Proprietary & Confidential
FINAL REPORT
City of Cupertino
ENTERPRISE RISK ASSESSMENT
May 23, 2024
Moss Adams LLP
999 Third Avenue, Suite 2800
Seattle, WA 98104
(206) 302-6500
Enterprise Risk Assessment Report
Table of Contents
Executive Summary 1
A. Project Scope 1
B. Risk Assessment Framework 1
C. Risk Assessment Results 2
Introduction 4
A. Project Scope 4
B. Methodology 4
Risk Assessment Framework 5
Definition of Risk Levels 6
C. External Environment 8
D. Comparison to 2020 Risk Assessment 9
E. Risk Assessment Employee Survey Results 10
Risk Assessment Results 12
A. High Risk Categories 12
Funding and Economics 12
B. Moderate to High Risk Categories 15
Capital Improvement Program 15
Compliance and Financial Reporting 17
Human Resources 20
Planning and Strategy 25
C. Moderate Risk Categories 27
Asset Management 27
Governance 29
Internal Controls 32
Management and Leadership 33
Operations and Service Delivery 35
Table of Contents – Continued
Enterprise Risk Assessment Report
Organization and Staffing 38
Policies and Procedures 40
Procurement and Contracting 41
Reputation and Public Perception 44
Risk Programs 46
D. Low to Moderate Risk Categories 49
Accounting and Finance 49
Ethics and Fraud, Waste, and Abuse 51
Information Technology 54
Public Safety and Security 58
Appendix A: Employee Survey Results 61
A. Survey Respondent Profile 61
B. Risk Category Ratings 61
Enterprise Risk Assessment Report | 1
FOR USE BY THE CITY OF CUPERTINO ONLY
EXECUTIVE SUMMARY
As part of our internal audit workplan, Moss Adams LLP (Moss Adams) conducted a triennial enterprise risk assessment for the City of Cupertino (the City). An enterprise risk assessment provides a snapshot of the risk landscape at a specific point in time, reflecting current threats and vulnerabilities faced by the City. It is a recommended practice to regularly update an enterprise risk assessment to ensure that the City maintains an accurate and up-to-date understanding of its risk environment.
1 This enterprise risk assessment provides a way for the leadership of the City to measure uncertainty related to the City’s ability to achieve defined strategic objectives and operate effectively. Risks are identified, analyzed, and measured by the level of inherent vulnerability, the level of preparedness to mitigate them, and the impact such negative events could have on the City should they occur. This assessment evaluates risk across 19 categories. This engagement took place between December 2023 and May 2024.
For each risk category, our assessment includes an overview of each risk condition, including the current risk level, likelihood, impact, preparedness, and trajectory (defined in the table below). Risk mitigation identifies potential strategies to reduce overall risk for each category. The residual risk level represents the probable risk exposure after mitigation efforts are implemented. These elements make up the risk assessment framework, which is guided by the Committee of Sponsoring Organizations of the Treadway Commission’s (COSO) Enterprise Risk Management (ERM) methodology. The COSO framework is supported by the Institute of Internal Auditors (IIA), American Institute of Certified Public Accountants (AICPA), and American Accounting Association (AAA).
RISK LEVEL Level of uncertainty that could impair functions and processes, in the absence of any actions taken to alter either the risk’s likelihood or impact.
LIKELIHOOD Qualitative assessment of the probability of a negative event occurring, given the current risk conditions.
IMPACT Level of potential impact of a negative event on strategy, people, operations, systems, and resources.
PREPAREDNESS Level of preparedness through activities and resources to manage risks and minimize and limit potential losses.
TRAJECTORY Trajectory of the risk level, given the current risk conditions.
1 Committee of Sponsoring Organizations of the Treadway Commission. 2012. “Risk Assessment in Practice.” Accessed April 8, 2024: https://www.coso.org/_files/ugd/3059fc_cdb2016e5bf64213a5ca726b7846856d.pdf
Enterprise Risk Assessment Report | 2
FOR USE BY THE CITY OF CUPERTINO ONLY
RISK MITIGATION Potential strategies for reducing risk.
RESIDUAL RISK Possible remaining exposure after known risks have been mitigated through specific actions.
The assessment evaluates the City’s risks across 19 categories. The table below presents the summary results of the assessment.
RISK CATEGORY IMPACT LIKELIHOOD PREPAREDNESS TRAJECTORY High Risk
Funding and Economics High High Moderate to High Flat
Moderate to High Risk
Capital Improvement
Program Moderate to High Moderate Low to Moderate Increasing – Low Compliance and
Financial Reporting Moderate Moderate to High Low to Moderate Flat Human Resources High Moderate to High Moderate Increasing – Low Planning and Strategy Moderate Moderate to High Moderate Increasing – Low Moderate Risk
Asset Management Moderate to High Moderate Moderate Flat Governance Moderate to High Moderate Moderate Decreasing – Low Internal Controls Moderate Moderate Moderate Flat
Management and
Leadership Moderate Moderate to High Moderate Flat
Operations and Service
Delivery Moderate to High Moderate Moderate Flat
Organization and
Staffing Moderate to High Moderate Moderate Increasing – Low Policies and Procedures Moderate Moderate Moderate Flat Procurement and
Contracting Moderate Moderate to High Moderate Decreasing – Low
Enterprise Risk Assessment Report | 3
FOR USE BY THE CITY OF CUPERTINO ONLY
RISK CATEGORY IMPACT LIKELIHOOD PREPAREDNESS TRAJECTORY Reputation and Public
Perception Moderate Moderate Moderate Increasing – Low
Risk Programs Moderate to High Moderate Moderate Flat
Low to Moderate Risk
Accounting and Finance Moderate Low to Moderate Moderate Flat Ethics and Fraud,
Waste, Abuse Moderate
Low to Moderate Moderate to High Decreasing – Low
Information Technology Moderate to High Low to Moderate Moderate to High Flat Public Safety and
Security Moderate
Low to Moderate Moderate Flat
Enterprise Risk Assessment Report | 4
FOR USE BY THE CITY OF CUPERTINO ONLY
INTRODUCTION
The City engaged its internal auditor, Moss Adams LLP (Moss Adams), to conduct an independent enterprise risk assessment to analyze the City’s overarching areas of risk. Periodically conducting an enterprise risk assessment enables the City to monitor risk over time, as well as identify emerging risks, and prioritize the implementation of mitigation strategies to address the most critical areas. The enterprise risk assessment process followed conventional ERM methodology as defined by COSO and embraced by IIA.
The Moss Adams team evaluated 19 categories of risk that collectively comprise operations across the organization. Risk assessment procedures include identifying the current levels of risk, the likelihood of a negative event occurring, the impact of a negative event, and the level of preparedness in terms of mitigating negative events. All City departments were included in the risk assessment process. This assessment incorporates information provided by City Council members, senior leadership, managers, supervisors, and staff.
The enterprise risk assessment process reflects a specific point in time. This engagement was conducted between December 2023 to May 2024. Both the overall risk ratings and trajectory levels are directly connected to this timing.
The enterprise risk assessment process consists of four phases: 1) planning, 2) fact finding, 3) analysis, and 4) reporting. Planning included requesting documents, identifying which individuals to interview, and timing the all-staff survey. Fact finding encompassed document review, analysis of existing data, interviews, and an online survey sent to City employees. Analysis included assessment of the level of uncertainty associated with each risk factor, including the potential for impact on the City’s operations. Reporting entailed the development of draft and final deliverables as well as follow- up discussions with management and presentation to key stakeholders.
The activities and goals for each phase are described in detail below.
PLANNING
We began planning our assessment by requesting a standard set of doc
uments and data from the City, including (but not limited to) prior risk assessments, audits, public website documents, and financial reports. We used these documents to identify individuals to interview and additional document needs based on business processes and functional areas.
Enterprise Risk Assessment Report | 5
FOR USE BY THE CITY OF CUPERTINO ONLY
FACT FINDING
Fact finding encompassed r eviewing documents received, interviewing employees and City Council members, and soliciting employee feedback via an online survey. During this phase, we gathered information to gain a clear understanding of the City’s processes and the way it operates to achieve its goals and purpose.
ANALYSIS
With the information collected and compiled, we performed a risk analysis t
hat included a comprehensive review and evaluation of the various categories of risks. This analysis included assessing current risk conditions and trajectory, the level of preparedness efforts to mitigate risks, and the probability and potential impact a negative event may have on the City’s ability to achieve its mission, vision, and strategic goals.
REPORTING
During the reporting phase, we developed preliminary observations to v
erify facts. Preliminary observations were reviewed with City leadership and feedback incorporated into the draft report. The draft report was developed and submitted to City leadership for review. Based on feedback, we finalized the report for delivery to City leadership and presentation to the Audit Committee.
The enterprise risk assessment process relies on data and documents obtained from the City. By design, the assessment process requires access to all senior leadership and many department and division managers. Full disclosure of information has been assumed in this process.
The process to identify and assess risks considers both internal and external factors. As part of this risk assessment, Moss Adams used a variety of techniques, both qualitative and quantitative, to identify external and internal factors that contribute to risk. Risk assessments involve a dynamic and iterative process to identify and analyze risks to the City’s ability to achieve its objectives, forming a basis for determining how risks should be managed.
For each of the risk categories assessed, our risk assessment includes an overview of the risk condition at the City, including the current risk level, likelihood, impact, preparedness, and trajectory (defined in the table below). Risk mitigation identifies potential strategies to reduce overall risk for each category, and residual risk represents the probable risk exposure after risk mitigation efforts have been implemented. The elements outlined below make up the risk assessment framework and are industry standard as defined by COSO’s ERM methodology.
Enterprise Risk Assessment Report | 6
FOR USE BY THE CITY OF CUPERTINO ONLY
RISK LEVEL
Level of uncertainty that could impair functions and
processes, in the absence of any actions taken to
alter either the risk’s likelihood or impact.
● Low
● Low to Moderate
● Moderate
● Moderate to High
● High
IMPACT
Level of potential impact of a negative event on
s
trategy, people, operations, systems, and
resources.
● Low
● Low to Moderate
● Moderate
● Moderate to High
● High
LIKELIHOOD
Qual itative assessment of the probability of a
negative event occurring, given the current risk
conditions.
● Low
● Low to Moderate
● Moderate
● Moderate to High
● High
PREPAREDNESS
Level of preparedness through activities and
r
esources to manage risks and minimize and limit
potential losses.
● Low
● Low to Moderate
● Moderate
● Moderate to High
● High
TRAJECTORY
Trajectory of the risk level, given the current risk
conditions.
● Decreasing – High
● Decreasing – Low
● Flat
● Increasing – Low
● Increasing – High
RISK MITIGATION
Potential strategies for reducing risk. B ased on the current risk conditions
RESIDUAL RISK
Possible remaining exposure after known risks have
been
mitigated through specific actions.
● Low
● Low to Moderate
● Moderate
● Moderate to High
● High
For each risk factor category, Moss Adams assigned an overall risk rating. The risk levels are intended to provide City leadership with a means of prioritizing remediation efforts. Definitions of each level of risk, impact, likelihood, preparedness, and trajectory are provided in the following tables.
Enterprise Risk Assessment Report | 7
FOR USE BY THE CITY OF CUPERTINO ONLY
RISK LEVEL DEFINITIONS
Risk Significance
High Represents significant risks that should be addressed immediately.
Moderate to High Represents serious risks that should be addressed expeditiously.
Moderate Represents moderate risks that should be addressed as soon as reasonably possible.
Low to Moderate Represents ordinary risks that should be addressed during the next review cycle.
Low Represents a minor threat to the organization.
IMPACT LEVEL DEFINITIONS
Impact Significance
High Threatens the success of the organization/service delivery.
Moderate to High Substantial impact on time, cost, or quality.
Moderate Notable impact on time, cost, or quality.
Low to Moderate Minor impact on time, cost, or quality.
Low Negligible impact.
LIKELIHOOD LEVEL DEFINITIONS
Likelihood Significance
High Almost certain to occur with current risk conditions.
Moderate to High Very likely to occur with current risk conditions.
Moderate Likely to occur with current risk conditions.
Low to Moderate May occur with current risk conditions.
Low Unlikely to occur with current risk conditions.
Enterprise Risk Assessment Report | 8
FOR USE BY THE CITY OF CUPERTINO ONLY
PREPAREDNESS LEVEL DEFINITIONS
Preparedness Significance
Low Minimal risk preparedness activity.
Low to Moderate Preliminary risk preparedness efforts have been initiated, though few, if any, have been implemented.
Moderate Deliberate risk preparedness efforts are underway; important gaps remain.
Moderate to High Risk preparedness efforts are well-established, documented, and stable.
High Risk preparedness activities are robust and likely to be sustained, with readily available evidence attesting to this level of achievement.
TRAJECTORY DEFINITIONS
Trajectory Significance
Increasing – High Inherent risk is increasing significantly in current conditions.
Increasing – Low Inherent risk is increasing somewhat in current conditions.
Flat Inherent risk is holding steady in current conditions.
Decreasing – Low Inherent risk is decreasing somewhat in current conditions.
Decreasing – High Inherent risk is decreasing significantly in current conditions.
The external environment can have a significant impact on the City's enterprise risk profile by introducing risks and uncertainties that may affect the City's operations and goals; however , these factors are not necessarily within the City’s ability to control or influence. For example, some of the key factors that may influence the external environment and, therefore, the enterprise risk assessment for the City include:
• Economic Conditions: Prevailing economic conditions, such as inflation, interest rates, and market fluctuations, can impact financial health, revenue streams, and investment opportunities. • Political Climate: The political climate can also affect risk exposure. For example, changes in local, state, or federal laws and regulations can create new compliance obligations or financial penalties.
• Natural Disasters and Climate Change: Natural disasters, such as floods, hurricanes, or earthquakes, can significantly impact the infrastructure and operations. • Social and Demographic Changes: Changes in population demographics and social trends can also affect the risk assessment. For example, an aging population may require more health care services, and changes in consumer preferences may impact the City's tourism industry.
Enterprise Risk Assessment Report | 9
FOR USE BY THE CITY OF CUPERTINO ONLY
Several significant trends have emerged at the national level that influence the City’s risk profile.
Economically, inflation rates have risen steadily, driven by global supply chain disruptions and increased consumer demand, posing challenges for cities in managing budgets and funding priorities.
Additionally, legislative and regulatory changes have been notable, with new environmental regulations and infrastructure investment initiatives impacting planning and compliance requirements.
Extreme weather events, including hurricanes, wildfires, and floods, have intensified due to climate change, emphasizing the urgency to invest in infrastructure resilience and emergency response capabilities. Demographic shifts have continued, characterized by ongoing urbanization and an aging population, influencing service demand for health care, housing, and social services within cities.
