Palo Alto City Council
April 4, 2022

1 City Council
Special Meeting
Monday, April 4, 2022
5:00 PM
Council Chambers & Virtual

AMENDED
Amended items appear below in RED
Pursuant to AB 361 Palo Alto City Council meetings will be held as “hybrid” meetings with the option to attend by teleconference/video conference or in person. To maximize public safety while still maintaining transparency and public access, members of the public can choose to participate from home or attend in person. Information on how the public may observe and participate in the meeting is located at the end of the agenda. Masks are strongly encouraged if attending in person.

HOW TO PARTICIPATE

VIRTUAL PARTICIPATION
CLICK HERE TO JOIN (https://cityofpaloalto.zoom.us/j/362027238) Meeting ID: 362 027 238 Phone:1(669)900-6833
The meeting will be broadcast on Cable TV Channel 26, live on YouTube at https://www.youtube.com/c/cityofpaloalto, and s t r e a m e d t o Midpen Media Center at https://midpenmedia.org.

TIME ESTIMATES
Time estimates are provided as part of the Council's effort to manage its time at Council meetings. Listed times are estimates only and are subject to change at any time, including while the meeting is in progress. The Council reserves the right to use more or less time on any item, to change the order of items and/or to continue items to another meeting. Particular items may be heard before or after the time estimated on the agenda. This may occur in order to best manage the time at a meeting or to adapt to the participation of the public.

PUBLIC COMMENTS
Public Comments will be accepted both in person and via Zoom meeting. All requests to speak will be taken until 5 minutes after the staff’s presentation. Written public comments can be submitted in advance to [email protected] and will be provided to the Council and available for inspection on the City’s website. Please clearly indicate which agenda item you are referencing in your email subject line.

CALL TO ORDER
CLOSED SESSION (5:00 PM - 6:00 PM)
Public Comments: Members of the public may speak to the Closed Session item(s); three minutes per speaker. 2 Special Meeting April 4, 2022
Materials related to an item on this agenda submitted to the Board after distribution of the agenda packet are available for public inspection at www.CityofPaloAlto.org.

1. CONFERENCE WITH LABOR NEGOTIATORS City Designated
Representatives: City Manager and his Designees Pursuant to Merit System Rules and Regulat ions (Ed Shikada, Kiely Nose, Rumi Portillo, Sandra Blanch, Nicholas Raisch, Molly Stump, and Terence Howzell) Employee Organization: Employee Organization: Service Employees International Union, (SEIU) L ocal 521, Utilities Management and Professional Association of Palo Alto (UMPAPA)Palo Alto Peace Officers’ Association (PAPOA), Palo Alto Police Management Association (PMA), International Association of Fire Fighters (IAFF) local 1319, Palo Alto Fire Chie fs Association (FCA), Management and Professional Employees (MGMT) ; Authority: Government Code Section 54957.6 (a) ; Authority: Government Code Section 54957.6 (a)
SPECIAL ORDERS OF THE DAY (6:00 PM - 6:15 PM)

2. Adoption of Resolution for Gabriel Mora Upon His Retirement

3. Proclamation Honoring National Public Safety Telecommunicator's Week - April 10-16, 2022

AGENDA CHANGES, ADDITIONS AND DELETIONS
PUBLIC COMMENT (6:15 PM - 6:30 PM)
Members of the public may speak to any item NOT on the agenda. Council reserves the right to limit the duration of Oral Communications period to 30 minutes.

CONSENT CALENDAR (6:30 PM - 6:35 PM)
Items will be voted on in one motion unless removed from the calendar by three Council Members.

4. Approve Minutes from the March 11, 2022 City Council Meeting, March 14, 2022 City Council Meeting, and the March 21, 2022 City Council Meeting

5. Utilities Advisory Commission and Staff Recommend the City Council Adopt Two Resolutions: 1) Approving an Amendment to the Amended and Restated Water Supply Agreement Between the C ity and County of San Francisco and Wholesale Customers in Alameda County, San Mateo County, and Santa Clara County and Authorizing the City Manager to Execute the Amended Agreement; and 2) Approving a Minimum Purchase Transfer from the City of Mountain Vi ew to the City of East Palo Alto

6. Approve Finance Committee Recommendation for FY 2023 to (a) Return to the Customary Pre -Pandemic Business Registry Certificate Requirement and Fee, and (b) Pause for One Year the Dow ntown Business Improvement District Assessment Program
Public Letters
3 Special Meeting April 4, 2022
Materials related to an item on this agenda submitted to the Board after distribution of the agenda packet are available for public inspection at www.CityofPaloAlto.org.

7. Approve, as Recommended by Policy and Services Committee, the FY2022/2023 Risk Assessment & Audit Plan Reports

8. Adoption of a Resolution Authorizing Use of Teleconferencing for Council Meetings During Covid-19 State of Emergency

9. Approval of Amendment Number 2 to the Power Purchase Agreement for Landfill Gas -Generated Electricity With Ameresco Keller Canyon LLC., Reducing the Facility's Output in Exchange for an Annual $250,000 Administrative Payment to the City

10. Approval of Cont ract Amendment Number 1 to Contract Number S22183587 with Fairbanks, Maslin, Maullin, Metz, and Associates (FM3) in the Amount of $28,500 for One Additional Poll (Three Polls, Total) for the Potential November 2022 Bal lot Measure(s) for a Total Not to Exceed Amount of $113,500 and Approve a Budget Amendment in the General Fund

11. Adoption of a Resolution Authorizing the Submittal of a Financial Assistance Application to the United States Bureau of Reclamation for the WaterSMART: Title XVI Water Reclamation and Reuse Project

12. Approval of Pets in Need's Amended Termination Notice to Extend Termination Date Six Months for Continued Animal Shelter Operations

13. Adoption of a Resolution Amending PUBLIC HEARING: Objection s to Weed Abatement and Adoption of a Resolution Ordering Weed Nuisance Abated to Correct an Administrative Error

14. Approval of Construction Contract Number C22181213 with Stronger Building Services in the Amount of $179,500 for the Mitchell Park Library Roof and Gutter Repair Project; Autho rize the City Manager or their Designee to Negotiate and Execute one or more Change Orders for Related Additional but Unforeseen Work Not to Exceed $17,950; and Approval of a Budget Amendment for the Roofing Replacemen t Capital Project (PF-00006) in the Capital Improvement Fund CITY MANAGER COMMENTS (6:35 PM - 6:55 PM)
BREAK (6:55 PM - 7:05 PM)

ACTION ITEMS
Include: Reports of Committees/Commissions, Ordinances and Resolutions, Public Hearings, Reports of Officials, Unfinished Business and Council Matters.

Q & A
Presentation
4 Special Meeting April 4, 2022
Materials related to an item on this agenda submitted to the Board after distribution of the agenda packet are available for public inspection at www.CityofPaloAlto.org.

15. Review and Approval of Workplans Implementing 2022 City Council Priorities (7:05 PM – 8:30 PM) Supplemental Memo Added

16. Receive the Police Department’s Annual Report and Discuss and Accept the Staff Update on Radio Encryption as a Follow-up from the Policy and Services Committee Recommendation on February 8, 2022 (8:30 PM – 10:00 PM) Supplemental Memo Added

17. Clarification of In-Person Attendance Protocols for Council Committees and Boards and Commissions (10:00 PM – 10:30 PM)

COUNCIL MEMBER QUESTIONS, COMMENTS, ANNOUNCEMENTS
Members of the public may not speak to the item(s)

ADJOURNMENT

OTHER INFORMATION
Standing Committee Meetings
Finance Committee Special Meeting March 28, 2022
Finance Committee Meeting Cancellation April 5, 2022
Public Letters
Schedule of Meetings

AMENDED AGENDA ITEMS
Items that have been added/modified from the original publication of the agenda are listed below. Any corresponding materials are appended to the end of the initial packet. If full items have been added to the Agenda, they will be denoted with a number staring with AA, meaning Amended Agenda item.

Review and Approval of Workplans Implementing 2022 City Council Priorities Supplemental Memo Added

16. Receive the Police Department’s Annual Report and Discuss and Accept the Staff Update on Radio Encryption as a Follow -up from the Policy and Services Committee Recommendation on February 8, 2022 Supplemental Memo Added

15. Presentation
Presentation
Public Comments
Public Comments
5 Special Meeting April 4, 2022
Materials related to an item on this agenda submitted to the Board after distribution of the agenda packet are available for public inspection at www.CityofPaloAlto.org.

PUBLIC COMMENT INSTRUCTIONS

Members of the Public may provide public comments to teleconference meetings via email, teleconference, or by phone.

1. Written public comments may be submitted by email to [email protected].

2. Spoken public comments using a computer will be accepted through the teleconference mee ting. To address the Council, click on the link below to access a Zoom -based meeting. Please read the following instructions carefully.

A. You may download the Zoom client or connect to the meeting in - browser. If using your browser, make sure you ar e using a current, up-to-date browser: Chrome 30+, Firefox 27+, Microsoft Edge 12+, Safari 7+. Certain functionality may be disabled in older browsers including Internet Explorer.

B. You may be asked to enter an email address and name. We request that you identify yourself by name as this will be visible online and will be used to notify you that it is your turn to speak.

C. When you wish to speak on an Agenda Item, click on “raise hand.” The Clerk will activate and unmute speakers in turn. Speakers will be notified shortly before they are called to speak.

D. When called, please limit your remarks to the time limit allotted.

E. A timer will be shown on the computer to help keep track of your comments.

3. Spoken public comments using a smart phone will be accepted through the teleconference meeting. To address the Council, download the Zoom application onto your phone from the Apple App Store or Google Play Store and enter the Meeting ID below. Please follow the instructions B-E above.

4. Spoken public comments using a phone use the telephone number listed below. When you wish to speak on an agenda item hit *9 on your phone so we know that you wish to speak. You will be asked to provide your first and last name before addressing the Council. You will be advised how long you have to speak. When called please limit your remarks to the agenda item and time limit allotted.

CLICK HERE TO JOIN Meeting ID: 362 027 238 Phone:1(669)900-6833

City of Palo Alto (ID # 14202)
City Council Staff Report
Meeting Date: 4/4/2022
City of Palo Alto Page 1
Title: Adoption of Resolution for Gabriel Mora Upon His Retirement From: City Manager
Lead Department: Police
Attachments:
• Attachment2.a: Attachment A: Gabriel Mora Resolution
2 Packet Pg. 6
Resolution

EXPRESSING APPRECIATION TO GABRIEL MORA

UPON HIS RETIREMENT
WHEREAS, Gabriel Mora served the City of Palo Alto and its residents as a member of the Palo Alto Police Department for nearly 24 years years, being hired as a Parking Enforcement Officer (a position later renamed Community Service Officer or CSO) in June 1998; and
WHEREAS, CSO Mora spent the majority of his years of service assigned in parking enforcement, enforcing parking regulations throughout Palo Alto, and also spent two separate stints as a patrol-based CSO between 2001 and 2004 and again from 2019 to 2022, where he responded to a wide variety of non -emergency calls and conducted investigations into thefts, burglaries, vandalisms, non-injury traffic collisions, abandoned vehicles, noise complaints, and more; and
WHEREAS, his fluency in Spanish was a tremendous asset to the Police Department, with CSO Mora often helping police officers and detectives with interviews of crime victims, witnesses, and suspects; and WHEREAS, CSO Mora assisted patrol officers many times over the years by spotting criminals and wanted subjects as they fled from the scenes of crimes, working in an “observe and report” capacity on their whereabouts until a police officer could arrive to detain the person and continue the investigation, which often led to arrests; and WHEREAS, CSO Mora received the Police Department’s prestigious Medal of Valor for his actions on October 8, 2003, when at great risk to his own life, he pulled an elderly woman from the path of an oncoming train and saved her life; and
WHEREAS, CSO Mora was always a friendly face to the community, bringing his calm demeanor and easy smile to assist him with his job duties and to help de-escalate tense situations; and WHEREAS, CSO Mora received several commendations for assisting with dignitary visits and special events; and
WHEREAS, CSO Mora supported his coworkers with a high degree of professionalism and respect that is in alignment with the mission of the Department; and
WHEREAS, CSO Mora deserves a long and happy retirement for all his years of dedicated service; and NOW, THEREFORE, BE IT RESOLVED, that the City Council of the City of Palo Alto hereby commends the outstanding public service of Community Service Offi cer Gabriel Mora and records its appreciation, as well as the appreciation of the citizens of this community, upon his retirement.

INTRODUCED AND PASSED: April 4, 2022

ATTEST: APPROVED:

_____________________ ____________________
City Clerk Mayor

APPROVED AS TO FORM:

_____________________ ____________________
City Manager City Attorney

2.a
Packet Pg. 7
City of Palo Alto (ID # 14033)
City Council Staff Report
Meeting Date: 4/4/2022
City of Palo Alto Page 1
Title: Proclamation Honoring National Public Safety Telecommunicator's Week - April 10 -16, 2022
From: City Manager
Lead Department: Police
Attachments:
• Attachment3.a: Attachment A - National Public Safety Telecommunications Week 3 Packet Pg. 8

______________________________
Patrick Burt
Mayor

Proclamation

NATIONAL PUBLIC SAFETY
TELECOMMUNICATOR’S WEEK
April 10-16, 2022

WHEREAS, emergencies can occur at any time requiring police, fire, or emergency medical services; and

WHEREAS, when an emergency occurs the prompt response of law enforcement, firefighters and paramedics is critical to the protection of life and preservation of property; and

WHEREAS, the safety of our police officers and firefighters is dependent upon the qu ality and accuracy of information obtained from citizens who telephone the City of Palo Alto Communications Center; and

WHEREAS, public safety dispatchers are the first and most critical contact our citizens have with emergency services; and

WHEREAS, public safety dispatchers are the single vital link for our law enforcement and fire personnel by monitoring their activities by radio, providing them information and ensuring their safety; and

WHEREAS, public safety dispatchers of the City of Palo Alto Communications Center have contributed substantially to the apprehension of criminals, suppression of fires and treatment of patients; and

WHEREAS, each dispatcher has exhibited compassion, understanding and professionalism during t he performance of their job in the past year; and

NOW, THEREFORE, I, Patrick Burt, Mayor of the City of Palo Alto on behalf of the entire City Council do hereby proclaim and call upon all citizens of Palo Alto to observe the week of April 10-16, 2022, as “National Public Safety Telecommunicator’s Week” and join in honoring the men and women whose diligence and professionalism keep our city and citizens safe.

Presented: April 4, 2022

3.a
Packet Pg. 9

City of Palo Alto (ID # 14217)
Office of the City Clerk
City Council CAO Report

Meeting Date: 4/4/2022

Title: Approve Minutes from the March 11, 2022 City Council Meeting, March 14, 2022 City Council Meeting, and the March 21, 2022 City Council Meeting
From: Lesley Milton, City Clerk

Staff recommends Council to review and approve the minutes as presented.

ATTACHMENTS:
• Attachment4.a: Attachment A: 20220311amCCs (PDF)
• Attachment4.b: Attachment B: 20220314amCCs (PDF)
• Attachment4.c: Attachment C: 20220321amCCs (PDF)
4 Packet Pg. 10

CITY COUNCIL

ACTION MINUTES

City Council
Special Meeting
March 11, 2022
The City Council of the City of Palo Alto met on this date in v irtual teleconference at 4:00 P.M.

Present: Burt, Cormack, DuBois, Filseth, Kou, Stone, Tanaka

Absent: None
Action Items

1. Interviews for the Architectural Review Board.

The City Council interviewed the following applicants for the Architectural Review Board:

A. Alfred Mandel
B. Curtis Smolar
C. Yingxi Chen
D. Kendra Rosenberg
E. Joao (Johnny) Baptista DaRosa
F. John Kunz
Adjournment: The meeting was adjourned at 5:11 P.M.

4.a
Packet Pg. 11

ACTION MINUTES

Sp. City Council Meeting
Action Minutes: 3/11/2022
ATTEST: APPROVED:
____________________ ____________________
City Clerk Mayor NOTE: Action minutes are prepared in accordance with Palo Alto Municipal Code (PAMC) 2.04. 160(a) and (b). Summary minutes ( sense) are prepared in accordance with PAMC Section 2.04.160(c). Beginning in January 2018, in accordance with Ordinance No. 5423 , the City Council found action minutes and the video/audio recordings of Council proceedings to be the official records of both Council and committee proceedings. These recordings are available on the City’s website.

4.a
Packet Pg. 12

CITY COUNCIL

DRAFT ACTION MINUTES

Special Meeting
March 14, 2022
The City Council of the City of Palo Alto met on this date in v irtual teleconference at 5:00 P.M.

Present: Burt, Cormack, DuBois, Filseth, Kou, Stone, Tanaka

Absent:

Closed Session

1. CONFERENCE WITH LABOR NEGOTIATORS City Designated
Representatives: City Manager and his Designees Pursuant to Merit System Rules and Regulations (Ed Shikada, Kiely Nose, Rumi Portillo, Sandra Blanch, Nicholas Raisch, Tori Anthony, Molly Stump, and Terence Howzell) Employee Orga nization: Service Employees International Union, (SEIU) Local 521, Utilities Management and Professional Association of Palo Alto (UMPAPA)Palo Alto Peace Officers’ Association (PAPOA), Palo Alto Police Management Association.

MOTION: Council Member Filset h moved, seconded by Council Member Cormack to go into Closed Session.

MOTION PASSED: 6-0, DuBois absent
Council went into Closed Session at 5:03 P.M.

Council Member Dubois jointed the meeting at 5:05 PM.

Council returned from Closed Session at 6:38 P.M.

There were no announcements for the public.

Special Orders of the Day

2. Congratulations to Sheryl Klein for designation as Woman of Persistence for Palo Alto.

NO ACTION TAKEN

3. Project Sentinel

4.b
Packet Pg. 13

DRAFT ACTION MINUTES

(Sp.) City Council Meeting
Draft Action Minutes: 03/14/2022

NO ACTION TAKEN
AA1. Appointments of Candidates for the Architectural Review Board.

MOTION: Council Filseth motioned, seconded by Mayor Burt to conduct an initial round of voting with the highest votes receiving the full term, and the second highest would receive the unexpired term. If there is no consensus, there would be a second round of voting for the terms.

MOTION PASSED: 7-0
First Round of voting for two positions on the Architectural Review Board; one full term ending March 31, 2025, and one unexpired term ending March 31, 2024.

Candidate Yingxi Chen receiving 6 votes is appointed to the full term expiring March 31, 2025 and Candidate Kendra Rosenberg receiving 5 votes is appointed to the unexpired term ending March 31, 2024.

Study Session

12. Report and Discussion on Community Engagement Activities Planned to Implement the City’s Workplans for the 2022 Calendar Year.

NO ACTION TAKEN
Agenda Changes, Additions and Deletions
None
Consent Calendar
Council Member Cormack Registered a No Vote on Item 6.

Council Member Tanaka Registered a No Vote on Items 5-8.

MOTION: Council Member Cormack moved, seconded by Council Member Filseth to approve Agenda Item Numbers 5 -10, and Item Number 4 as amended.

4. Approve Minutes from the February 28, 2022 City Council Meeting.

5. Adoption of Side letters of Agreement with Utilitie s Management and Professional Association of Palo Alto "UMPAPA", International Association of Fire Fighters IAFF "IAFF", Fire Chiefs Association "FCA", Palo Alto Peace Officers’ Association (POA), Palo Alto Police Management

4.b
Packet Pg. 14

DRAFT ACTION MINUTES

(Sp.) City Council Meeting
Draft Action Minutes: 03/14/2022
Association (PMA); and Updated Salary Schedules for Management and Professional Employees, SEIU Hourly Unit, and Limited Hourly Employees.

6. City Council Approval of the City's Response to the Civil Grand Jury Report Regarding Affordable Housing and Direction to Staff to Submit the Response Letter in Accordance with State Law Prior to the March 16, 2022 Deadline.

7. Approval of Amendment Number 2 to Contract Number C19172119 with Daryl D. Jones, Inc. DBA Telecommunications Engineering Associates (TEA) to Increase the Scope of Services to Include Program Verification and Design Review for the Public Safety Building Project (CIP PE-15001) and, Accordingly, Increase the Contract Amount by $189,882, for a New Total Not-to-Exceed Amount of $874,882.

8. Adoption of Resolution 10023 Amending t he Electric Hydro Rate Adjuster (E -HRA) and Activating the E -HRA Rate at the $0.013/kWh Level, Effective April 1, 2022 and Transmit Information on Preliminary Rate Forecast.

9. Approval of Surveillance Use Policy and Contract for E -Citation Devices/Services with Turbo Data Systems, Not-to-Exceed $218,545 for Five Years.

10. Approval of Amendment Number 2 to Contract Number C18168129 with Kennedy / Jenks Consultants for Professional Design Services for the Primary Sedimentation Tanks Rehabilitation and Equipment Room Electrical Upgrade Project at the Regional Water Quality Control Plant to Increase Compensation by $166,747 for a New Maximum Compensation Not to Exceed $1,131,747, and to Extend the Contract Term Through June 30, 2024 - Capital Improvement Program Project WQ-14003.

MOTION SPLIT FOR THE PURPOSE OF VOTING
ITEMS 4, 10 OF MOTION PASSED: 7-0
ITEMS 5-8 OF MOTION PASSED: 6-1, Tanaka no
ITEM 6 OF MOTION PASSED: 5-2, Cormack, Tanaka no
City Council took a break at 8:55 P.M. and returned at 9:05 P.M.

Action Items

4.b
Packet Pg. 15

DRAFT ACTION MINUTES

(Sp.) City Council Meeting
Draft Action Minutes: 03/14/2022

11. City Council Discussion with the Independent Police Auditor and Possible Approval of a Performance Review on Recruitment and Hiring.

MOTION: Council Member DuBois moved, seconded by Mayor Burt to approve the performance review of the Police hiring practices and require the Police Department to provide a written response to future IPA recommendations.

MOTION PASSED: 7-0

13. Discuss Recommended Foothills Fire Mitigation and Safety Improvement Strategies.

MOTION: Mayor Burt moved, seconded by Council Member Cormack to direct Staff to adopt the recommendation as stated:

A. Pursue funding for eucalyptus tree removal in Foothills Nature Preserve, Pearson Arastradero Nature Preserve, and Esther Clark Park, and Foothills Fire Management Plan (FFMP) mitigation efforts; B. Authorize the Fire Chief to determine, in collaboration with CSD, the appropriate restrictions on barbeques and campfires at Foothills Nature Preserve; and
C. Return to the Council with an Ordinance amendment to modify Municipal Code Section 2.30.620 (Surveillance and Privacy Protection Ordinance) to add the Foothills Fire Early Warning System (FFEWS).

MOTION PASSED: 7-0
Adjournment: The meeting was adjourned at 11:21 P.M.

ATTEST: APPROVED:
____________________ ____________________
City Clerk Mayor NOTE: Action minutes are prepared in accordance with Palo Alto Municipal Code (PAMC) 2.04.160(a) and (b). Summary minutes (sense) are prepared in accordance with PAMC Section 2.04.160(c). Beginning in January 2018, in accordance with Ordinance No. 5423
, the City Council found action minutes
and the video/audio recordings of Council proceedings to be the official records of both Council and committee proceedings. These recordings are available on the City’s website.

4.b
Packet Pg. 16

CITY COUNCIL

DRAFT ACTION MINUTES

Special Meeting
March 21, 2022
The City Council of the City of Palo Alto met on this date in virtual teleconference at 5:00 P.M.

Participating: Burt, Cormack, Filseth, Kou, Stone, Tanaka

Absent: DuBois
Special Orders of the Day

1. Tokyo Paralympics Gold Medal Winner Palo Alto Resident Katie Holloway Bridge.

Agenda Changes, Additions and Deletions
None
Consent Calendar
Council Member Tanaka registered a no vote on Agenda Item Number 9.

MOTION: Council Member Cormack moved, seconded by Council Member Filseth to approve Agenda Item Numbers 2-9.

2. Approve Minutes from the March 7, 2022 City Council Meeting.

3. Approval of a Construction Contract With Casey Construction, Inc. for Sewer Lateral Installation, Repair and Replacement and Wastewater Collection System Rehabilitation in a Total Not- to-Exceed Amount of $2,998,266 for a Three-Year Term Through June 2025.

4. Authorize Transmittal of the 2021 Compre hensive Plan Annual Progress Report to the Office of Planning and Research and the 2021 Housing Element Annual Progress Report to the Department of Housing and Community Development.

5. Accept the Stanford University Medical Center (SUMC) Annual Report for Fi scal Year 2020 -2021 and Find the SUMC Parties in Compliance With the Development Agreement.

4.c
Packet Pg. 17

DRAFT ACTION MINUTES

Sp. City Council Meeting
Draft Action Minutes: 3/21/2022

6. Approval of Task Order Construction Contract C22183580 With MP Nexlevel of California, Inc. in the Amount not to exceed $8,815,809 for Trenching and Substructure Installation and Materials; Authorization for the City Manager to Negotiate and Execute Related but Unforeseen Change Orders Not -to-Exceed $881,581, for a Total Not -to-Exceed Amount of $9,697,390 Over Three Years.

7. Approval of Construction Contract C22184073 with O'Grady Paving Inc. in the Amount of $1,200,234, and Authorization for the City Manager or Their Designee to Negotiate and Execute Change Orders for Related Additional but Unforeseen Work that May Develop During the Project Up to a Not- to-Exceed Amount of $118,523, for the Fiscal Year 2022 Asphalt Paving, Capital Improvements Program Projects PE86070, PO-12001, PL-04010 and PO-89003.

8. Approval of Amendment Number One to Contract C19173550 with Accela, Inc. to add the Accela Mobile Office and Accela Electronic Reporting Database Modules to this Online Services Contract, and to Increase the Compensation by an Amount Not -To-Exceed $57,210 for a New Total Not-to-Exceed Amount of $848,554.

9. Direct Staff to Relinquish S. Palo Alto Bikeways Project Grant Under OBAG2 and Reapply Under OBAG3 in May, 2022 to Allow For Additional Time to Meet Project Outreach, Design, and CEQA Requirements.

MOTION SPLIT FOR PURPOSES OF VOTING
MOTION PASSED ITEMS 2-8: 6-0, DuBois absent
MOTION PASSED ITEMS 9: 5-1, DuBois absent, Tanaka no
Action Items

10. Adoption of an Interim Ordinance Establishing Objective Urban Lot Split Standards and Further Refinements to SB 9 Development Standards; Authorizing the Public Works Director to Publish Objective Standards Regarding Adjacent Improvements Related to SB 9 Projects; and Direction Regarding Listing Properties Eligible for Historic Status.

MOTION: Vice Mayor Kou moved, seconded by Council Member Filseth to:

A. Review and adopt proposed objective standards for urban lot split s.

These standards will only apply to qualifying SB 9 projects within Palo Alto (Attachment A) with the flagpole to be at least 10 feet wide;

4.c
Packet Pg. 18

DRAFT ACTION MINUTES

Sp. City Council Meeting
Draft Action Minutes: 3/21/2022
B. Adopt Interim Ordinance Refining SB 9 Regulations and Authorizing the Public Works Director to Publish Objective Standards Regarding Adjacent Public Improvements Related to SB 9 Projects (Attachment B); and
C. Direct Staff to work with the Historic Resources Board to review the approximately 165 local, state and federal eligible properties and make recommendations for listing on the inventory in accordance with the process set forth in the PAMC and collaborate with the Historic Resources Board for community engagement.

MOTION PASSED: 6-0, DuBois absent

11. Approve the Housing Element Working Group and Planning and Transportation Commission Recommendations for the 2023 -31 Housing Element Sites and Their Associated Unit Yields as Well as Potential Feedback on Housing Element Policies and Programs, or Other Housing- Related Direction to Staff.

ORIGINAL MOTION: Mayor Burt moved, seconded by Council Member Stone to approve the Planning and Transportation Commission 2023 -31 Housing Element sites with their associated unit yields as reflected in Attachment A, incorporating staff recommended adjustments, and the following additional site selection strategies:

A. Faith Based Institutions Strategy: Require units to be 100% affordable units;
B. City-owned Parking Lots Strategy: Include strategy in the sites list and its 168 unit yield, providing they are 100% affordable units; C. General Manufacturing (GM) Zone Strategy: Encourage Council to plan retail, transit, schools, bike lanes, and parks to support the new neighborhood;
D. General Manufacturing (GM) Zone Strategy: Council to consider changing portions of the GM zoned sites to a multifami ly zone, eliminating general manufacturing uses;
E. Research, Office, Limited Manufacturing (ROLM) Zone Strategy:

Encourage Council to plan retail, transit, schools, bike lanes and parks to support the new neighborhood;
F. Transit Center Strategy: Increase the u nit yield of the Transit Center from 180 units to 270 units;

4.c
Packet Pg. 19

DRAFT ACTION MINUTES

Sp. City Council Meeting
Draft Action Minutes: 3/21/2022
G. Transit Center Strategy: The residential units on this site should be primarily developed as affordable units;
H. Staff to return to the Council for discussion and direction on modifications reducing commercial FAR in combination with increasing housing FAR with a focus on properties in the El Camino Real zone and the two Downtowns; and
I. Staff to return to Council for discussion engaging with Stanford Research Park on identifying additional housing si tes for the coming Housing Element.

MOTION SPLIT FOR THE PURPOSE OF VOTING
MOTION: Mayor Burt moved, seconded by Council Member Stone to approve the following element of the original motion:

B. City-owned Parking Lots Strategy: Include strategy in the sites list and its 168 unit yield, providing they are 100% affordable units.

MOTION PASSED: 4-2, DuBois absent, Tanaka, Kou no
MOTION: Mayor Burt moved, seconded by Council Member Stone to approve the following element of the original motion:

A. Faith Based Institutions Strategy: Require units to be 100% affordable units.

B. City-owned Parking Lots Strategy: Include strategy in the sites list and its 168 unit yield, providing they are 100% affordable units.

C. General Manufacturing (GM) Zone Strategy: Encourage Council to plan retail, transit, schools, bike lanes, and parks to support the new neighborhood.

D. General Manufacturing (GM) Zone Strategy: Council to consider changing portions of the GM zoned sites to a multifamily zone, eliminating general manufacturing uses.

E. Research, Office, Limited Manufacturing (ROLM) Zone Strategy:

Encourage Council to plan retail, transit, schools, bike lanes and parks to support the new neighborhood.

F. Transit Center Strategy: Increase the unit yield of the Transit Center from 180 units to 270 units.

4.c
Packet Pg. 20

DRAFT ACTION MINUTES

Sp. City Council Meeting
Draft Action Minutes: 3/21/2022
G. Transit Center Strategy: The residential units on this site should be primarily developed as affordable units
H. Staff to return to the Council for discussion and direction on modifications reducing commercial FAR in combination with increasing housing FAR with a focus on properties in the El Camino Real zone and the two Downtowns.

I. Staff to return to Council for discussion engaging with Stanford Research Park on identifying additional housing sites for the coming Housing Element.

MOTION PASSED: 4-2, DuBois absent, Tanaka, Cormack no
MOTION: Mayor Burt moved, seconded by Council Member Stone to approve the Planning and Transportation Commission 2023 -31 Housing Element sites with their associated unit yields as reflected in Attachment A, incorporating staff recommended adjustments, and the following additional site selection strategies:

C. General Manufacturing (GM) Zone Strategy: Encourage Council to plan retail, transit, schools, bike lanes, and parks to support the new neighborhood.

F. Transit Center Strategy: Increase the unit yield of the Transit Center from 180 units to 270 units.

MOTION PASSED: 5-1, DuBois absent, Tanaka no
Adjournment: The meeting was adjourned at 11:11P.M.

ATTEST: APPROVED:
____________________ ____________________
City Clerk Mayor NOTE: Action minutes a re prepared in accordance with Palo Alto Municipal Code (PAMC) 2.04. 160(a) and (b). Summary minutes ( sense) are prepared in accordance with PAMC Section 2.04.160(c). Beginning in January 2018, in accordance with Ordinance No. 5423 , the City Council found action minutes and the video/audio recordings of Council proceedings to be the official records of both Cou ncil and committee proceedings. These recordings are available on the City’s website.

