Office of the City Auditor
Report to the City Council
City of San José
RETIREMENT SERVICES:
INTERIM REPORT ON THE
ALIGNMENT OF
CONTROLS BETWEEN THE
CITY AND THE OFFICE OF
RETIREMENT SERVICES
Report 23-05
October 2023
This page was intentionally left blank
200 E. Santa Clara Street, San José, CA 95113
Telephone: (408) 535-1250 Email: [email protected] Website: www.sanjoseca.gov/auditor/ Office of the City Auditor
Joe Rois, City Auditor
October 12, 2023
Honorable Mayor and Members
Of the City Council
200 East Santa Clara Street
San José, CA 95113
Retirement Services: Interim Report on the Alignment of Controls Between the City and the Office of Retirement Services
The City of San José (City) has two retirement plan s, one for Police and Fire sworn employees and one for non-sworn employees. Two inde pendent boards oversee the plans and have fiduciary responsibility for the investment of moneys and administration of the retirement plans. The Office of Retirement Services (ORS) administers the plans. Despite oversight from the boards, ORS is a City department and is staffed by City employees. The City is the plans’ sponsor, and a key stakeholder of the retirement plans.
The plans have a significant impact on the City’s budget and ability to provide services. In FY 2021-22, the City contributed $475 million to the plans for retire ment and other post-employment benefits (e.g., healthcare). In addition, the City provides various support services to ORS, including finance, human resources, and information technology support.
The objective of this interim report was to review policies and procedures for ORS’ administrative responsibilities, including a comparis on of other retirement system’s ov ersight of such re sponsibilities.
This audit was conducted in response to direction from the City Council.
Finding 1: Alignment of ORS and City Policie s Would Strengthen Internal Controls Over ORS Operations. ORS relies on City resources and support serv ices in its operations. This includes information systems such as the City’s financial management and payroll systems, and even e-mail. The Finance, Human Resources, and Information Techno logy Departments provide support by processing biweekly payroll, paying invoices, administering empl oyee benefits, maintaining the City’s information systems, providing cybersecurity trainings, and other services. We found:
There is not clear agreement between the City Administration and ORS on whether all City administrative policies and procedures are rele vant for ORS, despite ORS staff being City employees and the boards adopting the City’s Code of Ethics. ORS does have some internal procedures related to administrative processes, but many date back to the 1990’s or early 2000’s and staff in some cases were unaware of them. In addition, ORS staff have expressed confusion about what policies they are expected to follow.
4 Not having clear direction or up-to-date procedures is an internal control weakness that can lead to practical difficulties in routine operat ions and could expose the retirement system and the City to unnecessary risks,
including inefficient operatio ns, fraud, and susceptibility to cybersecurity incidents.
Other retirement systems in California are similarly
staffed by individuals who ar e considered employees of their plan sponsor, like San José. In these cases, the systems report that staff generally follow their plan
sponsor’s administrative policies, or that they have
adopted policies that were aligned or in some cases
stricter than the plan sponsor’s.
This report has 1 recommendation. We plan to present this report at the October 24, 2023, meeting of the City Council. We would like to thank the Office of Retirement Services, the City Manager’s Office, the City Attorney’s Office, the Information Techno logy Department, the Finance Department, and the Office of Employee Relations for their time and insight during the audit process. The Office of Retirement Services has reviewed the information in this report, and their response is shown on the yellow pages.
Respectfully submitted,
Joe Rois
City Auditor
Audit staff: Alison Pauly
Michael O’Connell, Jr
Maria Valle
cc: Jennifer Maguire Lee Wilcox Nora Frimann Rick Bruneau Kevin Fisher Suzanne Hutchins Cheryl Parkman Khaled Tawfik Roberto Peña Barbara Hayman Jim Shannon Rob Lloyd
Board of Administration of the Federated City Employees’ Retirement System Board of Administration of the Polic e and Fire Department Retirement Plan
This report is also available online at www.sanjoseca.gov/audits RECOMMENDATION:
To strengthen its internal control
system, ORS and the Retirement Boards
should work with the City to either:
Adopt City policies and procedures
related to information technology,
procurement, and other
administrative functions, or
Develop a set of internal policies and
procedures that align with the City’s
in these areas.
T able of Contents
Cover Letter ........................................................................................................... 3 Background ............................................................................................................. 7 Finding I
Alignment of ORS and City Policies Would Strengthen Internal Controls Over ORS Operations ......................................................................................... 15 ORS Operations Rely on City Resources and Support Services, But Procedures in Some Areas Should Be Clarified .......................................................... 15 As Part of the City Organization, ORS Can Expose the City to Certain Risks ....................................................................................................................................... 20 Policies and Procedures Need Alignment to Clarify Responsibilities for City Employees ............................................................................................................................ 22 Benchmark Jurisdictions Generally Align Retirement System and Plan Sponsor Policies and Procedures for Administrative Functions .............................. 23 Conclusion ............................................................................................................. 25 Appendix A
Audit Objective, Scope, and Methodology ...................................................... A-1 Appendix B
San José City Charter Sections 810 and 810.1 ................................................. B-1 Appendix C
Acknowledgement of Receipt and Understanding of Key Policies ............... C-1 Appendix D
Results of Benchmarking to Other Retirement Systems .............................. D-1 Administration’s Response ................................................................. yellow pages
T able of Exhibits
Exhibit 1: Simplified Chart of Office of Retirement Services and City of San José Oversight .............................................................................................................................. 10 Exhibit 2: Total Annual Contributions for Pension and Retiree Health and Dental Benefits ................................................................................................................................. 12
7 Background
The City of San José (City) offers two de fined benefit retirement plans to City employees:
The Police and Fire Retirement Plan for qualifying members of the Police and Fire sworn services, and
The Federated City Employees’ Reti rement System for qualifying employees not covered by the Police and Fire plan.
Each plan has multiple tiers (i.e., Tier 1 and Tier 2) which provide different benefits when an employee retires. Which tier an employee belongs to depends on when that employee was hired. Tier 2 was es tablished for new employees in 2012.
Some employees, such as part-time unbe nefited employees and members of the City Council, are not part of either plan. 1 As of June 30, 2022, there were over 14,800 members of the plans (including active staff, retirees, and beneficiaries).
In addition to pension benefits, the City provides Other Post-Employment Benefits (OPEB) to some employees. 2 These benefits relate to post-employment healthcare, both medical and dental.
Oversight and Authority
The City Charter, the San José Municipal Code, and the California Constitution all provide direction for how the retirement plans operate and function. They also spell out the responsibilities of the Retirement Boards, who oversee the plans.
