This report is intended for the internal use of the City of Cupertino , and may not be provided to, used, or relied upon by any third parties.
FINAL REPORT
City of Cupertino
ENTERPRISE RISK ASSESSMENT
December 10, 2020
Moss Adams LLP
999 Third Avenue, Suite 2800
Seattle, WA 98104
(206) 302-6500
Enterprise Risk Assessment Report
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Table of Contents
Executive Summary 1
A. Project Scope 1
B. Risk Assessment Framework 1
C. Risk Assessment Results 2
Introduction 3
A. Project Scope 3
B. Methodology 3
Risk Assessment Framework 4
C. Entity Overview 6
City Government 7
Community Characteristics 8
D. Risk Assessment Employee Survey Results 8
Risk Assessment Results 10
A. High Risk Categories 10
Procurement and Contracting 10
B. Moderate-to-High Risk Categories 13
Governance 13
External Environment 16
Human Capital and Resources 21
Information Technology 26
Planning and Strategy 30
Policies and Procedures 32
C. Moderate Risk Categories 34
Capital Improvement Program 34
Compliance and Financial Reporting 36
Ethics and Fraud, Waste, Abuse 39
Funding and Economics 42
Table of Contents – Continued
Enterprise Risk Assessment Report
FOR INTERNAL USE OF THE CITY OF CUPERTINO ONLY
Internal Controls 44
Operations and Service Delivery 46
Organization and Staffing 48
Risk Programs 50
D. Low-to-Moderate Risk Categories 53
Accounting and Finance 53
Asset Management 55
Management and Leadership 57
Public Safety and Security 59
Reputation and Public Perception 61
Employee Survey Results 63
A. Survey Respondent Profile 63
B. Risk Category Ratings 64
Enterprise Risk Assessment Report | 1
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
EXECUTIVE SUMMARY
This enterprise risk assessment provides a way for the leadership of the City of Cupertino (the City) to measure uncertainty related to the City’s ability to achieve defined strategic objectives and operate effectively. Risks are identified, analyzed, and measured by the level of inherent vulnerability, the level of preparedness to mitigate them, and the impact such negative events could have on Cupertino should they occur.
For each of the risk categories assessed, our risk assessment includes an overview of the risk condition at the City of Cupertino, including the current risk level, likelihood, impact, preparedness, and trajectory. Risk mitigation identifies potential strategies to reduce overall risk for each category.
The residual risk level represents the probable risk exposure after risk mitigation efforts are implemented. The elements below make up the risk assessment framework, which are industry standards and guided by the Committee of Sponsoring Organizations of the Treadway Commission’s (COSO) Enterprise Risk Management (ERM) methodology.
RISK LEVEL Level of uncertainty that could impair functions and processes, in the absence of any actions taken to alter either the risk’s likelihood or impact.
LIKELIHOOD Qualitative assessment of the probability of a negative event occurring, given the current risk conditions.
IMPACT Level of potential impact of a negative event on strategy, people, operations, systems, and resources.
PREPAREDNESS Level of preparedness through activities and resources to manage risks and minimize and limit potential losses.
TRAJECTORY Trajectory of the risk level, given the current risk conditions.
RISK MITIGATION Potential strategies for reducing risk.
RESIDUAL RISK Possible remaining exposure after known risks have been mitigated through specific actions.
Enterprise Risk Assessment Report | 2
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
The risk assessment evaluates the organization’s risks across the following categories, organized alphabetically for each risk level. The table below presents the summary results of the assessment.
RISK CATEGORY IMPACT LIKELIHOOD PREPAREDNESS TRAJECTORY High Risk
Procurement and
Contracting High Moderate-to-High Low-to-Moderate Increasing Moderate -to-High Risk
Governance Moderate-to-High Moderate-to-High Low-to-Moderate Flat External Environment High Moderate-to-High Moderate Increasing Human Capital and
Resources Moderate-to-High Moderate-to-High Moderate Increasing Information Technology Moderate-to-High Moderate Moderate-to-High Increasing Planning and Strategy Moderate-to-High Moderate-to-High Low-to-Moderate Flat Policies and Procedures Moderate-to-High Moderate-to-High Moderate Flat Moderate Risk
Capital Improvement
Program Moderate-to-High Moderate Low-to-Moderate Flat
Compliance and Financial
Reporting Moderate Low-to-Moderate Moderate Increasing
Ethics and Fraud, Waste,
Abuse Moderate-to-High Low-to-Moderate Low-to-Moderate Flat Internal Controls Moderate Moderate Moderate Flat
Operations and Service
Delivery Moderate Moderate Moderate Flat
Organization and Staffing Moderate Moderate-to-High Moderate Flat Risk Programs Moderate Low-to-Moderate Low-to-Moderate Flat Low -to-Moderate Risk
Accounting and Finance Moderate Low-to-Moderate Moderate Decreasing Asset Management Moderate Moderate Moderate-to-High Decreasing Management and
Leadership Moderate Low-to-Moderate Moderate-to-High Decreasing Public Safety and Security Moderate Low-to-Moderate Moderate-to-High Increasing Reputation and Public
Perception Moderate Moderate Moderate-to-High Flat
Enterprise Risk Assessment Report | 3
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
INTRODUCTION
The City of Cupertino (the City) engaged Moss Adams to conduct an independent enterprise risk assessment to analyze the City’s overarching areas of risk. In order to assess the overall risk level of the City and its comprehensive risk categories, the enterprise risk assessment process followed conventional Enterprise Risk Management (ERM) methodology as defined by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and embraced by the Institute of Internal Auditors (IIA). This assessment was conducted under the oversight of the Audit Committee.
The Moss Adams team evaluated 20 categories of risk, and business processes within each category, that collectively comprise operations across the organization. Risk assessments include identifying the current levels of risk, likelihood of occurrence of a negative event, the impact of a negative event, and the level of preparedness in terms of mitigating negative events. Using this information, the City can identify the most important areas of risk and prioritize management of these risks. All City departments were included in the risk assessment process. This assessment includes information provided by City Council members, Audit Committee members, senior leadership, managers, supervisors, and staff.
The enterprise risk assessment process reflects a specific point in time: September 2020 to December 2020. Both the overall risk ratings and trajectory levels are directly connected to this timing.
The enterprise risk assessment process consists of four phases: 1) planning, 2) fact finding, 3) analysis, and 4) reporting. Planning included requesting documents and identifying which individuals to interview and include in the survey process. Fact finding encompassed document review, analysis of existing data, interviews, and an online survey sent to City employees. Analysis included assessment of the level of uncertainty associated with each risk factor. Reporting entailed the development of draft and final deliverables, as well as follow-up discussions with management and presentation to key stakeholders.
The activities and goals for each phase are described in detail below.
PLANNING
We began planning our assessment by requesting a standard set of documents from the City, including (but not limited to) prior risk assessments, audits, public website documents, and financial reports. We used these documents to identify the first round of individuals to interview and additional document needs based on business process/functional areas.
Enterprise Risk Assessment Report | 4
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
FACT -FINDING
Fact finding encompassed analyzing received documents, interviewing employees and City Council members, and soliciting additional employee feedback via an online survey. During this phase, we gathered information in order to gain a clear understanding of the City and the way it operates to achieve its goals and purpose.
ANALYSIS
With the information collected and compiled, we performed a risk assessment that included a comprehensive review and analysis of the various categories of risks. This analysis included assessing current risk conditions and trajectory, the level of preparedness efforts to mitigate risks, and the probability and potential impact a negative event may have on the City’s ability to achieve its mission, vision, and strategic goals.
REPORTING
During this phase, we developed a draft report to engage in review and discussion with senior leadership. Based on feedback, we finalized the report for delivery to the City Manager and presentation to the Audit Committee.
The enterprise risk assessment process relies heavily on evidence obtained from City employees. By design, the assessment process requires access to all senior leadership and many department and division managers. Full disclosure of information has been assumed in this process.
The process to identify and assess risks considers both internal and external factors. As part of this risk assessment, Moss Adams used a variety of techniques, both qualitative and quantitative, to identify external and internal factors that contribute to risk. Risk assessments involve a dynamic and iterative process to identify and analyze risks to the City’s ability to achieve its objectives, forming a basis for determining how risks should be managed.
For each of the risk categories assessed, our risk assessment includes an overview of the risk condition at the City, including the current risk level, likelihood, impact, preparedness, and trajectory.
In addition, risk mitigation identifies potential strategies to reduce overall risk for each category, and residual risk represents the probable risk exposure after risk mitigation efforts have been implemented. The elements provided below make up the risk assessment framework, which are industry standard and defined by COSO’s ERM methodology.
RISK LEVEL
Level of uncertainty that could impair functions and
processes, in the absence of any actions taken to alter either the risk’s likelihood or impact.
● Low
● Low-to-Moderate
● Moderate
● Moderate-to-High
● High
Enterprise Risk Assessment Report | 5
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
LIKELIHOOD
Qualitative assessment of the probability of a negative event occurring, given the current risk conditions.
● Low
● Low-to-Moderate
● Moderate
● Moderate-to-High
● High
IMPACT
Level of potential impact of a negative event on
strategy, people, operations, systems, and resources.
● Low
● Low-to-Moderate
● Moderate
● Moderate-to-High
● High
PREPAREDNESS
Level of preparedness through activities and resources
to manage risks and minimize and limit potential
losses.
● Low
● Low-to-Moderate
● Moderate
● Moderate-to-High
● High
TRAJECTORY
Trajectory of the risk level, given the current risk
conditions.
● Decreasing
● Flat
● Increasing
RISK MITIGATION
Potential strategies for reducing risk.
RESIDUAL RISK
Possible remaining exposure after known risks have
been mitigated through specific actions.
● Low
● Low-to-Moderate
● Moderate
● Moderate-to-High
● High
The levels and corresponding color coding for each risk condition, including impact, likelihood, preparedness, and trajectory, are represented in the table below.
Impact
Likelihood
Preparedness
Trajectory
High High Low Increasing
Moderate-to-High Moderate-to-High Low-to-Moderate Flat
Moderate Moderate Moderate Decreasing
Low-to-Moderate Low-to-Moderate Moderate-to-High
Low Low High
Enterprise Risk Assessment Report | 6
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Cupertino is a U.S. city of 11.31 square miles in Santa Clara County, California, directly west of San Jose on the western edge of the Santa Clara Valley with portions extending into the foothills of the Santa Cruz Mountains. Cupertino is bordered to the north by Sunnyvale, to the east by Santa Clara and San Jose, to the south by San Jose and Saratoga, and to the west by unincorporated Santa Clara County.
Enterprise Risk Assessment Report | 7
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
The City of Cupertino operates as a general law city with a City Council-City Manager form of government. Five council members serve four- year, overlapping terms, with elections held every two years. The Council meets twice a month, and once a month during the summer, and is assisted by several citizen advisory commissions and the Audit Committee.
TABLE 1: CITY ORGANIZATIONAL CHART
Enterprise Risk Assessment Report | 8
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
The City outsources multiple functions, including City Attorney, Fire, Police, Sewer, and Water. For example, the San Jose Water Company and California Water Service deliver water utilities to the City, while Pacific Gas and Electric (PG&E) provides gas and electric utilities. Additionally, sewer service is provided by the Cupertino Sanitary District.
Over the past three years, City population, income, unemployment rate, and median age (41) have remained stable. Per capita income has risen slightly up to $63,817 in 2018-19, with unemployment dropping to an all-time low of 2.3%. However, this data does not reflect recent impacts on employment and income as a result of the COVID-19 pandemic. The City’s population is highly educated, with 97.1% of residents over age 25 having a high school degree and 77.2% having a bachelor’s degree.
We administered a risk assessment survey to provide City staff the opportunity to identify perceived strengths and weaknesses of the City, which helped us assess potential opportunities for improvement and identify areas of specific vulnerability. The survey addressed a variety of topics and included rating scale questions and open-ended questions for each risk category. The confidential questionnaire was distributed to employees and was open for submission between September 23rd and October 1, 2020, via the research platform Qualtrics. Out of the 245 employees invited to take the survey, 112 individuals submitted responses to the survey, a strong participation rate of 45.7%.
In general, staff survey responses are lower than the risk assessment results, which may be partially attributable to the use of averages in the analysis of employee survey results.
RISK CATEGORY RISK ASSESSMENT
EMPLOYEE SURVEY
RESULTS
Procurement and Contracting High Low-to-Moderate
Governance Moderate-to-High Moderate
External Environment Moderate-to-High Moderate
Human Capital and Resources Moderate-to-High Moderate
Information Technology Moderate-to-High Low-to-Moderate Planning and Strategy Moderate-to-High Moderate
Policies and Procedures Moderate-to-High Moderate
Capital Improvement Program Moderate Low-to-Moderate
Compliance and Financial Reporting Moderate Low-to-Moderate Ethics and Fraud, Waste, Abuse Moderate Low-to-Moderate
Enterprise Risk Assessment Report | 9
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
RISK CATEGORY RISK ASSESSMENT
EMPLOYEE SURVEY
RESULTS
Internal Controls Moderate Low-to-Moderate
Operations and Service Delivery Moderate Moderate
Organization and Staffing Moderate Moderate
Risk Programs Moderate Moderate
Accounting and Finance Low-to-Moderate Low-to-Moderate
Asset Management Low-to-Moderate Low-to-Moderate
Management and Leadership Low-to-Moderate Moderate
Public Safety and Security Low-to-Moderate Low-to-Moderate Reputation and Public Perception Low-to-Moderate Low-to-Moderate
Enterprise Risk Assessment Report | 10
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
RISK ASSESSMENT RESULTS
For each of the risk categories assessed, our risk assessment includes an overview of the risk condition at the City, including the levels for overall risk, impact, likelihood, preparedness, and trajectory of the risk conditions. We identified potential risk mitigation strategies intended to reduce overall risk for each category. The residual risk level represents the probable risk exposure after risk mitigation efforts are implemented.