4.c
Packet Pg. 21

City of Palo Alto (ID # 13421)
City Council Staff Report

Meeting Date: 4/4/2022

City of Palo Alto Page 1

Title: Utilities Advisory Commission and Staff Recommend the City Council Adopt Two Resolutions: 1) Approving an Amendment to the Amended and Restated Water Supply Agreement Between the City and County of San Francisco and Wholesale Customers in Alameda Co unty, San Mateo County, and Santa Clara County and Authorizing the City Manager to Execute the Amended Agreement; and 2) Approving a Minimum Purchase Transfer from the City of Mountain View to the City of East Palo Alto From: City Manager
Lead Department: Utilities

Recommended Motion
The Utilities Advisory Commission (UAC) and Staff recommend the City Council adopt two resolutions (Attachment A and B) as follows:
1) Approving the attached “2021 Amended and Restated Water Supply Agreement Between the City and County of San Francisco Wholesale Customers in Alameda County, San Mateo County, and Santa Clara County” ( Linked Document) and authorizing the City Manager to execute such Agreement when final execution copies are prepared and distributed by the Bay Area Water Supply and Conservation Agency (BAWSCA); 2) Approving a Minimum Purchase Transfer from the City of Mountain View to the City of East Palo Alto.

Executive Summary
The City purchases water from the San Francisco Regional Water System (System or RWS) and is one of twenty-six BAWSCA members, also known as “Wholesale Customers.” In June 2009, the City entered into a Water Supply Agreement with the City and County of San Francisco (San Francisco) and Wholesale Customers in Alameda County, San Mateo County and Santa Clara County (WSA). There are two propose d WSA amendments for Palo Alto City Council’s consideration.

The primary amendment to the WSA allows for the paired transfer of a portion of an agency’s Minimum Purchase Quantity and Individual Supply Guarantee (ISG) through an expedited procedure. Four W holesale Customers (Alameda County Water District and the Cities of Milpitas, Mountain View, and Sunnyvale) may purchase water from sources other than San 5 Packet Pg. 22

City of Palo Alto Page 2

Francisco Public Utilities Commission (SFPUC), such as State Water Project, local groundwater, or tre ated water from Valley Water, but they are each obligated to purchase a specific minimum annual quantity of water from the SFPUC (Minimum Purchase Quantity). The amendment safeguards the financial and water supply interests of Wholesale Customers, including Palo Alto, who are not participating in such transfers.

The second proposed amendment to the WSA is a separate proposed minimum purchase obligation transfer between two Wholesale Customers. In 2017, the City of Mountain View (Mountain View) transferred 1 MGD of ISG to the City of East Palo Alto (East Palo Alto). Now, Mountain View and East Palo Alto request a parallel action to the proposed WSA Amendment described above. This separate amendment would apply the expedited process in the proposed WSA Amendment to approve a paired transfer of Minimum Purchase Quantity together with the ISG that Mountain View already transferred to East Palo Alto in 2017. Details of this conversion are outlined in an agreement between Mountain View and East Palo Alto that is available for information purposes in Attachment E. This amendment includes the same safeguards to protect the financial and water supply interests of Palo Alto and other Wholesale Customers who are not participating in the transfer.1

In addition to the two amendments described above, the proposed WSA Amendment language expands the waiver of minimum purchase obligations during certain declared emergencies.

Specifically, the WSA Amendment allows the SFPUC to issue a waiver of minimum purchase obligations if there is a state of emergency declared by the Governor of California that impacts water supply use or deliveries from the System.

Background
The WSA establishes the terms by which the twenty -six Wholesale Customers purchase water from the System. The W SA builds upon the 1984 "Settlement Agreement and Master Water Sales Contract between the City and County of San Francisco and Certain Suburban Purchasers in San Mateo County, Santa Clara County and Alameda County." In September 2017, BAWSCA and the Water Management Representatives (WMRs) of the BAWSCA member agencies began reviewing the issue of Minimum Purchase Quantities, as described in Section 3.07.C of the WSA, and discussing the creation of a process to transfer Minimum Purchase Quantities. Througho ut 2017 and 2018, the WMRs held multiple meetings during which the agencies currently subject to Minimum Purchase Quantity requirements and the other Wholesale Customers shared their interests and concerns regarding changes to the Minimum Purchase Quantity requirements and allowing transfers of Minimum Purchase Quantities.

1 In 2017, Palo Alto transferred 0.5 MGD of ISG to East Palo Alto. Palo Alto does not have a minimum purchase obligation, so a similar arrangement would not be applicable.

5 Packet Pg. 23

City of Palo Alto Page 3

Pursuant to Section 2.03 of the WSA, the WSA may be amended by a minimum of two -thirds of the Wholesale Customers representing at least 75 percent of the quantity of water delivered by San Francisco to all the Wholesale Customers during the fiscal year immediately preceding the amendment.

On March 4, 2019, the Palo Alto City Council passed Resolution No. 9821 to approve the Amended and Restated WSA, at which time the Wholesale Customers expressed a collective interest in working together to develop a process for the expedited and permanent transfer of Minimum Purchase Quantities.

Under Article 3 of the Amended and Restated WSA, the SFPUC agrees to deliver water to the Wholesale Customers up to the amount of 184 million gallons per day (MGD), referred to as the “Supply Assurance,” and the Wholesale Customers have allocated shar es of the Supply Assurance among themselves, referred to as ISG. Section 3.04 of the Amended and Restated WSA enables a Wholesale Customer that has an ISG to transfer a portion of its ISG to one or more other Wholesale Customers, subject to several conditions.

Paired transfer of a portion of an agency’s Minimum Purchase Quantity and ISG Section 3.07 of the Amended and Restated WSA provides that four Wholesale Customers (Alameda County Water District and the Cities of Milpitas, Mountain View, and Sunnyvale, collectively, the “Minimum Purchase Customers”) may purchase water from sources other than the SFPUC, but they are each obligated to purchase a specific minimum annual quantity of water from the SFPUC, referred to as a “Minimum Purchase requirement." If a Minimum Purchase Customer does not meet its minimum purchase requirement in a particular fiscal year, it must pay the SFPUC for the difference between its metered water purchases during the fiscal year and its minimum annual purchase quantity set forth in Attachment E of the Amended and Restated WSA. The Amended and Restated WSA does not currently allow a Minimum Purchase Customer to transfer a portion of its minimum purchase requirement and the associated financial obligation to another Wholesale Customer.

In 2019, the Wholesale Customers directed BAWSCA to draft a proposed amendment to the Amended and Restated WSA to provide a procedure for expedited and permanent transfers of Minimum Purchase Quantities that safeguards the financial and water supply in terests of Wholesale Customers not participating in such transfers.

Minimum Purchase Transfer from the City of Mountain View to the City of East Palo Alto

In 2017, Mountain View and East Palo Alto were interested in transferring 1.0 MGD of Mountain Vie w's Minimum Purchase Quantity to East Palo Alto, however, at the time, there was no procedure in the WSA to effectuate such a transfer without amending the WSA.

Therefore, the parties elected to execute a water rights transfer agreement (Linked Document) 5 Packet Pg. 24

City of Palo Alto Page 4

by which East Palo Alto agreed to pay Mountain View $5 Million for the perma nent transfer of all rights, title, interest to 1.0 MGD of Mountain View’s ISG to East Palo Alto.

In 2020, Mountain View and East Palo Alto began discussing a possible future transfer of a portion of Mountain View's Minimum Purchase Quantity to East Palo Alto.

In April 2021 and June 2021 the Councils of East Palo Alto and Mountain View, respectively, each approved the conversion of the 1.0 MGD of Mountain View's ISG sold to East Palo Alto in 2017 into a paired transfer of ISG and up to 1.0 MGD of Mountai n View's Minimum Purchase Quantity to East Palo Alto, in increments of 0.25 MGD, subject to the City Councils' approval of an agreement for each incremental transfer and the approval of the Wholesale Customers and San Francisco. East Palo Alto and Mountai n View are authorized and prepared to execute a negotiated agreement memorializing a 0.25 MGD transfer of Mountain View's Minimum Purchase Quantity to East Palo Alto.

In conjunction with the larger amendment to allow Wholesale Customers with ISGs to permanently transfer a portion of Minimum Purchase Quantity through an expedited procedure, East Palo Alto and Mountain View propose the Wholesale Customers and San Francisco approve, in advance, the terms and conditions for converting up to 1.0 MGD of Mountain View's ISG purchased by East Palo Alto in 2017 into a paired transfer of 1.0 MGD of ISG together with 1.0 MGD of Mountain View's Minimum Purchase Quantity to East Palo Alto, in 0.25 MGD increments, if Mountain View and East Palo Alto mutually agree to suc h incremental transfers in the future and provided the conditions outlined below are met.

Because the 2017 Mountain View/East Palo Alto ISG transfer predates the Minimum Purchase Amendment, the Mountain View/East Palo Alto Minimum Purchase Transfer must be accomplished separately from the adoption of the Minimum Purchase Amendment.2

Discussion

Main Amendment: Paired Transfer of a Portion of an Agency’s Minimum Purchase Quantity and ISG
The proposed amendment, shown with redline changes to Sections 3.04, 3.07, and 2.03 of the Amended and Restated Water Supply Agreement (Linked Document ), allows Wholesale Customers with ISGs and Minimum Purchase obligations to permanently transfer a portion of Minimum Purchase Quantity through an expedited procedure. The proposed amendment offers the following benefits:

1. Procedural safeguards built into the process by which a Wholesale Customer transfers a portion of its Minimum Purchase Quantity and ISG ensure that such transfers will not

2 Palo Alto’s 2017 transfer of 0.5 MGD of ISG to East Palo Alto did not require Wholesale Customer approval because Palo Alto does not have a minimum purchase obligation.

5 Packet Pg. 25

City of Palo Alto Page 5

result in new or different risks to the water supply and financial interests of Wh olesale Customers not participating in a transfer.

2. A Minimum Purchase Customer may transfer a portion of its Minimum Purchase Quantity within its respective ISG to reduce its financial obligation to pay for imputed sales for Minimum Purchase water that it did not use.

3. Intra-system water transfers are one potential solution to long term water reliability needs among the Wholesale Customers. This expedited, permanent transfer procedure will allow intra-system water transfers of Minimum Purchase Quantity to occur without a contract amendment approved by the Wholesale Customers, thus removing administrative obstacles to such transfers.

4. Expedited permanent intra-system transfers of portions of Minimum Purchase Quantity and ISG will facilitate the development o f new water supplies by the SFPUC that are necessary to support the Cities of San Jose and Santa Clara becoming permanent Wholesale Customers.

5. The Wholesale Customers may increase the 6 MGD cap on the total aggregate amount of Minimum Purchase Quantity that may be transferred by all of the Minimum Purchase Customers over the course of one or multiple transfers if demand for Minimum Purchase Quantity transfers exceeds 6 MGD in the future.

San Francisco, acting by and through the SFPUC, approved the 2021 A mended and Restated Water Supply Agreement, as negotiated by BAWSCA, on January 26, 2021 (Linked Minutes) , pending approval by the requisite number of the Wholesale Customers.

Second Proposed Amendment: Minimum Purchase Transfer from the City of Mountain View to the City of East Palo Alto

The proposed amendment would provide advance approval for the conversion of up to 1.0 MGD of Mountain View's ISG sold to East Palo Alto in 2017, into a transfer of up to 1.0 MGD of Mountain View's ISG plus up to 1.0 MGD of Mountain View’s Minimum Purchase Quantity to East Palo Alto, in 0.25 MGD increments, if all of the following terms and conditions are satisfied:

a. Mountain View will transfer up to 1.0 MGD of its Minimum Purchase Quantity to East Palo Alto, in increments of 0.25 MGD, subject to the Mountain View City Council's and the East Palo Alto City Council's approval of an agreement for each incremental transfer. b. For each incremental transfer, a Temporary Modified Minimum Annual Purchase Quantity will be calculated for East Palo Alto that is equal to East Palo Alto’s five -year average water use from the SFPUC for the most recent non -drought years prior to the 2017 ISG purchase, plus the incremental transfer amount(s). 5 Packet Pg. 26

City of Palo Alto Page 6

c. For each incremental transfer, Mountain View will maintain, and be responsible for paying any imputed sales for, its current Minimum Purchase requirement in effect at that time, as set forth in Attachment E of the WSA, including up to 1.0 MGD ISG transfer to East Palo Alto, until East Palo Alto's water use meets the Temporary Modified Minimum Annual Purchase Quantity for three consecutive years. d. East Palo Alto will not be requir ed to pay imputed sales associated with the Temporary Modified Minimum Annual Purchase Quantity for any incremental transfer of the 1.0 MGD of Mountain View's Minimum Purchase requirement.
e. For each incremental transfer, once East Palo Alto has met the Temporary Modified Minimum Annual Purchase Quantity for three consecutive years, the incremental portion of Mountain View's Minimum Purchase Quantity transferred to East Palo Alto will become East Palo Alto's Minimum Purchase Quantity, and Mountain View's Minimum Purchase Quantity will be reduced by an equivalent amount. East Palo Alto's new Minimum Purchase Quantity will be included in Attachment E of the WSA and both cities' Individual Water Sales Contracts will be updated to reflect this transfer. f. With exception of the incremental transfers that are the subject of this resolution and the agreement between East Palo Alto and Mountain View described herein, any additional transfers of Minimum Purchase Quantity, either from another Wholesale Customer or from Mountain View in excess of the 1.0 MGD, are subject to Section 3.04 of the 2021 WSA.

Additional Language Changes and Annual Reporting
In addition to the two amendments described above, this package incorporates two additional language changes:
1) New language in Section 3.04 H to clarify that a transfer of Minimum Purchase and/or ISG that does not satisfy the requirements of Section 3.04 may be implemented via a separate amendment to the WSA.
2) New language in Section 3.07 C to expand the waiver of minim um purchase obligations during certain declared emergencies. Based on experience from the previous drought when the State led the call for water use reductions, water use restrictions, and eventual water rationing obligations, SFPUC issued a waiver of Mini mum Purchase Requirements “at risk”. The proposed WSA Amendment allows SFPUC to issue a waiver “during a state of emergency declared by the Governor of California that impacts water supply use or deliveries from the Regional Water System”.

The proposed amendment codifies existing reporting and imposes a new reporting requirement in Section 3.07.C that states:
“ . . . After the end of each fiscal year, the SFPUC will send a written notice to each Wholesale Customer that is subject to the minimum annual purc hase requirements of this section with a 5 Packet Pg. 27

City of Palo Alto Page 7

copy to BAWSCA. The notice will include: (1) the quantity of water delivered to the Wholesale Customer during the previous fiscal year; (2) whether or not the Wholesale Customer met its minimum annual purchase requi rement under this section; (3) any Imputed Sales charged to the Wholesale Customer; and (4) the status of any Temporary Modified Minimum Annual Purchase Quantity of the Wholesale Customer, if applicable.” (new)
In addition, BAWSCA will prepare a new annual report that includes a summary of the SFPUC’s annual reports to each Wholesale Customer as well as additional RWS purchase trend information, as available.

Committee Review and Recommendation
On March 2, 2022, the UAC reviewed and discussed the 2021 Amend ed and Restated Water Supply Agreement and the approval of the Minimum Purchase Transfer from the City of Mountain View to the City of East Palo Alto. Commissioners asked clarifying questions about the regional benefits of the amendment, about the Mountain View and East Palo Alto Minimum Purchase transfer , and asked for information about Palo Alto’s ISG and forecasted water demand. One Commissioner asked about whether Palo Alto’s financial risks will change during a drought and staff explained that Palo Alt o’s financial risks during a drought would remain unchanged by the amendment . After the discussion, the UAC voted 5-0, to support the staff recommendation. Attached are the excerpted draft minutes of this meeting (Linked Minutes).

Resource Impact
Palo Alto is not a participant in a current or future transfer of ISG under this amendment because Palo Alto is not subject to a Minimum Purchase and Palo Alto has sufficient ISG to meet its current and future water demand. This amendment avoids shifting or transferring participating agencies’ contractual costs, or ob ligations, to Palo Alto and will not result in any new or different financial risks to Palo Alto.

Policy Implications
The execution and administration of the 2021 Amended and Restated WSA reaffirms the water reliability and quality requirements in the WS A and is consistent with the spirit of the 2009 WSA.

Environmental Review
Prior to approval of the WSIP, San Francisco prepared a program environmental impact report (PEIR) for the WSIP in compliance with the California Environmental Quality Act (CEQA) an d the San Francisco Planning Commission certified the WSIP Final PEIR in Planning Commission Motion No. 17734 in 2008. The City reviewed the Final PEIR and CEQA findings and adopted them to the extent the findings were relevant to its decision to approve the WSA.

At this time, the City need not take any further action to comply with the requirements of CEQA as the amendments are not a "project" for the purposes of the CEQA. The amendments at issue 5 Packet Pg. 28

City of Palo Alto Page 8

involve an administrative activity that does not result in a direct change to the environment (see 14 CCR Section 15378(b)(5)), and would not result in a direct or reasonably foreseeable indirect physical change in the environment (see 14 CCR Section 15060(c)(2)).

Attachments:
• Attachment5.a: Attachment A: Draft Resolution Approving an Amendment to the Amended and Restated Water Supply Agreement
• Attachment5.b: Attachment B: Draft Resolution Approving a Minimum Purchase Transfer from the City of Mountain View to the City of East Palo Alto 5 Packet Pg. 29
* NOT YET APPROVED* Attachment A
1 6055600
RESOLUTION NO. _____

Resolution Of The City Council Of The City Of Palo Alto Approving An Amendment To The Amended And Restated Water Supply Agreement Between The City And County Of San Francisco And Wholesale Customers In Alameda County, San Mateo County, And Santa Clara County

R E C I T A L S
A. Water supply agencies in Alameda, San Mateo, and Santa Clara Counties have purchased water from the City and County of San Francisco (San Francisco) for many years.

B. The San Francisco Public Utilities Commission (SFPUC or Commission) operates the Regional Water System, which delivers water to communities in Alameda, San Mateo, and Santa Clara Counties, as well as to customers within San Francisco (collectively, “the Parties”).

C. The Parties entered into the “Settlement Agreement and Mas ter Water Sales Contract between the City and County of San Francisco and Certain Suburban Purchasers in San Mateo County, Santa Clara County and Alameda County” in 1984 (1984 Settlement Agreement and Master Water Sales Contract).

D. In April 2003, water sup ply agencies in Alameda, San Mateo and Santa Clara Counties (collectively referred to as the "Wholesale Customers" or "BAWSCA member agencies") established the Bay Area Water Supply and Conservation Agency (BAWSCA), as authorized by Water Code Section 81300 et seq.

E. Upon expiration of the 1984 Settlement Agreement and Master Water Sales Contract, the Parties entered into the “Water Supply Agreement between San Francisco and Wholesale Customers in Alameda County, San Mateo County, and Santa Clara County” (Water Supply Agreement or WSA) on July 1, 2009, authorized by SFPUC Resolution No. 09- 0069, dated April 28, 2009.

F. In 2017, the Wholesale Customers directed BAWSCA to act as its authorized representative in discussions and negotiations with San Francisco to amend the Water Supply Agreement to address a number of substantive issues and these negotiations resulted in the Parties' adoption of the Amended and Restated Water Supply Agreement (Amended and Restated Water Supply Agreement) in 2018, authorized by SFPU C Resolution No. 18-0212, dated December 11, 2018.

G. On March 4, 2019 this Council, by Resolution No. 9821 approved the Amended and Restated Water Supply Agreement.

5.a
Packet Pg. 30
* NOT YET APPROVED* Attachment A
2 6055600
H. Under Article 3 of the Amended and Restated Water Supply Agreement, t he SFPUC agrees to deliver water to the Wholesale Customers up to the amount of 184 million gallons per day (MGD), referred to as the “Supply Assurance,” and the Wholesale Customers have allocated shares of the Supply Assurance among themselves, referred to as Individual Supply Guarantees (“ISG”).

I. Section 3.04 of the Amended and Restated Water Supply Agreement enables a Wholesale Customer that has an ISG to transfer a portion of its ISG to one or more other Wholesale Customers, subject to several conditions.

J. Under Section 3.07 of the Amended and Restated Water Supply Agreement, four Wholesale Customers (Alameda County Water District and the Cities of Milpitas, Mountain View, and Sunnyvale, collectively, the “Minimum Purchase Customers”) may purchase water from sources other than the SFPUC, but they are each obligated to purchase a specific minimum annual quantity of water fro m the SFPUC, referred to as a “Minimum Purchase requirement”.

K. If a Minimum Purchase Customer does not meet its M inimum Purchase requirement in a particular fiscal year, it must pay the SFPUC for the difference between its metered water purchases during the fiscal year and its minimum annual purchase quantity set forth in Attachment E of the Amended and Restated Water Supply Agreement.

L. The Amended and Restated Water Supply Agreement does not currently allow a Minimum Purchase Customer to transfer a portion of its M inimum Purchase requirement and the associated financial obligation to another Wholesale Customer.

M. In September 2017, BAWSCA and the Water Management Representatives (WMRs) of the BAWSCA member agencies began reviewing the issue of Minimum Purchase Quantities, as described in Section 3.07.C of the Water Supply Agreement, and discussing the creation of a process to transfer Minimum Purchase Quantities.

N. Throughout 2017 and 2018, the WMRs held multiple meetings during which the agencies currently subject to Minimum Purchase Quantity requirements and the other Wholesale Customers shared their interests and concerns regarding changes to the Minimum Purchase Quantity requirements and allowing transfers of Minimum Purchase Quantities.

O. At the time the Amended and Restated Water Supply Agreement was approved, the Parties expressed a collective interest in working together to develop a process for the expedited and permanent transfer of Minimum Purchase Quantities.

5.a
Packet Pg. 31
* NOT YET APPROVED* Attachment A
3 6055600
P. In 2019, the Wholesale Customers directed BAWSCA to draft a proposed amendment to the Amended and Restated Water Supply Agreement to provide a procedure for expedited and permanent transfers of Minimum Purchase Quantities that safeguards the financial and water supply interests of Wholesale Customers not participating in such transfers.

Q. The Parties recognize that, both before and after the most recent statewide drought, after meeting drought -related conservation mandates, several BAWSCA member agencies were unable to meet their respective Minimum Purchase requirements described in Article 3.07 of the Amended and Restated Water Supply Agreement, which requires payment for water up to the required Minimum Purchase level even if such water is not delivered and used.

R. Several of the Wholesale Customers with Minimum Purchase requirements might be interested in transferring a portion of their Minimum Purchase Quantity within their respective ISGs to reduce the financial obligation to pay for imputed sales for Minimum Purchase water that is not used.

S. With its Alternative Water Supply Program, the SFPUC is in the early stages of planning for fourteen projects to support the Wholesale and Retail Customers' ability to respond to climate change and address future water supply challenges and vulnerabilities , such as regulatory changes, earthquakes, disasters, emergencies, and increases in population and employment.

T. The City of San Jose (San Jose) and the City of Santa Clara (Santa Clara) are temporary, interruptible Wholesale Customers of the SFPUC Regional Water System and both cities wish to become permanent Wholesale Customers.

U. Pursuant to Section 4.06 of the Amended and Restated Water Supply Agreement, by December 31, 2028, San Francisco must complete any necessary California Environmental Quality Act (CEQA) review and must decide whether or not to make San Jose and Santa Clara permanent Wholesale C ustomers of the Regional Water System with a combined Individual Supply Guarantee (ISG) of 9 million gallons per day (MGD) allocated equally between the two cities, as well as how much water in excess of 9 MGD it will supply to San Jose and Santa Clara.

V. Section 4.06 of the Amended and Restated Water Supply Agreement provides:
"San Francisco will make San Jose and Santa Clara permanent c ustomers only if, and to the extent that, San Francisco determines that Regional Water System long term water supplies are available."

5.a
Packet Pg. 32
* NOT YET APPROVED* Attachment A
4 6055600
W. According to SFPUC's December 2021 Alternative Water Supply Planning Quarterly Update (Quarterly Update), "[f]or San Jose and Santa Clara to b ecome permanent customers of the SFPUC, an additional 9 MGD of new, year-round supplies would be needed to meet historic demand levels and up to 15.5 MGD would be needed to meet planned demand through 2045."

X. According to its December Quarterly Update, SFPUC is planning with the “intention to be able to make San Jose and Santa Clara permanent customers,” but is prioritizing instream flow obligations to meet existing permanent customer demands, including drought supplies.

Y. SFPUC has bud geted $ 298.3 million over the next ten years to fund water supply projects.

Z. SFPUC, San Jose, Santa Clara, and BAWSCA are actively working together to consider water supply projects that may offer potential sources of supply to support San Jose and Santa Clara as permanent Wholesale Customers.

AA. BAWSCA and SFPUC have identified intra -system water transfers as one potential solution to long term water reliability needs among the Wholesale Customers.

BB. A Minimum Purchase Customer might be more inclined to transfer a portion of its ISG to another Wholesale Customer under Section 3.04 of the Amended and Restated Water Supply Agreement if it was able to include a simultaneous transfer of a portion of its Minimum Purchase requirement and the associated financial obligation.

CC. Allowing simplified permanent intra-system transfers of portions of Minimum Purchase Quantity and ISG will facilitate the development of new water supplies by SFPUC that are necessary to support San Jose and Santa Clara as permanent Wholesale Customers.

DD. The Parties have developed a process to allow for the transfer of a Wholesale Customer's Minimum Purchase Quantity in conjunction with an ISG transfer pursuant to Section 3.04, which ensures that such transfers will not result in new or different risks to the water supply and financial interests of Wholesale Customers not participating in a transfer.

EE. The Parties agree th at the total aggregate amount of Minimum Purchase Quantity that may be transferred by all of the Wholesale Customers subject to Minimum Purchase requirements as first specified in Attachment E of the Amended and Restated Water Supply Agreement, over the course of one or multiple transfers, is limited to 6 MGD.

FF. If demand for Minimum Purchase Quantity transfers exceeds 6 MGD in the future, the Parties agree to consider further amending Section 3.04 of the Amended and Restated Water Supply Agreemen t to increa se the total aggregate cap on the amount of Minimum Purchase Quantity that may be transferred.

5.a
Packet Pg. 33
* NOT YET APPROVED* Attachment A
5 6055600
GG. A proposed transfer that does not meet the requirements of Section 3.04 of the Amended and Restated Water Supply Agreement, as amended by this Resolution, may be presented as an amendment to the Amended and Restated Water Supply Agreement pursuant to Section 2.03 of the Amended and Restated Water Supply Agreement.

HH. The Parties agree to consider a proposal by the City of Mountain View (Mountain View) and the City of East Palo Alto (East Palo Alto) to amend the Amended and Restated Water Supply Agreement to allow for the conversion of Mountain View's 2017 sale of 1 MGD of ISG to East Palo Alto into a transfer of 1 MGD of Mountain View's ISG that includes Minimum Purchase Quantity to East Palo Alto, over a period of time , and in a manner that protects the other Wholesale Customers' financial and water supply interests.

II. If such a conversion is approved by the Parties, the 1 MGD of Mountain View's Minimum Purchase Quantity would be counted towards the total aggregate 6 MGD cap on Minimum Purchase Quantity transfers.

JJ. The Parties now desire to adopt an amendment to the Amended and Restated Water Supply Agreement to permit Wholesale Customers with an ISG to transfer, or accept a transfer, of both a portion of a Wholesale Customer's ISG and its Minimum Purchase Quantity.

KK. An updated Amended and Restated Water Supply Agreement , reflecting this amendment, in the form negotiated by BAWSCA (2021 Amended and Restated Water Supply Agreement), was pres ented to and approved by SFPUC on January 26, 2021 pursuant to SFPUC Resolution No. 21-0009.

The Council of the City of Palo Alto does hereby RESOLVE as follows:

SECTION 1. The Council approves the modifications included in the attached "2021 Amended and Restated Water Supply Agreement Between the City and County of San Francisco Wholesale Customers in Alameda County, San Mateo County, and Santa Clara County" dated January 2021 (2021 Amended and Restated Water Supply Agreement).

SECTION 2. The City Manager is authorized and directed to sign the 2021 Amended and Restated Water Supply Agreement, in the form previously approved by the San Francisco Public Utilities Commission and attached hereto. //

//

//

5.a
Packet Pg. 34
* NOT YET APPROVED* Attachment A
6 6055600
//
SECTION 3. The Council finds that the amendment considered now is not a "project" for the purposes of CEQA as it involves an administrative activity that does not result in a direct change to the environment (see 14 CCR Section 15378(b)(5)), and would not result in a direct or reasonably foreseeable indirect physical change in the environment (see 14 CCR Section 15060(c)(2)).

INTRODUCED AND PASSED:

AYES:

NOES:

ABSTENTIONS:

ATTEST:

City Clerk Mayor

APPROVED AS TO FORM: APPROVED:

Assistant City Attorney City Manager

Director of Utilities

Director of Administrative Services

5.a
Packet Pg. 35
*NOT YET APPROVED* Attachment B

1 6055601

RESOLUTION NO. _____

Resolution Of The Council Of The City Of Palo Alto Approving A Minimum Purchase Transfer From
The City Of Mountain View To The City Of East Palo Alto

R E C I T A L S
A. The City and County of San Francisco ("San Francisco") Public Utilities Commission ("SFPUC" or "Commission") operates the Regional Water System, which delivers water to water supply agencies in Alameda, San Mateo, and Santa Clara Counties (collectively, “the Parties”).

B. In April 2003, water supply agencies in Alameda, San Mateo and Santa Clara Counties (collectively, the "Wholesale Customers") established the Bay Area Water Supply and Conservation Agency ("BAWSCA"), as authorized by Water Code Section 81300 et seq.

C. In Nov ember of 2018, San Francisco and the Wholesale Customers (the "Parties") entered into the Amended and Restated Water Supply Agreement ("WSA").

D. The Parties have identified intra- system water transfers as one potential solution to long-term water reliability needs among the Wholesale Customers.

E. In 2017, the City of Mountain View ("Mountain View") and the City of East Palo Alto ("East Palo Alto") were interested in transferring 1.0 million gallons per day ( "MGD") of Mountain View's Minimum Annual Purchase Quantity (“Minimum Purchase”) to East Palo Alto, however, at the time, there was no procedure in the WSA to effectuate such a transfer without amending the WSA.

F. In 2017, Mountain View and East Palo Alto executed a water rights transfer agreement in which East Palo Alto agreed to pay Mountain View $5 Million for the permanent transfer of all rights, title, interest to 1.0 MGD of Mountain View’s Individual Supply Guarantee (ISG) to East Palo Alto.

G. In August 2018, BAWSCA and San Francisco provided the Wholesale Customers a revised Attachment C to the Water Supply Agreement reflecting the updated ISG amounts for Mountain View and East Palo Alto, as a result of the 1.0 MGD transfer of ISG from Mountain View to East Palo Alto.

H. Mountain View continues to be subject to a Minimum Purchase of 8.93 MGD and the financial obligation of paying for imputed sales for the portion of Minimum Purchase that it does not use.

I. In 2020, Mountain View and East Palo Alto began discussing a possible future transfer of a portion of Mountain View's Minimum Purchase to East Palo Alto.

5.b
Packet Pg. 36
*NOT YET APPROVED* Attachment B

2 6055601

J. On January 26, 2021, the SFPUC adopted the 2021 Amended and Restated Water Supply Agreement ("2021 WSA"), which includes a new procedure by which Wholesale Customers with ISGs may participate in permanent expedited transfers of a portion of Minimum Purchase and ISG, without creating new or different risks to the water supply and financial interests of Wholesale Customers not participating in such transfers.

K. The 2021 WSA has been or will be presented to the governing body of each Wholesale Customer, and if approved, will permit Wholesale Customers with an ISG to transfer and accept a portion of another Wholesale Customer’s Minimum Purchase, if certain requirements are satisfied; and

L. On April 20, 2021, East Palo Alto approved the conversion of the 1.0 M GD of Mountain View's ISG sold to East Palo Alto in 2017 into a paired transfer of 1.0 MGD of ISG plus up to 1.0 MGD of Mountain View's Minimum Purchase to East Palo Alto, in increments of

0.25 MGD or other amount, subject to the City Council’s approval of a n agreement for each incremental transfer and the approval of the Wholesale Customers and San Francisco.

