7 3
5 7
City Council
Staff Report
From: City Auditor
Report Type: CONSENT CALENDAR
Lead Department: City Auditor
Meeting Date: June 17, 2025
Report #:2505-4691
TITLE
Approval of the Office of the City Auditor Annual Risk Assessment and FY 2026 Audit Plan and Corresponding Task Orders
RECOMMENDATION
The City Auditor and the Policy and Services Committee recommend the City Council approve the following reports:
1. Fiscal Year 2025 Risk Assessment Report
2. Fiscal Year 2026 Audit Plan Report
3. Fiscal Year 2026 Audit Plan Task Orders
EXECUTIVE SUMMARY
Baker Tilly, serving as the City Auditor, surveyed City Council, Executive Leadership Team and staff members about citywide and departmental risks. The Auditor received responses from 11 departments across the organization. Baker Tilly analyzed the results of these responses and other data and information gathered from industry associations and publications.
Identified risks were scored and then ranked based on likelihood and impact. The FY2026 Audit Plan was prepared based on the results of the FY2025 risk assessment and other relevant factors such as other planned assessments and studies.
BACKGROUND
The Palo Alto Municipal Code (Section 2.08.1301) requires the City Auditor prepare and submit an annual audit plan to the City Council for review and approval. In its capacity serving as the City Auditor function, and in accordance with Baker Tilly’s agreement with the City, Baker Tilly 1 https://codelibrary.amlegal.com/codes/paloalto/latest/paloalto_ca/0-0-0-60361
7 3
5 7
performed a citywide risk assessment (Task 1 of the agreement2). The purpose of the assessment was to identify and prioritize risks to develop the annual audit plan (Task 2). During the risk assessment, Baker Tilly assessed a wide range of risk areas, including strategic, financial, technological, human capital, operational, reputational, economic, and including compliance risk categories.
ANALYSIS
Baker Tilly provided presented the results of the risk assessment and proposed annual audit plan to members of the Policy & Services Committee and recommended the Committee recommend Council approval of the attached risk assessment report and proposed FY2026 annual audit plan and associated task orders. The Committee voted unanimously to recommend that Council approve the FY25 risk assessment and FY2026 audit plan.
Proposed FY2026 Audit Plan Projects:
For Baker Tilly to execute the approved audit plan, the Task Orders will need to be signed by the Policy & Services Committee Chair upon approval of the audit plan by City 2 https://www.cityofpaloalto.org/files/assets/public/v/1/agendas-minutes-reports/reports/city-manager-reports- cmrs/year-archive/2020-2/id-11624.pdf?t=64761.15
7 3
5 7
Council. Furthermore, one responsibility of the Office of the City Auditor (OCA) is to follow up on management’s corrective actions. The follow-up activities require periodic inquiries with management on outstanding corrective actions and verifying implementation of the corrective actions as well as testing of the effectiveness of the implemented controls.
FISCAL/RESOURCE IMPACT
Projects on the FY2026 Annual Audit Plan will commence in July 2025 with anticipated completion in June 2026. The proposed projects in the plan are within the contract amount for FY2026.
STAKEHOLDER ENGAGEMENT
The OCA designed and disseminated a risk assessment survey to members of City Council, the Executive Leadership Team, and other key management staff. The OCA received responses from eleven departments including City Council.
ENVIRONMENTAL REVIEW
Council action on this item is not a project as defined by CEQA because the audit activities do not involve any commitment to any specific project which may result in a potentially significant physical impact on the environment. CEQA Guidelines section 15378(b)(4). Council action on this item is not a project as defined by CEQA because the audit activities do not involve any commitment to any specific project which may result in a potentially significant physical impact on the environment. CEQA Guidelines section 15378(b)(4).
ATTACHMENTS
Attachment A: OCA - FY2025 Risk Assessment Report
Attachment B: OCA - FY2026 Annual Audit Plan
APPROVED BY:
Kate Murdock, City Auditor