Overall Risk Level
High
Impact
Likelihood
Preparedness
Trajectory
High Moderate-to-High Low-to-Moderate Increasing
Risk Mitigation
● Update procurement policies and procedures to develop a comprehensive set of citywide guidance for all employees involved in procurement processes.
● Review the purchasing card program structure, including purchasing activity, business needs by roles, and program oversight.
● Assess the City’s contract management processes for opportunities to improve efficiency, streamline communication, and incorporate best practice elements including equity and sustainability factors.
● Create vendor management procedures, including data entry definitions, compliance checklists, templates for service level agreements, periodic review processes, and triggers for removal.
● Review the City’s current procurement structure and evaluate opportunities for potential centralization.
Residual Risk
Moderate
Risk Areas: Risks associated with purchasing processes and contract administration for goods and services, including cost-savings, efficiencies and effectiveness, transparency, adherence to laws and regulations, monitoring costs and vendor payments, supply chain risks, and vendor performance and service delivery.
Scope: Procurement and contracting includes purchasing processes (e.g., purchase requisitions, due diligence, approvals, purchase orders, receiving) and contract administration (e.g., compliance with terms and conditions, payments, change orders) for goods and services.
In any public organization like the City, procurement processes are the means through which critical and strategic services, supplies, and construction are purchased to support essential City functions.
The City’s procurement model is highly decentralized, with departments primarily responsible for
Enterprise Risk Assessment Report | 11
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
conducting and managing purchasing and contracting activity with support from the Finance division and the City Attorney’s Office (CAO). Currently, most departments delegate responsibility for procurement activities to their management analyst. A highly decentralized procurement model requires that central leadership provide strategic direction, clear accountability, and consistent guidance across procurement-related processes. To operate effectively and efficiently, this should include having up-to-date comprehensive policies and procedures, regular training of staff involved in purchasing, and transparency through reporting.
The City’s procurement policy document was last formally updated in 2013; however, the Finance division drafted but did not finalize an updated version in 2018. When asked about policies and procedures needed at the City, multiple staff noted the need for expanding the documentation around the City’s credit card program and procurement practices.
PURCHASING
Much of the purchasing activity within the City is conducted within the purchasing module of the City’s enterprise resource planning (ERP) system, Logos. The City is also a participating member of the California Purchase Card (CAL-Card) Program, in which employees are given credit cards that are the equivalent of a petty cash fund with various dollar limits that can be used for work-related items.
Purchasing cards are intended to help expedite purchasing for urgent repairs and other items needed immediately, but they also come with increased risks. The Finance division currently administers the program and is responsible for ensuring only current employees have active cards. The division introduced additional checks and balances within the last year, but staff reported the program as one that the City should assess and review through the lens of internal controls.
Employees report limited training is available for purchasing-related activities (including CAL-Cards), which currently consists of requiring staff to review the user agreement and the policy. For more technical training on accessing accounts and reporting, the City may be able to leverage the CAL- Cards provider for additional resources. The City does not have clear policy requirements or an accountability mechanism to ensure that individuals in positions with purchasing-related responsibilities attend both initial training and ongoing refresher courses. Therefore, credit card use, including users and approvals of purchases, was noted as being not always clear for staff.
CONTRACTING
The City outsources many services, and staff are responsible for managing multiple types of contracts. The CAO has developed standardized templates that staff can choose from to support contracting activities. The City recently implemented the use of Cobblestone, an electronic contract processing software and document repository that is intended to house all City contracts eventually.
The City’s IT team also developed a Bid Management application for publishing City RFPs and providing capability for vendors to submit bids electronically.
Public procurement processes are complex, and regulation driven. Because the City outsources a variety of functions and activities, both large and small, it is essential that procurement practices adhere to public procurement code, well-defined City policies, and best practices. However, staff report minimal oversight of the contracting process, and limited compliance checks to ensure public procurement regulations are adhered to by staff. Staff have reportedly not initially chosen the correct type of contract for a project, and multiple employees reported a lack of citywide contract
Enterprise Risk Assessment Report | 12
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
management guidance. Employees identified the need for more contract management specific training, as well as a desire for more detailed guidance on the contracting processes.
Q: How would you rate the contracting process?
Additionally, the City’s current procurement policy does not actively incorporate equity and environmental factors into procurement processes, a growing area of best practice in public procurement.
VENDOR MANAGEMENT
An effective risk management strategy for local government entities is to establish a process for assessing and monitoring vendor performance and compliance. The City does not have a formal vendor management program, although some vendor due diligence is conducted during the current contracting process. Without comprehensive guidance to staff on how to manage contracts and vendors, there can be inconsistency between different types of vendors or contracts. Ultimately, this can result in inadequate contract management oversight, resulting in elevated costs for compromised products or services.
Finally, a key element for vendor management is conducting a vendor risk assessment for major vendors. The outcome of a vendor risk assessment should allow the City to rank vendors based on their access to confidential or sensitive information, the criticality of the product/service they provide, and the complexity of the product/service they provide. For top-tier vendors, the City’s procedures should include a request to review the vendor’s disaster recovery and business continuity plans. 8% 38% 36% 18%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 13
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Overall Risk Level
Moderate-to-High
Impact
Likelihood
Preparedness
Trajectory
Moderate-to-High Moderate-to-High Low-to-Moderate Flat
Risk Mitigation
● Establish a three- to five-year strategic plan that identifies major City goals and activities (see Planning and Strategy section).
● Consider clarifying the mission and charter of committees to ensure they are effectively providing support to City operations.
● Provide Council members and Commissioners trainings related to governance roles and responsibilities.
● Revise the Council Policy Manual and Commissioner Policy Manual as necessary to better reflect elected and appointed officials’ respective roles and purview.
Residual Risk
Moderate
Risk Areas: Risks associated with ongoing oversight; ethics and values; control environment; policy management; risk management; accountability; performance management; coordination and communication; and defined roles, responsibilities, and authorities.
Scope: Governance is a process of overseeing an organization’s management of risk and control processes and is ultimately the responsibility of the City Council. Management is responsible for identifying and managing risks.
City residents elect officials to provide community leadership and govern the administration of public services. The City operates under a Council-City Manager form of government, directed by a five- member City Council. Under this form of government, the City Council controls the administrative services of the City through the City Manager in order to balance technical staff input with the collective oversight of elected officials. Under the Council-City Manager form of government, neither the City Council nor individual Council members can direct any subordinates of the City Manager.
Council elections take place every two years, with Council members serving staggered four-year terms. The Council has established a Council policy manual to define bylaws and procedures related to council operations in addition to Council-level policies.
Based on a sample of the last 10 regular City Council meetings, meetings ranged in length from 1 hour and 35 minutes to 9 hours and 40 minutes with an average length of 5 hours and 28 minutes.
Three meetings ended after 12 a.m. including one that ended at 4:25 a.m. Extended meetings impact the workloads of City staff, who attend meetings in addition to regular duties, and elected officials, who may also be employed in other capacities. The current Council has conveyed an intent to reduce the length of Council meetings.
Enterprise Risk Assessment Report | 14
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Meeting Date Duration Meeting Date Duration
9/15/2020 5 hours 6/2/2020 4 hours, 49
minutes
8/18/2020 9 hours, 40
minutes
5/19/2020 5 hours, 53
minutes
7/21/2020 6 hours, 50
minutes
5/5/2020 3 hours, 23
minutes
7/7/2020 5 hours, 8
minutes
4/21/2020 4 hours, 49
minutes
6/16/2020 7 hours, 33
minutes
4/7/2020 1 hour, 35
minutes
Staff and elected officials report potential role confusion related to directing operational matters. As noted in the Planning and Strategy section, the City does not have a strategic plan and the Council sometimes operates at more of an operational rather than strategic level, focusing on immediate action items and implementation details rather than setting long-term strategic goals. This contributes to a reactive environment where staff priorities can change depending on the Council’s interests. As noted below, survey respondents reported a variety of experiences and perceptions of the City Council’s strategic direction for the City. The responses below indicate opportunities for improvement to strengthen policy governance and prioritization of initiatives within available resources.
Q: How would you rate the quality of the strategic direction for the City overall provided by City Council?
The City has established one Board Committee (the Audit Committee) and multiple commissions to assist and advise the Council and staff on community issues. The purpose and membership of each committee and commission is detailed in the table below.
Committ ee/
Commission Purpose
Number of
Members (#)
Audit Committee ● Reviews the annual audit report and management letter ● Recommends appointment of auditors
● Reviews the monthly Treasurer’s report
● Recommends a budget format
● Reviews City investment policies and internal controls of such policies
4 to -5; 2 from
City Council
Bicycle Pedestrian
Commission
● Reviews, monitors, and makes recommendations
regarding City transportation matters including but not limited to bicycle and pedestrian traffic, parking,
education, and recreation within Cupertino.
5 3% 27% 30% 24% 17%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 15
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Committ ee/
Commission Purpose
Number of
Members (#)
Fine Arts Commission ● Fosters, encourages, and assists in the realization, preservation, and advancement of fine arts for the
benefit of the citizens of Cupertino.
5 Housing Commission ● Assists the Housing Division in developing housing policies and strategies; recommends policies for
implementation and monitoring of affordable housing
projects; helps identify sources of funding for affordable housing; and performs other advisory functions
authorized by the Council.
5 Library Commission ● Advises Council on the adequacy of library service within the community and such other matters relating to library service as specified by the City Council; and
serves as liaison between the City and the Santa Clara
County library system.
5 Parks and Recreation
Commission
● Advises the City Council on municipal activities in
relation to parks and recreation, including park site
acquisition and development, recreation program
policy, and expansion of the park program as
development occurs.
5 Planning Commission ● Advises the Council on land use matters such as specific and general plans, zonings, and subdivisions. 5 Public Safety
Commission
● Advises the Council on all areas relating to public
safety, traffic, and policy, fire, and other matters. 5 Sustainability
Commission
● Serves in an advisory capacity to the City Council and provide expertise and guidance on major policy and
programmatic areas related to the environmental,
economic, and societal goals noted within Cupertino’s
Climate Action Plan (CAP) and General Plan (GP)
Environmental Resources/Sustainability Element.
5; including 1
from a
Cupertino-based
educational
institution and, 1
from a
Cupertino-based
business
Teen Commission ● Advises the City Council and staff on issues and projects important to youth. 9
Technology, Information,
and Communication
Commission
● Advises the City Council on all matters relating to
telecommunications within the City of Cupertino,
including evaluating compliance with any agreement
between the City and a telecommunications provider
and conducting periodic reviews of providers, facilities, and products.
● Provides support for community access television,
especially public and education access, and gives
guidance when needed for development and
implementation of access channels and programming.
5 These commissions offer an opportunity for residents to engage with and have an impact on their local government. However, staff report that commissioners do not consistently have a good understanding of their role in advising, rather than directing, the Council and City staff. The role of the
Enterprise Risk Assessment Report | 16
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
commissions could be better defined and articulated in the City’s Commissioner Handbook, which may require revisions. Approximately half (47%) of survey respondents reported that the City’s commissions and committees are either not effective at all or slightly effective. No respondents reported that these governance structures were extremely effective.
Q: How would you rate the effectiveness of the commissions and committees currently in place at the Cit y?
Overall Risk Level
Moderate-to-High
Impact
Likelihood
Preparedness
Trajectory
High Moderate-to-High Moderate Increasing
Risk Mitigation
● Develop a housing action to support additional affordable housing units and retain the character of the community.
● Coordinate with regional partners to address homeless encampments and dedicate resources to provide support services as necessary. ● Continue to evaluate the impact of COVID-19 on the community and City revenues.
Residual Risk
Moderate
Risk Area: Risks associated with events outside of an organization’s control.
Scope: External risks typically include economic trends, natural disasters, climate change, affordable housing, political lobbying and legislative changes, and interagency relations.
The City experiences multiple external risk factors that are largely outside of its control. Examples include natural disasters, climate change, and macroeconomic changes such as interest rates and industry shifts. Organizations typically cannot influence the likelihood of these events. Mitigating these risks requires a different approach from the other risk categories identified in this assessment. The approach for mitigating external risk factors should include risk identification and subsequent scenario 6% 47% 33% 14%
Extremely effective Very effective Moderately effective Slightly effective Not effective at all
Enterprise Risk Assessment Report | 17
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
analysis/testing to determine if the City has the necessary resources to mitigate the impact of an external risk event.
LEGAL AND REGULATORY CHANGES
While the City is subject to many laws and regulations (see the Compliance and Financial Reporting section of this report), mandates from the State often have significant impacts on the City. For example, as a result of a housing shortage, California’s housing costs have been rising consistently over the last few decades.
