Quarterly Audit and Performance
Review Report
FY 2025-26, Q1
December 9, 2025
Nancy L. Hom
Chief Financial Officer and AGM, Business Services
1 FY 2025-26 Audit Plan Status
Audits and Assessments to Date
Status Count
Completed 7
In Progress 13
Upcoming 5
Total 25
2 Completed In Progress Upcoming
Audits Completed and Reports Issued
Audit / Assessment Oversight Body Report Date
CY 2024 Post Audit Controller’s Office 8/20/2025
FY 2024-25 Warehouse Inventory Counts
(5 reports) SFPUC 8/29/2025
FY 2024-25 Cybersecurity Maturity
Assessment
Controller’s Office,
City Services
Auditor
10/1/2025
3 4
Spotlight: Annual Warehouse Inventory Counts
Background
As required by the Controller, SFPUC performs a full (100%) physical inventory count of all agency inventory warehouses each fiscal year end. Contracted audit firm (Crowe, LLP).
Objectives
• Validate inventory system data matches the physical counts at various facilities • Assess the effectiveness of the policies, procedures, and practices regarding inventory warehouse management.
Scope (8 warehouses)
• Water Enterprise (5): SF Water Division, Auxiliary Water Supply System, Lake Merced Pump Station, Water Supply & Treatment, and Moccasin (upcountry) • Wastewater Enterprise (1): Southeast
• Power Enterprise (2): In-City and Treasure Island
5 Spotlight: Annual Warehouse Inventory Counts (Cont.)
Observations and Findings
Variances were observed between the physical count and the amounts reported in the inventory system (Maximo), attributed mainly to:
• Data: Miscounts, data entry errors, untimely updates to Maximo • Operations: Discontinued/obsolete items, infrequent cycle counts, documentation • Issues with the automated fuel tracking system (EJ Ward) ‒ System not capturing all fuel transactions, inaccurate tank gauge measurements, interface issues and challenges between EJ Ward and Maximo No variance for Wastewater Enterprise Inventory Warehouse Management Management’s Response
Management generally concurred with the auditor’s recommendations and will continue to further improve internal controls over warehouse inventory management and operations.
Spotlight: Annual Warehouse Inventory Counts (Cont.)
6 Inventory variances improved over time
Tracking Summary: Audit Recommendations
7 # Audit Title
Report
Issued
Date
Open
Rec
Total
Rec
Months
Open
%
Complete
Close
Date
(or Target)
Public Integrity Assessment: Procurement
1 Criminal Conduct by Former San Francisco Public
Utilities Commission General Manager Harlan Kelly
Undermined the Integrity of City Procurements Despite
Existing Rules Governing Gifts, Disclosures, and Sole
Source Waivers
3/27/2024 2 2 18 0% 11/31/2025
Chapter 6 Delegated Authority Audit
2 Performance Audit of the Authority Delegated to the San Francisco Public Utilities Commission for Public Works
Contracts Under Chapter 6 of the Administrative Code
12/20/2024 14 14 9 0% 1/1/2026
Total 16 16 0%
8 FY 2025-26, Q2 Outlook
Completing
• Mission Valley Rock Revenue Lease Audit
• Revenue Bond Audit Phase 3
• 14B LBE Compliance Audit
• FY 2024-25 Single Audit
• Citywide Payroll Audit
• COVID-19 Emergency Procurement Audit
• FY 2024-25 Construction Close-Out Audit: Sunol Long Term Improvements - Corporation Yard
• Network Penetration and Vulnerability Assessment
9 FY 2025-26, Q2 Outlook (Cont.)
Upcoming
• FY 2024-25 Audited Financial Statements
• FY 2024-25 Annual Comprehensive Financial Report
• FY 2024-25 Popular Annual Financial Report
THANK YOU
Feedback & Questions?
10 OUR MISSION: To provide our customers with high-quality, efficient and reliable water, power and sewer services in a manner that values environmental and community interests and sustains the resources entrusted to our care.
BUSINESS SERVICES BUREAU
525 Golden Gate Avenue, 13th Floor
San Francisco, CA 94102
T 415.934.5707
F 415.554.1877
Date: December 9, 2025
To: Commissioner Joshua Arce, President
Commissioner Stephen E. Leveroni, Vice President
Commissioner Avni Jamdar
Commissioner Kate H. Stacy
Commissioner Meghan Thurlow
Through: Dennis J. Herrera, General Manager
From: Nancy L. Hom, Chief Financial Officer and Assistant General Manager, Business Services
Subject: FY 2025-26 Q1 Audit and Performance Review Report This memorandum summarizes the San Francisco Public Utilities Commission (SFPUC) Quarterly Audit and Performance Review (QAPR) report for the first quarter of FY 2025-26, ending September 30, 2025.
I. Completed Audits
There are seven completed audits to report since the last QAPR:
1. CY 2024 Post Audit | August 20, 2025
Report Link: https://tinyurl.com/mw5z9er6
Report Summary: The Controller’s Office performs the Post Audit to examine the effectiveness of the design and implementation of each department’s accounting and internal control practices and compliance with City laws, regulations, and policies.
