City of Santa Clara
Meeting Agenda
Audit Committee
Virtual Meeting9:00 AMFriday, February 3, 2023
Pursuant to California Government Code Section 54953(e) and City of Santa Clara Resolution 23-9178, the Audit Committee meeting will be held by teleconference only. No physical location will be available for this meeting; however, the City of Santa Clara continues to have methods for the public to participate remotely:
Join from a PC, Mac, iPad, iPhone or Android device:
Please click this URL to join: https://santaclaraca.zoom.us/j/99199624617 Webinar ID: 991 9962 4617
Or join by phone:
US: +1 669 900 6833
CALL TO ORDER AND ROLL CALL
CONSENT CALENDAR
None
PUBLIC PRESENTATIONS
[This item is reserved for persons to address the body on any matter not on the agenda that is within the subject matter jurisdiction of the body. The law does not permit action on, or extended discussion of, any item not on the agenda except under special circumstances. The governing body, or staff, may briefly respond to statements made or questions posed, and appropriate body may request staff to report back at a subsequent meeting.]
GENERAL BUSINESS
1. Overview of the Citywide Risk Assessment and Proposed 2023-2024 Audit Work Plan
23-155
Accept the results of the citywide risk assessment
report from Baker Tilly and approve the proposed
2023-2024 audit work plan, and recommend that
these reports be forwarded for note and file to the full Council at the February 21, 2023 Joint Council and
Authorities Concurrent and Stadium Authority
Meeting.
Recommendation:
ADJOURNMENT
Future Audit Committee Meetings will be scheduled at a later date.
Audit Committee Meeting Agenda February 3, 2023
MEETING DISCLOSURES
The time limit within which to commence any lawsuit or legal challenge to any quasi-adjudicative decision made by the City is governed by Section 1094.6 of the Code of Civil Procedure, unless a shorter limitation period is specified by any other provision. Under Section 1094.6, any lawsuit or legal challenge to any quasi-adjudicative decision made by the City must be filed no later than the 90th day following the date on which such decision becomes final. Any lawsuit or legal challenge, which is not filed within that 90-day period, will be barred. If a person wishes to challenge the nature of the above section in court, they may be limited to raising only those issues they or someone else raised at the meeting described in this notice, or in written correspondence delivered to the City of Santa Clara, at or prior to the meeting. In addition, judicial challenge may be limited or barred where the interested party has not sought and exhausted all available administrative remedies.
If a member of the public submits a speaker card for any agenda items, their name will appear in the Minutes. If no speaker card is submitted, the Minutes will reflect "Public Speaker."
In accordance with the requirements of Title II of the Americans with Disabilities Act of 1990 ("ADA"), the City of Santa Clara will not discriminate against qualified individuals with disabilities on the basis of disability in its services, programs, or activities, and will ensure that all existing facilities will be made accessible to the maximum extent feasible. The City of Santa Clara will generally, upon request, provide appropriate aids and services leading to effective communication for qualified persons with disabilities including those with speech, hearing, or vision impairments so they can participate equally in the City’s programs, services, and activities. The City of Santa Clara will make all reasonable modifications to policies and programs to ensure that people with disabilities have an equal opportunity to enjoy all of its programs, services, and activities.
Agendas and other written materials distributed during a public meeting that are public record will be made available by the City in an appropriate alternative format.
Contact the City Clerk’s Office at 1 408-615-2220 with your request for an alternative format copy of the agenda or other written materials.
Individuals who require an auxiliary aid or service for effective communication, or any other disability-related modification of policies or procedures, or other accommodation, in order to participate in a program, service, or activity of the City of Santa Clara, should contact the City’s ADA Coordinator at 408-615-3000 as soon as possible but no later than 48 hours before the scheduled event.
City of Santa Clara
Agenda Report
1500 Warburton Avenue
Santa Clara, CA 95050
santaclaraca.gov
@SantaClaraCity
23-155 Agenda Date: 2/3/2023
REPORT TO AUDIT COMMITTEE
SUBJECT
Overview of the Citywide Risk Assessment and Proposed 2023-2024 Audit Work Plan
BACKGROUND
Per Section 900 of the City Charter, the City Auditor’s duties and responsibilities include conducting in-depth financial and performance audits, overseeing the City’s performance management system, auditing and approving all bills, invoices, payrolls, demands or charges against the City government before payment and, with the advice of the City Attorney, making reports to the City Council as to the regularity, legality and correctness of such claims, demands or charges. The City Auditor’s Office conducts its work under the auditing standards prescribed by the Institute of Internal Auditors (IIA).
The IIA International Standards for the Professional Practice of Internal Auditing (Standards) requires the City Auditor’s Office to “establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization’s goals” and consider the input from senior management and a governing board.
DISCUSSION
The role of the Audit Committee (Committee) is to provide oversight of the City’s financial reporting processes, internal controls, and independent auditors. The city entered into a contract with Baker Tilly US, LLP to perform the City’s first risk assessment and using the results of that work, provide recommended projects to make up the audit work plan for both the 2023 and 2024 calendar years.
Accordingly, staff will present the results of the risk assessment to the audit committee for input and approval of an audit work plan.
ENVIRONMENTAL REVIEW
The action being considered does not constitute a “project” within the meaning of the California Environment Quality Act (“CEQA”) pursuant to CEQA Guidelines section 15378(a)(4) in that it is a fiscal activity that does not involve any commitment to any specific project which may result in a potential significant impact on the environment.
FISCAL IMPACT
Costs associated with the preparation of this report are included in the City’s FY 2022/23 Adopted Operating Budget.
COORDINATION
This report has been coordinated with the City Manager’s Office.
PUBLIC CONTACT
Public contact was made by posting the Council agenda on the City’s official-notice bulletin board outside City Hall Council Chambers. A complete agenda packet is available on the City’s website City of Santa Clara Printed on 1/30/2023Page 1 of 2
powered by Legistar™
23-155 Agenda Date: 2/3/2023
and in the City Clerk’s Office at least 72 hours prior to a Regular Meeting and 24 hours prior to a Special Meeting. A hard copy of any agenda report may be requested by contacting the City Clerk’s Office at (408) 615-2220, email [email protected] <mailto:[email protected]> or at the public information desk at any City of Santa Clara public library.
