Exhibit 6 - Memorandum on Internal Control — Alameda City Council, May 2, 2023

CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL
FOR THE YEAR ENDED JUNE 30, 2022
This Page Left Intentionally Blank

CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL
For the Year Ended June 30, 2022
Table of Contents
Page
Memorandum on Internal Control. ...1
Schedule of Significant Deficiencie....... ...3
Schedule of Other Matters ...5
Current Status of Prior Year Material Weaknesses ...17
Current Status of Prior Year Significant Deficiencies. ...21 Current Status of Prior Year Other Matters. ..29
This Page Left Intentionally Blank
M MAZE
& ASSOCIATES

MEMORANDUM ON INTERNAL CONTROL
To the City Council of
the City of Alameda, California
In planning and performing our audit of the basic financial statements of the City as of and for the year City's internal control.

Our consideration of internal control was for the limited purpose described in the preceding paragraph and was not designed to identify all deficiencies in internal control that might be material weaknesses or significant deficiencies and therefore material weaknesses or significant deficiencies may exist that were not identified. In addition, because of inherent limitations in internal control, including the possibility of management override of controls, misstatements due to error or fraud may occur and not be detected by such controls. However, as discussed below, we identified certain deficiencies in internal control that we consider to be significant deficiencies.

A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or ployes, in the normal cou detect and correct misstatements on a timely basis. A material weakness is a deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the City's financial statements will not be prevented, or detected and corrected on a timely basis. We did not identify any deficiencies in internal control that we consider to be material weaknesses.

A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. We consider the deficiencies in internal control included on the Schedule of Significant Deficiencies to be significant deficiencies.

Included in the Schedule of Other Matters are recommendations not meeting the above definitions that we believe are opportunities for strengthening internal controls and operating efficiency.

Government Auditing Standards require the auditor to perform limited procedures on the City's response to the findings identified in our audit and described in the accompanying Schedule of Significant Deficiencies and Schedule of Other Matters. The City's response was not subjected to the other auditing procedures applied in the audit of the financial statements and, accordingly, we express no opinion on the response.
т 925.930.0902
Accountancy Corporation = 925.930.0135
3478 Buskirk Avenue, Suite 215 • [email protected] Pleasant Hill, CA 94523 w mazeassociates.com
1 This communication is intended solely for the information and use of management, City Council, others within the organization, and agencies and pass-through entities requiring compliance with Government Auditing Standards, and is not intended to be and should not be used by anyone other than these specified parties.

Maye &Associates
Pleasant Hill, California
December 29, 2022
2 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF SIGNIFICANT DEFICIENCIES
2022-01 Prior Year Recommendations Not Yet Implemented
During the current year audit, we followed up on the status of Significant Deficiencies identified on the partialy or not mitigated at une 30, 202, Therefore, they are detone to be cument yead siger been Deficiencies. Details of these deficiencies and associated management's responses are listed in the Status of Prior Year Significant Deficiencies.
2019-02(b) Segregation of Duties in Major Control Areas 2019-03 Timely Review of Bank Reconciliations
2018-01(b) Segregation of Duties in Major Control Areas Management's Response:

See Management's Response to Current Year Status for each of the above deficiencies as listed in the Status of Prior Year Significant Deficiencies.
3 This Page Left Intentionally Blank

CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
2022-02 Purchasing Policy Compliance and Clarification of Requirements master Purchase Order.

We selected 25 disbursements of testing to supporting documentation and compliance with the City's purchasing policy and noted the following:
• One disbursement for $10,580 for grounds maintenance supplies did not have a purchase order, because it was comprised of individual invoices that were less than the $4,000 threshold. included 18 vendor invoices that were less than the purchase order threshold. However, we noted that the City uses this vendor throughout the year and disbursements to the vendor during fiscal year 2022 totaled $56,898.

We understand that City staff considers the individual purchases from the vendor as separate items and therefore not subject to the requirement of a purchase order. • One disbursement for $38,588 for vehicle fuel costs was not accompanied by a contract.

We understand the City had a contract with the vendor that expired in June 2012 and a new contract has not been executed, because certain City staff consider the fuel to be a utility cost, which is not subject to the contract requirement.

The City's Purchasing Policy does not appear to define utilities, but the Purchase Order Procedures does indicate that "Utilities expenditures such as water, power and telecommunication services" do not require the use of a Purchase Order. Although the Purchasing Policy does indicate utilities are an "Essential Service" and exempt from the contract requirements, fuel does not appear to be considered a utility as defined in the Purchase Order Procedures.

It appears that the City should have used a purchase order and/or contract for both of these vendors, and did not obtain a formal bid for the fuel vendor, and therefore, the transactions are not in compliance with the City's Purchase Order Procedures and Purchasing Policy.

The City should ensure that purchase orders and/or contracts are in place for vendors that meet the thresholds in the Purchase Order Procedures and Purchasing Policy and formal bids are obtained for applicable purchases. The City should also develop a procedure to review the services throughout the year for the same vendor rather than just looking at one individual invoice to determine if a purchase order or contract should be in place.

Finally, if the City does consider vehicle fuel purchases to be a utility or essential service, the definition should be clarified in the Purchasing Policy.

Management's Response:

Agree with finding. For the first item, City staff has been able to utilize features in our new ERP system to track when vendors reach the $4,000 threshold in the current fiscal year. We do not expect this item to continue into Fiscal Year 2023. For the second item, City staff is currently in the process of reviewing the purchasing policy and determining our stance on the matter. We agree the City must ensure purchase orders and contracts are in place for vendors that meet these criteria.
5 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
2022-03 Timely Vendor Payments
Vendor payments should be processed timely upon receipt of the vendor invoice.

During our testing of 25 City-wide disbursements and 25 disbursements from the Base Reuse Fund, we noted 5 invoices that were paid over 45 days after receipt and two of those showed that a prior balance was unpaid at the time of the invoice we'd selected for testing.

We understand that the invoice processing and payment process was delayed due to the implementation of the new general ledger system in October 2021. In addition, we understand one of the Base Reuse invoices was paid late, because it had been mailed to an employee that was on leave. peratic, i it does not pay isay not in elected imly does it period rite real ling late paymen.

The City should develop procedures to ensure that vendor invoices are paid timely throughout the fiscal year.

Management's Response:

Agree with finding. During the beginning months of Fiscal Year 2022, City staff was hard at work implementing our new ERP system. While this caused slight delays in some invoice processing, staff had caught up during Q3 of Fiscal Year 2022. We do not expect this item to continue into Fiscal Year 2023 as the Accounts Payable team has been up-to-date with all vendor invoices during the current fiscal year.
2022-04 Annual Adjustment of the Sewer PILOT
The Sewer Enterprise Fund makes an annual Payment in Lieu of Taxes (PILOT) that is supposed to be adjusted each fiscal year.

We noted that the PILOT for fiscal year 2022 was identical to that in 2021 and we understand it was due to a recurring charge not being updated in fiscal year 2022. As a result, the PILOT was understated by $14 thousand.

City staff should develop procedures to ensure that annual charges that should be increased are adjusted each fiscal year.

