1 December 12, 2023
City of Palo Alto
Office of the City Auditor
FY2023 Annual Risk Assessment
Contents
Baker Tilly US, LLP, trading as Baker Tilly, is an independent member of Baker Tilly International. Baker Tilly International Limited is an English company. Baker Tilly International provides no professional services to clients. Each member firm is a separate and independent legal entity, and each describes itself as such.
Baker Tilly US, LLP is not Baker Tilly International’s agent and does not have the authority to bind Baker Tilly International or act on Baker Tilly International’s behalf. None of Baker Tilly International, Baker Tilly US, LLP nor any of the other member firms of Baker Tilly International has any liability for each other’s acts or omissions. The name Baker Tilly and its associated logo is used under license from Baker Tilly International Limited.
INTRODUCTION ............................................................................................................. 1 RISK ASSESSMENT APPROACH ................................................................................. 2 SURVEY RESULTS ........................................................................................................ 3 RISK ASSESSMENT RESULTS ..................................................................................... 5 APPENDICES ................................................................................................................. 9
1 Introduction
Overview
According to City Ordinance of the City of Palo Alto (the City), the mission of the Office of the City Auditor (OCA) is to promote honest, efficient, effective, economical, and fully accountable and transparent city government. To fulfill this mission, the OCA conducts performance audits and performs financial/operational analyses of city departments, programs, services, or activities as approved by the City Council. (Section 2.08.130). In its capacity serving as the City Auditor function, and in accordance with Baker Tilly’s agreement with the City (Task #1 of the agreement), Baker Tilly US, LLP (Baker Tilly) conducted the fiscal year(FY) 2023 citywide risk assessment in order to develop the FY2024 annual audit plan (Task #2).
The California Government Code Section 1236 requires all cities that conduct audit activities to conduct their work under the general and specified standards prescribed by the Institute of Internal Auditors (IIA) or the Government Auditing Standards (GAO) issued by the Comptroller General of the United States, as appropriate.
According to the IIA Standard 2010, the head of internal audit function “must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization’s goals” and consider the input of senior management and a governing board.
The purpose of the risk assessment is to develop an internal audit plan that assigns internal audit resources to the activities that add the most value to the City. The risk assessment process involves identifying, measuring, and prioritizing risks associated with the audit universe (list of specific departments, functions, processes, programs, etc. that can be subject to an audit). Risk is defined as “the possibility of an event or condition occurring that will have an impact on the ability of an organization to achieve its objectives.”1 Our risk assessment involved collaboration with City Council and executive leadership from 14 main departments across the organization. This report summarizes our risk assessment methodology, analysis, and results. The FY2024 annual audit plan is based on the results of this risk assessment.
Through the risk assessment, we observed certain strengths of the City. Key strengths include:
Commitment to public service
High value on efficient and effective government
Focus on long term strategy
Dedicated and highly professional management and staff Demonstrated history of innovation and commitment to sustainability
Risk Assessment Process Considerations
The starting point of the internal auditing is to conduct a risk assessment that is the basis for determining the internal audit activities. However, it is not a one-size-fits-all process. The scope and complexity of risk assessment are affected by various factors such as the maturity level of the internal audit function’s products and services, the organization’s enterprise risk management efforts, coordination with other monitoring and risk management functions, and the stakeholders’ expectations. As every organization is subject to changing environment, the results of the annual risk assessment represent the information considered at the time of the assessment.
In addition to the annual macro-level risk assessment, the internal audit function is required to perform an engagement-level risk assessment when starting each audit listed in the approved audit plan. The IIA Standard 2200 states, “Internal auditors must develop and document a plan for each engagement, including the engagement’s objectives, scope, timing, and resource allocations. The plan must consider the organization’s strategies, objectives, and risks relevant to the engagement.”
1 Rick A. Wright Jr., CIA, “The Internal Auditor’s Guide to Risk Assessment” The Institute of Internal Auditors Research Foundation (IIARF), 2018
2 Risk Assessment Approach
Baker Tilly’s risk assessment approach consisted of four phases as illustrated in the graphic below.
2023 RISK ASSESSMENT PHASES
Planning
Prepared risk assessment survey questions and the online survey tool. Scheduled the interviews with City Council members and Executive Leadership Team (ELT) members.
