Quarterly Audit and Performance
Review Report
FY 2024-25, Q2
March 11, 2025
Nancy L. Hom
Chief Financial Officer and AGM, Business Services
1 FY 2024-25 Audit Plan Status
Audits and Assessments To Date
Status Count
Completed 17
In Progress 7
Upcoming 12
Total 36
2 Completed In Progress Upcoming
Q2 Audits Completed and Reports Issued
Audit / Assessment Oversight Body Report
Date
FY 2022-23 Wholesale Revenue Requirement:
Statement of Changes in Balancing Account
Bay Area Water Supply
& Conservation Agency 10/3/2024
CY 2021-22 Energy Center SF LLC Franchise
Fee Audit
Controller’s Office, City
Services Auditor 10/10/2024
CY 2021-22 Pacific Gas & Electric Company
Franchise Fee Audit
Controller’s Office, City
Services Auditor 10/17/2024
EPA Cybersecurity Guidelines Self-Assessment SFPUC 11/4/2024 FY 2023-24 Audited Financial Statements Controller 11/12/2024 Chapter 6 Delegated Authority Audit
Board Of Supervisors,
Budget and Legislative
Analyst
12/20/2024
FY 2023-24 Annual Comprehensive Financial
Report SFPUC 12/20/2024
FY 2023-24 Popular Annual Financial Report SFPUC 12/20/2024 3 4
[Option 1] Spotlight: Chapter 6 Delegated Authority
Performance Audit
Board of Supervisors’ Budget and Legislative Analyst’s Office (BLA) • First of citywide series of performance audits of procurement under Chapter 6
• Fiscal Years 2019-20, 2020-21, and 2021-22
Background
Chapter 6 of San Francisco’s Administrative Code governs public work or improvement contracting policies and procedure for:
a) Public works contracts
b) Contracts for related professional design, consulting, and construction management services
BLA, Audit Fieldwork
• Interviews with SFPUC staff
• Review of published reports, best practices, relevant laws • Examination of SFPUC policies and procedures, controls • Analysis of contract database records
5 Spotlight: Chapter 6 Delegated Authority Performance
Audit
Audit Results
The BLA identified seven (7) findings:
1. Insufficient contract procurement policies & procedures, training
2. Lack of detailed policies re: failure/rejection of bids
3. Lack of established metric/goal for procurement time and processing
4. Decentralized change order management
5. Lack of established policy re: consideration of alternative project delivery methods
6. Bid protests properly administered, but opportunity to improve detection of bidder non-responsiveness
7. Public Works contractor performance and evaluation database non- functional
The BLA made 16 recommendations relating mostly to suggested improvements in policy and procedure documentation and training standardization.
6 [Option 2] Spotlight: EPA Cybersecurity Guidelines Self- Assessment
Background
SFPUC Audit Bureau and ITS Cybersecurity Team assessed ten internal operational technology systems using the Environmental Protection Agency (EPA) Cybersecurity Tool
• Based on Cybersecurity and Infrastructure Security Agency (CISA) Cross-sector Performance Objectives
• EPA regulations do not currently incorporate tested items; SFPUC views self-assessment as an opportunity to improve cybersecurity for relevant operational technologies regardless of any potential future change in federal regulation
Areas of focus include:
• Account Security
• Device Security
• Data Security
• Governance and Training
• Vulnerability Management
• Supply Chain/Third Party
• Response and Recovery
• Other
7 Spotlight: EPA Cybersecurity Guidelines Self-
Assessment
Methodology
Fieldwork completed through interviews/surveys of operational technology system owners
34 criteria, judged for accordance or deficiency
• Subset of 16 described by EPA as sources of potential significant deficiency
Comprehensive report issued in November 2024, along with ten individual operational technology system reports
Results
Results and recommended mitigations presented to system owners individually Reports are confidential, available for Commission’s review upon request CSA/BLA Audit Recommendations