Management's Response:

Agree with finding. City staff will develop procedures to ensure this annual change is adjusted each fiscal year. These procedures will be in place by April 30, 2023. 6 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS

NEW GASB PRONOUNCEMENTS OR PRONOUNCEMENTS NOT YET EFFECTIVE The following comment represents new pronouncements taking affect in the next few years. We have cited them here to keep you informed of developments:

EFFECTIVE FISCAL YEARS 2021/22, 2022/23 and 2023/24:

GASB 99 - Omnibus 2022
The objectives of this Statement are to enhance comparability in accounting and financial reporting and to improve the consistency of authoritative literature by addressing (1) practice issues that have been identified during implementation and application of certain GASB Statements and (2) accounting and financial reporting for financial guarantees. The practice issues addressed by this Statement are as follows:
• Classification and reporting of derivative instruments within the scope of Statement No. 53, Accounting and Financial Reporting for Derivative Instruments, that do not meet the definition of either an investment derivative instrument or a hedging derivative instrument • Clarification of provisions in Statement No. 87, Leases, as amended, related to the determination of the lease term, classification of a lease as a short term lease, recognition and measurement of a lease liability and a lease asset, and identification of lease incentives • Clarification of provisions in Statement No. 94, Public-Private and Public-Public Partnerships and Availability Payment Arrangements, related to (a) the determination of the public-private and public-public partnership (PPP) term and (b) recognition and measurement of installment payments and the transfer of the underlying PPP asset
• Clarification of provisions in Statement No. 96, Subscription-Based Information Technology Arrangements, related to the subscription-based information technology arrangement (SBITA) term, classification of a SBITA as a short term SBITA, and recognition and measurement of a subscription liability
• Extension of the period during which the London Interbank Offered Rate (LIBOR) is considered an appropriate benchmark interest rate for the qualitative evaluation of the effectiveness of an interest rate swap that hedges the interest rate risk of taxable debt • Accounting for the distribution of benefits as part of the Supplemental Nutrition Assistance Program (SNAP)
• Disclosures related to nonmonetary transactions
• Pledges of future revenues when resources are not received by the pledging government • Clarification of provisions in Statement No. 34, Basic Financial Statements-and Management's Discussion and Analysis for State and Local Governments, as amended, related to the focus of the government-wide financial statements
7 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 99 - Omnibus 2022 (Continued)
• Terminology updates related to certain provisions of Statement No. 63, Financial Reporting of Deferred Outflows of Resources, Deferred Inflows of Resources, and Net Position • Terminology used in Statement 53 to refer to resource flows statements.

The Requirements of this Statement are Effective as Follows:

The requirements in paragraphs 26-32 related to extension of the use of LIBOR, accounting for SNAP distributions, disclosures of nonmonetary transactions, pledges of future revenues by pledging governments, clarification of certain provisions in Statement 34, as amended, and terminology updates related to Statement 53 and Statement 63 are effective upon issuance.

The requirements in paragraphs 11-25 related to leases, PPPs, and SBITAs are effective for fiscal years beginning after June 15, 2022, and all reporting periods thereafter.

The requirements in paragraphs 4-10 related to financial guarantees and the classification and reporting of derivative instruments within the scope of Statement 53 are effective for fiscal years beginning after June 15, 2023, and all reporting periods thereafter.

Earlier application is encouraged and is permitted by individual topic.

How the Changes in This Statement Will Improve Financial Reporting The requirements of this Statement will enhance comparability in the application of accounting and financial reporting requirements and will improve the consistency of authoritative literature. Consistent authoritative literature enables governments and other stakeholders to more easily locate and apply the correct accounting and financial reporting provisions, which improves the consistency with which such provisions are applied. The comparability of financial statements also will improve as a result of this Statement. Better consistency and comparability improve the usefulness of information for users of state and local government financial statements.

EFFECTIVE FISCAL YEAR 2022/23:

GASB 91 - Conduit Debt Obligations
The primary objectives of this Statement are to provide a single method of reporting conduit debt obligations by issuers and eliminate diversity in practice associated with (1) commitments extended by issuers, (2) arrangements associated with conduit debt obligations, and (3) related note disclosures. This Statement achieves those objectives by clarifying the existing definition of a conduit debt obligation; establishing that a conduit debt obligation is not a liability of the issuer; establishing standards for accounting and financial reporting of additional commitments and voluntary commitments extended by issuers and arrangements associated with conduit debt obligations; and improving required note disclosures.
8 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 91 - Conduit Debt Obligations (Continued)
A conduit debt obligation is defined as a debt instrument having all of the following characteristics:

There are at least three parties involved:
(1) an issuer
(2) a third-party obligor, and
(3) a debt holder or a debt trustee.
• The issuer and the third-party obligor are not within the same financial reporting entity. • The debt obligation is not a parity bond of the issuer, nor is it cross-collateralized with other debt of the issuer.
• The third-party obligor or its agent, not the issuer, ultimately receives the proceeds from the debt issuance.
• The third-party obligor, not the issuer, is primarily obligated for the payment of all amounts associated with the debt obligation (debt service payments).

All conduit debt obligations involve the issuer making a limited commitment. Some issuers extend additional commitments or voluntary commitments to support debt service in the event the third party is, or will be, unable to do so.

An issuer should not recognize a conduit debt obligation as a liability. However, an issuer should ecognize a liability associated with an additional commitment or a voluntary commitment to support deb ervice if certain recognition criteria are met. As long as a conduit debt obligation is outstanding, a issuer that has made an additional commitment should evaluate at least annually whether those criteria are met. An issuer that has made only a limited commitment should evaluate whether those criteria are met when an event occurs that causes the issuer to reevaluate its willingness or ability to support the obligor's debt service through a voluntary commitment.

This Statement also addresses arrangements often characterized as leases-that are associated with conduit debt obligations. In those arrangements, capital assets are constructed or acquired with the proceeds of a conduit debt obligation and used by third-party obligors in the course of their activities.

Payments from third-party obligors are intended to cover and coincide with debt service payments.

During those arrangements, issuers retain the titles to the capital assets. Those titles may or may not pass to the obligors at the end of the arrangements.
9 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 91 - Conduit Debt Obligations (Continued)
Issuers should not report those arrangements as leases, nor should they recognize a liability for the related conduit debt obligations or a receivable for the payments related to those arrangements. In addition, the following provisions apply:
• If the title passes to the third-party obligor at the end of the arrangement, an issuer should not recognize a capital asset.
• If the title does not pass to the third-party obligor and the third party has exclusive use of the entire capital asset during the arrangement, the issuer should not recognize a capital asset until the arrangement ends.
• If the title does not pass to the third-party obligor and the third party has exclusive use of only portions of the capital asset during the arrangement, the issuer, at the inception of the arrangement, should recognize the entire capital asset and a deferred inflow of resources. The deferred inflow of resources should be reduced, and an inflow recognized, in a systematic and rational manner over the term of the arrangement.

This Statement requires issuers to disclose general information about their conduit debt obligations, organized by type of commitment, including the aggregate outstanding principal amount of the issuers' conduit debt obligations and a description of each type of commitment. Issuers that recognize liabilities related to supporting the debt service of conduit debt obligations also should disclose information about the amount recognized and how the liabilities changed during the reporting period.