These national trends underscore the importance for cities to regularly update their risk assessments to account for evolving external factors and develop adaptive strategies to mitigate potential risks and capitalize on emerging opportunities. Prominent at the time of this report was the revenue shortfall resulting from a state audit (see Funding and Economics ).
Compared to 2020, the 2024 risk assessment results show that 42% of the City’s risk categories have remained flat in their risk rating. There has been an increase in risk rating for 32% of categories, and 26% of categories have decreased in their risk rating. Increased risk ratings are largely driven by the change in the City’s financial situation, while decreased risk is due to the City’s efforts in the intervening years to deploy risk mitigation strategies. This has involved additional studies over the past three years to address areas of risk, including an Enterprise Leadership Assessment, Budget Review, Capital Program Effectiveness Study, and Procurement Operational Review.
The following table presents the results from the 2020 assessment alongside the 2024 results.
SUMMARY OF RISK LEVEL RATING CHANGES
RISK CATEGORY 2020 RISK LEVEL 2024 RISK LEVEL CHANGE Funding and Economics Moderate High
Capital Improvement Program Moderate Moderate to High
Compliance and Financial Reporting Moderate Moderate to High Human Resources Moderate to High Moderate to High
Planning and Strategy Moderate to High Moderate to High Asset Management Low to Moderate Moderate
26% 42% 32%
Decreasing Flat Increasing
Enterprise Risk Assessment Report | 10
FOR USE BY THE CITY OF CUPERTINO ONLY
RISK CATEGORY 2020 RISK LEVEL 2024 RISK LEVEL CHANGE Governance High Moderate
Internal Controls Moderate Moderate
Management and Leadership Low to Moderate Moderate
Operations and Service Delivery Moderate Moderate
Organization and Staffing Moderate Moderate
Policies and Procedures Moderate to High Moderate
Procurement and Contracting High Moderate
Reputation and Public Perception Low to Moderate Moderate Risk Programs Moderate Moderate
Accounting and Finance Low to Moderate Low to Moderate
Ethics and Fraud, Waste and Abuse Moderate Low to Moderate Information Technology Moderate to High Low to Moderate Public Safety and Security Low to Moderate Low to Moderate
Distribution of a risk assessment survey offers staff the opportunity to identify perceived strengths and weaknesses of the City, which helps us assess potential opportunities for improvement and identify areas of specific vulnerability. The survey poses a variety of statements to employees, including rating scale questions as well as open-ended questions for each risk category. The confidential questionnaire was distributed to employees and was open for submission betwee n January 29 and February 8, 2024. Out of the 198 full-time employees invited to take the survey, 92 individuals submitted responses to the survey (a participation rate of 46%). Survey responses are noted in each section, while respondent demographics and overall risk ratings are included in Appendix A of this report.
While survey responses were considered as part of the overall context for each category, staff ratings for each category are not used as a formal component of the final risk rating. Rather, they provide additional context, a means to understand staff sentiment, and a method to identify trends occurring across departments.
Enterprise Risk Assessment Report | 11
FOR USE BY THE CITY OF CUPERTINO ONLY
RISK CATEGORY RISK ASSESSMENT
EMPLOYEE SURVEY
RESULTS
Accounting and Finance Low to Moderate Moderate
Asset Management Moderate Low
Capital Improvement Program Moderate to High Low to Moderate Compliance and Financial Reporting Moderate to High Low to Moderate Ethics and Fraud, Waste, Abuse Low to Moderate Low
Funding and Economics High Moderate to High
Governance Moderate Moderate
Human Resources Moderate to High Low
Information Technology Low to Moderate Low
Internal Controls Moderate Not Surveyed
Management and Leadership Moderate Moderate to High
Operations and Service Delivery Moderate Low to Moderate Organization and Staffing Moderate Moderate
Planning and Strategy Moderate to High Moderate
Policies and Procedures Moderate Moderate
Procurement and Contracting Moderate Moderate
Public Safety and Security Low to Moderate Low
Reputation and Public Perception Moderate Low
Risk Programs Moderate Low
Enterprise Risk Assessment Report | 12
FOR USE BY THE CITY OF CUPERTINO ONLY
RISK ASSESSMENT RESULTS
For each of the risk categories assessed, our risk assessment includes an overview of the risk condition, including the levels of overall risk, impact, likelihood, preparedness, and trajectory of the risk conditions. We identified potential risk mitigation strategies intended to reduce overall risk for each category. The residual risk level represents the probable risk exposure after risk mitigation efforts are implemented.
Results are grouped by overall risk level, in order of highest to lowest. The levels and corresponding color coding for each risk condition, impact, likelihood, preparedness, and trajectory are represented in the table below. Definitions of the risk category components are addressed in the Risk Assessment Framework section of this report.
Impact
Likelihood
Preparedness
Trajectory
High High Low Increasing – High
Moderate to High Moderate to High Moderate to High Increasing – Low Moderate Moderate Moderate Flat
Low to Moderate Low to Moderate Moderate to High Decreasing – Low Low Low High Decreasing – High
OVERALL RISK LEVEL: HIGH
Impact
Likelihood
Preparedness
Trajectory
HIGH HIGH MODERATE TO HIGH FLAT
Risk Mitigation
● Continue to pursue expenditure and service reductions to achieve a balanced budget for fiscal year (FY) 2025 without the use of reserve funds. ● Continue to explore opportunities to diversify revenues and optimize the City’s revenue strategy.
● Create a Citywide grant strategy to fully leverage grant funding opportunities (see also Capital Improvement Program).
RESIDUAL RISK: MODERATE
Enterprise Risk Assessment Report | 13
FOR USE BY THE CITY OF CUPERTINO ONLY
Risk Areas: Risks associated with revenue sources, funding levels, cash management, liquidity, expenditure rates and commitments, debt management, and inter-organizational business.
Scope: The funding and economic factors that impact the organization’s ability to maintain operations and deliver programs and services. Whether within the organization’s realm of influence (or outside of their control), the funding and economic factors impact the organization’s long-term fiscal stability as well as its ability to mitigate the negative impacts of extraordinary risk such as regional changes and national economic volatility.
The City has historically maintained a structurally sound budget, with revenues surpassing expenditures in most FYs. Additionally, the City has several controls in place to reduce funding and economic risks, including the following:
• The City develops medium-term and long-term financial forecasts as part of the budget process to help identify potential structural budget issues in advance and adjust as needed. The City also has a long-term financial stability policy that sets requirements for long-term financial planning for technology automation, revenue and expenditure forecasting, and decreasing expenditure and risk exposures.
• The City has an established reserves policy that requires a set dollar amount of reserves be maintained for various needs, including economic uncertainty, pension obligations, capital projects, sustainability, and other unassigned needs. Reserves reduce risks associated with unexpected revenue shortfalls or expenses.
• The City’s budget includes contingency funds that cover maintenance and operational funding for Public Works, as well as contingency funds for disaster response.
Based on the City’s FY24 budget, the City’s General Fund revenues are primarily reliant on property tax (40%), charges for service (15%), sales tax (14%), and transient occupancy tax (9%). Estimated sales tax revenues decreased 64.2% from FY23 when they represented 34% of the City’s General Fund revenues. This shift was due to a 2023 audit by the California Department of Tax and Fee Administration (CDTFA) that altered the sales tax revenue received by the City. As a result of the CDFTA’s audit decision, the City is estimated to experience an ongoing 73% ($30 million/year) decline in sales tax revenue. In addition to the annual decline in sales tax revenue, the CDTFA audit may call for the City to return sales tax revenue.
The City was able to manage the revenue shortfall resulting from the CDTFA audit in the short term by relying on its reserves. In FY24 the City’s adopted general fund budget of $86.1 million was funded with about $5.8million in one-time funds. However, based on the FY24 budget, the ongoing drop in sales tax revenue has put the City in a structural deficit, meaning ongoing expenses are projected to exceed ongoing revenue. The use of reserves to close the structural deficit is not sustainable in the long term. Additionally, the City’s Balanced Budget Policy requires the City to only deploy reserves with a plan to return to structural balance.
Balanced Budget Plan
To return to structural balance, the City plans to cover 85% of the expected $30 million in reduced annual sales tax revenue through expenditure reductions, including $15 million in reductions through the selective elimination of vacant positions, decreased transfers from the General Fund to other funds, use of the City’s Section 115 Trust to fund Other Post-Employment Benefits/Retiree Health (OPEB) costs, and other expenditure decreases. The remaining $15 million in reductions is expected
Enterprise Risk Assessment Report | 14
FOR USE BY THE CITY OF CUPERTINO ONLY
to be achieved through service-level reductions, such as reductions to operations and maintenance, infrastructure, technology improvements, community events, and potential revenue generation measures or fee increases. The strategies to fully address the structural deficit are actively in development, meaning that the budget deficit has not yet been resolved. This is the main driver of the increased risk rating in this area compared to the 2020 risk assessment.
To address the structural deficit, the City also explored opportunities to diversify and optimize its revenue sources, specifically increased taxes. After community polling indicated limited community support for increased taxes, the City Council unanimously voted to stop exploring ways to create new taxes or increase taxes in February 2024.
The City also completed a fee study in January 2024, which determined the City was under - recovering its costs by approximately 12%. In May 2024, City Council adopted a revised fee schedule for FY25 to better recover costs. Several interviewed staff also noted there may be opportunities for the City to explore additional grant opportunities to support financial needs, such as those related to capital improvements (see also Capital Improvement Program ); however, the City does not have a
Citywide grant strategy in place to fully capitalize on potential grant opportunities.
Staff Perceptions
The impacts of the CDTFA audit have somewhat impacted employees’ outlook on the City’s financial future. Most survey respondents (64%) rated the current trajectory of the City’s financial future as poor (54%) or terrible (10%). Survey responses reflect staff’s attitudes at a particular moment in time in early 2024, when the revenue shortfall was relatively new information. At the time of this report’s finalization, management shared the belief that there is now reason to be cautiously optimistic because the full monetary impact of the CDTFA audit on the City’s budget is now clear and t he City is actively developing strategies to adapt its budget to the new reality (see also Accounting and
Finance).
Q: How would you rate the current trajectory of the City's financial future?
7% 29% 54% 10%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 15
FOR USE BY THE CITY OF CUPERTINO ONLY
OVERALL RISK LEVEL: MODERATE TO HIGH
Impact
Likelihood
Preparedness
Trajectory
MODERATE TO HIGH MODERATE LOW TO MODERATE INCREASING – LOW
Risk Mitigation
● Develop a long-range Capital Improvement Program (CIP) to strategically guide capital improvement investments.
● Develop a standardized and transparent process to prioritize CIP projects. ● Create a Citywide grant strategy to fully leverage grant funding opportunities, including for CIP projects (see also Funding and Economics).
RESIDUAL RISK: LOW TO MODERATE
Risk Areas: Risks associated with CIP, including planning, financing, construction, close-out, and capital asset management (including preservation and maintenance), tracking, reporting, accountability, and inventory.
Scope: In construction, issues of risk are closely tied to schedule, site unknowns, and budget issues. In addition, construction contracts must be monitored to ensure full compliance with equal employment opportunity, discrimination, prevailing wage, and fair labor standards laws.
The CIP Division plans, manages, and implements improvements to City land, parks, buildings , and infrastructure, and ensures that all public improvements are designed and constructed in alignment with community expectations and City standards. The CIP Division is within the City’s Public Works department and includes a budgeted staff of 5.8 full-time equivalent (FTE) positions (as of FY24).
Each year, the CIP Division develops a schedule of proposed capital improvement projects ranked by priority that includes an estimate of project costs and financing sources. The annual CIP plan and budget are reviewed and approved by the City Council.
In 2022, a Capital Program Review found that although the City’s capital planning process is well- defined, it lacks two industry-standard best practices: 1) a long-range CIP plan and 2) a standardized project prioritization process. These two conditions still exist and are the main drivers of risk in this area.
• Long-Range CIP Plan: The Annual CIP Budget document focuses on the current FY. While it includes existing projects with multi-year funding that are intended to be in progress or completed over the course of the next five years, the plan does not provide a clear view of the City’s planned capital improvements beyond the upcoming year. The document does not include planning for projects starting in later years and does not maintain future estimates of CIP project impacts on the City’s operating budget.
Enterprise Risk Assessment Report | 16
FOR USE BY THE CITY OF CUPERTINO ONLY
It is industry best practice for municipalities to develop a long-term (three to five years) CIP plan2.
A long-term CIP plan enables the City to be more strategic when prioritizing and planning for upcoming projects and is designed to be amended on an annual basis. The lack of a long- term CIP plan can make it challenging for the City to develop a comprehensive long-range estimate of its unfunded CIP projects. Additionally, it may be more difficult to establish a strategic direction for capital spending, efficiently use resources, and identify opportunities to leverage funding from external sources, such as grants or partnerships. City staff shared the intention to eventually move to the development of a multi-year CIP; however, the budget shortfall has made multi-year budgeting exceptionally difficult.
• Standardized Project Prioritization Process: The selection of CIP projects is informed by needs identified in various planning documents and an annual process by which individual departments submit project requests. Projects are then prioritized by the CIP Division staff who evaluate various factors, including health and safety, available funding and grant opportunities, and political and community interest. High-priority projects are then submitted to City Council for approval. While the CIP Budget document lists several principles for project evaluation, the City has not yet adopted a standardized or quantitative set of evaluative criteria to guide the prioritization process. Over half of survey respondents rated the processes used to identify and prioritize CIP projects as average (39%), poor (16%), or terrible (3%). • Without a clear process in place for prioritization, the City may not be able to effectively prioritize critical infrastructure needs or maintenance projects that could extend the life of the City’s current assets. In light of future constraints to City resources, including staff and funds, it will become more important for the City to develop a robust project prioritization process.
Q: How would you rate the processes the City uses to identify and prioritize capital improvement projects?
The 2022 Capital Program Review also noted that the City had not yet developed a comprehensive grant strategy to take advantage of CIP funding opportunities outside of City revenues. While grant funding is currently being used on CIP projects, developing a standard approach would enable the City to take advantage of large multi-year grant funding sources and would add stability to CIP funding.
2 Government Finance Officers Association. 2008. “Master Plans and Capital Improvement Planning.” Accessed April 25, 2024:
https://www.gfoa.org/materials/master-plans-and-capital-improvement-planning 42% 39% 16% 3%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 17
FOR USE BY THE CITY OF CUPERTINO ONLY
OVERALL RISK LEVEL: MODERATE TO HIGH
Impact
Likelihood
Preparedness
Trajectory
MODERATE MODERATE TO HIGH LOW TO MODERATE FLAT
Risk Mitigation
● Continue efforts to update policies and procedures to reduce compliance- related risks.
● Continue efforts to improve compliance-related training. ● Review financial reporting and related processes to identify opportunities for streamlining and improving processes.
