Agenda packet — Audit Committee, March 21, 2024

City of Santa Clara
Meeting Agenda
Audit Committee
Hybrid Meeting
Council Conference Room/Virtual
City Hall - East Wing
1500 Warburton Avenue
Santa Clara, CA 95050
9:00 AMThursday, March 21, 2024
The City of Santa Clara is conducting the Audit Committee meetings in a hybrid manner (in-person and continues to have methods for the public to participate remotely).

Join from a PC, Mac, iPad, iPhone or Android device:

Please click this URL to join: https://santaclaraca.zoom.us/j/99199624617 Webinar ID: 991 9962 4617
Or join by phone:

US: +1 669 900 6833

CALL TO ORDER AND ROLL CALL

CONSENT CALENDAR

1. Audit Committee Minutes24-303
Approve the Audit Committee minutes of November
15, 2023.

Recommendation:

PUBLIC PRESENTATIONS
[This item is reserved for persons to address the body on any matter not on the agenda that is within the subject matter jurisdiction of the body. The law does not permit action on, or extended discussion of, any item not on the agenda except under special circumstances. The governing body, or staff, may briefly respond to statements made or questions posed, and appropriate body may request staff to report back at a subsequent meeting.]

GENERAL BUSINESS

2. Overview of the Annual Citywide Risk Assessment and
Proposed 2024-2025 Audit Work Plan
24-299
Accept the results of the citywide risk assessment
report from Baker Tilly US, LLP and approve the
prioritized proposed 2024-2025 audit work plan, and
recommend that these reports be forwarded for note
and file to the full Council at a future Joint Council and Authorities Concurrent and Stadium Authority
Meeting.

Recommendation:

Page 1 of 3 ends

Audit Committee Meeting Agenda March 21, 2024

ADJOURNMENT
Future Audit Committee Meetings will be scheduled at a later date.

MEETING DISCLOSURES

Page 2 of 3 ends

Audit Committee Meeting Agenda March 21, 2024
The time limit within which to commence any lawsuit or legal challenge to any quasi-adjudicative decision made by the City is governed by Section 1094.6 of the Code of Civil Procedure, unless a shorter limitation period is specified by any other provision. Under Section 1094.6, any lawsuit or legal challenge to any quasi-adjudicative decision made by the City must be filed no later than the 90th day following the date on which such decision becomes final. Any lawsuit or legal challenge, which is not filed within that 90-day period, will be barred. If a person wishes to challenge the nature of the above section in court, they may be limited to raising only those issues they or someone else raised at the meeting described in this notice, or in written correspondence delivered to the City of Santa Clara, at or prior to the meeting. In addition, judicial challenge may be limited or barred where the interested party has not sought and exhausted all available administrative remedies.

If a member of the public submits a speaker card for any agenda items, their name will appear in the Minutes. If no speaker card is submitted, the Minutes will reflect "Public Speaker."
In accordance with the requirements of Title II of the Americans with Disabilities Act of 1990 ("ADA"), the City of Santa Clara will not discriminate against qualified individuals with disabilities on the basis of disability in its services, programs, or activities, and will ensure that all existing facilities will be made accessible to the maximum extent feasible. The City of Santa Clara will generally, upon request, provide appropriate aids and services leading to effective communication for qualified persons with disabilities including those with speech, hearing, or vision impairments so they can participate equally in the City’s programs, services, and activities. The City of Santa Clara will make all reasonable modifications to policies and programs to ensure that people with disabilities have an equal opportunity to enjoy all of its programs, services, and activities.

Agendas and other written materials distributed during a public meeting that are public record will be made available by the City in an appropriate alternative format.

Contact the City Clerk’s Office at 1 408-615-2220 with your request for an alternative format copy of the agenda or other written materials.

Individuals who require an auxiliary aid or service for effective communication, or any other disability-related modification of policies or procedures, or other accommodation, in order to participate in a program, service, or activity of the City of Santa Clara, should contact the City’s ADA Coordinator at 408-615-3000 as soon as possible but no later than 48 hours before the scheduled event.

Page 3 of 3 ends

City of Santa Clara
Agenda Report
1500 Warburton Avenue
Santa Clara, CA 95050
santaclaraca.gov
@SantaClaraCity
24-303 Agenda Date: 3/21/2024

REPORT TO AUDIT COMMITTEE

SUBJECT
Audit Committee Minutes

RECOMMENDATION
Approve the Audit Committee minutes of November 15, 2023.