Information
Gathering
Reviewed the key documents such as City Council Priorities and the progress report, the budget documents, the annual comprehensive financial report, departmental strategic plans, employee turnover, the information on the City’s website and other relevant documents. Distributed a link to the online survey to the selected 51 managers. The survey responses were downloaded in Excel spreadsheet.
Interviewed all City Council Members and ELT members (25 individuals) to identify the events and conditions that may affect the achievement of objectives. Updated the risk assessment matrix with the information gathered.
Analysis
Analyzed the survey responses.
Scored the auditable units (listed in Appendix A) in the risk assessment matrix based on the likelihood and the impact2 of potential adverse events. o Each of the auditable units received scores for various risk factors related to the likelihood or impact (defined in Appendix B).
o Risk factor scores were summed to create a single score for the auditable unit. Identified potential internal audit activities for the auditable units with high risk scores.
Reporting Summarized the approach and results of the risk assessment
Baker Tilly conducted an initial comprehensive risk assessment in FY2021 by interviewing all Council Members and Executive Leadership Team (ELT) members to create a risk assessment matrix. For the FY2022 risk assessment, surveyed all ELT members and some additional members of management and conducted interviews with available Council Members as well as key ELT members representing areas of perceived high risk (e.g., Information Technology, Human Resources). For the third year risk assessment, all Council Members and ELT members were interviewed, the selected 51 managers were surveyed, and the risk assessment matrix was redeveloped for a comprehensive picture of the risk landscape, which will be continuously improved.
Our risk assessment primarily measured inherent risk (the risk without mitigating controls/factors) for each risk factor although we also considered specific risks based on the City’s processes, controls, and other factors we learned through internal audit activities. Using the information gathered, we identified risks and determined the likelihood and impact of the risks.
2 Likelihood is the possibility that an event will occur. Impact is the extent to which an event might affect an organization.
3 Survey Results
Baker Tilly team conducted an online risk assessment survey to gather management’s insights for all City departments and received 47 responses (92% response rate). The survey questions are listed in Appendix C.
Changes over the past 12 months
All organizations are subject to changing environments that can influence risk to organizations. The COSO3 Internal Control – Integrated Framework4 highlights the influence of change in one of the 17 principles. Principle 9 states, “the organization identifies and assesses changes that could significantly impact the system of internal control.” The survey participants were asked to select all significant changes for their team or department during last 12 months.
Policies and Procedures
Policies and procedures provide a
roadmap for daily operations to ensure
compliance with laws and regulations,
give guidance for decision-making, and
establish the standards and internal
controls.
The survey participants were also asked
to select the current state of the policies
and procedures necessary to perform
their job responsibilities.
3 The Committee of Sponsoring Organizations of the Treadway Commission (COSO) is sponsored jointly by five major professional associations headquartered in the United States: the American Accounting Association (AAA), the American Institute of Certified Public Accountants (AICPA), Financial Executives International (FEI), the Institute of Internal Auditors (IIA), and Institute of Management Accountants (IMA). https://www.coso.org/
4 Internal Control – Integrated Framework provides principles-based guidance for designing and implementing effective internal controls.
This framework has become the most widely used internal control framework in the U.S. https://www.coso.org/guidance-on-ic Changes for team or department # of ResponseNew/additional staff 33Unfilled positions 28Change in workload 23New software 19Change in organizational structure 17New workflows or business processes 13New or significant changes in information technology systems 13Change in compliance requirements (due to changes in policies/contracts/laws/regulations) 11New vendors and contractors 11Significant changes in processes or controls 7Workforce reduction 7Increased undesirable performance or instances (such as injuries/complaints/customer dissatisfaction/etc.) 6Change in goals/objectives/performance measures 6Change in culture 3Other 4
4 SURVEY RESULTS
Barriers to meeting goals and objectives in FY2024
The COSO Enterprise Risk Management—Integrating with Strategy and Performance5 provides insight into the links between strategy, risk, and performance through 20 principles. Principle 10 states, “the organization identifies risk that impacts the performance of strategy and business objectives.”
The survey participants were asked about their team/department’s periodic reporting on significant goals and compliance requirements to monitor the performance. The pie chart shows the results.
The survey participants were also asked what can possibly prevent their team/department from meeting its goals and objectives in 2024. The results are summarized below.
Top risk areas selected by the survey participants
The survey participants were asked to select and rank the top five risk areas from 31 risk areas listed in the survey. Based on the number of selection and the ranking given by them, the top 15 risk areas were identified.