● Implement improved grants management controls, including documented policies and procedures, increased training, and effective tracking processes.
RESIDUAL RISK: LOW TO MODERATE
Risk Areas: Risks associated with compliance with laws, regulations, and requirements. Also, risks associated with financial reporting (content, distribution, assembly, utilization, frequency, formatting, accuracy, and reliability).
Scope: Risks organizations face when they are unable to follow internal policies, government laws, and regulations, which may be subjected to legal penalties and financial fines. Financial reporting includes deliverables such audited annual financial statements. Reliable financial information is fundamental to planning, budgeting, pricing, evaluating vendor performance, assessing partnerships, and a range of other operational and strategic activities.
Cities are expected to remain in compliance with a large and growing number of laws and regulations, including but not limited to requirements related to financial statements, labor, health and safety, and the environment. Failure to meet compliance regulations can lead to a variety of consequences ranging from legal penalties to financial loss to reputational damage. As is common in most organizations, compliance at the City is managed by a combination of departments and individuals depending on the specific area of compliance. Key departments involved in ensuring the City remains compliant with laws and regulations include the City Attorney’s Office, Finance, HR, and IT.
Effective compliance management requires both clearly defined and up-to-date policies and procedures and regular staff training and education. While the City has taken action to improve its policy and procedure environment since 2020 (see also Policies and Procedures ), t here are key
policy and procedure gaps that are important to reduce compliance-related risks, including the following:
• T he City’s Administrative Rules and Regulations of the Personnel Code have not been updated since 2013, though staff reported updates have been drafted and are under review (see also Human Resources).
• The City adopted a City Council Grant Policy that does establishes Council authority for the application, acceptance, and reporting of grants. However, the City has not yet adopted comprehensive grants management policies and procedures to ensure that grants are managed
Enterprise Risk Assessment Report | 18
FOR USE BY THE CITY OF CUPERTINO ONLY
efficiently, effectively, and in compliance with relevant rules and regulations. Staff is currently working on documenting grants management policies and procedures, but these have not yet been finalized. Grants management policies and procedures are important to promote compliance with grants and other financial reporting requirements.
In addition to policies and procedures, regular training and education can help increase awareness and understanding of compliance requirements and reduce the risk of unintentional violations. Staff reported the City recently improved processes for tracking staff completion of required compliance- related training, such as mandatory safety training. However, 34% of surveyed employees reported that the quality of training and resources provided to stay abreast of compliance concerns was average. Since all employees share responsibility for compliance and any employee’s actions or decisions can have compliance implications, it is important for compliance-related training to be comprehensive and high quality. Surveyed employees suggested that training could be improved by expanding the training offered internally rather than from regional or state sources and offering guidance and training related to grant management and adherence to grant requirements.
Q: How would you rate the quality of resources/training provided at the City about how to remain in compliance with laws, regulations, and requirements?
Total equals 101% due to rounding.
Of survey respondents, only 36% of employees reported confidence that the City is unlikely to experience an issue with compliance in the next year. This indicates there may be a lack of confidence among some employees in the City’s compliance management process or that staff are not fully aware of compliance management processes. It can also be attributed to the changing regulatory environment at the federal and state levels, which is outside of the City’s control.
Uncertainty is often a driver of heightened feelings of risk. As noted above, awareness is a critical component of effective compliance management.
Q: What are the chances that the City will experience any issue with compliance (late or missed reporting, noncompliance with safety requirements, breach of sensitive data, etc.) in the next year?
Financial Reporting
Cities are subject to a variety of laws and regulations that are designed to ensure transparency, accuracy, and accountability in financial reporting. The City’s most recent published Single Audit (FY22) found the City did not have proper internal controls in place to ensure appropriate segregation 7% 42% 34% 16% 2%
Excellent Good Average Poor Terrible
11% 25% 38% 23% 3%
Extremely unlikely Somewhat unlikely Uncertain Somewhat likely Extremely likely
Enterprise Risk Assessment Report | 19
FOR USE BY THE CITY OF CUPERTINO ONLY
of duties between report preparation and approval or timely filing of financial reports in compliance with federal regulations for American Rescue Plan Act (ARPA) funding. Such issues can lead to the City being noncompliant with laws, regulations, and the terms and conditions of federal grant awards.
In response to this finding, the City added additional staff to the Treasury COVID-19 Relief Hub to address segregation of duties and staffing needs and began a Finance team group email to ensure that staff receive reminder emails on reporting deadlines. Strengthening grant management policies and procedures and using a consistent grant management tracking system would also strengthen controls in this area.
Some employees also reported that the City’s financial system limits the effectiveness of the City’s financial reporting. The system is not intuitive and there is not sufficient training available to navigate it, which can make financial reporting a more difficult process. A system replacement was planned but has been postponed due to budget cuts. The Finance Department is working on updated Standard Operating Procedures for financial reporting to improve challenges in this area.
Timeliness of financial reporting is also important for cities to reduce risks related to compliance and to support informed decision-making. Overall, survey respondents rated the timeliness of financial information as excellent (10%), good (35%), or average (38%).
Q: How would you rate the timeliness of the financial information you receive (e.g. , reports, response time to requests, etc.)?
Total equals 99% due to rounding.
Grant Management
As discussed in Funding and Economics, although grant funding is not a significant portion of the City’s overall revenue, it is likely that it will become an increasingly important source of revenue as the City aims to achieve a balanced budget in the future.
Grant management in the City is decentralized. Grant management, including identification, application, and administration, is tracked by individual departments. Reporting on program performance and grant compliance is conducted by individual departments. Financial reporting on grants is conducted by the Finance Division. Successful decentralization relies on comprehensive, accessible, and updated policies and procedures in addition to strong internal controls.
As noted above, the City does not have documented grants management policies and procedures, which are important to promote compliance with grants and other financial reporting requirements.
The City also lacks a grant management tracking system to support effective tracking of grant activities and compliance with grant requirements. Staff also reported concerns over individuals with limited experience in grant management being called upon to manage increasingly complex grants . 10% 35% 38% 11% 5%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 20
FOR USE BY THE CITY OF CUPERTINO ONLY
To mitigate risk in this area the City can implement improved grants management controls, including documented policies and procedures, increased training, and effective tracking processes. Staff note that access to in-house grant management training would be extremely helpful.
OVERALL RISK LEVEL: MODERATE TO HIGH
Impact
Likelihood
Preparedness
Trajectory
HIGH MODERATE TO HIGH MODERATE INCREASING – LOW
Risk Mitigation
● Maintain a one- to three-year schedule for updates to the Administrative Rules and Regulations of the Personnel Code.
● Continue to prioritize steps to mitigate turnover, including at the manager level. ● Develop the performance appraisal process to incorporate employee goals and growth plans and to move away from a paper-based process. ● Continue pursuing formal opportunities for employees to provide upstream or 360 evaluations.
● Prioritize retaining professional development opportunities. ● Provide formal management training to new managers and supervisors. ● Consider using a centralized training management system to track training requirements, schedules, and completions throughout the City. ● Develop formal cross-training and succession planning guidance. ● Develop strategies for diversifying the City’s workforce.
RESIDUAL RISK: MODERATE
Risk Areas: Risks associated with labor management/contracts, employee performance, training, compensation, benefits, turnover, grievances, overtime, resource availability, and communication.
Scope: Human capital and resource practices can span functions, including hiring, orientation, training, evaluating, counseling, career planning, compensation and benefits, and housing the policies that define an organization’s expected levels of integrity, ethical behavior, and competence.
Human Resources (HR) has 5.3 budgeted FTEs in FY24, including an HR Manager, two HR Analysts, and two HR Technicians. HR is responsible for the administration of all personnel -related programs, employee benefits, labor relation programs, risk management, safety and wellness, and a self-insured workers’ compensation program. Most survey respondents (76%) reported HR customer service as excellent or good, indicating high levels of satisfaction with the team.
Enterprise Risk Assessment Report | 21
FOR USE BY THE CITY OF CUPERTINO ONLY
Q: How would you rate the quality of internal customer service provided to staff by the HR Department?
Total equals 99% due to rounding.
Personnel Policies and Procedures
The Administrative Rules and Regulations of the Personnel Code contain key personnel policies and procedures, including but not limited to those related to classification, recruitment, performance, discipline, grievances, and equal opportunity. The policies were last updated in 2013, though staff reported updates were recently drafted and are being reviewed. It is best practice that policies and procedures be updated every one to three years (see Policies and Procedures).
Recruiting and Retention
The City’s overall turnover rate decreased from 14.9% in 2022 to 10.5% in 2023 (turnover data by department was not provided). The 2023 national average turnover rate for state and local governments (excluding education) was 1.6%.3 While a turnover rate around 10% is considered reasonable, the City’s 2023 turnover rate is higher than the national average. Staff shared that recent turnover may be due to concerns about layoffs in some departments due to budget reductions. As previously noted in the Funding and Economics section, the impacts of the CDTFA audit have impacted employees’ outlook on the City’s financial future. Employees who are concerned about organizational financial stability may be less engaged in their work and may be more motivated to seek employment elsewhere.
Retaining manager-level employees has reportedly been a particularly difficult challenge. The City’s management turnover rate is higher than its overall turnover rate, though it also decreased from 18% to 13% in 2023. Management-level turnover can have a significant impact in a relatively small organization where backup is usually limited. HR is taking steps to mitigate manager-level turnover, including recently working with the City Manager’s Office to conduct listening sessions with mid-level managers to discuss employee engagement, morale, and how to better support them.
The average recruitment timeline for all positions in 2023 was 88.2 days and the average recruitment timeline for manager-level positions and above was 81.8 days. This is comparable to other local governments. Still, just over half (52%) of surveyed employees rated the City’s recruitment processes and support as average or poor, though respondents did not provide additional detail as to why they responded this way. However, recruitment is an ongoing challenge for local governments nationally.
3 U. S. Bureau of Labor Statistics. Economic News Release, Table 20, Annual Average Total Separations Rates by Industry and Region, Not Seasonally Adjusted. Accessed April 25, 2024: https://www.bls.gov/news.release/jolts.t20.htm 43% 33% 21% 2%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 22
FOR USE BY THE CITY OF CUPERTINO ONLY
Q: How would you rate the City’s recruitment processes and support?
Compensation and Benefits
Approximately two-thirds (64%) of survey respondents report that the City’s compensation and benefits competitiveness was excellent or good. In the most recent compensation study that was completed in May 2022, the City was 2% above median total compensation on average. This suggests that the City’s pay scale may help recruit and retain highly qualified candidates , which provides a cascading benefit to the community.
Q: How would you rate the competitiveness of the City’s compensation and benefits?
Total equals 99% due to rounding.
Interviewed and surveyed staff shared their concern that the budget adjustments may impact employee compensation and benefits. If compensation and benefits were to stagnate, or the working environment became more difficult while trying to do more with less resources, many employees feel that the City would not be a competitive place to work. However, staff reported City leadership has prioritized funding additional compensation and benefits in the midst of financial uncertainty , including funding employee salary increases and covering increased employee medical insurance costs .
External factors are also affecting risk in this area. Insurance rates are rising industry -wide, making it difficult to maintain affordable rates. Employee medical fees sharply increased last year, though the City covered the cost for employees. Both changes may cause an increasing financial burden on employees to cover their own health benefits. As personnel-related costs rise and costs are shifted to employees, there is an increasing risk that turnover at the City may increase.
Performance Management and Accountability
We identified the following concerns related to the City’s performance management process:
• The City uses digital forms (in Adobe), but the process is not automated or supported by software that uses a seamless performance management environment. An automated performance management system can streamline the process, promote confidentiality, and improve transparency and accountability.
17% 29% 32% 20% 2%
Excellent Good Average Poor Terrible
19% 45% 19% 12% 4%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 23
FOR USE BY THE CITY OF CUPERTINO ONLY
• Performance appraisals do not incorporate a process for employees and supervisors to set goals and support employees’ accountability and growth. While many survey respondents reported the effectiveness of the performance evaluation process was at least moderately effective (66%), about one-third (34%) rated the process as only slightly effective or not effective at all. Without clear goals and expectations, employees may not know what is expected of them or how they can improve their performance, which can lead to employee disengagement and a loss of productivity.
• There are no formal opportunities to provide upstream or 360 evaluations, so management may not receive feedback from the staff they supervise. Some survey respondents mentioned that the City would benefit from the opportunity to provide upstream evaluations. Administrative Services is piloting a 360-degree evaluation program this year.
Q: How would you rate the effectiveness of the current performance evaluation system?
Training
The City provides mandatory training to all new employees and additional ongoing annual required training. City-provided training includes fraud, waste, and abuse; anti-harassment; cybersecurity; and required Occupational Safety and Health Administration (OSHA) training for Public Works Service Center employees. The City does not provide formal management training to new supervisors or managers, which is important to support new supervisors in understanding policies, policies, and legal requirements. Some efforts are being made to support the development of future leadership, including the City’s involvement with the San Mateo County Next Gen Committees and the Leadership Academy of Santa Clara.
The FY24 adopted budget included the reduction of professional development opportunities as an expenditure-cutting measure, including reduced Citywide training and conference attendance.
Surveyed employees had mixed responses when asked to rate their access to training and professional development resources needed to grow their careers. Limited training and development opportunities can lead to decreased employee morale and job satisfaction, which can ultimately impact employee retention and productivity.
Q: How would you rate your access to the training and professional dev elopment resources you need to grow your career?
23% 43% 27% 7%
Extremely effective Very effective Moderately effective Slightly effective Not effective at all 14% 33% 32% 13% 8%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 24
FOR USE BY THE CITY OF CUPERTINO ONLY
Training compliance is also contributing to the risk rating in this area. HR is currently developing a process to track mandatory compliance-related training Citywide. It is ideal to use a centralized training management system to track training requirements, schedules, and completions throughout the City. Such a system could be particularly helpful to support the City in tracking these trainings given the small size and limited resources of the HR team. Without such a system, the City is more susceptible to potential noncompliance with legal and regulatory requirements.
Succession Planning
As of January 2024, 36.4% (71) of the FTEs at the City were eligible for retirement in five y ears.
While eligibility for retirement does not necessarily indicate the likelihood of retiring, it’s important to continually monitor this metric. A growing proportion of retirement-eligible employees can present an increased risk to the City’s staffing and operational continuity. The City has not yet institutionalized succession planning or cross-training efforts, contributing to risk in this area. Without a deliberate, institutionalized program for effective knowledge management and transfer, a significant amount of institutional knowledge and technical expertise Citywide is at increased risk of being lost.
The recent slowdown in hiring personnel and possible future reductions to services have highlighted the importance of succession planning, cross-training, and ensuring that essential documentation is in place. Cross-training is currently at the discretion of individual managers.