High housing costs make it difficult for many Californians to find housing that is affordable and meets their needs. As part of State activities to address this issue, the proposed Regional Housing Needs Assessment (RHNA) mandates that the City plan for 1,064 dwelling units between January 2014 through October 2022 period. Staff report that these requirements have provoked concerns from community members about how the City will retain the character of the community and manage the increased infrastructure needs to support these additional units. According to the California Department of Housing and Community Development, only 308 out of the required 756 dwelling units have been added to the City’s housing stock, the majority of which apply to moderate or above- moderate income categories. Only 5% of the City’s allocation of the very low-income unit quota was addressed, and no low-income units were added to the City’s housing stock. As of December 2020, the City entitled 3,190 dwelling units, including 377 very-low income units; however, developers have not yet initiated construction on these units. This demonstrates risk of noncompliance with State regulations and the Association of Bay Area Governments agreed-upon housing need allocations. As noted in the Affordable Housing section below, the City reports that it has approved developer projects that would add additional affordable housing units, but developers have been slow to break ground.
Q: City risk from state and federal regulations
AFFORDABLE HOUSING
Aside from the challenges posed by RHNA, access to stable and affordable housing within the City and the greater region is an increasingly difficult challenge. Data from the U.S. Census shows that both owner and rental costs within the City are significantly higher than the surrounding County average and the U.S. national average. For example, the City’s median monthly rental costs (rent plus cost of utilities) is 41.3% higher than the County average and over twice as much as the U.S. national average as shown in the table below. This lack of affordable housing increases risks to the City relative to recruiting and retaining employees.
11% 18% 28% 28% 16%
Low Low to Moderate Moderate Moderate to High High
Enterprise Risk Assessment Report | 18
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
2018 HOUSING STATISTICS
Cupertino
Santa Clara
County U.S. Average
% diff. from
County
% diff from
U.S.
Value of owner -
occupied housing
$1,584,600 $913,000 $204,900 73.6% 673.4%
Monthly owner costs
(with mortgage)
$4,000+ $3,229 $1,558 -- --
Monthly owner costs
(without mortgage)
$850 $755 $490 12.6% 73.5%
Gross rent – median $3,005 $2,126 $1,023 41.3% 193.7% Source: U.S. Census Bureau, 2020
The City requires 15% of all new construction to be affordable to households below 120% of the County median income. The City contracts with West Valley Community Services to screen and place qualified households in most of the City’s below market rate units, and the vendor also maintains a waiting list due to a shortage of available units.
As noted previously, the City has rezoned and approved projects, as evidenced by the entitlement of 3,190 dwelling units, but City staff report that developers are not building due to the perception that there is no longer a market for the high-cost rental housing needed to make projects financially viable.
Additionally, State housing bills take away the City’s ability to choose projects that are right for the community and aligned with General Plan. In the employee survey, 52% of respondents characterized the risk from insufficient affordable housing as a high risk to the City.
Q: Level of risk due to a lack of affordable housing
Insufficient levels of affordable housing across the State of California contributes to elevated levels of homelessness. According to the last homeless census, Cupertino’s homeless population grew by 28%—from 127 to 159 people—between 2017 and 2019. The COVID-19 pandemic has resulted in a growing number of unsheltered persons, with several visible encampments in the City appearing since March 2020. In interviews and survey responses, City staff noted that the community expects the City to act on submitted concerns related to homelessness and remove unsheltered people from illegal encampments. Since both Police and Fire services are outsourced to the County, the only traditional resource for addressing homelessness within City government is the Code Enforcement function. There is concern that Code Enforcement lacks clear and consistent guidance on the roles, responsibilities, and resources necessary to address different complaints, which may vary depending on the location, owner, or type of property. As levels of homelessness in the region continue to increase, the City may need to evaluate its homeless response and resource dedication. 4% 6% 15% 23% 52%
Low Low to Moderate Moderate Moderate to High High
Enterprise Risk Assessment Report | 19
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Q: Level of risk from homelessness in the community
COVID-19 UNCERTAINTY
The COVID-19 pandemic has impacted the City community in new, unprecedented ways. For example, many small businesses and restaurants in Cupertino have closed temporarily or potentially permanently as a result of the State-mandated shelter-in-place and subsequent operating requirements and restrictions. This has a significant impact on the Cupertino community and could impact the City’s revenues going forward.
While the City has not yet been significantly impacted financially from the pandemic, reduced revenues are likely due to significantly decreased tourism, events, new development, and business activity in the community. Additionally, COVID-19 has required businesses, including Apple and the City itself, to rely heavily on employees working remotely. If continued, this trend could reduce traffic, housing prices, and commercial activity within City limits as employees that typically would live close to their offices can reside elsewhere. In the employee survey, responses reflected the uncertainty related to the COVID-19 pandemic’s impact on the organization.
Q: Level of risk from industry changes and major employers
GROUND TRAFFIC
The Bay Area consistently ranks on national worst traffic lists, and the congestion the City experiences is reflective of this reality. Many people drive through the City of Cupertino in order to commute between work and home in the Bay Area, making some main thoroughfares particularly vulnerable to traffic congestion, especially those routes that help drivers avoid the highway. In 2019, the City launched Via, an on-demand micro-transit system to all of Cupertino and beyond that connects the City to regional rail service. This could mitigate traffic concerns; however, the COVID-19 pandemic temporarily shut down the service. The City’s Transportation Manager is actively involved in regional traffic management, with a focus on implementing viable solutions. Despite the City’s efforts, 53% of survey respondents reported risk levels from traffic and commuting as high or moderate-to-high.
13% 27% 27% 18% 15%
Low Low to Moderate Moderate Moderate to High High
12% 14% 30% 24% 21%
Low Low to Moderate Moderate Moderate to High High
Enterprise Risk Assessment Report | 20
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Q: Level of risk from traffic and commuting
NATURAL DISASTERS
According to the City’s General Plan, the City coordinates its emergency planning efforts with federal, state, and regional resources to ensure a consistent, integrated, and efficient approach to emergency planning. The City employs an Emergency Manager who coordinates with the Santa Clara County Sheriff’s Office and Fire Department to plan and react to emergencies.
The City is susceptible to various natural hazards including drought, earthquakes, extreme heat, floods, wildfire, and other environmental shifts related to climate change. Due to Cupertino’s geographical location, there are risks related to both urban and wildland fires. Three acres of the City are in the High and Very High Fire Hazard Severity Zone, which was adopted as a Wildland-Urban Interface Fire Area (WUIFA). Properties in a WUIFA are subject to additional standards intended to manage community safety through availability of access roads and water. Research suggests that wildfire prone regions can anticipate future extensions and increased severity of wildfire season, including power line shut offs to decrease the risk of fires starting during certain weather conditions.
Additionally, Cupertino is in the seismically active Bay Area, which has several active fault lines including the San Andreas fault, the Sargent-Berrocal, and Monta Vista-Shannon faults. Seismically induced ground shaking, surface fault rupture, and various forms of earthquake-triggered ground failure are anticipated within the City limits, which impacts property and public safety.
Finally, the City and Santa Clara Valley Water District are actively involved in programs to minimize the risk of flooding in the city, including developing a flood management program for the flood plain of Stevens Creek between Interstate 280 and Stevens Creek Boulevard. Structural improvement may eventually be necessary to protect properties from a significant flood event.
CLIMATE CHANGE
Climate change is a complex issue that imposes multiple challenges on public agencies, which include defining how climate change relates to existing scopes of work and how to develop a plan to address climate change. While climate change itself is not a distinct hazard, the effects of it can exacerbate hazards and risks. These include increasing average temperatures, more heat waves and extreme heat days, more extreme weather, rising sea levels, worsening air pollutions, and more vector-borne diseases. These changing conditions can have devastating effects on the regional economy, urban infrastructure, public health, recreation, agriculture, and the environment. As noted previously, given the city’s proximity to waterways, issues related to sea level change may be highly impacted. Similarly, increasing levels of wildfires and hazardous smoke conditions present additional risk to the community as dry conditions persist longer.
In 2015, the City developed a Climate Action Plan designed to reduce greenhouse gas emissions.
According to the 2018 Progress Report on the Climate Action Plan, the City successfully reduced 8% 14% 26% 32% 21%
Low Low to Moderate Moderate Moderate to High High
Enterprise Risk Assessment Report | 21
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
greenhouse gas emissions by 24% below 2010 levels, achieving its 2020 goal ahead of schedule despite an increase in people and jobs in the community. In September 2018, the City declared a climate emergency that called on government agencies to initiate emergency mobilization efforts to mitigate climate change. In the employee survey, nearly half (48%) of respondents noted climate change as a high or moderate-to-high risk to the City.
Q: Level of risk from impacts of climate change
Overall Risk Level
Moderate-to-High
Impact
Likelihood
Preparedness
Trajectory
Moderate-to-High Moderate-to-High Moderate Increasing
Risk Mitigation
● Transition performance appraisals to an online platform and revise the process to provide a meaningful experience to employees. ● Reevaluate the performance improvement plan process to promote employee accountability at all levels.
● Develop succession plans for key positions.
Residual Risk
Low- to -Moderate
Risk Areas: Risks associated with labor management/contracts, employee performance, training, compensation, benefits, turnover, grievances, overtime, resource availability, and communication.
Scope: Human capital and resource practices can span functions including hiring, orientation, training, evaluating, counseling, career planning, compensation and benefits, and housing the policies that define an organization’s expected levels of integrity, ethical behavior, and competence.
The Human Resources department at the City has 3.85 budgeted FTEs in the 2020-21 fiscal years.
The positions consist of an HR Manager, two HR Analysts, an HR Technician, and a part-time HR Assistant. HR appears to be sufficiently staffed. However, recent COVID-19 related regulations have significantly impacted the workload of HR staff, as laws, regulations, risks, and guidance constantly 14% 15% 22% 23% 25%
Low Low to Moderate Moderate Moderate to High High
Enterprise Risk Assessment Report | 22
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
fluctuated from the state and federal government. This experience demonstrated the need to increase skills and staffing in the City’s benefits function. The City collaborates with two bargaining units that represent 120 City employees; the remaining 70 employees are not represented. Overall, most survey respondents (78%) reported HR customer service as excellent or good, indicating high levels of satisfaction with the team.
Q: How would you rate the quality of internal customer service provided by staff in the HR Department?
In FY 2020-2021, the City had 197.75 authorized positions in its budget. City staff report that leadership planned to bring new position requests to City Council over the next 3 years, but these were indefinitely postponed following the COVID-19 pandemic. Existing staff demographics tend to be moderately reflective of the local community, which consists of a large population from Asian countries. As of October 2020, two-thirds of staff were men and half of staff were white.
RECRUITING
Unlike other public agencies, the City appears to be able to recruit high-quality talent relatively easily despite local traffic and high-cost conditions. The City does not have a civil service system, which helps expedite the overall recruiting process; 86% of survey respondents reported that they receive average, good, or excellent support during the City’s recruitment process. Additionally, almost two- thirds (62%) of survey respondents reported that the City’s compensation and benefits competitiveness was excellent or good. This suggests that the City’s pay scale may help recruit and retain highly qualified candidate, which provides a cascading benefit to the community.
Q: How would you rate the City’s recruitment process and support?
40% 38% 17% 2%2%
Excellent Good Average Poor Terrible
14% 29% 43% 14%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 23
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Q: How would you rate the competitiveness of the City’s compensation and benefits?
PERFORMANCE MANAGEMENT
The City currently conducts performance appraisals using a manual, paper-based Adobe system.
This presents challenges in creating a seamless performance management environment that encompasses employee goals, trainings, and growth over time. Evaluations are conducted on a rolling basis, rather than on a regular annual calendar, which can decrease the likelihood that all staff receive appraisals on time. Currently, the content of performance appraisals is also standard for most municipalities and may not provide a meaningful process for employees and supervisors to set goals and support employee accountability and growth. Finally, there are no formal opportunities to provide upstream or 360 evaluations, so management may not receive feedback from the staff that they supervise. While many survey respondents reported the effectiveness of the performance evaluation process was at least moderately effective (69%), almost a third rated the process as only slightly effective or not effective at all. Additionally, 17% of survey respondents reported that they did not receive constructive guidance from their manager or supervisor.
Q: How would you rate the effectiveness of the current performance evaluation/appraisal process?
Q: How would you rate any constructive guidance you have been provided on how to improve any performance gaps (clear steps on what needs to be improved and what that improvement looks like)?
Accountability is also a commonly cited performance management challenge at the City.
Approximately one-third of all respondents (35%) reported that non-supervisory staff are sometimes or never held accountable for their actions. This perception was approximately the same for management-level employees. One of the contributing factors to employee accountability is likely the 23% 39% 34% 5%
Excellent Good Average Poor Terrible
6% 21% 43% 19% 12%
Extremely effective Very effective Moderately effective Slightly effective Not effective at all 15% 29% 26% 8% 4% 17%
Excellent Good Average Poor Terrible Not received
Enterprise Risk Assessment Report | 24
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
process for placing an employee on a performance improvement plan, which was rated as poor or terrible by almost half (44%) of survey respondents.
Q: How often are non- supervisory employees consistently held accountable for their actions?
Q: How often are management- level employees consistently held accountable for their actions?
Q: How would you rate the process for placing low -performing employees on a performance improvement plan and take subsequent action if no improvements are m ade?
RETENTION
In general, the City has a strong track record of retaining employees. Within the past three years, the City’s turnover rate for FTEs has ranged between 7% and 11%, which is well below the average turnover rate for local government agencies, which typically falls between 19% and 20%. While some variation exists between among specific departments and divisions, staff generally report that there is a positive work environment at the City. This is reflected in the responses to survey questions about the City efforts to establish a welcoming workplace culture.
Q: How well has the City established a welcom ing workplace culture?