M. On June 8, 2021, Mountain View approved the conversion of the 1.0 MGD of Mountain View's ISG sold to East Palo Alto in 2017 into a paired transfer of 1.0 MGD of ISG plus up to 1.0 MGD of Mountain View's Minimum Purchase to East Palo Alto, in increments of

0.25 MGD, subject to the City Council’s approval of an agreement for each incremental transfer and the approval of the Wholesale Customers and San Francisco.

N. East Palo Alto and Mountain View are authorized and prepared to execute a negotiated agreement memorializing the terms and condition s of a 0.25 MGD transfer of Mountain View's Minimum Purchase to East Palo Alto.

O. As noted below, one of the conditions of the negotiated agreement between Mountain View and East Palo Alto is that, in exchange for the 0.25 MGD of Minimum Purchase transfer, Mountain View will provide East Palo Alto with an immediate Right -of-First Refusal for drought water transfers at the same volume as the Minimum Purchase transfer, pursuant to Appendix H of the 2021 WSA.

P. In conjun ction with consideration of the 2021 WSA, East Palo Alto and Mountain View propose the Wholesale Customers and San Francisco approve, in advance, the terms and conditions for converting up to 1.0 MGD of Mountain View's ISG purchased by East Palo Alto in 2017 into a transfer of 1.0 MGD of Mountain View's Minimum Purchase to East Palo Alto, in 0.25 MGD increments, if Mountain View and East Palo Alto mutually agree to such incremental transfers in the future and provided the conditions outlined below are met.

5.b
Packet Pg. 37
*NOT YET APPROVED* Attachment B

3 6055601

Q. If up to 1.0 MGD of Mountain View's ISG purchased by East Palo Alto in 2017 is converted into a transfer of up to 1.0 MGD of Mountain View's Minimum Purchase to East Palo Alto, up to 1.0 MGD of Minimum Purchase, in 0.25 MGD increments, will be counted towards the total Minimum Purchase that may be transferred pursuant to Section 3.04.C.1 of the 2021 WSA.

R. This parallel action continues to require the calculation of a Temporary Modified Minimum Annual Purchase Quantity, set out in Attachment E -1 in the 2021 WSA; however, the transferor, Mountain View, is responsible for the imputed sales associated with transfers to East Palo Alto up to 1.0 MGD, until the terms and conditions outlined below are satisfied.

S. In accordance with the water transfer provisions of the 2021 WS A, Mountain View and East Palo Alto will coordinate with San Francisco and BAWSCA to document Temporary Modified Minimum Annual Purchase Quantities to be included on Attachment E-1, transferred Minimum Annual Purchase Quantities to be included on Attachme nt E, when timely, and amendments to each cities' Individual Water Sales Contract with San Francisco.

The Council of the City of Palo Alto does hereby RESOLVE as follows:

SECTION 1
. The Council approves, in advance, the conversion of up to 1.0 MGD of Mountain View's ISG, sold to East Palo Alto in 2017 into a transfer of 1.0 MGD of Mountain View's ISG, plus up to 1.0 MGD of Mountain View’s Minimum Purchase, to East Palo Alto, in

0.25 MGD increments, if all of the following terms and conditions are satisfied:
a. Mountain View will transfer up to 1.0 MGD of its Minimum Purchase to East Palo Alto, in increments of 0.25 MGD, subject to the Mountain View City Council's and the East Palo Alto City Council's approval of an agreement for each incremental transfer.
b. For each incremental transfer, a Temporary Modified Minimum Annual Purchase Quantity will be calculated for East Palo Alto that is equal to the City's five-year average water use from the SFPUC for the most recent non-drought years prior to the 2017 ISG purchase, plus the incremental transfer amount(s).
c. For each incremental transfer, Mountain View will maintain, and be responsible for paying any imputed sales for, its Minimum Purchase requirement in effect at that time, as set forth in Attachment E of the WSA, including up to 1.0 MGD ISG transfer to East Palo Alto, until East Palo Alto's water use meets the Temporary Modified Minimum Annual Purchase Quantity for three consecutive years.

5.b
Packet Pg. 38
*NOT YET APPROVED* Attachment B

4 6055601

d. East Palo Alto will not be required to pay imputed sales associated with the Temporary Modified Minimum Annual Purchase Quantity for any incremental transfer of the 1.0 MGD of Mountain View's Minimum Purchase requirement.
e. For each incremental transfer, once East Palo Alto has met the Temporary Modified Minimum Annual Purchase Quantity for three consecutive years, the incremental portion of Mountain View's Minimum Purchase transferred to East Palo Alto will become East Palo Alto's Minimum Purchase, and Mountain View's Minimum Purchase will be reduced by an equivalent amount. East Palo Alto's new Minimum Purchase will be included in Attachment E and both cities' Individual Water Sales Contracts will be updated to reflect this transfer. f. With exception of the incremental transfers that are the subject of this resolution and the agreement between East Palo Alto and Mountain View described herein, any additional transfers of Minimum Purchase, either from another Wholesale Customer or from Mountain View in excess of the 1.0 MGD, are subject to Section 3.04 of the 2021 WSA. //

//

//

//

//

//

//

//

//

//

//

5.b
Packet Pg. 39
*NOT YET APPROVED* Attachment B

5 6055601

//
SECTION 2. The Council finds that approval of a Minimum Purchase transfer from the City of Mountain View to the City to East Palo Alto is not a "project" for the purposes of CEQA as it involves an administrative activity that does not result in a direct change to the environment (see 14 CCR Section 15378(b)(5)), and would not result in a direct or reasonably foreseeable indirect physical change in the environment (see 14 CCR Section 15060(c)(2)).

INTRODUCED AND PASSED:

AYES:

NOES:

ABSENT:

ABSTENTIONS:

ATTEST:

City Clerk Mayor

APPROVED AS TO FORM: APPROVED:

Assistant City Attorney City Manager

Director of Utilities

Director of Administrative Services

5.b
Packet Pg. 40

City of Palo Alto (ID # 13901)
City Council Staff Report

Meeting Date: 4/4/2022

City of Palo Alto Page 1

Title: Approve Finance Committee Recommendation for FY 2023 to (a) Return to the Customary Pre -Pandemic Business Registry Certificate Requirement and Fee, and (b) Pause for One Year the Downtown Business Improvement District Assessment Program
From: City M anager
Lead Department: Administrative Services

Recommendation
The Finance Committee and staff recommend that Counc il approve the following for FY 2023:
1) Return to the historic and routine structure and timeline for the business registry certificate program (BRC) that applied prior to two years of fee waivers during the Covid-19 emergency.
2) Pause the business improvement district (BID) program in FY 2023, with anticipation of a program resumption in FY 2024, and direct staff to work with the Chamber of Comm erce and the Palo Alto Downtown Business and Professional Association (PADBPA) on the transfer of BID management.

Summary
On March 1 , 2022 the Finance Committee discussed options for the FY 2023 BRC and BID processes ( CMR 13902; Minutes). The Committee reviewed three options for the BRC and decided to continue the process in FY 2023 using the established structure used in pre-pandemic years. This structure includes notifying businesses of the re newal due date, past due dates , the $54 BRC fee , and how to complete the registration process via the online system. The timeline for FY 2023 will need to be revised from the routine timeline, which typically starts in February. For FY 2023 the due date will be June 1, 2022 with a late fee of $25 applied to payments received after July 1 and an additional late fee of $25 applied af ter August 1 , 2022 . Staff expects to mail BRC renewal notices to businesses in the mid-April timeframe pending final system configuration, which is typically around 30 days.

In 2020 when the pandemic emerged, Council adopted Resolution No. 9885, refunding BRC fees that had been paid for FY 2020 and waiving fees that would soon be due for FY 2021. In 2021, Council adopted Resolution No. 9956, waiving BRC fees for FY 2022 . 6 Packet Pg. 41

City of Palo Alto Page 2

Each of these resolutions temporarily waived requirements for a limited period defined in the resolution. After June 30, 2022, the existing waiver will expire and the requirements in the Municipal Code will apply. Accordingly, f or the FY 2023 cycle , the BRC program is returning to the full requirements in the Municipal Code, Chapter 4.6.

For the BID the Committee considered three options and decided to pause the BID assessment and program for FY 2023 with anticipation that the program would resume in FY 2024. Staff is directed to work with the Chamber and PADBPA to transition the management of the BID during this time. The Committee heard oral comments from the Chamber and PADBPA that highlighted th e need to first build support for a resumption of the BID assessment within the business community before collecting a new assessment and establishing a new management agreement. Both entities supported placing the BID on pause for FY 2023.

Timeline
Staff will return with the required notice of intent not to collect an assessment for the BID for FY 2023 in the May timeframe. This will be followed by the required public hearing on the BID in June.

Resource Impact
With the resumption of the full BRC fee an estimated $100,000 is expected to be collected through business registration for the FY 2023 cycle, which cover the costs of administering the program including the contract with Avenu for opera ting the online registration system, collection process and customer support. With the BID on pause an estimated $80,000 will not be collected and no BID business activities will be provided.

With the expectation that the BID will resume in FY 2024 a new cycle of assessments will bring in revenue that can then be used to support activies via the management agreement.

Stakeholder Engagement
Staff has met and coordinated with members of PADBA and the Chamber of Commerce in preparation of these recommendation s. In FY 2023 staff will work with these entities to develop a potential new management agreement for the BID.

Environmental Review
The proposed action is not a project for the purposes of the California Envi ronmental Quality Act.
6 Packet Pg. 42

City of Palo Alto (ID # 13914)
City Council Staff Report

Meeting Date: 4/4/2022

City of Palo Alto Page 1

Title: Approve, as Recommended by Policy and Services Committee, the FY2022/2023 Risk Assessment & Audit Plan Reports
From: City Manager
Lead Department: City Auditor

Recommendation

Executive Summary
Baker Tilly conducted a comprehensive Risk Assessment in FY 2021, which was used as the basis the FY 2022/2023 Risk Assessment. In order to make updates to the assessment, Baker T illy reached out to City Council members and executive leadership across 14 departments within the City. Executive leaders were asked to complete a survey that evaluated the potential opportunities and threats to their departments and the City as a whole. Baker Tilly analyzed the results of the survey and conducted additional interviews, as necessary.

The Risk Assessment identifies 15 risks rated as high to the organization among 154 total risks listed. The FY2022/2023 Audit Plan was prepared based on the results of the risk assessment, conversations with leadership, and other matters.

The Policy and Services Committee and City Auditor recommends that City approve the following reports:

1) Fiscal Year 2022/23 Risk Assessment Report (Attachment A); 2) Fiscal Year 2022/23 Audit Plan Report (Attachment B); and 3) Task Orders identified in the Audit Plan Report (Attachment B) o Remote and Flexible Work Study
o Cybersecurity Assessment
o Wastewater Treatment Plant Agreement Audit.
7 Packet Pg. 43

City of Palo Alto Page 2

Background

Discussion
The attached reports summarize the analysis of the risk assessment and the outline of potential future audit actives derived from the report.

Timeline, Resource Impact, Policy Implications (If Applicable) Timeline for risk assessment and audit plan is is for FY22-23. The audit plan assumes that the Office of the City Auditor will be allocated a similar budget in FY23 as in FY22.

The budget will be approved at a future point, and may neccssitate review of the Audit Plan. The City Auditor will bring any necessary changes to the Committee and to City Council.

Stakeholder Engagement
The Office of the City Auditor worked with Execut ive Leaders from 14 Departments across the City and engaged the City Council.

Environmental Review
Attachments:
• Attachment7.a: Attachment A OCA - Risk Assessment Report FY22-23 In its capacity serving as the City Auditor function, and in accordance with Baker Tilly’s agreement with the City (Task #2 of the agreement), Baker Tilly performed a citywide risk assessment. The purpose of the assessment was to identify and prioritize risks in order to develop the annual audit plan (Task #1). During the risk assessment, Baker Tilly assessed a wide range of risk areas, including strategic, financial, operational, compliance, technological, and reputation risks. The comprehensive risk matrix is included as an appendix to the report. Baker Tilly will provide a presentation to the Committee to discuss the results of the Risk Assessment and is asking that the Committee recommend approval of the report by City Council.

The Palo Alto Municipal Code (Section 2.08.130) requires the City Auditor prepare and submit an annual audit plan to the City Council for review and approval. Baker Tilly performed the initial risk assessment after having started to serve as the Office of the City Auditor (OCA) in October 2020 and submitted in early 2021 the FY21-FY22 annual audit plan identifying audit activities across an 18-month horizon (through FY22). The OCA updated the initial risk assessment in January 2022, one year after our initial risk assessment. This audit plan covers the remainder of FY22 as well as FY23 and was prepared based on the results of the updated risk assessment described above.

Baker Tilly presented the audit plan to the Policy and Services Committee, and it was approved unanimously to be sent to for City Council review and approval. Upon approval of the audit plan by City Council, the Task Orders will be approved by the Policy & Services Committee Chair.

Environmental review is not applicable to this activity. 7 Packet Pg. 44

City of Palo Alto Page 3

• Attachment7.b: Attachment B OCA - FY22-23 Audit Plan
7 Packet Pg. 45

City of Palo Alto
Office of the City Auditor
FY22 Annual Risk Assessment
February 15, 2022

7.a
Packet Pg. 46
Table of Contents
INTRODUCTION ......................................................................................................................................................................... 3 RISK ASSESSMENT APPROACH ............................................................................................................................................ 4 SURVEY RESULTS .................................................................................................................................................................... 5 MANAGEMENT’S VIEW OF STRENGTHS AND WEAKNESSES/THREATS .................................................................................................................... 5 KEY RISK AREAS RATED BY MANAGEMENT ...................................................................................................................................................... 6 SIGNIFICANT CHANGES IN FY21 .................................................................................................................................................................... 8 BARRIERS TO MEETING GOALS AND OBJECTIVES IN FY22 ................................................................................................................................... 8 RISK ASSESSMENT RESULTS ............................................................................................................................................... 9 APPENDICES ........................................................................................................................................................................... 11 APPENDIX A: SURVEY QUESTIONS ................................................................................................................................................................ 11 APPENDIX B: RISK MATRIX ......................................................................................................................................................................... 16

7.a
Packet Pg. 47

3 Introduction

According to City Ordinance of the City of Palo Alto (the City), the mission of the Office of City Auditor (OCA) is to promote honest, efficient, effective, economical, and fully accountable and transparent city government. To fulfill this mission, the OCA conducts performance audits and performs financial/operational analyses of city departments, programs, services, or activities as approved by the City Council. (Section 2.08.130). In its capacity serving as the City Auditor function, and in accordance with Baker Tilly’s agreement with the City (Task #1 of the agreement), Baker Tilly conducted the FY22 citywide risk assessment in order to develop the FY22/FY23 annual audit plan (Task #2).

The California Government Code Section 1236 requires all cities that conduct audit activities to conduct their work under the general and specified standards prescribed by the Institute of Internal Auditors (IIA) or the Government Auditing Standards (GAO) issued by the Comptroller General of the United States, as appropriate. According to the IIA Standard 2010, the head of internal audit function “must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization’s goals” and consider the input of senior management and a governing board.

The purpose of the risk assessment is to develop an internal audit plan that assigns internal audit resources to the activities that add the most value to the City. The risk assessment process involves identifying, measuring, and prioritizing risks associated with the audit universe (list of specific departments, functions, processes, programs, etc. that can be subject to an audit). Risk is defined as “the possibility of an event or condition occurring that will have an impact on the ability of an organization to achieve its objectives.”1 Our risk assessment involved collaboration with City Council and executive leadership from 14 main departments across the organization. This report summarizes our risk assessment methodology, analysis, and results. The FY22/FY23 annual audit plan is based on the results of this risk assessment.

Through the risk assessment, we observed certain strengths of the City. Key strengths include:
­ Commitment to public service
­ High value on efficient and effective government
­ Focus on long term strategy
­ Dedicated and highly professional management and staff ­ Demonstrated history of innovation and commitment to sustainability

Additionally, OCA commends the City for its continued response to COVID-19. In particular, we greatly admire all efforts taken to support the health and wellbeing of Palo Alto citizens and Stanford students, as well as the support of essential workers during this time of heightened risk.

1 Rick A. Wright Jr., CIA, “The Internal Auditor’s Guide to Risk Assessment” The Institute of Internal Auditors Research Foundation (IIARF), 2018

7.a
Packet Pg. 48

4 Risk Assessment Approach

Baker Tilly’s risk assessment approach consisted of the following phases:

Baker Tilly conducted an initial comprehensive risk assessment in FY2021 by interviewing all Council members and Executive Leadership Team (ELT) members to create a risk matrix. For the FY2022 risk assessment, we interviewed all available Council members, surveyed all ELT members and some additional members of management, and conducted interviews with key ELT members representing areas of perceived high risk in the current landscape (e.g., Information Technology, Human Resources).

Our initial FY2021 risk assessment primarily measured inherent risk (the risk without mitigating controls/factors). We continue to learn the City’s risk responses, processes, controls, and/or other factors in place to mitigate identified risks through internal audit activities. We considered the information gathered to identify risks and determine the likelihood and impact of risks identified.

The risk matrix in Appendix B includes our risk rating scale and lists all of the identified risks and associated likelihood and impact of potential adverse events.

Planning − Discussed a survey using an online survey tool with the City and the Baker Tilly internal resources. − Prepared risk assessment survey questions and the online survey tool.

Information
Gathering
− Reviewed key documentation such as the capital plan, annual budget, organizational charts, financial statements, and internal audit reports.
− Sent a link to the online survey to ELT members, asking them to complete the survey and forward it to their staff members as appropriate. Survey responses were downloaded in Excel spreadsheet. − Updated the risks in the existing risk matrix based on interviews with City Council members and the ELT members, survey responses, and review of critical documents.

Analysis
− Analyzed the survey responses.
− Scored the risks in the risk matrix based on the likelihood and the impact of potential adverse events. − Identified potential internal audit activities with high risk scores.

Reporting − Summarized the approach and results of the risk assessment.

FY22 Risk Assessment Phase

7.a
Packet Pg. 49

5 Survey Results

Baker Tilly team conducted an online risk assessment survey to gather management’s insights for all City departments and received 24 responses. The survey questions are listed in Appendix A.

Management’s View of Strengths and Weaknesses/Threats
Each manager was asked to identify up to
three strengths of his/her team/department
or the City. The following summary shows
that the employees are the strength of the
City and that the relationships and
collaboration with different departments and
organizations are an integral part of the
City’s operation.

Managers were also asked to identify up to
three weaknesses as well as threats for their
teams/departments or the City. The results
show that the City currently faces various
issues related to human capital
management. Additionally, economy, rising
costs, aging population, and a supply chain
issue were listed as some of the threats
(unfavorable external factors).

7.a
Packet Pg. 50

6 Key Risk Areas Rated by Management
We asked the managers who participated in the survey to rate 38 risk factors across five risk categories, using a scale of 1 (Very Low) to 5 (Very High), to assess their teams/departments. As shown in the table below, five out of top ten risk factors rated high by the City’s management belong to the Environmental risk category. Each risk category is summarized below, and the detailed descriptions of risk factors are included in the survey in Appendix A.

Environmental (Factors external to the organization)
Five out of six risk factors in this category are included in the top ten high-risk factors. External factors, such as the economy and citizen demands, are identified as the highest areas of Environmental risk category. Compliance with laws and standards and the opinions and perceptions of the public and customers towards the City (Regulatory) are also rated higher than other risk factors. Legal risk is the potential for an unforeseen event to cause litigation for the City or its elected leaders, directors, and officers.

Strategy (Planning and decision-making)
The top two risk factors of this risk category concern financial management necessary to achieving the City’s goals
(Planning and Budgeting) and the City’s ability to modify its processes in order to either align with its current strategy or to achieve a different strategic goal (Strategic Change). The Compliance Management risk factor refers to the continuous monitoring of the organization’s ability to operate within regulatory requirements and community standards

Rank Risk Category: Risk Factor Average Rating
1 Environmental: Economy 4.04
2 Environmental: Citizen Demands 3.71
3 Organization: Succession Planning 3.63
4 Environmental: Regulatory 3.46
5 Environmental: Reputation 3.42
6 Strategy: Planning and Budgeting 3.38
7 Organization: Human Capital Management 3.33
7 Organization: Governance 3.33
9 Environmental: Legal 3.25
10 Strategy: Strategic Change 3.17

Risk Factor Average Rating
Planning and Budgeting 3.4
Strategic Change 3.2
Resource Allocation 3.1
Compliance Management 3.1
Financial 2.8
Investments 2.8
Inter-government Relations 2.6
Strategy 3.0

Risk Factor Average Rating
Economy 4.0
Citizen Demands 3.7
Regulatory 3.5
Reputation 3.4
Legal 3.3
Technologies 2.5
Enviornmental 3.4

7.a
Packet Pg. 51

7 Organization (Attributes of departments)
Three risk factors in the Organization category are
included in the top ten risk factors. The Succession
Planning risk factor is rated as the third highest risk factor. It is the planning and processes to ensure that there are highly qualified people in key leadership
positions today and in the future. The related risk factor rated as the seventh highest is Human Capital
Management that is the set of practices an organization uses for recruiting, managing, developing, and optimizing their human capital. Governance is also rated as the
seventh highest overall and relates to the activities
providing direction and oversight for the organization.

Process and Operations (Functional effectiveness and policies and procedures) The Process and Operations risk factor was not
represented on the top ten risks rated by the City’s
management. However, the top three risk factors of this category are the 13th through 15th risk factors among all 38 risk factors. Human Resources concerns the
knowledge, skills and experiences, and resources among
personnel, which allow for the execution of the
organization’s business plan and achievement of its
critical success factors. Procurement/Sourcing pertains to the ability to acquire the necessary goods and services for operation and the process of vetting, selecting and
managing supplier, vendors and contractors.

Information (Data governance)
This Information risk category had the lowest average
rating among the five categories. The risk factor rated highest by City management in this category is the
availability of relevant critical information when needed in order to maintain the organization’s critical operations and processes, including when a disaster or unplanned
disruption occurs. The Security (any event that could
result in the compromise of organizational data) is rated as the second highest risk.

Risk Factor Average Rating
Human Resources 3.1
Procurement/Sourcing 3.0
Change Management 3.0
Efficiency 2.9
Information Systems 2.8
Vendor Management 2.8
Fraud 2.5
Contracts 2.5
Accounting 2.3
Payroll 2.2
Process and Operations 2.7

Risk Factor Average Rating
Succession Planning 3.6
Governance 3.3
Human Capital Management 3.3
Communication 2.9
Leadership and Authority 2.9
Safety 2.7
Organizational Structure 2.7
Empowerment and Values 2.6
Ethics and Code of Conduct 2.5
Organization 2.9

Risk Factor Average Rating
Information:Availability 2.8
Information: Security 2.7
Information: Retention 2.7
Information (Data Governance): Data Integrity 2.6
Information: Privacy 2.5
Information: Access 2.3
Information 2.6

7.a
Packet Pg. 52

8 Significant Changes in FY21
We asked the managers who participated in the survey to describe the significant changes for their teams or departments during the past 12 months. The responses seem to be consistent with the effect of a significant reduction of staff in FY21 as described in the FY22 Adopted Operating Budget as well as the national labor market facing all industries.

Barriers to Meeting Goals and Objectives in FY22
We asked the managers who participated the survey to describe the possible reasons that prevent their teams or departments from meeting their goals and objectives in FY22. These responses are consistent with the weaknesses and significant changes mentioned by them in this survey.

Significant Changes During Last 12 Months % of Respondents Change in Workload 64%
Workforce Reduction 44%
New Workflows or Business Processes 40%
Change in Compliance Requirements (Due to Changes in Policies/Contracts/Laws/Regulations) 32% New/additional Staff 32%
Change in Organizational Structure 32%
Other (No Significant Change, Staff Turnover, Mandatory Overtime ) 24% Changes in Processes/Controls/ Information Technology Systems 24% New Software 20%
Increased Undesirable Performance or Instances (such as Injuries/Complaints/Customer Dissatisfaction) 16% Change in Culture 16%
Change in Goals/Objectives/ Performance Measures 12%
New Vendors and Contractors 12%
Change in Any Risks Previously Identified for Your Team/Department 4% Barriers to Meeting Goals and Objectives in FY22 % of Respondents Staffing Constraints 88%
Financial Constraints 48%
Limited Skills/Knowledge/Experience/Training 32%
Constraints due to COVID-19 24%
Community Pressure 24%
Inefficiency in Process and/or Communication 20%
Technology Issue 20%
Other (Changing Priorities/Goals/Assignments Bottlenecks) 16% State/Federal Regulations 12%
Lack of or Ineffective Internal Controls 4%

7.a
Packet Pg. 53

9 Risk Assessment Results

We developed the risk matrix in FY21 during our first risk assessment for the City. For the FY22 risk assessment, we updated the matrix by identifying the changes that have occurred (e.g. City’s goals, organizational structure, etc.) over the past 12 months, obtaining input from City Council members and the City’s management, and by continuing to learn more about the City’s programs, initiatives, and processes. We added additional information to the existing risks, added or removed risks, and adjusted the rating, as necessary. The updated risk matrix is included in Appendix B. The following chart shows the distribution of overall risk scoring in our risk matrix. We do not necessarily seek a normal distribution but do consider distribution to evaluate the effectiveness of our scoring methodology, which has been right-sized to the City.

7.a
Packet Pg. 54

10 Listed below are the risks with a score over 36 (out of 50) in the risk matrix, excluding six risks that were audited in FY21 – FY22 or are currently being audited. The list includes 15 areas rated as high risks (with a score between 40 and 50) and 20 areas rated as high-moderate risks (with a score 36 and 38). In determining the audit activities to be performed in FY22 and in FY23, we further review these risks and functional areas and consider risk-based priorities as well as other factors such as requirements by law or regulation, timing of activities, special projects, and requests from City Council and management.

Functional Area Title Likelihood
(1-5)
Impact
(1-5) Score
City Wide COVID-19 Response 5 5 50
Org Wide Employee Retention & Succession Planning 5 4 46 Planning and Development
Services Long Rnage Planning 5 4 46
Information Technology Disaster Recovery Preparedness and Testing 3 5 44 Information Technology Host Intrusion and Malware Defense 3 5 44 Information Technology Problem Management and Incident Response 3 5 44 Transportation Contract Management 3 5 44
Org Wide Workforce 4 4 42
Org Wide Citywide Risk Management 4 4 42
Administrative Services Procurement 4 4 42
Fire Emergency Medical Service 4 4 42
Human Resources High Cost Claims 4 4 42
Human Resources Workload 4 4 42
Information Technology Mobile Device Management 5 3 40
Information Technology Strategy and Governance 5 3 40
Public Works Secondary Treatment Upgrades 2 5 38
Public Works ADA Compliance Upgrade 2 5 38
Administrative Services Investments, Debt, and Cash Management 2 5 38 Information Technology Information Security 2 5 38
Information Technology Operations and Monitoring 2 5 38 Information Technology Physical and Environmental Controls 2 5 38 Information Technology Ransomware 2 5 38
Police Use of Force and Officer Conduct 2 5 38
Org Wide Governance 3 4 36
Org Wide Organizational Culture 3 4 36
Administrative Services ERP System Upgrade 3 4 36
City Wide Sustainability and Climate Action Plan 3 4 36 Administrative Services Accounts Receivable 3 4 36
Fire Fire Suppression 3 4 36
Fire Fire Prevention - Palo Alto Foothills & Wildlad Fire Risk 3 4 36 Public Works Public Services - Fleet 3 4 36
Public Works Wastewater Treatment Plant Operations 3 4 36 Public Works Public Services -Facilities 3 4 36
Utilities AMI (Advanced Metering Infrastructure) Project 3 4 36 Utilities Rates and Rate Adjustments 3 4 36

7.a
Packet Pg. 55

11 Appendices

Appendix A: Survey Questions
The Office of City Auditor is conducting the FY22 Risk Assessment to identify and prioritize risks in order to update the annual audit plan. As part of our FY22 Risk Assessment, we are conducting a survey. This survey is used primarily to collect information related to changes in operations, emerging issues and risks the City faces, and to gather your perspective on key risks faced by your department. Your candid responses would be greatly appreciated to assess the risks that prevent the City of Palo Alto from achieving its mission, goals, and objectives.

Note: Although we may reach out to some of you to discuss specific topics further, your identity will not be part of our risk assessment report.

1. Please provide your name, title, Department, and e-mail address:
• Name
• Title
• Department
o City Council
o City Attorney
o City Manager’s Office – Other than Transportation
o City Manager’s Office – Transportation
o Administrative Services
o City Clerk’s Office
o Community Services
o Emergency Services
o Fire
o Human Resources
o Information Technology
o Library
o Planning
o Police
o Public works
o Utilities
• E-mail address

2. Are you a head of your department?
• Yes
• No – Please briefly describe the specific function or process for which you are responsible.

3. Describe any significant changes for your team or department during last 12 months. • New software
• New workflows or business processes
• Changes in processes, controls. Or information technology systems • Change in organizational structure
• Change in culture
• Workforce reduction
• New/additional staff
• New vendors and contractors

7.a
Packet Pg. 56

12 • Change in workload
• Change in compliance requirements (due to changes in policies, contracts, laws, or regulations) • Change in goals, objectives, or performance measures
• Increased undesirable performance or instances (such as injuries, complaints, customer dissatisfaction, etc.)
• Change in any risks previously identified for your team/department • N/A
• Other (please specify)

4. Are there adequate policies and procedures to perform your job responsibilities? • Yes
• No – Please describe how the responsibilities and requirements are communicated in a clear and consistent manner.

5. Describe what can possibly prevent your team/department from meeting its goals and objectives in FY22.
• Financial constraints
• Staffing constraints
• Limited skills, knowledge, experience, training
• Technology issue
• Inefficiency in process and/or communication
• Ambiguity in roles and responsibilities
• Lack of or ineffective internal controls
• Community pressure
• State/Federal regulations
• Constraints due to COVID-19
• N/A
• Other (please specify)

6. Describe the complexity of the processes in your team or department:

Complexity is a measure of the difficulty in performing a process or function. As a process or function becomes more complex, the greater the opportunity for errors. • Very high complexity
• High complexity
• Medium complexity
• Low complexity
• Very low complexity
Please provide any comment related to complexity, if necessary.

To help us identify potential risks, please list your team/department’s Strengths, Weaknesses, Opportunities, and Threats (SWOT) for achieving its missions, goals, and objectives. Typically, strengths and weaknesses are internal aspects of team/department/organization, while opportunities and threats are found externally.

7. Describe up to three STRENGTHS of your team or department:

Strengths refer to the resources or capabilities that help the team/department accomplish its mission and serve the public. These can be things like competitive advantages, available resources, engaged community, strong balance sheet, utilized technology and so on.

7.a
Packet Pg. 57

13 8. Describe up to three WEAKNESSES of your team or department:

Weaknesses refer to the areas where the team/department needs to improve to accomplish its mission.

These can include things like deficiencies in resources and capabilities, inefficient use of available technologies, barriers or inability to collaborate among different departments, lack of effective communication, mission or direction, high levels of debt, financial or human resources constraints and so on.

9. Describe up to three OPPORTUNITIES for your team or department:

Opportunities are any area where the team/department can grow. They are often related to the organization’s strengths. Outside factors that affect the organization in a favorable way can include things like; offering more products or services to citizens, lower costs through new technology and so on.

10. Describe up to three THREATS for your team or department:

Threats include the level of competition, the overall economy and any other external issue that can harm the team/department. Common threats include things like rising costs for housing/living, increasing competition, tight labor supply, billing rates and so on.

