1 May 15, 2025
City of Palo Alto
Office of the City Auditor
FY2025 Annual Risk Assessment
Contents
Baker Tilly Advisory Group, LP and Baker Tilly US, LLP, trading as Baker Tilly, operate under an alternative practice structure and are members of the global network of Baker Tilly International Ltd., the members of which are separate and independent legal entities. Baker Tilly US, LLP is a licensed CPA firm that provides assurance services to its clients. Baker Tilly Advisory Group, LP and its subsidiary entities provide tax and consulting services to their clients and are not licensed CPA firms.
INTRODUCTION ...............................................................................................................1 RISK ASSESSMENT APPROACH...................................................................................2 RISK ASSESSMENT RESULTS ......................................................................................3 APPENDICES ...................................................................................................................9
1 Introduction
Overview
According to City Ordinance of the City of Palo Alto (the City), the mission of the Office of the City Auditor (OCA) is to promote honest, efficient, effective, economical, and fully accountable and transparent city government. To fulfill this mission, the OCA conducts performance audits and performs financial/operational analyses of city departments, programs, services, or activities as approved by the City Council. (Section 2.08.130). In its capacity serving as the City Auditor function, and in accordance with Baker Tilly’s agreement with the City (Task #1 of the agreement), Baker Tilly Advisory Group, LP (Baker Tilly) conducted the fiscal year (FY) 2025 citywide risk assessment in order to develop the FY2026 annual audit plan (Task #2).
The California Government Code Section 1236 requires all cities that conduct audit activities to conduct their work under the general and specified standards prescribed by the Institute of Internal Auditors (IIA) or the Government Auditing Standards (GAO) issued by the Comptroller General of the United States, as appropriate.
According to the IIA Standard 2010, the head of internal audit function “must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization’s goals” and consider the input of senior management and a governing board.
The purpose of the risk assessment is to develop an internal audit plan that assigns internal audit resources to the activities that add the most value to the City. The risk assessment process involves identifying, measuring, and prioritizing risks associated with the audit universe (list of specific departments, functions, processes, programs, etc. that can be subject to an audit). Risk is defined as “the possibility of an event or condition occurring that will have an impact on the ability of an organization to achieve its objectives.”1 Due to management changes in the OCA at the end of FY2024, the FY2024 Risk Assessment was delayed and presented to City Council for approval in December 2024. As the FY2025 risk assessment is being conducted just 6 months later, the OCA conducted an assessment process to preserve City resources. The OCA surveyed City Council, Executive Leadership Team and other key management staff across the organization. OCA received responses from 11 departments. This report summarizes our risk assessment methodology, analysis, and results. The FY2026 annual audit plan is based on the results of this risk assessment.
Through the risk assessment, we observed certain strengths of the City. Key strengths include:
Commitment to public service by a dedicated and highly professional management team High value placed on efficient and effective government Focus on strategic planning and implementation
Demonstrated investment in innovation and commitment to sustainability Dedication to continuous improvement
Risk Assessment Process Considerations
The starting point of internal auditing is to conduct a risk assessment that is the basis for determining internal audit activities. However, it is not a one-size-fits-all process. The scope and complexity of the risk assessment are affected by various factors such as the maturity level of the internal audit function’s products and services, the organization’s enterprise risk management efforts, coordination with other monitoring and risk management functions, and the stakeholders’ expectations. As every organization is subject to a changing environment, the results of the annual risk assessment represent the information considered at the time of the assessment.
In addition to the annual macro-level risk assessment, the internal audit function is required to perform an engagement-level risk assessment when starting each audit listed in the approved audit plan. The IIA Standard 2200 states, “Internal auditors must develop and document a plan for each engagement, including the engagement’s objectives, scope, timing, and resource allocations. The plan must consider the organization’s strategies, objectives, and risks relevant to the engagement.” 1 Rick A. Wright Jr., CIA, “The Internal Auditor’s Guide to Risk Assessment” The Institute of Internal Auditors Research Foundation (IIARF), 2018
2 Risk Assessment Approach
Baker Tilly’s risk assessment approach this year focused on gathering information from the following inputs:
•Surveying City Council, Executive Leadership Team members and other key management staff •Analyzing key documents such as City Council Priorities, budget documents, the annual comprehensive financial report, and other relevant documents
•Updating the risk assessment matrix with the gathered information •Scoring the auditable units (listed in Appendix A) in the risk assessment matrix based on the likelihood and impact of potential adverse events
•Identifying potential internal audit topics for the auditable units with high-risk scores •Summarizing the approach and results for presentation
At the start of our contract with the City, Baker Tilly conducted an initial comprehensive risk assessment in FY2021 by interviewing all Council Members and Executive Leadership Team (ELT) members to create a risk assessment matrix. Each year, this matrix is updated to redevelop a comprehensive picture of the risk landscape which is continuously changing. For FY2025, Baker Tilly conducted a survey of City Council, ELT and other management staff, as well as meeting with available City Council members to identify strategic and operational challenges and risks.