How the Changes in this Statement will Improve Financial Reporting The requirements of this Statement will improve financial reporting by eliminating the existing option for issuers to report conduit debt obligations as their own liabilities, thereby ending significant diversity in practice. The clarified definition will resolve stakeholders' uncertainty as to whether a given financing is, in fact, a conduit debt obligation. Requiring issuers to recognize liabilities associated with additional commitments extended by issuers and to recognize assets and deferred inflows of resources related to certain arrangements associated with conduit debt obligations also will eliminate diversity, thereby improving comparability in reporting by issuers. Revised disclosure requirements will provide financial statement users with better information regarding the commitments issuers extend and the likelihood that they will fulfill those commitments. That information will inform users of the potential impact of such commitments on the financial resources of issuers and help users assess issuers' roles in conduit debt obligations.
10 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 94 - Public-Private and Public-Public Partnerships and Availability Payment Arrangements The primary objective of this Statement is to improve financial reporting by addressing issues related to public-private and public-public partnership arrangements (PPPs). As used in this Statement, a PPP is an arrangement in which a government (the transferor) contracts with an operator (a governmental or sike easton some pas mene dyin a descenter a
arrangement (SCA), which the Board defines in this Statement as a PPP in which (1) the operator collects and is compensated by fees from third parties; (2) the transferor determines or has the ability to modify or approve which services the operator is required to provide, to whom the operator is required to provide the services, and the prices or rates that can be charged for the services; and (3) the transferor is entitled to significant residual interest in the service utility of the underlying PPP asset at the end of the arrangement.

This Statement also provides guidance for accounting and financial reporting for availability payment arrangements (APAs). As defined in this Statement, an APA is an arrangement in which a government compensates an operator for services that may include designing, constructing, financing, maintaining, or operating an underlying nonfinancial asset for a period of time in an exchange or exchange-like transaction.

PPPs - This Statement requires that PPPs that meet the definition of a lease apply the guidance in Statement No. 87, Leases, as amended, if existing assets of the transferor that are not required to be improved by the operator as part of the PPP arrangement are the only underlying PPP assets and the PPP does not meet the definition of an SCA. This Statement provides accounting and financial reporting requirements for all other PPPs: those that either (1) meet the definition of an SCA or (2) are not within the scope of Statement 87, as amended (as clarified by this Statement). The PPP term is defined as the period during which an operator has a noncancelable right to use an underlying PPP asset, plus, if applicable, certain periods if it is reasonably certain, based on all relevant factors, that the transferor or the operator either will exercise an option to extend the PPP or will not exercise an option to terminate the A transferor generally should recognize an underlying PPP asset as an asset in financial statements prepared using the economic resources measurement focus. However, in the case of an underlying PPP asset that is not owned by the transferor or is not the underlying asset of an SCA, a transferor should recognize a receivable measured based on the operator's estimated carrying value of the underlying PPP asset as of the expected date of the transfer in ownership. In addition, a transferor should recognize a receivable for installment payments, if any, to be received from the operator in relation to the PPP.

Measurement of a receivable for installment payments should be at the present value of the payments expected to be received during the PPP term. A transferor also should recognize a deferred inflow of resources for the consideration received or to be received by the transferor as part of the PPP. Revenue should be recognized by a transferor in a systematic and rational manner over the PPP term. 11 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 94 - Public-Private and Public-Public Partnerships and Availability Payment Arrangements (Continued)
This Statement requires a transferor to recognize a receivable for installment payments and a deferred inflow of resources to account for a PPP in financial statements prepared using the current financial resources measurement focus. Governmental fund revenue would be recognized in a systematic and rational manner over the PPP term.

This Statement also provides specific guidance in financial statements prepared using the economic use asset should be the amount of consideration to be provided to the transferor, plus any payments made to the transferor at or before the commencement of the PPP term, and certain direct costs. For an underlying PPP asset that is not owned by the transferor and is not the underlying asset of an SCA, an operator should recognize a liability measured based on the estimated carrying value of the underlying PPP asset as of the expected date of the transfer in ownership. In addition, an operator should recognize a liability for installment payments, if any, to be made to the transferor in relation to the PPP. Measurement of a liability for installment payments should be at the present value of the payments expected to be made during the PPP term. An operator also should recognize a deferred outflow of resources for the consideration provided or to be provided to the transferor as part of the PPP. Expense should be recognized by an operator in a systematic and rational manner over the PPP term.

This Statement also requires a government to account for PPP and non-PPP components of a PPP as separate contracts. If a PPP involves multiple underlying assets, a transferor and an operator in certain cases should account for each underlying PPP asset as a separate PPP. To allocate the contract price to different components, a transferor and an operator should use contract prices for individual components as long as they do not appear to be unreasonable based on professional judgment or use professional judgment to determine their best estimate if there are no stated prices or if stated prices appear to be unreasonable. If determining the best estimate is not practicable, multiple components in a PPP should be accounted for as a single PPP.

This Statement also requires an amendment to a PPP to be considered a PPP modification, unless the operator's right to use the underlying PPP asset decreases, in which case it should be considered a partial or full PPP termination. A PPP termination should be accounted for by a transferor by reducing, as applicable, any receivable for installment payments or any receivable related to the transfer of ownership of the underlying PPP asset and by reducing the related deferred inflow of resources. An operator should account for a termination by reducing the carrying value of the right-to-use asset and, as applicable, any liability for installment payments or liability to transfer ownership of the underlying PPP asset. A PPP modification that does not qualify as a separate PPP should be accounted for by remeasuring PPP assets and liabilities.

APAs - An APA that is related to designing, constructing, and financing a nonfinancial asset in which ownership of the asset transfers by the end of the contract should be accounted for by a government as a financed purchase of the underlying nonfinancial asset. This Statement requires a government that engaged in an APA that contains multiple components to recognize cach component as a separate arrangement. An APA that is related to operating or maintaining a nonfinancial asset should be reported by a government as an outflow of resources in the period to which payments relate. 12 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 96 - Subscription-Based Information Technology Arrangements This Statement provides guidance on the accounting and financial reporting for subscription-based information technology arrangements (SBITAs) for government end users (governments). This Statement (1) defines a SBITA; (2) establishes that a SBITA results in a right-to-use subscription asset—an standards established in Statement No. 87, Leases, as amended.

The subscription term includes the period during which a government has a noncancelable right to use the underlying IT assets. The subscription term also includes periods covered by an option to extend (if it is reasonably certain that the government or SBITA vendor will exercise that option) or to terminate (if it is reasonably certain that the government or SBITA vendor will not exercise that option).

Under this Statement, a government generally should recognize a right-to-use subscription asset-an intangible asset-and a corresponding subscription liability. A government should recognize the subscription liability at the commencement of the subscription term, —which is when the subscription asset is placed into service. The subscription liability should be initially measured at the present value of subscription payments expected to be made during the subscription term. Future subscription payments should be discounted using the interest rate the SBITA vendor charges the government, which may be implicit, or the government's incremental borrowing rate if the interest rate is not readily determinable. A government should recognize amortization of the discount on the subscription liability as an outflow of resources (for example, interest expense) in subsequent financial reporting periods.

The subscription asset should be initially measured as the sum of (1) the initial subscription liability amount, (2) payments made to the SBITA vendor before commencement of the subscription term, and (3) capitalizable implementation costs, less any incentives received from the SBITA vendor at or before the commencement of the subscription term. A government should recognize amortization of the subscription asset as an outflow of resources over the subscription term.

Activities associated with a SBITA, other than making subscription payments, should be grouped into the following three stages, and their costs should be accounted for accordingly:
• Preliminary Project Stage, including activities such as evaluating alternatives, determining needed technology, and selecting a SBITA vendor. Outlays in this stage should be expensed as incurred. • Initial Implementation Stage, including all ancillary charges necessary to place the subscription asset into service. Outlays in this stage generally should be capitalized as an addition to the subscription asset.
• Operation and Additional Implementation Stage, including activities such as subsequent implementation activities, maintenance, and other activities for a government's ongoing operations related to a SBITA. Outlays in this stage should be expensed as incurred unless they meet specific capitalization criteria.
13 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 96 - Subscription-Based Information Technology Arrangements (Continued) In classifying certain outlays into the appropriate stage, the nature of the activity should be the determining factor. Training costs should be expensed as incurred, regardless of the stage in which they are incurred.