City of Santa Clara Printed on 3/15/2024Page 1 of 1
powered by Legistar™
City of Santa Clara
Meeting Minutes
Audit Committee
Draft
3:00 PM Hybrid Meeting
Council Conference Room/Virtual
City Hall - East Wing
1500 Warburton Avenue
Santa Clara, CA 95050
11/15/2023
The City of Santa Clara is conducting the Audit Committee meetings in a hybrid manner (in-person and continues to have methods for the public to participate remotely).

Join from a PC, Mac, iPad, iPhone or Android device:

Please click this URL to join: https://santaclaraca.zoom.us/j/99199624617 Webinar ID: 991 9962 4617
Or join by phone:

US: +1 669 900 6833

CALL TO ORDER AND ROLL CALL
Chair Park was absent so Member Jain was the Sub-Chair for this meeting.

Sub-Chair Jain called the meeting to order at 3:01 PM.

Member Kathy Watanabe, and Member Suds JainPresent 2 -
Chair Kevin ParkAbsent 1 -

CONSENT CALENDAR

1. 23-1289 Audit Committee Minutes
Recommendation: Approve the Audit Committee minutes of June 28, 2023.

A motion was made by Member Watanabe, seconded by
Member/Sub-Chair Jain, to approve the Audit Committee Minutes of June 28, 2023.

Aye: Member Watanabe, and Member Jain2 -

Absent: Chair Park1 -

Page 1 ends

11/15/2023Audit Committee Meeting Minutes

PUBLIC PRESENTATIONS
None.

GENERAL BUSINESS

2. 23-1268 Action to Accept Report of Whistleblower Hotline Activity as of September 30, 2023
Recommendation: Accept the report on the Whistleblower Hotline activity as of September 30, 2023.

Audit Manager, David Noce gave a presentation.

Committee Members’ questions and comments followed.

Audit Manager, David Noce addressed the Committee Members’ questions.

A motion was made by Member Watanabe, seconded by
Member/Sub-Chair Jain, to accept the report on the Whistleblower Hotline activity as of September 30, 2023.

Aye: Member Watanabe, and Member Jain2 -

Absent: Chair Park1 -

3. 23-1283 Action to Accept Audit Work Plan Status Update Report as of September 30, 2023
Recommendation: Accept the City Auditor’s Office Work Plan Status Update Report as of September 30, 2023 and recommend the report be forwarded to the full City Council for note and file at a future Council and Authorities Concurrent meeting.

Audit Manager, David Noce gave a presentation.

Committee Members’ questions and comments followed.

Audit Manager Noce addressed the Committee Members’ questions.

Member/Sub-Chair Jain asked for an update on the estimated hours required by Baker Tilly to perform the work. Audit Manager Noce to follow up with this question later after he reviews the invoices from Baker Tilly.

A motion was made by Member Watanabe, seconded by
Member/Sub-Chair Jain, to accept the City Auditor’s Office Work Plan Status Update Report as of September 30, 2023 and
recommend the report be forwarded to the full City Council for note and file at a future Council and Authorities Concurrent meeting.

Page 2 ends

11/15/2023Audit Committee Meeting Minutes

ADJOURNMENT
Sub-Chair Jain adjourned the meeting at 3:47 PM.

The next scheduled meeting is on Monday, November 27, 2023 in the Council Conference Room.

MEETING DISCLOSURES

Page 3 ends

11/15/2023Audit Committee Meeting Minutes
The time limit within which to commence any lawsuit or legal challenge to any quasi-adjudicative decision made by the City is governed by Section 1094.6 of the Code of Civil Procedure, unless a shorter limitation period is specified by any other provision. Under Section 1094.6, any lawsuit or legal challenge to any quasi-adjudicative decision made by the City must be filed no later than the 90th day following the date on which such decision becomes final. Any lawsuit or legal challenge, which is not filed within that 90-day period, will be barred. If a person wishes to challenge the nature of the above section in court, they may be limited to raising only those issues they or someone else raised at the meeting described in this notice, or in written correspondence delivered to the City of Santa Clara, at or prior to the meeting. In addition, judicial challenge may be limited or barred where the interested party has not sought and exhausted all available administrative remedies.

Agendas and other written materials distributed during a public meeting that are public record will be made available by the City in an appropriate alternative format.

Contact the City Clerk’s Office at 1 408-615-2220 with your request for an alternative format copy of the agenda or other written materials.

