Quarterly Audit and Performance
Review Report
FY 2022-23, Q3
May 9, 2023
Irella Blackwood, Audit Bureau Director
1 FY 2022-23 Audit Plan Portfolio Status
29 Audits and Assessments to Date
Status Count
Completed 15
In Progress 8
Upcoming 6
Total 29
2 Upcoming
21%
Completed
52%In Progress
27%
Audits Completed and Reports Issued
Audit / Assessment Oversight
Body Report Date
ERM: Cyber Risk Assessment SFPUC 1/24/23
FY 2021-22 Audited Financial Statements
(3 Reports)
SFPUC,
Controller 1/27/23
SSIP CS-165 Program Management
Contract Audit CSA, Controller 2/16/23
Annual Comprehensive Financial Report,
FY 2021-22
SFPUC,
Controller 2/28/23
Popular Annual Financial Report, FY
2021-22 SFPUC 2/28/23
Revenue Lease Audit: Crystal Springs
Golf Partners, LP CSA, Controller 3/9/23
3 2023 SFPUC Public Integrity Update
4 Since early 2020, the City and County of San Francisco (CCSF) has embarked on a series of investigations, audits, reviews, and department-specific assessments as part of the public integrity series:
Public Integrity Report Report Date PUC
Identified?
Recommendations
Completed?
1 Public Works Contracting June 2020 N N/A
2 Gifts through Non-City Orgs September
2020 Y Y
3 SF Debarment Process Nov. 2020 N N
4 San Francisco International Airport January 2021 Y Y
5 Refuse Rate Setting April 2021 N N
6 Department of Building Inspection Sept. 2021 N N/A
7 Social Impact Partnership Program Dec 2021 Y Y
8 Refuse Rates May 2022 N N/A
2023 SFPUC Public Integrity Update,
Cont.
5 Contracting and procurement has been a particular focus of SFPUC’s ongoing public integrity efforts:
Contracting Procurement
SIP Program Audit
SFPUC PI Assessment (SOLIS)
SSIP Management Audit
Crystal Springs Golf
Lease Administration
Audit
RBOC Phase 1
RBOC Phase 2
RBOC Phase 3
BLA SFPUC Chapter 6 Audit
SFPUC Public Integrity Project
(New)
Annual Post Audit
Completed
In Progress
Upcoming
Open CSA Audits and
Recommendations
6 # Audit Title
Report
Issued
Date
Open
Rec
Total
Rec
Months
Open
%
Complete
Target
Close
Date
SSIP CS-165 Program Management Contract Audit
1 Although Its Sewer System Improvement Program Management Consultant Complied With Contract Terms, the San Francisco Public Utilities Commission Should Improve Its Contract Management
2/16/2023 15 15 2 0% 3/31/2024
Revenue Lease Audit: Crystal Springs Golf Partners, LP
2 Crystal Springs Golf Partners, L.P., Paid Rent Owed for 2019 Through 2021, but a Few Improvements Can Strengthen
SFPUC’s Lease Administration
3/9/2023 8 8 1 0% 12/31/2023
Total 23 23 0%
7 FY 2022-23, Q4 Outlook
Completing
• Franchise Fee Audit: Energy Center SF LLC
• FY 2020-21 Wholesale Revenue Requirement: Statement of Changes in Balancing Account
• Post Audit, CY 2021
• Public Integrity Assessment: SOLIS Procurement
• SFPUC Revenue Bond Programs Audit: Phase II
8 FY 2022-23, Q4 Outlook
Upcoming
• 2022 Green-e Verification Audit, SuperGreen
• 2022 Green-e Verification Audit, SuperGreen Saver
• Cybersecurity Maturity Assessment, FY 2022-23
• Sanitary Survey, Cyber Security Assessment
• NERC-CIP Audit
• SFPUC Revenue Bond Programs Audit: Phase III
THANK YOU
Feedback & Questions?