If a SBITA contract contains multiple components, a government should account for each component as a Pois Statement provide an A pion er of 2 mo i or So inerm gary pio takind, regardless of their probability of being exercised. Subscription payments for short-term SBITAs should be recognized as outflows of resources.

This Statement requires a government to disclose descriptive information about its SBITAs other than short-term SBITAs, such as the amount of the subscription asset, accumulated amortization, other payments not included in the measurement of a subscription liability, principal and interest requirements for the subscription liability, and other essential information.

How the Changes in this Statement will Improve Financial Reporting The requirements of this Statement will improve financial reporting by establishing a definition for SBITAs and providing uniform guidance for accounting and financial reporting for transactions that meet that definition. That definition and uniform guidance will result in greater consistency in practice.

Establishing the capitalization criteria for implementation costs also will reduce diversity and improve comparability in financial reporting by governments. This Statement also will enhance the relevance and reliability of a government's financial statements by requiring a government to report a subscription asset and subscription liability for a SBITA and to disclose essential information about the arrangement. The disclosures will allow users to understand the scale and important aspects of a government's SBITA activities and evaluate a government's obligations and assets resulting from SBITAs.

EFFECTIVE FISCAL YEAR 2023/24:

GASB 100 - Accounting for Changes and Error Corrections The primary objective of this Statement is to enhance accounting and financial reporting requirements for accounting changes and error corrections to provide more understandable, reliable, relevant, consistent, and comparable information for making decisions or assessing accountability This Statement defines accounting changes as changes in accounting principles, changes in accounting estimates, and changes to or within the financial reporting entity and describes the transactions or other events that constitute those changes. As part of those descriptions, for (1) certain changes in accounting principles and (2) certain changes in accounting estimates that result from a change in measurement methodology, a new principle or methodology should be justified on the basis that it is preferable to the principle or methodology used before the change. That preferability should be based on the qualitative characteristics of financial reporting-understandability, reliability, relevance, timeliness, consistency, and comparability. This Statement also addresses corrections of errors in previously issued financial statements.
14 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 100 - Accounting for Changes and Error Corrections (Continued) This Statement prescribes the accounting and financial reporting for (1) each type of accounting change and (2) error corrections. This Statement requires that (a) changes in accounting principles and error corrections be reported retroactively by restating prior periods, (b) changes to or within the financial reporting entity be reported by adjusting beginning balances of the current period, and (c) changes in accounting estimates be reported prospectively by recognizing the change in the current period. The requirements of this Statement for changes in accounting principles apply to the implementation of a new pronouncement in absence of specific transition provisions in the new pronouncement. This Statement also requires that the aggregate amount of adjustments to and restatements of beginning net position, fund balance, or fund net position, as applicable, be displayed by reporting unit in the financial statements.

This Statement requires disclosure in notes to financial statements of descriptive information about accounting changes and error corrections, such as their nature. In addition, information about the quantitative effects on beginning balances of each accounting change and error correction should be disclosed by reporting unit in a tabular format to reconcile beginning balances as previously reported to beginning balances as restated.

Furthermore, this Statement addresses how information that is affected by a change in accounting principle or error correction should be presented in required supplementary information (RSI) and supplementary information (SI). For periods that are earlier than those included in the basic financial statements, information presented in RSI or SI should be restated for error corrections, if practicable, but not for changes in accounting principles.

EFFECTIVE FISCAL YEAR 2024/25:

GASB 101 - Compensated Absences
The objective of this Statement is to better meet the information needs of financial statement users by updating the recognition and measurement guidance for compensated absences. That objective is achieved by aligning the recognition and measurement guidance under a unified model and by amending certain previously required disclosures.

Recognition And Measurement
This Statement requires that liabilities for compensated absences be recognized for (1) leave that has not been used and (2) leave that has been used but not yet paid in cash or settled through noncash means. A liability should be recognized for leave that has not been used if (a) the leave is attributable to services already rendered, (b) the leave accumulates, and (c) the leave is more likely than not to be used for time off or otherwise paid in cash or settled through noncash means. Leave is attributable to services already rendered when an employee has performed the services required to earn the leave. Leave that accumulates is carried forward from the reporting period in which it is earned to a future reporting period during which it may be used for time off or otherwise paid or settled. In estimating the leave that is more likely than not to be used or otherwise paid or settled, a government should consider relevant factors such as employment policies related to compensated absences and historical information about the use or payment of compensated absences. However, leave that is more likely than not to be settled through conversion to defined benefit postemployment benefits should not be included in a liability for compensated absences.
15 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

SCHEDULE OF OTHER MATTERS
GASB 101 - Compensated Absences (Continued)
This Statement requires that a liability for certain types of compensated absences—including parental eave, military leave, and jury duty leave not be recognized until the leave commences. This Statemen lso requires that a liability for specific types of compensated absences not be recognized until the leav is used.

This Statement also establishes guidance for measuring a liability for leave that has not been used, associated with payments for leave also should be included in the measurement of the liabilities.

With respect to financial statements prepared using the current financial resources measurement focus, this Statement requires that expenditures be recognized for the amount that normally would be liquidated with expendable available financial resources.

Notes To Financial Statements
This Statement amends the existing requirement to disclose the gross increases and decreases in a liability for compensated absences to allow governments to disclose only the net change in the liability (as long as they identify it as a net change). In addition, governments are no longer required to disclose which governmental funds typically have been used to liquidate the liability for compensated absences.

How the Changes in this Statement Will Improve Financial Reporting The unified recognition and measurement model in this Statement will result in a liability for compensated absences that more appropriately reflects when a government incurs an obligation. In addition, the model can be applied consistently to any type of compensated absence and will eliminate potential comparability issues between governments that offer different types of leave.

The model also will result in a more robust estimate of the amount of compensated absences that a government will pay or settle, which will enhance the relevance and reliability of information about the liability for compensated absences.
16 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

MATERIAL WEAKNESSES
2021-01 Timeliness and Accuracy of Year-End Close
As noted in prior year comments 2020-01 and 2019-01, well-managed organizations should develop a balances and activities.
the audit, City staff proposed sixteen post-closing journal entries, including a number of material post- closing adjustment entries. City staff had difficulty completing material closing entries prior to providing the general ledger for audit for areas including deferred rents receivable, unavailable revenue, unearned revenue, long-term debt, pension expenditures, pension liabilities and related deferred outflows/inflows of resources, and OPEB liabilities and related deferred outflows/inflows of resources. In addition, during our audit of the City's pension and OPEB transactions, we noted that there were errors in three actuary reports and the OPEB Trust PARS statement that were not detected by City staff. Finally, we also noted that the City had not billed Alameda Municipal Power for its share of pension costs or claims payable during the fiscal year and over $2 million was due from the Alameda Municipal Power Enterprise Fund to the General Fund as of June 30, 2021. These areas affected the year-end closing process and many of the City's funds.

The above condition again delayed the completion of the year-end closing process, which increases the risk that errors or misstatements may go undetected by staff and corrections may not be made in a timely manner. Audit effort was substantially increased in response to these increased risks.

Although we did note that the City hired a Controller in January 2022, the Finance Director position was vacant as of February 2022. The City should analyze staff resources to determine what plans can or should be made to ensure that the financial data is processed properly and timely during staffing transitions. The City must also develop procedures to ensure that accounts are analyzed throughout the fiscal year and after the year end close to ensure that additional closing entries are not required prior to providing the general ledger for audit. . This process will also be significantly impacted by the City's system implementation that started in fiscal year 2021 and continued into fiscal year 2022, which will put an additional strain on staff resources and require the need for additional planning and procedures to ensure a smooth year end closing process.