San José City Charter
In 2014, San José voters passed Measur e G, which added sections 810 and 810.1 to the City Charter. Measure G gave some direction on the separation of responsibility between the City Council and Retirement Boards. This included:
Requiring that the Retirement Boards administer the retirement plans in accordance with the fiduciary duties and obligations established by law, the City Charter, and as further prescribed by ordinance.
Requiring the Retirement Boards comply with all open and public meeting requirements established by state law and applicable Council action.
1 Both the Police and Fire and Federated plans are defined benefit plans, meaning that the City provides stable pension benefits based on retirees’ years of service with the City and their final compensation. The City offers a third plan to Executive Management and Professional Employees (Unit 99) staff, which is a defined contribution plan similar to a traditional 401k. That plan—commonly known as Tier 3—i s administered by the City’s Department of Human Resources. The City also offers a defined contribution reti rement plan for part time, temporary, or contract (PTC) employees, including council assistants.
2 Benefits depend on an employee’s tier. For example, Tier 2 members hired after September 2013 are not provided the same post-employment healthcare benefits as Tier 1 members. Tier 1 members could have opted out of OPEB in 2017.
Audit of Retirement Services
8 Granting the Retirement Boards authority to hire an at-will chief executive officer and a chief investment officer.
Granting the chief executive officer authority to hire and terminate Retirement Services employees independent of the City Manager’s Office. Stipulating that the City Council retains the authority to approve the aggregate expense of administration of the retirement plans. Stipulating that Retirement Services has the authority to contract with external counsel for legal services.
As noted later, Measure G did not explicitly address all aspects of the City’s Office of Retirement Services (ORS) administration and operations.
San José Municipal Code
San José Municipal Code §3.36 Police and Fire Department Retirement Plan and §3.28 Federated Employees Retirement Plan establish the plans and some aspects of plan administration. This includes giving the Retirement boards power to adopt rules and regulations that are necessary to maintain the qualified status of the plan.
California Constitution
Proposition 162, passed in 1992, amended Article 16 §17 of the California Constitution to award boards of public employee retirement systems plenary authority and fiduciary responsibility for investment of moneys and administration. [T]he retirement board of a public pension or retirement system shall have plenary authority and fiduciary responsibility for investment of moneys and administration of the
system, subject to all of the following:
(a) The retirement board of a public pension or retirement system shall have the sole and exclusive fi duciary responsibility over the assets of the public pension or retirement system. The retirement board shall also have sole and exclusive responsibility to administer the system in a manner that will assure prompt delivery of benefits and related services to the participants and their beneficiaries.
The assets of a public pension or retirement system are trust funds and shall be held for the exclusive purposes of providing benefits to participants in the pension or retirement system and their beneficiaries and defraying reasonable expenses of administering the system.
(b) The members of the retirement board of a public pension or retirement system shall discharge their duties with respect to the system solely in the interest of , and for the exclusive purposes of providing benefits to, participants and their beneficiaries, Background
9 minimizing employer co ntributions thereto, and defraying reasonable expenses of administering the system . A
retirement board’s duty to its participants and their beneficiaries shall take precedence over any other duty. [emphasis added] The Retirement Boards
The retirement plans are overseen by two independent boards who have fiduciary responsibility for investment of moneys and administration of the retirement plans.
The Retirement Boards are also responsi ble for appointing and overseeing the work of ORS’ Chief Executive Officer and the Chief Investment Officer. The Federated Board consists of se ven appointed members: four public members appointed by the City Council, two employee representatives, and one retiree representative.
The Police and Fire Board consists of nine appointed members: five public members appointed by the City Council, one Police employee representative, one Fire employee representative, one Police retiree representative, and one Fire retiree representative.
Public members appointed by the City Council must have at least twelve years of experience relevant to the administration of a pension plan.
The Retirement Boards and ORS invest contributions to try and meet an expected rate of return that will enable them to make current and future benefits payments.
The Retirement Boards annually adopt an administrative budget, approved by the City Council, for ORS. ORS is almost entirely funded through the Federated and Police and Fire Retirement Funds.3
The City Council
Per the Municipal Code, the City Council establishes the Boards to administer retirement plans. The City Council approves the ORS budget annually and appoints Retirement Board members. 4 Each Board also includes one nonvoting City Councilmember who acts as a Council liaison to the Boards.
The Office of Retirement Services
ORS administers the retirement benefits pr ovided by the City. Its mission is to “provide quality services in the deliver y of pension and related benefits and maintain financially sound pension plans.”
3 In FY 2023-24, 1 percent of the ORS budget came from the General Fund. 4 Retiree and active Board members are elected by their re spective plan members and then appointed by the City Council.
Audit of Retirement Services
10 ORS’ Chief Executive Officer oversees the entire office, including authority to hire and fire ORS staff. In FY 2023-24, ORS has 43 full-time equivalent positions with a personnel budget of $8.7 million.
Exhibit 1: Simplified Chart of Office of Retirement Services and City of San José Oversight
Source: Auditor analysis of City Charter, San José Municipal Code, Office of Retirement Services organizational chart, and interviews with City and ORS staff regarding support services
The office is split into several divisions which handle different aspects of ORS operations.
The Investment division, overseen by the chief investment officer, manages retirement plan assets. The team aims to produce long-term net returns that exceed the actuarial assumed rate of return while maintaining a reasonable level of investment risk.
The Benefits division provides retireme nt planning and counseling services to plan member s and administers health care and other benefits for retirees and beneficiaries.
The Accounting division prepares annual comprehensive financial reports for the retirement plans, runs monthly benefit distributions for retirees and beneficiaries, manages the budget, and handles all other financial transactions for the department.
The Information Technology division manages the Pension Administration System and provide s other information technology services, planning, system development, and maintenance for the department.5
The Administration division supports the operations of the Police and Fire Department Retirement Boar d, the Federated City Employees’
5 The Pension Administration System houses all retirement data and runs most of the retirement business transactions.
Background
11 Retirement Board, and Board Committees. They also provide administrative support to Board Trustees and the Chief Executive Officer. The Internal Auditor provides an independent, objective assurance and consulting activity designed to add value and improve ORS’ operations.
The internal auditor is accountable to the joint audit committee of the Retirement Boards.
ORS Staff Are City Employees
ORS staff are City employees, hired by th e Chief Executive Officer. Most ORS staff are members of the Federated City Employees Retirement System, except for staff in the Investment division (who are members of CalPERS, the California Public Employees’ Retirement System).