16% 39% 10% 32% 3%
Always Most of the time About half the time Sometimes Never 12% 46% 7% 22% 14%
Always Most of the time About half the time Sometimes Never 6% 50% 19% 25%
Excellent Good Average Poor Terrible
24% 43% 26% 5% 3%
Extremely well Very well Moderately well Slightly well Not well at all
Enterprise Risk Assessment Report | 25
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
HR recently implemented its first citywide employee engagement initiative, which included an employee survey and cross-functional work groups to develop action plans. This effort builds on the City’s strength in creating a high-performing and welcoming workplace culture.
SUCCESSION PLANNING
In general, the public sector is experiencing significant challenges associated with an aging workforce reaching retirement eligibility. As of October 2020, 42.6% of the FTEs at the City were eligible for retirement in five years, based on the CalPERS requirement of five years in the California retirement system and age 50 years. The table below presents the number and percentage of FTEs by department who are eligible for retirement, which shows elevated risk among Public Works, the City Manager’s Office, and department heads. Of those eligible employees, 48.8% are in operational or technical positions; 16.7% are in professional positions; and 34.5% are in supervisory & management positions.
5 14.9 33.6% 60% 20% 20%
7 16.85 41.5% 14% 43% 43%
11 27.49 40.0% 45% 36% 18%
3 11.93 25.1% 0% 33% 67%
11 30.9 35.6% 64% 0% 36%
44 89.15 49.4% 57% 11% 32%
3 6 50.0% 0% 0% 100%
Total 84 197.22 42.6% 49% 17% 35%
The City has not yet institutionalized succession planning efforts across departments. The HR department has identified the need to perform additional collaborative work to ensure that there are strong career paths and cross-training opportunities within all departments. However, without a deliberate, institutionalized program for effective knowledge management and transfer, a significant amount of institutional knowledge and technical expertise citywide is at increased risk of being lost.
When staff leave positions, it can create gaps in institutional knowledge, increase stress, and slow operations. This is particularly true if several members of a team leave the organization within a close timeframe or team members are not cross-trained. Staff departures also increases the risk of losing institutional knowledge without strong document management practices in place.
Enterprise Risk Assessment Report | 26
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
In order to support both succession planning and employee retention, the City developed a new program called Building Employee Skills through Training (“BEST”) in the FY 2020-21 budget. In the employee survey, most respondents (66%) reported that access to training and professional development opportunities were either good or excellent. While training is a vital component to a comprehensive succession planning initiative, it will not address all City needs.
Q: How would you rate your ac cess to the training and professional development resources you need to grow your career?
Overall Risk Level
Moderate-to-High
Impact
Likelihood
Preparedness
Trajectory
Moderate- to High Moderate Moderate-to-High Increasing
Risk Mitigation
● Continue to assess opportunities to connect systems and integrate data flows.
● Continue to hold all departments accountable to following the IT governance model.
● Pursue the action items and recommendations identified in the Cybersecurity section.
● Connect with other local governments and agencies to increase collaboration and resource-pooling related to cybersecurity best practices.
Residual Risk
Moderate
Risk Areas: Risks associated with the design, development, implementation, administration, operations, and maintenance of information systems including change management and system development life cycle. Also includes risks to infrastructure, system performance, data architecture and management, integration, back-up, security, and controls.
Scope: The importance and pervasiveness of information technology and information systems continues to rapidly expand, regardless of organization.
Cities rely heavily on hardware, software, and technology equipment to run their operations, and technology has become part of the backbone of local government operations, as the integration of 28% 38% 21% 11% 2%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 27
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
systems evolves and reliance on technology continues to increase. The City’s Innovation and Technology (IT) department consists of 12 full-time positions and three part-time positions. There are three major teams within the department: Applications, GIS, and Infrastructure.
The Applications division supports the City’s enterprise applications like ERP, Land Management System, Recreation System, Laserfiche, as well as the many e-services custom applications like bid management, permit parking, business licenses, and the city’s mobile apps. The GIS Division builds web applications for staff and the public to use as a tool in their daily workflows. The Infrastructure team is responsible for the acquisition, maintenance, and support of all computer hardware necessary for the City's network (server, storage, switch, security, appliance) and end user services (PC, tablet, VoIP devices, smartphones).
Employees across the City consistently rated the IT department highly, and consistently highlighted how the talented individuals who staff the department have been responsible for the IT-related success stories, including the relatively smooth transition to remote work in response to the COVID- 19 pandemic.
Q: How would you rate the quality of the internal customer servi ce provided to staff by the IT support team?
IT GOVERNANCE
IT governance plays an important role in local governments to optimize technology purchases, systems integration, and access to information to support decision making. The City has created the Innovation & Technology Administration program, which is responsible for the strategic planning, governance, and policy setting related to the use of digital services for the City.
Some staff report instances of departments not including the IT department early enough in the procurement process when acquiring new systems or applications, resulting in increased risks to data security, successful implementation, and other technical challenges. Additionally, staff report that when IT is not sufficiently involved, the subject matter expert on the new system tends to reside within a department. This practice can result in conflicting guidance or inefficient use of the system since other employees may not be equipped with the appropriate skills or expertise to troubleshoot system issues.
SYSTEMS AND HARDWARE
Employees report a high quality in the hardware and software systems currently in use at the City.
One of the needs employees identified related to IT was a desire for IT to continue to strengthen system integration and data flow automation to reduce manual processes. According to information gathered from interviews, surveys, and document review, the City does lack some key systems that would increase efficiency and effectiveness. Examples of missing systems include a comprehensive 73% 22% 5%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 28
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Human Resources Information System, Learning Management System, and performance management system to automate performance evaluations.
Q: How would you rate the quality of the information technology hardware (computers, accessories, etc.) that you currently have and use in your role?
Q: How would you rate the quality of the information technology systems (software, applications, programs, etc.) that you currently have and use in your role?
CYBERSECURITY
Cybersecurity is a known area of high risk, though the City continues to focus on strengthening the IT Disaster Recovery Plan and other contingency efforts. Because of the growing complexity of cyberattacks, it will remain an imperative that the City continue to prioritize its cybersecurity resiliency efforts, including employee training and collaboration with other local governmental agencies. Several sources, including Interpol, have cited an increasing number of COVID-camouflaged domains, campaigns, and misinformation initiatives as avenues for cyber-attacks. City leaders across the country are increasingly being held accountable for protecting sensitive information and preventing cybersecurity incidents. On October 1, 2020, the U.S. Department of the Treasury released new guidance on the payment of ransomware that outlines various potential violations of federal law should an entity choose to pay a cyber- attacker. In a rapidly changing environment, the City is continually exposed to new and evolving risk areas.
Q: Have you received training focused on cybersecurity (best practices, resources, etc.) provided by the City within the last year?
46% 36% 18%
Excellent Good Average Poor Terrible
43% 40% 14% 2%1%
Excellent Good Average Poor Terrible
81% 1% 16% 3%
Yes - online Yes - in-person Yes - both online and in-person No - no training on cybersecurity
Enterprise Risk Assessment Report | 29
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Q: Based on this training, how prepared do you feel to identify, report, or manage a cybersecurity threat?
The City’s IT leadership completed a 45-question survey on the City’s cybersecurity practices, and the following recommendations emerged from the results.
• Develop, document, and implement an information security policy. • Develop, document, and implement an IT governance policy and process. • Develop, document, and implement a systems development life cycle policy that covers the process of acquiring, developing, implementing, and retiring information systems through a multistep process including ignition, analysis, design, implementation, maintenance, and disposal. The policy should outline documentation procedures, roles and responsibilities, and security considerations.
• Establish an information security incident management plan to help provide guidance and protocol during a possible security breach or incident, with an incident response team that has members with clearly defined roles and responsibilities. • Formally document change control procedures for changes to applications and hardware that includes a process for inception, documentation, testing, and approval. • Assigned users unique IDs to access all key systems and applications • Conduct an audit of remote vendor access to the City’s systems. 30% 60% 8% 2%
Extremely prepared Very prepared Moderately prepared Slightly prepared Not prepared at all
Enterprise Risk Assessment Report | 30
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
• Periodically review the City’s use of secure protocols, such as SFTP or HTTPS, when transmitting data both within and outside the City’s security perimeter. • Install fire suppression system in the City’s server room(s). • Conduct vulnerability assessment scans of internal and external systems and analyze the results for weaknesses and false positives on at least a quarterly basis. • Perform penetration testing against all publicly available services and IP addresses on at least a semiannual basis to identify emerging vulnerabilities and critical risk areas. • For third-party vendors used for IT support functions, request vendors provide a third-party attestation report, such as an SSAE 16 or SSAE 18 SOC audit report, and thoroughly review.
Overall Risk Level
Moderate-to-High
Impact
Likelihood
Preparedness
Trajectory
Moderate-to-High Moderate-to-High Low-to-Moderate Flat
Risk Mitigation
● Establish a three- to five-year strategic plan that identifies major City goals and activities.
● Implement a performance measurement strategy that is aligned with the City’s strategic plan.
● Use the strategic plan priorities to guide annual operating plans for each department.
● Leverage the strategic plan as a decision-making and prioritization tool as new opportunities arise.
Residual Risk
Low
Risk Areas: Risks associated with how the organization plans for operations, strategy, and the future, including both short-term and long-range planning.
Scope: A comprehensive planning framework builds upon the strategic goals, and dives into the next layer of planning, which looks at the strategic objectives for not only the enterprise, but sets objectives for the departments, divisions, programs, and individual roles.
The City has defined mission and vision statements, in addition to several other planning-related documents such as the budget, work programs, innovative technology plan, and the General Plan.
The mission of the City of Cupertino is to provide exceptional service, encourage all members of the community to take responsibility for one another, and support the values of education, innovation, and collaboration. The City’s vision is “Cupertino aspires to be a balanced community with quiet and attractive residential neighborhoods; exemplary parks and schools; accessible open space areas, hillsides and creeks; and a vibrant mixed-use ‘Heart of the City.’ Cupertino will be safe, friendly,
Enterprise Risk Assessment Report | 31
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
healthy, connected, walkable, bikeable, and inclusive for all residents and workers, with ample places and opportunities for people to interact, recreate, innovate, and collaborate.” On an annual basis, the City establishes Council goals and subsequently develops a work program that supports those goals. The work programs define highly detailed projects, next steps, timelines, budget, staff hours, and department leads. This level of detail supports City staff, but it is not industry standard for plans of this detailed nature to be approved by City Council. Because the plans are developed annually, projects can be reprioritized over time as Council priorities shift and hinder progress toward overarching objectives. These shifts also impact the City’s ability to develop and adhere to long-range financial plans that would benefit the City and protect it from significant economic fluctuations. Additionally, these plans are developed by City staff and approved by Council, which does not provide other community members with the opportunity to formally engage in City planning processes. In the survey, only 35% of employees reported that the City is doing extremely well or very well at soliciting input from stakeholders, including the community and front-line staff, during planning processes. Without enough stakeholder engagement, there can be a lack of buy-in, unclear direction, and shifting priorities that do not align with community desires.
Q: How well does the City solicit input from all impacted stakeholders (employees, community members, etc.) during planning activities?
Despite the development of highly detailed annual work programs, the City lacks a strategic plan that would clarify the multi-year direction of the City. Without the continuity provided by a high-level plan to guide decision- making over a multi-year period, there is a risk that work can become diluted, priorities can be unclear or change, and staff can be left to work in a reactive (rather than proactive) environment as they attempt to respond to multiple new and uncoordinated requests from the City Council or commissions. In the absence of an overarching strategic plan to outline City goals and objectives, departments have sometimes developed individualized strategic plans and report a lack of interconnectedness between functions. Accordingly, only 35% of respondents reported that the City made excellent or good use of its strategic plan to guide decisions and activities.
Q: How effective would you rate the City’s use of its strategic plan in terms of guiding City decisions and activities?
Additionally, without a strategic plan and associated goals, it is extremely challenging to implement successful performance measurement to track the City’s progress over time. The City has not 8% 27% 31% 20% 7%
Extremely well Very well Moderately well Slightly well Not well at all 9% 26% 39% 20% 7%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 32
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
adopted outcomes-based performance measures that would enable Council and City staff to evaluate their activities and whether they are having their intended impact. Within the budget document, each department annually reports on performance measures; however, these performance measures do not necessarily tie to larger, strategic City goals that would better communicate the impact of City government accomplishments for the community.
Overall Risk Level
Moderate to High
Impact
Likelihood
Preparedness
Trajectory
Moderate to High Moderate to High Moderate Flat
Risk Mitigation
● Develop a policy framework to help distinguish what needs Council approval versus administrative policies and procedures
● Inventory, review, and prioritize revisions to outdated policies and procedures ● Institutionalize a simple and ongoing review and update process for all City policies and procedures.
● Undertake an effort to review and update the Municipal Code to meet modern operating needs
Residual Risk
Low to Moderate
Risk Areas: Risks associated with policies, processes, and procedures, including efficiency, effectiveness, and level of documentation.
Scope: Policies and procedures play a critical role in providing the guidance required to ensure all functions operate efficiently, effectively, safely, and consistently across the organization. A policy establishes what should be done, and procedures effect the policy. Policies and procedures also play an important role in protecting against the loss of institutional knowledge.
The City lacks comprehensive policies and procedures in multiple areas across the City, including procurement, contract management, ethics, and operational policies. For example, departments including Economic Development, Community Development, Parks and Recreation, and Public Works noted that operational policies are not comprehensive and/or have not been updated in several years. In both interviews and survey responses, City staff identified the need to update policies and procedures from both operational and compliance perspectives, as well as ensure they reside at the appropriate level (i.e. Council, City Manager, or Department) and encompass users outside of the policy owner departments. Critically, the City has not yet defined what policies would go to Council versus the City Manager for approval, which may also contribute to challenges in defining governance roles and responsibilities.