Current Status:

Implemented
17 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

MATERIAL WEAKNESSES
2020-01 Timeliness and Accuracy of Year-End Close
post-closing journal entries, including a number of material post-closing adjustment entries. City staff had difficulty completing material closing entries prior to providing the general ledger for audit for areas including the fair value adjustment for cash and investments, capital assets, unavailable revenue, claims payable, long-term debt, pension liabilities and related deferred outflows/inflows of resources, and OPEB liabilities and related deferred outflows/inflows of resources. We also noted that the revenue budget for one fund had been recorded in an incorrect account, and during our audit of the City's OPE transactions, we noted that there were errors in the amortization schedules in the two actuary reports that were not detected by City staff. These areas affected the year-end closing process and most of the City's funds.

The City should analyze staff resources to determine what plans can or should be made to ensure that the financial data is processed properly and timely during staffing transitions. The City must also develop procedures to ensure that accounts are analyzed throughout the fiscal year and after the year end close to ensure that additional closing entries are not required prior to providing the general ledger for audit. This process will also be significantly impacted by the City's planned system implementation in fiscal year 2021, which will put an additional strain on staff resources and require the need for additional planning and procedures to ensure a smooth year end closing process.

Current Status:

See comment 2021-01.
18 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

MATERIAL WEAKNESSES
2019-01 Timeliness of Year-End Close
Well-managed organizations should develop a plan to ensure that adequate resources will remain available in thor entice to ply gape in ure positions, as perily in there ana reso repa available to be resources need to be in place throughout the fiscal year to ensure accounting processes and procedures continue and allow time for analysis of account balances and activities. ue to the staff turnover during the year, there is a significant strain on the City's ability to maintain od internal control environment and to produce accurate and timely financial data. As a result, th journal entics, netting a hunter of material post closing austen critics, City sat had dirtainy completing material closing entries prior to providing the general ledger for audit for areas including cash and investments, accounts receivable, interfund transactions, capital assets, pension liabilities and related deferred outflows/inflows of resources, and OPEB liabilities and related deferred outflows/inflows of resources. These areas affected the year-end closing process and most of the City's funds.

The above condition delayed the completion of the year-end closing process, which increases the risk that errors or misstatements may go undetected by staff and corrections may not be made in a timely manner.

Audit effort was substantially increased in response to these increased risks.

Current Status:

See comment 2021-01
19 This Page Left Intentionally Blank

CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

SIGNIFICANT DEFICIENCIES
2021-02 Prior Year Recommendations Not Yet Implemented
During the current year audit, we followed up on the status of Significant Deficiencies identified on the Status of Prior Year Significant Deficiencies. We found that the following deficiencies had either been partially or not mitigated at June 30, 2021. Therefore, they are deemed to be current year Significant Deficiencies. Details of these deficiencies and associated management's responses are listed in the Status 2019-02 Segregation of Duties in Major Control Areas
• 2019-03 Timely Review of Bank Reconciliations
2019-04 Timely Preparation and Review of Quarterly Investment Reports 2018-01 Segregation of Duties in Major Control Areas
Current Status:

See Management's Response to Current Year Status for each of the above deficiencies as listed in the Status of Prior Year Significant Deficiencies.
2021-03 Transportation Development Act Grant Drawdown
Grant reimbursement requests should be prepared periodically after grant-eligible expenditures are incurred.

The City received a grant allocation from the Metropolitan Transportation Commission (MTC) in August 2019 in the amount of $81,800 for the bicycle and pedestrian Active Transportation Plan. The City incurred costs related to the project in fiscal year 2020 and recorded a grant receivable as of June 30. 2020. During the fiscal year 2021 audit we noted that the City had not yet received the reimbursement.

Upon inquiry of City staff, we were initially told that the grant eligible expenditures had not been identified. After we indicated the grant-eligible costs had been identified in the prior fiscal year, City We understand the reimbursement request had not been filed due to workloads placed on City staff.

Failure to file timely reimbursement requests could jeopardize grant funding.

The City should file the reimbursement request with MTC as soon as possible, since the grant award expires in June 2022.
rexpies semes are lied at as daiterly to pry scald devad secures re insurement orans prior to the grant expiration.

Current Status:

The reimbursement request discussed was filed May 17, 2022 and thus filed within granting grant reimbursement filings.
21 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

SIGNIFICANT DEFICIENCIES
2019-02 Segregation of Duties in Major Control Areas
employees with access to the City's assets not have access to edit the City's accounting records for the same assets. Inappropriate access could potentially result in undetected errors or unauthorized transactions.
a) Access to Customer Database and Cash Receipts/ Non-Sufficient Funds Checks City staff that is involved in the cash receipts process should not normally be allowed to have access to make changes to the customer database. And, employees that generate accounts receivable billings should not be involved with the collection of cash receipts or processing of non-sufficient funds checks and ability to adjust the general ledger.

The Finance Supervisor and the Accounting Technician handle cash receipts and have access to the customer database, non-sufficient funds checks and can adjust the general ledger, while it does not appear that changes to the customer database are reviewed. In addition, three Account Clerks that handle cash receipts also have access to the customer database, and, the Accounting Technician generates accounts receivable billings.

We understand the Finance Department was understaffed, which resulted in a need to reallocate certain employee duties.

The access to make changes to the customer database should be removed from the Finance Supervisor, the Accounting Technician and the three Account Clerks. In the event the system does not allow such a change, there should be a review and approval of all changes to the customer database on a regular basis to ensure all changes were authorized. In addition, the processing of non-sufficient funds checks should be transferred to an employee that is not involved with both billings and collections and if the Accounting Technician continues to prepare accounts receivable billings, she should not be involved with cash collections.

Current Status:

Implemented
b) Finance Staff with General Ledger Super User Rights
A system super-user is an individual who has full access over the City's financial system including all modules and all functions. Accounting staff should not normally be allowed to have super-user rights in the City's general ledger system.

We noted that the City's Finance Supervisor has super-user access to the City's general ledger system.

When accounting staff have super-user rights, there is a potential risk of restricting or allowing access to other user's abilities to access the different modules in the accounting system. In addition, unauthorized transactions and misstatements may occur without timely detection and correction.
22 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

SIGNIFICANT DEFICIENCIES
2019-02 Segregation of Duties in Major Control Areas (Continued) We understand that City staff believes sufficient controls are in place to mitigate the risk.

Current Status:

We agree with the finding on super-user access and have re-assigned super-user responsibility to the Finance Director. A new procedure has been implemented where staff must request authorization from the Finance Director before any user access changes can be made in the Financial System.

Our new ERP system provides more structure and control of given permissions within roles than our legacy software. The Finance Director is now responsible for the review and sign-off on all user access requests in the Financial System.

City staff must develop procedures to review the City's internal controls to ensure there is proper segregation of duties and that there is documentation of the review and approval of transactions and reconciliations in key control areas. Where internal control conflicts exist, if mitigating controls cannot be put in place to reduce the internal control risk, then either the ability to process the transaction or the access to the asset should be transferred to another appropriate employee.

In response to the prior year comments on the same topic, City staff indicated that it is not feasible to remove or revise super-user and customer database access from all Finance Department staff and that the City has implemented other review and approval internal controls.