8 # Audit Title
Report
Issued
Date
Open
Rec
Total
Rec
Months
Open
%
Complete
Close
Date
(or Target)
Revenue Lease Audit: Crystal Springs Golf Partners, LP
1 Crystal Springs Golf Partners, L.P., Paid Rent Owed for 2019 Through 2021, but a Few Improvements Can Strengthen
SFPUC’s Lease Administration
3/9/2023 0 8 18 100% 7/10/2024
Revenue Bond Oversight Audit, Phase II
2 The San Francisco Public Utilities Commission Spent Revenue Bond Funds for Allowable Purposes but Should Strengthen Its Compliance and Monitoring Controls
9/5/2023 0 3 12 100% 7/10/2024
Public Integrity Assessment: Procurement
3 Criminal Conduct by Former San Francisco Public Utilities Commission General Manager Harlan Kelly Undermined the
Integrity of City Procurements Despite Existing Rules
Governing Gifts, Disclosures, and Sole Source Waivers
3/27/2024 3 3 9 0% 7/31/2025
Chapter 6 Delegated Authority Audit
4 Performance Audit of the Authority Delegated to the San Francisco Public Utilities Commission for Public Works
Contracts Under Chapter 6 of the Administrative Code
12/20/2024 16 16 0 0% 1/1/2026
Total 19 30 37%
9 FY 2024-25, Q3 Outlook
Completing
• BOS Budget & Legislative Analyst, Conflicts of Interest Audit • BOS Budget & Legislative Analyst, Work Orders Audit
• RBOC Audit Phase 3
• FY 2023-24 Single Audit
• Public Integrity Assessment: Status of City Contracts 10 FY 2024-25, Q3 Outlook (Cont.)
Upcoming
• Customer Assistance Program, Post-Enrollment Verification • CleanPowerSF Independent Privacy Audit
• FY 2023-24 Wholesale Revenue Requirement: Statement of Changes in Balancing Account
• CY 2024 Post Audit
THANK YOU
Feedback & Questions?
11 OUR MISSION: To provide our customers with high-quality, efficient and reliable water, power and sewer services in a manner that values environmental and community interests and sustains the resources entrusted to our care.
BUSINESS SERVICES BUREAU
525 Golden Gate Avenue, 13th Floor
San Francisco, CA 94102
T 415.934.5707
F 415.554.1877
Dat
e: March 11, 2025
To: Commissioner Kate H. Stacy, President
Commissioner Joshua Arce, Vice President
Commissioner Avni Jamdar
Commissioner Steve Leveroni
Through: Dennis J. Herrera, General Manager
From: Nancy L. Hom, Chief Financial Officer and Assistant General Manager, Business Services
Subject: FY 202 4-25 Q2 Audit and Performance Review Report This memorandum summarizes the San Francisco Public Utilities Commission (SFPUC) Quarterly Audit and Performance Review (QAPR) report for the second quarter of FY 2024-25, ending December 31, 2024.
I. Com
pleted Audits
There w
ere ten completed audits during the second quarter of FY 2024-25:
1. FY 2022-23 Wholesale Revenue Requirement: Statement of Changes in the Balancing Account | October 3, 2024
Report Link: https://tinyurl.com/3t2ek84s
Report Summary: Third-party auditor Macias Gini & O'Connell LLP performed the annual audit, as required by the Water Supply Agreement with Wholesale Water Customers, to review the allocation of operating and capital costs among retail and wholesale water customers.
Audit
Findings Summary: In the auditors’ opinion, the Statement of Changes in the Balancing Account presents fairly, in all material aspects, the changes in the Balancing Account for fiscal year 2022-23. No deficiencies were noted with respect to internal controls over financial reporting.
2. CY 2021-22 Energy Center SF LLC Franchise Fee Audit | October 10, 2024
Report Link: https://tinyurl.com/e49rabe3
Report Summary: The Controller’s City Services Auditor (CSA) engaged Sjoberg Evashenk Consulting, Inc., (SEC) to audit whether Energy Center San Francisco LLC (Energy Center) properly paid the franchise fee that the City and County of San Francisco charges to use its streets to install, construct, maintain, and operate steam pipe conduits for distributing steam for heating purposes for 2021 and 2022.
