3 6
3 2
City Council
Staff Report
From: City Manager
Report Type: CONSENT CALENDAR
Lead Department: City Auditor
Meeting Date: January 22, 2024
Report #:2311-2304
TITLE
Approval of Office of City Auditor Risk Assessment and Audit Plan (CEQA Status - Not a Project)
RECOMMENDATION
The Policy and Services Committee and City Auditor recommend that City Council approve the following reports:
1) Fiscal Year 2023/24 Risk Assessment Report
2) Fiscal Year 2023/24 Audit Plan Report
3) Task Orders identified in the Audit Plan Report
oTASK ORDER FY24-4.21 Purchasing Card Program
oTASK ORDER FY24-4.22 ADA Compliance Review
oTASK ORDER FY24-5 Various Reporting & City Hotline (Modified)
EXECUTIVE SUMMARY
Baker Tilly interviewed City Council members and executive leadership across 14 departments within the City. In addition, selected directors and managers were asked to complete a survey that provided their view of top risk areas to their departments and the City as a whole. Baker Tilly analyzed the results of the survey and other data and information gathered.
The risk assessment involved scoring and ranking the 97 auditable units to identify the audit areas with high to moderate risks. The FY2023/24 Audit Plan was prepared based on the results of the risk assessment, conversations with leadership, and other matters.
BACKGROUND
The Palo Alto Municipal Code (Section 2.08.1301) requires the City Auditor to prepare and submit an annual audit plan to the City Council for review and approval. In its capacity serving 1 https://codelibrary.amlegal.com/codes/paloalto/latest/paloalto_ca/0-0-0-60361
3 6
3 2
as the City Auditor function, and in accordance with Baker Tilly’s agreement with the City2, Baker Tilly performed a citywide risk assessment (Task 2 of the agreement). The purpose of the assessment was to identify and prioritize risks in order to develop the annual audit plan (Task 1). During the risk assessment, Baker Tilly assessed a wide range of risk areas, including strategic, financial, technology, human capital, operational, reputational, economic, and compliance risk categories.
During the Policy and Services Committee meeting on December 12, 20233, the council members approved the attached Risk Assessment Report and Audit Plan Report.
MOTION: Chair Tanaka moved, seconded by Mayor Kou, to approve the Office of the City Auditor Risk Assessment Report and FY2024 Audit Plan Report and recommend the City Council accept the following reports:
1) Fiscal Year 2023/24 Risk Assessment Report
2) Fiscal Year 2023/24 Audit Plan Report
3) Task Orders identified in the Audit Plan Report
o TASK ORDER FY24-4.21 Purchasing Card Program
o TASK ORDER FY24-4.22 ADA Compliance Review
o TASK ORDER FY24-5 Various Reporting & City Hotline (Modified) MOTION PASSED: 2-0
ANALYSIS
For Baker Tilly to execute the approved audit plan, the Task Orders will need to be signed by the Policy & Services Committee Chair upon approval of the audit plan by City Council. Per the contract with Baker Tilly, the P&S Chair is authorized to sign task orders that follow the approved annual audit workplan.
Furthermore, one of the OCA’s responsibilities is to follow up on management’s corrective actions. The follow-up activities require periodic inquiries with management on outstanding corrective actions and verifying implementation of the corrective actions as well as testing of the effectiveness of the implemented controls. As Task 5 of Baker Tilly’s agreement with the City includes the OCA’s annual report on the status of recommendations made in completed audits, the estimated costs for the follow-up activities on recommendations need to be allocated to the Task 5 budget. Therefore, modified TASK ORDER FY24-5 Various Reporting & City Hotline has been prepared to transfer the amount for the estimated costs of $30,592 for the follow-up activities (as shown as a line item in the Proposed Audit Plan for FY2024) from Task 4 to Task 5.
2 https://www.cityofpaloalto.org/files/assets/public/v/1/agendas-minutes-reports/reports/city-manager-reports- cmrs/year-archive/2020-2/id-11624.pdf?t=64761.15
3 https://cityofpaloalto.primegov.com/Portal/Meeting?meetingTemplateId=12186 3 6
3 2
FISCAL/RESOURCE IMPACT
The timeline for risk assessment and the audit plan is to complete within FY2024. The proposed audits in the audit plan are within the contract amount for FY2024. Specifically, below is a summary of the task orders seeking approval financial impacts, all estimated to be completed by June 30, 2024:
•TASK ORDER FY24-4.21 Purchasing Card Program in the amount of $76,540 •TASK ORDER FY24-4.22 ADA Compliance Review in the amount of $73,110 •TASK ORDER FY24-5 Various Reporting & City Hotline (Modified) revise from $90,000 to a total not to exceed of $120,592
STAKEHOLDER ENGAGEMENT
The Office of the City Auditor worked with Executive Leaders from 14 departments across the City and engaged the City Council.
ENVIRONMENTAL REVIEW
Environmental review is not applicable to this activity.
ATTACHMENTS
Attachment A: OCA – FY2023/24 Risk Assessment Report
Attachment B: OCA – FY2023/24 Annual Audit Plan Report
APPROVED BY:
Adriane D. McCoy, City Auditor