Although we agree that the City has other controls in place to mitigate the super-user risk, the City should consider implementing procedures to review/approve any system changes initiated by the Finance Supervisor and the other employees.
2019-03 Timely Review of Bank Reconciliations
Bank reconciliations are one of the most important internal controls the City can have, and the bank reconciliation cannot be considered complete until it has been reviewed and approved. To be an effective control, bank reconciliations and the associated review should be completed in their entirety as soon as reasonably possible after each month-end, usually within thirty to forty-five days of the bank statement date. The dates of preparation and performance of review of the monthly Bank Reconciliations should be documented to clearly indicate proper internal controls are in place and the bank reconciliation process was completed timely.

During our review of the January 2019 and March 2019 bank reconciliations for the general checking account, we noted that although the preparer and reviewer signed off on the bank reconciliations, the date of preparation for the January 2019 bank reconciliation is not documented, and the January 2019 and March 2019 bank reconciliations were not reviewed until April 5, 2019 and May 24, 2019, respectively. 23 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

SIGNIFICANT DEFICIENCIES
2019-03 Timely Review of Bank Reconciliations (Continued) By not completing and reviewing the bank reconciliations timely, accounting errors, misstatements and/or unauthorized activities may not be identified or corrected in a timely manner.

We understand the review of the bank reconciliations was delayed due to the Finance Department being understaffed, and the missing review documentation was due to staff oversight.

Update for June 30, 2020:

During our review of the January 2020 and March 2020 bank reconciliations, we noted that the reconciliations were not prepared and reviewed until May 2020 and June 2020, respectively. Although we did note that the June 2020 bank reconciliations were prepared and reviewed timely in August 2020, the City should develop procedures to ensure the bank reconciliation process should be completed within 30 to 45 days of month end throughout the fiscal year.

Update for June 30, 2021:

During our review of the November 2020 General Checking account bank reconciliation, we noted that the preparer and reviewer signed off on the reconciliations, by evidence of the employee's initials.

However, the preparation and review were not completed until February 1, 2021, and February 3, 2021, respectively.

We did note that the March 2021 and June 2021 bank reconciliations were prepared and reviewed timely, however due to staff turnover, some tasks during the fiscal year were delayed.

Update for June 30, 2022:

During our review of the January 2022 bank reconciliations, we noted that the preparer and reviewer signed off on the reconciliations, by evidence of the employee's initials. However, the preparation and review were not completed until April 20, 2022, and May 3/4, 2022, respectively.

We did note that the June 2022 bank reconciliations were prepared and reviewed in early August 2022, however we understand that due to staff turnover and a consultant hired to help that was later unable to provide the service, some tasks during the fiscal year were delayed.

Current Status:

Preparation of timely bank reconciliations are assigned to an Accountant II, which are subsequently reviewed and signed by both the Financial Services Manager and the Controller.

While we agree some tasks during the fiscal year were delayed due to staff turnover, bank reconciliation preparation and review submission time improved dramatically from Fiscal Year 2020 and into Fiscal Year 2021, as evidenced by the timely March and June 2021 bank reconciliations. Staff turnover led to the update for June 30, 2022, however all bank reconciliations have been prepared and reviewed on time so far for Fiscal Year 2023. 24 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

SIGNIFICANT DEFICIENCIES
2019-04 Timely Preparation and Review of Quarterly Investment Reports Investment account reconciliations are an important element of the City's internal controls. In order to be an effective control, reconciliations should be completed as soon as reasonably possible after each month- end, usually within 30-45 days if receipt of statements, and subsequently reviewed for accuracy. Errors and unreconciled differences should be researched, understood and corrected immediately, to prevent additional errors and a decrease in efficiency. In addition, Section XIV, Investment Advisory Committee/Reporting Requirements, requires that quarterly information "be submitted to the City Manager and City Council within 30 days following the end of the quarter, or as soon as practicable after the data is available to the City," and California Government Code Section 53646(b)(I) also requires filing of the report with City Council within 30 days of quarter end.

During our review of the four quarterly Investment Reports for fiscal year 2019, we noted that the preparation was delayed, which in turn delayed the City Treasurer's review process and the subsequent submission to Council. (see table below for timeframes):

Date Days Council Days
TR Month Reviewed Elapsed Approval Elapsed
9/30/2018 12/3/18 64 days 12/18/18 79 days
12/31/2018 10/31/19 304 days 11/19/19 323 days
3/31/2019 11/4/19 218 days 11/19/19 233 days
6/30/2019 11/4/19 127 days 11/19/19 142 days
As a result, the City is not in compliance with the requirements of the Investment Policy and the California Government Code, and any errors may not be detected in a timely manner.

We understand City staff is working to perform investment reconciliations in a timely manner, however due to staff turnover, some tasks have been delayed.

The City should develop procedures to ensure quarterly investment reports are completed, reviewed and submitted to Council in a timely manner in accordance with the reporting requirements of the Investment Policy and the California Government Code.

Update for June 30, 2020:

We again selected quarterly Investment Reports for testing of timely preparation and review and noted that the September 2019 and December 2019 quarterly Investment Reports included documentation of the preparer and reviewer, but neither included documentation as to when they had taken place. And, as of June 2020, neither quarterly Investment Report had been submitted to the City Council. 25 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL
2019-04 Timely Preparation and Review of Quarterly Investment Reports (Continued) Date Signed Days Council Days
TR Month by Treasurer Elapsed Approval Elapsed
9/30/2020 2/9/2021 132 days 3/16/2021 167 days
12/31/2020 3/9/2021 68 days 4/20/21 110 days
3/31/2021 5/5/2021 35 days 6/15/2021 76 days
We did note that the June 2021 Investment Report was prepared timely, however the City should develop procedures to ensure quarterly investment reports are completed, reviewed and submitted to Council in a timely manner in accordance with the reporting requirements of the Investment Policy and the California Government Code throughout the fiscal year. And, the dates of the preparation and review of the reports should be documented in some formal manner.

Current Status:

Implemented
2018-01 Segregation of Duties in Major Control Areas
During our review of the City's internal controls for proper segregation of duties and procedures, we noted areas in which controls need to be improved and employee's access and/or duties revised. Good internal controls require that employees with access to the City's assets not have access to the City's accounting records for the same assets. Inappropriate access could potentially result in undetected errors. a) Access to Customer Database and Cash Receipts/ Non-Sufficient Funds Checks City staff that is involved in the cash receipts process should not normally be allowed to have access to make changes to the customer database. And, employees that generate accounts receivable billings should not be involved with the collection of cash receipts or processing of non-sufficient funds checks and ability to adjust the general ledger.

The Finance Supervisor and the Accounting Technician handle cash receipts and have access to the customer database, non-sufficient funds checks and can adjust the general ledger, while it does not appear that changes to the customer database are reviewed. And, the Accounting Technician generates accounts receivable billings.

We understand the Finance Department was understaffed, which resulted in a need to reallocate certain employee duties.
26 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

SIGNIFICANT DEFICIENCIES
2018-01 Segregation of Duties in Major Control Areas (Continued) The access to make changes to the customer database should be removed from the Finance Supervisor and the Accounting Technician and in the event the system does not allow such a change, there should be a review and approval of all changes to the customer database on a gular basis to ensure all changes were authorized. In addition, the processing of non-sufficie nds checks should be transferred to an emplovee that is not involved with both billings an collections and if the Accounting Technician continues to prepare accounts receivable billings, b) Finance Staff with General Ledger Super User Rights
A system super-user is an individual who has full access over the City's financial system including all modules and all functions. Accounting staff should not normally be allowed to have super-user rights in the City's general ledger system.

