Audit Committee
Meeting
Discussion of Internal
Audit Workplan
March 30, 2023
Recap
• The audit committee met on February 3, 2023 to review the City’s first Citywide risk assessment performed by Baker Tilly and also present a proposed audit plan for the years 2023 and 2024. We discussed how the audit plan was developed with the risk assessment ratings being the underlying data points for the audits that are proposed.
• The committee asked staff to come back for further discussion about the priority of the projects and put in place the order in which they will be performed, either in 2023 or 2024.
2 Proposed 2023 Projects
3 -- -
UE°!l1.lllllliilll ~llilll)
.... Ill, ----- ...... Ia~1 11rnI1~1
I =11~ 11 1111 11 ,, , .,.!TJTi 1111, ,11 •, ..... ::." IIlmm .. .. .. ..
Electric Umy Departme nt
• Map current state securrry capabilrries to the NI ST Cybersecurity Framework andlor other industry specific frameworks and evaluate the maturity of current security processes
Cybersecurity assessment • Identify current risks related to weaknesses in the City's cybersecurrry program 650 lnformafon Technology Department • I de ntify target state objectives utilizing the Capabil rry Maturity Model (CMMI) and develop recoffill);ndation to meet the obiectives
• Dete mine whether procurement cards are administered to ensure that only the authorized users can make purchases in Finance Department Procurement card administration accordance with the requirements and gu~elines. 330 • Detemine whether internal controls over procurement card transactions are in place and wor~ng effective~ to prevent and detect errors and irreoularities inciudinq duplicate unauthorized or iITll)rooer transactions.
Conmmity Development Department Building perrritting process Assess the efficiency and effectweness of the bui~ing perrritting process 360 Library Department Merm randum of Understanding (MOU) wrrh Deterrrine whether the internal controls to rmnrror the compliance wrrh the MOU requirements are in place and wor~ng 240 the Santa Clara Librarv Foundation & Friends eff ectivelv Department of Public Works Construction proj:!ct control assessment Deterrrine whether internal controls over construction projects are adequate and wor~ng effective~ 300 CNJ proj:!ct / Citywide Risk and control matrix Create a risk and control matrix for each department to be utilizied for future discussion and review of the Citys control 840 en~ronment TBD M Hoc Requests TBD 200
Sub Total -2023 2,920
Proposed 2024 Projects
4 Information Technology Department
Police Department
Managed Service Provider (MSP) contract
management
- -------------< Public safety personnel overtime
Fire Department
Electric Utility Department Power purchase agreements
Parks & Recreation Department Park operation
City Manager's Office Property management
Determine whether the City proactive~ manages its cybersecurity risk and collaborates with its MSP to joint~ reduce the risk by defining roles/responsibilities and expectations such as security controls and incident response plans and by monitoring of MSP's access and activities.
• Determine whether adequate policies and procedures are in place to ensure the appropriate usage of overtime for the public safety personel.
• Determine whether the overtime practice and reporting comp~ with the City's policies and procedures. • Assess the process for evaluating and entering into power purchase agreements. • Assess the effectiveness of the internal controls in overseein the ower urchase a reements • Determine whether the internal controls over the maintenance of parks are working effective~. • Determine whether the internal controls over fee collection are workin effective .
Evaluate the efficiency and effectiveness of the City's property management 400
300
370
380
240
Water and Sewer Utilities Department Work order process and asset management Determine whether the internal controls over the work order process are adequate and working effective~. 420 City Clerk's Office
Human Resources / Citywide
TBD
Record management and retention program
Citywide succession planning and staff
development
Ad Hoc Requests
• Determine whether citywide record management and retention policies and procedures are properly established in accordance with laws and regulations
• Determine whether internal controls are working effectively to ensure compliance with the record management and retention policies and procedures
• Determine whether adequate policies and procedures are in place to development and maintain succession plans to ensure continuity in key positions for all departments
• Determine whether coaching and development programs are in place to ensure that the successors are prepared to assume positions when necessary
TBD
300
300
200
Sub Total· 2024 2,910
Staff Recommendation
Calendar Year 2023
Department Project Title Preliminary Audit Objectives Estimated Duration
Electric Utility and
Information
Technology
Cybersecurity
assessment
• Map current state security capabilities to the NIST
Cybersecurity Framework and/or other industry specific
frameworks and evaluate the maturity of current security processes
• Identify current risks related to weaknesses in the City’s cybersecurity program
• Identify target state objectives utilizing the Capability Maturity Model (CMMI) and develop recommendation to meet the
objectives
12-16 weeks
Electric Utility
Department
Power purchase
agreements
• Assess the process for evaluating and entering into power purchase agreements.
• Assess the effectiveness of the internal controls in overseeing the power purchase agreements
12-16 weeks
City Manager's
Office Property management Evaluate the efficiency and effectiveness of the City's property management 12-16 weeks
5 Staff Recommendation
Calendar Year 2024
Department Project Title Preliminary Audit Objectives
Estimated
Duration
Finance
Department
Procurement card
administration
• Determine whether procurement cards are administered to ensure that only the authorized users can make purchases in accordance with the requirements and guidelines.
• Determine whether internal controls over procurement card transactions are in place and working effectively.
12-16 weeks
Community
Development
Department
Building permitting
process
Assess the efficiency and effectiveness of the building permitting process 12-16 weeks
Library
MOU with the Santa
Clara Library
Foundation & Friends
Determine whether the internal controls to monitor the
compliance with the MOU requirements are in place and
working effectively
12-16 weeks
Police & Fire
Department
Public safety personnel
overtime
• Determine whether adequate policies and procedures are in place to ensure the appropriate usage of overtime for the public safety personnel and whether the overtime practice and
reporting comply with the City's policies and procedures. 12-16 weeks
6 Recommendation
•Approve the proposed 2023 & 2024 audit work
plan and recommend that the citywide risk
assessment and prioritized audit workplan be
forwarded for note and file to the full Council at a
future Joint Council and Authorities Concurrent
and Stadium Authority Meeting.
7