11. Environmental (factors external to the organization): For each risk category described below please assess the potential risk level to your department based on a scale of 1 (Very Low) to 5 (Very High).
• Reputation - The opinions and perceptions of the public and customers toward the organization. • Regulatory - Laws and standards, which the organization must comply with in its operations.
• Citizen Demands - The effect that current citizens demands have on the decisions made by management for aligning tactical plans with the business strategy and the allocation of resources.
• Economy - The effect that current external conditions have on the decisions made by management for aligning tactical plans with the business strategy and the allocation of resources.
• Legal - The potential for an unforeseen event to cause civil or criminal litigation for the organization or its elected leaders, directors, officers, and employees. • Emerging Technologies - The evolution of technology both within and outside of the organization’s industry.

12. Strategy (planning and decision-making): For each risk category described below please assess the potential risk level to your department based on a scale of 1 (Very Low) to 5 (Very High). • Strategic Change - The ability of the organization to modify its processes in order to either align with its current strategy and business model or to achieve a different strategic goal. • Investments - The portfolio of both intangible and tangible investments held by the organization, and the implications of these assets on the resources, financial viability, and operations of the organization. The effect on liquidity the ability of current assets to meet current liabilities when due.
• Planning and Budgeting - Details of the organization’s goals and the financial management necessary to achieving those goals.
• Financial - The goals of the organization in terms of the structure of its assets and liabilities, including the financing capability based on its credit worthiness, the ability to receive credit and the use of credit lines to achieve its business objectives. • Inter-government Relations - The relationship of the organization with other government agencies that have regulatory and oversight responsibilities and shared services or citizens.

• Compliance Management - The continuous monitoring of the organization’s ability to operate within regulatory requirements and community standards. • Resource Allocation – The process for assigning and managing assets that support the organizations strategic goals

7.a
Packet Pg. 58

14 13. Organization (attributes of departments): For each risk category described below please assess the potential risk level to your department based on a scale of 1 (Very Low) to 5 (Very High). • Governance - The role, composition, and major activities of the governing body of the organization in providing direction and oversight for the organization. • Empowerment and Values - The ability of senior members of the organization to effectively delegate power or authority to other members of the organization. • Communication - The methods of communication commonly used in the organization and the effectiveness of this communication on the operations of the organization. • Ethics and Code of Conduct - The set of rules outlining the ethical practices expected of management and employees of the organization.
• Leadership and Authority - The members of the organization who hold power and their ability to exercise this power effectively.
• Organizational Structure - The configuration of units and work flows to align the behavior of the units to the higher-level goals of the organization. • Succession Planning - The planning and processes to ensure that there are highly qualified people in key leadership positions today and in the future. • Human Capital Management - The set of practices an organization uses for recruiting, managing, developing, and optimizing employees, including performance management (The process of creating expectations for performance, monitoring progress, and measuring the results) and training (The ability for employees to gain and develop necessary tools to ensure effective operations).
• Safety - The organization strives to provide a safe working environment by effectively mitigating the risks to the safety of its employees.

14. Process and Operations (functional effectiveness and policies and procedures): For each risk category described below please assess the potential risk level to your department based on a scale of 1 (Very Low) to 5 (Very High).
• Contracts - Contracts are adequately structured to address and mitigate risks. • Efficiency - Processes are up-to-date and efficient, resulting in efficient operations and output.
• Accounting - The timely and accurate tracking of the financial position of the organization. • Payroll - The policies, processes, and systems in place to ensure that employee compensation is reliable, timely, and accurate.
• Fraud - The organization uses internal controls to prevent and/or detect fraud. • Procurement/Sourcing – The ability to acquire the necessary goods and services for operation and the process of vetting, selecting and managing supplier, vendors and contractors.
• Human Resources - The knowledge, skills and experiences, and resources among personnel, which allow for the execution of the organization’s business plan and achievement of its critical success factors.
• Information Systems - The facilities, systems, and connectivity in place to support data processing.
• Vendor Management - The need for the organization to continuously monitor the quality and reliability of vendors it uses in the course of its business. • Change Management - Management adapts appropriately to the evolution of the processes and operations of the organization.

15. Information (data governance): For each risk category described below please assess the potential risk level to your department based on a scale of 1 (Very Low) to 5 (Very High). • Data Integrity - Data used for making management decisions, recording information, and reporting financial activity is accurate, complete, and reliable.
• Access - The right to view or manipulate data is carefully granted and monitored to prevent the mishandling of data. • Retention - The policies used by the organization to determine document retention in terms of the form of documents, how these documents are stored, and for how long these should be maintained. • Availability - Relevant critical information is available when needed in order to maintain the organization’s critical operations and processes, including when a disaster or unplanned disruption occurs. • Privacy - Organization policies are in place to ensure the correct treatment of sensitive information held by the organization. • Security – Any event that could result in the compromise of organizational data. (I.e. unauthorized use, loss, damage, disclosure or modification of organizational data).

7.a
Packet Pg. 59

15 16. Do you feel that adequate internal controls are in place and performed effectively to mitigate the risks your team or department is exposed to?
Internal controls can be segregation of duties, proper approvals, application controls that prevent errors, proper training, timely communication, reconciliation of data/information, review and resolution of exception reports, and so on.
• Yes – Processes and procedure are in place and performed effectively • Yes – Processes and procedures are in place but NOT always performed effectively • No – Processes and procedures are not in place to mitigate risks Please provide any comment related to complexity, if necessary.

17. What would be the potential impact of significant risks not being addressed in your team or department?
• Reputation of the team/department or the City will be damaged • The team/department or the City will be in noncompliance with contracts, laws or regulations • The operations or procedures will be inefficient, which may result in more costs and/or decreased level of services
• The team/department will not meet its objectives, goals, and mission • The consequences may be result in injuries or deaths
• The City may lose assets (cash, properties, equipment, etc.) • The information provided to the public will be incomplete, inaccurate, and/or untimely. • No or little impact
• Other (please specify)

18. Please share your thoughts on any risks you think your team/department or City of Palo Alto faces:

For example, risks you identified for other teams or department; risks of frauds (corruption, misappropriation of assets, financial statement fraud); and so on.

19. Please list any potential audit activities you recommend based on the risks you identified.

7.a
Packet Pg. 60

16 Appendix B: Risk Matrix
For purposes of scoring risks based on likelihood and impact, Baker Tilly categorized risks in the following manner:
­ Environment, Strategy, and Governance – Generally speaking, these risks affect the entire organization rather than a specific department or function. ­ Major Projects and Initiatives – These are risks related to on-going projects and initiatives; generally speaking, the duration of the project lasts only as long as the project itself (i.e., they are not inherent to the organization). ­ Function Specific Risks – These risks are inherent to a function with no timetable for completion.

Likelihood of an Adverse Event
Likelihood Definitions
Likelihood Scale General
Very Likely 5 Weekly
(50+ occurrences annually)
Likely 4 Monthly
(10-50 occurrences annually)
Somewhat Likely 3 Annually
(>10 occurrences annually)
Unlikely 2 Once every 2 years
Rare 1 Less than once every 2 years

Impact of an Adverse Event
The table below shows the scoring methodology for major initiatives and projects:

Impact - Major Initiatives
Impact Scale Financial
High 5 $50M+
Elevated 4 $25M - $49.99M
Moderate 3 $10M - $24.99M
Minor 2 $5M - $9.99M
Insignificant 1 <$5M

The table below shows the scoring methodology for function specific risks as well as general organization wide risks:

Impact Definitions - General
Impact Scale Financial General
High 5 Event causes a $100k or greater impact
to revenue, expense, or net revenue
Very significant and long term impact to revenue, profit, brand/company image, and/or people
Elevated 4 Event causes a $50k - $100k impact to
revenue, expense, or net revenue
Significant and sustained impact to revenue, profit,
brand/company image, and/or people
Moderate 3 Event causes a $25k - $50k impact to
revenue, expense, or net revenue
Moderate and short-term impact to revenue, profit,
brand/company image, and/or people
Minor 2 Event causes a $5k - $25k impact to
revenue, expense, or net revenue
Moderately low impact to revenue, profit, and/or
brand/company image which can be overcome w/in 1 year
Insignificant 1 Event causes less than $5k impact to
revenue, expense, or net revenue
Low impact to revenue, profit, and/or brand/company image which can be overcome within one quarter of occurrence

Overall Risk Scoring
Following the scoring of likelihood and impact, each risk is assigned an overall score based on the methodology outlined in The Internal Auditor’s Guide to Risk Assessment by Rick Wright Jr. Red represents high risk, yellow represents moderate, and green represents low.

5 30 38 44 48 50
4 20 28 36 42 46
3 12 18 26 34 40
2 6 10 16 24 32
1 2 3 8 14 22
1 2 3 4 5
Likelihood
Impact
Note: Examples of Potential Risks
Included in the Risk Detail column of the Risk Matrix in the following pages are examples of potential risks. These are examples of risks inherent in the activities before any controls are applied to reduce risks. The inherent risks are identified to understand what could go wrong without mitigating factors or controls.

7.a
Packet Pg. 61

17 Risk Matrix - Environment, Strategy, and Governance Risks (Risks 1-13) The following table summarizes risks related to Environment, Strategy, and Governance.

Note: Examples of Potential Risks included in the Risk Detail column of the Risk Matrix on the following pages are examples of potential risks inherent to the function. These are examples of risks in the activities before any controls are applied to reduce risks.

The inherent risks are identified to understand what could go wrong without mitigating factors or controls. These are not intended to communicate actual issues or challenges.

Risk
ID
Functional Area Risk Title Municipal Code Reference
(From City Municipal and
Process Ordinances)
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
1 Org Wide Ethics Title 2 - Administrative Code, Part
7 Ethics in Contracting

Title 2 - Administrative Code,
Chapter 2.09 Conflict of Interest
for Designated Positions
Ethics is mentioned directly in the City Code as it pertains to purchasing/contracting. The City Code intends to prevent con flicts of interest in the purchasing process and requires employees from withdrawing from participation in a purchasing or contracting activity where a r eal or perceived conflict exists.

Additionally, the City has adopted a Conflict of Interest Code in accordance with the CA Political Reform Act.

The City of Palo Alto has a Fraud, Waste, and Abuse Hotline in place and corresponding administrative policy. The objective of the Hotline is to encourage anonymous reporting of potential instances of fraud, waste, and abuse. The Hotline is monitored by a committee consisting of the 3 members - the City Manager, City Auditor, and City Attorney.

Examples of Potential Risks (Note):
>Instance of fraud, waste, or abuse involving a City employee or contractor engaged by the City >Conflict of interest in the purchasing process whereby a City employee improperly influences a City purchasing decision 1 5 30 Financial
Legal & Compliance
Reputation
2 Org Wide Governance Charter of the City of Palo Alto, Article III. Council

Charter of the City of Palo Alto,
Article III. Council, Section 9
FY22 Risk Updates:

In the risk assessment survey, Governance was rated as the seventh highest risk by management.

Some of the risk assessment interviewees have a concern about governance, and some have a concern about risk management.

FY21 Risks:

The City of Palo Alto is governed first and foremost by its citizens. The citizens of Palo Alto elect seven members of City Council, who in turn elect the Mayor and Vice Mayor. The City Council is the governing body of the City and is responsible for all legislation. The Council also sets the strategic direction and priorities of the City. It approves the budget, adopts ordinances and resolutions, and functions as a board of appeals. The City Council also appoints the City Manager, City Attorney, City Clerk, and City Auditor.

The City Council has committees including the Policy & Services Committee and the Finance Committee. The City Council also a ppoints members to Boards and Commissions including the Human Relations Commission, the Utilities Advisory Commission, and the Public Art Commission.

The Executive Leadership Team is the administrative function of the City and is made up of leaders from different departments across the City. The Executive Leadership Team is led by the City Manager.

Examples of Potential Risks (Note):
>Acting outside the bounds of delegated authority
>Misuse and abuse of authority for personal gain
>Conflicts of interest in appointees by City Council
>Non-compliance with the City Charter
3 4 36 Strategic
Operational
Legal & Compliance
Reputation
Political & Economic
3 Org Wide Labor Environment City of Palo Alto employees are represented by seven unions and collective bargaining agreements. Palo Alto must maintain ong oing negotiations, handle disputes, and mitigate conflicts from becoming larger, more costly issues.

Labor contracts include:
>International Association of Fire Fighters (IAFF)
>Management and Professional Personnel and Council Appointees (MGMT) >Fire Chief's Association (FCA)
>Palo Alto Peace Officers' Association (PAPOA)
>Palo Alto Police Management Association (PAPMA)
>Service Employees International Union (SEIU)
>Utilities Management and Professional Association of Palo Alto (UMPAPA)

The City also adheres to other compensation plans including:
>Limited Hourly Employees Compensation Plan

Examples of Potential Risks (Note):
>Non-Compliance with California Labor Code
>Long-term financial pressures, including unfunded pension liabilities >Agreement oversight and administrative burden
>Service disruptions due to extended contract negotiations 3 3 26 Operational
Financial
Legal & Compliance
Reputation
Political & Economic

7.a
Packet Pg. 62

18 Risk
ID
Functional Area Risk Title Municipal Code Reference
(From City Municipal and
Process Ordinances)
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
4 Org Wide Financial Planning
and Budgeting
Title 2 - Administrative Code,
Chapter 2.28 Fiscal Procedures
The adopted budget is released annually in August. The preparation of the budget begins in September of the prior year. The Office of Management and Budget (OMB) in the Administrative Services Department develops the operating and capital budgets. The OMB works with senior management and the City Manager to develop budgets accordingly. Per the Capital Budget for FY21, there are six sources that inform the budget:

>The City Council’s top priorities and other City Council directives, such as the 2014 Infrastructure Plan >Organizational financial status and budgetary guidelines >Service level and infrastructure prioritization, as identified by the City Manager >Community input (e.g. Infrastructure Blue Ribbon Commission) >The City’s policies regarding land use and community design, transportation, housing, natural environment, business, and economics, as outlined in the Comprehensive Plan.

Examples of Potential Risks (Note):
>Disagreement among City leadership and/or City Council regarding budgetary priorities >Non-compliance with City Code
>Long-term financial pressures, including unfunded pension liabilities 2 4 28 Strategic
Operational
Financial
5 Org Wide Public-Private
Partnerships
Palo Alto partners with private organizations and non-profits. In particular, the City has established partnerships with non-profits in the administration of senior services, the animal shelter, urban forestry, local history museum, suicide prevention activities, the Zoo, and others.

Examples of Potential Risks (Note):
>Reputational damage done to the City based on actions of a partner >Financial impact of any inefficiencies
>Agreement oversight and administrative burden
3 4 36 Strategic
Operational
Financial
Reputation
6 Org Wide Compliance and
Regulatory
Environment
FY22 Risk Update:

In the risk assessment survey, Regulatory was rated as the fourth highest risk by management.

FY21 Risks:

Palo Alto has numerous laws and regulations, ordinances, and policies and procedures that the organization and its employee must abide by. These laws are promulgated at the Federal, State, and Local level.

Examples of Potential Risks (Note):
>Failure to track and update relevant regulations may lead to external audit findings, fines, and other punitive measures by federal and state agencies >Changing regulations may add complexity to operations and strategic planning >Non-compliance leading to enforcement action
3 3 26 Legal & Compliance
Political & Economic
7 Org Wide Employee Retention
& Succession
Planning
Title 2 - Administrative Code,
Chapter 2.36 Personnel
Procedures
FY22 Risk Updates:

Recruitment and retention challenges and lack of succession plan were identified as weaknesses by many managers who took our risk assessment survey. Palo Alto living situation (Long commute, Cost of living) was listed as threat.

Some of the risk assessment interviewees are concerned about succession planning

FY21 Risks:

Many factors impact employee recruitment and retention within the City.

The Public Employee Pension Reform Act of 2013 (PEPRA) ultimately made public employment less attractive in the State. The new benefits structure lowered retirement benefits to State employees.

Palo Alto and the surrounding area has a high cost of living. For many employees, it is difficult to afford to live in or near Palo Alto, and any employees commute great distances to work for the City. For certain positions, it is difficult to recruit candidates, as there are other employment options in more affordable communities. This is especially difficult for those employees with skills in high demand, such as linemen and othe r employees in the trades.

Examples of Potential Risks (Note):
>Lack of succession planning or cross training may result in knowledge loss after employee separations >High levels of turnover may result in expensive hiring/training >Inability to recruit for key positions
>Inability to hire qualified candidates due to greater competition from other companies/communities 5 4 46 Strategic
Operational
Financial

7.a
Packet Pg. 63

19 Risk
ID
Functional Area Risk Title Municipal Code Reference
(From City Municipal and
Process Ordinances)
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
8 Org Wide Stanford University Palo Alto provides Stanford University with a variety of services, including, but not limited too; police, fire, ambulance, disaster preparedness, land use, and utilities.

Stanford directly and indirectly serves as a revenue source for the City. Stanford University is the largest source of property taxes within the City, with $5.5M in taxable assets for the City.

The City and Stanford also partner on various community issues, relationships and projects. Stanford Medical and Stanford University are the first and third largest employer in Palo Alto, respectively. Palo Alto is responsible for providing services to students, facility, sta ff and visitors of the University every day, as well as providing increased services for special events held by or at Stanford University every year.

Examples of Potential Risks (Note):
> Reliance on revenues generation directly and indirectly tied to Stanford University > Shared blame or reputational impact for instances that occur on or by Stanford persons or property, and City services are involved 1 4 20 Financial
Reputation
Political & Economic
9 Org Wide Organizational
Culture
FY22 Risk Updates:

Burnout / Low Moral, Multiple competing priorities, Lack of Diversity, and Lack of Communication (Among departments) were identified as weaknesses by many managers who took our risk assessment survey.

FY21 Risks:

General risk description: Culture is the system of values, beliefs and behaviors that shape how things get done within an organization. Culture risk results form potential misalignments between the values and beliefs of an organization and day to day operations.

Examples of Potential Risks (Note):
>Acceptance of deviations from policies and procedures
>Culture of long hours leading to employee dissatisfaction >Lack of ethical tone at the top
3 4 36 Operational
Reputation
Political & Economic
10 Org Wide Workforce FY22 Risk Update:
- FY22 Adopted Operating Budget reflects a net reduction of 86 full-time staff (equivalent of 78.85 FTE) and 102 part-time staff (equivalent of 24.73 FTE) - Workload and Limited Resources were identified as weaknesses by many managers who took our risk assessment survey.

FY21 Risks:

There are vacancies throughout the organization at all levels. Vacancies have increased workload of current employees, who mu st cover the same amount of work with fewer FTE's. Nationwide staffing and workforce shortages, combined with the generational highest resignations have also contributed to the City's difficulties finding potential employees.

Examples of Potential Risks (Note):
> Inability to be proactive in handling situations and concerns for the City > Burnout and resentment of staff
> Exhaustion and increased safety concerns for field employees 4 4 42 Operational
11 Org Wide State Legislative
Issues

FY22 Risk Update:

One of the risk assessment interviewees is concerned about unfunded state mandates. There is uncertainty with those mandates.

FY21 Risks:

State priorities and legislative action impact have increased in recent years, as the State priorities and mandates, particul arly related to housing, land usage and development have become more robust. The City has to balance local priorities with legal regulations and usage from the State.

Policies around the use of land, housing developments, low-income housing and green initiatives require additional legal action and planning considerations.

Examples of Potential Risks (Note):
> Litigation from improver use of land or housing requirements > Inability to properly grow and develop the City based on local priorities and community values > Non-compliance to State regulations resulting in delays in development, sanctions and citations

3 3 26 Financial
Legal & Compliance
Reputation
12 Org Wide Procurement and
Supply Chain

Worldwide raw materials and supply shortages from COVID-19 and the lack of available workforce, will continue to produce challenges for the City. There is also an associated increase in products as a result of the lack of available materials.

Examples of Potential Risks (Note):
> Increased costs of goods not incorporated into project budgets > Project schedule times will increase, increasing labor costs, opportunity costs and financial constraints > Impact to community trust and understanding as community services take longer to fulfill 4 3 34 Strategic
Operational
Financial

7.a
Packet Pg. 64

20 Risk
ID
Functional Area Risk Title Municipal Code Reference
(From City Municipal and
Process Ordinances)
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
13 Org Wide Aging Population

Palo Alto’s community continues to age. Rising costs of living and the limited available housing have limited the ability for younger families and individuals to move into the area.

Examples of Potential Risks (Note):
> Loss of population that impacts revenues
> Changing demographics that result in change of City priorities and community needs 1 1 2 Environmental
Political & Economic
14 Org Wide Citywide Risk
Management
Some of the risk assessment interviewees have a concern about risk management and expressed a need for citywide risk assessment.

The City currently has some risk management processes in Human Resources department for insurance and in Utilities department for safety.

Excerpt from IIA position paper THE ROLE OF INTERNAL AUDITING IN ENTERPRISE-WIDE RISK MANAGEMENT "Enterprise-wide risk management (ERM) is a structured, consistent and continuous process across the whole organization for identifying, assessing, deciding on responses to and reporting on opportunities and threats that affect the achievement of its objectives.

Responsibility for ERM
The board has overall responsibility for ensuring that risks are managed. In practice, the board will delegate the operation of the risk management framework to the management team, who will be responsible for completing the activities below. There may be a separate function that co-ordinates and project-manages these activities and brings to bear specialist skills and knowledge.

Benefits of ERM
ERM can make a major contribution towards helping an organization manage the risks to achieving its objectives. The benefits include:
• Greater likelihood of achieving those objectives;
• Consolidated reporting of disparate risks at board level; • Improved understanding of the key risks and their wider implications; • Identification and sharing of cross business risks;
• Greater management focus on the issues that really matter; • Fewer surprises or crises;
• More focus internally on doing the right things in the right way; • Increased likelihood of change initiatives being achieved; • Capability to take on greater risk for greater reward and • More informed risk-taking and decision-making."
4 4 42 Strategic
Operational
Legal & Compliance
Reputation
Political & Economic

7.a
Packet Pg. 65

21 Risk Matrix - Major Projects & Initiatives (Risks 15-44) The following table summarizes risks related to Major Projects and Initiatives.

Note: Examples of Potential Risks included in the Risk Detail column of the Risk Matrix on the following pages are examples of potential risks inherent to the function. These are examples of risks in the activities before any controls are applied to reduce risks.

The inherent risks are identified to understand what could go wrong without mitigating factors or controls. These are not intended to communicate actual issues or challenges.

Risk
ID
Functional Area Risk Title Municipal Code Reference
(From City Municipal and
Process Ordinances)
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
15 City Wide COVID-19
Response
Palo Alto has operated under emergency response orders in some capacity since March 2020. Mitigation and control of COVID -19 is imperative for citizen and employee safety and continued operation of City services.

COVID-19 has created additional needs and hurdles for the City, including:
> Compliance with Federal vaccination requirements
>Increased demand for public services
>Transition to a hybrid virtual and in-person environment >More centralized need for internal and external communications >Discontinued shuttle services

Examples of Potential Risks (Note):
>Inability to meet citizens demands given current financial and operational constraints >Transition of communications and operations to normal operational status >Health and safety of citizens and employees
5 5 50 Strategic
Operational
Financial
Legal & Compliance
Reputation
Political & Economic
16 Uplift Local
Program
Parking Revenue FY22 Risk Updates:

Length of time of road closures and suspending parking payments increased the City’s risk for removing those regulations and reintroducing parking payments for Citizens. Prolonged lack of parking revenues may also impact the City’s ability to fund existing projects and budgeted items. Citizens and businesses may also push-back on reopening streets and reinstating parking payments.

FY21 Risks:

The City has closed or partially closed several streets to allow restaurants and patrons more space for socially distanced outdoor dining. The City has also removed parking meters and garage parking fees during this time. The City implemented the Uplift Local Program to help s upport the economy and local businesses, residents and visitors.

Examples of Potential Risks (Note):
>Loss of revenues from closure or suspending parking meter and parking garage fees >Logistics for reopening of closed streets after sustained closures >Resistance from businesses and vendors on reopening streets and stopping outdoor dining and shopping 5 2 32 Operational
Financial
Legal & Compliance
Reputation
Political & Economic
17 Administrative
Services
ERP System
Upgrade
FY22 Risk Updates:

ERP system upgrade is still planned to be done.

Noted as a risk area by a risk assessment interviewee

FY21 Risks:

The City of Palo Alto is currently undergoing an upgrade of the ERP system. This includes two phases of efforts. The first ph ase is migrating upgrading to a new version of SAP. The second phase focuses on process improvement through use of the upgraded system.

Examples of Potential Risks (Note):
>Unforeseen barriers in implementation requiring change orders that delay the process and increase overall expenses >Strain on capacity associated with the level of attention required by ERP implementation >Data loss during system upgrade or subsequent efforts
>System downtime leading to stoppage in the ability to provide services 3 4 36 Operational
Financial
Legal & Compliance
IT
Reputational
18 Public Safety Public Safety
Building
Construction
The City approved the FY22-FY26 Capital Improvement Plan, which includes construction of the Public Safety Building. The total project budget is $118M, $9.4M is budgeted from FY22-FY26. Justification for the project was included in the 2014 Council approved Infrastructure Plan, which was preceded by a recommendation by the Infrastructure Blue Ribbon Commission report in 2011. Construction Contract was awarded i n early 2021, with plans to complete construction in Summer 2023.

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 3 5 44 Operational
Financial

7.a
Packet Pg. 66

22 Risk
ID
Functional Area Risk Title Municipal Code Reference
(From City Municipal and
Process Ordinances)
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
19 Public Works Newell Road/San
Francisquito Creek
Bridge
Replacement
The City approved the FY22-FY26 Capital Improvement Plan, which includes the continued replacement of the Newell Road/San Francisquito Creek Bridge. The total project budget is $18.2M, $15.0M is budgeted from FY22-FY26. Removal of the existing bridge is a necessary element of the San Francisquito Creek Joint Powers Authority (JPA) comprehensive flood management program.

Examples of Potential Risks (Note):
>Increased costs related to project delays and need to coordinate with other agencies >Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 3 18 Operational
Financial
Legal & Compliance
Reputation
20 Public Works Fire Station 4
Replacement
The City approved the FY22-FY26 Capital Improvement Plan, which includes construction of Fire Station 4. The total project budget is $10.2M, all of which is budgeted from FY22-FY26. This project provides funding to replace Fire Station #4 at the corner of Middlefield Road and East Meadow Drive.

The replacement facility will be based on the prior Replacement Study and Needs Assessment prepared in 2005 and the station b eing operationally and technologically deficient.

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 3 18 Operational
Financial
Legal & Compliance
Reputation
21 Public Works Street Maintenance FY22 Risk Updates: The City approved the FY22-FY26 Capital Improvement Plan, which includes the continued upkeep and repair of various City streets. The total project budget is $26.0M, all of which is budgeted from FY22-FY26. This project provides funding for annual resurfacing, slurry sealing, crack sealing, and reconstruction of various City streets. Using Pavement Maintenance Management Systems (PMMS) and Metropolitan Transportation Agency's Street Saver software, streets determined to be below the pavement condition index (PCI) standard minimum of 60, are to be repaired. The City Council established a goal of achieving an average City-wide PCI of 85,and intends to bring all City streets to a PCI of 85 or greater.

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 4 28 Operational
Financial
Legal & Compliance
Reputation
22 Office of
Transportation
Railroad Grade
Separation and
Safety
Improvements
The City approved the FY22-FY26 Capital Improvement Plan, which includes the construction and upkeep of safety measure at railroad crossings. The total project budget is $15.9M, $11.7M is budgeted from FY22-FY26. Connecting Palo Alto, is a community-based process to advance the railroad grade crossing circulation study and context sensitive solutions study envisioned by the City Council.

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 3 18 Operational
Financial
Legal & Compliance
Reputation
23 Public Works Airport Apron
Reconstruction
The City approved the FY22-FY26 Capital Improvement Plan, which includes the repaving of airport pathways. The total project budget is $41.9M, $.49M is budgeted from FY22-FY26, with $17.8M being distributed in FY21. The project includes the total re-pavement of airport runways, taxiways and pavement surfaces critical to airport safety. Average pavement condition index (PCI) for the airport was 36, below the indust ry standard minimum of 60, and below the City's goal of a PCI of 85. A PCI of 36 indicated a need for full pavement reconstruction.

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 1 3 Operational
Financial
Legal & Compliance
Reputation
24 Utilities Electric Customer
Connections
The City approved the FY22-FY26 Capital Improvement Plan, which includes the installations of services, transformers and meters for new customers.

The total project budget is $13.5M, all of which is budgeted from FY22-FY26. During a typical year, over 200 electric services are installed or upgraded in the City. This is a recurring CIP.

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 3 18 Operational
Financial
Legal & Compliance
Reputation

7.a
Packet Pg. 67

23 Risk
ID
Functional Area Risk Title Municipal Code Reference
(From City Municipal and
Process Ordinances)
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
25 Utilities Electrical Systems
Improvement
The City approved the FY22-FY26 Capital Improvement Plan, which includes improve the Electrical Distribution System. The total project budget is $12.6M, all of which is budgeted from FY22-FY26. Typical activities include: increasing system capacity for load growth, replacing deteriorated capital facilities, reconfiguring/adding to the system to improve service reliability, repairing and replacing storm damaged equipmen t, and making general improvements to the system. This is a recurring CIP.

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 3 18 Operational
Financial
Legal & Compliance
Reputation
26 Utilities Smart Grid
Technology
Installation
The City approved the FY22-FY26 Capital Improvement Plan, which includes building a smart grid. The total project budget is $17.6M, $17M is budgeted from FY22-FY26. Smart grid technology, including the Smart Grid Road Map leads to cost operation savings and energy conservation.

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 3 18 Operational
Financial
Legal & Compliance
Reputation
27 Utilities Fiber To The Home The City has been exploring the possibility of providing the option for residents to connect to a fiber optic network for fas ter internet. This would involve expanding the current fiber optic network and formalizing a new utility function. Interest in the service has been rising and the Utilities Department have been exploring the possibility of implementing a greater network of fiber optic.

The City has engaged a consultant to perform a feasibility study.

Examples of Potential Risks (Note)
>Financial loss associated with learning curve of new service >Resources associated with operating the new service
>Risk of misalignment with broader City strategy
2 4 28 Operational
Financial
Legal & Compliance
Reputation
28 Utilities Gas Main
Replacements
FY22 Risk Updates: The City is replacing gas mains that may be leaking, inadequately sized, and/or structurally deficient based on the City's Distribution Integrity Management Plan's mathematical model. The model is used to evaluate risks presented by PVC and steel facilities located within business districts that have been assigned the highest probability and consequence scores. The project will target replacing PVC mains and services located in business districts and steel mains and services with ineffective corrosion protection, also known as catholic protection. Targeted streets will be coordinated with the Public Works Street Maintenance Program to complete replacement before streets are paved.

Gas main replacements totals $22.46M, includes four projects > Project 23: 21,700 linear feet, at $.46M (remaining from FY21) > Project 24: 20,209 linear feet, at $9M
> Project 25: 31,260 linear feet, at $11M
> Project 26: 13,471 linear feet, at $2M

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 3 18 Operational
Financial
Legal & Compliance
Reputation
29 Public Works Wastewater
Collection System
Rehabilitation/
Augmentation
FY22 Risk Updates: The City is replacing wastewater mains for outdated, rusted and under capacity wastewater systems. The 2004 Collection System Master Plan update indicated facilities that are in need of augmentation to handle growth and peak flow increases. Priority w ill be given to areas identified by Public Works are targeted work zones.

Wastewater aim replacement total $11.3M , includes four projects > Project 29: 9,965 linear feet, at $.35M
> Project 30: 8,778 linear feet, at $4.1M
> Project 31: 10,474 linear feet, at $5.2M
> Project 32: 9,756 linear feet, at $1.65M

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 3 18 Operational
Financial
Legal & Compliance
Reputation

7.a
Packet Pg. 68

24 Risk
ID
Functional Area Risk Title Municipal Code Reference
(From City Municipal and
Process Ordinances)
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
30 Public Works New Laboratory and
Environment
Services Building
The City approved the FY22-FY26 Capital Improvement Plan, which includes construction of the Wastewater Laboratory and Environmental Services building. The total project budget is $24.1M, $23.8M is budgeted from FY22-FY26. The existing laboratory does not have adequate space for staff, instruments, chemical storage, and microbiology testing, the new building will allow for consolidation of staff in a single building and a larger updated lab.