9 London N. Breed
Mayor
Newsha K. Ajami
President
Sophie Maxwell
Vice President
Tim Paulson
Commissioner
Anthony Rivera
Commissioner
Kate H. Stacy
Commissioner
Dennis J. Herrera
General Manager
DocuSign Envelope ID: BOA061A2-AC90-4E67-AF15-473F8E774B8B San Francisco
Water Power Sewer
Services of the San Francisco Public Utilities Commission 525 Golden Gate Avenue, 13th Floor
San Francisco, CA 94102
T 415.934.5707
F 415.554.1877
Date: May 9, 2023
To: Commissioner Newsha K. Ajami, President
Commissioner Sophie Maxwell,Vice President
Commissioner Tim Paulson
Commissioner Anthony Rivera
ommissioner Kate H. Stacy
Through: ennis J. Herrera, General Manager
From: Nancy L. Horn, Chief Financial Officer and Assistant Os
General Manager, Business Services iqk
Subject: FY 2022-23 Q3 Audit and Performance Review Report This memorandum summarizes the San Francisco Public Utilities Commission (SFPUC) Quarterly Audit and Performance Review (QAPR) report for the third quarter of FY 2022-23 Q3, ending March 31st, 2023.
I. Completed Audits
There were eight completed audits during the third quarter of FY 2022-23:
1. Enterprise Risk Management: Cyber Risk Assessment I January 24, 2023 Report Summary: The SFPUC's Cyber ERM Assessment is an annual iterative review of risks, risk components, and treatments. It serves as a continuous monitoring, tracking, and identification of new and emerging risks. Due to the sensitive nature of cybersecurity, the contents of this report are confidential.
2.- 4. FY 2021-22 Audited Financial Statements (3 Reports)1January 27, 2023 Report Link: https://tinyurl.com/mj3yce4s
Report Summary: Third-party auditor KPMG LLP issued clean, or unqualified opinions, of the financial statements of all three enterprises. It was the auditor's independent opinion that the financial statements are accurate and free from material misstatements, and additionally noted no internal control weaknesses.
5. SSIP CS-165 Program Management Contract Audit! February 16, 2023 Report Link: https://tinyurl.com/3ejbzu86
Report Summary: Sjoberg Evashenk Consulting, Inc., was engaged by the Controller's Audit Division to conduct a performance audit of SFPUC's Program Management Consultant professional service contract for the Sewer System Improvement Program (Agreement Number CS-165) and evaluate whether OUR MISSION: To provide our customers with high-quality, efficient and reliable water, power and sewer services in a manner that values environmental and community interests and sustains the resources entrusted to our care.
DocuSign Envelope ID: BOA061A2-AC90-4E67-AF15-473F8E774B8B SFPUC's contract management practices and procedures were adequate to ensure the contractor complied with contract requirements.
Audit Findings Summary: The audit concluded that SFPUC ensured that the 15-year professional services Program Management Consultant contract with AECOM-Parsons Joint Venture was fulfilled, but improvement is necessary in its contract management practices over similar large-scale programs. SFPUC was found to have generally employed solid practices around appropriate and allowable invoicing, staying within contract limits, and approving labor hours and billing rates. However, 13 findings were identified across three broadly defined areas:
1. Contract management — oversight, policies and procedures
2. Planning — for life of contract and across task orders
3. Task order administration — appropriate use and oversight of contractors
6. Annual Comprehensive Financial Report, FY 2021-22! February 28, 2023 Report Link: https://tinyurl.com/4vwf8jyz
Report Summary: The Annual Comprehensive Financial Report holistically details the financial activities, condition, and services for all Water, Wastewater, and Hetch Hetchy Water & Power & CleanPowerSF results. It also provides financial and statistical data, inclusive of 10 years of financial and operating metrics, with social and economic data.
7. Popular Annual Financial Report, FY 2021-22 (February 28, 2023 Report Link: https://tinyurl.coml4p8dc8z7
Report Summary: The Popular Annual Financial Report (PAFR) is a high-level summary of information from the Annual Financial Report specifically designed to be readily accessible and easily understandable to the general public and other interested parties. This year's PAFR highlights protection of watersheds; continued work to reduce carbon emissions from fossil fuels; promotion of equitable access to clean energy; expansion of wastewater infrastructure and programs to build resiliency, improve systems, and protect the environment; and serving diverse communities through racial equity and inclusivity in operations and programs.