We noted that the City's Finance Supervisor has super-user access to the City's general ledger system.

We understand that City staff believes sufficient controls are in place to mitigate the risk.

The City should consider restricting super user rights to as few employees as possible, preferably to those outside of the Finance Department, such as Information Technology personnel, since they are not involved with processing or approving general ledger transactions. Until that is possible, the City should implement mitigating controls such as a review and approval of changes made to the system by the above employee.

Current Status:

See comment 2019-02.
27 This Page Left Intentionally Blank

CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2019-05 Timely Posting of Journal Entries
As noted above and in prior year Memorandum on Internal Control comment 2018-05, journal entries are an important transaction cycle that affects all aspects of accounting and financial reporting. Prudent internal control concepts dictate the journal entries should be posted within a timely manner that is usually within 35 to 45 days.

We selected forty journal entries for testing of supporting documentation and timely posting and noted three were not posted timely as follows:

1. A journal entry with an effective date in December 2018 was not posted until April 2019

2. A journal entry with an effective date in January 2019 was not posted until April 2019

3. A journal entry with an effective date in March 2019 was not posted until May 2019 We understand the delays were due to the following:
• #1 - The public works department did not provide the supporting documentation needed to prepare the journal entry to finance timely.
• #2 and #3 - Bank reconciliation review was not performed in a timely manner as discussed in comment 2019-03, which delayed the posting of the journal entries.

The delay in posting journal entries could potentially affect the timeliness of all aspects of accounting and financial reporting. In addition, year-end entries may not be recorded to the correct accounting period in a timely manner.

The City should remind departments of the importance of providing information to the Finance Department timely and bank reconciliations should be prepared, reviewed and approved in a timely manner to ensure associated journal entries are posted timely. The City should develop processes anc procedures to ensure journal entries are prepared, reviewed and posted within 30 to 45 days after the period date for which the journal entry is to be recorded.

Update for June 30, 2020:

We again selected forty journal entries for testing of supporting documentation and timely posting and noted ten were not posted timely as follows:

1. A journal entry with an effective date in August 2019 was not posted until October 2019

2. A journal entry with an effective date in August 2019 was not posted until December 2019

3. A journal entry with an effective date in September 2019 was not posted until February 2020

4. A journal entry with an effective date in September 2019 was not posted until March 2020

5. A journal entry with an effective date in October 2019 was not posted until February 2020

6. Two journal entries with an effective date in October 2019 were not posted until March 2020

7. Two journal entries with an effective date in November 2019 were not posted until March

8. A journal entry with an effective date in December 2019 was not posted until March 2020 We understand these journal entries are entries related to transactions discovered during the bank and investment reconciliation processes, which were delayed due to staff turnover and limited available staff. 29 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2019-05 Timely Posting of Journal Entries (Continued)
Update for June 30, 2021:

We again selected forty journal entries and noted five were not posted timely as follows:

1. JE 1021 with a transaction date in July 2020 was not posted until October 2020.

We understand these journal entries are entries related to transactions discovered during the bank and investment reconciliation processes, which were delayed due to staff turnover and limited available staff.

Update for June 30, 2022:

We again selected forty journal entries and noted seventeen were not posted timely, with delays ranging from two to eight months.

We understand these journal entries were delayed due to the implementation of the new general ledger system and the workflow notification not working. The workflow component of the general ledger system electronically sends transactions to reviewers when they are ready for review and approval.

The City should develop processes and procedures to ensure journal entries are prepared, reviewed and posted within 30 to 45 days after the period date for which the journal entry is to be recorded.

Current Status:

We agree processes and procedures should be in place to ensure journal entries are prepared. reviewed, and posted within 30-45 days. While the journal workflow feature in the new ERP system has created efficiencies in this area, implementation of the ERP system during Fiscal Year 2022 hampered timeliness of some journal entries. We do not expect this item for Fiscal Year 2023.
2018-05 Timely Posting of Journal Entries
Journal entries are an important transaction cycle that affects all aspects of accounting and financial reporting. Prudent internal control concepts dictate that journal entries should be posted within a timely manner that is within 30 to 45 days after the period date for which the journal entry is intended to record.

We selected forty journal entries and noted two that were not posted timely. • One journal entry was to record fuel charges for the month of December 2017. The journal entry was prepared on March 1, 2018 and posted on March 29, 2018. • One journal entry posted in June 2018 was to record Engineering Charges for the month of March 2018.
30 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2018-05 Timely Posting of Journal Entries (Continued)
We understand the Finance department was heavily involved in preparing budget reports during the month of December 2017, coupled with a shortage in department staff, that caused the delay in posting the fuel charge journal entry. As for the delay in posting the Engineering Charges activity was due to the Engineering department's project time (billable time) not being integrated with the general ledger system.

Is a result, City staff has to manually enter all transactions, which can be a tedious and time consuming process.

The delay in posting journal entries could potentially affect the timeliness of all aspects of accounting and financial reporting.

The City should develop procedures to ensure that all journal entries are prepared, reviewed and posted within 30 to 45 days after the period date for which the journal entry is to be recorded, including Engineering Department's time billing.

Current Status:

See comment 2019-05
2018-06 Develop a Review Process for Deposits Payable
To ensure that deposits payable balances are accurate, deposit payable details should be reviewed on a regular basis, such as monthly or quarterly.

We selected forty journal entries for testing and noted one was for the reclassification of a Business Improvement Area deposit that was collected in August 2017 and paid out in September 2017. The deposit payable remained in the deposit account, because the disbursement was coded to an expense account and the error was identified and corrected in December 2017.

We understand the City does not have a procedure in place to review Business Improvement Area deposits to ensure that payment activity is reconciled to the deposits payable activity. Lack of review could result inaccurate accounting for the deposits payable balances.

The City should develop a review process for the Business Improvement Area deposits payable to ensure all balances are outstanding and were not refunded in a prior period.

Current Status:

The City agrees that we should develop a process for the Business Improvement Area (BIA) leposits payable to ensure that all balances are outstanding and were not refunded in a prio eriod. The BIA deposit account holds the fees collected with the business licenses for the Park Street Business Association and the Webster Street Business Association. Currently a remittance is done to the associations for their fees on a quarterly basis and reconciled before the year-end close.
31 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2018-08 Review of Service Organization Reports
The City has several independent contractors which process transactions for various City activities including fiscal agent cash, investments, ambulance billing services, parking citations and others. The City should review the Statements on Standards for Attestation Engagements #16 (SSAE 16) reports from their service organizations.

City staff does not currently request and review SSAE 16 reports from the service organizations to ensure that findings are addressed by the entities and such findings do not involve or affect the City's The procedures used by these service organizations are outside the scope of City oversight and staff review, nor are these controls part of the scope of an audit of the City's financial statements. Typically, cities may employ a variety of approaches to gain comfort that service organizations are performing their functions in a prudent manner and producing reliable data. For example, trust departments manage funds held pursuant to debt indentures, but cities rarely have audits performed as City staff review transactions and verify the trust data. Less frequently, special audits are performed to determine adequacy of controls and to verify the data produced. There is a third option which is to request a review and report on internal controls pursuant to the requirements of Statements on Standards for Attestation Engagements #16.

We understand that City staff was unaware that SSAE 16 reports were available for review and should be requested and reviewed on an annual basis.

The City should request a SSAE 16 report from its independent contractors. Any weaknesses or system problems disclosed by that audit should be addressed and resolved by the contractor to the satisfaction of Current Status:

As part of the year-end procedures, the City will request SSAE16 reports from identified service organizations.