Page 4 ends

City of Santa Clara
Agenda Report
1500 Warburton Avenue
Santa Clara, CA 95050
santaclaraca.gov
@SantaClaraCity
24-299 Agenda Date: 3/21/2024

REPORT TO AUDIT COMMITTEE

SUBJECT
Overview of the Annual Citywide Risk Assessment and Proposed 2024-2025 Audit Work Plan

BACKGROUND
Per Section 909 of the City Charter and Chapter 2.29 of the City Code, the City Auditor’s duties and responsibilities include conducting in-depth financial and performance audits, overseeing the City’s performance management system, auditing and approving all bills, invoices, payrolls, demands or charges against the City government before payment and, with the advice of the City Attorney, making reports to the City Council as to the regularity, legality and correctness of such claims, demands or charges. The City Auditor’s Office conducts its work under the auditing standards prescribed by the Institute of Internal Auditors (IIA). The IIA International Standards for the Professional Practice of Internal Auditing (Standards) requires the City Auditor’s Office to “establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization’s goals” and consider the input from senior management and a governing board.

DISCUSSION
The role of the Audit Committee (Committee) is to provide oversight of the City’s financial reporting processes, internal controls, and independent auditors. In 2022, the City entered into a contract with Baker Tilly US, LLP to perform the annual risk assessment and using the results of that work, assist with project recommendations to make up the audit work plan for each calendar year. Accordingly, staff will present the results of the risk assessment to the audit committee along with the proposed 2024-2025 audit work plan for input and approval.

ENVIRONMENTAL REVIEW
The action being considered does not constitute a “project” within the meaning of the California Environment Quality Act (“CEQA”) pursuant to CEQA Guidelines section 15378(a)(4) in that it is a fiscal activity that does not involve any commitment to any specific project which may result in a potential significant impact on the environment.

FISCAL IMPACT
Costs associated with the preparation of this report are included in the City’s FY 2023/24 Adopted Operating Budget.

COORDINATION
This report has been coordinated with the City Manager’s Office and City Attorney’s Office.

PUBLIC CONTACT
Public contact was made by posting the Council agenda on the City’s official-notice bulletin board outside City Hall Council Chambers. A complete agenda packet is available on the City’s website City of Santa Clara Printed on 3/15/2024Page 1 of 2
powered by Legistar™
24-299 Agenda Date: 3/21/2024
and in the City Clerk’s Office at least 72 hours prior to a Regular Meeting and 24 hours prior to a Special Meeting. A hard copy of any agenda report may be requested by contacting the City Clerk’s Office at (408) 615-2220, email [email protected] <mailto:[email protected]> or at the public information desk at any City of Santa Clara public library.

RECOMMENDATION
Accept the results of the citywide risk assessment report from Baker Tilly US, LLP and approve the prioritized proposed 2024-2025 audit work plan, and recommend that these reports be forwarded for note and file to the full Council at a future Joint Council and Authorities Concurrent and Stadium Authority Meeting.

Reviewed and Approved by: David Noce, Audit Manager

ATTACHMENTS

1. City of Santa Clara - Citywide Risk Assessment and 2024-2025 Audit Work Plan

2. City of Santa Clara IA Risk Assessment Audit Plan PowerPoint Presentation City of Santa Clara Printed on 3/15/2024Page 2 of 2
powered by Legistar™

1 March 21, 2024
City of Santa Clara
City Auditor’s Office
Citywide Risk Assessment and Proposed 2024 - 2025
Audit Work Plan
(t bakerti lly

Contents
Baker Tilly US, LLP, trading as Baker Tilly, is an independent member of Baker Tilly International. Baker Tilly International Limited is an English company. Baker Tilly International provides no professional services to clients. Each member firm is a separate and independent legal entity, and each describes itself as such.

Baker Tilly US, LLP is not Baker Tilly International’s agent and does not have the authority to bind Baker Tilly International or act on Baker Tilly International’s behalf. None of Baker Tilly International, Baker Tilly US, LLP nor any of the other member firms of Baker Tilly International has any liability for each other’s acts or omissions. The name Baker Tilly and its associated logo is used under license from Baker Tilly International Limited.

INTRODUCTION ............................................................................................................. 1 RISK ASSESSMENT APPROACH ................................................................................. 3 SURVEY RESULTS ........................................................................................................ 4 RISK ASSESSMENT RESULTS ..................................................................................... 6 PROPOSED 2024 - 2025 AUDIT PLAN ........................................................................ 12 APPENDICES ............................................................................................................... 14

1 Introduction
Overview
Background
The California Government Code Section 1236 requires all cities that conduct audit activities to conduct their work under the general and specified standards prescribed by the Institute of Internal Auditors (IIA) or the Government Auditing Standards (GAO) issued by the Comptroller General of the United States, as appropriate. The internal audit function will govern itself by adherence to the mandatory elements of the International Standards for the Professional Practice of Internal Auditing (the Standards). According to the IIA Standard 2010, the head of internal audit function “must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization’s goals” and consider the input from senior management and a governing board.

