CITY COUNCIL STAFF REPORT
Meeting: March 18, 2025
Subject
Citywide Policy Inventory and Gap Analysis Final Report and City Council Policy Inventory
Recommended Action
1. Receive the Citywide Policy Inventory and Gap Analysis Report
2. Review the City Council Policy Inventory and authorize Moss Adams LLP (“Moss Adams”) to include gap analysis as part of the FY 2025-26 Internal Audit Work Plan
Reasons for Recommendation
Background
An inventory of Citywide Administrative and Council policies was included as a project in the Fiscal Year 2023- 24 Council Work Program item to “Repeat the 2013 process of compiling and reviewing all City Policies including 1) Administrative and 2) Council policies and provide recommendations/updates .” The City’s internal auditor, Moss Adams, previously conducted an inventory and gap analysis of the city's fiscal policies as part of their FY 2021- 22 Internal Audit Workplan. Building on this, staff recommended that Moss Adams review the citywide administrative policies as part of their FY 2023-24 Internal Audit Workplan while city staff inventory the Council policies . The FY 2023-24 Internal Audit Workplan was approved by the Audit Committee on July 24, 2023, and the Council on September 19, 2023. This work was identified in the workplan by both the Audit Committee and City Council.
The Citywide policy inventory and gap analysis audit focused on administrative policies, which are more operationally focused such as Travel Policy, Intranet Policy, and Pool Vehicle Use Polic y. Citywide Administrative Policies and Procedures ( P&Ps) are reviewed and approved by the City Manager and department-specific P&Ps are reviewed and approved by the respective Department Head. It is important to note that Moss Adams’ policy gap analysis did not include Council P&Ps and P&Ps adopted by Council Resolution, due to a current list of policies not available to conduct a gap analysis.
Council
approved P&Ps typically cover specific topics of interest to the Council such as Legislative Advocacy Policy, Ethics Policy, Sister City-Friendship Policy, etc.
To create an inventory of Council policies, Administrative Services staff collaborated with the City Manager’s Office, City Attorney’s Office, and Innovation Technology staff. They compiled a list of existing Council policies, which is included as Attachment B , covering policies from 1955 through January 2025.
Although staff created an inventory of Council policies, a significant amount of additional staff time would be required to analyze the effectiveness and relevance of each policy, whether the policy has been rescinded, amended or otherwise moot, as well as analyze, evaluate and determine risk categories. Staff is recommending that Moss Adams review the Council policy inventory and conduct a gap analysis to provide recommendations and updates as part of the FY 2025-26 Internal Audit Work Plan.
Since FY 2021-22, Moss Adams has served as the designated Internal Auditor for the City of Cupertino (“City”) and conducts projects focused on:
• Risks
• Internal controls
• Efficiency and effectiveness
• Best practices
• Compliance
As described in the internal audit charter, the Internal Auditor is appointed by and reports to the Audit Committee and Council. The Audit Committee and Council approve the annual audit work plan, review audit report findings and recommendations, and monitor the implementation of recommendations.
FY 2023-24 Internal Audit Work Plan
Moss Adams develops an internal audit work plan to guide activities for each fiscal year.
The Audit Committee and City Council approved the FY 2023-24 internal audit work plan, which included the following projects:
• FY 2023-24:
o Ongoing Internal Audit Services
o Enterprise Risk Assessment
o Citywide Policy Review and Gap Analysis
The FY 2023-24 work plan was approved by the Audit Committee on July 24, 2023, and the City Council on September 19, 2023.
Project Summary
The goals of this project were to:
• Determine which Citywide departments are adequately covered by comprehensive and current P&Ps
• Identify the gaps within each policy, including areas where:
o There were no documented policies to support departmental functions o Existing policies that are outdated or in need of minor updates or additions, and
o Current internal control or gap coverage is missing key components • Prioritize policy gaps based on overall risk and develop an implementation plan to provide the City with recommendations for prioritizing and addressing identified policy gaps
Moss Adams’ analysis on Citywide administrative policies and procedures was conducted between November 2023 and November 2024 and consisted of the following phases:
Citywide Administrative P&P Inventory
• Obtained all available P&P documents
• Documented a full in ventory of existing P&Ps, including a summary of the coverage areas and age of each P&P
• Discussed with City staff the full inventory of results to ensure that all P&Ps were provided and included in the inventory for each department
Citywide Administrative P&P Gap Analysis
o Identified potential gaps in coverage for the current departmental P&Ps o Assessed the current departmental P&Ps for opportunities to improve the overall content and flow/structure, incorporate best practices, and improve internal controls, where possible, to provide effective resources for employees o Summarized the gaps identified for all policies within the gap analysis o Categorized the significance and extent of the identified gaps as follows: full gaps, major gaps, or minor gaps
o Identified policies that need to be reviewed for potential updates
Project Results
Based on the results of the Citywide administrative P&P inventory and gap analysis performed, Moss Adams developed detailed recommendations, by department, for the City to use as a road map for developing, amending, or updating policies. Moss Adams assigned a risk level (high, medium, or low), and a recommended priority order by phase based on the risk level.