RECOMMENDATION
Accept the results of the citywide risk assessment report from Baker Tilly and approve the proposed 2023-2024 audit work plan, and recommend that these reports be forwarded for note and file to the full Council at the February 21, 2023 Joint Council and Authorities Concurrent and Stadium Authority Meeting.
Reviewed and Approved by: David Noce, Audit Manager
ATTACHMENTS
1. City of Santa Clara - Citywide Risk Assessment and 2023-2024 Audit Work Plan
2. City of Santa Clara IA Risk Assessment Audit Plan
City of Santa Clara Printed on 1/30/2023Page 2 of 2
powered by Legistar™
1 February 3, 2023
City of Santa Clara
City Auditor’s Office
Citywide Risk Assessment and Proposed 2023 – 2024
Audit Work Plan
Contents
Baker Tilly US, LLP, trading as Baker Tilly, is an independent member of Baker Tilly International. Baker Tilly International Limited is an English company. Baker Tilly International provides no professional services to clients. Each member firm is a separate and independent legal entity, and each describes itself as such.
Baker Tilly US, LLP is not Baker Tilly International’s agent and does not have the authority to bind Baker Tilly International or act on Baker Tilly International’s behalf. None of Baker Tilly International, Baker Tilly US, LLP nor any of the other member firms of Baker Tilly International has any liability for each other’s acts or omissions. The name Baker Tilly and its associated logo is used under license from Baker Tilly International Limited.
INTRODUCTION ............................................................................................................... 1 RISK ASSESSMENT APPROACH .................................................................................. 3 RISK ASSESSMENT RESULTS ...................................................................................... 4 PROPOSED 2023 - 2024 AUDIT PLAN ........................................................................... 9 APPENDICES ................................................................................................................. 11
1 Introduction
Overview
Background
The California Government Code Section 1236 requires all cities that conduct audit activities to conduct their work under the general and specified standards prescribed by the Institute of Internal Auditors (IIA) or the Government Auditing Standards (GAO) issued by the Comptroller General of the United States, as appropriate. The internal audit function will govern itself by adh erence to the mandatory el ements of the Internat ional Standards for the Professional Practice of Internal Auditing (the Standards). According to the IIA Standard 2010, the head of internal audit function “must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization’s goals” and consider the input from senior management and a governing board.
The City Auditor’s Office (CAO) engaged Baker Tilly US, LLP (Baker Tilly) in 2022 to conduct a citywide risk assessment and prepare an annual audit work plan for five years. The purpose of the internal audit function’s risk assessment is to develop an audit plan that assigns internal audit resources to the activities that add the most value to the City of Santa Clara (the City). The risk assessment process involves identifying and measuring risks associated with the audit universe (a list of specific departments, functions, processes, programs, etc. that can be subject to an audit, i.e. auditable units). Risk is defined as “the possibility of an event or condition occurring that will have an impact on the ability of an organization to achieve its objectives.”1
Audit Planning
This report summarizes Baker Tilly’s risk assessment methodology, analysis, and results. The 2023–2024 audit plan proposed in this report is based on the results of this risk assessment. T he risk assessment involved collaboration with City Council and executive management from 14 main departments across the organization.
In conducting the 2022 risk assessment, we performed the following:
Developed an understanding of the City’s environment, businesses, and objectives Met with members of City Council and the Ex ecutive Management Team representing the major operations and administrative functions of the City
Reviewed key documentation such as the City Co uncil Priority Matrix, the annual budget documents, financial statements, departmental strategic plans, and prior audit reports Evaluated the results of interviews and documentatio n reviews and considered industry factors to identify areas of risk to the City
In developing the 2023–2024 Audit Plan, we considered the following:
Risk assessment – Internal audit activities to target high and moderate risk areas based on the results of the risk assessment
Adding value – Internal audit activities to add value through independent and objective analysis City Council – The CAO reports to the Ci ty Council and seeks input on audit priorities Coverage and other audits – Consideration of prior and other audits as well as pervasiveness of the process or control to ensure audit coverage and to avoid duplication of efforts Scheduling – Consideration of the timing of an audi t and other on-going initiatives in order to avoid putting an undue burden on City staff that may exacerbate the risk at hand or other interrelated risks
1 Rick A, Wright Jr., CIA, “The Internal Auditor’s Guide to Risk Assessment” The Institute of Internal Auditors Research Foundation (IIARF), 2018
2 INTRODUCTION
Organizational Strengths
Through the risk assessment, we observed certain strengths of the City. Key strengths include:
Dedication to the citizens and business community
High value on financial stability and public safety
Focus on excellence and affordability
Highly professional and dedic ated management and staff
Risk Assessment Process Considerations
The starting point of the internal auditing is to conduct a risk assessment that is the basis for determining the internal audit activities. However, it is not a one-size-fits-all process. The scope and complexity of risk assessment are affected by various factors such as the maturity level of the internal audit function’s products and services, the organization’s enterprise risk management (ERM) efforts, coordination with other monitoring and risk management functions, and the stakeholders’ expectations. The best practice is to focus on risks related to the achievement of the organization’s strategies and objectives. The internal audit risk assessment needs to be conducted at least annually, and internal auditors should monitor the environment for changes and emerging risks.
In addition to the annual macro-level risk assessment, the internal audit function is required to perform an engagement-level risk assessment when starting each audit listed in the approved audit plan. The IIA Standard 2200 states, “Internal auditors must develop and document a plan for each engagement, including the engagement’s objectives, scope, timing, and resource allocations. The plan must consider the organization’s strategies, objectives, and risks relevant to the engagement.”