ORS staff have the same benefits as othe r City employees and are subject to the same employment terms. Most ORS staff are members of an employee bargaining unit (either the Municipal Employees’ Fe deration or City Association of Management Personnel); the remainder are unclassified, primarily as Unit 99. 6 Role of the City
The City is the plan sponsor of the two retirement plans. The City acts as the financial backstop for the plans and is required to make employer contributions into the pension funds. These may take the form of one annual payment into the funds or contributions throughout the year.
The plans are established in the City’s Municipal Code and the City Charter, and the City employs the members of the reti rement plans. Unlike in some other jurisdictions, no other agencies are sponsors of the City’s retirement plans.
Contributions Into the Plans
The City and current employees who are plan members contribute to the plans at a defined rate, and the City transfers the funds to ORS to manage and pay for benefits.
These retirement contributions constitute a sizeable portion of the City’s budget.
In FY 2021-22, the City’s total contributions to the two plans included $420 million for pension benefits and roughly $55 million for OPEB, a total of $475 million. For context, this is about a quarter of the City’s overall spending on department budgets (which totaled $1.8 billion that year ). As such, the overall health of the Retirement plans impacts the City’s budget, and thus its ability to provide services to residents.
6 ORS also employs temporary retiree-rehires, who are unclas sified but not in Unit 99. Unit 99 includes executive management and professional staff across the City who are not members of one of the other City bargaining units.
Audit of Retirement Services
12 Additionally, City employees contributed $81 million into the plans in FY 2021-22.
Exhibit 2: Total Annual Contributions for Pension and Retiree Health and Dental Benefits
Source: Police and Fire Department Retirement Plan and Federated City Employees’ Retirement System Annual Comprehensive Financial Reports.
As of June 30, 2022, though the plan a ssets totaled $7.7 billion, there was a net liability of $4.1 billion (meaning the plans overall pension and OPEB liabilities were greater than its total assets). The differe nce between plan assets and liabilities is called the unfunded liability. Both the City and City employees are responsible for paying off the unfunded liability. For the Ci ty, this will continue to result in large annual contributions in coming years.
Operational Support for ORS
The City also provides some support serv ices to ORS. This includes payroll, invoice processing, human resources (s uch as new employee orientation and providing benefits), information technology (such as email and network services), and employee relations (including negotiat ing with bargaining units on terms of employment).
The City also maintains the City Policy Manual (CPM). The CPM covers a range of topics, including ethics, workplace rules, compensation and benefits, finance, and technology. Per the City’s website:
The policies contained within the CPM reflect not only the City’s values as an employer, but also convey the standards that the City has for its employees.
Per the City’s Code of Ethics, City empl oyees are obligated to abide by all City policies.
$0
$100
$200
$300
$400
$500Contributions ($millions)
Employer
contributions
($475 million in
2021-22)
Employee
contributions
($81 million in
2021-22)
Background
13 Audit Direction
In May 2023, the ORS inte rnal auditor released a report regarding ORS procurement and contracting oversight. 7 Further details on the findings in that audit are discussed in Finding 1 of this report.
In response to that audit, the Mayo r and two Councilmembers issued a memo noting that the internal audit report found confusion among ORS staff about proper procedures and whether they are required to follow City policies. The Mayor and Councilmembers directed the City Auditor to conduct an audit of ORS to address the following areas:
1. Identifying internal process controls for financial activities such as accounting, purchasing and contracting;
2. Identifying policies and procedures around information systems and security;
3. Compliance with City policies for financial activities, information systems and security, and other relevant administrative functions;
4. A comparison of the governance structures of other pension plans, including board oversight of management's administrative functions and responsibilities.
The audit was approved by the City Council’s Rules and Open Government Committee in August 2023 for inclusion in the City Auditor’s Fiscal Year (FY) 2023-24 work plan. This is an interim audit addressing portions of the audit direction. More detailed testing for compliance with City policies was not included in this interim report.
7 The ORS internal auditor is not part of the Office of the City Auditor.
Audit of Retirement Services
14 This page was intentionally left blank
15 Finding I Alignment of ORS and City Policies
Would Strengthen Internal Controls
Over ORS Operations
Summary
The Office of Retirement Services relies on City resources and support services in its operations. This includes informat ion systems such as the City’s financial management and payroll systems, and even e-mail. Staff in the Finance, Human Resources, and Information Technology Departments also provide support by processing biweekly payroll, paying invoic es, administering benefits, maintaining the City’s information systems, providing cybersecurity trainings, and other services. However, there is not clear agreement between the City Administration and ORS on whether all City policies and procedures in these areas are relevant for ORS, despite ORS staff being City employees. ORS has some internal procedures, but many date back to the 1990s or early 2000s and staff in some cases were unaware of them. Not having clear direction or up-to- date procedures is an internal contro l weakness that can lead to practical difficulties in routine operations and expose the retirement systems and the City to unnecessary risks.
Other retirement systems in California are similarly staffed by individuals who are considered employees of their plan sponso r, like San José. In these cases, the systems report that staff follow their plan sponsor’s policies, or that they have adopted policies that were aligned or st ricter than the plan sponsor’s. We recommend that ORS and the Retirement Boards, in coordination with the City Administration, adopt City procedur es around information security, procurement, and other administrative functions, or develop a set of policies that are in alignment with the City’s in these areas.
ORS Operations Rely on City Resources and Support Services, But Procedures in Some Areas Should Be Clarified
ORS relies significantly on City resources and support services in its operations.
However, the City Administration and ORS do not appear to agree on whether ORS staff should follow all City policie s and procedures, including those areas where ORS relies on City resources or support staff.8
The City Administration has expressed concern that ORS staff are not following City policies, such as for procurement and information security, and have outlined the risks of noncompliance.
8 The Retirement Boards have an investment policy, specific to the retirement plans, as the Boards have full authority over the investment of retirement funds and payments to beneficiaries.
Audit of Retirement Services
16 ORS management stated that in their view, ORS staff should be following most City policies, with some exceptions. Management acknowledged that which policies cons titute those exceptions needs to be clarified.
The Retirement Boards’ outside legal counsel has stated publicly that some ORS staff follow City proced ures out of habit, but not out of requirement and law.
Retirement Board members reported ambiguity around which policies applied to ORS and stated th at clarification in this area was needed. In September 2023, the Boards’ Joint Audit Committee voted to engage a consultant to conduct a review of ORS’s policies on procurement and contracting issues.
Agreement between the City and ORS management regarding adherence to most of the City’s policies provides some cl arity. However, ambiguity impacts the strength of ORS’s internal controls. Not having clear direction for staff can create confusion around administrative proc esses, such as invoice processing, accounting, procurement, and information security. This in turn can be a risk for error, potential fraud, or a cybersecurity incident.