Staff Demographics
Existing staff demographics tend to be somewhat reflective of the local community, but ideally, staff demographics would more closely mirror community demographics. Given the small size of the City’s staff, the percentage of staff diversity can be easily influenced by the hiring or departure of a small number of employees. A diverse staff can help to build trust and understanding between the City and the community and help ensure the City is providing equitable services to all residents. The data presented below is from the City’s website and the U.S. Census Bureau. 4 REPORTED GENDER COUNT PERCENTAGE SANTA CLARA
COUNTY
Female 71 37.6% 48.9%
Male 118 62.4% 51.1%
REPORTED RACE
COUNT
(MALE)
COUNT
(FEMALE)
COUNT
(TOTAL) PERCENTAGE
SANTA CLARA
COUNTY
Asian 22 27 49 25.9% 41.4%
Black 3 0 3 1.6% 2.9%
Decline to Answer 4 3 7 3.7% Not available
4 U.S. Census Bureau, Quick Facts Santa Clara County, California. Accessed May 22, 2024:
https://www.census.gov/quickfacts/fact/table/santaclaracountycalifornia,CA/SEX255222#SEX255222
Enterprise Risk Assessment Report | 25
FOR USE BY THE CITY OF CUPERTINO ONLY
Hispanic 31 12 43 22. 8% 24.7%
Two or More Races 4 1 5 2.6% 4.3%
White 54 28 82 43. 4% 28.3%
Source: FY2024 Adopted Budget
OVERALL RISK LEVEL: MODERATE TO HIGH
Impact
Likelihood
Preparedness
Trajectory
MODERATE MODERATE TO HIGH MODERATE INCREASING – LOW
Risk Mitigation
● Develop a multi-year strategic plan to identify long-term objectives, align resources, and provide greater organizational direction to both employees and residents.
● Promote tenure and stability in key leadership positions.
RESIDUAL RISK: LOW TO MODERATE
Risk Areas: Risks associated with how the organization plans for operations, strategy, and the future, including both short-term and long-range planning.
Scope: A comprehensive planning framework builds upon the strategic goals, and dives into the next layer of planning, which looks at the strategic objectives for not only the enterprise, but sets objectives for the departments, divisions, programs, and individual roles.
Planning documents are critical tools for guiding growth and development in a way that meets the needs of current residents while also preserving resources and opportunities for the future. The City has developed several guiding planning documents, including the City Work Program, which informs the major efforts of the City in any given year and the following year and the City’s General Plan 2015–2040, which describes the long-term goals for the City’s future related to land use and community design, transportation, housing, environmental resources, and health and safety. The City also has several emergency management-related plans, which include an Innovation Technology Disaster Recovery Plan, Emergency Operations Plan (EOP), and Local Hazard Mitigation Plan.
These plans provide the City with multi-year guidance and direction to help achieve Citywide goals, initiatives, and strategies.
To clarify priorities and inform decision-making, the City Council establishes overarching City goals every two years. Departments then develop associated work programs that supports those goals.
These work programs serve as guiding plans for departments, and outline project scopes, next steps, timelines, budgets, and responsibilities. In March 2023, City Council held a Goal Setting Workshop to
Enterprise Risk Assessment Report | 26
FOR USE BY THE CITY OF CUPERTINO ONLY
discuss Citywide goals and priorities that would be used as a roadmap for the next two years. At this workshop, Council reaffirmed their commitment to the following five goals first adopted in February 2020: Public Engagement and Transparency, Sustainability and Fiscal Strategy, Housing, Transportation, and Quality of Life.
Council goals are meant to lead Citywide strategic thinking. However, staff report there is not a strong sense of strategic direction and there is a lack of clarity on Citywide initiatives. In the 2020 ERA, the City’s lack of a multi-year strategic plan was identified as a significant gap in planning and strategy.
The City still has not developed a strategic plan that encompasses long-term initiatives, goals, and strategic decision-making. This limits the City’s ability to effectively plan and allocate resources and achieve its long-term vision; it also creates a risk that priorities will shift dramatically while medium- and long-term initiatives are still in progress. In a resource-constrained environment, careful strategic planning is even more important. Without a multi-year strategic plan, the City may be more vulnerable to short-term thinking and competing priorities, which can make it difficult to achieve its goals and objectives over the long term.
While the current City Manager has been in their role since August 2022 and the City is working toward increased leadership stabilization, turnover of key leadership positions can impact the effectiveness of planning efforts and disrupt the continuity of projects. Without stable leadership and a consistent vision, there is a heightened risk of strategic drift, where the City gradually veers off cours e from its long-term goals. This may lead to inefficiencies, missed opportunities, and a lack of alignment with community needs. When asked to rate the quality of organizational planning that happens at the City, responses varied with most participants responding average (40%). This may reflect a desire from staff to strengthen the City’s organizational planning environment.
Q: How would you rate the quality of organizational planning (strategic planning, annual operations planning, financi al planning, etc.) that happens at the City?
Total equals 101% due to rounding.
Key Performance Indicators
The City has key performance indicators (KPIs) for each department. These KPIs include an overall goal, the effects of that goal, and the purpose that goal may serve for residents. The City reports on these KPIs annually in the mid-year report and provides data comparison for two prior years. KPIs are crucial for cities in reducing risks because they enable early issue detection and data-driven decision- making. By monitoring KPIs, the City can efficiently allocate resources, hold departments accountable, and proactively address risks.
13% 28% 40% 13% 7%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 27
FOR USE BY THE CITY OF CUPERTINO ONLY
OVERALL RISK LEVEL: MODERATE
Impact
Likelihood
Preparedness
Trajectory
MODERATE TO HIGH MODERATE MODERATE FLAT
Risk Mitigation
● Continue to encourage standard use of Cityworks for asset management. ● Develop a plan to address deficiencies for facilities that received a poor rating in the Facility Condition Assessment.
● Develop a plan to address City Hall’s seismic deficiency, or to otherwise mitigate the risk of a seismic event.
RESIDUAL RISK: LOW TO MODERATE
Risk Areas: Risks associated with the ongoing maintenance, management, tracking, reporting, accountability, accounting, and physical safeguarding of assets, including the organization’s assets used in support of business processes (i.e., vehicles, mobile devices, IT equipment, etc.).
Scope: Asset management includes the supply, deployment, and maintenance of the organization’s resources. It also includes physical or logical access to data and locations (offices, warehouses, etc.). Asset management is inclusive of the connected strategies, processes, people, and technology that make up the foundation of enabling the organization to meet service levels and minimize the overall cost of asset ownership.
Asset Management
City operational divisions use Cityworks for asset management, based on a GIS-centric approach.
Although the tracking of small items such as tools and equipment was a concern in the 2020 ERA, staff report that progress has been made in this area, particularly the Citywide adoption of its asset management system. Improvements are ongoing and the focus has now moved to standardizing the asset and maintenance information that is being tracked and modifying the data input process to simplify operations.
Surveyed employees generally feel the City’s assets are well-tracked and accounted for and rated the condition and management of non-IT equipment highly.
Enterprise Risk Assessment Report | 28
FOR USE BY THE CITY OF CUPERTINO ONLY
Q: How well do you feel the assets of the City are tracked and accounted for?
Total equals 99% due to rounding.
Q: How would you rate the condition of the non- IT equipment you use for your job?
To reduce expenditures, staff are exploring options to defer non-essential asset management activities, such as increasing the standard fleet replacement schedule and reducing the level of sidewalk maintenance. While these changes may be necessary to balance the City’s budget, strategies like these may also put the City at risk for increased maintenance costs, decreased asset reliability, and public safety concerns, if the appropriate balance is not maintained.
Facility Conditions
The City’s facility conditions are the primary driver of the risk rating for this area. The City contracted with Kitchell Corporation to conduct a Facility Condition Assessment of City-owned and operated buildings in 2022. The assessment identified $4.8 million in Priority 1 capital renewal costs and $2.3 million in Priority 2 costs. This represented about 21% of the total capital renewal costs identified ($34.3 million). Included in the Priority 1 projects are $1.6 million in projects at City Hall, which received a poor condition rating, and $1 million in projects at the library.
City Hall received a poor condition rating in the 2022 assessment described above, and as noted in the 2020 ERA, previous engineering studies have indicated that City Hall’s structure is deficient in seismic force resistance. Additionally, concerns about the seismic safety of City Hall were a major theme in the staff survey. The City is in a seismically active region with several active earthquake faults. One of the longest and most active faults in the world, the San Andreas fault, crosses the western portion of the City. Interviewed City leadership reported that awareness of this issue is high, but building replacement is estimated between $60 million and $80 million, and a seismic upgrade is estimated between $20 million and $30 million. There are no projects planned to address the seismic deficiency, which impacts the City’s preparedness rating in this area.
City pavement and sidewalks are generally kept in good condition. The City inspects sidewalks regularly and catalogs required maintenance, which is addressed through an annual sidewalk maintenance program.
8% 39% 39% 13%
Extremely well Very well Moderately well Slightly well Not well at all 30% 50% 20%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 29
FOR USE BY THE CITY OF CUPERTINO ONLY
Deferred maintenance contributes to the risk rating in this area. The City reportedly has $63 million in deferred maintenance projects, but this may not include all deferred maintenance needs due to the City’s lack of a long-term CIP (see Capital Improvement Program). O ver time, the total cost of deferred maintenance will grow proportional to inflation and increased cost of goods and services.
This will make it more difficult for the City to effectively reduce its deferred maintenance.
OVERALL RISK LEVEL: MODERATE
Impact
Likelihood
Preparedness
Trajectory
MODERATE TO HIGH MODERATE MODERATE DECREASING – LOW
Risk Mitigation
● Uphold implementation of recently developed or revised governance-related documents, including the City Council Procedures Manual and the new ethics code.
● Continue implementing recommendations from the 2022 Grand Jury Report and 2023 Enterprise Leadership Assessment.
● Continue work to improve effectiveness and productivity of City Council meetings.
RESIDUAL RISK: LOW TO MODERATE
Risk Areas: Risks associated with ongoing oversight; ethics and values; control environment; policy management; risk management; accountability; performance management; coordination and communication; and defined roles, responsibilities, and authorities.
Scope: Governance incorporates all governance-related groups, processes, policies, and operations.
City residents elect officials to provide community leadership and govern the administration of public services. The City operates under a Council-Manager form of government, directed by a five-member City Council. Under this form of government, the City Council sets policy, while a professional City manager is responsible for implementing those policies and managing day-to-day operations of the City.
Council elections take place every two years, with Council members serving staggered four -year terms. The City established a City Council Procedures Manual ( the Manual) in 2023 to define bylaws and procedures related to Council operations and activities. The Manual supports clarity in Council processes, roles, and responsibilities and reflects the City’s ongoing efforts to enhance governance.
The City Council approved additional revisions to the Manual in March 2024 to clarify procedures related to attendance, reporting, consent calendar, and Council questions and deliberations.
The duration of City Council meetings has historically been a challenge for Council mem bers, City staff, and community participants alike. Long meetings, characterized as those extending greater than five hours, or past midnight, that impact staff capacity and productivity, are less accessible to members of the public, and may signal a governing body that operates at a tactical level rather than
Enterprise Risk Assessment Report | 30
FOR USE BY THE CITY OF CUPERTINO ONLY
in a strategic or policy level. Between 2021 and 2023, the average City Council meeting lasted between 4 and 5.7 hours.
YEAR
TOTAL # OF
MEETINGS
AVERAGE MEETING
LENGTH
# OF MEETINGS PAST
MIDNIGHT
2021 59 5.7 hours 1
2022 64 5.2 hours 5
2023 37 4.0 hours 2
To address the strain of the length of meetings and focus the Council on priorities and policy, the Manual referenced above included supplementary guidance for the conduct of City Council meetings.
In Section 8.9, meeting length is addressed. The Manual asserts that City Council meetings are to adjourn by 11:00 p.m., unless a motion to extend is passed. In the event of a meeting extension, further guidelines are provided. Interviewed staff report that the implementation of additional policies and procedures regarding City Council meetings has contributed to an improvement in the overall length of the meetings.
Grand Jury Report
Historically, relationships between Council and City staff have been strained. In 2022, following a series of complaints regarding the behavior and practices of City Council members, the Santa Clara County Civil Grand Jury (Civil Grand Jury) conducted an investigation of City Council, A House Divided: Cupertino City Council and City Staff. This report “confirmed the existence of adversarial and dysfunctional behavior toward City staff exhibited by some City councilmembers,” and suggested that “the behavior of councilmembers may need to be reviewed and good government practices implemented to remediate the dysfunction that currently exists.” Following these findings, the City undertook an independent investigation and conducted an Enterprise Leadership Assessment as part of its internal audit program. Several of the recommendations in the Enterprise Leadership Assessment were already in progress at the time of the study. As a result of these reports and a commitment to improve City governance, the City has taken several actions to improve governance:
• A new ethics code was adopted and implemented.
• As previously noted, the Manual was created and implemented. • The City updated qualifications for certain Commissioner appointments to improve the recruitment process and increase accessibility for interested, eligible community members . • Continued efforts are underway to revise the Commission Handbook.
While the City has acted quickly to improve the governance environment, trust and relationship building takes time, which contributes to the moderate risk rating in this category. As trust continues to build, the risk rating will likely decrease.
Commissions
The City has established various committees and commissions to address specific areas of focus.
There are 10 commissions tasked with advising the City Council in the formation of policy. With the
Enterprise Risk Assessment Report | 31
FOR USE BY THE CITY OF CUPERTINO ONLY
exception of the Planning Commission, all other commissions function in a strictly advisory role to the City Council, as is appropriate and consistent with best practices. Commissions include:
• Arts and Culture Commission
• Bicycle Pedestrian Commission
• Housing Commission
• Library Commission
• Parks and Recreation Commission
• Planning Commission
• Public Safety Commission
• Sustainability Commission
• Technology, Information, and Communications Commission • Teen Commission
The City also has three bodies that review specific topics affecting the City and make recommendations to City Council: the Audit Committee, Disaster Council, and Sister City Committee.
In addition, the Administrative Hearings Committee reviews select planning and zoning actions.
Generally, one or two Council members are assigned as members, and the committees may include members from the public or staff.
As outlined in the 2023 Enterprise Leadership Assessment, while the foundational duties of most governance groups are codified in the City’s Municipal Code, the City has not yet established the process of developing individual charters to outline each group’s purpose and member roles and responsibilities. It was frequently reported that certain group members believe they have the authority to direct staff on administrative matters or assign work tasks. This is a breach of the group’s actual authority and can create tension when staff members are put in a position to deny or redirect the work requests. The report also notes that several groups often do not have significant volumes of work, which can create challenges to keeping members productively engaged.
To address risks in this area, the City should work collaboratively to further review, adopt, and implement relevant recommendations from the Enterprise Leadership Assessment.