8. Revenue Lease Audit: Crystal Springs Golf Partners, LP I March 9, 2023 Report Link: https://tinyurl.com/3sremv2h
Report Summary: Sjoberg Evashenk Consulting, Inc., was engaged by the Controller's Audit Division to conduct a contract compliance audit of Crystal Springs Golf Partners, LP (Partners) and assess how well SFPUC managed the lease agreement. The 20-year lease, which will expire in September 2037, allows Partners to operate a public golf course and related facilities on SFPUC land. The audit covered 2019 through 2021.
Audit Findings Summary: The audit found that SFPUC ensured Partners paid all rent that was due for the period of 2019 through 2021. Four findings were listed, however — in summary:
•Loss of potential interest from temporary pandemic-related rent forbearance between 2020 and 2021
•Untimely deposit of rent payments
•Lack of lease-required tracking by Partners of capital improvement expenses by applicable funding source and submission of audited financial information to SFPUC
2 DocuSign Envelope ID: BOA061A2-AC90-4E67-AF15-473F8E774138B •Lack of documentation provided by Partners to SFPUC of lease-required planned advertising activities or related costs
II. Audit Recommendation Status
As of 3/31/23, 23 audit recommendations are open for two audits: the SSIP CS-165 Program Management Contract Audit and the Crystal Springs Golf Partners, LP Revenue Lease Audit.
If you have questions, please contact me at NHomasfwater.orci or IreIla Blackwood at [email protected].
Attachment: FY 2022-23 Audit Plan, By Status
CC: Ronald P. Flynn, Deputy General Manager
IreIla Blackwood, Audit Bureau Director
Sheryl Bregman, SFPUC Counsel, Office of the City Attorney 3 DocuSign Envelope ID: BOA061A2-AC90-4E67-AF15-473F8E774B8B O San Francisco Quarterly Audit & Performance Review Report Water Power Sewer FY 2022-23 Audit Plan, By Status
As of March 31, 2023
Status
Completed:
In Progress:
Upcoming:
Total:
15 8
29 # Quarter Status Audit Type Enterprise / Bureau Audit Name Oversight Body
1 [Updated]
Completed
Financial Water
Audited Financial Statements, FY 2021-22 SFPUC,
Controller 2
[Updated]
Completed
Financial Wastewater
3 [Updated]
Completed
Financial
Hetch Hetchy Water
& Power and
CleanPowerSF
4 [Updated]
Completed Financial Business Services,
Finance Annual Comprehensive Financial Report, FY 2021-22 SFPUC, Controller
5 [Updated]
Completed
Financial Business Services,
Finance Popular Annual Financial Report, FY 2021-22 SFPUC 6 In Progress Financial Power
1 Franchise Fee Audit: Energy Center SF LLC Controller
7 In Progress Financial Business Services,
Finance
Wholesale Revenue Requirement: Statement of
Changes in Balancing Account, FY 2020-21 BAWSCA
8 Completed Financial Power Franchise Fee Audit: Pacific Gas & Electric Company Controller 9 Completed Financial Water
Annual Physical Inventory Count, FY 2021-22 SFPUC,
Finance 10 Completed Financial Wastewater
11 Completed Financial Hetch Hetchy Water
& Power
12 Completed Financial Business Services,
Finance Post Audit, CY 2021 Controller
13 Upcoming Financial Power 2022 Green-e Verification Audit, SuperGreen Center for
Resource
Solutions
14 Upcoming Financial Power 2022 Green-e Verification Audit, SuperGreen Saver Center for
Resource
Solutions
15 [Updated]
In Progress
Financial Business Services,