Risk assessment can also be conducted as part of risk management as one of the essential elements of organizational governance. ERM is defined as “the culture, capabilities, and practices, integrated with strategy- setting and performance, that organizations rely on to manage risk in creating, preserving, and realizing value.” 2 ERM is more than having a list of all the risks for an organization. The COSO’s ERM principles covering governance to monitoring (including defining risk appetite and implementing risk responses), apply to all levels and functions of an organization although management has overall responsibility for managing risks and a governing body has an oversight role. The internal audit function may leverage ERM information, if available, for efficiency and quality of its risk assessment.
2 “COSO Enterprise Risk Management-Integrating with Strategy and Performance”, The Committee of Sponsoring Organizations of the Treadway Commission (COSO), 2017
3 Risk Assessment Approach
Baker Tilly’s risk assessment approach consisted of four phases as illustrated in the graphic below.
2022 RISK ASSESSMENT PHASES
Planning
Worked with the CAO to determine the approp riate approach to plan and perform the risk assessment
Scheduled the interviews with City Coun cil members and Executive Management Team (EMT) members
Information
Gathering
Reviewed the key documents such as Council Priority Matrix, the biennial budget documents, the annual comprehensive financial report, departmental strategic plans, audit reports, the information on the City’s website and other relevant documents. Interviewed over 30 individuals to identify the events and conditions that may affect the achievement of objectives
Distributed a questionnaire to the EMT member s- to gather additional information on each auditable unit
Analysis
Obtained and considered the financial data, budget data, employee turnover data, application inventory, and claims information
Scored the auditable units in the risk ma trix based on the likelihood and the impact3 of potential adverse events
o Each of the auditable units received scor es for various risk factors related to the likelihood or impact (defined in Appendix A)
o Risk factor scores were summed to create a single score for the auditable unit Identified potential internal audit activities for the auditable units with high risk scores Reporting
Summarized the approach and resu lts of the risk assessment
Baker Tilly conducted the first risk assessment by interviewing all City Council members and EMT members and reviewing the key documents and data. Our risk assessment process primarily measured inherent risk (the risk before mitigating controls/factors are applied) in the City’s current environment.
The next risk assessment will include an update to this risk assessment in accordance with the contract. For the second-year risk assessment, Baker Tilly will interview the EMT members and also conduct a risk assessment survey to obtain input from other members of management. For the third and fifth year, the existing audit plan will be evaluated based on interviews with City audit staff and amended if necessary. For the fourth year, a full risk assessment and a survey will be conducted.
3 Likelihood is the possibility that an event will occur. Impact is the extent to which an event might affect an organization.
4 Risk Assessment Results
Citywide Key Risk Areas
Baker Tilly performed interviews with members of City Council and the Executive Management Team. During these interviews, Baker Tilly asked them to describe the areas they view to be the top five risks facing the City overall, regardless as to whether it is specific to their area of focus/department or not. The following is a list of risk themes identified in those interviews:
- Strategic Workforce Planning
- Budget and Financial Performance
- Compliance and Legal Risks
- Organizational Governance
- Information Technology & Cybersecurity
Strategic Workforce Planning
- Employee Recruitment & Retention – Attracting and retaining high-performing employees is a complex challenge facing the City. Recent legislation such as the Public Employee Pension Reform Act of 2013 (PEPRA) made public employment less attractive in the State of California as retirement benefits became less generous. In addition, the City’s high cost of living limits the applicant pool as many employees and prospective employees commute long distances to work for the City. - Employee Turnover – The City faces potential risk of employee turnover in a variety of critical positions due to retirement eligibility, perceived or actual lack of upward mobility, and competitiveness of compensation and benefits in comparison to the cost of living. Employee turnover for any reason creates gaps in institutional knowledge. Succession planning, documenting standard operating procedures and cross training are key considerations for entities facing this dynamic.
Financial
- Revenue Generation – Although the City has many sources of revenue, some of which are healthy and stable, the City also relies on economically sensitive revenues such as sales tax and transient occupancy tax. The City has been a hub for the world’s top technology firms and owns Levi’s Stadium and Convention Center, which bring in visitors to hotels, restaurants, and retail. These visitors and daytime population help feed the sales and transient occupancy taxes. The COVID-19 pandemic has highlighted weaknesses in the reliability of this revenue structure. - Funding – The City faces difficult budget reductions necessary to bring the budget into balance. As a result, some essential accounts, programs, and capital projects remain unfunded.
Compliance/Legal
- Compliance with Laws, Regulations, and Contracts – The City has a complex regulatory compliance environment, in which the City must comply with numerous laws and regulations, local ordinances, contracts and grant agreements, and policies and procedures. Failure to track and update relevant laws and regulations may lead to external audit findings, fines, reputational harm and other negative outcomes.
- Litigation – The City has been involved in multiple lawsuits and settlements in recent years.
Governance
- Leadership – Effective local government governing body and officers must think and act strategically and collaborate with a network of community entities and institutions at the national, state, and local level. Operating in an environment where there are numerous stakeholders and key partners can strain the governance system and impair the ability to meet citizens’ needs and organizational objectives.
5 RISK ASSESSMENT RESULTS
Information Technology
- Cybersecurity – Ransomware and malware attacks are growing threats facing all municipal governments. These cyberattacks may result in significant financial losses, costly service disruption, and loss of information. The City faces similar threats on a daily basis and seeks to ensure that its information security practices and controls mitigate these risks.
Department Descriptions and Key Risk Areas
When identifying risks for the City, Baker Tilly considered each department and associated risks. The concerns listed by the interviewees included limited staffing and succession planning, specific accounts or programs with limited or no funding, aged infrastructure, lawsuits, and drought. Based on these concerns, departments’ functions, and their inherent risks, Baker Tilly identified the auditable risk areas for each department. Below is an overview of the City’s departments and their key risk areas.
City Attorney’s Office
The City Attorney’s Office provides hearing and trial counsel services and other legal advisory services such as
review/negotiation of contracts, preparation of resolutions and ordinances, attendance to all meetings of the City Council, and response to legal inquiries.