Enterprise Risk Assessment Report | 32
FOR USE BY THE CITY OF CUPERTINO ONLY
OVERALL RISK LEVEL: MODERATE
Impact
Likelihood
Preparedness
Trajectory
MODERATE MODERATE MODERATE FLAT
Risk Mitigation
● Conduct targeted internal controls reviews and testing to assess compliance with updated policies and procedures.
● Ensure that decentralized accounting and finance processes are accompanied by clear procedures and adequate training.
● Continue efforts to update policies and procedures.
RESIDUAL RISK: LOW TO MODERATE
Risk Areas: Risks associated with preventive controls (e.g., tone at the top, policies and procedures, and passwords), detective controls (e.g., segregation of duties, reconciliations, and variance reports), and corrective controls (e.g., changes to policies and procedures, training, and loss of privileges).
Scope: Control activities are the processes and procedures that help ensure that management’s risk responses are carried out; they are not performed simply for their own sake or because it seems to be the “right” or “proper” thing to do. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets, and segregation of duties.
Internal controls are processes, procedures, and mechanisms implemented within an organization to ensure the achievement of objectives, safeguard assets, maintain accurate financial reporting, and ensure compliance with laws and regulations. The City’s internal control environment represents the processes designed to provide reasonable assurance about the reliability of financial reporting, efficiency and effectiveness of operations, and compliance with applicable laws and regulations.
Internal controls also safeguard the City’s assets from unauthorized acquisition, use, or disposition.
An external firm conducted an internal controls review prior to the establishment of the City’s internal audit function. As noted in the Accounting and Finance s ection of this report, many financial
transactions are somewhat decentralized, which can impact the effectiveness of internal controls.
While decentralization has some benefits, it increases risks of inconsistent financial practices, noncompliance with laws and regulations, fraud, errors, and monitoring difficulty.
In a decentralized environment, strong policies and procedures are particularly important. It is r
ecommended that policies and procedures are updated every one to three years. In accordance with best practices, the City’s financial and procurement policies have been updated within the last year.
As noted in other sections throughout this report, the City has policy gaps related to H uman Resources and IT. Policy gaps represent internal control deficiencies and increased risks of waste, financial impact, and legal consequences (see also Policies and Procedures).
Enterprise Risk Assessment Report | 33
FOR USE BY THE CITY OF CUPERTINO ONLY
In 2022, the City underwent a single audit as required by the federal government, which assessed the City’s internal controls and compliance for the prior FY (FY22) related to federal funding. The audit did not uncover any internal control deficiencies within the City that would meet the criteria for material weaknesses, as defined in the report, but did note that unidentified deficiencies or material weaknesses may exist. As a result of the audit, it was recommended that the City revisit its control design and revise its procedures to ensure proper controls over preparation, review, and submission of ARPA reports and to ensure timely submission of all reports (see also Compliance and Financial Reporting). In response, the City developed the following pla n:
• Added an additional staff person
• Filed its late report
• Added a Finance team group email to ensure various staff would receive reminder emails on reporting to support improved reporting compliance
OVERALL RISK LEVEL: MODERATE
Impact
Likelihood
Preparedness
Trajectory
MODERATE MODERATE TO HIGH MODERATE FLAT
Risk Mitigation
● Continue to promote stability and tenure in management positions (see also Human Resources).
● Provide formal management training to new managers and supervisors (see also Human Resources).
● Continue to solicit feedback from staff on communication practices and use the results to strengthen internal communication practices.
RESIDUAL RISK: LOW TO MODERATE
Risk Areas: Risks associated with organizational leadership, management practices, leadership strategic activities, and operating styles.
Scope: Management's philosophy and operating style affect the way an organization is managed, including the kinds of risks accepted. The attitude and daily operating style of top management affect the extent to which actions are aligned with risk philosophy and appetite.
Strong management structures and leadership help ensure that a city operates efficiently and effectively. Leaders are responsible for decision-making that provides clear direction as well as providing a foundation for governance, policies, and programs. Good leadership within a city promotes stability for employees, residents, and stakeholders.
The City has experienced changes in senior management personnel in recent years, including frequent turnover in the City Manager role. As noted previously, the City Manager’s Office has made a concerted effort to stabilize leadership. Change in management-level positions can create a sense of instability throughout the organization and impede the continuity of Citywide initiatives and actions.
In 2021, the City’s management level turnover rate was 7%. In 2022, it was 18%, and in 2023, it was
Enterprise Risk Assessment Report | 34
FOR USE BY THE CITY OF CUPERTINO ONLY
13%. While the City’s recent turnover rate has largely aligned with industry averages, staff reported that directives, goals, and expectations have changed over time as each leader has their own unique leadership style. Constant changes in directives, goals, and expectations due to shifting leadership styles can create confusion among staff members. This inconsistency can lead to a lack of clarity regarding priorities and objectives, hindering productivity and effectiveness.
When asked how confident they were in senior leadership, the majority of staff (53%) responded moderately confident. Notably, 38% said either slightly confident or not confident at all with only 9% saying very confident or extremely confident. Staff also note that there is a rise in stability among leadership and a clearer understanding of expectations with the growing tenure in pivotal leadership roles.
Q: How confident are you in the senior leadership team of the City?
Given recent turnover in leadership roles, there's an increased need for robust and standardized management onboarding and training procedures (see also Human Resources). When new leaders enter positions, it is important to have strong management onboarding and training procedures in place to ensure they can quickly adapt to their roles, understand organizational processes, and effectively lead their teams. Robust and standardized training helps to mitigate the negative impacts of turnover by enabling new leaders to become productive and efficient in their positions more quickly, thus reducing disruptions and maintaining continuity in operations. When managers were asked to rate the quality of training they received, the majority (71%) said either average (44%), poor (21%), or terrible (6%).
Q: How would you rate the quality of the management training you have received?
Total equals 101% due to rounding.
Internal Communication
Communication remains a perennial challenge for the City as people, processes, and technology continue to change. In interviews and the all-staff survey, manager-level staff reported feeling disconnected and uninformed, experiencing challenges staying in the right communication loops.
Staff reported a lack of clarity in internal communication regarding the City’s budget challenges due to the CDTFA audit, particularly concerning its implications for staffing and service delivery. The City uses several methods to communicate information to staff, including department meetings, leadership 6% 3% 53% 16% 22%
Extremely confident Very confident Moderately confident Slightly confident Not confident at all 6% 24% 44% 21% 6%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 35
FOR USE BY THE CITY OF CUPERTINO ONLY
team meetings, email distributions lists, and posts through the City’s intranet. While having a variety of communication modalities is encouraged, there are some associated challenges and risks to having an abundance of communication modalities. As staff reported, it is difficult ensure that information is updated across all channels, and there are challenges for newer individuals to effectively use established channels, either to distribute or receive information.
When asked how they would rate the quality of communication received from leadership, only 36% of respondents said excellent (9%) or good (27%), with the remaining 63% responding average (33%), poor (21%), or terrible (9%).
Q: How would you rate the quality of the communication you receive from leadership?
Total equals 99% due to rounding.
Effective internal communication is important as it facilitates coordination and collaboration among different departments, teams, and individuals. This enables employees to work together seamlessly, share information, and coordinate efforts to achieve common goals. More communication is not always the most effective method to mitigate risk related to communication, rather evaluating each modality for quality and effectiveness can help keep individuals informed of important updates.
OVERALL RISK LEVEL: MODERATE
Impact
Likelihood
Preparedness
Trajectory
MODERATE TO HIGH MODERATE MODERATE FLAT
Risk Mitigation
● Make proper adjustments and preparations for anticipated reductions on operations and service delivery.
● Provide staff with necessary information and guidance to prepare for future constraints on operations and service delivery.
● Commit to consistent, recurring resident satisfaction surveys.
RESIDUAL RISK: MODERATE
9% 27% 33% 21% 9%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 36
FOR USE BY THE CITY OF CUPERTINO ONLY
Risk Areas: Risks associated with community expectations, level of service commitments, scheduling, program/service delivery, sustainability, quality, process efficiencies, and resource allocation.
Scope: Day-to-day operations across the organization, and efficient and effective delivery of the organization’s programs and services in alignment with goals, vision, and mission.
Operations and service delivery in a city refer to the day-to-day activities and functions that municipal governments undertake to provide essential services and maintain the functioning of a city. A city’s general plan provides a framework and guidance for how these services are planned, delivered, and maintained. As defined in the City’s 2015–2040 General Plan, the City aspires to be a balanced community with quiet and attractive residential neighborhoods; exemplary parks and schools; accessible open space areas, hillsides, and creeks; and a vibrant mixed-use “Heart of the City.” The mission of the City is to provide exceptional service, encourage all members of the community to take responsibility for one another, and support the values of education, innovation, and collaboration.
At the most fundamental level, the City’s mission is to direct the efficient and effective delivery of municipal services. The City provides a broad range of services to residents, including:
• Community Development (planning, building permits and plans, code enforcement) • Finance (billing and payment processing)
• Public Works (infrastructure and streets maintenance) • Recreation and Senior Services
• Public Information
City planning documents, especially ones that are designed with consideration of residents, enable cities to be responsive and transparent in action. Using a general plan as a guide, the City can help inform decisions that align with community priorities and goals, leading to outcomes that resonate with residents and enhance their satisfaction.
Staffing Levels
As noted in Organization and Staffing section, staffing concerns were noted in both interviews and survey responses in Community Development, Parks and Recreation, and Public Works, all departments who provide resident-facing services. Understaffing in these areas can impact the quality and availability of services provided to the community. If staffing levels are insufficient to meet the demand for services, there may be longer wait times, reduced service hours, or a decrease in the quality of services provided, which can lead to decreased resident satisfaction and a negative impact on the City’s reputation.
Service Delivery
The City’s staffing reductions will impact service delivery in the future as community expectations often do not keep up with resource constraints in cities. However, few issues related to service delivery were reported in interviews. The main challenge noted was related to permitting delays due to limited staff resources and a high volume of applications. In addition to reducing economic activity in the City or delaying construction projects, which can lead to frustration from residents and businesses, permitting delays can negatively impact the City’s reputation (see also Reputation and
Public Perception).
Enterprise Risk Assessment Report | 37
FOR USE BY THE CITY OF CUPERTINO ONLY
Staff report that City residents are often vocal, with high expectations for the services the City provides, which can make it difficult to fulfill all demands. When staff were asked to rate how well the City is able to deliver core services to the public, the majority of survey respondents (73%) said either excellent or good. While this is a large majority, it is a notable 14% decrease from 2020. In 2020, when asked to rate how well the City is able to deliver core services to the public, 87% of respondents said either excellent or good. This decrease may be in anticipation of the City’s impending budgetary restrictions. A risk associated with the reduction in revenue is that the City anticipates the need to adjust levels of service accordingly. City staff report that levels of service provided to the community are high and that changes to service levels are likely to be noticed.
Q: How would you rate the City's overall ability to deliver core services to the public in an effective manner?
2020
2024
Total equals 101% due to rounding.
To gain further insight into resident satisfaction, the City conducts a resident satisfaction survey every few years. The City did not conduct a resident satisfaction survey in 2020 due to the COVID -19 pandemic and conducted a Community Budget Survey in 2023 instead of the resident satisfaction survey. The City is currently working to relaunch the community satisfaction survey, which will provide more recent insight into community member satisfaction with City services. 35% 52% 13% 1%
Excellent Good Average Poor Terrible
35% 38% 25% 1%1%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 38
FOR USE BY THE CITY OF CUPERTINO ONLY
OVERALL RISK LEVEL: MODERATE
Impact
Likelihood
Preparedness
Trajectory
MODERATE TO HIGH MODERATE MODERATE INCREASING – LOW
Risk Mitigation
● Evaluate staffing in Community Development, Parks and Recreation, and Public Works and ensure the staffing model is adequate for the services provided.
● Review and update job descriptions, and the associated roles and responsibilities, to improve clarity.
RESIDUAL RISK: MODERATE
Risk Areas: Risks associated with how personnel are organized, as well as staffing levels and skills.
Scope: An entity’s organizational structure provides the framework to plan, execute, control, and monitor its activities. Organization and staffing encompass hierarchy, chain of command, span of control, and staffing levels. Staffing includes specific positions, counts, and capacity. A relevant organizational structure includes defining key areas of authority and responsibility and establishing appropriate lines of reporting.
The City’s organizational structure is composed of six main departments: Administration (City Manager’s Office, City Attorney’s Office), Administrative Services, Community Development, Innovation and Technology, Parks and Recreation, and Public Works. Span of control typically varies depending on the function
5; however, based on a review of organizational charts, span of control appears to be appropriate across the organization. Additionally, no concerns about organizational structure were identified in interviews.
The ratio of City staff to residents has increased since FY20, meaning there are now fewer residents per City staff member. This is because both the City’s population has decreased, and the total number of staff has increased. In FY20, Cupertino had a population of 66,762 with a total of 203.75 authorized positions. This is a ratio of one City staff for every 327.7 residents. In FY 24, Cupertino has a population of 60,869 with 212 authorized positions. This is a ratio of one City staff for every 287.1 residents.
5 McKinsey & Company. “How to Identify the Right ‘Spans of Control’ for Your Organization.” Accessed April 25, 2024:
https://www.mckinsey.com/capabilities/people-and -organizational-performance/our-insights/how-to-identify-the-right-spans-of- control-for-your-organization
Enterprise Risk Assessment Report | 39
FOR USE BY THE CITY OF CUPERTINO ONLY
FISCAL YEAR FTE POPULATION
RATIO OF CITY STAFF
TO RESDIENT S
2020 203.75 66,762 327.7
2024 212 60,869 287.1
Overall, staff reported adequate staffing in most areas. However, staffing concerns were noted in both interviews and survey responses in Community Development, Parks and Recreation, and Public Works (see also Operations and Service Delivery). To address the City’s budget deficit, a total of 14 positions were cut in FY24, including staffing in these three departments and Administrative Services.
When vacant positions are removed or not filled, the responsibilities of that position are often transferred onto existing positions. This can result in increased workloads, fear of burnout, and confusion regarding roles and responsibilities, which are all concerns that are likely to increase. While eliminating vacant positions may be necessary to address the City’s structural deficit, the City must continue to practice responsible workload management, such as through reassigning tasks, adjusting deadlines, or streamlining processes to reduce risks in this area. As positions change and responsibilities shift, clarity surrounding job descriptions has decreased. When asked to rate the quality of job descriptions, staff reported varying levels of satisfaction. While 49% reported the quality of job descriptions as either excellent (6%) or good (43%), 52% reported either average (34%), poor (11%), or terrible (7%). When job descriptions are inadequate and roles and responsibilities are unclear, risks related to process inefficiency, poor staff performance, and low employee morale increase.