For the risks they selected:
59.6% of the participants think the City management is aware of the risk, but more efforts are needed to help mitigate the risks. 34.0% of the participants think the City management is aware of the risks and has implemented activities to help mitigate the risks.
6.4% of the participants think the City management is either not aware of the risks or have not developed sufficient activities to help mitigate the risks.
5 Enterprise Risk Management—Integrating with Strategy and Performance addresses the need for organizations to improve their approach to managing risk to meet the demands of an evolving business environment. https://www.coso.org/guidance-erm Rank Risk Area1 Citizen Demands2 Succession Planning3 Economy4 Human Capital Management5 Human Resources6 Procurement/Sourcing7 Security8 Regulatory9 Reputation10 Resource Allocation11 Efficiency12 Document Retention13 Leadership and Authority14 Technologies15 Strategic Change
5 RISK ASSESSMENT RESULTS
Risk Assessment Results
Department Descriptions and Key Risk Areas
When identifying risk areas throughout the City, Baker Tilly considered each department and associated risks.
Based on the concerns described by interviewees and survey respondents, departments’ functions, and their inherent risks, Baker Tilly identified the auditable risk areas for each department. Below is an overview of the City’s departments and their key risk areas.
Administrative Services
The Administrative Services Department provides financial and analytical support to the City. Departmental functions include finance and accounting, purchasing, administration, budget, real estate, and others.
Key Risk Areas
Purchasing card program
Vendor master file
Property management
Grant management
City Attorney’s Office
The City Attorney’s Office provides legal services to the City, including providing legal advice and training to City leaders, negotiating on behalf of the City, drafting contracts and other legal documents, investigating claims, and defending the City in litigation
Key Risk Areas
Identification of legal risks
Contracts and legal documents
City Clerk’s Office
The City Clerk serves as a liaison between the public and City Council. Office functions include Public Records Act requests, public hearings, local elections, board and commission
recruitments, record management, and others.
Key Risk Areas
Election administration
Record management
Council meeting management
City Manager’s Office
The City Manager’s Office provides leadership to the City departments and is responsible for facilitating City Council legislative actions, managing special interdepartmental projects, and more. The Communications Office is housed under the City Manager’s Office and is the primary correspondent between the City and the public.
Key Risk Areas
Citywide risk management
Economic development
Office of Transportation
The Office of Transportation works to enhance quality of life and improve the safety of the users of all modes of transportation.
The Office is responsible for sustainable transportation systems, manage parking, and oversees the City’s traffic and
transportation capital improvement projects.
Key Risk Areas
Intersection safety improvements
Federal Railroad Administration (FRA)
Quiet Zone
Parking permit revenue
Community Services Department
The Community Services Departments offers a variety of
services administered through the following three divisions and the Office of Human Services: Arts and Sciences; Open Spaces, Parks, and Golf; and Recreation.
Key Risk Areas
Human Services Resource Allocation
Process (HSRAP)
Junior Museum and Zoo (JMZ)
Operation
Contract management
6 RISK ASSESSMENT RESULTS
Fire
The Fire Department oversees emergency response such as ambulance transports and fire response/rescue, emergency protection services such as fire prevention, and hazardous materials planning. The department highlights safeguarding the community and compassionate care.
Key Risk Areas
Emergency Preparedness (Foothills
Fire Master Plan)
Safety and Wellness
Human Resources
The Human Resources Department is responsible for recruiting, developing, and retaining a well-qualified and professional workforce. The Department ensures compliance with relevant labor laws, adheres to record keeping practices, and serves as a strategic partner for executive decision making.
Key Risk Areas
Recruitment
Succession Planning
HR Strategy & Risk Management
Workplace Safety
Information Technology
The Information Technology Department's provides innovative technology solutions that support City departments. The department oversees IT project management, operations,
enterprise systems, and security services.
Key Risk Areas
- PCI/DSS Compliance
- AMI Implementation
- ERP Upgrade
Library
The Library Department operates five libraries throughout the City, each offering unique resources. The Library provides educational programming, multi-cultural events, and large and diverse book, information and technology resources.
Key Risk Areas
Operations
Events and Programming
Office of Emergency Services
The Office of Emergency Services is designed to prevent, prepare for, and recover from various hazards. The Office is responsible for overseeing various risk management programs.