Key Risk Areas
- Case management
- Conflict of interest monitoring
City Clerk’s Office
The Elected City Clerk administers City elections. The Assistant City Clerk is responsible for various day-to-day operations, including attending and maintaining records of City Council and public meetings; complying with Records Retention Schedule; responding to Public Records Act requests, and administering campaign and disclosure laws.
Key Risk Areas
- Public Records Act compliance
- Records retention program
City Manager’s Office
The City Manager’s Office supports the City Council with policy decision making, provides direction and support to all City departments, and is responsible for strategic planning, citywide emergency preparedness, economic development, community outreach and engagement, property management, special
projects, and implementation of Council direction. It also provides general administration for citywide programs, citywide strategic programs and initiatives (such as sustainability), convention center, and stadium operations.
Key Risk Areas
- Property management
- Convention center operation
- Stadium operation
- Business continuity plan for the City
departments
Community Development Department
The Community Development Department’s primary objectives are maintenance of the General Plan, proactive land use planning to meet the future needs of the community, delivery of professional services such as development review and permitting and inspection services, and administration of programs related to affordable housing.
Key Risk Areas
- Building permitting & inspection
- Housing inspection
- Development projects review
- Code enforcement
- Affordable housing program
Electronic Utility Department
The Electric Utility Department (Silicon Valley Power, or SVP) owns power generation facilities, has investments in joint ventures that produce electric power, and trades power on the
Key Risk Areas
- Power Purchase Agreements
- Renewable energy programs
6 RISK ASSESSMENT RESULTS
open market. SVP delivers electricity to the residents and businesses and provides diverse services such as dispatch services to all City departments, outdoor Wi-Fi services, dark fiber leasing service, and energy efficiency programs.
- Procurement and contract management
- Work Order and Asset Management
- Cybersecurity
- Construction project controls
Finance Department
The Finance Department administers the City’s financial affairs.
Departmental functions include budget; general accounting; financial reporting; collection of taxes, fees, special assessments, and utility charges; investment; procurement; the City Warehouse operations; and debt management.
Key Risk Areas
- Procurement Card Administration
- Vendor master file
- Timesheet processing
- Utility billing and collection process
- Investment management
- Warehouse/inventory management
Fire Department
The Fire Department provides fire and emergency services and organized into Administration and six divisions: Field Operations (first responders providing immediate services); Emergency Medical Services (first responder medical services); Community Risk Reduction (fire prevention activities and hazardous materials regulation by providing plan review and inspection services); Training (State and Federal certification programs);
Administrative (grant management, payroll processing, budget development, etc.); Office of Emergency Services (emergency preparedness activities and disaster management plans).
Key Risk Areas
- Overtime
- Field inspection services
- Training
- Emergency medical services
Human Resources Department
The Human Resources Department is responsible for Benefits, Compensation, Recruitment, Testing, Classification, Employee and Labor Relations, Equal Employment Opportunity, Workers Compensation/Safety, and Employee development. The
department also negotiates the Memorandum of Understanding agreements with bargaining units.
Key Risk Areas
- Staff development and succession
planning for the City departments
- Workers' Compensation and Safety
- Employee records management
Information Technology Department
The Information Technology Department's IT service provider provides most IT services including enterprise computing (City data centers and network), service desk, end-user support, application management, configuration and maintenance of over 150 applications, and security services (including security incident and event management). The City IT employees are responsible for IT governance and budget.
Key Risk Areas
- Cybersecurity Assessment
- Managed Service Provider (MSP)
contract management
- Application portfolio management
- Data management
Library Department
The Library Department has three libraries throughout the City and also provides Bookmobile service. It offers physical and digital collection of books/movies/music, technology and information access, literacy instruction, and programming such as young adults activities. The Library Department establishes
Key Risk Areas
- Memorandum of Understanding with the
Santa Clara Library Foundation &
Friends
- Fee collection
- Purchasing
7 RISK ASSESSMENT RESULTS
partnerships with community organizations to leverage
resources.
Parks and Recreation Department
The Parks and Recreation Department consists of the Parks Division (planning, development, operation, maintenance and rehabilitation of City parks); the Recreation Division (classes and programs); the Cemetery Division (maintaining 33,000 interment sites), and the Senior Nutrition Program Division (a meals program). The Department offers the public with facility rentals, community services, cultural programs, and special events.
Key Risk Areas
- Park infrastructure
- Park revenue
Police Department
The Police Department is broken down into four divisions. The Field Operations Division is comprised of uniformed personnel that respond to calls for service and initiate proactive contacts.
The Investigations Division, which includes the Records Unit, handle follow-up investigations and bring cases forth for criminal prosecution. The Special Operations Division oversees law enforcement services for any major event within the city, including Levi’s Stadium. The Administrative Services Division encompasses the department’s Training Unit, School and
Community Services, and 911-Comunucations Center.
Key Risk Areas
- Overtime
- Body-worn camera
- Use of force policies
- Evidence processing and storage
- Case management
Department of Public Works
The Department of Public Works is responsible for design, construction, and maintenance of the City infrastructure. The five divisions for engineering services are Administration, Traffic, Design, Land and Property Development, and Field services divisions. Operation and maintenance is provided by Facilities Services, Streets, and Feet Management divisions.
Key Risk Areas
- Construction project controls
- The Americans with Disabilities Act
(ADA) compliance
- Maintenance service requests
- Grant management
Water and Sewer Utilities Department
The Water and Sewer Utilities Department provides planning, design, construction, maintenance, and operation of the City’s water distribution system, sewer collection system, and recycled water system. The City jointly owns the San Jose-Santa Clara Regional Wastewater Facility.
Key Risk Areas
- Construction project controls
- Water conservation and sustainability
programs
- Rate setting practices
- Work order and asset management
8 RISK ASSESSMENT RESULTS
Overall Risk Scoring Distribution
Baker Tilly structured the audit universe
based on the department/division/program
from the budget document and
management’s feedback, which resulted in
124 auditable units (Appendix B). We scored
them based on the information gathered for
each risk factor related to the likelihood,
impact, or fraud. Appendix A lists the risk
factors, definitions, and scoring method. The
maximum score for an auditable unit is 12.