Q: How would you rate the quality of the current job descriptions used by the City in terms of defining roles, responsibilities, qualification criteria, and position goals?
Total equals 101% due to rounding.
6% 43% 34% 11% 7%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 40
FOR USE BY THE CITY OF CUPERTINO ONLY
OVERALL RISK LEVEL: MODERATE
Impact
Likelihood
Preparedness
Trajectory
MODERATE MODERATE MODERATE FLAT
Risk Mitigation
● Continue efforts to update personnel policies and procedures. ● Prioritize addressing other key policy gaps in IT and grants management, as well as implementation of recommendations from the Citywide policy review and gap analysis.
● Develop and implement a policy on policies to promote a centralized and standardized approach to reviewing and updating policies and procedures. ● Establish a centralized location for policies and procedures to make them more easily accessible to staff.
● Ensure staff are provided training when policies and procedures are implemented or updated.
RESIDUAL RISK: LOW TO MODERATE
Risk Areas: Risks associated with policies, processes, and procedures, including efficiency, effectiveness, and level of documentation.
Scope: Policies and procedures play a critical role in providing the guidance required to ensure all functions operate efficiently, effectively, safely, and consistently across the organization. A policy establishes what should be done, and procedures affect the policy. Policies and procedures also play an important role in protecting against the loss of institutional knowledge.
Policies and procedures guide internal operations and help ensure that every employee knows the rules and expectations. Policies and procedures should be dynamic documents that employees can reference with regularity. Keeping policies and procedures up to date is an essential part of risk mitigation as policies and procedures help ensure that management’s directives to mitigate risks are carried out consistently at all levels of the organization and at various stages within different business processes.
In the City’s 2020 ERA, the City’s outdated policies and procedures were identified as a risk area.
Since then, the City has updated some policies and procedures, including several financial policies and procedures as well as policies and procedures related to purchasing. Additionally, the City has committed to incremental updates to policies and procedures and has undertaken a Citywide policy review and gap analysis in the current internal audit program. This review will provide a more comprehensive and detailed analysis of the current state of the City’s policy and procedure environment.
As noted in other sections throughout this report, the City has key policy gaps related to the following:
• Personnel policies and procedures have not been updated since 2013, though they are in the process of being updated (see Human Resources).
Enterprise Risk Assessment Report | 41
FOR USE BY THE CITY OF CUPERTINO ONLY
• The City is in the process of documenting grants management policies and procedures (see Compliance and Financial Reporting).
• Key information technology policies and procedures have not been updated since 2018 (see Information Technology).
According to best practice, the City should review policies and procedures to ensure they are consistent with laws, regulations, advances in technology, and operating practices at least every three years. Outdated policies and procedures can contribute to reduced efficiency and effec tiveness as well as communication and accountability challenges. In the absence of up-to-date documented policies, staff rely on historical practices and verbal directions, which requires significant institutional knowledge to perform and could be inconsistent with management expectations over time. To date, policy and procedure updates have largely been led by managers at the individual department level.
While many updates have been made, the lack of a consistent, standardized Citywide policy update process creates a gap in the review process as there is limited assurance that regular reviews and updates will be conducted.
Additionally, the City has yet to establish a centralized location for policies and procedures making it difficult for staff to locate the most up-to-date guidance. A key component to effectively adopt updated policies and procedures is ensuring that they are communicated and accessible to staff. This may also lead to different departments or individuals maintaining their own versions of policies and procedures, leading to inconsistencies across the organization. This can also result in confusion and errors in implementation. Policies and procedures should be stored centrally in a searchable format.
When new versions are published, alerts should be communicated, and training should be provided.
OVERALL RISK LEVEL: MODERATE
Impact
Likelihood
Preparedness
Trajectory
MODERATE MODERATE TO HIGH MODERATE DECREASING – LOW
Risk Mitigation
● Continue to plan and provide training related to updated procurement and contracting policies and procedures.
● Formalize procurement card (P-Card) training requirements and establish rules for who may carry a P-Card.
● Consider providing contract-related training for employees who manage their department’s contracts.
● Continue to plan for an eventual transition to centralized procurement and contracting functions.
RESIDUAL RISK: LOW TO MODERATE
Enterprise Risk Assessment Report | 42
FOR USE BY THE CITY OF CUPERTINO ONLY
Risk Areas: Risks associated with purchasing processes and contract administration for goods and services, including cost-savings, efficiencies and effectiveness, transparency, adherence to laws and regulations, monitoring costs and vendor payments, supply chain risks, and vendor performance and service delivery.
Scope: Procurement and contracting includes purchasing processes (e.g., purchase requisitions, due diligence, approvals, purchase orders, and receiving) and contract administration (e.g., compliance with terms and conditions, payments, and change orders) for goods and services.
In any public organization, procurement processes are the means through which critical and strategic services, supplies, and construction are purchased to support essential functions. The City’s risk profile in this area has decreased since the 2020 risk assessment due to the City’s work on updating policies and procedures and committing resources to updating the City’s approach to procurement.
That work is still in progress, which is what largely informs the City’s moderate risk rating.
A Procurement Operational Review conducted in 2022 found that the City’s decentralized procurement activities led to inefficiencies as departments created customized processes for common procurement practices. To address this, the City has recently begun the process of moving toward a hybrid procurement model (where policies, procedures, and systems are centralized but operations are decentralized), and eventually will move to a centralized model. A full-time procurement manager was hired in 2023.
To support a hybrid procurement model and move toward an overall more strategic approach to procurement, the Purchasing Manager has started an interdepartmental effort to begin updating related policies, procedures, and templates and strengthening internal controls. For example, the City’s Purchasing Policy and accompanying Purchasing Matrix was updated in February 2024. This effort has decreased the likelihood of risk and increased the City’s preparedness for risk in this area.
Updating policies is important, but it represents change for the employees who are responsible for departmental purchasing tracking and reporting. Most surveyed staff felt positive about the upcoming change and were looking forward to additional clarity and stabilization around the purchasing process, but some shared that the procurement process feels like it is in a constant state of change.
While training for City staff on new purchasing policies is in development for this calendar year, there is an inherent risk of creating confusion or encountering resistance to change when updating a significant process or policy.
Q: How easy is it to acquire the goods and services your division/department needs?
11% 19% 36% 32% 2%
Extremely easy Somewhat easy Neither easy nor difficult Somewhat difficult Extremely difficult
Enterprise Risk Assessment Report | 43
FOR USE BY THE CITY OF CUPERTINO ONLY
Q: How would you rate the usefulness of documented policies and procedures in terms of providing adequate guidance on purchasing?
P-Cards
The P-Card program also contributes to risk in this area. The Finance Division currently administers the P-Card program and is responsible for ensuring only current employees have active cards. The 2020 risk assessment noted that the City did not have clear policy requirements or an accountability mechanism to ensure that individuals in positions with purchasing-related responsibilities attend both initial training and ongoing refresher courses. Therefore, credit card use, including users and approvals of purchases, was noted as being occasionally unclear for staff. Although Finance has since developed a Credit Card Policy that governs the credit card request process, proper use, and internal controls, this is still an issue as P-Card training requirements have not yet been formalized and rules for who may carry a P-Card have not been determined. Finance staff intend to develop guidelines about who may carry a City P-Card this year.
Contracting
Contract management remains decentralized and departmental staff are responsible for managing contracts, which is driving the City’s preparedness rating in this area. Oversight of the contracting process was a concern in the 2020 risk assessment, and some progress has been made since then, including the following:
• The City recently reduced the competitive procurement threshold from $60,000 to $5,000, since most City contracts are relatively small.
• The City Attorney’s Office developed standardized templates that staff can choose from to support contracting activities.
• The IT team developed a bid management application for publishing City RFPs and bids and providing the capability for vendors to submit bids electronically.
Surveyed employees identified the need for more contract management-related training as well as a desire for more detailed guidance on contracting processes. Because the City outsources a variety of functions and activities, it is essential that employees have sufficient training and guidance to carry out contracting processes consistently and in compliance with regulatory requirements and standards.
15% 28% 38% 17% 2%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 44
FOR USE BY THE CITY OF CUPERTINO ONLY
Q: How would you rate the usefulness of documented policies and procedures in terms of providing adequate guidance on contracting ?
Total equals 99% due to rounding.
Finally, the City uses CobbleStone, an electronic contract processing software and document repository. CobbleStone does not easily integrate with New World, the City’s Enterprise Resource Planning (ERP) system. This results in duplicative and manual efforts between the two systems and puts the City at risk of reporting errors. As mentioned in Accounting and Finance, t he City was previously pursuing an ERP update but deprioritized that effort as an expenditure -saving measure.
OVERALL RISK LEVEL: MODERATE
Impact
Likelihood
Preparedness
Trajectory
MODERATE MODERATE MODERATE INCREASING – LOW
Risk Mitigation
● Strengthen proactive communication to the public, specifically concerning the City’s budget and subsequent effects on service delivery. ● Clarify roles and responsibilities regarding communication from the City to public.
● Continue to re-establish the resident satisfaction survey to track public perception over time and engage a broader portion of the community.
RESIDUAL RISK: LOW TO MODERATE
Risk Areas: Risks associated with the organization’s reputation and the public’s perception of the organization, including its competency (financial performance, safety and security, and responsiveness), transparency (openness and integrity), and guardianship (demonstrating care and consideration).
Scope: The reputation of an organization refers to how a broad group of stakeholders perceive the accumulated decisions, actions, and behaviors of the people within an organization. This social judgement is influenced both directly and indirectly by interactions with employees, with programs and services, and by commentary in the public domain (e.g., news stores, press release, and social media).
The operations of a local government like the City are complex, multifaceted, and impact the lives of residents, either directly or indirectly, every single day. In essence, the City’s reputation directly influences the effectiveness of the City’s governance overall function, and ability to recruit and retain employees.
17% 28% 37% 15% 2%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 45
FOR USE BY THE CITY OF CUPERTINO ONLY
Recent challenges at the City have created obstacles in preserving a strong and positive public reputation, including challenges related to:
• The relationship between the City Council and staff (see also Governance) • The CDTFA audit decision and its expected impact on City services (see also Funding and Economics and Operations and Service Delivery)
• Affordable housing, including the City’s delayed Housing Element (see also Planning and Strategy)
• Permitting process delays due to a high volume of permit applications and limited staff resources Such challenges can impact the City’s reputation and attractiveness to residents, businesses, and investors.
It is important for cities to take proactive steps to manage their reputation, including investing in public relations and marketing efforts and promoting transparency and accountability. The City hired a new Communications Coordinator to fill a longstanding vacancy in the beginning of 2024. This position is intended to improve proactive communication to the public, as well as refine the City’s approach to branding.
Resident Perception and Satisfaction
As noted in Operations and Service Delivery, the City did not conduct its regularly planned resident satisfaction survey in 2020 due to the COVID-19 pandemic. Revitalizing the community satisfaction survey will be an important mechanism as the City navigates community response to changes in services and expectations. In general, staff report that the City has a good relationship with the City’s residents. When asked what type of reputation they felt the City had within the community, the majority (51%) of respondents said good, with a notable 10% saying excellent. In interviews, staff reinforced this sentiment referencing a long-standing history of providing quality services and attentiveness to the community. However, the City faces increased risk trajectory in this area given the potential friction between service delivery expectations and the reality of what the City can provide and fund. There is an increased risk that diminished service levels and staffing will contribute to a poor perception of the City, which can impact residents, businesses, local economy, and recruitment and retention efforts.
Q: What kind of reputation do you think the City has within the community?
The majority of survey respondents (70%) also reported that the City’s overall consistency of communication with the public was either good or excellent. Moreover, when asked how responsive the City is to resident feedback, 47% said the City is appropriately responsive and 30% s aid slightly responsive. This feedback reflects the sentiment that a majority of respondents view the City's communication with the public positively.
10% 51% 31% 8%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 46
FOR USE BY THE CITY OF CUPERTINO ONLY
Q: How would you rate the City’s overall consistency of communication with the public?
Q: How responsive is the City to resident feedback?
OVERALL RISK LEVEL: MODERATE
Impact
Likelihood
Preparedness
Trajectory
MODERATE TO HIGH MODERATE MODERATE FLAT
Risk Mitigation
● Continue efforts to update the City’s EOP.
● Prioritize regular updates to the City’s Continuity of Operations Plan (COOP). ● Increase staff participation in and awareness of available emergency response training, particularly related to staff roles and responsibilities in emergencies. ● Consider strategies to increase employee’s feeling of physical safety at work, such as proactive plans to protect public-facing employees in the event of a security threat.
RESIDUAL RISK: LOW TO MODERATE
Risk Areas: Risks associated with the organization’s formal/structured risk management programs, such as employee health and safety programs, operational risk management programs, and incident response and emergency management efforts.
Scope: Risk programs include administration of the general liability, workers’ compensation, safety, disability management, and property programs. Risk efforts also include contract/insurance certificate review, insurance procurement, emergency preparedness programs, and continuity of operations planning.
HR is responsible for administering the City’s risk management, safety, and wellness programs . HR also oversees the City’s workers’ compensation program, unemployment insurance program, OSHA 20% 50% 26% 3%
Excellent Good Average Poor Terrible
47% 30% 1% 22%
Appropriate level Slightly responsive Slightly too unresponsive Far too unresponsive
Enterprise Risk Assessment Report | 47
FOR USE BY THE CITY OF CUPERTINO ONLY
safety and training programs, and the Risk Management Committee. The City Attorney’s Office works with HR to administer the City’s general liability and property insurance programs.
Insurance Premiums
Insurance claims have been steady for the past three years, while workers’ compensation claims have decreased. There have been 31 workers’ compensation claims in the past three years. Of those claims, 21 were in 2021, and the number of claims dropped sharply in 2022 and 2023. There have been 39 insurance claims in the past three years, at relatively flat rates. This contributes to the flat risk trajectory in this area.
As mentioned in the Human Resources
section, insurance premiums are rising industry-wide for general liability, excess workers’ compensation, and employment practices liability, making it difficult to maintain affordable rates. In addition, employee medical fees were sharply increased last year, and the City covered the cost.
Emergency Management and Business Continuity
The Office of Emergency Management (OEM) is staffed with two full-time positions, including an Emergency Manager who is responsible for leading and directing the City in prevention, preparation, mitigation, response, and recovery activities and a Management Analyst who is primarily dedicated to emergency planning. The office is also staffed with two part-time positions.
OEM is responsible for maintaining, reviewing, and updating the City’s EOP, which was last published in June 2019. The EOP should be reviewed on a regular basis (every two to three years) to ensure it remains relevant and effective and should be updated more often if there are significant changes to the emergency management landscape (such as high turnover at the City Manager position, which the City has experienced in recent years). The City is currently finalizing an assessment and revision of the existing plan.