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 3 3 26 Operational
Financial
31 Public Works Advanced Water
Purification Facility
The project provides funding for an Advanced Water Purification Facility, with a total project budget of $20.2M, $17.2M is bu dgeted from FY22-FY26. The Regional Water Quality Control Plant (RWQCP) provides recycled water to the City, and currently have a TDS level of 800-900 mg/L. In 2010 City Council adopted a goal to reduce TDS to 600 mg/L, with approximately 40 potential users of recycled water waiting for connect ion still pending until TDS levels are lowered.

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 3 18 Operational
Financial
32 Public Works Headworks Facility
Replacement
The City approved the FY22-FY26 Capital Improvement Plan, which includes the replacement of the Headworks Facility. The total project budget is $49.1M, with the entire amount budgeted from FY22-FY26. The project was identified in the Long Range Facilities Plan and adopted by City Council in 2012. The project will replace pumping, suction and discharge pipes, manifolds, valve and additional control system and equipment of the water facility.

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 4 28 Operational
Financial
33 Public Works Outfall Line
Construction
The project provides funding for the construction of a new parallel outfall pipe of the San Francisco Bay. The total project budget is $10.7M, with $10,6M budgeted for FY22-FY26. The Long Range Facilities Plan identified the need for the construction of the water line, as the system has a 54-inch outfall line and a 36 in-inch legacy outfall line, which is inadequate in passing the Plant's peak wet-weather hydraulic flow capacity of 8- million gallons per day.

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 2 10 Operational
Financial
34 Public Works RWQCP Plant
Repair, Retrofit and
Equipment
Replacement
This project provides funding for the assessment, repair, and retrofit of the Regional Water Quality Control Plant's (RWQCP) concrete and metal structures; the replacement of necessary RWQCP equipment and ancillary facilities to maintain treatment reliability and existing infrastructure; and the replacement of large diameter flow meters built into the wastewater treatment system on sewers, pipes, wires, transformers, switches and components of medium voltage electrical equipment.

The budget from FY22-FY26 is $23.2M.

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 3 18 Operational
Financial
Legal & Compliance
Reputation
35 Public Works Secondary
Treatment
Upgrades
FY22 Risk Updates: Upgrades to the Secondary Treatment process at the Regional Water Quality Control Plant (RWQCP). The existing Secondary Treatment process has two main components: the Fixed Film Reactors (FFR) and the Activated Sludge (AS) Process. This project includes the reconfiguration of the aeration basins, modification of the AS Proce ss, and the elimination of the FFRs.

Justification of the project was identified in the Long-Range Facilities Plan accepted by Council in 2012. The components of the Secondary Treatment process are between 35 and 45 years old and show signs of wear and structural weakness. In FY22 the project was expanded to address the sea level rise policy implications.

The budget from FY22-FY26 is $126.0M, with a total project budget of $129.0M.

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 5 38 Operational
Financial
Legal & Compliance
Reputation

7.a
Packet Pg. 69

25 Risk
ID
Functional Area Risk Title Municipal Code Reference
(From City Municipal and
Process Ordinances)
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
36 Utilities Water Tank Seismic
Upgrade and
Rehabilitation
The City approved the FY22-FY26 Capital Improvement Plan, which includes upgrades and repairs to the water tank seismic system. The total project budget is $26.3M, $15.6M is budgeted from FY22-FY26.

Work at the reservoir sites will also include the installation of: new seismic shut off valves between the reservoirs and val ve vaults, new plug valves, piping and pipe supports in the valve vaults, and recoating of the interior and exterior reservoir walls.

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 3 18 Operational
Financial
Legal & Compliance
Reputation
37 Utilities Water Main
Replacement
FY22 Risk Updates: The project will fund the design and replacement of structurally deficient water mains and appurtenances i n Fiscal Years 2024 and 2026. Mains are selected by researching the maintenance history of the system and identifying those that are undersized, corroded, and subject to breaks.

Water main replacements totals $29.9M, include four projects > Project 28:18,985 linear feet, at $11.1M
> Project 29:13,425 linear feet, at $9.4M
> Project 30:13,025 linear feet, $9.4M

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 4 28 Operational
Financial
Legal & Compliance
Reputation
38 Public Works Scheduled Vehicle
and Equipment
Replacement
The ongoing replacement of City fleet vehicles and equipment is prescribed by the City's policy on vehicle replacement, which includes guidelines based on age, mileage accumulation, and obsolescence. Timely replacement of vehicles lowers maintenance costs, helps to maintain or even increase the productivity of client departments, and allows the City to take advantage of new technology.

The largest vehicle replacement costs are scheduled for FY23-FY26. Total budget amounts for FY22-FY26 is $15.1M.

> FY22: $1.4M
> FY23: $3.4M
> FY24: $3.5M
> FY25: $3.4M
> FY26: $3.4M

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to contract terms and conditions
>Justification for change orders or changes in delivery schedules >On-going funding for replacement
2 3 18 Operational
Financial
Legal & Compliance
Reputation
39 Utilities Gas Main
Replacements
The City is replacing gas mains that may be leaking, inadequately sized, and/or structurally deficient based on the City's Distribution Integrity Management Plan's mathematical model. The model is used to evaluate risks presented by PVC and steel facilities located within business districts that have been assigned the highest probability and consequence scores. The project will target replacing PVC mains and services l ocated in business districts and steel mains and services with ineffective corrosion protection, also known as catholic protection. Targeted streets will be coordinated with the Public Works Street Maintenance Program to complete replacement before streets are paved.

Gas main replacements totals $29.6M, include three projects > Project 23: 21,700 linear feet, at $7.6M
> Project 24:33,050 linear feet, at $11M
> Project 25:31,260 linear feet, at $11M

Examples of Potential Risks (Note):
>Design and operating effectiveness of internal controls over various financial aspects of the construction project >Adherence to construction contract terms and conditions >Mathematical accuracy of project related costs
>Justification for change orders or changes in delivery schedules 2 4 28 Operational
Financial
Legal & Compliance
Reputation

7.a
Packet Pg. 70

26 Risk
ID
Functional Area Risk Title Municipal Code Reference
(From City Municipal and
Process Ordinances)
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
40 Public Works ADA Compliance
Upgrade
According to Palo Alto's ADA Transition Plan, the ADA Transition "project identifies potential noncompliant items and other physical barriers at City buildings, parking lots, and recreational facilities. The work to be performed under this contract includes the evaluation of site and program accessibility compliance to provide the basis for identification, prioritization, budgeting, and implementation of plans, as well as an upd ated plan and database which will be used in continuing efforts to comply with accessibility requirements as established by the ADA and State of California Building Code (CBC) accessibility provisions." This will be a multi-decade project to upgrade City-owned properties to align with ADA requirements.

Examples of Potential Risks (Note):
>Unforeseen costs associated with a multi-decade project, consuming greater Capital Improvement funds than expected >Changes in ADA regulations during the course of the project, requiring changes to the existing plan 2 5 38 Operational
Financial
Legal & Compliance
Reputation
41 City Wide Sustainability and
Climate Action Plan
FY22 Risk Update:
- FY22 Adopted Operating Budget reports one of the four priorities City Council selected was Climate Change (Protection and Ada ptation). - Two of the risk assessment interviewees are concerned about sea level rise and one of them is concerned about climate risk in terms of adaptation of the plan and funding and the other is concerned about wildland fire.

FY21 Risks:

Palo Alto's goal is to reduce our greenhouse gas emissions 80 percent below 1990 levels by 2030. In early 2020, the City launched an update to the Sustainability and Climate Action Plan (S/CAP) to help meet our sustainability goals, including our goal of reducing GHG emissions 80 percent below 1990 levels and being completely carbon neutral by 2030. The plan includes goals and key actions in seven areas: Energy, Mobi lity, Electric Vehicles, Water, Climate Adaptation and Sea Level Rise, Natural Environment, and Zero Waste.

The City currently has 100% renewable energy resource through several power purchase agreements. Next steps include electrificatio n of cars and elimination of natural gas use in home and commercial electric appliances. As of 2019,

Examples of Potential Risks (Note):
>Reputational risk of not achieving stated goals
>Costs associated with marginal improvements in greenhouse gas emission reductions 3 4 36 Operational
Financial
Reputation
42 City Wide Noise Pollution FY22 Risk Updates: Palo Alto is impacted by three arrival routes into San Francisco International Airport (SFO). These routes have had an ongoing negative health impact on our community and intensified due to the implementation of the Federal Aviation Administration’s NextGEN Initiative.

The City is committed to working with our citizens, Congress, the Federal Aviation Administration (FAA), SFO, SFO’s Community Roundtable, neighboring city and county agencies, regional airports, noise groups, and all stakeholders associated with air traffic in Silicon Valley to find solutions which restore the quality of life of our community.

Examples of Potential Risks (Note):
>Health and safety risk associated with noise pollution. >Property value reductions
>Community trust and engagement
4 3 34 Financial
Legal & Compliance
Reputation
43 City Wide College Terrace
Market
The PC ordinance (5069), and the associated Restrictive Covenant, require that a grocery store must be in continuous operation. If the grocery store ceases operations, a new grocery operator must be found. There is a six-month grace period for the property owner to find a new grocery tenant.

Starting on February 13, 2020, daily fines of $2,157/day began to be assessed against the property owner for its failure to have a grocery store in operation. This requirement for the continuous operation of a grocery store was established by PC Ordinance 5069 and was further amended by a restrictive covenant put in place in 2015.

Examples of Potential Risks (Note):
>Inability to identify and retain a tenant
>Reputational risk associated requiring a grocery store 2 2 10 Legal & Compliance
Reputation
44 City Wide Race & Equity
Initiative
In June 2020, the City Council adopted a resolution affirming that Black lives matter and committed to address systemic racis m and bias, and honored the lives of George Floyd, Breonna Taylor, Ahmaud Arbery, and others that have fallen victim to violence at the hands of authorities. The City Council also approved the Race & Equity Framework and action plan and a series of actions including reviewing policing practices, mak ing changes to use-of- force policies to reduce the potential for violence, and engaging the community in ongoing, thoughtful dialogue and leadership.

Examples of Potential Risks (Note):
>Inaction causing reputational damage
>Improper use of force
2 4 28 Financial
Legal & Compliance
Reputation

7.a
Packet Pg. 71

27 Risk Matrix - Function Specific Risks (Risks 45 -154) The following table summarizes Function Specific Risks.

Note: Examples of Potential Risks included in the Risk Detail column of the Risk Matrix on the following pages are examples of potential risks inherent to the function. These are examples of risks in the activities before any controls are applied to reduce risks.

The inherent risks are identified to understand what could go wrong without mitigating factors or controls. These are not intended to communicate actual issues or challenges.

Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
45 Administrative
Services
Real Estate and
Property
Management

2.08.150 Department of
Administrative Services
FY22 Risk Updates:

The Real Estate team started using a new database called Spacebase to centrally manage all lease agreements.

The requirements of GASB 87 (Leases) are effective for the City's fiscal year ending June 30, 2022.

FY21 Risks:

The City of Palo Alto handles many different real estate and property agreements such as easements, rights of way, leases, tie back agreements, and more. The Real Property team provides expertise on real estate matters and partners with client departments on specific real estate needs.

Examples in which the Real Property team coordinates with client department include leases at the Cubberley Community Center and hangar space at the airport.

Examples of Potential Risks (Note):
>Inadequate technology to manage lease agreements
>Lack of capacity to manage and ensure accuracy in real estate agreements >Revenue collection errors
>Failure to properly implement GASB 87
4 3 34 Operational
Financial
Legal & Compliance
46 Administrative
Services
P-Card Program 2.08.150 Department of
Administrative Services

2.30.240 Designated Employees'
Use of Petty Cash, P-Card, or
Other Credit Card
The City of Palo Alto uses P-Cards throughout the organization to leverage purchasing power and improve purchasing processes. The organization has hundreds of P-Cards assigned to individuals throughout the City. P-Cards can be requested through purchasing and require supervisor approval for use.

Transactions have a threshold of $10k.

Examples of Potential Risks (Note):
>Personal expenditures on City P-Cards for items that could be interpreted as business expenses >Circumventing policy, such as splitting transactions to fall below the $10K threshold >Information technology purchases that do not allow for proper IT oversight or governance 4 2 24 Financial
Legal & Compliance
47 Administrative
Services
Vendor Master File 2.08.150 Department of
Administrative Services
At City of Palo Alto, segregation of duties as it pertains to changes to the Vendor Master File are segregated such that one individual cannot process payments and modify the vendor master file.

Examples of Potential Risks (Note):
>Accounts Payable changing payment information to a personal bank account routing number >Erroneous Vendor data leading improper payments
1 3 12 Financial
Reputation
48 Administrative
Services
Print and Mail
Services

2.08.150 Department of
Administrative Services
The City of Palo Alto operates a print and mail services department, managing the mailing of all utility bills, acting as a central re ceiving area in City Hall, and also completing any printing services. The print services division handles printing of Council packets for City Council members.

Examples of Potential Risks (Note):
>Financial and operational opportunity costs of running in-house mail services department compared to outsourcing the function 2 2 10 Strategic
Operational
Financial
49 Attorney Claims & Claim
Reserves

2.28.240 Settlement of Claims and
Actions

2.08.120 Office and Duties of the
City Attorney

State of California Tort Claims Act
As provided in Section 935.4 of the Government Code of California, the City Attorney is designated to perform the functions of the City Council relative to claims and actions against the City or any of its officers or employees under the provisions of Division 3.6 of the Government Code.

The City may be liable for a variety of claims including:
>Torts Claims
>Law Claims
>Labor and Employment Claims
>Contract Claims

Risk to the City is mitigated though the City's membership in the Authority for California Cities Excess Liability (ACCEL) pool, though which the insures itself.

Examples of Potential Risks (Note):
>Property damage resulting from City actions
>Motorist injuries due to an interaction with a Palo Alto staff member acting within scope of her/his employment >An employee suffers an injury while performing their job duties 3 3 26 Legal & Compliance

7.a
Packet Pg. 72

28 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
50 Clerk Public Records
Requests

2.08.110 Office and Duties of the
City Clerk

2.08.300 Books and records.

(Ord. 4274 § 1 (part), 1995)
The City receives upwards of 400 requests for information every year. Public records requests come in a variety of ways; written, in person, online and over the phone. Compliance with the Freedom of Information Act (FOIA) and state and local jurisdiction dictate the availabili ty of requests and outlines the procedures for providing documents to the public.

Examples of Potential Risks (Note)
>Incoming requests are decentralized, leaving possibility for requests to go unfulfilled >Fulfilling of requests is centralized, burdening the department and causing inefficiencies >Noncompliance with applicable laws
2 3 18 Financial
Legal & Compliance
Reputation
51 Clerk Elections Chapter 2.40 Municipal Elections The City Clerk is the local Filing Officer for the State of California. All local campaign Committees are required to file Campaign Statements with the City Clerk. The City Clerk maintains regulations and forms under the State of California Fair Political Practices Commission.

Examples of Potential Risks (Note)
>Non-compliance with regulatory requirements
1 2 6 Reputation
52 Clerk Records
Management

2.08.110 Office and Duties of the
City Clerk

2.08.300 Books and records.

(Ord. 4274 § 1 (part), 1995)
The City Clerk is the Records Manager for the City and is responsible for maintaining the City's Records Retention Schedule a nd for providing departments with guidance on policies and best practices of records management.

The City Clerk's Office records official actions and legislation of the municipal government and retains other legal and historical records. The City Clerk manages the proper maintenance and disposition of City records and information according to statute, and helps to pres erve City history. Formalized Standard Operating Procedures (SOPs) communicate the correct way of carrying out records management activities. SOPs help the organization operate efficiently, maintain consistency, and communicate clearly. The City Clerk does not have current SOPs detailing records management and retention practices.

A modern/centralized records management system may increase efficiency and offer functionality such as analytics and reporting capability. Without a centralized repository, employees use paper based files and multiple online platforms. The City of Palo Alto operates on a decentralized records management process.

Examples of Potential Risks (Note)
>Damage to documents from improper storage
>Inability for documents and information to be accurately recorded and sourced for public information requests and public is given inaccurate information about the availability of documents
>Institutional knowledge is lost when employees retire or leave the department >Records are destroyed prematurely or stored longer that legally necessary 4 2 24 Operational
Legal & Compliance
Reputation
53 Communications Social Media
Management
Brown Act
(California Government Code
Section 54950 et seq.)
Social media accounts are handled and managed by separate, decentralized departments. Content published by these accounts are not generated from a central office, but are monitored by the Communications Office.

Additionally, elected official’s social media posts may be considered public record and may be subject to State law. The majority of instances include the use of personal platforms to promote City agenda, issues and positions.

Examples of Potential Risks (Note):
>False or misleading information is published by City owned accounts >Conflicting information is provided by multiple City owned accounts >Lack of internal controls for publishing content on City owned accounts >Publishing of inappropriate or inaccurate content
>Inaccurately holding and/or of managing public information for records management 3 3 26 Strategic
Legal & Compliance
Reputation
Political & Economic
54 Communications Digital Marketing Digital platforms, such as websites, social media, online platforms, blog posts (Palo Alto Connect) and digital newsletters a re used to disperse information and inform community members and City employees. Additionally, these platforms are used to advertise City services and events.

Examples of Potential Risks (Note):
>False and/or misleading information is published by the City >Publishing of inappropriate or inaccurate content
1 3 12 Strategic
Legal & Compliance
Reputation
Political & Economic
55 Communications External Affairs Relations with the media and general public are primarily handled by the Communications Office. The City of Palo Alto works t o timely and accurately inform the media, Including a monthly newsletter, presses releases, interviews, news releases to 400 media contacts and statements on behalf of departments and the City. Requests for information from media is decentralized, with the majority of responses for comments and communication coming from the Communications Department.

Multiple channels are used by the City to build relationships and inform the citizens of Palo Alto and surrounding communitie s. The City works to engage stakeholders and provide a positive public perception by:
>Communicating through its multiple platforms
>Hosting community service events
>Maintaining open and transparent government

Examples of Potential Risks (Note):
>False or misleading information is published by the City 2 2 10 Strategic
Legal & Compliance
Reputation
Political & Economic

7.a
Packet Pg. 73

29 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
>Conflicting statements made by City officials
>Lack of internal controls for managing media requests
56 Communications Website FY22 Risk Updates:
1) City website updated
2) Website maintained centrally with records of who has back-end access

FY21 Risks:

The City's website and affiliated websites are maintained and updated in conjunction with the Communications Office and the Information Technology Department. Both departments work with website host to update information and publish new webpages. Additionally, Individual departments have access to back-end website publishing.

Examples of Potential Risks (Note)
>Lack of internal controls for website access
>Publishing of inappropriate or inaccurate content
2 2 10 Legal & Compliance
Reputation
IT
57 Communications Internal
Communications

18.79.010 Purposes Communications oversees formal internal communications, including creation and/or review of Citywide emails, internal newslet ters and communications.

A centralized place of issuance for organization wide communication including City Manager and department head presentations and reporting.

Examples of Potential Risks (Note):
>Conflicting information is provided to City Employees
>Internal communications are improperly published to the community 2 1 3 Operational
58 Community
Services
Contract Monitoring 2.30 Contracts and Purchasing
Procedures
FY22 Risk Updates:
1) Non-profit agreements internal audit
2) Updated internal controls for contract and vendor management 3) Diversification of contractors
4) Updated software

FY21 Risks:

Community Services relies on third-party contractors to manage the animal shelter, deliver recreational services (i.e. swimming pool, athletic fields, the golf course), and provide arts and theatre programs. As a result, Community Services oversees dozens of contracts and independent contractors.

Examples of Potential Risks (Note):
>Loss of revenue due to overpayments on contracts
>Reputational risk associated with actions of a 3rd party >Failure to adhere to contract terms including scope of work and other critical provisions >Failure to monitor vendor performance
3 4 36 Strategic
Operational
Financial
Legal & Compliance
Reputation
59 Community
Services
Background Check
Procedures

2.08.210 Department of
community services.

Community Services offers a variety of programs where workers may come into contact with children. The following is a non-inclusive list of screening practices the City uses: local criminal record check, state criminal record check, FBI criminal record check, employment reference checks, and personal reference checks.

Examples of Potential Risks (Note):
>Hiring of unqualified individuals
>Employing an individual that should be ineligible for employment involving interactions with children 3 3 26 Operational
Legal & Compliance
Reputation
60 Community
Services
Recreations
Services
Recreation Services has a focus on youth wellbeing. Facilities include the historic Lucie Stern Community Center, Mitchell Pa rk Community Center, Cubberley Community Center, and Rinconada Pool. Recreation Services also coordinates a variety of recreation programs including middle school athletics, the Teen Center, Palo Alto Youth Leadership programs, year-round Life-Long Learning classes, adult sports leagues, dynamic summer camp and aquatics program.

Examples of Potential Risks (Note):
>Resources are expended on services that are not of sufficient benefit to the community >Employing an individual that should be ineligible for employment involving interactions with children >Improper payment for services (e.g., a referee)
2 3 18 Strategic
Financial
Legal & Compliance
Reputation

7.a
Packet Pg. 74

30 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
61 Community
Services
Human Services 2.08.210 Department of
community services.

The Office of Human Services provides services and works toward enhancing the quality of life in Palo Alto in a variety of wa ys. Services relate to the following areas:
>Children Resources
>Family Resources
>Tenant/Landlord
>Human Services Grants
>Emerging Needs Funds

Examples of Potential Risks (Note):
>Resources are expended on services that are not of sufficient benefit to the community >Ineligible program participation
>Fraud/waste/abuse of public funds
1 3 12 Operational
Financial
Legal & Compliance
Reputation
62 Community
Services
Children's Theatre 2.08.210 Department of
community services.

Palo Alto's Children Theatre serves more than 57,000 community members each year with theatrical productions and programs for youth ages 3 through high school. Performing arts education opportunities include onsite classes, camps, and production experiences, as well as th eatrical Outreach Productions (grades 3-5) and Dance in Schools classes (grades K-2) in all twelve PAUSD Elementary Schools.

Children's Theatre offers a variety of programs where workers may come into contact with children.

Examples of Potential Risks (Note):
>Resources are expended on services that are not of sufficient benefit to the community >Employing an individual that should be ineligible for employment involving interactions with children 1 3 12 Strategic
Financial
Legal & Compliance
Reputation
63 Community
Services
Open Space, Parks,
& Baylands Golf
Links
The City of Palo Alto has almost 4,000 acres of open space to explore, recreate and relax in. Park Services handles the maintenance of 162 developed acres of urban parklands. Individual parks range in size from under two acres to large community parks such as Rinconada Park, Mitchell Park, and Greer Park. Besides maintaining urban parks, Parks Services handles landscape maintenance of libraries, community centers, business districts and utility sub-stations.

Troon, previously OB Sports, manages the newly constructed Baylands Golf Links. According to the contract, Troon is responsib le for course maintenance, leases a cafe from the City, and manages a pro shop. The City receives a percentage of revenue from the pro shop. This approach to golf course management is new to the City within the past few years.

The City has a contract with Brightview for maintenance and landscaping services on other open space and parks land.

Examples of Potential Risks (Note):
>Resources are expended on services that are not of sufficient benefit to the community >3rd party management of City resources, such as the golf course 1 3 12 Strategic
Legal & Compliance
Reputation
64 Community
Services
Palo Alto Art Center 2.08.210 Department of
community services.

2.18 Public Art Commission
The Palo Alto Art Center has a partnership with the Palo Alto Art Center (PAAC) Foundation Board. Successful fundraising effo rts of the PAAC Foundation are necessary, in addition to City funds, to sustain the Art Center. The Art Center measures its progress based on the following priorities:
>Community Engagement
>Financial Sustainability
>Leadership capacity

Examples of Potential Risks (Note):
>Resources are expended on services that are not of sufficient benefit to the community >Employing an individual that should be ineligible for employment involving interactions with children 1 2 6 Strategic
Financial
Legal & Compliance
Reputation
65 Community
Services
Junior Museum &
Zoo

2.08.210 Department of
community services.

The Palo Alto Junior Museum & Zoo has a partnership with the Friends of Palo Alto Junior Museum & Zoo. Successful fundraising efforts of Friends of Palo Alto Junior Museum & Zoo are necessary, in addition to City funds, to sustain the museum and zoo. The JMZ is owned and operated by the City of Palo Alto. The JMZ hosts more than 17,000 local students annually from schools, science camps, and field trips. In total, the JMZ has approximately 180,000 visitors per year.

The City is exploring potential opportunities to relinquish day-to-day operations responsibilities to Friends of Palo Alto Junior Museum & Zoo. These discussions are still early stage.

Examples of Potential Risks (Note):
> Resources are expended on services that are not of sufficient benefit to the community >Transferring operating responsibilities to a non-profit may result in legal challenge from existing City employees >Failure to properly manage the JMZ may result in negative publicity and reputational damage 1 2 6 Strategic
Financial
Legal & Compliance
Reputation
66 Community
Services
Public Art Program Chapter 2.26

15.61.110 Public Art Fund

2.26.070 Public Art for Municipal
Projects

2.26.030 Duties of the Public Art
Commission
The Public Art Program operates in accordance with Chapter 2.26 of Palo Alto Municipal Code to provide opportunities for the placement of permanent and temporary site-specific public art projects in municipal projects across Palo Alto. Additionally, the Program oversees the implementation of the Ordinance requirement to incorporate public art in private development projects. The Public Art Commission (PAC) reviews and advises the Public Art Program on selection, placement, and care of public art throughout the City of Palo Alto.

The City collection of public art is comprised of approximately 100 permanently sited works and approximately 200 portable wo rks of art in a diverse range of media. All works are commissioned and acquired through a public process.

1 2 6 Strategic
Financial

7.a
Packet Pg. 75

31 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
Examples of Potential Risks (Note):
>Resources are expended on services that are not of sufficient benefit to the community 67 Emergency
Services
Disaster Response 2.08.185 Office of Emergency
Services.

The mission of the Office of Emergency Services is to prevent, prepare for, mitigate, respond to, and recover from all hazards. This involves:
>Executing a training plan for designated staff
>Maintaining emergency management facilities, critical infrastructure, and essential equipment >Coordinating with private sector, non-governmental organizations to promote continuity of operations >Maintaining disaster plans for the City

The City has developed many resources and have placed them on the website: www.cityofpaloalto.org/thira.

Example of Potential Risks (Note):
>Inadequate response to an emergency such as an earthquake, fire, urban flood, or active shooter situation may result in inju ry, loss of life, financial hardship, and reputational damage to the City and its employees 1 5 30 Strategic
Operational
Financial
Legal & Compliance
Reputation
Political & Economic
68 Emergency
Services
Emergency
Volunteer Coverage
Palo Alto Municipal Code (PAMC)
Sec. 2.12.070

2.08.185 Office of Emergency
Services.

FY22 Risk Updates:
1) On-going pandemic has impacted the ability to find volunteers • Additional COVID19 protocols
• Apprehension of working with the community during the pandemic • Availability of vaccinated or proven negative volunteers 2) Aging population

FY21 Risks:

In the case of emergency, the Office of Emergency Services may enlist the assistance of the community through a volunteer net work. The mission of the Palo Alto Emergency Services Volunteers (ESV) is to: 1) provide supplemental resources to the professional first responders of the City and surrounding communities and 2) facilitate means for neighbors to help neighbors (including business and other entities). Emergency Servic e Volunteers are often times geographically concentrated in some, but not all, neighborhoods.

Examples of Potential Risks (Note):
>Lack of volunteer participation across the City/concentration of volunteers leading to inconsistent emergency response depending on location 3 3 26 Strategic
Operational
Financial
Legal & Compliance
Reputation
Political & Economic
69 Administrative
Services
Tax Revenue 2.08.150 Department of
Administrative Services
FY22 Risk Updates:

In the risk assessment survey, Economy was rated as the seventh highest risk by management.

One of the risk assessment interviewees wants the structure of revenue sources to be looked at.

FY21 Risks:

The City of Palo Alto's largest sources of revenue include property taxes, sales taxes, and transient occupancy taxes. These three main sources of tax revenue. Palo Alto has been a hub for large technology businesses which bring in visitors to hotels, restaurants, and retail. These visitors and daytime population help feed the sales and transient occupancy taxes. Palo Alto property values have also risen over the last few decades, driving an increase in property tax revenue.

Examples of Potential Risks (Note):
>Large businesses moving to other locations or decreasing the focus on in-person interactions at headquarters lowers the daytime population and visitors >Decreasing real estate values due to external factors decreases City revenues from property taxes 3 5 44 Strategic
Financial
Political & Economic
70 Administrative
Services
Asset Management 2.08.150 Department of
Administrative Services
FY22 Risk Updates:

The requirements of GASB 87 (Leases) and GASB 89 (Interest Cost) are effective for the City's fiscal year ending June 30, 2022.

FY21 Risks:

The City manages assets to ensure that all assets are properly accounted for both operationally and financially. Asset management is important to the accounting function as well to ensure that depreciation on all assets is being properly tracked and applied as well as classification of various assets.

Examples of Potential Risks (Note):
>Misclassification of assets, hampering the ability to properly account for depreciation and other accounting requirements >Lack of internal controls in managing and accounting for assets 3 4 36 Operational
Financial

7.a
Packet Pg. 76

32 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
71 Administrative
Services
Investments, Debt,
and Cash
Management

2.08.150 Department of
Administrative Services

2.28.140 Depositories and
Investments
FY22 Risk Updates:

Based on the FY2022 survey and interview, investments is an area where the City may benefit from an internal audit. There is a need to update the City's investment policy to increase flexibility based on the current environment.

FY21 Risks:

Palo Alto manages their investment, debt, and cash portfolio through a single internal investment manager. This investment manager maintains the City's investment portfolio subject to the investment policy, including limits on holdings of various financial products. Maintaining an internal investments manager allows for the City of Palo Alto to avoid commissions/fees.

In addition, the investment manager also performs cash management and cash flow modeling, executes wire transactions, serves as the bank custodian, and performs a daily cash flow reconciliation.

Examples of Potential Risks (Note):
>Financial opportunity cost from an optimized portfolio managed by an outsourced firm >Operational inefficiencies due to lack of economies of scale in comparison to an outsourced firm >Fraud/misuse/abuse risk associated with lacking or failed internal controls in regards to investments >Noncompliance with the investment policy
>Over reliance on one individual to manage City investments 2 5 38 Strategic
Financial
Legal & Compliance
72 Administrative
Services
Accounts
Receivable

2.08.150 Department of
Administrative Services
FY22 Risk Updates:
> There is a lack of communication and transparency with other City Departments. >The department has goals that change frequently which may result in the inability to focus and follow through with any one goal. > The department struggles is attracting and retaining staff. > Public meetings increase pressure on the department to perform.

FY21 Risks:

The Revenue Collection and General Accounting teams manage the City's accounts receivable function. This function ensures that bills are timely, accurate and include adequate information for those who paying the City. Additionally, this function manages what payments ar e expected, any overdue payments, and any necessary collections. Note that this function is not responsible for utility billing.

Examples of Potential Risks (Note):
>Outstanding balances for extended periods of time
>Redirected payments to personal accounts
3 4 36 Operational
Financial
Legal & Compliance
73 Administrative
Services
Credit & Debt 2.08.150 Department of
Administrative Services
Palo Alto's credit rating is currently AAA, the highest rating a municipality can receive. This is due in large part to high fund balances and low debt burdens. Healthy fund balances and low reliance on debt equips the City to face economic hardships or other external factors outside the City's control.

Example of Potential Risks (Note):
>Sustained decreasing revenues may require the City to diminish fund balances and rely more heavily on debt >Operational inefficiencies may result from sustained economic prosperity, leaving the City vulnerable to inefficient uses of debt and fund balances during times of economic hardship
2 4 28 Financial
Reputation
Political & Economic
74 Administrative
Services
General Accounting 2.08.150 Department of
Administrative Services
FY22 Risk Updates:

There is a lack of skills and/or time to implement new accounting pronouncements / GASB's, which may result in being noncompliant with applicable laws.