The following chart shows the distribution of
overall risk scoring.
City Department Risk Heat Map
A risk heat map is a common tool to plot risks or auditable units in order to measure their relative risks in terms of impact and likelihood. The risk heat map for the City below illustrates the City’s departments based only on the highest risk division/program within each department, and therefore, it represents only 14 out of 124 auditable units. The departments toward the upper right corner of the heat map represent those with higher possibilities of greater effect. The size of a bubble indicates the fraud risk factor score.
9 Proposed 2023 - 2024 Audit Plan
Summary
The proposed audits and CAO projects for 2023 through 2024 are listed in the next page. The projects were selected from the auditable units that were rated as High or Moderate as a results of the risk assessment. The selection was made based on some factors such as risk rating, the pervasiveness of the process or control, the audit coverage, the timing of projects, and the value-adding activities that help the City enhance the ability to manage risks, strengthen accountability, and improve efficiency and effectiveness. The proposed projects include the following:
Efficiency improvement: Building Permitting Process Review Capital assets: Construction Project Control Assessment; Work Order Process and Asset Management Compliance: Overtime Review; Power Purchase Agreement Review Operations: Park Operation Review
Finance: Procurement Card Administration Review
IT-related audits: Cybersecurity Assessmen t; Service Provider Contract Management Citywide processes: Succession Planning & St aff Development Review; Record Management and Retention
CAO project: Risk and Control Matrix
The proposed audit plan consists of a variety of projects for a 24-month period to provide flexibility to adjust the timing of audits. It also incorporates time for an ad hoc project to address a request from the City management, if necessary. The audit plan will be updated based on the results of an annual risk assessment. However, amendments to the approved audit plan may be proposed during a year in response to changes in the City’s environment such as organizational structure, operations, risks, systems, and controls.
The preliminary audit objectives are described for each audit listed. These objectives and scope of each audit activity will be further defined based on the result of an audit planning risk assessment process performed at the beginning of each activity.
Also listed in the proposed audit plan are the estimated hours to complete each audit. The budgeted hours should be determined once audit objectives and scope are finalized during the audit planning phase. The current CAO resources are two full-time employees (Internal Audit Manager and a staff member), and their total available hours would be over 3,000 hours per year. However, the CAO’s capacity to execute the audit plan is very limited due to the following reasons:
1. The staff member will not be available to execute the internal audit activities due to the responsibility to “audit and approve all bills, invoices, payrolls, demands or charges against the City government before payment”, which is required by the Santa Clara City Code Sec. 909 City Auditor
4. 2. The approval before payment is a control activity in the operational/transactional process. According to Standard 1130 of the IIA Standards5, it would be an impairment to organizational independence and individual objectivity if the staff member performs an audit of the processes related to her approvals.
3. The Internal Audit Manager who supervises the internal audit staff also performs the same tasks whenever the staff member cannot perform the approval and other related duties.
It is recommended that the City evaluate the current roles and responsibilities of the CAO and take the appropriate action(s) to ensure that the CAO will achieve its mission and help the City improve the effectiveness of risk management, control, and governance processes.
4 The Charter of the City of Santa Clara Article IX Officers and Employees, Sec. 909 City Auditor ( CHARTER OF THE CITY OF SANTA CLARA (codepublishing.com) )
5 Standard 1130.A1 states. “Internal auditors must refrain from assessing specific operations for which they were previously responsible. Objectivity is presumed to be impaired if an internal auditor provides assurance services for an activity for which the internal auditor had responsibility within the previous year.”
10 Proposed Audit Plan for 2023 and 2024
Department Project Title Preliminary Audit Objectives Estimated Hours
Electric Utility Department
Information Technology Department
Finance Department Procurement card administration
• Determine whether procurement cards are administered to ensure that only the authorized users can make purchases in accordance with the requirements and guidelines.
• Determine whether internal controls over procurement card transactions are in place and working effectively to prevent and detect errors and irregularities, including duplicate, unauthorized, or improper transactions. 330
Community Development Department Building permitting process Assess the efficiency and effectiveness of the building permitting p rocess 360 Library Department Memorandum of Understanding (MOU) with the Santa Clara Library Foundation & Friends
Determine whether the internal controls to monitor the compliance with the MOU requirements are in place and working effectively 240
Department of Public Works Construction project control assessment Determine whether internal controls over construction projects are adequate and working effectively 300 CAO project / Citywide Risk and control matrix Create a risk and control matrix for each department to be utilizied for future discussion and review of the City's control environment 840
TBD Ad Hoc Requests TBD 200
2,920
Information Technology Department Managed Service Provider (MSP) contract management
Determine whether the City proactively manages its cybersecurity risk and collaborates with its MSP to jointly reduce the risk by defining roles/responsibilities and expectations such as security controls and incident response plans and by monitoring of MSP's access and activities.
400
Police Department
Fire Department
Electric Utility Department Power purchase agreements • Assess the process for evaluating and entering into power purchase agreements. • Assess the effectiveness of the internal controls in overseeing the power purchase agreements 370 Parks & Recreation Department Park operation • Determine whether the internal controls over the maintenance of parks are working effectively. • Determine whether the internal controls over fee collection are working effectively. 380 City Manager's Office Property management Evaluate the efficiency and effectiveness of the City's property management 240 Water and Sewer Utilities Department Work order process and asset management Determine whether the internal controls over the wor k order process are adequate and working effectively. 420 City Clerk's Office Record management and retention program • Determine whether citywide record management and retention policies and procedures are properly established in accordance with laws and regulations
• Determine whether internal controls are working effectively to ensure compliance with the record management and retention policies and procedures
300
Human Resources / Citywide Citywide succession planning and staff development
• Determine whether adequate policies and procedures are in place to development and maintain succession plans to ensure continuity in key positions for all departments
• Determine whether coaching and development programs are in place to ensure that the successors are prepared to assume positions when necessary
300
TBD Ad Hoc Requests TBD 200
2,910
5,830TOTAL - 2023 & 2024
Sub Total - 2023
Sub Total - 2024
Cybersecurity assessment
• Map current state security capabilities to the NIST Cybersecurity Framework and/or other industry specific frameworks and evaluate the maturity of current security processes
• Identify current risks related to weaknesses in the City’s cybersecurity program • Identify target state objectives utilizing the Capability Maturity Model (CMMI) and develop recommendation to meet the ob
jectives
650
Public safety personnel overtime
• Determine whether adequate policies and procedures are in place to ensure the appropriate usage of overtime for the public safety personel.