Key Risk Areas
Emergency preparedness (Foothills Fire
Mitigation Program)
Planning and Development Services
The Planning Department supports the City in land use
development, planning, transportation, housing and
environmental policies, and plans and programs that “maintain and enhance the City as a safe, vital, and attractive community”.
Key Risk Areas
Building Permit & Inspection
Zoning Ordinance
Code Enforcement
Long Range Planning
Police
Palo Alto’s Police Department oversees technical services such as dispatch and record management, field services such as patrol and emergency response, and animal control. The Police Department also places a high value on community relations.
Key Risk Areas
Crime Reduction
Psychiatric Emergency Response Team
(PERT) Program
Safety and Wellness
Training
Public Works
The Public Works Department is broken into four divisions:
Engineering, Airport, Public Services, and Environmental Services. The Divisions are responsible for a variety of tasks
Key Risk Areas
Wastewater treatment capital program
7 RISK ASSESSMENT RESULTS
Overall Risk Scoring Distribution
Baker Tilly structured the audit universe based on the department/division/program from the budget document and management’s feedback, which resulted in 96 auditable units (Appendix A). We scored them based on the information gathered for each risk factor related to the likelihood, impact, or fraud. Appendix B lists the risk factors, definitions, and scoring method. The maximum score for an auditable unit is 30. The following chart shows the distribution of overall risk scoring.
Baker Tilly rated the auditable units as follows:
High Risk – Scores 14 and above
Moderate Risk – Scores more than 9 and less than 14
Low Risk – Scores below 9
Listed in the following page are the auditable units with a score over 13 (out of 30) based on our scoring. The list includes 27 functions rated as high risk (with a score between 14 and 30) and 13 functions rated as moderate risk (with a score between 13 and 14). In determining the audit activities to be performed in FY2024, we further review specific risks and functional areas and consider risk-based priorities as well as other factors such as requirements by law or regulation, timing of activities, special projects, and requests from City Council and management. The proposed audit plan will be included in a separate FY2024 Annual Audit Plan Report.
72643164SCORE ≤ 5 5 - 10 10 - 15 15 - 20 > 20
including design and implementation of capital projects, maintenance of City-owned and leased structures, and
management of the solid waste programs.
The Americans with Disabilities Act
(ADA) compliance
Flood protection capital project
Airport Operations
Utilities
The Utilities Department owns and operates electric, gas, water, wastewater and fiber optic services to the City. The City purchases all their power from external sources. The mission of the Department is to “provide safe, reliable, environmentally sustainable and cost effective services.”
Key Risk Areas
Power Purchase Agreements
Utility Billing
Rate Setting and Adjustment
Utility Asset Management
8 Department Function Risk Area Total Risk ScorePlanning and Development Services Building Building Permit & Inspection Process 22.8Public Works Wastewater Treatment Wasterwater Treatment Capital Program 22.4Planning and Development Services Development Services Building Permit & Inspection Process 20.5Public Works Structures and Grounds ADA Compliance / Flood protection capital project 20.0Administrative Services Purchasing Purchasing Card Program / Vendor Master File 18.6Police Field Services Psychiatric Emergency Response Team (PERT) Program 18.2Utilities Electric Administration Power Purchase Agreement 18.2Community Services Administration and Human Services Human Services Resource Allocation Process (HSRAP) 18.0Community Services Arts and Sciences Junior Museum and Zoo (JMZ) Operation 18.0Community Services Recreation and Cubberley Contract Management 18.0Police Technical Services 911 Operations 17.2Community Services Animal Shelter Contract Management 16.9Fire Emergency Response Emergency Preparedness (Foothills Fire Master Plan) 15.8City Manager Administration and City Management Citywide Risk Management 15.6Fire Administration Safety and Wellness 15.6Planning and Development Services Planning and Transportation Code Enforcement 15.4Office of Transportation Programs Intersection safety improvements 15.4Utilities Electric Engineering (Operating) Utility Asset Management 15.3Public Works Airport Airport Operations 15.1Human Resources Administration, Employee Org Development and HR Systems HR Strategy / Succession Planning 15.1Police Police Personnel Selection Recruitment and retention 14.9Administrative Services Treasury / Revenue Collection / Warehouse Investment Management 14.9Administrative Services Real