FY21 Risks:

Palo Alto's accountants ensure that the City has accurate financial information with which to make decisions and to report to the public. The accounting function ensures that the financial statements reflect the true operations and financial state of the City.

Examples of Potential Risks (Note):
>Misstatement on financial statements
>Lack of internal controls to catch accounting errors
3 3 26 Strategy
Operational
Financial
Legal & Compliance
75 Administrative
Services
Budget
Management

2.08.150 Department of
Administrative Services
FY22 Risk Updates:
> There can be challenges with the OMB due to the need for coordination between City Departments and City Leadership to ensure information/requests provided align with the needs of the department to provide services in addition to that fact that various financial systems a re used to maintain the budget. > OMB staff have been tasked with updating policies and procedures when changes occur to keep them current; however, turnover in staff and the decentralization of where policies are stored has caused some documentation to be updated more slowly. > There is a need for a central budgeting tool and specialized budget training.

One of the risk assessment interviewees has a concern about lack of a plan around funding for infrastructure 3 3 26 Operational
Financial

7.a
Packet Pg. 77

33 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
76 Administrative
Services
Accounts Payable 2.08.150 Department of
Administrative Services
FY22 Risk Updates:
> There have been fraud attempts surrounding the wire payments process. Currently, the City is working to establish a formal for this process. > Staffing changes are impacting the department. There is a need to better define staff responsibilities.

FY21 Risks:

The Accounts Payable division handles payment of vendor invoices, p-card transactions, and other payments. The Accounts Payable department issues payments in a number of manners, including ACH and Checks. Accounts Payable is managed in SAP and any paper invoices are inputted into the system.

Examples of Potential Risks (Note):
>Late payment of invoices in the event invoices are not inputted into SAP >Invoices entered into the system with incorrect information, such as dates miskeyed 4 2 24 Financial
Legal & Compliance
77 Administrative
Services
Procurement 2.08.150 Department of
Administrative Services

2.30.040 Centralized Purchasing
FY22 Risk Updates:
> Staffing constraints may prevent the department from meeting its goals and objectives. > Financial constraints may prevent the department from meeting its goals and objectives. > Some of the risk assessment interviewees mentioned the inefficient procurement process. > Procurement/Sourcing was rated 14th highest risk factor (out of 38 risk factors) in the risk assessment

FY21 Risks:

Palo Alto has detailed policies and procedures in place for purchasing and procurement. The process includes internal control s to ensure that the organization is protected against fraud, misuse and abuse in the purchasing process. If any areas within the purchasing process are missing co ntrols, it opens an opportunity for unethical, fraudulent, or erroneous activities. If the purchasing process has too many controls, the City may be missing opportunities for cost savings and operational efficiencies.

Examples of Potential Risks (Note):
>Burdensome internal controls slowing the purchasing process down, discouraging good vendors from bidding on projects >Lack on internal purchasing controls, opening opportunities for fraud, misuse and abuse 4 4 42
Operational
Financial
Legal & Compliance
78 Administrative
Services
Payroll 2.08.150 Department of
Administrative Services
Payroll ensures that all City employees are paid on time and with accuracy. Payroll must ensure that all benefit deductions, taxes, withholdings, and other individual differences in paychecks are proper and included in paychecks. This includes ensuring that any changes to employee statuses are properly reflected in paychecks.

Examples of Potential Risks (Note):
>Lack of audit prior to payroll disbursements leading to errors in paychecks, including over or under payments >Not accounting for updates to qualifying events such as marriage or new children 4 2 24 Operational
Financial
Legal & Compliance
79 Administrative
Services
Grants Management 2.08.150 Department of
Administrative Services
Grants Management include the pursuit of grants, the tracking of outstanding grant decisions, reporting managing any awards and associated reporting and spending deadlines.

The City of Palo Alto does not have a centralized Grant Management Function. Rather, each department pursues grant opportuni ties applicable to a specific program or the department as a whole and manages the grant in accordance with the grant agreement and applicable law.

The Administrative Services Department prepares pertinent financial reports including the Schedule of Expenditures of Federal Awards (SEFA).

Examples of Potential Risks (Note):
>Missed grant reporting deadlines
>Use of grant funding on ineligible expenses
>Missed grant opportunities due to inaction or delays in application writing 3 2 16 Operational
Financial
Legal & Compliance
80 Administrative
Services
Proposition 13 2.08.150 Department of
Administrative Services
Proposition 13, or "The Peoples Amendment to Control Taxation", caps property tax rates according to a percentage of the prop erty value or the Consumer Product Index. This proposition limits the amount that residents can be taxed on their property in the midst of rising property values, while a lso limits the ability for the City to collect revenue at a rate in pace with the Palo Alto real estate market.

Examples of Potential Risks (Note):
>Lost revenue for the City to fund City services with Prop 13 in place >High taxation on residents due to increased property values, especially long term Palo Alto residents, in the absence of Prop 13 1 3 12 Financial
Reputation
Political & Economic

7.a
Packet Pg. 78

34 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
81 Fire Emergency Medical
Service
State of California Senate Bill 201

2.08.180 Fire department.

FY22 Risk Update:

Various changes were noted in responses to the risk assessment survey. - There have been numerous employee reductions
- Redeployed the resources to optimize our response with less personnel (based on predictive analysis with previous years incid ent data and response times).
- Had a higher than normal number of personnel on injury, likely from fatigue related to COVID - The increase in mandatory overtime due to personnel reductions. - The goals identified in the 5 year strategic plan and other work flows were negatively impacted due to COVID responses and reduction in staff and line positions.

FY21 Risks:

The Fire Department operates an ambulance transfer service. The EMS Director oversees equipment, staffing, training, and all other activities associated with this ambulance function.

The City is implementing an Ambulance Subscription Fee Program. The program will be voluntary and proposes to waive the insurance co-pay participants would otherwise be charged when transported to the hospital by ambulance.

Examples of Potential Risks (Note):
>Compliance with EMS Act, including Section 201 and service level requirements >Proper billing and collection of subscription fees
4 4 42 Operational
Financial
Legal & Compliance
Reputation
82 Fire Fire Suppression 2.08.180 Fire department. FY22 Risk Update:

Various changes were noted in responses to the risk assessment survey. - There have been numerous employee reductions
- Redeployed the resources to optimize our response with less personnel (based on predictive analysis with previous years incident data and response times).
- Had a higher than normal number of personnel on injury, likely from fatigue related to COVID - The increase in mandatory overtime due to personnel reductions. - The goals identified in the 5 year strategic plan and other work flows were negatively impacted due to COVID responses and reduction in staf f and line positions.

Other
- A technical rescue over a hillside or a large structure fire can be very technical. - Response time data is regularly reviewed, and an annual update is completed to the accreditation (CFAI - Commission on Fire Accreditation International) that details the performance in relation to the benchmarks established by council. ===
Respond to emergency and non-emergency calls
Palo Alto's Hazardous Materials Team responds to calls involving hazardous materials.

Examples of Potential Risks (Note):
>Inadequate training, and certification
>Improper staffing of firetruck and ambulance units
3 4 36 Operational
Legal & Compliance
83 Fire Fire Prevention -
Palo Alto Foothills &
Wildland Fire Risk

2.08.180 Fire department. FIRE PREVENTION BUREAU
Improve the quality of life for the Palo Alto community through risk assessment, code enforcement, fire investigation, public education, and hazardous materials management.

FY22 Risk Update:
- Current workforce constraints for the City and surrounding communities, as well as larger workforce shortages impact the response time or availability for mutual support.
- Fire department's initiative includes rigorous wildland fire drills and trainings in order to prepare for the increased risk of a longer and more intense California fire season (FY22 Operating Budget)
- One focus of climate adaption is preparation for and protection from wildfires (City of Palo Alto website) - One of the risk assessment interviewees mentioned a wildland fire risk and the effect on the climate. - One of the risk assessment survey respondents wants to see study of staffing and compensation package among similar departments. Another respondent suggests a review of the Self-Assessment Manual and a review of the current training facilities.

FY21 Risks:

The City includes land west of Highway 280, including Foothills Park. This area is served by Fire Station 8. When Fire Station 8 is not staffed, the City is heavily reliant on mutual aid.

Examples of Potential Risks (Note):
>Lack of staffing to respond to emergencies in the Foothills Park area 3 4 36 Operational
Legal & Compliance
Reputation

7.a
Packet Pg. 79

35 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
84 Fire Fire/EMS Training 2.08.180 Fire department. EMPLOYEE FIRE/EMS CERTIFICATION TRAINING Provide training to certify that staff maintain safe, efficient, and effective practices when responding to emergencies. Ensure personnel are familiar with and able to utilize the most up-to-date and proven techniques. Training specific to required EMT and/or Paramedic re-certification is also incorporated.

FY22 Risk Update:

Current workforce constraints for the City and larger shortage of EMT/EMS workers impacts the ability for the City to hire an d/or train employees for proper staffing of EMT's.

FY21 Risks:

The majority of City of Palo Alto Firefighters are also certified as either EMT's or Paramedics. Palo Alto offers training for firefighters to be certified as EMT's. Paramedics and EMT's both respond to medical/rescue and fire calls. Paramedics are trained to perform additional medical services that EMT's are not certified to perform, including; starting IV's, administering medication and beginning intubation.

According to NFPA safety standards and best practices, two paramedics and two EMT or BLS trained individuals should be on scene for every event.

Examples of Potential Risks (Note):
>Inadequate training facilities and staff training and certification 2 3 18 Operational
Legal & Compliance
Reputation
85 Human
Resources
High Cost Claims 2.08.160 Department of human
resources.

Managing high-cost claimants, including individuals suspected of "gaming the system" is critical for controlling benefits costs. Staffing m odels should plan for high-cost scenarios such as employees with chronic illnesses and sick leave abuse. High cost claims include both expensive chronic medical conditions and acute conditions. Major cost drivers include:
>Cardiovascular disease
>Pulmonary conditions
>Neurological conditions
Examples of Potential Risks (Note):
>Public safety employees may place a significant financial burden on the City given the dangerous nature of the role 4 4 42
Financial
Legal & Compliance
86 Human
Resources
Workload 2.08.160 Department of human
resources.

Due to departmental workload, there is a risk of employees may experience the below.

Examples of Potential Risks (Note):
> Lower morale
> Employee health (e.g. physical, mental and emotional) > Poor communication
> Human error
4 4 42 Human Capital
Management
87 Human
Resources
Staffing Levels 2.08.160 Department of human
resources.

FY22 Risk Updates:

The HR department experiences some technology issues that prevent the department from meeting its goals and objectives. The C ity is still at risk for losing HR professionals.

FY21 Risks:

Multiple departments within the City expressed challenges with staffing levels. Hiring limitations in response to COVID-19 worsened these existing challenges.

Example of Potential Risk:
>Relying on unqualified employees to perform critical tasks due to an unfilled vacancy >Non-compliance with state and federal laws due to capacity limitations >Reductions in service quality due to capacity limitations 4 3 34 Operational
Legal & Compliance
88 Human
Resources
Employee
Separation and
Offboarding
The City adheres to a detailed offboarding process including a formalized employee termination checklist. Departmental management, Human Resources, and IT coordinate to gather necessary paperwork, update IT permissions and access rights, discuss knowledge transfer, schedule and conduct an exit interview, and recover city-owned assets. This process is not supported in SAP. Instead, it involves multiple workflows and manual communications.

Example of Potential Risks (Note):
>Payroll fraud
>Compliance with relevant laws and regulations regarding employee separation >On-going, improper physical access or business/information systems 3 3 26 Strategic
Operational
Financial
Legal & Compliance
Reputation

7.a
Packet Pg. 80

36 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
89 Human
Resources
Hiring 2.08.160 Department of human
resources.

FY22 Risk Updates:

City Council Staff Report #11973 meeting date 3/15/2021 - Finding and recommendation for fire departments in Santa Clara County: Increase the recruitment and hiring of more female firefighters
Lack of diversity in Fire or Police departments were noted in the survey response and one of interviews we conducted. It was noted that the actions are being taken to correct the issue.

FY21 Risks:

The Human Resources Department oversees the hiring process. The hiring process starts with departments submitting a requisition to fill a vacancy.

Upon receipt of approval from the Budget Office, Human Resources goes through a planning process with the department to ident ify urgency, develop a timeline, and agree on a process. Most positions are governed by merit rule and require public posting. At this stage, the Ci ty details position requirements including whether exams are necessary.

Human Resources completes an initial review to eliminate candidates that fail to meet minimum requirements. Screening processes (i.e. phone, paper- based) differ depending on the position. Interview processes are structured and questions require sign-off from Human Resources. Human Resources works with departments to conduct a job analysis and author interview questions tied to job duties. To score interviews, the City uses a scoring matrix.

Human Resources has plans to promote diversity, for example, blind resume reviews. To address issues related to diversity, the City focuses on job outreach to encourage a diverse candidate pools.

Examples of Potential Risk:
>Hiring of unqualified individuals
>Employing an individual that should be ineligible for employment >Litigation due to an illegal interview question
>Implicit bias in the hiring process
3 3 26 Operational
Legal & Compliance
Reputation
90 Human
Resources
Records
Management

2.08.160 Department of human
resources.

CA Labor Code Section 226 -
Record Keeping Requirements
Human Resources lacks a centralized repository for employee records. As a result, tracking employee data is oftentimes cumbersome. Within the past three years, Human Resources started converting files in an effort to go paperless. Due to issues with the vendor partner, the department has been unable to complete this transition. Completing this transition would enhance the department's ability to store, retrieve, and archive information.

In addition, it is unclear whether the department has policy language detailing proper handling of personal identifiable information (PII). This topic is covered through annual trainings.

Examples of Potential Risks (Note):
>Failure to establish clear record keeping guidelines increases the likelihood the City will be noncompliant with state and federal record keeping requirements such as USCIS, the EEOC, and numerous federal employment acts (such as ERISA, ADA, FMLA and OSHA) >Increased difficulty responding to various legal actions and unemployment claims 3 3 26
Legal & Compliance
91 Human
Resources
Succession
Planning

2.08.160 Department of human
resources.

FY22 Risk Updates:

Succession Planning is noted as a risk

FY21 Risks:

The City used to conduct "people-focused" succession planning exercises and is considering a transition to a more "skill-focused" approach. This process may include:
>Determining current and short-term departmental needs
>Compiling critical skillsets
>Analyzing the current in-house talent pool
>Assessing risk of turnover for critical positions

Examples of Potential Risks (Note):
>Successors may lack readiness
>Loss of institutional knowledge
>Costs associated with recruiting a replacement
3 3 26 Strategic
92 Human
Resources
Systems and
Technology

2.08.160 Department of human
resources.

FY22 Risk Updates:
1) Changes in compliance related to COVID-19 workplace regulations. 2) Vacancies in HR due to turnover.
3) The City has not yet acquired a centralized Human Resources Information System (HRIS). i.e., HRIS is not fully utilized Noted as a risk area by a risk assessment interviewee

FY21 Risks:

The City does not have a centralized HRIS. Instead, Human Resources relies on multiple systems and software, especially the f inance system powered by SAP. Due to system limitations, Human Resources is required to conduct critical processes manually. These processes include adjusting hazard pay and bilingual worker pay. In addition, Human Resources experiences challenges coordinating with the pension system and making salary adjustments when certain employee types are promoted.

Example of Potential Risks (Note):
>Human error due to manual processes
>Inaccurate calculation of employee compensation and pension balance 3 3 26 Operational

7.a
Packet Pg. 81

37 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
93 Human
Resources
Class and Comp 2.08.160 Department of human
resources.

Due to COVID-19, cost of living increases (COLA) and merit-based increases are frozen for non-union, management-level employees. For unionized employees, the City has contractual obligations to adhere to agreed upon pay structures and step advancements.

In the case of union employees, classification and compensation are determined through market analysis based on agreed upon comparable firms. In some instances, agreeing upon these comparable firms has been an obstacle.

Examples of Potential Risks (Note):
>Choosing an inappropriate market sample may result in an noncompetitive salary ranges >Noncompetitive salary ranges on the high end may result in an increased financial burden on the City >Noncompetitive salary ranges on the low end may result in difficulties with recruitment and retention 3 3 26 Operational

94 Human
Resources
Standard Operating
Procedures

2.08.160 Department of human
resources.

FY22 Risk Updates:

A flow chart of hiring process was presented to Council meeting.

There is a restrictive merit fuels and policy was noted as a weakness in the risk assessment survey Need a study of remote positions which affect recruitment and retention as many people prefer remote positions Safety is a concern of HR department especially during COVID-19 pandemic since the City does not have a Safety Officer

FY21 Risks:

Formalized SOPs are a critical tool as they communicate the correct way of carrying out HR activities. SOPs help the organiza tion operate efficiently, maintain consistency, and communicate clearly. Based on interviews, it is unclear whether SOPs cover all critical processes and are updated.

Examples of Potential Risks (Note):
>A lack of standard operating procedures detailing appropriate HR practices >A lack of standard operating procedures may result in loss of institutional knowledge if an employee leaves the organization >A lack of standard operating procedures related to employee safety may result in preventable injury claims 2 3 18 Strategic
Operational
Financial
Legal & Compliance
95 Human
Resources
Contract Employees State of California Assembly Bill
(AB) 5
State of California Assembly Bill (AB) 5 requires the application of the "ABC test" to determine if workers in California are employees or independent contractors. Under the ABC test, a worker is considered an employee and not an independent contractor, unless the hiring entity satisfies all three of the following conditions:

1. The worker is free from the control and direction of the hiring entity in connection with the performance of the work, both under the contract for the performance of the work and in fact;

2. The worker performs work that is outside the usual course of the hiring entity’s business; and 3 . The worker is customarily engaged in an independently established trade, occupation, or business of the same nature as that involved in the work performed

Some City departments rely on third-party contractors to deliver services. For example, Community Services relies on third-party contractors to manage the golf course, deliver recreational services (i.e. swimming pool, athletic fields) and provide arts and theatre programs. The City uses a variety of methods to mitigate risk in this area including management-level trainings led by the City Attorney and detailed reviews by Procurement. The City relies on a variety of "flags" such as previous employees trying to work as contractors. In these cases, the City can share the contract with CalPERS for review.

Examples of Potential Risks (Note):
>Litigation against the City for improper employment practices 3 2 16 Strategic
Operational
Financial
Legal & Compliance
96 Human
Resources
Onboarding
Employee Set-up

2.08.160 Department of human
resources.

The City relies on NEOGOV HR Software to assist with the onboarding process and Check to assist with the background check pro cess. Before the implementation of the NEOGOV onboarding module, the onboarding process was more paper-based. Once an employee is selected for hiring, their information is transferred from the applicant tracking system to the onboarding system.

The City leverages the onboarding tool to ensure candidates receive benefits, payroll, and tax documents along with critical policies and procedures. The NEOGOV system allows the City to share paperwork with new employees before their first day and eliminate the step of creating applicant packets.

Human Resources oversees a two-day onboarding training with new employees. In the past, the City conducted this training monthly thus allowing for a natural cohort structure. Employees would receive a tour, meet key employees, meet their union representative, and attend a variety of trainings reviewing policies and other key information. Since COVID-19, the City has shifted to an on demand hiring approach instead of the cohort model.

Examples of Potential Risk:
>New hires do not understand critical policies and procedures >New hires do not gain access to important employment documents in a timely manner 3 2 16 Strategic
Operational
Legal & Compliance
97 Human
Resources
Performance
Management

2.08.160 Department of human
resources.

The performance management process is predominantly manual. The City has not transitioned to an automated process that would assist with critical steps such as notifying supervisors and employees about upcoming evaluation deadlines.

Performance evaluations for non-union, management employees is less structured and involves greater discretion to determine merit based increases.

Departments conduct these reviews on the anniversary of the employee’s first day to determine if an employee moves to the next step.

Examples of Potential Risks (Note):
>Failure to eliminate unconscious bias from the performance appraisal process may increase the risk of litigation against the City based on the Lilly Ledbetter Act (2009) and/or the State of California Fair Pay Act (2016) >Failure to accurately track and recognize employee performance may lead to reduced engagement, especially among high -performers >Failure to recognize employee performance may result in unwanted turnover of high-performers 3 2 16 Strategic
Operational
Financial
Legal & Compliance
Reputation
Political & Economic
IT

7.a
Packet Pg. 82

38 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
98 Information
Technology
Disaster Recovery
Preparedness and
Testing

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was High in the internal audit report, IT Risk Management Report Noted as a risk area by a risk assessment interviewee

FY21 Risks:

This area focuses on the IT department’s preparations and testing for disaster recovery (DR). In-scope activities include the following:
• Disaster recovery strategy and alignment with the organization’s business continuity plans • Disaster recovery plan preparation
• Disaster recovery testing

Examples of Potential Risks (Note):
> Inability to establish a formal disaster recovery team that has the authority to declare a disaster and does not have defined roles during an event may result in financial penalties for service level misses
> Inadequate disaster recovery preparedness may result in a disruption of essential process and service delivery thus preventing business continuity > Lack of restoration testing may result in false assurance that your organization has functional backups to restore operatio ns in the event of an emergency
3 5 44 Strategic
Operational
Reputational
IT
99 Information
Technology
Host Intrusion and
Malware Defense

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was High in the internal audit report, IT Risk Management Report One of the risk assessment interviewees is interested in understanding the risk the City faces in comparison with the risks others face

FY21 Risks:

This area focuses on the IT department’s practices for protecting network connected computers, telephones, printers and infra structure hardware devices from intrusive activity and malicious software exploitation. In-scope activities include the following:
• Intrusion detection and prevention deployment, operation, and monitoring • Malware defense deployment, operation (e.g., signature updating), and monitoring for hosts and applications (e.g., spam email)

Examples of Potential Risks (Note):
> Loss of system/application availability and integrity > Possible data breach and hijacking (ransomware) of organization data > Lack of intrusion detection and protection controls may result in the untimely identification of an attack 3 5 44 Strategic
Operational
Financial
Legal & Compliance
Reputational
IT
100 Information
Technology
Problem
Management and
Incident Response

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was High in the internal audit report, IT Risk Management Report

FY21 Risks:

This area focuses on the IT department’s practices for managing problems and incidents. In scope are the following activities:
• The method(s) by which IT problems are reported and resolved • Problem tracking, reporting and communication
• Incident response preparation and response testing
• Incident identification, triaging, containment, eradication and recovery

Examples of Potential Risks (Note):
>Loss of IT asset confidentiality, integrity and availability >Inability to properly identify the root cause of an incident thus preventing the ability to implement the appropriate corrective controls to reduce the risk a future incidents
3 5 44 Strategic
Operational
Reputational
IT
101 Information
Technology
Mobile Device
Management

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was Medium in the internal audit report, IT Risk Management Report Noted as a risk area by a risk assessment interviewee

FY21 Risks:

This area focuses on the IT department’s management of mobile devices. In-scope activities include the following:
>Authorization to use mobile devices
>Mobile device provisioning, monitoring, support and de-provisioning >Mobile device incident response

Examples of Potential Risks (Note):
>Unauthorized device access due to compromised security PINs >Unauthorized access by installed mobile applications to stored email, text messages, media and data >Unauthorized user access to stored email, text messages, media and data as well as network applications via VPN >Lack of mobile device monitoring may result in the untimely identification of an incident 5 3 40 Operational
IT

7.a
Packet Pg. 83

39 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
102 Information
Technology
Strategy and
Governance

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was High in the internal audit report, IT Risk Management Report Noted as a risk area by a risk assessment interviewee

FY21 Risks:

This area focuses on IT strategy and governance practices. In-scope activities include the following:
• Development, maintenance and approval of an IT strategic plan that is aligned with the organization's business strategy • Development and execution of tactical IT plans that are aligned to the IT strategy • Development, maintenance and approval of an IT operating budget • Recurring performance and risk reporting to Executive Management and the Board of Directors • Oversight of IT operation and resource consumption by Executive Management and the Board of Directors

Examples of Potential Risks (Note):
>Executive management and the Board of Directors are unaware of IT risks and their severity >IT service delivery is misaligned with the organization and/or over-spends and under-delivers 5 3 40 Strategic
Operational,
Reputational
IT
103 Information
Technology
Information Security 2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was Medium in the internal audit report, IT Risk Management Report Noted as a risk area by a risk assessment interviewee

FY21 Risks:

This area focuses on the IT department’s practice of information security.

Information security programs are developed to protect an organization’s information systems and information from plausible t hreats and vulnerability exploitation that could result in one or more losses of security: confidentiality, integrity, availability, authenticity and/or non-repudiation.

Programs should address the following:
• Policy development and enforcement
• Identity and access management
• Threat identification and management
• Vulnerability identification and management
• Security roles and responsibilities
• Security training and awareness for IT and non-IT personnel

Examples of Potential Risks (Note):
> Increased probability that the systems and data within the systems are not adequately protected from technical and malicious threats. > Lack of security awareness training may result in internal employees exposing the organization to security threats. > Lack of vulnerability monitoring may result in untimely threat identification and a lag in response time 2 5 38 Strategic
Operational
Financial
Legal & Compliance
Reputational
IT
104 Information
Technology
Operations and
Monitoring

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was Medium in the internal audit report, IT Risk Management Report

FY21 Risks:

This area focuses on the IT department’s practices for operating, monitoring and maintaining the computer systems and support ing infrastructure that are used by the work staff. In-scope activities include the following:
>Capacity management
> Hardware and software maintenance

Examples of Potential Risks (Note):
>Increased costs due to insufficient planning and forecasting >Disruption of business processes and service delivery
>Financial penalties for service level misses
2 5 38 Operational
IT
105 Information
Technology
Physical and
Environmental
Controls

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was Medium in the internal audit report, IT Risk Management Report

FY21 Risks:

This area focuses on IT physical and environmental safeguards that are deployed to protect the organization’s application sys tems and information. In scope activities include the following:
• Deployment and monitoring of physical access controls that protect IT assets • Deployment and monitoring of environmental controls that protect IT assets

Examples of Potential Risks (Note):
>Inappropriate or unauthorized physical access to data centers, server rooms, wiring closets, or facilities containing end-user IT hardware >Inappropriate or unauthorized physical access to IT hardware >IT hardware and/or infrastructure loss due to poor environmental controls 2 5 38 Strategic
Operational
Legal & Compliance
IT

7.a
Packet Pg. 84

40 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
106 Information
Technology
Asset Management 2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was Medium in the internal audit report, IT Risk Management Report

FY21 Risks:

This area focuses on the IT department’s asset management practices. In-scope activities include the following:
• Tracking information technology assets from procurement through disposal. • Reusing and decommissioning information technology assets • Ensuring information technology assets have an assigned owner, who is a stakeholder in the asset’s protection • Ensuring information technology assets are properly maintained to maximize their useful life • Tracking software usage and ensuring that vendors’ software license agreements are followed

Examples of Potential Risks (Note):
> Inadequate security management of untracked IT assets > Lack of asset longevity and usefulness of assets
> Data loss due to unsecured assets
3 3 26 Strategic
Operational
Financial
IT
107 Information
Technology
Compliance
Management

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was Medium in the internal audit report, IT Risk Management Report

FY21 Risks:

This area focuses on the IT department’s practices for complying with IT-related contract requirements, governmental regulations (e.g., HIPAA Security Rule) and industry standards (e.g., PCI Data Security Standard).

In-scope are the following activities:
• Compliance program development and maintenance
• Compliance program monitoring and reporting

Examples of Potential Risks (Note):
> Poor compliance management practices may result in regulatory fines and oversight stemming from non-compliance. > Inability to management compliance requirements may result in increased operating expenses (e.g., payment card transaction costs). > Legal costs and ramifications that damage reputation and hinder business operations 3 3 26 Legal & Compliance
IT
108 Information
Technology
Procurement and
Service Provider
Management

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was Medium in the internal audit report, IT Risk Management Report Noted as a risk area by a risk assessment interviewee

FY21 Risks:

This area focuses on the IT department’s practices for procuring hardware, soft-ware, facilities and services as well as managing the contracted service providers. In scope are the following activities:
>Procurement strategy
> Vendor and service provider due diligence and performance monitoring

Examples of Potential Risks (Note):
>Insufficient oversight of procurement strategy and methods could result in the failure to optimize the cost and effectiveness of IT asset and service purchases
>Insufficient oversight of service provider contract performance could result in the non-timely detection of product/service delivery problems >Insufficient oversight of service provider activity and security controls could cause security problems including a data breach 3 3 26 Strategic
Operational
Financial
Legal & Compliance
Reputational
IT
109 Information
Technology
Risk Management 2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was Medium in the internal audit report, IT Risk Management Report

FY21 Risks:

This area focuses on the IT department’s risk management practices. In-scope activities include IT risk identification, triaging, treatment, tracking and management reporting.

Examples of Potential Risks (Note):
>Reputational damage
>Monetary loss and penalties
>Inadequate risk identification may lead to unmitigated threats to the organization 3 3 26 Strategic
Operational
Reputational
IT
110 Information
Technology
Application
Management

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was Medium in the internal audit report, IT Risk Management Report

FY21 Risks:

This area focuses on the management of the organization's business applications – how they are developed, procured, modified and managed as well as how application security is performed and the role of the IT department in managing an application.

Examples of Potential Risks (Note):
> Inability to implement application changes and provide application support in a timely manner due to critical staff shortage or turn-over > Disruption of core business functions due to application downtime > Shared or generically named and/or shared among a group of users, the lack of accountability may result in inappropriate activity 2 3 18 Operational
IT

7.a
Packet Pg. 85

41 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
111 Information
Technology
Architecture and
Deployment

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was Medium in the internal audit report, IT Risk Management Report

FY21 Risks:

This area focuses on the architecture and deployment of organization’s information technology. In-scope elements include:
• The network architecture and deployed technology that is used to provide intra-site, inter-site connectivity and Internet connectivity • The organization’s server and storage infrastructure
• The computer hardware that is deployed for end-users

Examples of Potential Risks (Note):
> Poor or unreliable IT service delivery that may result in customer dissatisfaction 2 3 18 Strategic
Operational
IT
112 Information
Technology
Change
Management

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was Medium in the internal audit report, IT Risk Management Report

FY21 Risks:

This area focuses on the IT department’s practices for controlling changes to the IT environment. In-scope activities include the following:
• Management of infrastructure hardware, software and configuration changes • Management of host system software and configuration changes • Management of normal and emergency changes
• Application release management
• Delineation of the activities that are controlled by change management versus help desk request ticketing

Examples of Potential Risks (Note):
> Inappropriate, unauthorized, under-planned and/or under-tested system changes may be implemented that negatively impact agency operations and/or reputation
> Lack of managements approval prior to moving changes into production may result in disruptions in business operations. > Lack of a formal documented change management process may result in the inconsistent application of changes. > Lack of segregation of duties between environments related to development, testing and production can result in inappropriate changes that may disrupt operations
2 3 18 Strategic
Operational
IT
113 Information
Technology
Database and Data
Management

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was Medium in the internal audit report, IT Risk Management Report Noted as a risk area by risk assessment interviewees

FY21 Risks:

This area focuses on the IT department’s practices for controlling changes to the IT environment. In-scope activities include the following:
• Management of infrastructure hardware, software and configuration changes • Management of host system software and configuration changes • Management of normal and emergency changes
• Application release management
• Delineation of the activities that are controlled by change management versus help desk request ticketing

Examples of Potential Risks (Note):
> Inappropriate, unauthorized, under-planned and/or under-tested system changes may be implemented that negatively impact agency operations and/or reputation
> Lack of managements approval prior to moving changes into production may result in disruptions in business operations. > Lack of a formal documented change management process may result in the inconsistent application of changes. > Lack of segregation of duties between environments related to development, testing and production can result in inappropriate changes that may disrupt operations
2 3 18 Operational
IT
114 Information
Technology
Organizational
Architecture

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was Medium in the internal audit report, IT Risk Management Report Noted as a risk area by a risk assessment interviewee

FY21 Risks:

This area focuses on the organization of the IT department, its placement within the organization and its approach to staffin g.