• Determine whether the overtime practice and reporting comply with the City's policies and procedures. 300
11 Appendix A: Resumes
Appendices
12 Appendix A: Risk Factor Definitions
Factor Definition Weight
Magnitude
A measure of materiality based on pervasiveness or volume of dollars or transactions; Scores based on the budgeted expenditure amount
Extreme - 5: $50M or more
Material - 4: $10M or more; Less than $50M
Significant - 3: $3M or more; Less than $10M
Moderate - 2: $1M or more; Less than 3M
Inconsequential - 1: Less than $1M
Added 1 to the magnitude of the Information Technology Department due to the pervasive nature of its work 30%
Customer /
Resident
Experience
Negative experience by customers and residents, such as perceived or actual safety concerns and unsatisfactory services, impacts negatively on the reputation / credibility of the organization Extreme - 5: Direct impact on health and safety
Material - 4: Direct impact on transparency
Significant - 3: Direct impact on customer satisfaction/City's reputation Moderate - 2: Indirect impact on customer satisfaction/City's reputation Inconsequential - 1: Immaterial impact on reputation / credibility 35%
Achievement of
Organizational
Goals
The greater the effect that a department or process has on the organization meeting strategic objectives and goals, the greater the related risks
Extreme - 5: Directly relates to the City Council Priorities Material - 4: Supports the function/process directly related to the City Council Priorities Significant - 3: Has performance/workload measures related to Strategic Pillars Moderate - 2: Somewhat relates to the organizational goals Inconsequential - 1: Does not relate to City's priorities and goals 35%
100%
Complexity
A measure of the difficulty in performing a process or function. As a process or function becomes more complex, the greater the opportunity for errors
5 - Very high complexity
4 - High complexity
3 - Medium complexity
2 - Low complexity
1 - Very low complexity
25%
Policies and
Procedures
Policies and Procedures are a complete set of written instructions that guide personnel in the successful execution of their duties and the duties of the office for which they work. If the policies and procedures are adequate and up-to-date, a risk is lower
5 - No or little written P&P
4 - Some written P&P
3 - Basic P&P requiring improvements
2 - Adequate but outdated P&P
1 - Adequate and up-to-date P&P or Not Applicable
10%
Regulatory
Compliance
Measures the existence of and potential noncompliance with, government regulations and other applicable laws, standards, and policies/procedures
5 - Requirements to meet more than a few laws/regulations and professional standards specific to the division's responsibilities
3 - Requirements to meet one or two laws/regulations and professional standards specific to he division's responsibilities 1 - No requirement to meet any laws/regulations or professional standards specific to he division's responsibilities 25%
Monitoring
Consider the existence of monitoring activities, including the results of last audits by Internal Auditor, External Auditor, Regulators, etc. and other known deficiencies
5 - Overall, there is no mechanism to monitor the status of performance goals/compliance requirements 4 - For only some significant performance goals/compliance requirements, there is an annual or semi-annual reporting, management review process and/or audits by an external party to identify the status of performance goals/compliance requirements
3 -For all significant performance goals/compliance requirements, there is an annual or semi-annual reporting, management review process and/or audits by an external party to identify the status of performance goals/compliance requirements 2 - For only some of significant performance goals/compliance requirements, there is a periodic (weekly/monthly/quarterly) reporting process to ensure performance goals/compliance requirements are met 1 - For all significant performance goals/compliance requirements, there is a periodic (weekly/monthly/quarterly) reporting process to ensure performance goals/compliance requirements are met 10%
Specific Risks
Consider the existence of specific risk events/conditions and their significance 5 - Identified risk event(s)/condition(s) seem to significantly affect the liklihood 3 - Identified risk event(s)/condition(s) seem to have some impact on the liklihood 1 - No or very minor risk event(s)/condition(s) have been identified 30%
100%
Fraud Schemes
Consider tthe susceptibility to fraud, which is the opportunity for employees/vendors/customers/fraudsters to misappropriate resources or defraud the organization*
5 - High Risk
3 - Moderate Risk
1 - Low Risk
40%
40%
Impact Factors (the effect on the organization)
Likelihood Factors (the probability of the risk occurring) Other Risk Factor
* Considered fraud schemes listed in the Fraud Tree provided in the “Occupational Fraud 2022: A report to the Nations” by Association of Certified Fraud Examiners. Also considered are cyber fraud schemes.