Audit Findings Summary: The audit found that the SFPUC generally fulfilled its obligations in administering and monitoring the franchise.
3. CY 2021-22 Pacific Gas & Electric (PG&E) Franchise Fee Audit | October 17, 2024
Report Link: https://tinyurl.com/yxv8yksr
Report Summary: The Controller’s City Services Auditor engaged Sjoberg Evashenk Consulting, Inc., to audit the payment of franchise fees and surcharge fees by PG&E to the City and County of San Francisco (City) for 2021 and 2022. PG&E pays the City franchise fees to use city streets to transmit, distribute, and supply electricity and natural gas.
Audit Findings Summary: The audit found that the SFPUC generally fulfilled its obligations in administering and monitoring the franchise.
4. EPA Guidelines Cybersecurity Self-Assessment | November 4, 2024 Report is confidential
Report Summary: The SFPUC Audit Bureau and ITS Cybersecurity Team assessed ten internal operational technology systems using the Environmental Protection Agency (EPA) Cybersecurity Tool based on Cybersecurity and Infrastructure Security Agency Cross-sector Performance Objectives. This is a self-assessment as outlined by the EPA's Cybersecurity Risk Self-Assessment Resources.
5-7. Audited Financial Statements for Hetch Hetchy Water and Power, Water, and Wastewater Enterprises | November 12, 2024
Report Links: https://tinyurl.com/3bhxvkmp, https://tinyurl.com/3ta75cy5, https://tinyurl.com/485emjmm
Report Summary: It was the independent opinion of third-party auditor Macias Gini & O'Connell LLP that the financial statements for each of the enterprises were accurate and free from material misstatements, and additionally reported no deficiencies in internal control over financial reporting.
8. Chapter 6 Delegated Authority Audit | December 20, 2024 Report Link: https://tinyurl.com/2wsk6ycv
Report Summary: The scope of this performance audit conducted by the Board of Supervisors’ Budget and Legislative Analyst’s Office includes the procurement of public works contracts pursuant to Chapter 6 of the City’s Administrative Code by the San Francisco Public Utilities Commission (SFPUC) during Fiscal Year (FY) 2019-20, FY 2020-21, and FY 2021-22. This report is the first of a multi-part performance audit of various City departments’ delegated authority for procurement of public works contracts.
Audit Findings Summary: The report included 14 recommendations relevant to SFPUC, relating mostly to suggested improvements in policy and procedure documentation and training standardization.
9. Annual Comprehensive Financial Report, FY 2022-23 | December 20, 2024
Report Link: https://tinyurl.com/5f9vfm8f
Report Summary: The Annual Comprehensive Financial Report holistically details the financial activities, condition, and services for Water, Wastewater, and Hetch Hetchy Water & Power & CleanPowerSF.
It also provides financial and statistical data, inclusive of 10 years of financial and operating metrics, with social and economic data.
It was the independent opinion of third-party auditor Macias Gini & O'Connell LLP that the financial statement within the report was accurate and free from material misstatements, and additionally reported no deficiencies in internal control over financial reporting.
10. Popular Annual Financial Report, FY 2023-24 | December 20, 2024 Report Link: https://tinyurl.com/yas5m5ea
Report Summary: The Popular Annual Financial Report (PAFR) is a high-level summary of information from the Annual Financial Report specifically designed to be readily accessible and easily understandable to the general public and other interested parties. This year’s PAFR highlights rebuilding water and wastewater infrastructure; advancing green power and environmental initiatives; and delivering clean, efficient services.
II. Audit Recommendation Status
As of 12/31/24, 3 audit recommendations were open for the Procurements Public Integrity Assessment and 14 were open for the Chapter 6 Delegated Authority Audit.