The City Auditor’s Office (CAO) engaged Baker Tilly US, LLP (Baker Tilly) in 2022 to conduct a citywide risk assessment and prepare an annual audit work plan for five years. The purpose of the internal audit function’s risk assessment is to develop an audit plan that assigns internal audit resources to the activities that add the most value to the City of Santa Clara (the City). The risk assessment process involves identifying and measuring risks associated with the audit universe (a list of specific departments, functions, processes, programs, etc. that can be subject to an audit, i.e. auditable units). Risk is defined as “the possibility of an event or condition occurring that will have an impact on the ability of an organization to achieve its objectives.” 1

Audit Planning
This report summarizes Baker Tilly’s risk assessment methodology, analysis, and results. The 2024–2025 audit plan proposed in this report is based on the results of this risk assessment. The risk assessment involved collaboration with City Council and senior leadership from 14 main departments across the organization.

In conducting the 2023 risk assessment, we performed the following:
 Updated an understanding of the City’s environment, businesses, and objectives  Met with members of City Council and the Senior Leadership Team representing the major operations and administrative functions of the City
 Reviewed key documentation such as the City Council Priority Matrix, the annual budget documents, financial statements, departmental strategic plans, and prior audit reports  Conducted a risk assessment survey to gain additional insight from the City employees  Evaluated the results of interviews and documentation reviews and considered industry factors to identify areas of risk to the City

In developing the 2024–2025 Audit Plan, we considered the following:
 Risk assessment – Internal audit activities to target high and moderate risk areas based on the results of the risk assessment
 Adding value – Internal audit activities to add value through independent and objective analysis  City Council – The CAO reports to the City Council and seeks input on audit priorities  Coverage and other audits – Consideration of prior and other audits as well as pervasiveness of the process or control to ensure audit coverage and to avoid duplication of efforts  Scheduling – Consideration of the timing of an audit and other on-going initiatives in order to avoid putting an undue burden on City staff that may exacerbate the risk at hand or other interrelated risks

1 Rick A, Wright Jr., CIA, “The Internal Auditor’s Guide to Risk Assessment” The Institute of Internal Auditors Research Foundation (IIARF), 2018 (G bakertilly

2 INTRODUCTION

Organizational Strengths
Through the risk assessment, we observed certain strengths of the City. Key strengths include:
 Dedication to the citizens and business community
 High value on financial stability and public safety
 Focus on excellence and affordability
 Highly professional and dedicated management and staff

Risk Assessment Process Considerations
The starting point of the internal auditing is to conduct a risk assessment that is the basis for determining the internal audit activities. However, it is not a one-size-fits-all process. The scope and complexity of risk assessment are affected by various factors such as the maturity level of the internal audit function’s products and services, the organization’s enterprise risk management (ERM) efforts, coordination with other monitoring and risk management functions, and the stakeholders’ expectations. The best practice is to focus on risks related to the achievement of the organization’s strategies and objectives. The internal audit risk assessment needs to be conducted at least annually, and internal auditors should monitor the environment for changes and emerging risks.

In addition to the annual macro-level risk assessment, the internal audit function is required to perform an engagement-level risk assessment when starting each audit listed in the approved audit plan. The IIA Standard 2200 states, “Internal auditors must develop and document a plan for each engagement, including the engagement’s objectives, scope, timing, and resource allocations. The plan must consider the organization’s strategies, objectives, and risks relevant to the engagement.”

Risk assessment can also be conducted as part of risk management as one of the essential elements of organizational governance. The ERM is defined as “the culture, capabilities, and practices, integrated with strategy-setting and performance, that organizations rely on to manage risk in creating, preserving, and realizing value.”2 The ERM is more than having a list of all the risks for an organization. The COSO’s ERM principles covering governance to monitoring (including defining risk appetite and implementing risk responses), apply to all levels and functions of an organization although management has overall responsibility for managing risks and a governing body has an oversight role. The internal audit function may leverage ERM information, if available, for efficiency and quality of its risk assessment.

Fraud Considerations
While managing fraud risks is management’s responsibility, internal auditors should consider probability of significant errors, fraud, or noncompliance in exercising due professional care, according to the IIA Standard 1220.A1. For this annual macro-level risk assessment, only general fraud schemes, including the schemes listed in the professional publication and common cyber-attacks, were considered as described in Appendix B. A comprehensive citywide fraud risk assessment is scheduled to be conducted in 20243, and the results will be used as the City’s fraud risk baseline and considered for the future audit planning.