HIGHEST TOTAL SCORE FOR IMPACT: 5
HIGHEST TOTAL SCORE FOR LIKELIHOOD: 5
HIGHEST TOTAL SCORE FOR OTHER: 2
HIGHEST TOTAL SCORE 12
13 Appendix B: Audit Universe
City Attorney’s Office
Administration
Litigation
City Clerk’s Office
Assistant City Clerk - Council/Administration Support
Assistant City Clerk - Public Information/Legislation Records Management Assistant City Clerk - Political Reform Act
Elected City Clerk - Election
City Manager’s Office
City Council Support - Policy Support for Decision Making City Council Support - Intergovernmental Relations & Advocacy Leadership and Management Services - Day to Day Operations Leadership and Management Services - Strategic Planning Leadership and Management Services - Community Outreach & Engagement Citywide Programs
Stadium Operations
Citywide Strategic Programs & Initiative
Convention Center
Community Development Department
Planning- Development Review
Planning- Advanced Planning
Planning- Historical Preservation
Planning- Code Enforcement
Building - Plan Review
Building - Permit Services
Building - Field Inspection
Building - Code Enforcement
Housing Inspection
Housing and Community Services - Federal State Grant
Housing and Community Services - Neighborhood Conservation and Improvement Program Housing and Community Services - Tenant Based Rental Assistance Program (Funded by HUD HOME) Housing and Community Services - Below Market Rate Rental Program (BMR) Housing and Community Services - Below Market Rate Purchase Program (BMP) Housing and Community Services - Community Development Housing Successor Fund Housing and Community Services - Housing Development Lending (Various Funds) Electronic Utility Department
Business Services - Rates and Budget
Business Services - Electric Compliance
Business Services - Risk Management
Customer Develop. & Project Man. - Key Accounts
Customer Develop. & Project Man. - Fiber Program
Customer Develop. & Project Man. - SVP Engineering
Resource Planning & Engagement - Public Benefits
Resource Planning & Engagement - SVP Electric Vehicle Program Resource Planning & Engagement - Greenhouse Gas Program Resource Planning & Engagement - Resource Management
Utility Operations - SVP Systems Support
Utility Operations - Power System Controls
Utility Operations - Communications & Meter Technical Support Utility Operations - Substation Maintenance
Utility Operations - Transmission & Distribution
Utility Operations - Generation
Finance Department
General Accounting
Citywide Fiscal Planning & Administration
Budget & Financial Analysis
Municipal Services - Utility Billing Services
Municipal Services - Revenue Receipt-Cashiering
Municipal Services - Business Certificate
Municipal Services - Field Service
14 Municipal Services – Administration
Municipal Services - Contact Center/Communication
Purchasing
Purchasing - Warehouse
Fire Department
Administration
Community Risk Reduction - Prevention and Hazardous Materials Community Risk Reduction - Certified United Program Agency (CUPA) Emergency Medical Services
Field Operations
Office of Emergency Services
Training
Human Resources Department
Employee Benefits and Records – Compensation
Employee Benefits and Records - Workers' Compensation & Safety Recruitment, Classification and Staff Development - Selection and Classification Recruitment, Classification and Staff Development - Labor Relations Information Technology Department
Enterprise Services - Application Services
Enterprise Services - IT Web Services
Enterprise Services - GIS Services
Infrastructure and Support
Contract Services
Telecommunication Services
Library Department
Administration
Adult Services
Branch Services - Mission Library
Branch Services - Northside Branch
Branch Services - Bookmobile & Mobile Library Services
Customer Services
Technical and Technology Services
Youth Services
Parks and Recreation Department
Administration
Parks
Recreation
Cemetery
Police Department
Administrative Services - Administration
Administrative Services - Professional Standards
Administrative Services - Departmental Support
Administrative Services - Community Services
Administrative Services - 911 Dispatch/Communications
Field Operations - General Patrol
Field Operations – Traffic
Field Operations - Emergency Response/Temporary Holding Facility Investigations - General Investigation
Investigations - Special Enforcement Team
Investigations – Records
Special Operations – General
Special Operations - Specialized Teams
Special Operations - Reserves
Department of Public Works
Engineering – Traffic
Engineering – Design
Engineering - Land and Property Development
Engineering - Field Services
Facility Services
Fleet Management
Streets
15 Water and Sewer Utilities Department
Recycled Water Program - System Maintenance
Recycled Water Program - Storm Pump Maintenance
Sewer - System Administration
Sewer - System Maintenance
Sewer – Operations
Sewer - San Jose-Santa Clara Water Pollution Control Plant Sewer - Storm Pump Maintenance
Solar Utility - System Maintenance
Water Engineering - Admin Design
Water Engineering - Water Quality
Water Engineering - Water Resources
Water Construction, Maintenance, Operations - Water System Maintenance Water Construction, Maintenance, Operations - Water Construction Water Construction, Maintenance, Operations - Water System Operations Baker Tilly US, LLP, trading as Baker Tilly, is a member of the global network of Baker Tilly International Ltd., the members of which are separate and independent legal entities. © 2022 Baker Tilly US, LLP.
Citywide Risk
Assessment and
Annual Internal
Audit Work Plan
February 3, 2023
2 2
I. Baker Tilly - Who We Are
II. Internal Audit’s Risk Assessment for
Audit Planning
III. Risk Assessment Methodology
IV. Risk Assessment Results
V. Proposed Audit Work Plan
Table of Contents
Baker Tilly -
Who We Are
4 At a glance
BAKER TILLY – WHO WE ARE
5 Engagement Management
BAKER TILLY – WHO WE ARE
Adriane D. McCoy, CIA, CGAP, CISA, CFSA, CFE,
CAMS, CSOE
Director, Public Sector Advisory
Adriane is a public sector services professional with more than 25 years of internal audit experience in state, local and federal government agencies. She serves as a trusted business partner to staff and management, consulting on ways to strengthen and improve operations to reduce risk and improve process
efficiencies. Adriane focuses on risk management, business processes and procedures, compliance, and operations.
6 Engagement Management
BAKER TILLY – WHO WE ARE
Chiemi Perry, CPA, CIA, CISA, CFE
Manager, Public Sector Advisory
Chiemi leverages 20+ years of experience to help state and local government agencies improve their processes and
controls efficiently and effectively to mitigate risks and comply with applicable contract terms, laws, and regulations.
Internal Audit’s
Risk Assessment
for Audit Planning
8 The Institute of Internal Auditors
https://www.theiia.org/en/standards/what-are-the-standards/definition-of-internal-audit/ Internal auditing is an independent, objective
assurance and consulting activity designed to add
value and improve an organization's operations. It
helps an organization accomplish its objectives by
bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management,
control, and governance processes.