Examples of Potential Risks (Note):
>A decentralized IT Department may result in inefficient operations by resulting in shadow IT. >Unaligned organizational structure may result in inefficient service delivery resulting in increased operating costs and potential service disruption >Lack of cross-training to backfill critical job roles and tasks may result in inadequate staffing >Lack of professional development for staff may result in the inability to recruit and retain qualified talent 2 3 18 Strategic
Operational
IT

7.a
Packet Pg. 86

42 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
115 Information
Technology
Project
Management

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was Low in the internal audit report, IT Risk Management Report

FY21 Risks:

This area focuses on the IT department’s project management practices. In-scope activities include:
>Initiating, planning, executing, controlling, and closing projects >Managing projects’ scope, milestones, quality and budget >Ensuring projects are adequately staffed
>Reporting project progress and issues on a recurring basis to management and stakeholders

Examples of Potential Risks (Note):
>Poor project deliverable quality
>Project cost overruns and late project completion
>Inadequate project management may lead to fines due to unmet project milestones or non-compliance 2 2 10 Operational
IT
116 Information
Technology
End-User Support
and Perceptions

2.08.240 Department of
information technology.

FY22 Risk Updates:

Risk rating for this risk area was Medium in the internal audit report, IT Risk Management Report

FY21 Risks:

This area focuses on the IT department’s scope and approach for providing end-user support as well as the perceptions that end-users have regarding IT service delivery. In-scope activities include the following:
• End-user request intake
• Help Desk triaging of end-user requests and problems
• Help Desk request tracking and reporting
• End-user notification of request handling progress and completion • Requesting and receiving end-user feedback on completed or abandoned service requests

Examples of Potential Risks (Note):
> Loss of end-user sponsorship and partnership in IT initiatives > Inefficient help desk processes related to request in-take, triaging, tracking and reporting may result in end-user dissatisfaction 3 1 8 Operational
Reputational
IT
117 Information
Technology
Ransomware 2.08.240 Department of
information technology.

FY22 Risk Updates:

Noted as a risk area by a risk assessment interviewee

FY21 Risks:

Governments are subject to cybersecurity threats, including but not limited to hacking, malware, ransomware. These crimes are becoming more common and costly for local governments to detect and deter.

Examples of Potential Risk:
>Financial loss as a result of a cyber attacker demanding a monetary payment in exchange organization data. >Service delivery disruption as a result of organizational data being held ransom thus preventing employee assess to essential d ata. 2 5 38 Reputational
IT
118 Information
Technology
Business Continuity
Plan (BCP) and
Disaster Recovery
Plan (DRP)

2.08.240 Department of
information technology.

FY22 Risk Updates:

Reference notes under "Disaster Recovery Preparedness and Testing"

FY21 Risks:

As a best practice, the City can benefit from a BCP which includes a DRP that is communicated to all staff. There is a lack of awareness across several functions on whether or not the City has a formal BCP and DRP. Failure to establish a plan leaves the potential for an interruption in services and the inability for all parties to know their roles, responsibilities and sequence of operations in the instance of an identified disasters.

Examples of Potential Risks (Note):
>Less effective and timely recovery from disaster events resulting in increased disruption of business operations or service delivery, increased expenditures for system recovery and potentially reputational damage 2 4 28 Strategic
Financial
IT
119 Information
Technology
IT Roadmap 2.08.240 Department of
information technology.

FY22 Risk Updates:
• The City's three-year IT strategy is ending in 2021. Also, reference "Strategy and Governance"

FY21 Risks:

As a best practice, an IT Department's 1-3 year strategic roadmap is recommended to specifically align with the City's strategic goals. Failure to implement a documented roadmap may result in an insufficient use of limited resources and the inability of the department to support the overall b usiness operations of the City. This can reveal itself when operations tend to be more reactive in nature. Proactive measures such as a roadmap will support alignment of network security, replacing aging application with new systems, hardware and software and technical items with t he business goals of the City.

Examples of Potential Risks (Note):
>Absence of a formal IT Capital Plan approach has limited the transparency into the IT Capital Plan budget and misses the opportunity to facilitate a cohesive, City-wide IT investment strategy
2 3 18 Strategic
Legal & Compliance
Reputational
IT

7.a
Packet Pg. 87

43 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
120 Library Events 2.08.230 Department of libraries. Throughout the year, the library hosts many events, holiday parties and seminars. These events are interactive, often involvi ng food, music and performances. Events are hosted by the library in conjunction with external non-profits, community agencies, faith-based organizations and individual persons and groups. The library also works with internal departments such as Police and Fire to host events. Events are desig ned to be educational and to help engage the community.

Examples of Potential Risks (Note):
>Health and safety for gatherings of large groups of individuals >Culturally insensitive events
1 3 12 Strategic
Legal & Compliance
Reputation
121 Library Inventory
Management

2.08.230 Department of libraries. The largest business of the library involves the management of the book inventory (check-in and check-out). An inherent risk to lending is the ability to recoup and collect items loaned. The City does not charge late fees for book rentals but does impose fines and fees for replacement of books that are 42 days late. Laptop's and other library collection items are subject to late fees and replacement costs.

Examples of Potential Risks (Note):
>Book return process and inventory management
3 2 16 Financial
122 Library Library Programs 2.08.230 Department of libraries. Palo Alto's library offers hundreds of adult, children and family programs and services. These programs and services are open to any member of the community or library card holder. These programs include; >Book Clubs
>ESL Classes
>Writers workshops and contests
>Arts and Crafts
>Story Times

Library offered programs are services are traditionally in person and virtual. Programs may require pre-registration, while others are readily available online, to be used at any time.

Examples of Potential Risks (Note):
>Program demand
1 3 12 Strategic
Financial
Legal & Compliance
Reputation
123 Library Privacy 2.08.230 Department of libraries. Privacy is a concern for both the City and its citizens. Holding and storing of personal information safely, even for minimal periods of time, is essential.

The library collects personal information from residents when evaluating citizens requests for a library card, no information is retained by any of the City's libraries.

Examples of Potential Risks (Note):
>Users do not log off when using the library computers//hardware >Private information regarding uses of libraries and its services is stored improperly 3 1 8 Legal & Compliance
Reputation
IT
124 Library Locations
Management

2.08.230 Department of libraries. FY22 Risk Updates:

The Libraries organizational structure was reorganized and diminished during previous rounds of budgeting. Limited staff has increased workload on existing staff without changes in technology for inventory management.

FY21 Risks:

Palo Alto has 5 library branches spaced throughout the City. Each library has unique services and function and is situated near other City services. The placement and special function of each library is to best serve the local community surrounding the library.

Individuals are able to use any library and may request books from another library be transferred to their chosen community library for reservation and check-out. Additionally, books may be returned to any library or book-drop, regardless of where the book was originally checked-out.

Examples of Potential Risks (Note):
>Internal management of book returns and logistics is inefficient, and books are temporarily or permanently lost >Balance of staff and service offerings
3 1 8 Strategic
Operational
Financial
Reputational
125 Planning and
Development
Services
Long Range
Planning

2.08.220 Department of planning
and development services

Chapter 16.65

CITYWIDE AFFORDABLE

HOUSING REQUIREMENTS

Chapter 19.04

PLANNING COMMISSION
FY22 Risk Updates:
• Uncertainty of aging population
• Workforce constraints
• Economic uncertainty
• Inflation
• State mandated initiatives and/or funding requirements FY21 Risks:

The Long Range Planning division within the Department of Planning & Development Services guides and develops visioning and i mplementation programs for the City's community development policies and programs.

Division areas of focus include:
>Affordable housing
>Housing planning and policies
>Land Use and zoning
>Weatherization
>Comprehensive Planning
>Community Block Grants
Examples of Potential Risks (Note):
>Unforeseen changes in economic or political conditions leading to required changes and inability to forecast future circumstances 5 4 46 Strategic
Operational
Financial
Legal & Compliance
Reputation
Political & Economic

7.a
Packet Pg. 88

44 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
126 Planning and
Development
Services
Current Planning 2.08.220 Department of planning
and development services
FY22 Risk Updates:
• Internal audit review of permitting processes, specific to solar panels • Updated ERP syst6em for tracking permitting, and payments FY21 Risks:

For anyone desiring to build in Palo Alto, they will first need to receive a building permit. The planning function will provide building permits based on the function's broader Comprehensive Plan 2030, compliance with the California Environmental Quality Act (CEQA), Plan Review (a fully outsourced service) and other codes and regulations. There is also an Architecture Review Board that consults on the decision for new proposals. All of these fact ors are considered when making decisions regarding proposals and requests.

Examples of Potential Risks (Note):
>Disagreement amount interpretation of current codes and regulations increasing the amount of discretion necessary in decisio n making >High quantities of new building proposals required for review, putting pressure on existing staff and lowering overall qu ality 4 3 34 Strategic
Operational
Financial
Legal & Compliance
Reputation
127 Planning and
Development
Services
Development
Services

2.08.220 Department of planning
and development services
FY22 Risk Updates:
• Internal audit review of permitting processes, specific to solar panels • Updated ERP syst6em for tracking permitting, and payments

FY21 Risks:

Development Services includes the Development Center, Plan Review Services, and the Inspection program. Permits are filed in person at City Hall or through the new Online Permit Services System. Permits and inspections are mandated before construction and/or remodeling for a variety of projects.

Examples of Potential Risks (Note):
>Individuals and businesses do not request permits or inspections before initiating projects >Delays or backlogs in providing permitting and inspection services 3 3 26
Operational
Financial
Legal & Compliance
Reputation
128 Planning and
Development
Services
Code Enforcement 2.08.220 Department of planning
and development services
The Code Enforcement Division of the Department of Planning & Development Services is responsible for enforcement of property maintenance, zoning, and building codes throughout Palo Alto.

Examples of Potential Risks (Note):
>High volume of development and/or renovations without adequate capacity to enforce all codes >Inability to respond to all complaints made by community members 3 2 16 Operational
Legal & Compliance
Reputation
129 Planning and
Development
Services
Building Division 2.08.220 Department of planning
and development services
The City of Palo Alto Building Division serves as a resource for homeowners, businesses, designers and contractors. The goal is to help customers build safe, healthy and sustainable buildings that comply with applicable codes and regulations.

Examples of Potential Risks (Note):
>Volume of requests due to high demand for new builds and renovation, leading to lower quality of advice or inability to answer all incoming questions 3 2 16 Operational
Legal & Compliance
Reputation
130 Planning and
Development
Services
Historic
Preservation

2.08.220 Department of planning
and development services

18.12.140 Historical Review and
Incentives

18.10.130 Historical Review and
Incentives
The City of Palo Alto looks to preserve and protect its culturally, historically and architecturally significant places in order to create a vibrant and sustainable community that fully reflects Palo Alto’s diverse past. The City of Palo Alto’s Historic Preservation Program began in 1979 and currently boasts four National Register Districts and hundreds of individually significant resources.

Examples of Potential Risks (Note):
>Cultural significance of historic homes and architecturally significant places increases reputational risk related to preservation >Process efficiency and customer service
1 2 6
Financial
Legal & Compliance
Reputation
Political & Economic
131 Police Use of Force and
Officer Conduct

2.08.170 Police department. The Independent Police Auditor has the authority to review and assess for objectivity, thoroughness, and appropriateness of d isposition citizen complaint investigations of misconduct and internal affairs investigations associated with the Police Department and makes recommendations to the Police Chief.

Loss of trust in law enforcement is a common externality. Research shows that perceived legitimacy of law enforcement is crit ical to effective law enforcement.

High profile officer-involved interactions carry with them a variety of risks.

Examples of Potential Risks (Note):
>Litigation due to perceived or actual misconduct may result in legal action and expensive settlements >Reputational harm from improper use of force
2 5 38 Operational
Financial
Reputation

7.a
Packet Pg. 89

45 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
132 Police Staffing Levels 2.08.170 Police department.

FY22 Risk Updates:

In the survey, an audit of hiring, recruiting, and retention was recommended.

Some interviewees noted lack of diversity, which they are currently trying to address.

FY21 Risks:

As of November 2020, nine employees are eligible for retirement and the City recently offered a retirement incentive. In addi tion, PD is also experiencing attrition among line-level officers, some of whom make lateral moves to work in other communities. Due to hiring constraints, turnover typically results in prolonged position vacancies.

Examples of Potential Risks (Note):
>Costs associated with position vacancy including lost productivity, overtime paid to officers, and training costs 3 3 26 Strategic
Operational
Financial
Legal & Compliance
Reputation
Political & Economic
IT
133 Police Overtime 2.08.170 Police department. FY22 Risk Updates:

Staffing shortages for police officers and first responders are common across the State and within the City. Additionally, public pressure to not grow police forces, and the retirement of City Officers.

FY21 Risks:

Unpaid overtime claims are the largest category of complaints filed under California's wage and hours laws. Palo Alto police officers frequently work overtime. A common issue is having step based officers working dispatch during times of need.

Examples of Potential Risks (Note):
>Increased stress and fatigue among officers
>Increased financial burden on the City as officers are paid at a higher rate 4 2 24 Strategic
Operational
Financial
Legal & Compliance
Reputation
Political & Economic
IT
134 Police Records
Management

2.08.170 Police department. Law enforcement records management systems are a valuable source of information essential to the investigative, arrest, and j udicial processes. Failure to manage records can affect the successful prosecution of criminal violators, resulting in liability or loss of public confidence.

The City of Palo Alto Police Department relies on Sun Ridge Systems, Inc. to manage its police records.

Examples of Potential Risks (Note):
>Mismanagement of records, resulting in non-compliance from federal and/or State standards >Insufficient record retainage for important, highly visible cases 2 3 18 Strategic
Operational
Financial
Legal & Compliance
Reputation
Political & Economic
IT
135 Police Dispatch 2.08.170 Police department. The City of Palo Alto uses the dispatch function within the Police Department in order to dispatch for multiple functions, in cluding police calls, Stanford matters, utilities, fire, and others. This dispatching service provides a conduit from citizens to City public safety and emergency services.

Examples of Potential Risks (Note):
>Mishandling of emergency calls from the public could lead to unfavorable views of City Police and other services >Multiple services addressed by dispatch may raise the risk for errors or bottlenecks in dispatching processes >Inaccurate allocation of dispatch related costs to other departments or organizations 3 2 16
Operational
Reputation
136 Police Onboarding/Training 2.08.170 Police department. FY22 Risk Updates:

Staffing shortages for police officers and first responders are common across the State and within the City. Additionally, given the actual or perception of public pressure for law enforcement, training is increasingly important for public trust.

FY21 Risks:

Officers are required to reach a minimum of 32 hours of ongoing professional training every 24 months. Officer training is in tegrated into officers’ schedules throughout the year. Trainings are both in-person and virtual, and can be in both group or individual settings. Additionally, training and onboarding of a new officer recruit can take upwards of 18 months.

Examples of Potential Risks (Note):
>Noncompliance with training requirements
>Inadequately trained personnel resulting in improper handling of public safety matters 2 3 18
Operational
Legal & Compliance
Reputation

7.a
Packet Pg. 90

46 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
137 Public Works Engineering
Services

12.04.030 Public Works

2.30.100 Public Works Contracts

2.30.300 Public Works Contracts

2.08.190 Department of Public
Works
FY22 Risk Updates:
• Collective cost of repairs, upgrades and new building projects has increased • Pipeline monies from State and Federal dollars
• Supply chain constraints for raw materials and supplies • Cost of materials and labor, particularly for contracted work

The internal audit report, Construction Project Controls Assessment, provided recommendations in the following areas:
• Project Reporting
• Document Control
• Prevailing Wage Monitoring
• Schedule Management
• Allowance Usage

FY21 Risks:

The Engineering Services Division designs and constructs City-owned facilities, streets, sidewalks, storm drains and parks infrastructure; provides engineering support to City Departments and the private development community for construction in the public right of way.

The City oversees approximately 400,000 square feet of City-owned facilities including multiple community centers and libraries. Usage and maintenance patterns differ for each of these facilities. For example, the City leases space within the Cubberley Community Center to a variety of long-term leases.

Examples of Potential Risks (Note):
>Lack of funding may cause some capital projects to be significantly delayed and risk cost over-run from lack of continuous activities (i.e. start-up/shut- down operations)
>Unfavorable contract terms resulting in unexpected expenses 2 5 38 Strategic
Operational
Financial
Legal & Compliance
Reputation
Political & Economic
IT
138 Public Works Public Services -
Fleet

2.30.100 Public works contract. FY22 Risk Updates:
• Supply chain constraints for raw materials and supplies • Cost of materials and labor, particularly for contracted work

FY21 Risks:

The Public Services Division maintains the City’s fleet. Due to spending restrictions because of the COVID-19 pandemic, the City has limited fleet maintenance efforts as a cost savings measure.

The City maintains a pool of vehicles that may be used for City business.

Examples of Potential Risks (Note):
>An ageing fleet may result in increased maintenance costs >Lack of funding stability may harm the City's ability to maintain and replace vehicles >Charges to user departments may not sufficiently cover the City's full fleet costs >Policies and procedures that fail to clearly define replacement criteria may result in inefficient replacement methods 3 4 36 Strategic
Operational
Financial
Legal & Compliance
Reputation
139 Public Works Wastewater
Treatment Plant
Operations
The City operates the Regional Water Quality Control Plant (RWQCP), which cleans and treats wastewater before it is discharged to San Francisco Bay.

The plant is owned and operated by the City of Palo Alto, and it treats wastewater for the communities of Los Altos, Los Alto s Hills, Mountain View, Palo Alto, Stanford University and the East Palo Alto Sanitary District. There is an agreement in place to allocate costs to each community.

Examples of Potential Risks (Note):
>Accuracy of cost allocation to each community
>Compliance with applicable environmental laws
3 4 36 Operational
Financial
Legal & Compliance
140 Public Works Airport 2.30.100 Public works contract. FY22 Risk Updates:

In the survey, the following opportunity was identified: New Airport technologies for streamlining administrative processes FY21 Risks:

The Airport Division operates and maintains the Palo Alto Airport, the 3rd busiest airport in the Bay Area. The Air Traffic C ontrol Tower is operated by the Federal Aviation Administration.

The Airport generates revenues through tie-down fees and hangar rentals. The fee schedule is updated periodically.

The Airport Division is overseeing a multi-phase apron reconstruction project. Construction began in 2018 and is expected to be complete in 2021.

Construction of Phase I was completed in June 2018. Construction of Phase II began in December 2018 and was completed in January 2020.

Examples of Potential Risks (Note):
>Unfavorable contract terms may result in in unexpected expenses >Failure to reconcile contractor invoices may result in overpayments >Poor project planning may result in expensive change orders >Improper billing or management of fees for service
>Impact of repayment plan established by Airport to the General Fund causing impacts on airport operations 2 4 28 Strategic
Operational
Financial
Legal & Compliance

7.a
Packet Pg. 91

47 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
141 Public Works Public Services -
Facilities
FY22 Risk Updates:

State requirements to maintain facilities that are related to environmental impacts and controls have increased and oversight has c hanged. Larger workforce issues for the City and for outside Vendors.

FY21 Risks:

The City must prioritize capital projects based on a variety of factors. The 2011 Blue Ribbon Commission (IBCR) report highlighted conclusions the City uses to assist with project prioritization and funding models. Key conclusions include:
>The City underfunded its infrastructure maintenance in the amount of over $2 million per year. >The City permitted the infrastructure underfunding to accumulate, building a backlog of "catch-up" needs totaling over $40 million. >Five major City-owned facilities fell below current standards of safety, capacity, and functionality.

Examples of Potential Risks (Note):
>Inadequate preventative maintenance resulting in long-term financial burden of managing emergency maintenance needs >Failure to adhere to an infrastructure management system may hinder the City's ability to track the condition and use of all City infrastructure >Failure to effectively maintain City-owned facilities may result in more costly long-term repairs and replacement in the future 3 4 36 Operational
Financial
142 Public Works Environmental
Services

2.30.100 Public works contract. FY22 Risk Updates:

The City incorporated the building of a new Environmental Laboratory and Environmental Services Building. The building will a llow for new technology and testing for water, wastewater and stormwater systems.

FY21 Risks:

The Environmental Services division operates and maintains the Regional Water Quality Control Plant; maintains a Pretreatment Program for control of industrial and commercial dischargers; provides pollution prevention information and programs to residents and businesses; manages the City’s solid waste programs.

Environmental Services helps implement Zero Waste Palo Alto's mission, to help the community virtually eliminate waste being buried or burned. This effort involves garbage collection and sorting, recycling, and composting. Environmental Services contracts out these waste c ollection and sorting services.

Examples of Potential Risks (Note):
>Failure to detect non-compliant industrial dischargers may result in preventable pollution >Failure to achieve Zero Waste goals may harm the City's reputation 3 3 26 Strategic
Operational
Financial
Legal & Compliance
Reputation
143 Public Works Urban Forestry The Public Works Urban Forestry Section maintains nearly 66,000 trees of Palo Alto’s urban forest. The urban forest provides a variety of benefits including:
>Reduce the effects of urban density
>Increase property values
>Assist with storm water mitigation
>Remove air pollutants
>Assist with greenhouse gas sequestration

The City has established a Urban Forest Master Plan, which was adopted in February 2019. The “Implementation Plan” includes p lanning for:
>Budget need
>Inter-departmental collaboration
>Municipal Code updates
>Monitoring

Examples of Potential Risks (Note):
>Risks associated with contract management
1 3 12 Operational
Legal & Compliance
Reputation
144 Public Works Building
Deconstruction

2.30.100 Public works contract. As part of an ongoing effort to reduce waste in Palo Alto, City Council approved a Deconstruction Ordinance. The goal is for building materials to be reused or recycled, so workers will have to disassemble structures instead of wrecking buildings. Two of the largest componen ts of landfill waste are food waste and construction and demolition (C&D) related materials. C&D materials represent more than 40% of Palo Alto debris that gets disposed in landfills.

Examples of Potential Risks (Note):
>This ordinance may place a financial burden on residential, commercial, and industrial property owners interested in demolishing a building >The City may weaken its reputation as "business-friendly" >Property owners may avoid needed upgrades to circumvent additional costs 2 2 10
Financial
Reputation
Political & Economic
145 Transportation Safety Improvement
Projects and Traffic
Operations

2.08.260 Office of transportation. FY22 Risk Updates:

The California Department of Transportation's mission was changed in FY22 to make transportation more equitable and defend the climate. State missions and funding streams will be used to advance this mission.

FY21 Risks:

The Office of Transportation works to enhance quality of life and improve the safety of the users of all modes of transportation. To achieve these goals, the Office manages safety improvement projects, collects transportation data, sets speed limits, follows signage and striping best practices, and implements traffic control measures.

Examples of Potential Risks (Note):
>Improper roadway safety and operations decisions may result in preventable roadway incidents with legal ramifications for the City >Failure to obtain community support for a project may result in expensive change orders and reputational harm 2 4 28 Strategic
Financial
Legal & Compliance
Reputation

7.a
Packet Pg. 92

48 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
146 Transportation Contract
Management

2.08.260 Office of transportation. FY22 Risk Updates:

The contract with Duncan Solution was amended to implement ALPR technology and the Surveillance Use Policy were approved by City Council on 2/22/2021. There is a public's concern about privacy, and the contract is to comply with SB 210. The policy states, "ALPR sys tem audits will be conducted on a regular, annual basis." Staff anticipates being able to procure the essential hardware by April 2021 or shortly thereafter, with full implementation expected to launch by late Summer 2021.

FY21 Risks:

The Office of Transportation relies on contracted services for a variety of areas including construction, parking enforcement, and permitting. Noteworthy contractors include Serco and Duncan Solutions.

The Serco contract is three years, in an amount not-to-exceed $2,322,285 for residential preferential parking enforcement services. The Duncan Solution contract is $627,000 over a five-year term to develop, implement, support and maintain a parking permit and citation management system.

Examples of Potential Risks (Note):
>Unfavorable contract terms resulting in unexpected expenses >Contract compliance and cost control issues
>Failure to reconcile contractor invoices may result in overpayments 3 5 44 Operational
Financial
Legal & Compliance
147 Utilities Workforce &
Succession
Planning

2.08.200 Department of Utilities FY22 Risk Updates
- The department may be impacted by a loss of institutional knowledge due to long-term staff retirements creating position vacancies which results in the hiring of new staff that is unaware of the City's processes. There are also challenges with attracting and retaining staff due to non-competitive salaries. - One of the risk assessment interviewees mentioned that a salary is being increased as a currently vacant position cannot be f illed.

FY21 Risks:

With Palo Alto's high cost of living, the City has had trouble recruiting and retaining positions such as lineman and operations crew as there are other organizations (such as investor-owned utilities) in more affordable areas that are also in need of these positions. These employees can oftentimes make the same or higher salaries at other organizations with lower costs of living. This creates an issue for the City in regards to recruiting and retaining positions in high demand such as linemen.

Examples of Potential Risks (Note):
>Sustained high vacancy of positions decrease the ability for Palo Alto to maintain pace of capital improvements and maintenance >High turnover of employees increases personnel expenses associated with onboarding and training >Difficulty hiring high-quality employees in these types of positions 2 3 18 Operational
Financial
Reputation
Political & Economic
148 Utilities AMI Project 2.08.200 Department of Utilities FY22 Risk Updates:

The City has the opportunity to improve its metering process.

FY21 Risks:

Palo Alto is moving towards an implementation of AMI technology for meter reading. AMI will allow for the City to conduct met er readings with more efficiency and accuracy. The costs associated with such an implementation are significant. Any implementation with such an effort may run into unexpected challenges and barriers to implementation. Additionally, redeploying current meter readers is also a challenge.

Examples of Potential Risks (Note):
>Customers desiring to opt out of AMI technology may introduce additional challenges in creating efficient meter reading processes >Implementation of AMI can introduce financial risks for unexpected challenges 3 4 36 Strategic
Operational
Financial
IT
149 Utilities Word Order & Asset
Management

2.08.200 Department of Utilities For any operations and maintenance, a proper work order system is vital to the operations of the utility. Modern day technolo gy and automation can improve the work order process and reduce the number of steps required from employees.

Examples of Potential Risks (Note):
>Implementation of an automated work order system can be costly and disruptive >Lack of an automated work order system can create efficiency issues and opportunities for human error >Improper use of the work order system resulting in improper classification of assets 3 3 26 Operational
IT
150 Utilities Rebates and
Programs

2.08.200 Department of Utilities FY22 Risk Updates:
- FY22 Adopted Operating Budget document states that it assumes various rate changes. - One of the risk assessment interviewees is concerned about capacity and costs to increase renewable energy.

FY21 Risks:

The City offers both residential and commercial utility customers rebates and programs to assist with efficiency and cost savings. In particular, both residential and commercial customers can take advantage of city resources to learn more about solar energy. The City also off ers tips and tricks regarding energy efficiency. For residential customers, you can receive landscape rebates, rebates for outdoor surveys, home water surveys, EV rebates, heat pump water heater rebates, permeable pavement rebates just to name a few. Commercial customers also can receive water re bates and other business specific rebates. Commercial can also take advantage of the fiber program, renewable energy program and others.

Examples of Potential Risks (Note):
>Decreased consumption impacting rates
>Rebates and programs become cost inefficient, producing less benefits than inputs required to run the program 3 3 26 Operational
Financial
Reputation

7.a
Packet Pg. 93

49 Risk ID Functional Area Risk Title Municipal / State Code Reference
Risk Detail
(From documents provided, audit reports, interviews)
Likelihood
(1-5)
Impact
(1-5)
Score Risk Areas
151 Utilities Purchase Power
Contract
Management

2.08.200 Department of Utilities FY22 Risk Updates (Based on PPA Audit):
> There is no formal process to monitor and document vendor compliance with Power Purchase Agreements. > Changes made to the front office model do not require approvals, which may increase the likelihood of inaccurate reporting. > The OCA identified during process interviews that CPAU does not have a process in place to validate NCPA settlement processes that include the verification of invoice calculations, contract rates, and matching ARB amounts on behalf of the City.

FY21 Risks:

The City purchases all of their power from external sources, without any generation operations of their own. This requires a greater effort in monitoring these Purchase Power Agreements. Monitoring these agreements is important both from a compliance standpoint, ensuring that s tate and local requirements are being met, as well as a financial standpoint, ensuring that costs are reasonable.

Examples of Potential Risks (Note):
>The cost of purchased power exceeding the cost of generating power >Noncompliance with purchase power agreements
4 4 42 Strategic
Financial
Legal & Compliance
152 Utilities Rates and Rate
Adjustments

2.08.200 Department of Utilities FY22 Risk Updates:

The City needs improvement with processing large rate adjustments.

FY21 Risks:

Palo Alto owns and operates its own utilities. However, the City purchases all of its electric, water, and gas from other sou rces. The City must set its rates according to the cost to purchase power, water, and gas as well all O&M and capital costs associated with administering the u tilities. For example, the City purchases water from a different source than its neighbors and subsequently has higher water rates.

Examples of Potential Risks (Note):
>Competitive rates in neighboring communities may provide incentive for any prospective residents to choose neighboring commu nities >Rising rates may indicate operational inefficiencies that contribute to a greater cost of service >Compliance with regulatory requirements in the rate setting process >Reputational risk associated with rate setting
>Delay in cost recovery after provider's cost increase
>Allocation of costs across utilities
3 4 36 Strategic
Operational
Financial
Reputation
153 Utilities Utility Bill
Collections

2.08.200 Department of Utilities As a practice, the City of Palo Alto does not currently shut off utilities for those who are regularly missing payments. This includes both commercial and residential customers. The City maintains financial reserves that fluctuate over time, but attempt to remain above 70 days. Continued customers who do not pay their bills will reduce financial reserves.

Examples of Potential Risks (Note):
>Continued practices of no water shut offs may encourage late payments or missed payments >The City may not have the option to complete water shut offs during times like COVID-19, or may not want to complete shut offs due to reputational risk 3 2 16 Financial
Legal & Compliance
Reputation
Political & Economic
154 Utilities Customer Service 2.08.200 Department of Utilities The City of Palo Alto Utilities Customer Service supports the Utilities mission to provide safe, reliable, environmentally su stainable and cost effective services. Customer Services supports residential and commercial customers with questions about the Utilities services: electric, fiber optics, natural gas, water, and wastewater. Customer Services helps customers pay their bill, start new services, and access rebates.

Examples of Potential Risks (Note):
>Negative customer interactions reflect poorly upon the City >COVID-19 and other emergency utility disconnection moratoriums cause a financial burden for the City >Improper handling of customer accounts
3 2 16 Operational
Reputation

7.a
Packet Pg. 94

City of Palo Alto
Office of the City Auditor
FY22/FY23 Annual Audit
Plan
February 15, 2022

7.b
Packet Pg. 95
FY2022/2023 Audit Plan

2 Overview
Introduction
The purpose of the audit activites performed by the Office of the City Auditor (OCA) for the City of Palo Alto (the City) is “to ensure that city management is using its financial, physical, and informational resources effectively, efficiently, economically, ethically, and equitably, and in compliance with laws, regulations, contract and grant requirements, and city policies and procedures”, according to the Palo Alto Municipal Code (Section 2.08.130). It requires the City Auditor prepare an annual audit plan for the City Council’s approval at the beginning of each fiscal year.

In accordance with Task #2 of the Baker Tilly agreement (City of Palo Alto Contract No, C21179340), Baker Tilly US, LLP (Baker Tilly) performed the initial risk assessment after having started to serve as OCA in October 2020 and submitted in early 2021 the FY21-FY22 annual audit plan identifying audit activities across an 18-months horizon (through FY22).

The OCA updated the initial risk assessment in January 2022, one year after our initial risk assessment. This audit plan for the remaining FY22 and FY23 was prepared based on the results of the updated risk assessment. The OCA will seek approval of contract task orders iteratively during that timeframe in order to remain agile and accommodate changes to the plan as time passes.

Other activities are addressed in separate task orders corresponding to the tasks in the Baker Tilly agreement. For example, the City Auditor performs follow up on audit findings and recommendations, as outlined in Task #5.