Enterprise Risk Assessment Report | 33
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Policies and procedures help ensure that management directives to mitigate risks are carried out consistently at all levels of the organization and at various stages within different business processes (such as procurement). Overall, staff reported weaknesses in policies and procedures at both the citywide and departmental level.
Q: How would you rate the quality of the documented operational policies and procedures at the City overall?
Q: How would you rate the quality of the documented operational policies and procedures for your department?
The City does not currently follow a standard review process for all policies and procedures, so they are currently updated on an ad hoc basis. As a result, some policies have not been updated recently; notably, the Administrative Rules and Regulations of the Personnel Code has not been updated since 2013. Conversely, the City’s financial policies appear to have all been updated in the last two years.
According to best practice, the City should review policies and procedures every one to three years.
Outdated policies and procedures can contribute to reduced efficiency and effectiveness, as well as communication and accountability challenges. In the absence of up-to-date documented policies, staff rely on historical practices and verbal directions which requires significant institutional knowledge to perform and could be inconsistent with management expectations over time. Given the City’s high proportion of employees nearing retirement, document policies and procedures are critical to supporting operational continuity as employees leave City employment.
A key component to effectively adopted, updated policies and procedures is ensuring that they are communicated and accessible to staff. Currently, documentation is intended to be stored on the internal network drive, although departments report inconsistent storage practices. In some cases, policies and procedures may be stored on individual hard drives, particularly if they are older. Policies and procedures should be stored centrally in a searchable format; when new versions are published, alerts should be communicated, and training should be provided. 6% 37% 43% 14% 1%
Excellent Good Average Poor Terrible
10% 36% 40% 13% 2%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 34
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Overall Risk Level
Moderate
Impact
Likelihood
Preparedness
Trajectory
Moderate-to-High Moderate Low-to-Moderate Decreasing
Risk Mitigation
● Continue to develop a 5- to 10- year long-term Capital Improvement Program (CIP) plan and budget.
● Conduct a capital project process and program assessment to identify opportunities to strengthen project oversight and project management. ● Develop a standardized and transparent process to prioritize CIP projects. ● Define and document cross-departmental roles and responsibilities related to capital projects.
Residual Risk
Low to Moderate
Risk Area: Risks associated with capital improvement program, including planning, financing, construction, close-out, and capital asset management (including preservation and maintenance), tracking, reporting, accountability, and inventory.
Scope: In construction, issues of risk are closely tied to schedule, site unknowns, and budget issues. In addition, construction contracts must be monitored to ensure full compliance with equal employment opportunity, discrimination, prevailing wage, and fair labor standards laws.
The Capital Improvement Program (CIP) is managed by the CIP Administration group with the City’s Public Works department, which includes a budgeted staff of 6.20 FTE. The CIP is documented in the City’s annual plan to provides design and construction administration for all capital improvement projects. The CIP organizes the projects into five categories: Parks, Buildings, Streets, Traffic Facilities, and Storm Drainage. The City listed 29 active capital projects in August 2020 across seven different project phases.
The CIP Program Manager departed the City in early September 2020, in addition to at least one other staff in the group. The departure of staff in the CIP group presents an opportunity for the City to re-evaluate the staffing, processes, culture, and performance expectations of the group. The City has filled two positions since September, including the acting program manager. Employees reported that the turnover has positioned the City to strengthen the CIP program overall, and is expected to result in improved relationships with other departments and achievement of the program’s objectives.
Each fiscal year, the CIP is funded by the capital reserve and/or restricted grant and donation proceeds. The five-year budget denotes funding sources and a description of each project. The City
Enterprise Risk Assessment Report | 35
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Council approves funding of capital improvements on a total project basis but allocates the funding annually. Funding into the CIP from the capital reserves is capped at approximately $1.5 million annually. The adopted budget for the Capital Projects Funds for FY 2020-21 is $2.2 million, primarily due to a reduction in capital project spending resulting from the COVID-19 pandemic and its unprecedented uncertainty.
Many of the current CIP projects have been identified as priorities in the City’s adopted master plans, such as the Bicycle Transportation Plan or the Pedestrian Master Plan. However, the CIP funding process is relatively short-term and prone to change year-over-year, as there is no long-term CIP plan, although project funding is approved in the first year for multi-year projects. The City does not currently have a long-term CIP plan, though the City has begun preliminary work on a 10-year plan.
Likely as a result, the pipeline of planned capital projects changes year-over-year, despite approximately $400 million in unfunded CIP projects already identified. The City’s process for prioritizing and selecting projects is not standardized and transparent across the CIP projects. Short- term planning for capital improvement projects can increase risks of higher long-term costs and pose a threat to health and safety. Many employees reported concerns about the safety of City Hall and the continued deferral by Council of the City Hall project by the Council in favor of other CIP projects. T; the building has become a growing potential liability to the City.
Finally, staff that coordinate with the CIP group on design elements of projects sometimes reported confusion related to their role, responsibility, and hand-off point. Without clarity of everyone’s role and purview on each project, employees may experience accountability confusion and create inefficiencies in the CIP process.
Q: How would you rate the processes the City uses to identify and prioritize capital improvement projects?
2% 20% 54% 24%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 36
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Overall Risk Level
Moderate
Impact
Likelihood
Preparedness
Trajectory
Moderate Low-to-Moderate Moderate Increasing
Risk Mitigation
● Develop a process to manage grant funding to ensure compliance with tracking, reporting, and monitoring requirements.
● Assess the organizational structure related to the City’s management analysts.
● Conduct an Americans with Disabilities Act (ADA) self-evaluation consistent with the 1991 federal requirements and track the resulting action -items.
Residual Risk
Low-to-Moderate
Risk Area: Risks associated with compliance with laws, regulations, and requirements. Also, risks associated with financial reporting (content, distribution, assembly, utilization, frequency, formatting, accuracy, and reliability).
Scope: Risks organizations face when they are unable to follow internal policies, government laws and regulations, which may be subjected to legal penalties and financial fines. Financial reporting includes deliverables such audited annual financial statements. Reliable financial information is fundamental to planning, budgeting, pricing, evaluating vendor performance, assessing partnerships, and a range of other operational and strategic activities.
Proactive compliance is characterized by employees being aware of requirements and actively operating to comply with them. Performed effectively, proactive compliance prevents issues from occurring before they become problematic. Reactive compliance involves ongoing monitoring, testing, and reporting. Overall, about half of employees felt that noncompliance issues were extremely or somewhat unlikely. Approximately the same amount reported that the quality of training/resources provided to stay abreast of compliance concerns was excellent or good.
Q: What are the chances that the City will experience any issue with compliance (late or missed reporting; noncompliance with safety requirements; breach of sensitive data, etc.) in the next year?
14% 33% 42% 12%
Extremely unlikely Somewhat unlikely Uncertain Somewhat likely Extremely likely
Enterprise Risk Assessment Report | 37
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Q: How would you rate the quality of resources/training provided at the City about how to remain in compliance with laws, regulations, and requirements?
FINANCIAL REPORTING
Timely and accurate financial reporting for management decision-making is a key component for efficient and effective operations. Some employees report that in certain departments, financial information may only be available through specific employees, adding to the time it may take to get needed data. Others note that sometimes, reports out of the system are not intuitive for newer or more infrequent employees or infrequent users of the reports, suggesting that some departments may benefit from additional training. Overall, employees rated the timeliness of financial information as excellent (20%) or good (40%).
Q: How would you rate the timeliness of the financial information you receive (e.g. reports, response time to requests, etc.)?
ADA COMPLIANCE
Employees report that there are numerous facilities they suspect or know that are non-compliant with their obligations under the Americans with Disabilities Act (ADA). The City last published its ADA self- evaluation and transition plan in April 2015 and ADA-compliance elements have been identified as part of other City projects. However, the City does not have a formal effort to track and identify ADA compliance action plans. It is imperative that once the City has identified an item of non-compliance, that a subsequent actionable improvement plans is also created. Identifying a problem without an action plan can lead to further compliance problems. While the City has funding identified for ADA projects in the CIP budget, prioritization of projects in general has been a challenge, as noted in more detail in the Capital Improvement Program section.
In 2017, the Ninth Circuit Court of Appeals issued a decision reversing the trial court’s decision of the Kirola v. City and County of San Francisco, which alleged ADA violations in City facilities, and allowed the plaintiff to proceed with some claims that the City’s facilities were in violation of the ADA. In the first year of the lawsuit alone (fiscal year 2020-2011), the City and County of San Francisco paid $2,285,000 for litigation expenses related to this lawsuit. The decision revealed that even seemingly minor access barriers in a government facility may serve as the basis for a class action lawsuit against the City. The U.S. Department of Justice (DOJ) has recently encouraged local government agencies to conduct a new self-evaluation like the one required by the 1991 federal law. We 10% 38% 36% 14% 2%
Excellent Good Average Poor Does not exist
20% 40% 35% 5%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 38
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
recommend the City take this proactive action to help mitigate and reduce the risk of possible ADA violations.
GRANT FUNDING
Several employees expressed concerns over grants management, specifically federal grant reporting.
While the volume of dollars coming from federal grants is relatively low, it is critical to maintain compliance with federal reporting requirements. The City does not currently have a standardized approach in place to monitor grants and relevant compliance.
As the City continues to explore alternative revenue sources as a result of the pandemic, there will likely be grant funding opportunities that may be relevant for the City. Pursuing grants will require the City to first assess and determine how to best approach both grant writing—a specialized skill—and grant administration.
To help mitigate the impacts of the COVID-19 pandemic on the small businesses in Cupertino, the City established the Small Business Emergency Relief Grant Program to offer one-time emergency relief grants of $5,000 to eligible small businesses. The City is utilizing its allocated Coronavirus Aid, Relief and Economic Security Act (CARES) Act Community Development Block Grant funding (CDBG-CV) to provide these grants. The Enterprise Foundation, a 501c3 organization, is the City’s partner to administer this grant program.
Q: How would you rate the quality of sy stems used to track and monitor grants for compliance purposes?
REQUIREMENTS FOR AFFORDABLE HOUSING
Across the State of California, moderate-income households struggle to afford rent and mortgages.
The COVID-19 pandemic has further exacerbated this issue. Since Cupertino is in the heart of Silicon Valley, its community members feel a particular impact on the shortage of affordable housing, as noted in the External Environment section of this Risk Assessment. In September 2020, California’s Governor signed a package of housing bills designed to increase affordable opportunities for renters and homeowners, including incentives for developers to increase the number of affordable housing units built in the state.
However, state laws are designed to incentivize increased density, while single-family housing currently characterizes most of Cupertino. In 2018, the Friends of Better Cupertino filed a lawsuit to stop a development project approved by City staff that would contribute 1,201 affordable housing units to the community and was approved by City staff. The project was ultimately approved by the Santa Clara Superior Court and allowed to progress forward in accordance with previous City approval. State housing officials have put the City on notice, stating that it may be on the verge of violating State law around regional housing requirements if the City’s housing plan faces further hindrances or developers do not move forward with construction on projects. This additional scrutiny 7% 20% 40% 13% 20%
Excellent Good Average Poor Does not exist
Enterprise Risk Assessment Report | 39
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
applied by the State, in conjunction with escalating State regulations to support increased affordable housing, places the City at risk of noncompliance with State requirements and potentially community goals. Ultimately, this can result in loss of funding from state and federal housing programs.
As noted in the External Environment section, State requirements, community desires, and developer schedules are outside of the City’s control. However, affordable housing shortages present risk to the City from both a compliance and community characteristic perspective.
Overall Risk Level
Moderate
Impact
Likelihood
Preparedness
Trajectory
Moderate-to-High Low-to-Moderate Low-to-Moderate Flat
Risk Mitigation
● Develop and implement a comprehensive fraud, waste, and abuse program. ● Implement an anonymous whistleblower hotline and standardized complaint management processes.
● Develop and schedule fraud, waste, and abuse training to all City employees, including mechanisms in place to protect employees from retaliation.
Residual Risk
Low-to-Moderate
Risk Areas: Risks associated with misappropriation of funds, extravagant spending, using one’s position to accomplish a specific outcome, the intent to deceive, or behavior that is not aligned with the organization’s ethical values and policies.
Scope: The employees of the organization have a duty to use funds economically, efficiently, effectively, and ethically. When employees do not honor this obligation, it could result in instances of fraud, waste, abuse, or unethical behavior.
All City employees share the common purpose of serving the public in an ethical and transparent manner. When City employees do not fulfill this purpose, it could result in instances of fraud, waste, or abuse. Fraud, waste, and abuse are defined as:
• Fraud: A dishonest and deliberate course of action that results in obtaining money, property, or an advantage to which employees or an official committing the action would not normally be entitled.
• Waste: The needless, careless, or extravagant expenditure of funds, incurring of unnecessary expenses, or mismanagement of resources or property.
Enterprise Risk Assessment Report | 40
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
• Abuse: The intentional, wrongful, or improper use or destruction of resources, or highly improper practices that does not involve prosecutable fraud.