9 Risk Assessment
INTERNAL AUDIT’S RISK ASSESSMENT FOR AUDIT PLANNING Risk – The possibility of an event or condition occurring
that will have an impact on
the ability of an organization
to achieve its objectives*
Purpose – To develop an
audit plan that assigns
internal audit resources to
the activities that add the
most value to an organization
Process - Identifying and
measuring risks associated
with the audit universe
Identify, measure, and
prioritize risk
Identify, measure, and
prioritize risk
Risk‐based
Audit Plan
Risk‐based
Audit Plan
Risk‐based
Audit Plan
Identify, measure, and
prioritize risk
Allocate internal audit
resources
Risk‐based
Audit Plan
Risk‐based
Audit Plan
Risk‐based
Audit Plan
Assess the progress against the
audit plan
Follow up on management’s
corrective actions
Communicate audit results
1.Risk Assessment
Plan and execute approved
audits
Monitor emerging risks
and changes in
organization and
environment
3.Engagement
Identify, measure, and
prioritize risk
Allocate internal audit
resources
2.Risk‐based
Audit Plan
4.Reporting
5.Follow‐Up
6.Monitoring
7.Assessment
Internal Auditing
Annual Cycle
Risk
Assessment
Methodology
11 Phase
RISK ASSESSMENT METHODOLOGY
12 Phase
RISK ASSESSMENT METHODOLOGY
13 Phase
RISK ASSESSMENT METHODOLOGY
14 Risk Factor - Impact
RISK ASSESSMENT METHODOLOGY
15 Risk Factor - Likelihood
RISK ASSESSMENT METHODOLOGY
16 Risk Factor – Likelihood
RISK ASSESSMENT METHODOLOGY
17 Risk Factor – Other
RISK ASSESSMENT METHODOLOGY
18 Audit Universe
RISK ASSESSMENT METHODOLOGY
19 Risk Matrix
RISK ASSESSMENT METHODOLOGY
Risk
Assessment
Results
21 Overall Risk Scoring Distribution
RISK ASSESSMENT RESULTS
22 Citywide Key Risk Areas
RISK ASSESSMENT RESULTS
• Strategic Workforce Planning
o Employee Recruitment & Retention
o Employee Turnover
• Budget and Financial Performance
o Revenue Generation
o Funding
• Compliance and Legal Risks
o Compliance with Laws, Regulations, and Contracts
o Litigation
• Organizational Governance
o Leadership
• Information Technology & Cybersecurity
23 City Department Risk Heat Map
RISK ASSESSMENT RESULTS
24 Department Key Risk Areas
RISK ASSESSMENT RESULTS
City Attorney’s Office
• Case management
• Conflict of interest monitoring
City Clerk’s Office
• Public Records Act compliance
• Records retention program
City Manager’s Office
• Property management
• Convention center operation
• Stadium operation
• Business continuity plan for the City
departments
Community Development Department
• Case management
• Conflict of interest monitoring
City Clerk’s Office
• Building permitting & inspection
• Housing inspection
• Development projects review
• Code enforcement
• Affordable housing program
Library Department
• Memorandum of Understanding with the
Santa Clara Library Foundation & Friends
• Fee collection
• Purchasing
25 Department Key Risk Areas
RISK ASSESSMENT RESULTS
Electronic Utility Department
• Power Purchase Agreements
• Renewable energy programs
• Procurement and contract management
• Work Order and Asset Management
• Cybersecurity
• Construction project controls
Finance Department
• Procurement Card Administration
• Vendor master file
• Timesheet processing
• Utility billing and collection process
• Investment management
• Warehouse/inventory management
Fire Department
• Overtime
• Field inspection services
•T r a i n i n g
• Emergency medical services
Human Resources Department
• Staff development and succession
planning for the City departments
• Workers' Compensation and Safety
• Employee records management
Parks and Recreation Department
• Park infrastructure
• Park revenue
26 Department Key Risk Areas
RISK ASSESSMENT RESULTS
Information Technology Department
• Cybersecurity Assessment
• Managed Service Provider (MSP)
contract management
• Application portfolio management
• Data management
Police Department
• Overtime
• Body-worn camera
• Use of force policies
• Evidence processing and storage
• Case management
Department of Public Works
• Construction project controls
• The Americans with Disabilities Act (ADA)
compliance
• Maintenance service requests
• Grant management
Water and Sewer Utilities Department
• Construction project controls
• Water conservation and sustainability programs
• Rate setting practices
• Work order and asset management
Proposed
Audit Work
Plan
28 Audit Project Selection
PROPOSED AUDIT WORK PLAN
• Selection based on some factors such as:
o Risk rating
o Pervasiveness of the process or control
o Audit coverage
o Timing of projects
o Value-added activities that help the City enhance the ability to manage risks, strengthen accountability, and improve efficiency and effectiveness • A variety of projects for a 24-month period
o Flexibility to adjust the timing of audits
o Amendments during a year in response to changes in the City’s environment such as organizational structure, operations, risks, systems, and controls 29 CAO Resources
PROPOSED AUDIT WORK PLAN
• Two full-time employees:
o Internal Audit Manager
o Staff member
• Limited capacity due to:
1. Santa Clara City Code Sec. 909 City Auditor
• The responsibility to “audit and approve all bills, invoices, payrolls, demands or charges against the City government before payment.”
2. Control activities performed in the operati onal/transactional process (Approval before payment) • Impairment to organizational independence and individual objectivity if the staff member performs an audit of the processes related to their approvals (Standard 1130 of the IIA Standards).
3. Supervisory responsibility of the Internal Audit Manager • Influence over the staff member who performs control activities • A need to perform control activity whenever the staff member cannot perform the approval and other related duties
• It is recommended that the City evaluate the current roles and responsibilities of the CAO and take the appropriate action(s) to ensure that the CAO will achieve its mission 30 Proposed 2023 Plan
PROPOSED AUDIT WORK PLAN
31 Proposed 2024 Plan
PROPOSED AUDIT WORK PLAN
Questions?