Quarterly Audit and Performance Review Report
FY2025-26, Q4
09/08/26
Irella Blackwood
Audit Director
1 FY 2025-26 Audit Plan Status
Audits and Assessments to Date
Completed In Progress Upcoming
Status Count
Completed 20
In Progress 12
Upcoming 5
Total 35
2 5
1 1
13 4
8 2
3 Tracking Summary: Audit Recommendations
3 # Audit Title
Report
Issued
Date
Open Total
Rec
Months
Open % Complete Close Date
(or Target)
Public Integrity Assessment: Procurement
1 Criminal Conduct by Former San Francisco
Public Utilities Commission General Manager Harlan
Kelly Undermined the Integrity of City Procurements
Despite Existing Rules Governing Gifts, Disclosures,
and Sole Source Waivers
3/27/2024 2 2 27 0% 8/5/2026
Mission Valley Rock Revenue Lease Audit
2 Mission Valley Rock Co., LLC, Generally Complied
With Financial Contract Provisions but Underpaid at
Least $18,628 in Rent for Fiscal Years 2021-22
Through 2023-24, and SFPUC Needs to Bolster Its
Financial Practices
12/18/2025 4 8 6 50% 9/30/2026
Total 6 10 40%
Spotlight: Wholesale Revenue Requirement and the Section
7.06 Process
4 Background:
The SFPUC Wholesale Revenue Requirement (WRR), as laid out in the 25-year Water Supply Agreement (WSA) between SFPUC and the Wholesale Water Customers, is the total amount SFPUC calculates each year to cover the operating and capital costs of delivering regional water to suburban wholesale customers.
Audited WRR
The WRR is prepared annually and audited in accordance with the terms of the WSA. It details the Wholesale share of expenditures, Wholesale revenues, and resulting changes to the Balancing Account between the parties.
WSA Section 7.06
Section 7.06 outlines the process for the Wholesale Customers' review, the Balancing Account, and dispute resolution regarding the annual WRR.
Spotlight: Wholesale Revenue Requirement and the Section
7.06 Process (Cont.)
5 The Section 7.06 Process: Bay Area Water Supply and Conservation Agency (BAWSCA) typically engages an independent certified public accountant (CPA) to conduct a review of San Francisco’s calculation of the annual Wholesale Revenue Requirement and a review of changes in the balancing account.
Purpose: Further verification that costs and revenue are properly allocated and that wholesale customers pay only their contractual share of regional water system costs under Water Supply Agreement
Significance: Provides assurance that wholesale customers only pay their appropriate share of regional water costs, and encourages transparency and trust between SFPUC and partners Beginning with the FY 2024-25 WRR, the SFPUC Audit Bureau has assumed responsibility for evaluating and providing responses to BAWSCA’s questions and any disputed allocations arising from this additional review.
FY 2026-27, Q1 Outlook
Completing
• FY 2025-26 Annual Physical Inventory Count (Water, Wastewater, Hetch Hetchy Water & Power)
• FY 2025-26 Interim Financial Statements (Water, Wastewater, Hetch Hetchy Water & Power, and CleanPowerSF)
• FY 2024-25 Cybersecurity Maturity Assessment
• Calendar Year 2025 Post Audit
6 FY 2025-26, Q1 Outlook (Cont.)
Upcoming
• FY 2026-27 Digital Accessibility and Inclusion Standard Assessment • FY 2026-27 City-Wide Prop Q Audit
7 THANK YOU
Feedback & Questions?
8 Business Services
525 Golden Gate Ave.
San Francisco, CA 94102
(415) 554-3155
sfpuc.gov
Date: September 8, 2026
To: Commissioner Joshua Arce, President
Commissioner Stephen E. Leveroni, Vice President
Commissioner Avni Jamdar
Commissioner Kate H. Stacy
Commissioner Meghan Thurlow
Through: Dennis J. Herrera, General Manager
From: Nancy L. Hom, Chief Financial Officer and Assistant General Manager, Business Services
Subject: FY 2025-26 Q4 Audit and Performance Review Report This memorandum summarizes the San Francisco Public Utilities Commission (SFPUC) Quarterly Audit and Performance Review (QAPR) report for the fourth quarter of FY 2025-26, ending June 30, 2026.
I. Completed Audits
There are three completed audits to report since the last QAPR:
1. Interconnection Security Agreement - San Francisco Public Utilities Commission | May 29, 2026
Report is confidential.
Summary: The Interconnection Security Agreement is an annual process whereby the Office of the Controller verifies that appropriate SFPUC information security controls exist to protect the confidentiality, integrity, and availability of Controller-operated enterprise-level systems and associated data.
Results: Security controls were found to be sufficient, and interconnection was authorized.
2 2. Fiscal Year 24-25 Wholesale Revenue Requirement: Statement of Changes in Balancing Account | May 13, 2026
Read the report: https://tinyurl.com/37xazudb
Report Summary: Third-party auditor Macias Gini & O’Connell LLP (MGO) performed the annual audit, as required by the Water Supply Agreement with Wholesale Water Customers, to review the allocation of operating and capital costs among retail and wholesale water customers.