Audit Findings Summary: The Post Audit highlighted SFPUC’s strengths in collaborating with the Controller’s Office, management of increased transactions, and effective internal controls around manual carryforwards. Areas for improvement were identified in the processing of purchases, payables, and vouchers; expense reimbursement; and timely journal entries. In response to the audit, SFPUC staff will continue to evaluate opportunities to promote and improve compliance with particular focus on areas highlighted in the findings.
2-6. FY 2024-25 W
arehouse Inventory Counts | August 29, 2025
Report Link: https://tinyurl.com/kcwtkst7
Report Summary: The SFPUC engaged third-party auditor Crowe, LLP (Crowe) to perform FY 2024-25 physical inventory counts at locations in Millbrae, Sunol Yard, Power In-City and Treasure Island, Moccasin, Wastewater Southeast, San Francisco Water Division (CDD), and Auxiliary Water Supply System (AWSS).
Findings Summary: The audits found variances between the physical count and the amounts reported in the inventory system (Maximo). The observed variances were attributed primarily to:
• Issues with the automated fuel tracking system
• Miscounts, double counts, or other errors in data entry • Inventory updates not posted to Maximo in a timely fashion
Management concurred with the recommendations and provided additional detail regarding mitigating actions.
7. FY 2024-25 Cybersecurity Maturity Assessment | October 1, 2024 Report is confidential.
Report Summary: The City Services Auditor (CSA) assessed SFPUC’s cybersecurity maturity level based on the National Institute of Standards and Technology (NIST) cybersecurity framework. The assessment is mandated by the Committee on Information Technology (COIT) cybersecurity policy.
Audit Findings Summary: SFPUC scored a “3.4” out of a possible “4.0” where a higher score indicates higher maturity. SFPUC continues to improve its cybersecurity program and bolster its cyber infrastructure.
II. Audit Recommendation Status
As of 9/30/25, 2 audit recommendations were open for the Procurements Public Integrity Assessment and 14 were open for the Chapter 6 Delegated Authority Audit.
If you have questions, please contact me at [email protected] or Christopher
Crane, Acting Audit Director, at [email protected].
cc: Christopher Crane, Acting Audit Director
att: FY 2025-26 QAPR Audit Plan as of Q1, By Status
# Quarter
Status Audit Type Enterprise /
Bureau Audit Name Oversight
Body
1-5
[Updated] Financial Water
Annual Physical Inventory Count, FY 2024-25 SFPUC,
Finance
Completed
[Updated] Financial Wastewater
Completed
[Updated] Financial Hetch Hetchy
Water & Power
Completed
6 [Updated] Financial Business Services,
Finance Post Audit, CY 2024 Controller
Completed
7 [Updated]
Financial Business Services,
Finance TIDA Costs Reconciliation SFPUC
In Progress
8 [Updated] Financial Water
Audited Financial Statements, FY 2024-25 Controller
In Progress
9 [Updated]
Financial Wastewater
In Progress
10 [Updated]
Financial
Hetch Hetchy
Water & Power
& CleanPowerSF
In Progress
11 [Updated]
Financial Business Services,
Finance Annual Comprehensive Financial Report, FY 2024-25 SFPUC
Upcoming
12 [Updated]
Financial Business Services,
Finance Popular Annual Financial Report, FY 2024-25 SFPUC
Upcoming
13 [Updated]
Financial Business Services,
Finance
Wholesale Revenue Requirement: Statement of Changes in
Balancing Account, FY 2024-25 BAWSCA
Upcoming
14 [Updated] Financial Business Services,
Finance Single Audit, FY 2024-25 Controller
Upcoming
15 [Updated]
Performance Hetch Hetchy
Water & Power Cybersecurity Maturity Assessment, FY 2024-25 SFPUC
Completed
16 In Progress Performance Human Resources
Services Citywide Payroll Audit CSA,
Controller
17 In Progress Performance Human Resources
Services COVID-19 Emergency Procurement Audit CSA,
Controller
18 In Progress Performance Infrastructure FY 2024-25 Construction Close-Out Audit: Sunol Long Term Improvements - Corporation Yard
CSA,
Controller
19 In Progress Performance Customer Services
Bureau Customer Assistance Program Post-Enrollment Verification SFPUC
20 In Progress Performance Hetch Hetchy
Water & Power
Critical Infrastructure Protection and Operations and
Planning Reliability Standards Audit
WECC /
NERC
Quarterly Audit & Performance Review Report
FY 2025-26 Audit Plan, By Status
As of September 30, 2025
Status
Completed: 7
In Progress: 13
Upcoming: 5
Total: 25
# Quarter
Status Audit Type Enterprise /
Bureau Audit Name Oversight
Body
21 [Updated]
Performance
Contracts
Administration
Bureau
14B LBE Compliance Audit CSA,
Controller
In Progress
22 [Updated]
Performance All SFPUC Network Penetration and Vulnerability Assessment SFPUC
In Progress
23 [Updated]
Performance All SFPUC Digital Accessibility and Inclusion Standard Assessment CSA, Controller
Upcoming
24 In Progress
Concessions, Real Estate
Services Revenue Lease Audit: Mission Valley Rock CSA,
Controller
Lease Revenue
25 In Progress
Revenue Bond Business Services,
Finance SFPUC Revenue Bond Programs Audit: Phase III CSA, Controller
Oversight