The City’s COOP, which is a core component of business continuity planning, was last updated in June 2021. The COOP outlines how the City will continue to provide services in the event of an emergency until full operations are restored. The Federal Emergency Management Agency (FEMA) recommends COOPs be updated at least annually, or whenever there is a significant change in the organization’s structure, mission, or operating environment to ensure the plan remains current and relevant to the organization’s needs and capabilities.
The City offers several emergency-related trainings for staff. OEM provided training to 25 City staff with roles in staffing disaster emergency shelters in 2023, recently initiated a new training program for City Emergency Operations staff and set completion dates for Disaster Service Worker training for all staff. Planned training updates are underway as well. OEM hopes to provide Citywide training covering roles and responsibilities during emergency protocols in 2024.
Most employees (83%) report that they have received training related to emergency preparedness within the last year, and most employees (89%) report that they feel extremely (8%), very (43%), or somewhat (38%) prepared to respond to or handle an emergency situation within their department or office. It is important that all employees receive training on emergency preparedness to create a culture of safety and preparedness and ensure everyone is equipped to handle emergencies when they arise. Many surveyed employees mentioned confusion surrounding a recent incident at City Hall
Enterprise Risk Assessment Report | 48
FOR USE BY THE CITY OF CUPERTINO ONLY
involving a phoned-in security threat; this may indicate a need to require that employees attend training related to roles and responsibilities and communication during emergencies.
Q: Have you received training focused on emergency preparedness provided by the City within the last year?
Q: How prepared do you feel to respond to or handle an emergency situation within your department or office?
The City developed an Alert, Warning, and Notification (AWN) Program to provide critical alert and warning to the public while also allowing for effective information sharing across City departments and partner agencies. The AWN Program provides the framework for alert, warning, and notifications before, during, and after any emergency or situation. The framework documents the recommended criteria for issuing public alerts and warnings, types of alerts and warnings, governance, training, and technical requirements for activating alerts. This document provides best practices for crafting effective alert and warning messages, choosing appropriate alerting technology, and providing public education to ensure the people understand how to obtain, use, and respond to information from the City. This is a strong control to promote effective communication during a crisis or emergency and reduce associated reputational risks.
Employee Safety
About one-third of surveyed employees (29%) reported they have experienced an incident where they felt physically unsafe while working at the City in the last two years, a 20% increase from the 2020 ERA. Over half of surveyed employees (60%) rated the physical security of their workplace as average (39%), poor (13%), or terrible (8%). This is driven by ongoing concerns over the physical structure of City Hall and a one-time acute threat. The safety of employees, and their perception of safety, can have significant impacts on City operations. It is important for the City to consider strategies to increase each employee’s feeling of physical safety at work, such as proactive plans to protect public-facing employees in the event of a security threat. 32% 29% 22% 17%
Yes, online Yes, in-person Yes, both No
8% 43% 38% 8% 3%
Extremely prepared Very prepared Somewhat prepared
Slightly prepared Not prepared at all
Enterprise Risk Assessment Report | 49
FOR USE BY THE CITY OF CUPERTINO ONLY
Q: In the last two years, have you experienced an incident or time where you’ve felt physically at risk or unsafe while working at the City?
Q: How would you rate the overall level of physical security within the facility and/or location in which you work?
OVERALL RISK LEVEL: LOW TO MODERATE
Impact
Likelihood
Preparedness
Trajectory
MODERATE LOW TO MODERATE MODERATE FLAT
Risk Mitigation
● Ensure that updated accounting procedures are accompanied by clear communications to staff about the changes.
● Ensure that decentralized accounting and finance processes are accompanied by clear procedures and adequate training.
● Prioritize continuing to address the recommendations for improvement in budget development and monitoring training, document storage efficiency, and budget review communications contained in the 2022 Budget Process Review. ● Continue to prioritize improvements to the City’s financial systems to increase process efficiency where possible.
RESIDUAL RISK: LOW TO MODERATE
29% 66% 5%
Yes No Decline to Answer
8% 32% 39% 13% 8%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 50
FOR USE BY THE CITY OF CUPERTINO ONLY
Risk Areas: Risks associated with fiscal control, budgeting, ongoing information tracking and management, revenue capture, and transaction processing.
Scope: The role of accounting and financial functions in risk mitigation is focused on recordkeeping and compliance through recording, classifying, summarizing, and reporting financial transactions. Financial reporting includes deliverables such as the Annual Comprehensive Financial Report (ACFR), monthly financials for budgetary comparison, and other compliance reports such as an organization’s Single Audit.
Reliable financial information is fundamental to planning, budgeting, pricing, evaluating vendor performance, assessing partnerships, and a range of other operational and strategic activities.
The City’s Finance Division operates under the Administrative Services department. The Finance Division has a total staffing of 11.4 FTEs and is responsible for overseeing all financial accounting and treasury functions for the City. Administrative Services also houses a Budget Manager and Purchasing Manager outside of Finance who are involved in the accounting and finance function.
Because the structure and functions of the Finance Division can vary significantly among jurisdictions, there is not a one-size fits all suggested staffing ratio. However, almost all survey respondents in the Finance Division rated staffing levels in the department as either good or excellent. Additionally, over two-thirds of surveyed employees (71%) rated the quality of internal customer service provided by the Finance team as excellent or good, suggesting there are not significant gaps in services.
Q: How would you rate the quality of the internal customer service provided by the Finance team?
Total equals 102% due to rounding.
The City updated its financial policies and procedures in 2023. Policies and procedures are in place pertaining to accounting and financial reporting, capital assets, budgeting, cash receipts and handling, City Council grants, payroll, accounts payable, and revenue and accounts receivable. Up- to-date policies and procedures reduce risks of noncompliance, increase accountability, and promote consistency and efficiency. However, some staff shared that Finance employees sometimes give inconsistent direction to outside departments regarding policies and procedures. Recent updates to most accounting procedures are likely the driver of this feedback. Procedure changes often make it difficult for staff to understand which information is most up to date.
Staff report several accounting and financial processes are decentralized at the City. As noted in Internal Controls
, there are concerns about financial transactions such as deposits and refunds being handled in a decentralized manner and non-Finance staff, who may lack financial expertise to process transactions without effective oversight or clear procedures. While decentralization can have some benefits, it increases risks of inconsistent financial practices, noncompliance with laws and regulations, fraud, errors, and monitoring difficulty. Clear procedures and a strong training environment can help mitigate these risks.
The City typically aims to complete its Annual Comprehensive Financial Report (ACFR) within six months after the close of each FY (i.e., by December). However, the City’s ACFR has been delivered 33% 38% 23% 8%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 51
FOR USE BY THE CITY OF CUPERTINO ONLY
between March and May in the last three years. The City switched auditors this year and is hoping t o deliver more timely ACFR’s moving forward.
Budgeting
The City’s annual budget is prepared on a July 1 to June 30 FY, with ongoing processes throughout the year, including budget development, proposals, adoption, monitoring, amendments , and resident participation.
Overall, the City’s budget process is well-established and runs smoothly. The City maintains budget policies aligned with best practices in the adopted budget book, including a Balanced Budget Policy, Pension and Retirement Funding Policy, and Investment Policy. The City received the Operating Budget Excellence Award from the California Society of Municipal Finance Officers and the Distinguished Budget Presentation Award from the Government Finance Officers Association (GFOA) for its FY23 budget. A review of the budget process conducted in 2022 as part of the City’s internal audit program found that the City was in alignment with most budget best practices developed by the GFOA, but that there were opportunities for improvement in budget developm ent and monitoring training, document storage efficiency, and budget review communications. The City is currently working with a consultant to validate its budget forecasting processes. Such validation can help promote the accuracy of budget projections and support the City’s decision-making moving forward.
Financial Systems
There are some shortcomings to New World, the City’s current ERP system. The system does not easily integrate with the City’s other systems, including CobbleStone, ACTIVENet, and Accela. This has contributed to process inefficiencies and a high level of manual intervention to effectively manage data and reporting across systems. The City had initially planned to replace its ERP; however, this initiative was paused while the City focused on balancing its budget. Instead, the Innovation & Technology (IT) Department is now working to improve the functionality of New World. This will not be a permanent solution. The City will need to eventually replace its ERP, but this should help ease the burden of data management and reporting across unintegrated systems.
OVERALL RISK LEVEL: LOW TO MODERATE
Impact
Likelihood
Preparedness
Trajectory
MODERATE LOW TO MODERATE MODERATE TO HIGH DECREASING – LOW
Risk Mitigation
● Continue ongoing activities that support a robust fraud, waste, and abuse program, including regular training and consistent reporting. ● Update the City’s Harassment, Discrimination, Retaliation, and Workplace Violence Policy.
● Clearly communicate and enforce non-retaliation policies.
Enterprise Risk Assessment Report | 52
FOR USE BY THE CITY OF CUPERTINO ONLY
RESIDUAL RISK: LOW TO MODERATE
Risk Areas: Risks associated with misappropriation of funds, extravagant spending, using one’s position to accomplish a specific outcome, the intent to deceive, or behavior that is not aligned with the organization’s ethical values and policies.
Scope: The employees of the organization have a duty to use funds economically, efficiently, effectively, and ethically. When employees do not honor this obligation, it could result in instances of fraud, waste, abuse, or unethical behavior.
All City employees share the common purpose of serving the public in an ethical and transparent manner. Fraud, waste, and abuse are defined as:
• Fraud: A dishonest and deliberate course of action that results in obtaining money, property, or an advantage to which employees or an official committing the action would not normally be entitled
• Waste: The needless, careless, or extravagant expenditure of funds; incurring of unnecessary expenses; or mismanagement of resources or property
• Abuse: The intentional, wrongful, or improper use or destruction of resources, or highly improper practices that do not involve prosecutable fraud
The City’s 2020 ERA noted the absence of a robust fraud, waste, and abuse program was an area of risk for the City. Even without a robust program in place, the 2020 ERA rated the likelihood of an incident occurring as low to moderate. Meaning that it is unlikely that an incident of fraud, waste, or abuse will occur. Since 2020, the City has implemented measures to further mitigate risk by establishing a Fraud, Waste, and Abuse Program in October 2022. This program includes a Fraud, Waste, and Abuse Policy; confidential reporting mechanisms; a whistleblower policy; and mandatory training for all staff.
According to the Fraud, Waste, and Abuse Policy, reporting methods include a toll-free number, mail, phone, or in-person reporting, and several methods are available 24 hours a day, seven days a week, 365 days a year. This hotline is coordinated by the City’s internal auditor and administered by third- party vendor Lighthouse through an off-site reporting system. By offering a confidential reporting mechanism, the program encourages open communication and allows staff and the public to share sensitive information without fear of retaliation or judgment. This program signifies the City’s ongoing commitment to strengthening its ethics infrastructure and environment, as well as providing staff with the appropriate resources. When asked if they know what action(s) to take if they were to become aware of unethical or fraudulent activity, 77% of survey respondents said yes compared to 65% of respondents in 2020.
Enterprise Risk Assessment Report | 53
FOR USE BY THE CITY OF CUPERTINO ONLY
Q: Do you know what action(s) to take if you were to become aware of unethical or fraudulent behavior?
2020
2024
Total equals 99% due to rounding.
While the program is a notable contribution to the City’s ethics environment, it is important to note that the City’s Harassment, Discrimination, Retaliation, and Workplace Violence Policy, which is a section of the City’s overarching Administrative Rules and Regulations of the Personnel Code, has not been updated since July 2013. Regularly updating and reviewing ethics policies and procedures are imperative to guarantee that the City’s infrastructure adequately promotes ethical integrity.
Having confidence in the City’s ethics and reporting framework is essential for staff in building trust, promoting compliance, enabling risk management, and detecting and preventing misconduct. The majority of respondents (76%) responded management definitely or probably would make an effort to stop wrongdoing if reported.
Q: What are the chances that management above you would make efforts to stop wrongdoing if you reported it?
Total equals 99% due to rounding.
While there is a strong sense of confidence in how a reported incident would be handled, there is hesitancy related to potential retaliation. Only 29% of respondents to the survey indicated they would definitely be protected from retaliation if they reported wrongdoing, which is similar to the 2020 survey results. Both actual and perceived retaliation erode trust, discourage reporting, and can make it more challenging to realize the full benefit of the robust program in place. 65% 29% 6%
Yes - I know what I would do Maybe - I would have to research a bit No, not really sure 77% 17% 5%
Yes - I know what I would do Maybe - I would have to research a bit No, not really sure 49% 27% 18% 1%4%
Definitely would Probably would Might or might not Probably not Definitely not
Enterprise Risk Assessment Report | 54
FOR USE BY THE CITY OF CUPERTINO ONLY
Q: What are the chances that you would be protected from retaliation if you reported wrongdoing? 2020
2024
OVERALL RISK LEVEL: LOW TO MODERATE
Impact
Likelihood
Preparedness
Trajectory
MODERATE TO HIGH LOW TO MODERATE MODERATE TO HIGH FLAT
Risk Mitigation
● Continue to prioritize cybersecurity resiliency efforts, including employee training and collaboration with other local government agencies. ● Ensure IT policies and procedures are updated at least every three years. ● As the City explores expenditure mitigation strategies, consider developing a feedback mechanism to track employee satisfaction with technology and prioritize opportunities for improvement.
● When possible, prioritize the adoption of a new ERP.
● Consider adopting key systems that would increase efficiency and effectiveness like an HR information system, learning management system, grants management, and performance management system. Prioritize system interoperability between these systems and the City’s ERP.
RESIDUAL RISK: LOW TO MODERATE
Risk Areas: Risks associated with the design, development, implementation, administration, operations, and maintenance of information systems, including change management and system development life cycle. Also includes risks to infrastructure, system performance, data architecture and management, integration, backup, security, and controls.
Scope: The importance and pervasiveness of information technology and information systems continues to rapidly expand, regardless of organization.
29% 41% 20% 6% 3%
Definitely would be protected Probably would be protected Might or might not be protected Probably not protected Definitely not protected
29% 43% 22% 4%2%
Definitely would be protected Probably would be protected Might or might not be protected Probably not protected Definitely not protected
Enterprise Risk Assessment Report | 55
FOR USE BY THE CITY OF CUPERTINO ONLY
The City’s IT Department consists of 14 full-time positions, four part-time positions, and one intern position. There are three divisions within the department: Applications, GIS, and Infrastructure. The Applications Division supports the City’s enterprise applications like its ERP, Land Management System, Recreation System, Laserfiche, as well as the many e-services custom applications like bid management, permit parking, business licenses, and the City’s mobile apps. The GIS Division builds web applications for staff and the public to use as a tool in their daily workflows. The Infrastructure Division is responsible for the acquisition, maintenance, and support of all computer hardware necessary for the City's network (server, storage, switch, security, and appliance) and end user services (PC, tablet, VoIP devices, and smartphones).