ORS Has Historically Followed City Policies and Procedures Related to Procurements and Payment Processing
The City’s Finance Department (Finance) supports ORS procurement and payment processing in multiple ways. For procurements that require formal bidding, ORS uses Biddingo, the City’s e-procurement system. Finance also processes purchase orders and authorizes payments on invoices through the City’s financial management system.9
Because the Retirement Boards have th e ultimate authority on how retirement funds are spent, ORS accounting and administrative staff follow their broad direction for financial activities. However, in the past, ORS has expected staff to comply with City policies for procurement. For example:
In 2021, ORS violated Finance policies by contacting a vendor to procure goods or services without a purchase order or other agreement in place.
In response to a reprimand letter from Finance, ORS’ CEO stated: “We are now aware of these policies and will abide them.”
ORS staff also have City-issued procurement cards (p-cards). 10 ORS Accounting staff report that they ha ve historically complied with the City’s p-card policy (City Policy 5.1. 2). In addition, the ORS internal auditor’s workplan includes an audit reviewing ORS compliance with the
9 Finance processed 12 purchase orders in FY 2021-22.
10 In 2022, 8 ORS staff had p-cards.
Finding 1
17 City’s p-card policy. This workplan was approved by the Boards’ audit committee.
In 2008, the Retirement Boards adop ted the City’s travel policy for all Board members and staff. They passe d an additional resolution in 2016 which reiterated the adoption of the City’s updated travel policy.11 ORS Accounting staff report filing after-the-fact memos, per Finance orders, if they have not complied with the policy.
Internally, ORS has policies regarding contract payments that date back to 1994.
Staff report that generally, these internal policies are not used.
Per the California Constitution, the Retire ment Boards have a fiduciary duty in the administration of the plans and have a duty to oversee management’s performance of the administration of the plans. Per the City Attorney’s Office, such duties would include having procur ement processes in place as a means to defray reasonable expenses for the administration of the plans.
Internal Audit Findings Show Noncompliance With City Policies ORS Accounting staff report that they ha ve historically followed the City’s procurement rules, and largely continue to do so. Two ORS internal audit reports in recent years had findings related to procurements and invoice processing.
1. In February 2020, the ORS internal auditor at that time issued an audit on cash disbursements. The audit found that invoices were paid late, and wire transfers were sent through fax, which is less secure than normal practices. The audit, which was heard by the Boards’ audit committee, recommended strengthening monitoring of the invoice payment process and training staff on City policies.
2. In May 2023, the current ORS internal auditor issued a procurement and contract oversight audit. Among the findings were that ORS violated City policies and ORS practices by making wire transfers to pay invoices without authorized contracts and pa id an insurance broker without a competitive selection process or a contract. These invoices related to work in the Investment Division but were not to investment managers.
As such, they would typically have been paid through the Finance Accounts Payable process like other ORS transactions.
The audit noted that operationally, there is confusion among ORS staff and management about the need to follow City policy, creating procurement and cybersecurity concerns. The audit stated:
11 The Boards adopted the City’s 2015 update to the travel policy, but do not appear to have adopted the more recent 2019 revision.
Audit of Retirement Services
18 ORS staff disagreed among themselves on whether the ORS is required to follow San José’s procurement rules, as stated in the San José Municipal Code and the Finance Department's procurement policies and procedures.
The response to the audit highlighted management’s differing opinion on whether City policies and procedures apply to ORS operations. At the May 2023 audit committee meeting, management indicated that overriding City policies to conti nue smooth operations of the plans would be repeated if necessary.
Unclear or Conflicting Direction Creates Operational Challenges for ORS Accounting and City Finance Department Staff
ORS uses the City’s financial management system and processes transactions through Finance Accounting staff. In FY 2021-22, ORS had seven financial management system users and Finance’s Accounts Payable Division processed over 1,000 invoices for ORS totaling $13 million. Finance’s Payroll team also processes ORS staff paychecks biweekly, like other City employees.
ORS standard processes and City procedures maintain clear segregation of duties to protect financial assets. ORS Accounting staff indicate that when transactions are processed by Finance, these controls are in place. However, the May 2023 ORS internal audit report reports that wire transfers directly from the retirement plans’ custodian bank do not comply with these processes and violate basic segregation of duties.
Unclear direction on policies and procedures can present practical problems for ORS and the City. For example, Finance staff require certain documentation to be submitted with a request to pay an invoice. ORS staff are expected to provide that documentation, and it could presen t problems if they do not follow this requirement.
If ORS sets policies that do not incl ude the requirement to submit that documentation, Finance staff may simply refuse to process the payment.
This leaves ORS Accounting staff in a difficult position or may prompt ORS staff to make the payment using non-standard procedures. Alternatively, if Finance staff do pr ocess the payment, they would be in violation of their own procedures.
In either situation, not having consistent, standard procedures in place increases the risk of error, or even fraud. In a memo to the City Auditor in response to the May 2023 internal audi t on procurement and contract oversight, the City’s Finance Director stated:
To ensure strong fiduciary management, uniform accounting and reporting procedures are required of public entities that conform Finding 1
19 to Generally Accepted Accounting Principles (GAAP) as prescribed by the Government Accounting Standards Board (GASB).
ORS Uses City Networks and Applications Without Clear Adherence to City Policies
The City’s Information Technology Department (ITD) supports ORS in a similar way to other departments. ORS uses the City’s networks and software applications, such as the City’s financial management system and the City’s human resources management system. The City’s ITD provides email and productivity applications. At the time of the audit, ITD hosted one server for ORS and provided network communications, iden tity and access management, base cybersecurity protections, and some technical support for ORS employees.
Cybersecurity trainings provided by ITD ar e required of all City staff, including ORS staff. Due to increasing risks and the severe impacts of cybersecurity attack, the City Administration reports that all City departments are required to actively engage in cybersecurity responsibilities defined in City policy and guidelines. This includes policy compliance, security assessments, incident response, and business resilience planning and exercises. Addi tionally, ORS is covered by the City’s cybersecurity insurance.
ITD also maintains the City’s information security policies, which are included in the City’s Policy Manual. ORS IT staff report that they were instructed to use an internal ORS information security policy, but that it is not adequate; ORS’ current policy dates back to the year 2000. During this audit, ITD noted that they were aware of some ORS information systems that may not comply with City security standards and an assessment is required. ORS staff have also stated concerns about the current cybersecurity practices in ORS.
The ORS internal audit from May 2023 fo und that the delayed procurement of laptops in 2020 caused security vulner abilities and raised operational risks because staff were accessing sensitive info rmation on personal devices. During this audit, we were alerted that personal devices were still being used to conduct some ORS business. In the memo to th e City Auditor in response to the May 2023 internal audit on procurement and co ntract oversight, the City’s Finance Director noted that using personal co mputers to conduct City business is a violation of the City’s Information Systems and Security guidelines.