The assessed risk levels recommended phases/timing for addressing gaps and recommendations are summarized by department in the table below:
Department Associated Risk Level1 Management Response
Administrative Services High Risk – 0
Medium Risk – 1
Low Risk - 16
Agree
City Manager’s Office High Risk – 0
Medium Risk – 6
Low Risk - 8
Agree
Community Development High Risk – 0
Medium Risk – 1
Low Risk - 5
Agree
Innovation and
Technology
High Risk – 0
Medium Risk – 4
Low Risk - 4
Agree
Law Enforcement High Risk – N/A
Medium Risk – N/A
Low Risk – N/A
Agree
Parks and Recreation High Risk – 0
Medium Risk – 3
Low Risk - 1
Agree
Public Works High Risk – 1
Medium Risk – 3
Low Risk - 30
Agree on policy update, but
staff is currently evaluating
the timelines and may require
additional time to complete
certain policies
Management Response
Management agrees with the observations and recommendations. Staff will work on updating P&Ps as needed per the final audit report. Progress updates will be provided as part of Moss Adams’ quarterly Internal Audit Status Updates.
Audit Committee
The Citywide Policy Inventory and Gap Analysis report was presented twice to the Audit Committee, once on October 31, 2024, and again on November 25, 2024, as Audit Committee’s duties and responsibilities outlined in the Municipal Code include “ to review internal audit reports.” On October 31, 2024, the Audit Committee (3-0-2) reviewed and accepted the report. Subsequent to the report being received by the Audit Committee, staff discovered that four policies were inadvertently placed in the administrative
1 High – Phase 1 (within 6 months of fiscal year end through June 2025)
Medium – Phase 2 (within 12 months of fiscal year end through Dec 2025)
Low – Phase 3 (within 18 months of fiscal year end through Dec 2025)
category when staff submitted administrative policies to Moss Adams. These include Records Retention, Sponsorship, Trusted Electronics System and Naming of City Facilities. As a result, staff reached out to Moss Adams to revise the report and remove the four Council adopted policies from the inventory. Therefore, a revised Citywide Policy Inventory and Gap Analysis report was presented to the Audit Committee again on November 25, 2024. The Audit Committee (3-0-2) reviewed and accepted the report. The revised final report is included as attachment A.
The Council policies were not presented to Audit Committee as they were not a part of Moss Adams’ audit workplan but were completed by staff as part of the City Council Work Program.
City Council Policy Audit
Administrative Services staff worked with City Manager’s Office and City Attorney’s Office staff to determine an inventory of existing City Council policies. These policies were then cross-referenced with Legistar, the City’s records management system, to determine if all policies had been captured. To expand the search of policies, the Innovation Technology Department also developed a platform that leveraged machine learning to enable staff to thoroughly search for resolutions and ordinances dating back to 1955. Without this tool, a significant amount of staff time would be necessary to locate almost 70 years’ worth of documents. As explained in the Next Steps section, these documents could be analyzed as part of a Council policy gap analysis.
Council policies are within the purview of City Council. Staff completed an inventory of the policies as part of the City Work Program item. Policies are included in Attachment B. No risk levels are included.
Next Steps
Administrative Policies - Staff will begin working on implementing the report’s recommendations on administrative policies consistent with prior internal audit recommendations. Internal audit status reports are available on the City’s website at cupertino.org/internal-audit.
City Council Policies - This report completes the City Work Program item. Should Council desire additional work to review and/or update any Council policies , staff is recommending that Moss Adams review the City Council policy inventory and conduct a gap analysis to provide recommendations and updates as part of the FY 2025-26 Internal Audit Workplan.
Sustainability Impact
No sustainability impact.
Fiscal Impact
No fiscal impact. The City’s Internal Audit contract is included in the contracts category of the accounting program in the FY 2023-24 and FY 2024-25 Adopted Budgets. City Council policy inventory was completed by staff within existing appropriations. Should Council approve Moss Adams to conduct a gap analysis of Council policies as part of the FY 2025-26 Internal Audit Workplan, the project estimate would be $40,000.
City Work Program (CWP) Item:
Yes, Whole City Policy Review.
CWP Item Description:
Repeat the 2013 process of compiling and reviewing all City Policies including 1) Administrative and 2) Council policies and provide recommendations/updates.
Council Goal:
Public Engagement and Transparency.
Environmental Quality Act
Not applicable.
_____________________________________
Prepared by: Toni Oasay-Anderson, Senior Management Analyst Reviewed by: Kristina Alfaro, Director of Administrative Services Reviewed by: Tina Kapoor, Deputy City Manager
Approved for Submission by: Pamela Wu, City Manager
Attachments:
A – Citywide Policy Inventory and Gap Analysis Report
B – City Council Policy Inventory