If you have questions, please contact me at [email protected] or Irella Blackwood, Audit Director, at [email protected].
cc: Irella Blackwood, Audit Director
att: FY 2024-25 QAPR Audit Plan, By Status
# Quarter Status Audit Type Enterprise /
Bureau Audit Name Oversight
Body
1-5
Completed Financial Water
A
nnual Physical Inventory Count, FY 2023-24 SFPUC,
Finance
Completed Financial Wastewater
Completed Financial Hetch Hetchy
W
ater & Power
6 Completed Financial Business Services,
Finance Post Audit, CY 2023 Controller
7 [Updated]
Financial Business Services,
F
inance
Wholesale Revenue Requirement: Statement of Changes
in Balancing Account, FY 2022-23 BAWSCA
Completed
8 [Updated]
Financial Power F ranchise Fee Audit: Energy Center SF LLC Controller
Completed
9 [Updated]
Financial Power F ranchise Fee Audit: Pacific Gas & Electric Company Controller
Completed
10 [Updated] Financial Water
A
udited Financial Statements, FY 2023-24 Controller
Completed
11 [Updated]
Financial Wastewater
Completed
12 [Updated]
Financial
Hetch Hetchy
W
ater & Power
& CleanPowerSF
Completed
13 [Updated]
Financial Business Services,
F
inance Annual Comprehensive Financial Report, FY 2023-24 SFPUC
Completed
14 [Updated]
Financial Business Services,
F
inance Popular Annual Financial Report, FY 2023-24 SFPUC
Completed
15 In Progress Financial Business Services,
F
inance Single Audit, FY 2023-24 OMB
16 Upcoming Financial Business Services,
F
inance Post Audit, CY 2024 Controller
17 Upcoming Financial Business Services,
F
inance
Wholesale Revenue Requirement: Statement of Changes
in Balancing Account, FY 2023-24 BAWSCA
18 Upcoming Financial Water
I
nterim Financial Statements, FY 2024-25 Controller
19 Upcoming Financial Wastewater
20 Upcoming Financial
Hetch Hetchy
W
ater & Power
& CleanPowerSF
Quarterly Audit & Performance Review Report
FY 2024-25 Audit Plan, By Status
As of December 31, 2024
Status
Completed: 17
In Progress: 7
Upcoming: 12
Total: 36
# Quarter Status Audit Type Enterprise /
Bureau Audit Name Oversight
Body
21-
25 [Updated] Financial Water
Annual Physical Inventory Count, FY 2024-25 SFPUC,
Finance
Upcoming
[Updated] Financial Wastewater Upcoming
[Updated] Financial Hetch Hetchy Water
& Power Upcoming
26 Completed Performance Hetch Hetchy Water
& Power Cybersecurity Maturity Assessment, FY 2023-24 SFPUC
27 [Updated]
Performance All SFPUC SFPUC Chapter 6 Delegated Authority Audit BOS
Completed
28 [Updated]
Performance Hetch Hetchy Water
& Power EPA Cybersecurity Guidelines Self-Assessment SFPUC
Completed
29 [Updated]
Performance Human Resources
Services Citywide Payroll Audit CSA,
Controller
In Progress
30 [Updated]
Performance Human Resources
Services Public Integrity Assessment: Status of City Contracts CSA, Controller
In Progress
31 In Progress Performance All SFPUC BLA Conflicts of Interest Audit BOS
32 In Progress Performance All SFPUC BLA Work Orders Audit BOS
33 Upcoming Performance Customer Services
Bureau Customer Assistance Program Post-Enrollment Verification SFPUC
34 Upcoming Performance CleanPowerSF CleanPowerSF Independent Privacy Audit SFPUC
35 In Progress
Concessions,
Real Estate Services Revenue Lease Audit: Mission Valley Rock CSA, Controller
Lease Revenue
36 In Progress
Revenue Bond
RBOC SFPUC Revenue Bond Programs Audit: Phase III RBOC
Oversight
Committee