In 2018, the City discovered a 14-year embezzlement that took place between 2000 to 2014 and resulted in a loss of $791,494. In response, the City contracted with an independent, third party to conduct an internal control review. As discussed in the Internal Controls section of this report, the review assessed the City’s fixed assets, human resources and payroll, order to cash, procure to pay, and treasury management processes. The City has implemented additional controls for high-risk areas and is in the process of evaluating additional recommendations to strengthen controls overall, resulting in an improved internal controls environment. However, the City has not implemented a robust fraud, waste, and abuse program to educate employees on potential red flags or a whistleblower hotline to report allegations of wrongdoing that could detect issues sooner.
The City’s Administrative Rules and Regulations of the Personnel Code include some elements inherent in a comprehensive fraud, waste, and abuse program such as employee protection from retaliation when reporting concerns in good faith. The Administrative Rules and Regulations of the Personnel Code also includes a section related to complaint procedures; however, this requires employees to report the incident to their supervisor, Department Head, or HR Director, which does not allow for anonymous reporting and may deter some employees from reporting concerns.
However, despite an incomplete fraud, waste, and abuse program, over half (65%) of survey respondents reported that they knew what action(s) to take if they became aware of unethical or fraudulent behavior.
Q: Do you know what action(s) to take if you were to become aware of unethical or fraudulent behavior?
Overall, City employees appear to hold the perception that another instance of fraud, waste, or abuse at the City is relatively unlikely. However, only 30% of respondents reported that they would definitely be protected in the event that they reported suspicious or concerning behaviors. When employees do not feel fully secure in reporting concerns, they may choose to ignore these behaviors, which can enable and perpetuate inappropriate behaviors and activities in the organization. Multiple survey respondents noted that the City has had at least one experience where there was a perception of retaliation for reporting wrongdoing, which may also deter employees from coming forward with concerns.
65% 29% 6%
Yes - I know what I would do Maybe - I would have to research a bit No, not really sure
Enterprise Risk Assessment Report | 41
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Q: what are the chances that an incident of fraud, waste, or abus e would likely occur at the City within the next year?
Q: What are the chances that you would be protected from retaliation if you reported wrongdoing?
Finally, just under half (42%) of survey respondents reported that they have not received ethics or fraud, waste, and abuse training in the last two years. Training is imperative to a robust ethics and fraud, waste, and abuse program by reinforcing the City’s values, describing suspicious activity, and providing information on the organization’s reporting environment (i.e., how to report concerns, complainant protections, complaint responses).
Q: Have you received training focused on ethics or fraud, waste , and abuse prevention provided by the City within approximately the last two years?
16% 53% 28% 4%
Definitely will not Probably will not Might or might not Probably will Definitely will 29% 41% 20% 6% 3%
Definitely would be protected Probably would be protected Might or might not be protected Probably not protected Definitely not protected
23% 22% 14% 42%
Yes - online (e.g., webinar, class) Yes, in-person (e.g., training session/clasS) Yes-both online and in-person No - no training
Enterprise Risk Assessment Report | 42
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Overall Risk Level
Moderate
Impact
Likelihood
Preparedness
Trajectory
Moderate Low-to-Moderate High Increasing
Risk Mitigation
● Continue to proactively plan and address California Public Employee’s Retirement System (CalPERS) obligations.
● Expand the current economic development-related performance measures to track and assess outcomes of the City’s efforts over time.
Residual Risk
Low-to-Moderate
Risk Areas: Risks associated with revenue sources, funding levels, cash management, liquidity, expenditure rates and commitments, debt management, and inter-organizational business.
Scope: The funding and economics factors that impact the organization’s ability to maintain operations and deliver programs and services. Whether within the organization’s realm of influence (or outside of their control), the funding and economic factors impact the organization’s long-term fiscal stability as well as its ability to mitigate the negative impacts of extraordinary risk such as regional changes and national economic volatility.
Revenue growth in the City is primarily driven by sales, property, and transient occupancy taxes.
Because Cupertino is a mature, 93% built-out city, the City primarily focuses on business retention and revitalization. Supported by the stability of tech-giants like Apple, Inc. and Seagate Technologies, the City’s economic development activities have focused on creating an environment for start-ups and growing companies. The Economic Development program resides within the City Manager’s department and relocated from the Community Development department in FY 2018-19. The program currently consists of one full-time employee, who is responsible for providing support and assistance to local businesses, conducting community outreach, and collaborating with City employees on projects.
The City relies heavily on revenues from the Apple Campus to fuel sales tax, property taxes, and business travel. Apple either owns or leases approximately 25% of commercial properties within the City. The top 25 sales tax producers in the City included both Apple and Seagate Technology, and then was followed largely by retailers and restaurants. However, as a result of the COVID-19 pandemic, small businesses within the community have suffered and closed temporarily or permanently.
Enterprise Risk Assessment Report | 43
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
The City develops medium-term (5-year) and long-term (20-year) forecasts as part of the budget process and has a long-range financial plan (LRFP) established. The City’s budget includes a contingency budget that covers maintenance and operational funding for Public Works, as well as contingency funds for disaster response. However, given the unprecedented levels of uncertainty stemming from the COVID-19 pandemic, the City may need to re-evaluate its revenues more regularly. There are several strategies identified in the FY 2020-21 adopted budget aimed at balancing the City’s budget over the next five to 20 years.
The City currently anticipates the pandemic will result in at least a two-year recession and subsequent declines in revenue. As a result, the City’s focus for the coming fiscal year is on reducing expenditures to offset declining revenues. The City prioritized creating fiscal reserves in recent years, and therefore has the resources to mitigate the short-term looming risks of declining revenues. The City’s Economic Uncertainty Reserve reached $19 million at the start of fiscal year 2021, representing approximately 24% of the city’s general fund, and serves as a potential source of mitigating any shortfalls in future fiscal years.
RESERVE FY 2021 RESERVE LEVEL DESCRIPTION
Economic
Uncertainty
$19,000,000 For economic downturns and major revenue
changes. Represents two months of general fund
expenditures plus a two-year 13% drop in total
general fund revenue.
PERS $12,000,000 For pension cost increases
Sustainability $123,397 For future sustainability projects/programs Unassigned $500,000 1% of general fund operating budget, for mid-year budget adjustments and redeployment into the
five-year budget
Capital
Improv ement
$5,000,000 Set aside for future capital projects, calculated based on the average dollars spent for capital
projects in the last three fiscal years.
Source: City of Cupertino Fiscal Year 2020-2021 Adopted Budget
The City’s proactive responses thus far to the economic impact of COVID-19 included delaying the planned increase in certain fees, reducing departmental operational budgets, and furloughing some staff. Additionally, the City’s unassigned fund balance remains healthy, and is expected to be able to assist in addressing funding gaps as needed. A risk associated with the reduction in revenue is that the City may need to adjust levels of service accordingly. While reserves are helpful in the short-term, there are many unknown variables related to how the pandemic will impact the future of local government revenues and communities. City staff report that levels of service provided to the community are high and therefore may require ongoing adjustments depending on the City’s incoming revenues (see Operations and& Service Delivery section for more detail).
Enterprise Risk Assessment Report | 44
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Q: As of mid -September, how much has COVID -19 negatively impacted your department’s operating budget?
The City has also identified its Section 115 Pension Trust ($12 million) as a potential source to mitigate any increases to California Public Employee’s Retirement System’s (CalPERS) annual required contribution rate or further reductions in the discount rate as set by CalPERS.
RETIREMENT BENEFITS
Cupertino provides retirement benefits for its employees through the California Public Employee’s Retirement System (CalPERS). In mid-2018, the City implemented a Pension Rate Stabilization Program (PRSP), a Section 115 Trust intended to stabilize pension rate volatility from year to year. A Section 115 Trust is an investment tool that allows the City to pre-fund pension and retiree health costs. The City elected to use a more conservative discount rate than CalPERS and allocates more towards pension funding each year than is required by CalPERS. Given this strategy and the $12 million currently set aside for pension funding, the City is in a strong position to withstand the effects of pension cost increases.
Overall Risk Level
Moderate
Impact
Likelihood
Preparedness
Trajectory
Moderate Moderate Moderate Flat
Risk Mitigation
● Continue to strengthen internal controls through regular reviews and assessment of key programs and processes.
● Develop a mechanism to track and report on recommendations and action plans that emerge from internal audit and other assessment projects.
Residual Risk
Low-to-Moderate
5% 26% 33% 26% 12%
None at all A little A moderate amount A lot A great deal
Enterprise Risk Assessment Report | 45
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Risk Areas: Risks associated with preventive controls (e.g., tone at the top, policies and procedures, passwords), detective controls (e.g., segregation of duties, reconciliations, variance reports), and corrective controls (e.g., changes to policies and procedures, training, and loss of privileges).
Scope: Control activities are the processes and procedures that help ensure that management’s risk responses are carried out; they are not performed simply for their own sake or because it seems to be the “right” or “proper” thing to do. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets, and segregation of duties.
The City’s internal control environment represents the processes designed to provide reasonable assurance about the reliability of financial reporting, the efficiency and effectiveness of operations, and compliance with applicable laws and regulations. Internal controls also safeguard the City’s assets from unauthorized acquisition, use, or disposition. Audit Committee members highlighted the following functions as desired areas of continued internal control focus based on historical events at the City:
• Cash reconciliation
• Vendor approval process
• Prior period adjustments
In early 2019, the City conducted an internal control review of its fixed assets, human resources and payroll, order to cash, procure to pay, and treasury management processes. Many of the recommendations from the report were noted as in-progress at the time of the internal control review report’s publication. The City has addressed recommendations pertaining to high-risk areas and continues to evaluate additional opportunities to strengthen internal controls, though the City has not yet completed a follow-up to validate the completion of action items committed to in the report. For example, the City created an Audit Committee and established an internal audit function. Additionally, internal control matrices are used in order to support the transparency and adequacy of segregation of duties. In line with best practice, the Finance Manager reviews system access requests to add or change roles within the City’s ERP, including when new employees are added. The Finance Manager also reviews with the IT team any updates made to the City’s Active Directory. The Finance Manager meets with the IT team on a quarterly basis to cross-validate the emails and review the system access logs. In order to communicate these improvements to the Audit Committee and Cupertino community, updates on the recommendations included in the internal control review should be validated and made available on the City’s website.
Cash handling and revenue collection is one area of concern for the City, as employees will continue to need to be trained on the City’s policies and procedures. The Parks and Recreation department employs a significant number of part-time employees who are teenagers, so the inherent risk will always be elevated due to the high-turnover and the lower level of experience in these part-time seasonal employees.
Enterprise Risk Assessment Report | 46
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Q: How would you rate the City’s overall internal controls environment, including checks and balances, preventative and detective measures, testing/evaluating internal controls, and monitoring effectiveness of controls?
Overall Risk Level
Moderate
Impact
Likelihood
Preparedness
Trajectory
Moderate Moderate Moderate Flat
Risk Mitigation
● Evaluate service levels as needed according resulting from COVID-19 impacts on City revenues.
● Conduct programmatic reviews of Senior Center services, sports venue management, business license issuance, and other key programs to identify potential redundancies and efficiencies.
Residual Risk
Low
Risk Areas: Risks associated with community expectations, level of service commitments, scheduling, program/service delivery, sustainability, quality, process efficiencies, and resource allocation.
Scope: Day-to-day operations across the organization, and efficient and effective delivery of the organization’s programs and services in alignment with goals, vision, and mission.
At the most fundamental level, the City’s mission is to direct the efficient and effective delivery of municipal services. The City provides a full range of services to residents, including:
• Community Development (planning, building permits and plans, code enforcement) • Finance (billing and payment processing)
• Public Works (infrastructure and streets maintenance) • Recreation and senior services
• Public information
9% 44% 37% 9%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 47
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
City staff report high levels of service expectations by the community and a constant drive to meet service demands. Most survey respondents (87%) reported that the City’s overall ability to deliver core services to the public in an effective manner was excellent or good. As noted previously, over time, City revenues may be impacted by COVID-19 and existing service levels should be evaluated accordingly.
Q: How would you rate the City’s overall ability to deliver core services to the public in an effective manner?
Amidst the COVID-19 pandemic, some City services were required to transition in order to continue serving the community. Notably, Recreation Services transitioned its programming from in-person to virtual and saw increased participation from residents, demonstrating a bright spot in terms of City service flexibility. Additionally, the City’s digital permitting process was expanded and provided continuity of service for an activity that is traditionally performed in-person. City staff noted the impacts of shelter-in-place orders in terms of how they deliver services to residents and interact with colleagues in interviews and survey responses. A virtual work environment poses both opportunities and challenges that staff embrace, but also express concern about the potential to alter workplace dynamics and the ability to effectively serve all residents.
There are also opportunities to reevaluate some of the City’s current service offerings to increase efficiency and effectiveness. The following areas were noted in interviews as well as in survey responses as requiring potential revisions to better serve the community. • Sports venue management: The City’s Sports Center is operated partially by a private vendor. Council members noted frequent resident complaints regarding public access to and use of the facilities. The Blackberry Farm Golf Course, like many municipal golf courses, is also operated by a private vendor. While municipal venue operators tend to be long-standing, it is best practice to regularly review vendor contracts to ensure goals for the facilities are clearly articulated and ensure that performance measures are included in vendor reporting. • Business license issuance: Business license issuance at the City is not integrated into the permitting process, therefore, some businesses in the community may be operating without a license. During the COVID-19 pandemic, local, state, and federal resources have been available to support small businesses; however, because the City has incomplete records of businesses operating within its limits, it was challenging to reach owners that may have benefited from these resources. When the City conducted physical outreach to businesses, staff discovered that some were operating without a license. This also presents additional liability and lost revenue on behalf of the City.