Estate Property Management 14.7Public Works Engineering Services Animal Shelter Renovation 14.3Community Services Open Space, Parks and Golf Emergency Preparedness (Foothills Fire Master Plan) 14.1Information Technology Operations PCI/DSS Compliance 14.1Administrative Services Accounting Grant Management 14.0Office of Emergency Services Emergency Services Emergency preparedness (Foothills Fire Mitigation Program) 13.9Utilities Electric Customer Service Utility Billing 13.9Information Technology Project Services AMI Implementation 13.8Library AdministrationBusiness Operations (Donations and grants; Inventory Management; Fines, Purchasing, etc.)13.8Human Resources Risk Mgmt., Safety, Workers' Compensation HR Risk Management / Workplace Safety 13.8Police Law Enforcement Services Evidence 13.8Utilities Water Customer Service Utility Billing 13.6City Manager Economic Development Economic Development 13.4Human Resources Recruitment Recruitment Process 13.3Utilities Electric Resource Management Rate setting and adjustments 13.2Public Works Administration Safety and Wellness 13.0Utilities Gas Customer Service Utility Billing 13.0Utilities Fiber Optics Customer Service Utility Billing 13.0
9 Appendix A: Resumes
Appendices
10 Appendix A: Audit Universe
City Attorney’s Office
Administration
Consultation and Advisory
Litigation and Dispute Resolution
Official and Administration Duties
City Clerk’s Office
Administration
Administrative Citations
Council Support Services
Election/Conflict of Interest
Legislative Records Management
City Manager’s Office
Administration and City Management
Economic Development
Public Communication
Administrative Services Department
Accounting
Administration
Office of Management and Budget
Printing and Mailing
Purchasing
Real Estate
Treasury/Revenue Collection/Warehouse
Community Services Department
Administration and Human Services
Animal Shelter
Aquatics
Arts and Sciences
Open Space, Parks and Golf
Recreation and Cubberley
Fire Department
Administration
Emergency Response
Environmental Safety Management
Records and Information Management
Training and Personnel
Human Resources Department
Administration, Employee Org Development and HR Systems Benefits and Compensation
Employee and Labor Relations
Recruitment
Risk Management, Safety, Workers’ Compensation
Information Technology Department
Enterprise Systems
Office of the CIO
Operations
Project Services
Library Department
Administration
Collection and Technical Services
Public Services
Office of Emergency Services
Emergency Services
Office of Transportation
Administration
Parking Districts
Programs
Special Revenue Funds
Planning and Development Services Department
Administration
11 Building
Development Services
Planning and Transportation
Special Districts
Police Department
Administration
Animal Control
Field Services
Investigations and Crime Prevention Services
Law Enforcement Services
Parking Services
Police Personnel Selection
Technical Services
Traffic Services
Department of Public Works
Administration
Airport
Engineering Services
Refuse
Storm Drainage
Streets
Structures and Grounds
Sustainability
Trees
Vehicle Replacement and Maintenance
Wastewater Treatment
Utilities Department
Electric Administration
Electric Customer Service
Electric Demand Side Management
Electric Engineering (Operating)
Electric Operations and Maintenance
Electric Resource Management
Fiber Optics Administration
Fiber Optics Customer Service
Fiber Optic Operations and Maintenance
Gas Administration
Gas Customer Service
Gas Demand Side Management
Gas Engineering (Operating)
Gas Operations and Maintenance
Gas Resource Management
Wastewater Collection Administration
Wastewater Collection Customer Service
Wastewater Collection Engineering (Operating)
Wastewater Collection Operations and Maintenance
Water Administration
Water Customer Service
Water Engineering (Operating)
Water Operations and Maintenance
Water Resource Management
12 Appendix B: Risk Factor Definition
Factor Definition WeightMagnitudeA measure of materiality based on pervasiveness or volume of dollars or transactions; Scores based on the budgeted expenditure amountExtreme - 5: $50M or moreMaterial - 4: $10M or more; Less than $50MSignificant - 3: $3M or more; Less than $10MModerate - 2: $1M or more; Less than 3M30%Customer / Resident ExperienceNegative experience by customers and residents, such as perceived or actual safety concerns and unsatisfactory services, impacts negatively on the reputation / credibility of the organizationExtreme - 5: Direct impact on health and safetyMaterial - 4: Direct impact on transparencySignificant - 3: Direct impact on customer satisfaction/City's reputationModerate - 2: Indirect impact on customer satisfaction/City's reputationInconsequential - 1: Immaterial impact on reputation / credibility35%Achievement of Organizational GoalsThe greater