City does not appear to have audit logs on the financial application server, such that any change addition or deletion of user accounts within the application are tracked and monitored. The City shoul have audit/event logs of any addition, deletion or change in financial application user accounts and that log should be monitored by someone without the rights to effect such changes. Also, any administrative access such as upgrades or application modifications by IT personnel, outside consultants or vendors should also be logged and reviewed.?
1 "State, local, and tribal governments, as well as private sector organizations are encouraged to consider using these guidelines, as appropriate." NIST SP 800-37 Rev 1 pg 11 = For more information on Audit/Event log management see NIST SP 800-92 Guide to Computer Security Log Management. 35 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2018-10 Information Technology Best Practices Recommendations (Continued) Session Locks
The City does not have session locks turned on for the financial application or the workstation operating systems. A session lock is a temporary lockout of the operating system or financial application when a user stops work and typically moves away from the immediate physical vicinity of the computer.

Employees may leave their workstation for lunch or break and not log off or log out of the application This leaves the operating system or financial application open and available to any passerby. Any persor with physical access would be able to perform any tasks the absent user has privileges or rights to do. At the very least workstations should be set to lock out the workstation after a period of inactivity. Best practice would be to have both the operating system and financial application have lockouts after a period of inactivity.

General Information Systems Controls
Our administrative and technical control review is based on the National Institute of Standards and Technology (NIST) control catalog NIST SP 800-53 rev. 4 for a moderate system as defined by NIST SP sod ribal though there is no reder r standard fe ged goes a rose ones are al standards, the local government demonstrates due diligence in designing and implementing appropriate controls around its information systems.

A list of the controls that are not fully in place is available in the questionnaire provided to City staff.

Current Status:

Recognizing there are no material weaknesses in our Information Systems Review, the following measures will be or are being implemented to improve our best practices efforts.

Payment Card Industry Card Compliance:

Third-party systems used across the City are PCI compliant by storing the card information in tokens at the point of entry through the gateway rather than using a separate processing system Our new ERP system improves PCI compliance for all City departments.

Our current version of Central Square Finance Plus is outdated and does not provide a mechanism to process card payments in the system and requires the use of a separate processing station to process all card transactions that reconcile to daily deposits. Third-party systems used across the City are PCI compliant by storing the card information in tokens at the point of entry through the gateway rather than using a separate processing system. The City is implementing a new ERP system that will improve PCI compliance for all City departments.

Audit/Event Logging:

The City implemented Tyler Munis ERP system during FY 2022. This replacement financial system includes detailed audit logs on the financial application for any change. Any administrative access such as upgrades or application modifications by IT personnel, outside consultants or vendors will be logged and reviewed following the IT Change Control Policy requirements.
36 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2018-10 Information Technology Best Practices Recommendations (Continued) Session Locks: Implemented
mentioned in the audit; however, the IT Department does have a plan for action to address the Here are the results from our latest Nationwide Cyber Security Review (NCSR) based on the NIST CSF:

STATUS 2020 PRIOR +/- CHANGE
Fully Compliant 40% 32% +8%
Partially Compliant 7% 19% -12%
Non-compliant 53% 49% +4%
37 This Page Left Intentionally Blank

CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

ALAMEDA MUNICIPAL POWER

CURRENT STATUS OF PRIOR YEAR SIGNIFICANT DEFICIENCIES
Finding 2020-001 Inventory Observation
Criteria:

Internal controls should be established to ensure that inventory on hand is accurately counted and that reconciliation is performed over AMP's Inventory Management System and Cayenta, AMP's general ledger system.

Condition Found:

Significant Deficiency - As a result of our audit procedures, we identified discrepancies between our test count and AMP's inventory records generated from Cayenta. We also noted instances in which the Cayenta report did not match the Inventory Management System.

During our physical inventory observation at both warehouses, we were provided an inventory list generated from Cayenta to perform a test count. Based on our test count at one warehouse, we identified an instance in which a box of four smart meters were not accounted for as management reported a quantity of 116 whereas we counted 120.

During our physical inventory observation at the other warehouse, we identified an instance in which 167 bolts were reported by Cayenta whereas we counted 166; and another instance in which 9 repair couplers were reported by Cayenta whereas we counted 12. However, for both instances, our test count results agreed to AMP's Inventory Management System. As such, the discrepancies were due to differences between the Inventory Management System and Cayenta.

AMP did not have policies and procedures in place to ensure all inventory is accounted for and to reconcile records between the Inventory Management System and Cayenta.

Effect:

There is an increased risk of financial statements misstatements due to error or fraud if physical inventory is not counted accurately and that the Inventory Management System does not agree to Cayenta.

Recommendation:

We recommend that management strengthen its policies and procedures over physical inventory to ensure all inventory is accounted for. We also recommend that management implement policies and procedures to perform reconciliation over the Inventory Management System and Cayenta.

Current Status:

Implemented. AMP has designated a space for parts that are being returned to the vendor or those that are waiting testing before being accepted into inventory.
39 This Page Left Intentionally Blank

Alameda City CouncilJuly 12, 2022

Alameda City Council
July 12, 2022