Conformance with Local Ordinances and Standards
Section 2.08.130 of the Palo Alto Municipal Code defines that the mission of OCA is to promote honest, efficient, effective, economical, and fully accountable and transparent city government. Audits are to be conducted and nonaudit services provided in accordance with Government Auditing Standards, as established by the Comptroller General of the United States, Governmental Accountability Office.

The following duties of the City Auditor exist regarding the plan and scope of internal audits.

Palo Alto City Charter
Article IV Sec. 12 requires the City Auditor to perform the following:
– Conduct audits in accordance with a schedule approved by the City Council and may conduct unscheduled audits from time to time.
– Conducts internal audits of all the fiscal transactions of the City.

Title 2 Administrative Code
Section 2.08.130 requires the City Auditor to perform the following:
– Prepare an annual audit plan for city council approval. – Identify the preliminary objectives of each audit to be performed, reflecting the purpose of the engagement and a preliminary description of the areas that may be addressed. – Conduct performance audits and perform nonaudit services of any city department, program, service, or activity as approved by the city council.

California Government Code
Section 1236 requires all cities that conduct audit activities to conduct their work under the general and specified standards prescribed by the Institute of Internal Auditors (IIA) or the Government Auditing Standards (GAO) issued by the Comptroller General of the United States, as appropriate.

7.b
Packet Pg. 96
FY2022/2023 Audit Plan

3 Audit Activity Types
OCA will conduct performance audits and perform financial/operational analyses of any City department, program, service, or activity as approved by the City Council in accordance with the Baker Tilly agreement.

Performance Audits
According to the Government Auditing Standards (GAO-18-568G, Section 1.21 and 1.22, page 10-12), performance audits provide objective analysis, findings, and conclusions to assist management and those charged with governance and oversight with, among other things, improving program performance and operations, reducing costs, facilitating decision making by parties responsible for overseeing or initiating corrective action, and contributing to public accountability.

Performance audits may include the following four (4) audit objectives:
– Program effectiveness and results
– Internal control design and effectiveness
– Compliance with laws, regulations, and policies
– Prospective analysis

Audit Planning Considerations
While maintaining its independence and objectivity in accordance with standards, the City Auditor considers a variety of matters when developing the Annual Audit Plan, including but not limited to:
– Risk assessment – OCA performed a risk assessment and summarized the results in a separate report (Task #2).

Generally speaking, audit activities target high(er) risk areas. The results are shown the following page. – Ability to add value – audit seeks to add value through independent and objective analysis. – City Council – the City Auditor reports to the City Council and seeks input on audit priorities. – Coverage and Prior Audits – the City Auditor considers prior audits conducted by OCA, the financial audit, and other audit and consulting reports recently issued.
– “Ripeness” and On-Going Initiatives – certain risk areas may be addressed through operational activities, which could mean they are not be ripe for audit to add value. – Scheduling – the City Auditor takes into consideration the timing of an audit and other on-going initiatives that directly relate. Putting an undue burden on City staff may exacerbate the risk at hand or other interrelated risks.

7.b
Packet Pg. 97
FY2022/2023 Audit Plan

4 Risk Assessment Results
The OCA performed a citywide risk assessment to plan for FY22 and FY23 audit activities and documented the methodology and the detailed results in a separate Risk Assessment Report. In summary, we identified the following areas rated as High or High-Moderate risks. In determining the audit activities to be performed in FY22 and in FY23, we further reviewed these risks and functional areas and considered the matters listed in the previous page.

Functional Area Title Likelihood
(1-5)
Impact
(1-5) Score
City Wide COVID-19 Response 5 5 50
Org Wide Employee Retention & Succession Planning 5 4 46 Planning and Development
Services Long Rnage Planning 5 4 46
Information Technology Disaster Recovery Preparedness and Testing 3 5 44 Information Technology Host Intrusion and Malware Defense 3 5 44 Information Technology Problem Management and Incident Response 3 5 44 Transportation Contract Management 3 5 44
Org Wide Workforce 4 4 42
Org Wide Citywide Risk Management 4 4 42
Administrative Services Procurement 4 4 42
Fire Emergency Medical Service 4 4 42
Human Resources High Cost Claims 4 4 42
Human Resources Workload 4 4 42
Information Technology Mobile Device Management 5 3 40
Information Technology Strategy and Governance 5 3 40
Public Works Secondary Treatment Upgrades 2 5 38
Public Works ADA Compliance Upgrade 2 5 38
Administrative Services Investments, Debt, and Cash Management 2 5 38 Information Technology Information Security 2 5 38
Information Technology Operations and Monitoring 2 5 38 Information Technology Physical and Environmental Controls 2 5 38 Information Technology Ransomware 2 5 38
Police Use of Force and Officer Conduct 2 5 38
Org Wide Governance 3 4 36
Org Wide Organizational Culture 3 4 36
Administrative Services ERP System Upgrade 3 4 36
City Wide Sustainability and Climate Action Plan 3 4 36 Administrative Services Accounts Receivable 3 4 36
Fire Fire Suppression 3 4 36
Fire Fire Prevention - Palo Alto Foothills & Wildlad Fire Risk 3 4 36 Public Works Public Services - Fleet 3 4 36
Public Works Wastewater Treatment Plant Operations 3 4 36 Public Works Public Services -Facilities 3 4 36
Utilities AMI (Advanced Metering Infrastructure) Project 3 4 36 Utilities Rates and Rate Adjustments 3 4 36

7.b
Packet Pg. 98
FY2022/2023 Audit Plan

5 Proposed Audit Activities for FY2022-2023

Included in the tables below are the proposed audit activities for the remainder of FY2022 and FY2023. Each audit activity corresponds to a risk rated as High or Moderate in the Risk Assessment Report and selected based on other factors outlined on page 3.

The preliminary audit objectives are described for each audit listed. These objectives and scope of each audit activity will be further defined based on the result of a project planning risk assessment processes performed at the beginning of each activity.

Audits are planned in three overall phases – note that the timing may differ slightly for each audit activity:
– Phase I – Activities projected to start before March 2022 and end by June 2022 – Phase II – Activities projected to start in March 2022 and end by December 2022 – Phase III – Activities projected to start in June 2022 or January 2023 and end by June 2023

Amendments to the proposed audit plan will be proposed either as needed or after conducting an annual risk assessment and update the audit plan, as needed, during FY23. Amendments may be proposed in response to changes in the City’s environment such as organizational structure, operations, risks, systems, and controls. Please note that the City Auditor will actively manage projects and overall budgets and workload in its execution of the workplan.

For each audit activity, a task order is submitted to the City Council for approval before the work is commenced. We have prepared and attached to this report multiple task orders that correspond to audit activities we have prioritized (e.g., those in Phase I). Those audit activities for are marked with an “X” in the ‘Seeking Approval’ column of the table below, and the Task Orders are included in the Appendix.

7.b
Packet Pg. 99
FY2022/2023 Audit Plan

6 Phase I Activities
Seeking
Approval
Function Project Title Audit Objectives Timeline Estimated Hours
FY22 Cost FY23 Cost
(*)
Total Cost
FY21+22+23
_
Administrative
Services
Economic Recovery
Advisory (Task Order

4.7)
● Review the City’s long-term financial planning model and offer recommendations for improvement.
● Identify and evaluate key revenue sources categories that present long term risk to the City's financial sustainability.
● Perform scenario analysis and advise in the development of long term financial projections.

March -
December
2021
400 $64,663 $64,663
Public Works
Public Safety Building
- Construction Audit
(Task Order 4.8)
● Monthly invoice review
● Change order testing
● Contingency and allowance testing
● Lien waiver control
● Compliance with insurance requirements
● Closeout testing
● Verify the City’s implementation and adherence to documented project controls
March 2021
- June 2023 420 $26,633 $26,633 $51,266

Planning and
Development
Services
Building Permit &
Inspection Process
Review
(Task Order 4.9)
● Identify highest impact area to focus the assessment (e.g., specific permit type(s), specific sub-processes, etc.).
● Document corresponding process(es) and evaluate for efficiency and effectiveness.
● Benchmark operational performance against industry practices and established standards.

April –
September
2021
360 $48,300 $48,300
Citywide
Nonprofit Agreements
Risk Management
Review
(Task Order 4.10)
● Evaluate controls in place to ensure that nonprofit organizations are properly vetted prior to selection and monitored through the life of an agreement.
● Assess the performance monitoring process against the best practice. ● Follow up on relevant audit findings from past audit work.

May –
September
2021
400 $55,246 $55,246
Utilities
Utility Work Order &
Process Review
(Task Order 4.11)
● Determine whether adequate controls are in place and working effectively around the work order process
● Assess the work order process against best practices
January -
December
2022
400 $81,400 $81,400

Administrative
Services /
Information
Technology
Wire Payment
Process and Controls
(Task Order 4.12)
● Determine whether adequate controls are in place and working effectively to ensure that all disbursements are valid and properly processed in compliance with City’s policies and procedures
● Determine whether end user security awareness training is sufficient to prevent erroneous payments caused by phishing
February -
June 2022 270 $54,550 $54,550
Phase I Sub Total 2,250 $329,792 $26,633 $355,425 * For the purpose of audit plan preparation, OCA used the FY22 budget amount for FY23

7.b
Packet Pg. 100
FY2022/2023 Audit Plan

7 Phase II Activities
Seeking
Approval
Function Project Title Audit Objectives
(preliminary objectives for audits not currently subject to approval) Timeline Estimated
Hours
FY22 Cost FY23 Cost
(*)
Total Cost
X Human Resources Remote and Flexible
Work Study
● Assess employee and management perspectives for long-term remote and flexible work viability and associated challenges
● Evaluate positive outcomes and challenges for managing a mixed location workforce
● Identify policies, processes, management practices and work culture improvements that may improve the City’s ability to manage a remote workforce
March -
December
2022
285 $50,000 $10,000 $60,000
X Information
Technology
Cybersecurity
Assessment
● Map current state security capabilities to the NIST Cybersecurity Framework and evaluate the maturity of current security processes ● Identify current risks related to weaknesses in the City’s cybersecurity program
● Identify target state objectives utilizing the Capability Maturity Model (CMMI) and develop recommendation to meet the objectives March -
December
2022
525 $90,000 $20,000 $110,000
X Public Works Wastewater Treatment
Plant Agreement Audit
● Evaluate whether direct and indirect costs incurred by the City are properly allocated to the operation of the Wastewater Treatment Plant. ● Review whether costs are properly allocated to the various parties to the Wastewater Treatment Plant Agreement.

March 2022
- December
2022
400 $60,000 $2,250 $62,250
Phase II Sub Total 1,210 $194,000 $38,250 $232,250
* For the purpose of audit plan preparation, OCA used the FY22 budget amount for FY23

7.b
Packet Pg. 101
FY2022/2023 Audit Plan

8 Phase III Activities
Seeking
Approval
Function Project Title Preliminary Audit Objectives Timeline Estimated Hours
FY22 Cost FY23 Cost
(*)
Total Cost
Transportation Contract Management -
ALPR Technology
● Determine whether policies and procedures are implemented effectively to protect the privacy of personal information gathered using ALPR technology for the City's parking management.
● Determine whether the City monitors the vendor's performance to ensure the compliance with contract terms and applicable laws and regulations related to data privacy.

June 2022 -
January
2023
400 $82,500 $82,500
Administrative
Services
Investment
Management
● Determine whether adequate controls are in place and operating effectively to ensure that investments are managed in accordance with the investment management and other relevant policies. ● Assess the organizational structure and operations of the investment portfolio management function against best practice.

June 2022 -
January
2023
350 $61,550 $61,550
Information
Technology
Disaster Recovery
Preparedness
● Determine whether a formal disaster recovery plan exists and aligns with the City's needs for business continuity
● Determine whether a disaster recovery plan is periodically tested and updated to ensure a successful recovery
January -
June 2023 400 $87,500 $87,500
Administrative
Services Procurement Process
● Determine whether adequate controls are in place and working effectively to ensure that the appropriate vendors are selected properly to achieve desired objectives
● Identify the opportunities to improve the efficiency and effectiveness of the procurement process
January -
June 2023 350 $61,550 $61,550

Planning and
Development
Services
Long Range Planning
● Review progress against intended goals and identify any gaps ● Determine whether an effective control environment exists for the Long Range Planning group to maintain City's Comprehensive Plan ● Determine whether adequate controls are in place and working effectively for data analyses
January -
June 2023 400 $82,500 $82,500
Public Works ADA Compliance
● Determine whether improvements have been made to make facilities, programs, and services accessible in accordance with the Transition Plan and Self-Evaluation Final Study to ensure compliance with the Americans with Disabilities Act (ADA) OF 1990
January -
June 2023 350 $61,550 $61,550
TBD TBD / Ad Hoc Requests TBD TBD TBD
Phase III Sub Total 2,300 $0 $458,100 $458,100
Phase I + II + III TOTAL 5,760 $523,792 $521,983 $1,045,775 FY22 - FY23 Budget $600,000 $560,000 $1,160,000
FY23 Ad Hoc / Contingency $76,208 $38,017 $114,225
* For the purpose of audit plan preparation, OCA used the FY22 budget amount for FY23

7.b
Packet Pg. 102
FY2021/2022 Audit Plan

9 Appendix: Task Orders

7.b
Packet Pg. 103

10 Audit Activity 4.13 – Remote and Flexible Work Study

PROFESSIONAL SERVICES TASK ORDER
TASK ORDER FY22-004.13
Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consul tant shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below.

CONTRACT NO. C21179340
OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE)

1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE):
1B. TASK O RDER NO.: FY22-004.13

2. CONSULTANT NAME: Baker Tilly US, LLP

3. PERIOD OF PERFORMANCE: START: March 1, 2022 COMPLETION: December 31, 2022 4 TOTAL TASK ORDER PRICE: $60,000
BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT $TBD

5. BUDGET CODE_______________
COST CENTER________________
COST ELEMENT______________
WBS/CIP__________
PHASE__________

6. CITY PROJECT MANAGER’S NAME & DEPARTMENT:

Greer Stone, Chair of the City Council’s Policy and Services Committee

7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A)
MUST INCLUDE:
▪ SERVICES AND DELIVERABLES TO BE PROVIDED
▪ SCHEDULE OF PERFORMANCE
▪ MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable) ▪ REIMBURSABLE EXPENSES, if any (with “not to exceed” amount)

8. ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A

I hereby authorize the performance of the
work described in this Task Order.

APPROVED:

CITY OF PALO ALTO

BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________

I hereby acknowledge receipt and acceptance of
this Task Order and warrant that I have
authority to sign on behalf of Consultant.

APPROVED:

COMPANY NAME: ______________________

BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________

7.b
Packet Pg. 104

11 Attachment A

DESCRIPTION OF SCOPE OF SERVICES

Introduction

Attachment A, the Description of Scope of Services, contains the following four (4) elements:

• Services and Deliverables To Be Provided
• Schedule of Performance
• Maximum Compensation Amount and Rate Schedule (As Applicable) • Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables

Baker Tilly’s approach to conducting the Construction Controls Assessment involves four (3) primary steps:

• Step 1: Audit Planning
• Step 2: Control review and analysis
• Step 3: Reporting

Step 1 – Audit Planning
This step consists of the tasks performed to adequately plan the work necessary to address the overall audit objective and to solidify mutual understanding of the audit scope, objectives, audit process, and timing between stakeholders and auditors. Tasks include:

• Gather information to understand the environment under review o Understand the organization structure and objectives
o Review the codes, regulations, policies, and other standards and expectations o Review the prior audit results, if any
o Review previously conducted employee engagement and satisfaction surveys o Issue an employee survey centered on remote work capabilities o Issue a management survey centered on remote work capabilities o Review additional documentation and conduct interviews as necessary • Assess the audit risk
• Write an audit plan and audit program
o Define audit objectives and scope
o Identify the audit procedures to be performed and the evidence to be obtained • Announce the initiation of the audit and conduct a kick-off meeting with key stakeholders
o Discuss audit objectives, scope, audit process, timing, resources, and expectations
o Discuss documentation and interview requests for the audit

7.b
Packet Pg. 105

12 Step 2 – Control Review and Testing
This step involves executing the procedures in the audit program to gather information, interview individuals, and analyze the data and information to obtain sufficient evidence to address the audit objectives. The preliminary audit objective is to: (1) Assess employee and management perspectives for long-term remote and flexible work viability and associated challenges; (2) Evaluate positive outcomes and challenges for managing a mixed location workforce; (3) Identify policies, processes, management practices and work culture improvements that may improve the City’s ability to manage a remote workforce. Tasks include but are not limited to:

• Analyze employee and management surveys to identify management and policy change opportunities and barriers for managing a mixed location workforce • Interview (focus group and/or individual) the Human Resources, employee representatives and management representatives to understand the current state, benefits and barriers to
• Review relevant policies and procedures as well as the position eligibility standards for remote work to identify the criteria to be used for evaluation of control design and effectiveness
• Research best practices and practices of surrounding communities • Analyze available data to assess current practices impact on recruitment and retention • Validate analysis with Human Resources

Step 3 – Reporting
In Step 3, the project team will perform tasks necessary to finalize audit working papers and submit a final audit report. Tasks include:

• Develop findings, conclusions, and recommendations based on the supporting evidence gathered
• Validate findings with the appropriate individuals
• Complete the supervisory review of working papers and a draft audit report • Distribute a draft audit report and conduct a closing meeting with key stakeholders o Discuss the audit results, finings, conclusions, and recommendations o Discuss management responses
• Obtain written management responses and finalize a report

Deliverables:

The following deliverable will be prepared as part of this engagement:
• Audit Report with remote and flexible work data analysis and best practice recommendation

Schedule of Performance

Anticipated Start Date: March 1, 2022

7.b
Packet Pg. 106

13 Anticipated End Date: December 31, 2022

Maximum Compensation Amount and Rate Schedule
The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this Task is $60,000. The not-to-exceed budget is based on an estimate of 285 total project hours, of which 16 are estimated to be completed by the City Auditor.

Reimbursable Expenses
If circumstances allow, Baker Tilly anticipates planning one on-site fieldwork. Given this possibility, Baker Tilly could incur reimbursable expenses for this Task.

The not-to-exceed maximum for reimbursable expenses for this Task is $5,000.

The following summarizes anticipated reimbursable expenses:
• Round-trip Airfare – $1,200
• Rental Car - $600
• Hotel accommodation - $2,500 (8 nights)
• Food and incidentals – $700

Note that, if current restrictions associated with COVID-19 continue, an on-site visit may not be possible. The project team will work with the City to consider circumstances at the time.

7.b
Packet Pg. 107

14 Audit Activity 4.14 – Cybersecurity Assessment

PROFESSIONAL SERVICES TASK ORDER
TASK ORDER FY22-004.14
Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below.

CONTRACT NO. C21179340
OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE)

1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE):
1B. TASK O RDER NO.: FY22-004.14

2. CONSULTANT NAME: Baker Tilly US, LLP

3. PERIOD OF PERFORMANCE: START: March 1, 2022 COMPLETION: December 31, 2022 4 TOTAL TASK ORDER PRICE: $110,000
BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT $TBD

5. BUDGET CODE_______________
COST CENTER________________
COST ELEMENT______________
WBS/CIP__________
PHASE__________

6. CITY PROJECT MANAGER’S NAME & DEPARTMENT:

Greer Stone, Chair of the City Council’s Policy and Services Committee

7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A)
MUST INCLUDE:
▪ SERVICES AND DELIVERABLES TO BE PROVIDED
▪ SCHEDULE OF PERFORMANCE
▪ MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable) ▪ REIMBURSABLE EXPENSES, if any (with “not to exceed” amount)

8. ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A

I hereby authorize the performance of the
work described in this Task Order.

APPROVED:

CITY OF PALO ALTO

BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________

I hereby acknowledge receipt and acceptance of
this Task Order and warrant that I have
authority to sign on behalf of Consultant.

APPROVED:

COMPANY NAME: ______________________

BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________

7.b
Packet Pg. 108

15 Attachment A

DESCRIPTION OF SCOPE OF SERVICES

Introduction

Attachment A, the Description of Scope of Services, contains the following four (4) elements:

• Services and Deliverables To Be Provided
• Schedule of Performance
• Maximum Compensation Amount and Rate Schedule (As Applicable) • Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables

Cybersecurity Maturity Assessment
Baker Tilly’s approach to conducting a cybersecurity assessment and developing a cybersecurity program strategy involves four (4) primary steps:

• Step 1: Assessment Planning and Kick-off
• Step 2: Information Gathering
• Step 3: Cybersecurity Capability Analysis and Recommendations • Step 4: Reporting

Step 1 – Assessment Planning and Kick-off
This step consists of the tasks performed to adequately plan the work necessary to address the overall assessment objective and to solidify mutual understanding of the assessment scope, objectives, assessment process, and timing between stakeholders and assessors. Tasks include:
• Baker Tilly will work with the City to finalize the assessment scope and project timeline. Baker Tilly will also provide the City with an initial interview and documentation request list.
• Finally, Baker Tilly will perform a project kick-off discussion with the City to ensure alignment with the project timeline, interview schedule, and deliverables.

Step 2 – Information Gathering
This step involves conducting interviews with identified IT security personnel and key stakeholders to identify security capabilities, processes, and currently implemented technologies.

Baker Tilly will also review current IT security policy and procedure documentation, as well as network and infrastructure architecture documents.

7.b
Packet Pg. 109

16 Step 3 – Cybersecurity Capability Analysis and Recommendations This step involves mapping current state security capabilities to the NIST Cybersecurity Framework and evaluate the maturity of current security processes. Baker Tilly will also identify current risks related to weaknesses in the City’s cybersecurity program.

Baker Tilly will then review current state capabilities and risks with the City to ensure alignment on Baker Tilly’s initial analysis and identify target state objectives utilizing the Capability Maturity Model (CMMI)

Finally, Baker Tilly will take the identified improvement areas and target state maturity objectives to develop our recommendations for the City’s cybersecurity program to meet its target state objectives.

Step 4 – Reporting
The project team will perform tasks necessary to finalize the initial draft cybersecurity assessment report and review a draft report with the stakeholders. Additionally, the team will submit a final assessment report to the City. Tasks include:
• Develop findings, conclusions, and recommendations based on the supporting evidence gathered
• Validate findings with the appropriate individuals
• Distribute a draft assessment report and conduct a closing meeting with key stakeholders
o Discuss the assessment results, findings, conclusions, and recommendations • Obtain written management responses and finalize a report

Deliverables:

The following deliverable will be prepared as part of this engagement:
• Cybersecurity Assessment Report and Program Strategy

External Penetration Testing
Baker Tilly will perform external penetration testing on behalf of the City. Baker Tilly’s approach to conducting these security testing activities involves four (4) primary steps:

• Step 1: Assessment Planning and Kick-off
• Step 2: Open-Source Information Gathering and Reconnaissance • Step 3: External Penetration Testing
• Step 4: Reporting

Step 1 – Assessment Planning and Kick-off
This step consists of the tasks performed to adequately plan the work necessary to address the overall testing objective and to solidify mutual understanding of the testing scope, objectives, testing process, and timing between stakeholders and assessors. Tasks include:

7.b
Packet Pg. 110

17 • Baker Tilly will work with the City to finalize the testing scope and project timeline. • Baker Tilly will perform a project kick-off discussion with the City to ensure alignment with the project timeline, testing approach, and deliverables. • Baker Tilly will provide the City with an ISP authorization form and Rules of Engagement documents for signature to confirm testing scope and activities.

Step 2 – Open-Source Information Gathering and Reconnaissance This step involves conducting interviews with identified IT security personnel and key stakeholders to identify security capabilities, processes, and currently implemented technologies.

Baker Tilly will also review current IT security policy and procedure documentation, as well as network and infrastructure architecture documents.

Step 3 – External Penetration Testing
Baker Tilly will conduct external penetration testing on up to 300 active and 208 dormant external IP addresses provided by the City. External penetration testing services include:
• Confirmation of active versus dormant IP addresses
• Identification of services and service versions running on each active system; • Automated vulnerability discovery scanning for each active system; • Penetration attempts on systems identified that have known exploitable vulnerabilities; and
• Deep dive exploitation of any identified exploitable vulnerabilities to gain unauthorized access to internal systems and/or data.

Step 4 – Reporting
The project team will perform tasks necessary to finalize our security testing report and review a draft report with City stakeholders. Additionally, the team will submit a final testing report to the City. Tasks include:
• Develop findings, conclusions, and recommendations based on the supporting evidence gathered
• Validate findings with the appropriate individuals
• Distribute a draft testing report and conduct a closing meeting with key stakeholders o Discuss the testing results, findings, conclusions, and recommendations • Obtain written management responses and finalize a report

Deliverables:

The following deliverable will be prepared as part of this engagement:
• External Penetration Testing Report

7.b
Packet Pg. 111

18 Schedule of Performance

Anticipated Start Date: March 1, 2022
Anticipated End Date: December 31, 2022

Maximum Compensation Amount and Rate Schedule
The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this Task is $110,000. The not-to-exceed budget is based on an estimate of 525 total project hours, of which 30 are estimated to be completed by the City Auditor.

Reimbursable Expenses
We plan to complete the audit work remotely, including all interviews and documentation review. However, if the City requests the assessment team to travel on-site for meetings, interviews, or assessment report readouts, these travel related expenses will be billed in addition to the fees above.

7.b
Packet Pg. 112

19 Audit Activity 4.15 – Wastewater Treatment Plant Agreement

PROFESSIONAL SERVICES TASK ORDER
TASK ORDER FY22-004.15
Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consultant shall furnish the necessary facil ities, professional, technical and supporting personnel required by this Task Order as described below.

CONTRACT NO. C21179340
OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE)

1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE):
1B. TASK O RDER NO.: FY22-004.14

2. CONSULTANT NAME: Baker Tilly US, LLP

3. PERIOD OF PERFORMANCE: START: March 1, 2022 COMPLETION: December 31, 2022 4 TOTAL TASK ORDER PRICE: $110,000
BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT $TBD

5. BUDGET CODE_______________
COST CENTER________________
COST ELEMENT______________
WBS/CIP__________
PHASE__________

6. CITY PROJECT MANAGER’S NAME & DEPARTMENT:

Greer Stone, Chair of the City Council’s Policy and Services Committee

7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A)
MUST INCLUDE:
▪ SERVICES AND DELIVERABLES TO BE PROVIDED
▪ SCHEDULE OF PERFORMANCE
▪ MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable) ▪ REIMBURSABLE EXPENSES, if any (with “not to exceed” amount)

8. ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A

I hereby authorize the performance of the
work described in this Task Order.

APPROVED:

CITY OF PALO ALTO

BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________

I hereby acknowledge receipt and acceptance of
this Task Order and warrant that I have
authority to sign on behalf of Consultant.

APPROVED:

COMPANY NAME: ______________________

BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________

7.b
Packet Pg. 113

20 Attachment A

DESCRIPTION OF SCOPE OF SERVICES

Introduction

Attachment A, the Description of Scope of Services, contains the following four (4) elements:

• Services and Deliverables To Be Provided
• Schedule of Performance
• Maximum Compensation Amount and Rate Schedule (As Applicable) • Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables

Baker Tilly’s approach to conducting a Wasterwater Treatment Plant Agreement Review involves three (3) primary steps:

• Step 1: Audit Planning
• Step 2: Process and Control Review
• Step 3: Reporting

Step 1 – Audit Planning
This step consists of the tasks performed to adequately plan the work necessary to address the overall audit objective and to solidify mutual understanding of the audit scope, objectives, audit process, and timing between stakeholders and auditors. Tasks include:
• Gather information to understand the environment under review o Understand the organizational structure and objectives o Review the City code, regulations, and other standards and expectations o Review prior audit results, as applicable
o Review additional documentation and conduct interviews as necessary • Assess the audit risk
• Write an audit planning memo and audit program
o Refine audit objectives and scope
o Identify the audit procedures to be performed and the evidence to be obtained and examined
• Announce the initiation of the audit and conduct kick-off meeting with key stakeholders
o Discuss audit objectives, scope, audit process, timing, resources, and expectations
o Discuss documentation and interview requests for the audit

7.b
Packet Pg. 114

21 Step 2 – Process and Control Review
This step involves executing the procedures in the audit program to gather information, interview individuals, and analyze the data and information to obtain sufficient evidence to address the audit objectives. The preliminary audit objective is to: (1) Determine whether adequate controls are in place and working effectively to ensure that costs for treatment plan operations are properly accounted for and allocated; (2) Assess the compliance with contracts and regulations. Procedures include:

• Interview the appropriate individuals to understand the process, the information system used, and internal controls related to accounting and allocation of costs for treatment plan operations.
• Review the contracts, policies and procedures as well as the regulations and standards to identify the criteria to be used for evaluation of compliance and control design and effectiveness
• Review the documents (such as contracts and supporting documents for allocation) for the selected allocation transactions
• Compare the cost accounting and allocation methodology against the requirements

Step 3 – Reporting
In Step 3, the project team will perform tasks necessary to finalize audit working papers, prepare and review a draft report with the stakeholders, and submit a final audit report. Tasks include:
• Develop findings, conclusions, and recommendations based on the supporting evidence gathered
• Validate findings with the appropriate individuals and discuss the root cause of the identified findings
• Complete supervisory review of working papers and a draft audit report • Distribute a draft audit report and conduct a closing meeting with key stakeholders o Discuss the audit results, finings, conclusions, and recommendations o Discuss management responses
• Obtain written management responses and finalize a report • Review report with members of City Council and/or the appropriate Council Committee
• Present the final report to the City Council and/or appropriate Council Committee

Deliverables:

The following deliverable will be prepared as part of this engagement:
• Audit Report

Schedule of Performance

7.b
Packet Pg. 115

22 Anticipated Start Date: March 1, 2022
Anticipated End Date: December 31, 2022

Maximum Compensation Amount and Rate Schedule
The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this Task is $82,500. The not-to-exceed budget is based on an estimate of 400 total project hours, of which 20 are estimated to be completed by the City Auditor.

Reimbursable Expenses
If circumstances allow, Baker Tilly anticipates planning one on-site fieldwork week. Given this possibility, Baker Tilly could incur reimbursable expenses for this Task.

The not-to-exceed maximum for reimbursable expenses for this Task is $4,750.

The following summarizes anticipated reimbursable expenses (for three team members):
• Round-trip Airfare – $1500
• Rental Car - $400
• Hotel accommodation - $2500 (4 nights)
• Food and incidentals – $750

Note that, if current restrictions associated with COVID-19 continue, an on-site visit may not be possible. The project team will work with the City to consider circumstances at the time.

7.b
Packet Pg. 116

City of Palo Alto (ID # 13931)
Office of the City Clerk
City Council CAO Report

Meeting Date: 4/4/2022

Title: Adoption of a Resolution Authorizing Use of Teleconferencing for Council Meetings During Covid-19 State of Emergency
From: Mahealani AhYun, Deputy City Clerk

Recommendation
Adopt a Resolution (Attachment A) authorizing the use of teleconferencing under Government Code Section 54953(e) for meetings of the Council and its committees due to the Covid-19 declared state of emergency.

Background
In February and March 2020, the state and the County declared a state of emergency due to the Covid-19 pandemic. Both emergency declarations remain in effect.

On September 16, 2021, the Governor signed AB 361, a bill that amends the Brown Act, effective October 1, 2021, to allow local policy bodies to continue to meet by teleconferencing during a state of emergency without complying with restrictions in State law that would otherwise apply, provided that the policy bodies make certain findings at least once every 30 days.

AB 361, codified at California Government Code Section 54953(e), empowers local policy bodies to convene by teleconferencing technology during a proclaimed state of emergency under the State Emergency Services Act in any of the following circumstances:

(A) The legislative body holds a meeting during a proclaimed state of emergency, and state or local officials have imposed or recommended measures to promote social distancing.

(B) The legislative body holds a meeting during a proclaimed state of emergency for the purpose of determining, by majority vote, whether as a result of the emergency, meeting in person would present imminent risks to the health or safety of attendees.
8 Packet Pg. 117