• Senior Case Management program: The City’s Senior Center currently offers a direct service support program for residents aged 50 and older who require support to stay in their home.
Staff report that this program lacks clear policies, procedures, and internal controls over expenditures and services provided. Additionally, this program’s services are likely to be duplicative with offerings provided by other governmental agencies in the region. Typically, 35% 52% 13% 1%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 48
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
cities operate a referral program to direct residents in need to the appropriate resources rather than providing services directly.
• Senior Travel program: The City’s Senior Center also offers a service akin to travel agencies in scheduling individual and group travel to both domestic and international locations. The scope of this program extends beyond local or regional travel destinations that cities typically offer and may be duplicative with private providers.
As the City continues to evaluate the impact of COVID-19 on its revenues and service delivery, these programs should be evaluated to find potential efficiencies and cost savings.
Overall Risk Level
Moderate
Impact
Likelihood
Preparedness
Trajectory
Moderate Moderate-to-High Moderate Flat
Risk Mitigation
● Assess outsourced functions to determine whether continued outsourcing is cost-effective.
● Review decentralized functions to determine if efficiencies can be gained through increased coordination or centralized guidance, oversight, and training.
Residual Risk
Low
Risk Areas: Risks associated with how personnel are organized, as well as staffing levels and skills.
Scope: An entity’s organizational structure provides the framework to plan, execute, control and monitor its activities. Organization and staffing encompass hierarchy, chain of command, span of control, and staffing levels. Staffing includes specific positions, counts, and capacity. A relevant organizational structure includes defining key areas of authority and responsibility and establishing appropriate lines of reporting.
The City’s organization structure consists of seven departments: City Council and Commissions, Administration (includes the City Manager’s Office, City Attorney’s Office, and City Clerk), Innovation and Technology, Administrative Services, Parks and Recreation, Community Development, and Public Works. As of October 2020, the City has approximately 190 FTEs on staff. With a few exceptions, managers’ spans of control are within normal ranges of four to eight direct employees.
Historically, the City Council has been hesitant to add additional staffing, instead relying heavily on outsourcing for key functions, such as the City Attorney and Police and Fire services. Prior to COVID- 19, the City planned to bring several new positions forward over the next three years to fill key roles; however, given the uncertainty related to the pandemic, this effort has been postponed indefinitely.
Enterprise Risk Assessment Report | 49
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Outsourcing provides both advantages and disadvantages, such as elevated costs for specialists, but also the ability to secure and rely upon subject matter experts. Both employees and elected officials at the City were unsure whether the balance of in-house versus external contractors was in the best interests of the City. As the Council adds new initiatives to the City’s annual work plan and extends meetings, staff workloads are impacted and continue to elevate. While the City currently experiences relatively low levels of turnover and high levels of employee satisfaction with workplace culture, consistent overwork can contribute to burnout over time.
Employees who responded to the survey reported a variety of experiences related to the adequacy of current staffing levels, as noted below. This may reflect differences between departments or divisions in terms of how workload is distributed and what expectations are. Overall, less than one-third (39%) felt that the current staffing levels across the City were either good or excellent.
Q: How would you rate the adequacy of current staffing levels within your department?
Q: How would you rate the current staffing levels across the City as a whole?
During interviews, some key positions were noted as lacking backup, which could result in significant operational disruptions if employees leave the City for an extended period or permanently. The following functions would benefit from support through cross-training of designated backups to support operational consistency and employee flexibility:
• Economic development
• Housing
• Traffic signal
• Management analysis within each department
Like most cities, Cupertino has several functions that are highly decentralized. Some notable examples include budgeting, procurement, communications, and planning. While decentralized functions can provide operational benefits, they typically require enhanced coordination to achieve service efficiency and sometimes result in duplication of efforts. 13% 33% 23% 26% 5%
Excellent Good Average Poor Terrible
3% 26% 50% 21%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 50
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Overall Risk Level
Moderate
Impact
Likelihood
Preparedness
Trajectory
Moderate Low-to-Moderate Low-to-Moderate Flat
Risk Mitigation
● Develop a process to analyze trend insurance claims trends and proactively respond to recurring risks.
● Strengthen controls on access to non-public areas, including employee areas, across all City buildings.
● Complete the update to the City Continuity of Operations Plan.
Residual Risk
Low-to-Moderate
Risk Areas: Risks associated with the organization’s formal/structured risk management programs, such as employee health and safety programs, operational risk management programs, and incident response and emergency management efforts.
Scope: Risk programs include administration of the general liability, workers’ compensation, safety, disability management and property programs. Risk efforts also include contract/insurance certificate review, insurance procurement, emergency preparedness programs, and continuity of operations planning.
The Human Resources department is responsible for administering the City’s risk management, safety, and wellness programs. The department also oversees the City’s self-insured workers’ compensation program. Many risk management functions are outsourced through the City’s outsourced City Attorney function and Joint Powers Authority (JPA), the self-insurance program. The JPA provides some reporting related to claims to the City Attorney’s Office, but there has not been a concentrated effort on proactive risk mitigation by analyzing trends related to claims. The JPA operates with limited control and risk reporting to the City. Most interactions relate to insurance requirements on City contracts.
Before the COVID-19 pandemic, the City Attorney’s Office noticed an increase in claims related to City tree maintenance and requested additional information related to the tree maintenance program.
However, this work has been postponed due to the pandemic, which impacted City operations and shifted attention to other pressing risk management matters. Ideally, the City would conduct routine claims analysis to identify potential issues and proactively mitigate risks on an ongoing basis.
Enterprise Risk Assessment Report | 51
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Q: How would you rate the services provided to staff by the City Attorney’s Office?
BUSINESS CONTINUITY
The City’s Office of Emergency Services has one full-time employee who is responsible for leading and directing the City in prevention, preparation, mitigation, response, and recovery activities focused on mitigating the risks of emergencies, hazards, incidents, and other negative events. As part of this responsibility, the office has been tasked with maintaining and updating the City’s Continuity of Operations Plan (COOP), a core component of business continuity planning.
The City was working with a consultant to revise the City’s COOP in early 2020, but the project was put on hold as a result of the pandemic. In the absence of this plan, City staff have adjusted to remote operations; however, 60% report that they have not been involved in any continuity of operations activities or training in the last year.
Q: Have you been involved in any type of continuity of operations/government planning activity (work sessions, training, documentation, etc.) at the City in the last year?
Only half of employees reported feeling extremely or very prepared to respond to an emergency occurring, which suggests that employees are at greater levels of risk in the event of a negative incident.
Q: How prepared do you feel to respond to or handle an emergency within your department or office?
32% 32% 24% 12%
Excellent Good Average Poor Terrible
40% 60%
Yes No
7% 47% 40% 6%
Extremely prepared Very prepared Somewhat prepared Slightly prepared Not prepared at all
Enterprise Risk Assessment Report | 52
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
EMPLOYEE SAFETY
Most employees (90%) report that they have received training related to emergency preparedness within the last year. This training is imperative to ensure that employees are aware of the appropriate course of action to take in the event of different types of emergencies.
Q: Have you received training focused on emergency preparedness provided by the City within the last year?
However, employees reported concerns about the safety of employees within City Hall in the event of an earthquake. As noted previously, City Hall continues to be placed on the City’s CIP list, but has not yet been prioritized for funding due to shifting priorities at the Council level.
Q: H ow would you rate the overall level of physical security within the facility and/or location in which you work?
Q: In the last two years, have you experienced an incident or time where you’ve felt physically at risk or unsafe while working at the City?
14% 35% 41% 10%
Yes - online Yes - in-person Yes - both online and in-person No - no training 8% 33% 34% 21% 4%
Excellent Good Average Poor Terrible
15% 85%
Yes No
Enterprise Risk Assessment Report | 53
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Overall Risk Level
Low to Moderate
Impact
Likelihood
Preparedness
Trajectory
Moderate Low-to-Moderate Moderate Decreasing
Risk Mitigation
● Continue to develop resources and training related to financial functions, including examples, checklists, and schedules.
● Align budgeting process to longer- term planning activities.
Residual Risk
Low
Risk Area: Risks associated with fiscal controls, budgeting, ongoing information tracking and management, revenue capture, and transaction processing.
Scope: The role of accounting and financial functions in risk mitigation is focused on recordkeeping and compliance through recording, classifying, summarizing, and reporting financial transactions.
The City’s Finance division consists of the Accounting and Business Licenses programs and operates under the Administrative Services department. The division has a total staffing of 7.95 FTEs and is responsible for overseeing all financial accounting and treasury functions for the City. In addition to the Finance division, several finance-related functions are decentralized as a result of the City’s past leadership style and organizational structure. A Management Analyst is positioned within each department. This role is meant to serve as the liaison between the department and Finance on financial matters. While most Management Analysts report a collaborative relationship with Finance, some department leadership underutilizes the reporting and analytical capabilities of their assigned Management Analyst. This can result in a disconnect between Finance and department leadership, since Finance is not responsible for conducting reporting or analysis for each department.
Most surveyed employees rated the customer service provided by the Finance division team as either excellent (44%) or good (28%).
Enterprise Risk Assessment Report | 54
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Q: How would you rate the quality of the internal customer service provided by the Finance team?
BUDGETING
The City’s annual budget is prepared on a July 1 to June 30 fiscal year (FY) basis, with ongoing processes throughout the year including budget development, proposals, adoption, monitoring, and amendments. The City has modified its budgeting process in recent years, shifting to a zero-based budgeting process for the FY 2019-20 period. The City had planned to convert to a biennial budget process; however, given the timing and constraints of COVID-19, the City deferred the conversion indefinitely.
Employees report the changes have been primarily positive, though multiple employees expressed that the changes at times felt abrupt, potentially due to the high volume of changes that have occurred. This indicates the City may be at increased risk of inefficiencies and the value-add of changes to the budgeting process not being fully leveraged by the employees. Surveyed employees requested more examples of how to complete budget materials and additional training on the process changes.
Similar to the challenges noted in the Planning and Strategy section, budgeting is often conducted in a reactionary manner, rather than proactively done in conjunction with long-term planning activities.
This has been exasperated by the impacts of the COVID-19 pandemic, which the City anticipates will result in at least a two-year recession and subsequent declines in revenue.
Over half of managers (54%) reported via the survey an excellent or good experience with the City’s budgeting process. Multiple staff requested additional training to empower staff to strengthen their budgets and monitor spending.
Q: How would you rate the experience of the C ity’s budgeting process?
44% 28% 24% 4%
Excellent Good Average Poor Terrible
14% 40% 33% 7% 5%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 55
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Overall Risk Level
Low-to-Moderate
Impact
Likelihood
Preparedness
Trajectory
Moderate Moderate Moderate-to-High Decreasing
Risk Mitigation
● Transition all operational divisions to Cityworks for asset management. ● Conduct a citywide asset inventory.
● Expand the current tracking assets as appropriate to include small and desirable items such as tools and equipment.
Residual Risk
Low
Risk Areas: Risks associated with the ongoing maintenance, management, tracking, reporting, accountability, accounting, and physical safeguarding of assets, including the organization’s assets used in support of business processes (i.e., facilities/buildings, transportation vehicles, mobile devices, IT equipment, etc.).
Scope: Asset management includes the supply, deployment, and maintenance of the organization’s resources; it includes physical or logical access to data and locations (offices, warehouses, etc.). Asset management is inclusive of the connected strategies, processes, people and technology that make up the foundation of enabling the organization to meet service levels and minimize the overall cost of asset ownership.
Almost all City operational divisions use Cityworks for asset management, based on a GIS-centric approach. The City achieved this by rolling out Cityworks use and implementation over the last 10 years. Since 2016, the City has had a dedicated Asset Management Technician to support asset management activities, liaise with divisions, and provide trainings. However, at least one operational division—Traffic Signals—continues to leverage alternative asset management solutions. Fully leveraging the asset management program across all operational units would decrease the City’s risk of compromised asset performance, human error in inventory tracking, and missed asset maintenance.
Employees in multiple departments reported concerns that small items (such as tools/equipment) are being comprehensively and consistently tracked. The City has also not conducted a full asset inventory in at least three years. Monitoring and tracking assets are key functions of asset management, and without a robust approach the City is at increased risk of inefficient management of tools and equipment, as well as increased risk of theft and /loss of City assets.
Enterprise Risk Assessment Report | 56
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Q: How well do you feel the assets of the City are tracked and accounted for?
As the City continues to add programs and assets, it will be increasingly important to leverage the existing systems and integrate as possible. For example, the carpool and bike fleet services may be strengthened by being more integrated into the fleet system.
FACILITY CONDITIONS
The City conducted and documented the results of a comprehensive facility condition and use efficiency assessment in 2018. The goal of this assessment was to provide the City with a long-range planning tool by identifying the investments needed to keep facilities maintained and functioning adequately. In the Condition Facility Report, most of the 46 facilities assessed were rated between two and three on a scale of one (critical repairs needed) to five (excellent condition), with some exceptions on either end. The assessment also identified space shortages, including a significant shortage at City Hall and the Senior Center.
Q: How would you rate the condition of the facilities (buildings) used by the City?
The same assessment reported that previous engineering studies have indicated that City Hall’s structure is deficient in seismic force resistance. As noted in the External Environment section, Cupertino is in a seismically active region with several active earthquake faults. One of the longest and most active faults in the world, the San Andreas fault, crosses the western portion of the City. 9% 42% 40% 7% 2%
Extremely well Very well Moderately well Slightly well Not well at all 4% 22% 42% 23% 9%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 57
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Overall Risk Level
Low-to-Moderate
Impact
Likelihood
Preparedness
Trajectory
Moderate Low-to-Moderate Moderate-to-High Decreasing
Risk Mitigation
● Continue efforts to institutionalize enterprise decision-making at the senior leadership team level.