the effect that a department or process has on the organization meeting strategic objectives and goals, the greater the related risksExtreme - 5: Directly relates to the City Council PrioritiesMaterial - 4: Supports the function/process directly related to the City Council Priorities Significant - 3: Has performance/workload measures related to City Council Priorities Moderate - 2: Somewhat relates to the City Council PrioritiesInconsequential - 1: Does not relate to City's City Council Priorities35%100%ComplexityA measure of the difficulty in performing a process or function. As a process or function becomes more complex, the greater the opportunity for errors5 - Very high complexity4 - High complexity3 - Medium complexity2 - Low complexity1 - Very low complexity25%Policies and ProceduresPolicies and Procedures are a complete set of written instructions that guide personnel in the successful execution of their duties and the duties of the office for which they work. If the policies and procedures are adequate and up-to-date, a risk is lower5 - No or little written P&P4 - Some written P&P3 - Basic P&P requiring improvements2 - Adequate but outdated P&P10%Regulatory ComplianceMeasures the existence of and potential noncompliance with, government regulations and other applicable laws, standards, and policies/procedures5 - Requirements to meet more than a few laws/regulations and professional standards specific to the division's responsibilities 25%MonitoringConsider the existence of monitoring activities, including the results of last audits by Internal Auditor, External Auditor, Regulators, etc. and other known deficiencies5 - Overall, there is no mechanism to monitor the status of performance goals/compliance requirements 3 - For only some of significant performance goals/compliance requirements, there is a periodic reporting process to ensure performance goals/compliance requirements are met1 - For all significant performance goals/compliance requirements, there is a periodic reporting process to ensure performance goals/compliance requirements are met10%Specific RisksConsider the existence of specific risk events/conditions and their significance5 - Identified risk event(s)/condition(s) seem to significantly affect the likelihood3 - Identified risk event(s)/condition(s) seem to have some impact on the likelihood1 - No or very minor risk event(s)/condition(s) have been identified30%100%Fraud SchemesConsider the susceptibility to fraud, which is the opportunity for employees/vendors/customers/fraudsters to misappropriate resources or defraud the organization*5 - High Risk3 - Moderate Risk1 - Low Risk100%100%HIGHEST TOTAL SCORE 30* Considered fraud schemes listed in the Fraud Tree provided in the “Occupational Fraud 2022: A report to the Nations” by Association of Certified Fraud Examiners. Also considered are cyber fraud schemes.
Impact Factors (the effect on the organization) HIGHEST TOTAL SCORE FOR IMPACT: 5Likelihood Factors (the probability of the risk occurring) HIGHEST TOTAL SCORE FOR LIKELIHOOD: 5Other Risk FactorHIGHEST TOTAL SCORE FOR OTHER: 5
13 Appendix C: Survey Questions
The Office of City Auditor is conducting the 2023 Risk Assessment to identify and prioritize risks in order to update the annual audit plan. As part of our 2023 Risk Assessment, we are conducting a survey. This survey is used primarily to collect information related to changes in operations, emerging issues and risks the City faces, and to gather your perspective on key risks faced by your department. Your candid responses would be greatly appreciated to assess the risks that prevent the City of Palo Alto from achieving its mission, goals, and objectives.
Questions 1-7 remain the same for both options.
1. Please provide your name, title, department, and email address:
Name
Title
Department
o City Council
o City Attorney
o City Manager’s Office – Other than Transportation
o City Manager’s Office – Transportation
o Administrative Services
o City Clerk’s Office
o Community Services
o Emergency Services
o Fire
o Human Resources
o Information Technology
o Library
o Planning
o Police
o Public works
o Utilities
Email address
2. Describe any significant changes for your team or department during last 12 months. Select all that apply.
New software
New workflows or business processes
Significant changes in processes or controls
New or significant changes in information technology systems Change in organizational structure
Change in culture
Workforce reduction
Unfilled positions
New/additional staff
New vendors and contractors
Change in workload
Change in compliance requirements (due to changes in policies, contracts, laws, or regulations) Change in goals, objectives, or performance measures
Increased undesirable performance or instances (such as injuries, complaints, customer dissatisfaction, etc.)