While the risk assessment primarily measures inherent risk (the risk without mitigating controls/factors) for each risk factor, it also considers specific risks based on the above information and the City’s processes, controls, and other factors surfaced through internal audit activities. Using the information gathered, OCA identified risks and determined the likelihood and impact of those risks. 3 Risk Assessment Results
Department Descriptions and Key Risk Areas
When identifying risk areas throughout the City, Baker Tilly considered each department and associated risks.
Based on the concerns described by interviewees, departments’ functions, and their inherent risks, Baker Tilly identified the auditable risk areas for each department. Below is an overview of the City’s departments and their key risk areas.
Administrative Services
The Administrative Services Department provides financial and analytical support to the City. Departmental functions include finance and accounting, purchasing, administration, budget, real estate, and others.
Key Risk Areas
Purchasing Card Program
Procurement Process
Property Management
Contract & Consultant Oversight
City Attorney’s Office
The City Attorney’s Office provides legal services to the City, including providing legal advice and training to City leaders, negotiating on behalf of the City, drafting contracts and other legal documents, investigating claims, and defending the City in litigation
Key Risk Areas
Identification of Legal Risks
Contracts & Legal Documents
Public Records Act
City Clerk’s Office
The City Clerk serves as a liaison between the public and City Council. Office functions include Public Records Act requests, public hearings, local elections, board and commission
recruitments, record management, and others.
Key Risk Areas
Election Administration
Record Retention & Management
Council Meeting Management
City Manager’s Office
The City Manager’s Office provides leadership to the City departments and is responsible for facilitating City Council legislative actions, managing special interdepartmental projects, and more. The Communications Office is housed under the City Manager’s Office and is the primary correspondent between the City and the public.
Key Risk Areas
Citywide Risk Management
Government Efficiency
Economic Development
Strategic Planning
Consultant Management
Office of Transportation
The Office of Transportation works to enhance quality of life and improve the safety of the users of all modes of transportation.
The Office is responsible for sustainable transportation systems, managing parking, and oversees the City’s traffic and
transportation capital improvement projects.
Key Risk Areas
Traffic Safety Improvements
Federal Railroad Administration (FRA)
Quiet Zone
Transit-Related Growth
Community Services Department
The Community Services Departments offers a variety of
services administered through the following three divisions and the Office of Human Services: Arts and Sciences; Open Spaces, Parks, and Golf; and Recreation.
Key Risk Areas
Human Services Resource Allocation
Process (HSRAP)
Junior Museum and Zoo (JMZ)
Operation
Equipment & Materials Management
4 Fire
The Fire Department oversees emergency response such as ambulance transports and fire response/rescue, emergency protection services such as fire prevention, and hazardous materials planning. The department highlights safeguarding the community and compassionate care.
Key Risk Areas
Emergency Preparedness (Foothills
Fire Master Plan)
Staffing
Fleet Electrification
Human Resources
The Human Resources (HR) Department is responsible for
recruiting, developing, and retaining a well-qualified and professional workforce. The Department ensures compliance with relevant labor laws, adheres to record keeping practices, and serves as a strategic partner for executive decision making.
Key Risk Areas
Recruitment
Succession Planning
HR Strategy & Risk Management
Workplace Safety
Information Technology
The Information Technology Department's provides innovative technology solutions that support City departments. The department oversees IT project management, operations,
enterprise systems, and security services.
Key Risk Areas
- PCI/DSS Compliance
- AMI Implementation
- ERP Upgrade
- Adoption & Integration of New Tech
Library
The Library Department operates five libraries throughout the City, each offering unique resources. The Library provides educational programming, multi-cultural events, and large and diverse book, information and technology resources.
Key Risk Areas
Operations
Events and Programming
Volunteer Engagement
Office of Emergency Services
The Office of Emergency Services is designed to prevent, prepare for, and recover from various hazards. The Office is responsible for overseeing various risk management programs.
Key Risk Areas
Emergency Preparedness (Foothills
Fire Mitigation Program; Evacuation
Plans, COOPs, Interlocal Agreements)
Training Compliance
Planning and Development Services
The Planning Department supports the City in land use
development, planning, transportation, housing and
environmental policies, and plans and programs that “maintain and enhance the City as a safe, vital, and attractive community”.
Key Risk Areas
Building Permit & Inspection Processes
Building Permit & Inspection Fees
Zoning Ordinance
Code Enforcement
Long Range Planning
Below Market Rate Housing
Police
The Police Department oversees technical services such as dispatch and record management, field services such as patrol and emergency response, and animal control. The Police
Department also places a high value on community relations.