● Develop a cascading communication framework to improve internal communication.
● Provide additional management training focusing on leadership, change management, and communication.
Residual Risk
Low
Risk Areas: Risks associated with organizational leadership, management practices, leadership strategic activities, and operating styles.
Scope: Management's philosophy and operating style affect the way an organization is managed, including the kinds of risks accepted. The attitude and daily operating style of top management affect the extent to which actions are aligned with risk philosophy and appetite.
A collaborative management team that can communicate and make decisions through an enterprise leadership lens is a critical component to operational effectiveness. Staff report that the City’s leadership collaboration has improved greatly over the last year or two and attribute this improvement to the leadership style of the City Manager. At the end of 2019, the City Manager arranged a leadership retreat for Department Directors, which began to break down historical siloes among operations. Additional opportunities to improve enterprise decision-making remains.
Many of the employees in leadership positions across the City are relatively new to their roles, which provides an opportunity to enhance enterprise decision-making. Overall, leaders reported being very supportive of one another and open to opportunities for collaboration which was reflected in survey responses that fully reported that the senior leadership team works at least moderately well together.
However, the focus on enterprise decision-making represents a cultural shift in the way the City has historically operated and will take time to be fully realized.
The following positions have either been filled recently or will need to be filled within approximately the next year:
• CIP Manager
• City Manager
Enterprise Risk Assessment Report | 58
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
• Assistant City Manager
• HR Manager
• Parks & Recreation Director
• Asst. Parks & Recreation Director
• Parks Manager
In order to support new City leaders, the City offers supervisory and managerial training. Based on survey results, this training may benefit from a revision. Less than half (41%) of respondents reported that the management training they have received was either excellent or good. Management training is imperative to succession planning and strong leadership that supports the City’s values and workplace culture effectively.
Q: How well do you feel that the senior leadership team at the City works together?
During interviews and as reported in survey responses, internal communication was noted to be inconsistent across departments. In particular, there is a perception that a knowledge gap exists between what is shared at the director level and what is communicated to staff. This is exacerbated by a lack of positions focused on internal communications. Almost one-third (29%) of surveyed staff reported that the quality of leadership communication was either poor or terrible, with employees in the Public Works and Parks and Recreation departments giving the lowest ratings. This suggests that opportunities for improvement in communication exist within these departments. 30% 50% 20%
Extremely well Very well Moderately well Slightly well Not well at all
Enterprise Risk Assessment Report | 59
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
Overall Risk Level
Low-to-Moderate
Impact
Likelihood
Preparedness
Trajectory
Moderate Low-to-Moderate Moderate-to-High Increasing
Risk Mitigation
● Plan to re-evaluate the City’s current public safety agreements and the current level of service provided at certain levels of growth in the community. ● Evaluate options to resource the City’s growing need for code enforcement staffing and related activities.
● Evaluate options to resource the City’s desired level of service in delivering emergency services and related activities.
Residual Risk
Low
Risk Areas: Risks associated with public safety services, including level of services, funding, and community issues.
Scope: Public safety includes emergency services such as law enforcement, fire, dispatch, and community disaster response programs.
PUBLIC SAFETY
Cupertino contracts both its Police and Fire services with Santa Clara County, which is a somewhat unique operating model. The Santa Clara Sherriff’s Office and Fire Department both assign a primary contact for the City to oversee operations within city limits. One benefit of the regional approach to police and fire services is the ability for the County to redistribute resources as needed on an ongoing basis. For example, if a significant event occurs in Cupertino, regional resources can be dispatched to the scene and vice versa. Both the Sheriff’s Office and Fire Department report a close relationship with the City, in particular with the City Manager and Emergency Services Coordinator. While services appear to be sufficient for the current population within the City, with additional development and changes in the City’s transient population levels, additional levels of service are likely to be required to maintain public safety.
The table below reflects the number of reported property and violent crimes in the City over the last three years. Since 2019, violent crime has dropped by 28.6%, but property crimes have increased by approximately 5%. Overall, levels of crime appear low relative to other communities in the region.
Enterprise Risk Assessment Report | 60
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
PROPERTY CRIMES
REPORTED
VIOLENT CRIMES
REPORTED
2017 970 77
2018 956 72
2019 1,018 55
Percent Change +4.9% -28.6%
Source: FBI UCR Data 2019
In the employee survey, levels of the sense of safety were reported as good or excellent by 86% of survey respondents, which aligns with the reported crime data.
Q: How would you rate the overall feeling of safety in the community?
The Santa Clara County Fire Department noted the impact of traffic on response times, which may present a need to build another fire station in the future to access emergency situations in a timely manner. Additionally, there continues to be an elevated risk associated with wildfire season lasting longer and intensifying in the local area, particularly the foothills of the City. Department representatives also noted the impact of transient populations on call volume and fire risk, which could impact future service delivery needs.
Q: How would you rate the effectiveness of the public safety services delivered to the City?
CODE ENFORCEMENT
The City employs 3.5 FTE Code Enforcement Officers who enforce non-emergency and preventative life-safety issues around zoning, building, housing, and fire code compliance. Code enforcement functions serve a critical role and are responsible for supporting the health, safety, and economic well-being of the community. Staff report that this function is under-staffed and unable to adequately address all necessary concerns. However, jurisdictional issues can also prevent code enforcement from acting on citizen complaints Therefore, these responsibilities should be clarified, and response expectations established prior to adding resources into this function. 36% 50% 11% 2%
Excellent Good Average Poor Terrible
33% 52% 15%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 61
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
EMERGENCY RESPONSE
The City’s Office of Emergency Services consists of one full-time employee. The office is responsible for coordinating emergency response and recovery efforts, including running volunteer responder programs and community response training. The City runs a Community Emergency Response Team (CERT) program, which is sponsored by the Federal Emergency Management Agency (FEMA). The office is also responsible for maintaining, reviewing, and updating the City’s Emergency Operations Plan (EOP), which was last published in June 2019. While the City has made significant progress in addressing its emergency operations, the City will likely need to identify additional resources to support the Office of Emergency Services. One full-time employee is likely insufficient to meet the rising demands, highlighted in part because of the role the City government continues to play during the COVID-19 pandemic.
Overall Risk Level
Low to Moderate
Impact
Likelihood
Preparedness
Trajectory
Moderate Moderate Moderate-to-High Flat
Risk Mitigation
● Re-institute the resident satisfaction survey to track public perception over time and engage a broader potion of the community.
● Secure translation services for ongoing resident communication.
Residual Risk
Low-to-Moderate
Risk Areas: Risks associated with the organization’s reputation and the public’s perception of the organization, including its competency (financial performance, safety and security, responsiveness), transparency (openness and integrity), and guardianship (demonstrating care and consideration).
Scope: The reputation of an organization refers to how a broad group of stakeholders perceive the accumulated decisions, actions, and behaviors of the people within an organization. This social judgement is influenced both directly and indirectly by interactions with employees, with programs and services, and by commentary in the public domain (e.g., news stores, press release, social media).
As a local government entity, the City’s reputation and relationship with its residents is the heart of its success. The operations of a local government like the City are complex and multi-faceted and impact the lives of residents, either directly or indirectly, every single day. In general, staff report that the City has built a positive relationship with members of the public. However, some distrust may exist due to
Enterprise Risk Assessment Report | 62
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
the embezzlement discovered in 2018, the City Manager turnover, and issues with the prior City Attorney. The City’s communication team proactively responded to these issues to the extent possible and reports ongoing strengthening of its function in collaboration with City leadership.
Most survey respondents (74%) reported that the City has a good or excellent reputation within the community, despite also reporting mistrust between staff and the Council. In both interviews and survey responses, employees noted that the City strives to be highly responsive to community needs and operate as transparently as possible. For example, the City website has an Open Government Portal that provides residents with direct access to meeting minutes and various City records. Almost half (47%) of survey respondents reported nearly daily interactions with members of the community.
Only 3% of respondents reported that the City was not sufficiently responsive to citizen feedback, with nearly half (48%) reporting that levels of responsiveness were too high. In interviews, staff noted high levels of responsiveness to citizens who were active in voicing their concerns to Council members and City employees, which may also skew community engagement.
Q: How responsive is the City to resident feedback?
Similar to other cities, Cupertino staff report that it struggles to balance its response to the loud voices of a few over the quiet voices of the many in its community. A primary way that cities seek to engage and solicit feedback from their broader communities is through resident satisfaction surveys.
Historically, the City conducted resident satisfaction surveys on an annual basis; however, a survey has not been conducted since 2017. Without this tool to reach citizens who do not actively attend Council meetings or participate in other forms of ongoing community engagement, these voices can be lost in the larger community discussion.
Another complexity to Cupertino’s community engagement and communication paradigm is the number of citizens who do not speak English or speak English as a second language. The City has not yet defined what documents should be translated into other primary local languages, such as Hindi and Mandarin, and currently relies on bilingual employees rather than a translation service to perform this additional work. Given the large number of citizens who require translation services, the City should ensure that important documents are translated and consider securing contracted translation services on an ongoing basis. Items such as budget-at-a-glance, strategic plans, meeting invitations, and the resident survey, at a minimum, should be translated into both Hindi and Mandarin to support engagement within those communities.
23% 25% 51% 3%
Far too responsive Slightly too responsive Appropriate level Slightly too unresponsive Far too unresponsive
Enterprise Risk Assessment Report | 63
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
EMPLOYEE SURVEY RESULTS
Distribution of a risk assessment questionnaire was sent out to City employees, and was open for submission from September 23 through October 1. Out of the 245 employees invited to take the survey, 112 individuals submitted either full or partial responses to the survey (a participation rate of
45.7%.
YEARS OF TENURE
EMPLOYEE LEVEL1
1 Only management-level employees were asked to rate overall level of risk for each category. 14%
10%
33%
13%
31%
33%
9%
18%
6%
12%
6%
14%
Tenure in Position
Tenure with Organization
Less than 1 1 to 2 3 to 5 6 to 10 11 to 15 More than 15 23%
40%
77%
60%
Senior Leadership
Management
Yes No
Enterprise Risk Assessment Report | 64
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
DEPARTMENT
HOW WOULD YOU RATE THE ORGANIZATION’S LEVEL OF OVERALL RISK?
ACCOUNTING AND FINANCE
ASSET MANAGEMENT
31%
23%
19%
8%
7%
4%
4%
3%
Public Works
Community Development
Parks and Recreation
City Manager's Office
Finance
Innovation & Technology
Administrative Services
Other
19% 43% 26% 7% 5%
Low Low to Moderate Moderate Moderate to High High
23% 49% 19% 2% 7%
Low Low to Moderate Moderate Moderate to High High
Enterprise Risk Assessment Report | 65
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
CAPITAL IMPROVEMENT PROGRAM
COMPLIANCE AND FINANCIAL REPORTING
ETHICS AND FRAUD, WASTE, ABUSE
EXTERNAL ENVIRONMENT
FUNDING AND ECONOMICS
19% 36% 26% 12% 7%
Low Low to Moderate Moderate Moderate to High High
18% 38% 38% 3%3%
Low Low to Moderate Moderate Moderate to High High
14% 44% 21% 19% 2%
Low Low to Moderate Moderate Moderate to High High
7% 16% 26% 42% 9%
Low Low to Moderate Moderate Moderate to High High
5% 19% 48% 17% 12%
Low Low to Moderate Moderate Moderate to High High
Enterprise Risk Assessment Report | 66
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
GOVERNANCE
HUMAN CAPITAL AND RESOURCES
INFORMATION SYSTEMS AND TECHNOLOGY
INTERNAL CONTROLS
10% 29% 37% 15% 10%
Low Low to Moderate Moderate Moderate to High High
14% 23% 40% 16% 7%
Low Low to Moderate Moderate Moderate to High High
23% 53% 14% 7% 2%
Low Low to Moderate Moderate Moderate to High High
17% 32% 39% 12%
Low Low to Moderate Moderate Moderate to High High
Enterprise Risk Assessment Report | 67
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
MANAGEMENT AND LEADERSHIP
OPERATIONS AND SERVICE DELIVERY
ORGANIZATION AND STAFFING
PLANNING AND STRATEGY
POLICIES, PROCEDURES, AND PROCESSES
11% 40% 24% 18% 7%
Low Low to Moderate Moderate Moderate to High High
9% 14% 43% 23% 11%
Low Low to Moderate Moderate Moderate to High High
9% 20% 40% 20% 11%
Low Low to Moderate Moderate Moderate to High High
12% 21% 47% 16% 5%
Low Low to Moderate Moderate Moderate to High High
11% 30% 36% 18% 5%
Low Low to Moderate Moderate Moderate to High High
Enterprise Risk Assessment Report | 68
FOR INTERNAL USE OF CITY OF CUPERTINO ONLY
PROCUREMENT
PUBLIC SAFETY
REPUTATION AND PUBLIC PERCEPTION
RISK PROGRAMS
15% 33% 36% 9% 6%
Low Low to Moderate Moderate Moderate to High High
34% 32% 17% 12% 5%
Low Low to Moderate Moderate Moderate to High High
19% 47% 16% 14% 5%
Low Low to Moderate Moderate Moderate to High High
9% 30% 30% 19% 12%
Low Low to Moderate Moderate Moderate to High High