Change in any risks previously identified for your team/department
14 Other (please specify)
3. Describe the complexity of the key processes in your team or department:
Complexity is a measure of the difficulty in performing a process or function. As a process or function becomes more complex, the greater the opportunity for errors. Very high complexity
High complexity
Medium complexity
Low complexity
Very low complexity
Please provide any comment related to complexity, if any.
4. Are there adequate and up-to-date documented policies and procedures to perform your job responsibilities?
Yes, documented policies and procedures are adequate and up-to-date Documented policies and procedures are adequate but not updated regularly Documented policies and procedures need improvement
No – Please describe how the responsibilities and requirements are communicated in a clear and consistent manner.
5. Please select the compliance requirements with applicable Federal/State/Local laws and regulations and professional standards (e.g. CEQA, NERC, OSHA, EMT licensure/certification) for each of divisions/functions of your department listed below:
More than a few laws/regulations and/or professional standards specific to the division's responsibilities need to be met
One or two laws/regulations and/or professional standards specific to the division's responsibilities need to be met
No requirement to meet any laws/regulations or professional standards specific to the division's responsibilities
6. Describe what can possibly prevent your team/department from meeting its goals and objectives in 2024. Select all that apply.
Financial constraints
Staffing constraints
Limited skills, knowledge, experience, training
Technology issue
Inefficiency in process and/or communication
Ambiguity in roles and responsibilities
Lack of, or ineffective, internal controls
Community pressure
State/Federal regulations
Other (please specify)
7. Describe the activities to monitor the achievement of the goals in your team or department:
Example – Periodic reporting, periodic meetings, spot checks by management, periodic audits by external organizations such as consultants and the Federal government, etc. For all significant performance goals/compliance requirements, there is a periodic reporting process to ensure performance goals/compliance requirements are met For only some of significant performance goals/compliance requirements, there is a periodic reporting process to ensure performance goals/compliance requirements are met Overall, there is no mechanism to monitor the status of performance goals/compliance requirements
15 Please provide comments related to monitoring the achievement of your department’s goals, if any.
To help us identify potential risks, please list your team/department’s Strengths, Weaknesses, Opportunities, and Threats (SWOT) for achieving its missions, goals, and objectives. Typically, strengths and weaknesses are internal aspects of team/department/organization, while opportunities and threats are found externally.
8. Describe up to three STRENGTHS of your team or department:
Strengths refer to the resources or capabilities that help the team/department accomplish its mission and serve the public. These can be things like competitive advantages, available resources, engaged community, strong balance sheet, utilized technology and so on.
9. Describe up to three WEAKNESSES of your team or department:
Weaknesses refer to the areas where the team/department needs to improve to accomplish its mission.
These can include things like deficiencies in resources and capabilities, inefficient use of available technologies, barriers or inability to collaborate among different departments, lack of effective communication, mission or direction, high levels of debt, financial or human resources constraints and so on.
10. Describe up to three OPPORTUNITIES for your team or department:
Opportunities are any area where the team/department can grow. They are often related to the organization’s strengths. Outside factors that affect the organization in a favorable way can include things like; offering more products or services to citizens, lower costs through new technology and so on.
11. Describe up to three THREATS for your team or department:
Threats include the local or national economy, laws and regulations and any other external issue that can harm or affect the team/department successfully meeting goals. Common threats include things like rising costs for housing/living, increasing competition, tight labor supply, billing rates and so on.
12. Using the bulleted list within the risk framework below, please select what you consider to be the top five enterprise risks to the City of Palo Alto.
Environmental (factors external to the organization)
• Reputation - The opinions and perceptions of the public and customers toward the organization. • Regulatory - Laws and standards, which the organization must comply with in its operations. • Citizen Demands - The effect that current citizens demands have on the decisions made by management for aligning tactical plans with the business strategy and the allocation of resources. • Economy - The effect that current external conditions have on the decisions made by management for aligning tactical plans with the business strategy and the allocation of resources. • Legal - The potential for an unforeseen event to cause civil or criminal litigation for the organization or its elected leaders, directors, officers, and employees.
• Technologies - The evolution of technology both within and outside of the organization’s industry.
Strategy (planning and decision-making)
• Strategic Change - The ability of the organization to modify its processes in order to either align with its current strategy and business model or to achieve a different strategic goal. • Investments - The portfolio of both intangible and tangible investments held by the organization, and the implications of these assets on the resources, financial viability, and operations of the organization. The effect on liquidity the ability of current assets to meet current liabilities when due.