Finance Post Audit, CY 2022 Controller
16 [Updated]
In Progress
Financial Business Services,
Finance
Wholesale Revenue Requirement: Statement of
Changes in Balancing Account, FY 2021-22 BAWSCA
17 In Progress Performance Infrastructure Public Integrity Assessment: SOLIS Procurement CSA, Controller
18 [Updated]
Completed
Performance Infrastructure SSIP CS-165 Program Management Contract Audit CSA, Controller
4 23
[Updated]
Upcoming
[Updated]
Upcoming
[Updated]
Completed
[Updated]
In Progress
27 [Updated]
Completed
DocuSign Envelope ID: I30A061A2-AG90-4E67-AF15-413h8E774138B
Quarter Status Audit Type Enterprises'
Bureau Audit Name Oversight Body
RBOC
Lease Revenue
Revenue Bond
Oversight
Committee
Revenue Bond
Oversight
Committee
CSA,
Controller
Reliability Standards Compliance Audit
IT / OT Network Audit
CA Independent System Operator (CAISO) Scheduling
Coordinators Self-Audit, 2020-22
Cybersecurity Maturity Assessment, FY 2022-23
Sanitary Survey, Cyber Security Assessment TBD
NERC-CIP Audit WECC /
NERC
Revenue Lease Audit: Crystal Springs Golf Partners LP CSA, Controller
SFPUC Revenue Bond Programs Audit: Phase II RBOC
Enterprise Risk Management: Cyber Risk Assessment
SFPUC Chapter 6 Delegated Authority Audit
SFPUC Revenue Bond Programs Audit: Phase III I RBOC
Business
Services, ITS
Hetch Hetchy
Water & Power
Hetch Hetchy
Water & Power
Business
Services, ITS
WECC /
NERC
CAISO
CSA,
Controller
RBOC
Hetch Hetchy
Water & Power
Business
Services, ITS
All SFPUC
Real Estate
Services
Power
SFPUC
BOS
Performance
Performance
Performance
Performance
Performance
Performance
Performance
Performance
Concessions,
5 19 In Progress
20 Completed
21 Completed
22 Upcoming
24 28 In Progress
29 Upcoming
25 26
DocuSign
Certificate Of Completion
Envelope Id: B0A061A2AC904E67AF15473F8E774B8B
Subject: Complete with DocuSign: 0.2 4.26.23 0.1 - FY 2022-23 03 QAPR for signature.pdf Source Envelope:
Document Pages: 5 Signatures: 0
Certificate Pages: 1 Initials: 1
AutoNav: Enabled
EnvelopeId Stamping: Enabled
Time Zone: (UTC-08:00) Pacific Time (US & Canada)
Status: Completed
Envelope Originator:
Christopher Crane
525 Golden Gate Ave
San Francisco, CA 94102
[email protected]
IP Address: 67.218.104.126
Record Tracking
Status: Original Holder: Christopher Crane Location: DocuSign 4/28/2023 2:07:09 PM [email protected]
Signer Events
Nancy Horn
[email protected]
CCSF - PUC
Security Level: Email, Account Authentication
(None)
Electronic Record and Signature Disclosure:
Not Offered via DocuSign
Signature
/- DS
Mk
Signature Adoption: Pre-selected Style
Using IP Address: 98.234.27.130
Signed using mobile
Timestamp
Sent: 4/28/2023 2:11:36 PM
Viewed: 4/28/2023 2:20:22 PM
Signed: 4/28/2023 2:20:28 PM
In Person Signer Events Signature Timestamp
Editor Delivery Events Status Timestamp
Agent Delivery Events Status Timestamp
Intermediary Delivery Events Status Timestamp
Certified Delivery Events Status Timestamp
Carbon Copy Events Status Timestamp
Witness Events Signature Timestamp
Notary Events Signature Timestamp
Envelope Summary Events Status Timestamps
Envelope Sent Hashed/Encrypted 4/28/2023 2:11:36 PM
Certified Delivered Security Checked 4/28/2023 2:20:22 PM Signing Complete Security Checked 4/28/2023 2:20:28 PM
Completed Security Checked 4/28/2023 2:20:28 PM
Payment Events Status Timestamps