The City has a history of being technologically forward and progressive, and its focus on technology translates to an overall low to moderate risk rating in this category. The IT Department is considered the root of that reputation and is critical to the continued optimization and efficiency of service delivery Citywide. The risk in this area is largely driven by the inherent cybersecurity risks to any public -facing organization, the acknowledged need to replace the City’s ERP, some outdated policies and procedures, and opportunities to systematize HR, including training and performance management, as well as grants to further support operational efficiency and effectiveness.
IT Internal Service
Staff are generally pleased with IT internal service. Employees across the City consistently rated the IT Department highly and highlighted that the department is a model for other cities. Staff reported that trust and communication is high between IT and other departments. This is likely driven in part by frequent cross-departmental collaboration. For example, the Applications Division meets with departments monthly to discuss needs, and recently worked with the CIP team to build an application that tracks day-to-day operations.
Q: How would you rate the quality of the internal customer service provided to staff by the IT team?
Total equals 99% due to rounding.
The internal management of the department appears strong. The Chief Technology Officer plans to retire at the end of this FY and has accordingly prioritized succession planning efforts.
IT adheres to a department-specific standard replacement schedule as defined by the Information Technology Replacement and Capitalization Policy. Though there is not a dedicated IT replacement fund, IT budgets for replacements according to the life cycles of hardware. Generally, laptops are replaced every four years and cell phones every three years.
The likelihood of risk occurring with regard to internal service and hardware is driven by current and future impacts to the budget. Among the strategies to reduce expenditures identified in the FY24 budget are reductions to technology purchases and pursuing fewer pilots of technology in the future.
The IT team has already cut some of the applications that were previously procured from a third 63% 31% 3%
1%
1%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 56
FOR USE BY THE CITY OF CUPERTINO ONLY
party. While surveyed employees were generally satisfied with the quality of the information technology hardware provided by the City, there were some concerns that extending equipment life cycles due to budget cuts would cause equipment to become outdated.
Q: How would you rate the quality of the information technology hardware (computers, accessories, etc.) that you currently have and use in your role?
IT Security
The likelihood of risk in this area is driven by the inherent risk related to cybersecurity in any modern organization. In addition, the City does not have control over the rising cost of cybersecurity insurance. As that cost continues to increase, there is an associated risk that more of the City’s resources will need to be allocated to this area.
Cybersecurity was identified as a high-risk area in the 2020 risk assessment. Since then, the IT Department has made investments to mitigate that risk, including the following:
• The City providing end user education through semi-annual training. The focus on training is reflected by 100% of survey respondents reporting that they received high-quality cybersecurity training within the past year. Because of the growing complexity of cyberattacks, it will remai n imperative that the City continue to prioritize its cybersecurity resiliency efforts . • The City continues to focus on strengthening the IT Disaster Recovery Plan and other contingency efforts, including the Business Continuity Flow Chart and EOP (a unified cyber command incident response process that clarifies processes and roles and responsibilities for cyber incidents).
• The City works with a contractor to monitor the cyber environment 24/7 and isolate anomalies that occur at night to prevent viruses or encryption from spreading throughout the environment.
The City maintains the following IT Security policies and procedures:
• A detailed EOP Annex with processes to respond to cyber incidents (last updated in 2021) • An Innovation Technology Disaster Recovery Plan and Business Continuity Flow Chart for IT response to natural disasters, hardware failures, and cybersecurity events (undated) • A Technology Use Policy setting acceptable use of City technology resources that covers data and information security and cybersecurity (last updated in 2018) • A Photo Identification Policy governing acceptable photo use (last updated in 2018) • A Redaction Policy concerning private information in public records (last updated in 2018) While these policies and procedures are important controls for the City to reduce IT -related risks, they fall outside of the recommended review cycle of three years. All policies and procedures should 37% 43% 15% 3%
1%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 57
FOR USE BY THE CITY OF CUPERTINO ONLY
include the date they were created as well as revision or review dates to ensure policies are kept up to date and provide clarity to staff.
The City takes a hybrid approach to data storage, with some data stored on premises and some stored in the Cloud. In alignment with best practice, the on-premises environment and applications are backed up in an off-site location. Though on-site storage typically presents greater risks, the on- premises environment is being updated within the coming months after a recent audit noted that the server room is shared with the Finance Division and is accessible by non-IT personnel.
City Systems
The City uses Zendesk as its CRM and New World as its ERP. Although these are commonly used systems, City staff report integration challenges between New World and other major systems as described in Accounting and Finance
.While staff generally reported that New World’s inefficiencies were frustrating, they shared that the workarounds that have been developed are ultimately operational. One of the needs employees identified related to IT was a desire for IT to continue to strengthen system integration and data flow automation to reduce manual processes.
The City lacks some key systems that would contribute to increased efficiency and effectiveness.
Examples include a comprehensive HR information system, learning management system, grants management, and a performance management system to automate performance evaluations.
Otherwise, employees rated the quality of the hardware and software systems currently in use at the City highly.
Q: How would you rate the quality of the information technology systems (software, applications, programs, etc.) that you currently have and use in your role?
IT Governance
IT governance plays an important role in local governments to optimize technology purchases, systems integration, and access to information to support decision-making. The City has established an Innovation & Technology IT Governance Framework, which is responsible for the strategic planning, governance, and policy-setting related to the use of digital services for the City. In accordance with industry standards, asset decision-making is centralized—the IT Department approves all software and hardware purchases.
33% 51% 11% 4%
1%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 58
FOR USE BY THE CITY OF CUPERTINO ONLY
OVERALL RISK LEVEL: LOW TO MODERATE
Impact
Likelihood
Preparedness
Trajectory
MODERATE LOW TO MODERATE MODERATE FLAT
Risk Mitigation
● Explore opportunities to establish a formal agreement with the Santa Clara County Fire Department for fire services.
● Work with the Santa Clara County Sherriff’s Department to understand why some types of crime have been increasing and jointly develop mitigation strategies.
● Consider allocating resources to the Unhoused Task Force to support proactive public communication around the City’s efforts to address homelessness in the community.
RESIDUAL RISK: LOW TO MODERATE
Risk Areas: Risks associated with public safety services, including level of services, funding, and community issues.
Scope: Public safety includes emergency services such as law enforcement, fire, dispatch, and community disaster response programs.
The City’s public safety and security environment is relatively strong, but there are risks associated with the City’s lack of direct control over its contracted and outsourced police and fire services. In addition, the City does not currently dedicate any money to homelessness related issues or services.
Public Safety
The OEM leads and directs the City in prevention, preparation, mitigation, response, and recovery from all emergencies, hazards, incidents, and events. OEM also maintains the City’s contract for law enforcement services with the Santa Clara County Sheriff’s Office.
The City contracts its law enforcement with the Santa Clara County Sherriff’s Department, and its fire services are provided by the Santa Clara County Fire Department. Outsourcing law enforcement and fire services can result in cost savings for the City and reduce administrative burdens on the City, such as those related to hiring, training, and managing law enforcement and fire service personnel.
However, there are also some risks to this approach:
• The City has less control over law enforcement and fire services and less input into how services are provided and how resources are allocated.
• Santa Clara County may have other priorities, which can impact responsiveness or limit the customizability of services to local needs.
While the City has a formal contract with Santa Clara County for law enforcement services, the City does not have a formal agreement for fire services and staff reported they were not able to meaningfully participate in Santa Clara County’s Fire Department’s strategic planning efforts last
Enterprise Risk Assessment Report | 59
FOR USE BY THE CITY OF CUPERTINO ONLY
year. This represents risk for the City because if the City notices deficiencies in fire services, there is not a defined process to address those concerns. However, the likelihood of this occurring is relatively low, and services appear to be sufficient. This is evidenced by positive responses to the employee survey (respondents did not report any significant concerns regarding the effectiveness of the public safety services delivered to the City and the sense of safety was reported as good or excellent by 82% of respondents) and by Sheriff and Fire response data:
• The average County Sheriff response time in 2022 (the most recent year available) in the City was 5.33 minutes for Priority 1 calls, 6.94 minutes for Priority 2 calls, and 11.73 minutes for Priority 3 calls—all well under the established target response times for the department. 6 • The average Fire response time for emergency events in the City in December 2023 w as 4:47 minutes in urban areas and 5:49 minutes in rural areas. Incidents responded to by Fire in the City decreased slightly during the COVID-19 pandemic and have been climbing back to pre-pandemic levels, which leveled off in 2023. Most responses are EMS (63%) or service (17%).
Q: How would you rate the effectiveness of the public safety services delivered to the City?
Q: How would you rate the overall feeling of safety in the community?
Total equals 99% due to rounding.
The risk level in this area is also informed by crime rates. Crime rates in the City have fluctuated between 2021 and 2023, most recently decreasing between 2022 and 2023. However, some types of crime have been increasing between 2021 and 2023, including simple and aggravated assaults (50%), identity theft and forgery fraud (22%), commercial burglary (33%), and robbery (22%). The 2022 relative crime rate (the most recent comparison available) within the Santa Clara County Sheriff’s Office jurisdiction is among the highest between California agencies that shared data. Crime rates are another area that the City has limited control over due to its contractual service relationship with the Sheriff’s Office.
Public safety and security is also influenced by the public’s perception of homelessness in the community. Homelessness is not as prominent an issue in the City as it is in surrounding areas , and
6 Santa Clara County Sheriff’s Office. 2022 Annual Statistics. Accessed April 25, 2024:
https://countysheriff.sccgov.org/sites/g/files/exjcpb406/files/reports/2022%20SCCSO%20Report%20ToC.pdf. 27% 53% 18%
1%
1%
Excellent Good Average Poor Terrible
29% 53% 14% 3%
Excellent Good Average Poor Terrible
Enterprise Risk Assessment Report | 60
FOR USE BY THE CITY OF CUPERTINO ONLY
the number of people experiencing homelessness in the City appears to be decreasing (the City’s 2022 Point-In-Time count observed 102 people experiencing homelessness, a 36% decrease from the 2019 count).7 However, staff report a sense of increased public concern about the unhoused population in the City and the management of encampments, evidenced by a reported 20 to 30 encampment-related complaints that are received per week. To address concerns in this area, the City created the Unhoused Task Force, comprising multiple City departments. The task force’s primary purpose is to track encampments and ensure that services are provided to people who are unhoused in the City, as well as to communicate with the public and coordinate encampment resolutions with Sheriff, Fire, Public Works, and the City Attorney’s Office. The cost of addressing homelessness is absorbed into standard operating costs across departments, including Public Works.
Code Enforcement
The City employs three FTE Code Enforcement Officers who enforce non-emergency and preventative life-safety issues around zoning, building, housing, and fire code compliance. Code enforcement functions serve a critical role and are responsible for supporting the health, safety, and economic well-being of the community. Code enforcement is budgeted for 4 FTE, and staff shared that vacancies are currently unfilled due to budget conditions, which has impacts on service delivery in this area.
Community Emergency Preparedness
The City has developed community emergency preparedness programs. Such programs are helpful to reduce risks related to disasters and emergencies by helping promote community preparedness.
The City runs a Community Emergency Response Team Program, which is sponsored by FEMA. The City provides ongoing community preparedness training through the Personal and Neighborhood Emergency Preparedness Program, which is operated through the Neighborhood Block Leader Public Safety Program.
7 County of Santa Clara. 2022 Point-In-Time Report on Homelessness. Accessed April 25, 2024:
https://osh.sccgov.org/sites/g/files/exjcpb671/files/documents/2022%20PIT%20Report%20Santa%20Clara%20County.pdf
Enterprise Risk Assessment Report | 61
FOR USE BY THE CITY OF CUPERTINO ONLY
APPENDIX A: EMPLOYEE SURVEY RESULTS
We distributed a confidential online questionnaire to City employees on January 2, 2024, and collected data through February 8, 2024. Out of the 198 full-time employees invited to take the survey, 92 individuals submitted responses, a participation rate of 46%. Some totals may not equal 100 due to rounding.
Years of Tenure
Employee Level8
How would you rate the organization’s level of overall risk? Accounting and Finance
8 Only management-level employees were asked to rate overall level of risk for each category. 14%
8%
26%
15%
28%
18%
22%
30%
4%
10%
5%
18%
Tenure in Position
Tenure with Organization
Less than 1 1 to 2 3 to 5 6 to 10 11 to 15 More than 15 46% 54%Management
Yes No
16% 27% 38% 16% 3%
Low Low to Moderate Moderate Moderate to High High
Enterprise Risk Assessment Report | 62
FOR USE BY THE CITY OF CUPERTINO ONLY
Asset Management
Capital Improvement Program and Infrastructure
Compliance and Financial Reporting
Ethics and Fraud, Waste, Abuse
Funding and Economics
33% 39% 25% 3%
Low Low to Moderate Moderate Moderate to High High
23% 37% 20% 14% 6%
Low Low to Moderate Moderate Moderate to High High
7% 17% 50% 7% 2% 17%
Low Low to Moderate Moderate Moderate to High High N/A
24% 36% 31% 7% 2%
Low Low to Moderate Moderate Moderate to High High
10% 30% 50% 10%
Low Low to Moderate Moderate Moderate to High High
Enterprise Risk Assessment Report | 63
FOR USE BY THE CITY OF CUPERTINO ONLY
Governance
Human Resources
Information Technology
Management and Leadership
Operations and Service Delivery
11% 26% 42% 18% 3%
Low Low to Moderate Moderate Moderate to High High
30% 33% 30% 8%
Low Low to Moderate Moderate Moderate to High High
48% 33% 15% 5%
Low Low to Moderate Moderate Moderate to High High
15% 33% 30% 13% 10%
Low Low to Moderate Moderate Moderate to High High
26% 31% 40% 2%
Low Low to Moderate Moderate Moderate to High High
Enterprise Risk Assessment Report | 64
FOR USE BY THE CITY OF CUPERTINO ONLY
Organization and Staffing
Planning and Strategy
Policies and Processes
Procurement and Contracting
Public Safety and Security
17% 14% 36% 21% 12%
Low Low to Moderate Moderate Moderate to High High
13% 30% 38% 15% 5%
Low Low to Moderate Moderate Moderate to High High
23% 30% 35% 13%
Low Low to Moderate Moderate Moderate to High High
16% 39% 32% 10% 3%
Low Low to Moderate Moderate Moderate to High High
30% 45% 15% 8% 3%
Low Low to Moderate Moderate Moderate to High High
Enterprise Risk Assessment Report | 65
FOR USE BY THE CITY OF CUPERTINO ONLY
Reputation and Public Perception
Risk Programs
30% 30% 35% 5%
Low Low to Moderate Moderate Moderate to High High
8% 36% 33% 21% 3%
Low Low to Moderate Moderate Moderate to High High