Audit Findings Summary: In the auditors’ opinion, the
Statement of Changes in the Balancing Account presents fairly, in all material aspects, the changes in the Balancing Account for fiscal year 2024-25.
No deficiencies were noted with respect to internal controls over financial reporting.
3. Network Penetration and Vulnerability Assessment
Report is confidential.
Summary: The SFPUC partnered with the Controller's Office's City Services Auditor and NetSPI LLC to perform a network penetration test and vulnerability assessment of operational technology systems.
II. Audit Recommendation Status
As of 6/30/26, 2 audit recommendations were open for the Procurements Public Integrity Assessment, and 4 for the Mission Valley Rock Revenue Lease Audit.
If you have questions, please contact me at [email protected] or Irella Blackwood at [email protected].
cc: Irella Blackwood, Audit Director
att: FY 2025-26 QAPR Audit Plan as of Q4, By Status
3 # Quarter
Status Audit Type Enterprise / Bureau Audit Name Oversight Body
1-5
Completed Financial Water
Annual Physical Inventory Count, FY 2024-25 SFPUC,
Finance
Completed Financial Wastewater
Completed Financial Hetch Hetchy Water
& Power
6 Completed Financial Business Services,
Finance Post Audit, CY 2024 Controller
7 Completed Financial Water
Audited Financial Statements, FY 2024-25 Controller
8 Completed Financial Wastewater
9 Completed Financial
Hetch Hetchy Water
& Power
& CleanPowerSF
10 Completed Financial Business Services,
Finance Annual Comprehensive Financial Report, FY 2024-25 SFPUC
11 Completed Financial Business Services,
Finance Popular Annual Financial Report, FY 2024-25 SFPUC
12 [Updated] Financial Business Services,
Finance Single Audit, FY 2024-25 Controller
Completed
13 [Updated]
Financial Business Services,
Finance
Wholesale Revenue Requirement: Statement of Changes
in Balancing Account, FY 2024-25 BAWSCA
Completed
14 [Updated]
Financial Power Franchise Fee Audit: Energy Center SF LLC Controller
In Progress
15 [Updated]
Financial Power Franchise Fee Audit: Pacific Gas & Electric Company Controller
In Progress
16 [Updated] Financial Business Services,
Finance Post Audit, CY 2025 Controller
In Progress
17-21
[Updated] Financial Water
Annual Physical Inventory Count, FY 2025-26 SFPUC,
Finance
In Progress
[Updated] Financial Wastewater
In Progress
[Updated] Financial Hetch Hetchy Water
& Power
In Progress
Quarterly Audit & Performance Review Report
FY 2025-26 Audit Plan, By Status
As of June 30, 2026
Status
Completed: 20
In Progress: 12
Upcoming: 5
Total: 37
4 # Quarter
Status Audit Type Enterprise / Bureau Audit Name Oversight Body
22 [Updated] Financial Water
Interim Financial Statements, FY 2025-26 Controller
Upcoming
23 [Updated]
Financial Wastewater
Upcoming
24 [Updated]
Financial
Hetch Hetchy Water
& Power
& CleanPowerSF
Upcoming
25 Completed Performance Hetch Hetchy Water
& Power Cybersecurity Maturity Assessment, FY 2024-25 SFPUC
26 Completed Performance
Contracts
Administration
Bureau
14B LBE Compliance Audit CSA,
Controller
27 Completed Performance Hetch Hetchy Water
& Power
Critical Infrastructure Protection and Operations and
Planning Reliability Standards Audit
WECC /
NERC
28 [Updated]
Performance Business Services,
ITS Interconnection Security Agreement, FY 2025-26 CSA, Controller
Completed
29 [Updated]
Performance All SFPUC Network Penetration and Vulnerability Assessment SFPUC
Completed
30 In Progress Performance Human Resources
Services Citywide Payroll Audit CSA,
Controller
31 In Progress Performance Infrastructure FY 2024-25 Construction Close-Out Audit: Sunol Long Term Improvements - Corporation Yard
CSA,
Controller
32 In Progress Performance Customer Services
Bureau Customer Assistance Program Post-Enrollment Verification SFPUC
33 [Updated]
Performance Hetch Hetchy Water
& Power Cybersecurity Maturity Assessment, FY 2025-26 SFPUC
In Progress
34 Upcoming Performance All SFPUC Digital Accessibility and Inclusion Standard Assessment CSA, Controller
35 [Updated]
Performance All SFPUC City-Wide Prop Q Audit CSA,
Controller
Upcoming
36 Completed
Concessions,
Real Estate Services Revenue Lease Audit: Mission Valley Rock CSA, Controller
Lease
Revenue
37 Completed
Capital Business Services,
Finance SFPUC Revenue Bond Programs Audit: Phase III CSA, Controller
Project