ORS Maintains Internal Operational Procedures and Board Policies ORS and the Retirement Boards have their own policies and procedures, separate from the City Policy Manual. These procedures cover topics such as beneficiary enrollment, benefit payments, accountin g and invoice processing, investment practices, and information security.
Most of these internal policies and pr ocedures were written in the 1990s and early 2000s. For example, the Procedur es for Contract Payments was last Audit of Retirement Services
20 updated in July 1994. ORS staff report that they are not using those procedures for their current operations, and in some cases, they did no t know that they existed until recently. ORS management acknowledges that the policies and procedures are out of date and are undertaking efforts to update them.
The Retirement Boards also have a set of governing policies. These include policies specific to the Boards, such as the Board Communication Policy, and policies regarding investments. They do not include policies specific to the daily operations of ORS functions.
As Part of the City Organization, ORS Can Expose the City to Certain Risks As a department that relies on City s upport services, ORS can expose the City to certain risks that can have adverse impacts. Because of this, it is in the City’s interests that ORS operates efficiently under a cohesive, clear set of internal controls.
Information Security ORS uses City-issued laptops and connects to the City’s networks. As such, cyber security incidents by ORS staff or through ORS devices could impact the City’s networks. 12 Additionally, ORS’s pension administration system contains personally identifiable information (PII) about current and former City employees.
Because ORS is covered under the City ’s cybersecurity insurance, City ITD reports that any ORS cybersecu rity incidents would most likely increase the insurance renewal cost for the City and may result in hindering the City's ability to obtain insurance due to high risk.
As noted earlier, ORS staff have used , and reportedly continue to use, personal devices to conduct ORS bus iness. The City Administration expressed concerns around the risks associated with this practice and the timeliness of City device procurement by ORS.
City Budget From a budgetary perspective, the City is responsible for a portion of the retirement plans’ unfunded liability. Any actions that would increase this liability would affect the City’s required contributions into the retirement funds. As no ted in the Background, contributions into the retirement funds have been a substantial cost to the City in recent years, totaling $475 million in FY 2021-22.
Reputational Risk As part of the City organization, actions on the part of ORS and ORS staff can have reperc ussions to the City’s reputation.
This could include violations of the Code of Ethics on the part of ORS staff. Additionally, if there are concerns about inappropriate procurement practices, this could damage the City’s reputation with
12 ITD conducts cybersecurity trainings that are required for all City staff. ITD tracks whether ORS staff have completed the required trainings, and reports that information to ORS management.
Finding 1
21 vendors and risk alienating key vend ors in the community. In a memo responding to the May 2023 ORS internal audit on procurement and contract oversight, the City’s Fina nce Director stated that by not following standard invoice payment processes, “ORS violated City policy and introduced significant financial and reputational risk to the City.” Financial Statements The retirement funds are included in the City’s overall financial statements (the Annual Comprehensive Financial Report or ACFR). Net pension and OPEB lia bilities are included in the City’s Statement of Net Position. In FY 2021-22, net pension and OPEB liability was the largest liability included in the City’s financial statements. As a result, the financial health of the retirement funds can impact how investors view the City as a whole.
Internal Controls Are Essential to Achieve an Organization’s Objectives and Reduce Risk
To meet an organization’s needs, management should establish a clear and effective system of internal controls. Internal controls include policies and procedures, monitoring, and evaluating risks.
The Government Accountability Office has published Standards for Internal Control in the Federal Government. These standards provide guidance for management as to how to establish an effective system of internal controls. They state:
A key factor in improving account ability in achieving an entity’s mission is to implement an effective internal control system. An effective internal control system helps an entity adapt to shifting environments, evolving demands, changing risks, and new priorities.
The GAO lays out a variety of principles for effective internal controls in its Standards for Internal Control. These include:
Tone at the top (principle 1). The oversight body and management set the tone of the organization’s values , philosophy, and operating style.
These are fundamental for an effectiv e control system. Tone at the top can be either a driver or barrier to effective internal controls. Establish structure, responsibility, and authority (principle 3). Per the Standards for Internal Control: “Management should establish an organizational structure, assign resp onsibility, and delegate authority to achieve the entity’s objectives.” Delegating authority for internal control tasks through segregation of duties “prevents fraud, waste, and abuse.” Identify, analyze, and respond to risks, including fraud (principles 7 and 8). Management should identi fy and analyze risks and determine appropriate responses. This shou ld include an assessment of the potential for fraud.
Audit of Retirement Services
22 Design and implement control activities (principles 10 and 12).
Management should design control activities, such as policies, procedures, techniques, and mechan isms, to achieve the entity’s objectives. These should follow man agement’s directives and address related risks, including areas such as transactions. Controls should be established at multiple levels, includin g at the entity level. Entity-level controls include preventions against management override and monitoring. Per the Standards for Internal Control : “Management should implement control activities through policies.”
Design activities for the information system (principle 11). Along with other control activities, management should design controls around information systems. This includes the guidance that: “ Management designs control activities over the acquisition, development, and maintenance of information technology.”
Policies and Procedures Need Alignment to Clarify Responsibilities for City Employees
Because ORS uses City support services, alignment of procedures between ORS and City staff is important to ensure operations can run efficiently and to reduce risks. The current legal and operational guidance does not clarify how ORS and the City’s processes should align and what ORS staff responsib ilities are as City employees.
As noted in the Background, San José voters passed Measure G in 2014 to change and clarify the role of the Retirement Boards and their governance. The resulting changes to the City Charter are included in Appendix B.
Measure G established clear lines of au thority in some areas, such as the appointment of the Chief Executive Officer and of the Retirement Board members. It did not specifically cover the question of what administrative and operational processes and policies ORS sta ff, as City employees, should follow.
This is not specifically addressed in the Municipal Code either, where the retirement plans are codified.
ORS Staff are City Employees
ORS management, legal counsel, and the City Administration agree that ORS staff are City employees. There is not agreement on what responsibilities that entails with regards to fully following City policies and procedures.
The Retirement Boards adopted the City’s Code of Ethics in February 2018. The City’s Code of Ethics states:
City officials and employees are obligated to uphold the Constitution of the United States and the Constitution of the State Finding 1
23 of California and to comply with Federal, State, and local laws and City policies. [emphasis added]
Additionally, ORS staff participate in the City’s standard performance appraisal process. This includes signing that staff will adhere to the City Policy Manual (Appendix C). As noted in the Backgr ound, the City Policy Manual includes policies such as code of ethics, informat ion security, and procurement. Even as recently as August 2023, ORS staff were signing this standard acknowledgement that they would adhere to the City Policy Manual.
