1 0
1 7
2 City Council
Staff Report
From: City Manager
Report Type: CONSENT CALENDAR
Lead Department: City Auditor
Meeting Date: August 10, 2026
Report #:2606-6469
TITLE
Recommend City Council Approval of the City Auditor Annual Risk Assessment and FY 2027 Audit Plan and Corresponding Task Orders. CEQA Status: Not a Project.
RECOMMENDATION
The Policy & Services Committee (P&S) and the Office of the City Auditor recommend City Council approve the Citywide Risk Assessment and FY 2027 Audit Plan.
BACKGROUND
The Palo Alto Municipal Code (Section 2.08.1301) requires the City auditor prepare and submit an annual audit plan to the City Council for review and approval. Baker Tilly, in its capacity as the City Auditor, and in accordance with its agreement with the City, performed a citywide risk assessment (Task 1 of the agreement2). The purpose of the assessment was to identify and prioritize risks to develop the annual audit plan (Task 2). During the risk assessment, Baker Tilly assessed a wide range of risk areas, including strategic, financial, technological, human capital, operational, reputational, economic, and including compliance risk categories.
ANALYSIS
Baker Tilly surveyed and interviewed City Council members and executive leadership across all departments within the City regarding risks to the City and individual departments. As part of this process, Baker Tilly also piloted a new risk assessment tool that enabled participants to engage in discussion around key risks to the City. Baker Tilly analyzed the results of all these inputs and other City documents, news articles, as well as information gathered from industry associations and publications. Identified risks were scored on their potential impact to the City 1 https://codelibrary.amlegal.com/codes/paloalto/latest/paloalto_ca/0-0-0-60361 2 https://www.cityofpaloalto.org/files/assets/public/v/1/agendas-minutes-reports/reports/city-manager-reports- cmrs/year-archive/2020-2/id-11624.pdf?t=64761.15
1 0
1 7
2 and the likelihood that they might occur. The FY2027 Audit Plan was prepared based on the results of the FY2026 risk assessment.
Baker Tilly provided a presentation of both the risk assessment and audit plan results to the Committee. Committee members discussed the prioritization of the projects for this year’s plan noting that one of the selected projects was rated as “medium” versus the rest of the projects on the plan being rated as “high”. Risk ratings help to guide development of the plan, but other factors are also considered including, but not limited to, public interest, strategic importance, imminent operational challenges, or other projects/work underway. In addition, many of the “high” rated risks have been recently audited or are currently being addressed by management.
Topics for the FY 2028 audit plan were also discussed but no substitutions were recommended.
P&S recommended approving the plan as presented.
Upon Council approval of the attached Citywide Annual Risk Assessment and FY 2027 Audit Plan and associated task orders, these orders will be signed by the Policy & Services Committee Chair to authorize work to begin.
FISCAL/RESOURCE IMPACT
The FY2027 Audit Plan commences in August 2026 with anticipated completion of the entire plan in June 2027. The proposed audits are within the contract amount for FY2027. This year, the Audit Plan has a larger than typical “ad hoc” budget. This is to account for FY2027 reductions to the audit services contract which subsequently will reduce the budget available for Task 4 – Execute the Annual Audit Plan.
STAKEHOLDER ENGAGEMENT
The Office of the City Auditor engaged the City Council in interviews and worked with executive leaders from 15 departments across the City.
ENVIRONMENTAL REVIEW
Council action on this item is not a project as defined by CEQA because the audit activities are organizational or administrative activities that will not result in direct or indirect physical changes in the environment. CEQA Guidelines section 15378(b)(5).
ATTACHMENTS
Attachment A: Citywide Annual Risk Assessment and FY 2027 Audit Plan Report APPROVED BY:
Kate Murdock, City Auditor