Key Risk Areas
Crime Reduction
Psychiatric Emergency Response Team
(PERT) Program
Safety and Wellness
Training
Staffing
5 Overall Risk Scoring Distribution
Baker Tilly structured the audit universe based on the department/division/program from the budget document and management’s feedback, which resulted in 96 auditable units (Appendix A). We scored them based on the information gathered for each risk factor related to the likelihood, impact, or fraud. Appendix B lists the risk factors, definitions, and scoring method. The maximum score for an auditable unit is 30. The following chart shows the distribution of overall risk scoring.
Baker Tilly rated the auditable units as follows:
•High Risk – Scores 14 and above
•Moderate Risk – Scores more than 9 and less than 14
•Low Risk – Scores below 9
Listed in the following pages are the auditable units with a score over 12 (out of 30) based on our scoring. The list includes 26 functions rated as high risk (with a score between 14 and 30) and 49 functions rated as Public Works
The Public Works Department is broken into four divisions:
Engineering, Airport, Public Services, and Environmental Services. The Divisions are responsible for a variety of tasks including design and implementation of capital projects, maintenance of City-owned and leased structures, and
management of the solid waste programs.
Key Risk Areas
Wastewater Treatment Capital Program
The Americans with Disabilities Act
(ADA) Compliance
Flood Protection Capital Project
Fleet Operations
Airport Operations
Utilities
The Utilities Department owns and operates electric, gas, water, wastewater and fiber optic services to the City. The City purchases all their power from external sources. The mission of the Department is to “provide safe, reliable, environmentally sustainable and cost effective services.”
Key Risk Areas
Power Purchase Agreements
Utility Billing
Fiber Optics Billing & Rates
Rate Setting and Adjustment
Utility Asset Management
Reserves
21 49
26 2 - 8 (LOW) 9 - 13 (MODERATE) 14 - 30 (HIGH)
6 moderate risk (with a score between 9 and 14). In determining the audit activities to be performed in FY2026, we further evaluated specific risks and functional areas and considered risk-based priorities as well as other factors such as requirements by law or regulation, timing of activities, special projects, and requests from City Council and management. The proposed audit plan will be included in a separate FY2026 Annual Audit Plan Report.
7 8
9 Appendix A: Resumes
Appendices
10 Appendix A: Audit Universe
City Attorney’s Office
Administration
Consultation and Advisory
Litigation and Dispute Resolution
Official and Administration Duties
City Clerk’s Office
Administration
Administrative Citations
Council Support Services
Election/Conflict of Interest
Legislative Records Management
City Manager’s Office
Administration and City Management
Economic Development
Public Communication
Administrative Services Department
Accounting
Administration
Office of Management and Budget
Printing and Mailing
Purchasing
Real Estate
Treasury/Revenue Collection/Warehouse
Community Services Department
Administration and Human Services
Animal Shelter
Aquatics
Arts and Sciences
Open Space, Parks and Golf
Recreation and Cubberley
Fire Department
Administration
Emergency Response
Environmental Safety Management
Records and Information Management
Training and Personnel
Human Resources Department
Administration, Employee Org Development and HR Systems Benefits and Compensation
Employee and Labor Relations
Recruitment
Risk Management, Safety, Workers’ Compensation
Information Technology Department
Enterprise Systems
Office of the CIO
Operations
Project Services
Library Department
Administration
Collection and Technical Services
Public Services
Office of Emergency Services
Emergency Services
Office of Transportation
Administration
Parking Districts
Programs
Special Revenue Funds
Planning and Development Services Department
Administration
11 Building
Development Services
Planning and Transportation
Special Districts
Police Department
Administration
Animal Control
Field Services
Investigations and Crime Prevention Services
Law Enforcement Services
Parking Services
Police Personnel Selection
Technical Services
Traffic Services
Department of Public Works
Administration
Airport
Engineering Services
Refuse
Storm Drainage
Streets
Structures and Grounds
Sustainability
Trees
Vehicle Replacement and Maintenance
Wastewater Treatment
Utilities Department
Electric Administration
Electric Customer Service
Electric Demand Side Management
Electric Engineering (Operating)
Electric Operations and Maintenance
Electric Resource Management
Fiber Optics Administration
Fiber Optics Customer Service
Fiber Optic Operations and Maintenance
Gas Administration
Gas Customer Service
Gas Demand Side Management
Gas Engineering (Operating)
Gas Operations and Maintenance
Gas Resource Management
Wastewater Collection Administration
Wastewater Collection Customer Service
Wastewater Collection Engineering (Operating)
Wastewater Collection Operations and Maintenance
Water Administration
Water Customer Service
Water Engineering (Operating)
Water Operations and Maintenance
Water Resource Management
12 Appendix B: Risk Factor Definition