ORS management stated that in their view , all ORS staff should be following the policies listed on that acknowledgement form. Despite this, ORS staff report confusion regarding whether City policies and procedures apply to them and have difficulty understanding what other set of policies would apply instead.
Benchmark Jurisdictions Generally Align Retirement System and Plan Sponsor Policies and Procedures for Administrative Functions
Like San José, other public retirement syst ems are operationally linked to their plan sponsor. 13 Retirement systems we surveyed had varying approaches to administrative oversight, but generally reported that staff aligned internal policies to the city or county policies when th eir operations used those systems.
Understanding how other jurisdictions structure the relationship between the plan sponsor and the retirement system can give insight into options that San José has for clarifying how ORS can improve their internal control system. City/County Employees: All benchmarked retirement systems reported that either all or the major ity of their staff were considered city/county employees.
14 Reliance on City/County Functions: Benchmarked retirement systems varied in their reliance on ci ty/county administrative functions.
At a minimum, nearly all benchmarked systems reported reliance on their respective city/county for payroll for retirement system employees.
Some relied on city/county support for human resources, information security, and finance functions. One system relied on their city staff for all these processes, similar to San José.
Alignment of Policies: In areas where the retirement system used city/county support functions, al l benchmarked retirement systems reported that staff either followed the city/county policies in those areas
13 Benchmarked retirement systems were Los Angeles City Employees’ Retirement System (LACERS), San Diego City Employees’ Retirement System (SDCER S), City of Fresno Retirement Syst em (CFRS), San Francisco Employees’ Retirement System (SFERS), Orange County Employees Retirement System (OCERS), and Alameda County Employees’ Retirement Association (ACERA).
14 Orange County reported that some staff, supervisors and management, are employed directly by the retirement system. Other staff are employees of Orange County.
Audit of Retirement Services
24 or aligned their internal policies with the city/county policies. In some cases, the internal policies were st ricter than what the city/county required.
Governance Structure: All benchmarked retirement systems shared key aspects of their governance structures with San José. All have independent retirement boards who appoint the chief executive. All but one have an internal audit function, and nearly all have audit committees.
There is variation around how the in ternal auditor is appointed, with some appointed by the audit committee or board and others by the CEO.
Some plans retain both in-house legal counsel and hired external counsel, two reported receiving general legal counsel from their City Attorney’s Office; San José, like one other retire ment system, only uses external legal counsel.
For complete results of the benchmarki ng analysis, including these and other topics, see Appendix D.
To Reduce Risk and Improve Internal Controls, ORS Policies Should Align with City Policies and Procedures
Because ORS is part of the City organization and uses City processes, alignment of policies between ORS and City staff is important to reduce risk and ensure efficient operations. Other benchmar ked retirement systems have addressed this by either aligning internal policies with their plan sponsor’s or by following the plan sponsor policies when applicab le. ORS and the Boards should work together with the City Administration to ensure that ORS staff are following City policies, either by adopting the City po licies and procedures for administrative functions, or developing a set of policies and procedures that align with the City’s in key areas.
Recommendation:
1: To ensure that the Office of Retirement Services has efficient operations and strong internal controls around administrative functions, the Office of Retirement
Services and the Retirement Boards, in coordination
with the City Administration and the City Attorney’s
Office, should either:
a) Adopt the City’s policies and procedures related to information systems and technology, and support
services such as procurement, invoice processing,
and other relevant administrative functions, or
b) Develop a set of internal policies and procedures that are in alignment with the City’s policies and
procedures.
25 Conclusion
Though ORS staff are City employees, ORS management and the City Administration have provided differing direction on whether they should be following all City policies. The result is that it is not clear what internal controls apply to ORS operations, either for ORS staff or the Retirement Boards. ORS has some internal procedures, but many date back to the 1990s or early 2000s and staff in some cases were unaware of them. Not having clear direction or up-to-date procedures is an internal control weakness that can lead to practical difficulties in routine operations and expose the retirement systems and the City to unnecessary risks. To ensure that ORS has strong internal controls, ORS and the Retirement Boards should work with the City Administration and City Attorney’s Office adopt City policies and procedures for ORS st aff or develop internal policies and procedures that align to the City’s.
RECOMMENDATION
Finding 1: Alignment of ORS and City Policies Would Strengthen Internal Controls Over ORS Operations
Recommendation #1: To ensure that the Office of Retirement Services has efficient operations and strong internal controls around administrative functions, the Office of Retirement Services and the Retirement Boards, in coordination with the City Administration and the City Attorney’s Office, should either:
a) Adopt the City’s policies and procedures related to info rmation systems and technology, and support services such as procurement, invoice processing, and other relevant administrative functions, or
b) Develop a set of internal policies and proc edures that are in alignment with the City’s policies and procedures.
Audit of Retirement Services
26 This page was intentionally left blank
APPENDIX A
Audit Objective, Scope, and Methodology
A-1
The mission of the City Auditor’s Office is to inde pendently assess and report on City operations and services. The audit function is an essential elemen t of San José’s public accountability, and our audits provide the City Council, City management, and the general public with independent and objective information regarding the economy, efficiency, effectiven ess, and equity of City operations and services.
In accordance with the City Auditor’s Fiscal Year (FY) 2023-24 Audit Work Plan, we have completed an audit of the governance structure of retirement services. The audit was conducted in response to a City Council request.
We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan an d perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reason able basis for our findings and conclusions based on our audit objectives.
The objective of this interim audit report was to review policies and procedures for Office of Retirement Service’s administrative responsibilities, including a comparison of other retirement system’s oversight of such responsibilities. We sought to understand the relevant management controls over Retirement Services administration, and have performed the following to achieve the audit objective:
Reviewed the Municipal Code, City Charter, and California Constitution to understand governance regulations.
Reviewed the ORS internal audits published between October 2019 and May 2023. Reviewed ORS internal policies and procedur es and the City Policy Manual to understand guidance provided to staff.
Interviewed ORS staff to understand the procedures and policies. Interviewed City staff to understand how they support ORS operations and the impact of ORS operations on the City organization.
Reviewed the City’s FY 2023-24 Cost Allocation Plan to determine how ORS used City support services.
Benchmarked other jurisdictions to understand how the City’s retirement system governance and administrative structures compared to peers, incl uding the cities of San Diego, Los Angeles, and Fresno; the city and county of San Francisco; and the counties of Alameda and Orange. This included sending questionnaires, interviewing staff, reviewing policies and procedures, and researching municipal codes.