• Planning and Budgeting - Details of the organization’s goals and the financial management necessary to achieving those goals.
• Financial - The goals of the organization in terms of the structure of its assets and liabilities, including the financing capability based on its credit worthiness, the ability to receive credit and the use of credit lines to achieve its business objectives. • Inter-government Relations - The relationship of the organization with other government agencies that have regulatory and oversight responsibilities and shared services or citizens.
16 • Compliance Management - The continuous monitoring of the organization’s ability to operate within regulatory requirements and community standards.
• Resource Allocation – The process for assigning and managing assets that support the organizations strategic goals.
Organization (attributes of departments)
• Governance - The role, composition, and major activities of the governing body of the organization in providing direction and oversight for the organization
• Empowerment and Values - The ability of senior members of the organization to effectively delegate power or authority to other members of the organization.
• Communication - The methods of communication commonly used in the organization and the effectiveness of this communication on the operations of the organization.
• Ethics and Code of Conduct - The set of rules outlining the ethical practices expected of management and employees of the organization.
• Leadership and Authority - The members of the organization who hold power and their ability to exercise this power effectively.
• Organizational Structure - The configuration of units and workflows to align the behavior of the units to the higher-level goals of the organization.
• Succession Planning - The planning and processes to ensure that there are highly qualified people in key leadership positions today and in the future.
• Human Capital Management - The set of practices an organization uses for recruiting, managing, developing, and optimizing employees, including performance management (The process of creating expectations for performance, monitoring progress, and measuring the results) and training (The ability for employees to gain and develop necessary tools to ensure effective operations).
• Safety - The organization strives to provide a safe working environment by effectively mitigating the risks to the safety of its employees.
Process and Operations (functional effectiveness and policies and procedures) Externa • Contracts - Contracts are adequately structured to address and mitigate risks. • Efficiency - Processes are up-to-date and efficient, resulting in efficient operations and output. • Accounting - The timely and accurate tracking of the financial position of the organization. • Payroll - The policies, processes, and systems in place to ensure that employee compensation is reliable, timely, and accurate.
• Fraud - The organization uses internal controls to prevent and/or detect fraud. • Procurement/Sourcing – The ability to acquire the necessary goods and services for operation and the process of vetting, selecting and managing supplier, vendors and contractors. • Human Resources - The knowledge, skills and experiences, and resources among personnel, which allow for the execution of the organization’s business plan and achievement of its critical success factors. • Information Systems - The facilities, systems, and connectivity in place to support data processing. • Vendor Management - The need for the organization to continuously monitor the quality and reliability of vendors it uses in the course of its business.
• Change Management - Management adapts appropriately to the evolution of the processes and operations of the organization.
Information (data governance)
• Data Integrity - Data used for making management decisions, recording information, and reporting financial activity is accurate, complete, and reliable.
• Access - The right to view or manipulate data is carefully granted and monitored to prevent the mishandling of data • Retention - The policies used by the organization to determine document retention in terms of the form of documents, how these documents are stored, and for how long these should be maintained. • Availability - Relevant critical information is available when needed in order to maintain the organization’s critical operations and processes, including when a disaster or unplanned disruption occurs • Privacy - Organization policies are in place to ensure the correct treatment of sensitive information held by the organization. • Security – Any event that could result in the compromise of organizational data. (I.e. unauthorized use, loss, damage, disclosure or modification of organizational data).
17 13. Please use the click and drag feature to rank the five enterprise risks that you selected into a priority order, with #1 being the highest.
14. Please describe why you selected them as the top five risks.
15. How well does the City of Palo Alto manage activities to mitigate these risks? Well – the City management is aware of the risk and has implemented activities to help mitigate this risk Somewhat well – the City management is aware of this risk, but more effort/activities are needed to help mitigate this risk
Not well – the City management is either not aware of this risk or hasn’t developed sufficient activities to help mitigate this risk
16. Are there any other risks that could affect operations that were not included in the risk framework?
17. Please list any potential internal audit activities you recommend based on the risks you identified.
The projects can be consultative/advisory in nature, or provide assurance:
Internal Audit – an objective examination of evidence for the purpose of providing an independent assessment on governance, risk management, and control processes for the organization. Advisory and related client service activities, the nature and scope of which are intended to add value and improve an organization’s governance, risk management, and control processes without the internal auditor assuming management responsibility.