The Finance Director and the Revenue Supervisor review the SSAE 16 reports. 32 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2018-09 Alameda County Transportation Commission Timely Use of Funds Policy In December 2015, the Alameda County Transportation Commission (ACTC) approved a Timely Use of Funds Policy. This policy was adopted to encourage Measure B/Measure BB/Vehicle Registration Fee (VRF) recipients to expend voter-approved transportation dollars expeditiously on transportation improvements and operations that the public can use and benefit from immediately.

Under the terms of the Policy, a recipient of Measure B, BB or VRF cannot carry a fiscal year end fund Conse ive fiscat years wi of each Finding primain. ACT il menior foreciples genets anuat ending fund balance to revenue received ratio, cumulatively across the recipient's programmatic categories by fund program, to verify Policy compliance.

If the recipient does not meet the requirements of the Policy, the ACT may determine that the recipient does not need Measure B, BB or VRF funding and rescind the recipient's subsequent fiscal year's Measure B, BB or VRF direct local distribution in part or in its entirety and redistribute those funds to the same program type.

The provisions of the Timely Use of Funds Policy begin with the Measure B, BB, or VRF funding received in fiscal year 2017, which means that if the fund balance for any program exceeds 40% of the distribution consecutively in each of the fiscal years of 2017 to 2020, funding for fiscal year 2021 could be at risk. ACTC provided the recipient agencies with a flow chart to assist in determining compliance and track the funds. In the event the recipient's fund balance for a program does exceed the maximum allowed percentage, there are provisions in the Policy for submitting a request for exemption with a justification and implementation plan, which resets the consecutive fiscal year "clock." However, ACTC will only allow exemptions under extraordinary circumstances and the recipient must provide a timely expenditure plan for use of the funds.

The City should ensure that it is using the flow chart and any other compliance tools necessary to ensure that the City is spending the funds as intended and not accumulating ending fund balance in any of the three programs in excess of the maximum allowed percentage for four consecutive fiscal years, or request an exemption, if applicable.

Current Status:

The City of Alameda continues to use Measure B, BB and VRF funding to support a variety of transportation related projects throughout the City. These funding sources currently support a variety Capital Projects and operational programs. In response to the Timely Use of Funds Policy, the City has prioritized Measure B, BB and VRF funding towards the City's annual Pavement Management, Street Safety Improvements, Paratransit, and Bicycle Pedestrian programs to ensure compliance. For FY 2020-21, Alameda CTC granted all cities an extension to the Timely Use of Funds policy to ensure there is no disruption of funding due to the challenges faced by the pandemic. Alameda CTC revisited their Timely Use of Funds Policy for DLD funds presented a revised policy that addresses issues raised by DLD recipients over the course of implementing/adhering to the current policy.
33 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2018-10 Information Technology Best Practices Recommendations We conducted an Information Systems Review with our audit which encompassed the financial information system and the network environment that houses it. We expanded our work in previous years Geed by overliusty gracin in ver-based colems as and interfereased inancia systorised acres controls that are present in the overall network environment have become more important and relevant to understanding the internal controls over the financial system. We believe Information System controls must be continuously improved and enhanced to stay ahead of the ever-increasing sophistication of hackers and criminals.
adequate security over information technology. A voluntary risk-based Cybersecurity Framework has been developed by the National Institute of Standards and Technology (NIST) per Presidential Executive Order 13636 (12 FEB 2013). The Framework for Improving Critical Infrastructure Cybersecurity version 1.0 (12 FEB 2014) offers some appropriate standards. Our Information Systems auditors have reviewed the voluntary framework and concluded that the risk management framework developed by NIST for the Federal Information Security Management Act (FISMA) is the most appropriate for local governments'. The NIST risk management framework represents the minimum security requirements for federal government agencies and recommends these controls for private industry and state and local governments. Our procedures included performing an external network scan based on NIST criteria and in determining that internal control provides for:
• Internet access defenses including hacker prevention, detection and deterrent systems • Security of data from physical or network access
• Adequately protecting data from unauthorized internal access •I Reasonable measures to ensure continuation of service We again noted areas which could be improved to conform to NIST guidelines. A summary of these recommendations which we believe are "best practices" as follows:

Payment Card Industry Compliance
The City is not in compliance with the Payment Card Industry Data Security Standard (PCI-DSS). Any organization that processes credit cards is required to comply with PCI-DSS, even if the processing is outsourced. Failure to meet compliance requirements results in higher transaction fees and liability if a security breach is found. Because the City accepts credit cards as a form of payment, the City must be compliant with the applicable controls.
1 "State, local, and tribal governments, as well as private sector organizations are encouraged to consider using these guidelines, as appropriate." NIST SP 800-37 Rev 1 pg. 11
34 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2018-10 Information Technology Best Practices Recommendations (Continued) Audit/Event Logging
access such as upgrades or application modifications by IT personnel, outside consultants or vendors should also be logged and reviewed.?
Session Locks
The City does not have session locks turned on for the financial application or the workstation operating systems. A session lock is a temporary lockout of the operating system or financial application when a user stops work and typically moves away from the immediate physical vicinity of the computer.

Employees may leave their workstation for lunch or break and not log off or log out of the application.

This leaves the operating system or financial application open and available to any passerby. Any person with physical access would be able to perform any tasks the absent user has privileges or rights to do. At the very least workstations should be set to lock out the workstation after a period of inactivity. Best practice would be to have both the operating system and financial application have lockouts after a period of inactivity.

General Information Systems Controls
Our administrative and technical control review is based on the National Institute of Standards and Technology (NIST) control catalog NIST SP 800-53 rev. 4 for a moderate system as defined by NIST SP 800-60. Although there is no required IT standard for local governments, NIST encourages state, local and tribal governments to consider the use of these guidelines, as appropriate. In adopting NIST standards, the local government demonstrates due diligence in designing and implementing appropriate controls around its information systems.

A list of the controls that are not fully in place is available in the questionnaire provided to City staff.

Current Status:

Recognizing there are no material weaknesses in our Information Systems Review, the following measures will be or are being implemented to improve our best practices efforts.

Payment Card Industry Card Compliance:

The City implemented a new ERP system that satisfied PCI compliance for all City departments.

Audit/Event Logging:

User access is set up by the IT department following separation of duties. IT receives approval from the Finance Department to establish approved user permissions. Our new ERP system can have audit logs on the financial application server.

Session Locks: Implemented
2 For more information on Audit/Event log management see NIST SP 800-92 Guide to Computer Security Log Management. 35 CITY OF ALAMEDA

MEMORANDUM ON INTERNAL CONTROL

CURRENT STATUS OF PRIOR YEAR

OTHER MATTERS
2018-10 Information Technology Best Practices Recommendations (Continued) General Information Systems Controls: As part of our IT Governance strategy plan, the city is following the National Institute of Standards and Technology (NIST) to adhere to best practices for cybersecurity. While the city is not yet 100% compliant, we are 32% fully compliant, 19% artially compliant and 49% non-compliant with the NIST cybersecurity framework (CSF nentioned in the audit; however, the IT Department does have a plan for action to address th Here are the results from our latest Nationwide Cyber Security Review (NCSR) based on the NIST CSF:

STATUS 2020 PRIOR +/- CHANGE
Fully Compliant 40% 32% +8%
Partially Compliant 7% 19% -12%
Non-compliant 53% 49% +4%
36

Alameda City CouncilMay 2, 2023

Alameda City Council
May 2, 2023