We should note that many Auditor’s Office staff, including this audit team, are members of the Federated City Employees’ Retirement System.
We would like to thank the Office of Retirement Services, the City Attorney’s Office, the City Manager’s Office, and staff from Office of Employment Relations for their time and insight during the audit process.
A-2
This page was intentionally left blank
APPENDIX B
San José City Charter Sections 810 and 810.1
B-1
SECTION 810. Retirement Board or Boards.
(a) The City Council by ordinance shall establish one or more retirement boards to administer the retirement plans established pursuant to Article XV of this Charter. (b) The term of membership, qualifications of the members and the size of each retirement board shall be prescribed by ordinance. The members of any retirement board shall be appointed and removed in a manner prescribed by ordinance wi th a majority of the members appointed by the City Council. The City Council shall appoint and remove the members of any retirement board in a manner prescribed by ordinance. The member s of each retirement board shall be paid a monthly stipend determined pursuant to the provisions of Section 1001.1 of this Charter. (c) Each retirement board shall administer the retirement plan or plans that the retirement board has been designated to administer in accordan ce with the fiduciary duties and obligations established by law, the City Charter, and as further prescribed by ordinance. (d) Each retirement board shall annually adopt a budget approved by th e City Council covering the entire aggregate expense of administration of the retirement plan or plans that the retirement board has been designated to administer for the en suing fiscal year, using the same fiscal year as the City pursuant to Section 1200 of this Charter.
(e) Each retirement board may retain or employ, by contract, attorneys to assist the retirement board on matters reasonably necessary to carry out their fiduciary duties in the administration of the retirement plan or plans that the retirement board has been designated to administer. (f) Each retirement board shall comply with all open and public meeting requirements established by state law and applicable Council action.
SECTION 810.1. Retirement Board; Power of Appointment.
(a) The retirement board or boards may appoint and prescribe the duties of the chief executive officer and the chief investment officer or such eq uivalent positions of the Office of Retirement Services to assist in the administration of the plan or plans. Such appointed officers shall serve in unclassified positions at the pleasure of the appointing retirement board; if more than one board then the boards shall jointly appoint the chief executive officer and the chief investment officer. (b) The chief executive officer or the officer hold ing an equivalent position of the Office of Retirement Services may appoint and prescribe the duties of the professional and technical employees and clerical employees employed in the Office of Retirement Services. (c) In addition, when the chief executive officer or the officer holding an equivalent position deems it necessary for the good of the service he or she may suspend without pay, demote, discharge, remove or discipline any such employee in the O ffice of Retirement Services subject to any applicable Civil Service provisions of the Charter and any Civil Service Rules adopted thereto. (d) Neither the Council nor any of its members nor the Mayor shall in any manner dictate the appointment or removal of any such officer or employee whom the retirement board or boards is empowered to appoint or the chief executive officer is empowered to appoint, but the Council
B-2
may express its views and fully and freely discuss with the retirement board or boards anything pertaining to the appointment and removal of such officers and employees. (e) Compensation set for chief executive officer, chief investment officer, or their equivalent and the investment profession al staff shall be set in accordan ce with Charter Section 902 and the board or boards shall consider compensation of equivalent positions in comparable United States Public Pension Plans in recommending the total compensation for the positions of chief executive officer, chief investment officer or their equivalent and the investment professional staff.
APPENDIX C
Acknowledgement of Receipt and Understanding of Key Policies C-1
I , , acknowledge that I have received and will review Print Name
the following Key Policies, which are located in the City Policy Manual, as well as any other policies, including Departmental policies, listed below:
Discrimination and Harassment (1.1.1)
Nepotism Policy (1.1.3)
Non-Retaliation (1.1.4)
Code of Ethics (1.2.1)
Gift Policy (1.2.2)
Outside Employment (1.2.3)
Customer Service Guidelines (1.2.9)
Workplace Violence (1.3.1)
Disaster Service Workers (1.3.4)
Drug-Free Workplace (1.4.1)
Substance Abuse (1.4.2)
Personal Use of City Equipment (1.6.2)
Use of Email, Internet Services, and Other Electronic Media (1 .7.1) Mobile Communications and Devices (1.7.4)
Information and Systems Security Policy (1.7.6)
Use of City and Personal Vehicles (1.8.1)
Discipline (2.1.3)
__________________________________________
I understand that the City Policy Manual, which is located on the City’s intranet, contains important information on the general rules, policies and practices of the City of San Jose. I understand that it is my responsibility to familiarize myself with the rules, p olicies, and practices contained in the City Policy Manual, including, but not limited to, the foregoing Key Policies.
I understand that it is my responsibility to adhere to and abide by the terms and conditions set forth in the City Policy Manual, including, but not limited to, the foregoing Policies, including Departmental policies, and that violation of City pol icies may result in disciplinary action.
Employee Signature Date
C-2
This page was intentionally left blank
APPENDIX D
Results of Benchmarking to Other Retirement Systems
D-1
CITY OF
SAN JOSE
(SJ ORS)
SAN
FRANCISCO
(SFERS)
CITY OF
LOS ANGELES
(LACERS)
CITY OF
SAN DIEGO
(SDCERS)
CITY OF
FRESNO
(CFRS)
ORANGE
COUNTY
(OCERS)
ALAMEDA
COUNTY
(ACERA)
Size of Plan
(Total
Members)
14,839
(as of 6/30/22)
77,003
(as of 6/30/22)
44,346
(as of 6/30/22)
21,533
(as of 6/30/22)
4,804
(as of 6/30/22)
50,633
(as of 12/31/22)
25,493
(as of 12/31/22)
Retirement
staff are
city/county
employees
YES YES YES YES YES SPLIT
Managers and
executive staff are
OCERS
employees. Other
OCERS staff are
county employees.
YES
Retirement
relies on
city/county
support
functions
YES
- Finance
- Payroll
- HR
- IT
YES
- Finance
- Payroll
- HR
YES
- Finance
- Payroll
- HR
YES
- Payroll
- HR
YES
- HR
- Information
Services
- Finance
- Payroll
YES
- Payroll
- HR
YES
- HR
Retirement
staff follow
city/county
policies or
their internal
policies are
aligned
City and Boards
disagree on
applicability of City
Policy Manual for
retirement staff,
and internal ORS
policies are
outdated.
YES YES
YES
YES
YES
YES
Retirement
staff follow
city/county
administrative
procedures
City and Boards
disagree on
applicability of City
policies and
standard
administrative
This is not a code
requirement, but
there is an
expectation for
SFERS staff as city
employees to
LACERS is
generally subject
to the same
policies and
procedures as
other non-
SDCERS report
staff are generally
subject to policies,
rules and practices
set by the city and
This is not a code
requirement, but
an expectation for
CFRS employees
as city staff.
OCERS staff
considered county
employees are
expected to follow
the County Code
of Conduct,
County gives
board deference
for posting, hiring,
and RFPs. ACERA
generally follows
D-2
procedures for
retirement staff.
follow the City
Administrative
Code.
proprietary city
departments.
There is not an
explicit code
requirement, but
an expectation for
city staff based on
municipal code
the SD Ethics
Commission.
recruitment rules,
and salary setting.
county guidelines
for this.
Retirement
system has
their own
policies for
areas such as
payment
processing
ORS has internal
policies and
procedures, dating
back to the year
2000. Staff
reported that, in
some cases, they
were not aware of
policies.
SFERS staff, as city
employees,
generally follow
city policies for any
procurement or
payment
processing.
LACERS can
develop additional
or supplementary
policies that should
not be in conflict
citywide policies.
SDCERS sets
internal
operational
policies, rules, and
requirements for
staff.
CFRS does not
have their own
internal policies for
payment
processing and
follow the city’s
policies for this.
OCERS reporting
having their own
procurement
policy.
ACERA reports
having their own
policy for vendor
procurement, but
generally follow
the county’s rules
for payment
processing.
Board
appoints the
CEO
YES YES YES YES YES YES YES
Internal
auditor(s)
YES
Hired by CEO
NO YES
Audit Department
Manager appointed
by the General
Manger in
consultation with
the Audit
Committee
YES
Board appointed
YES
Board
appoints/hires
Independent
Auditor
YES
Audit Committee
appoints the
Director of
Internal Audits
YES
Chief of Internal
Audits appointed
by the CEO
Audit
committee
YES NO YES YES NO YES YES
D-3
Source: Auditor analysis of questionnaire responses and interviews with benchmarked retirement systems
Legal support
for retirement
system
ORS contracts for
external legal
counsel. Does not
have internal legal
counsel nor
receives support
from City
Attorney’s Office.
SFERS is assigned
legal counsel by
the City
Attorney’s Office.
The City
Attorney’s Office
is responsible for
contracting for
external legal
counsel for the
System, as needed.
LACERS is
assigned legal
counsel by the
City Attorney’s
Office. They also
retain external
legal counsel.
SDCERS maintains
internal legal
support as well as
retaining external
legal counsel.
CFRS only
maintains external
legal counsel to
support retirement
system operations.
OCERS maintains
internal legal
support as well as
retaining external
legal counsel.
ACERA maintains
internal legal
support as well as
retaining external
legal counsel.
D-4
This page was intentionally left blank
TO: J oe Rois FROM: Roberto Peña
City Auditor Director
SUBJECT: See Below DATE: October 10, 2023
Approved Date
SUBJECT: Response to the audit of Retirement Services: Report on the Alignment of Controls Between the City and the Office of Retirement Services
BACKGROUND
The Office of Retirement Services ( “ORS”) has reviewed the Audit of Retirement Services:
Report on the Alignment of Controls Between the City and the Office of Retirement Services (“Report”), and we partially agree with the recommendation identified in the Report. The ORS response to the finding of the City Auditor’s recommendation is provided below.
Although ORS is a department of the City of San Jose (“City”), it is unique from any other City department. This is because, under San Jose Municipal Code (“SJMC”) § 2.04.3120, ORS serves and operates at the pleasure and direction of the Boards of Administration (“Boards”) for the Federated City Employees’ Retirement System (“Federated”) and Police and Fire Department Retirement Plan (“Police and Fire Plan”), who are independent fiduciaries separate from the City—the plan sponsor.
The California Constitution grants the Boards plenary and exclusive authority over t he administration of the public retirement systems they are charged to oversee. Because the Boards are fiduciaries who owe a duty to the members and beneficiaries of the retirement plans, the City’s governing law provides the Boards with independence in administration so that the Boards have flexibility in how best to discharge those fiduciary duties. Indeed, t he San Jose City Charter and Municipal Code acknowledge and recognize the Boards’ independence in matters relating to the administration of these public retirement systems. Charter § 810; SJMC §§ 3.28.310 (Federated),
3.36.510 (Police and Fire); see also id. § 3.28.100 (Federated), & 3.36.300 (Police and Fire).
ORS exists to serve the operational needs of the independent Boards in administering the retirement systems. The Boards delegate authority to ORS staff to assist the Boards in carrying out the day-to-day business operations of the plan. Although ORS carries out its functions at the direction of the Boards, it remains a City Department, subject to the City’s authority on compensation and budgeting issues.
Given this unique hybrid arrangement between the City and ORS, the Boards are engaging their governance consultant and legal counsel to clarify the rules, procedures and pr otocols that will apply to ORS in administering the retirement systems and will work with the City to establish ground rules where roles and responsibilities overlap.
City Auditor
October 10, 2023
Management Response to the audit of Retirement Services: Report on the Alignment of Controls Between the City and the Office of Retirement Services
T
he City in many instances has useful, existing resources that benefit ORS’ operations . The City has policies on areas of ethics, conflict-of-interests, gifts prohibitions, revolving door employment that all City employees are bound to follow and the Boards may adopt. There are several areas where the City provides services for the two retirement plans (e.g., human resources, IT infrastructure, risk management, premises, etc.), and the Boards may exercise its judgment to utilize City processes.
RECOMMENDATIONS AND ADMINISTRATION’S RESPONSE
Fin
ding 1: Alignment of ORS and City Policies Would Strengthen Internal Controls Over ORS Operations.
RECOMMENDATION
T
o strengthen its internal control system, ORS and the Retirement Boards should work with the City to either:
• Adopt City policies and procedures related to information technology, procurement, a nd ot
her administrative functions, or
• Develop a set of internal policies and procedures that align with the City’s in these areas.
Administration’s Response: The ORS partially agrees with this recommendation.
O
RS recognizes that updates and improvements in policies and procedures need to be prioritized.
The Boards are embarking on the process of engaging with an external governance consultant to work with our legal counsel on developing a set of policies and procedures to ensure that the Office of Retirement Services has efficient operations and strong internal controls around administrative functions. ORS will also work with the City on areas of overlap in operations, where prudent to do so and at the direction of the Boards.
Target Date for Completion: June 2024
CONCLUSION
The Office of Retirement Services would like to extend its gratitude to the City Auditor’s Office which dedicated their time to the completion of this audit.
Roberto L. Peña
Chief Executive Officer
Office of Retirement Services