Like the engagement-level risk assessment described above, the IIA Standard (2210.A2) requires internal auditors to “consider the probability of significant errors, fraud, noncompliance, and other exposures when developing the engagement objectives.” Therefore, while we only considered general fraud schemes during this annual risk assessment, potential fraud schemes are considered in detail when an audit is commenced.

2 “COSO Enterprise Risk Management-Integrating with Strategy and Performance”, The Committee of Sponsoring Organizations of the Treadway Commission (COSO), 2017
3 Item #18, Audit Status Report as of September 30, 2023, File #23-1283, https://santaclara.legistar.com/LegislationDetail.aspx?ID=6411701&GUID=8514483F-4EE0-49F9-BFD0-B61222F98093&Options=&Search=

3 Risk Assessment Approach
Baker Tilly’s risk assessment approach consisted of four phases as illustrated in the graphic below.

2023 RISK ASSESSMENT PHASES
Planning
 Prepared risk assessment survey questions and the online survey tool.  Scheduled the interviews with City Council members and Senior Leadership Team (SLT) members
Information
Gathering
 Reviewed the key documents such as Council Priority Matrix, the biennial budget documents, the annual comprehensive financial report, departmental strategic plans, audit reports, the information on the City’s website and other relevant documents.  Distributed a link to the online survey to the selected 56 City’s employees including SLT members who were not scheduled to be interviewed. The survey responses were downloaded in Excel spreadsheet.
 Interviewed all City Councilmembers and some of the City’s managers including SLT members (11 individuals) to identify the events and conditions that may affect the achievement of objectives
 Updated the risk assessment matrix with the information gathered Analysis
 Analyzed the survey responses
 Scored the auditable units (listed in Appendix A) in the risk matrix based on the likelihood and the impact4 of potential adverse events
o Each of the auditable units received scores for various risk factors related to the likelihood or impact (defined in Appendix B)
o Risk factor scores were summed to create a single score for the auditable unit  Identified potential internal audit activities for the auditable units with high risk scores Reporting  Summarized the approach and results of the risk assessment

Baker Tilly conducted the first risk assessment in 2022 by interviewing all City Council members and SLT members and reviewing the key documents and data. The Year 2 risk assessment was conducted as described above to update the first risk assessment. Our risk assessment process primarily measured inherent risk (the risk before mitigating controls/factors are applied) in the City’s current environment.

In Year 3, no risk assessment will be conducted in accordance with the contract. However, the existing audit plan will be evaluated based on discussions with City audit staff and amended if necessary. For the fourth year, a full risk assessment and a survey will be conducted.

4 Likelihood is the possibility that an event will occur. Impact is the extent to which an event might affect an organization. (G bakertilly
Phase I Phase II Phase Ill Phase IV
Planning Information Analysis Reporting
gathering
ra .. % RI
Ongoing project management and collaboration

4 Survey Results
The Baker Tilly team conducted an online risk assessment survey to gather management’s insights for all City departments and received 38 responses (67.9% response rate). The survey questions are listed in Appendix C.

Changes over the past 12 months
All organizations are subject to changing environments that can influence risk to organizations. The COSO 5 Internal Control – Integrated Framework 6 highlights the influence of change in one of the 17 principles. Principle 9 states, “the organization identifies and assesses changes that could significantly impact the system of internal control.” The survey participants were asked to select all significant changes for their team or department during the last 12 months.

Policies and Procedures
Policies and procedures provide a roadmap for
daily operations to ensure compliance with
laws and regulations, give guidance for
decision-making, and establish the standards
and internal controls.

The survey participants were also asked to
select the current state of the policies and
procedures necessary to perform their job
responsibilities.

5 The Committee of Sponsoring Organizations of the Treadway Commission (COSO) is sponsored jointly by five major professional associations headquartered in the United States: the American Accounting Association (AAA), the American Institute of Certified Public Accountants (AICPA), Financial Executives International (FEI), the Institute of Internal Auditors (IIA), and Institute of Management Accountants (IMA). https://www.coso.org/
6 Internal Control – Integrated Framework provides principles-based guidance for designing and implementing effective internal controls.

This framework has become the most widely used internal control framework in the U.S. https://www.coso.org/guidance-on-ic Changes for team or department # of Response
New/additional staff 25
New workflows or business processes 24
Change in workload 21
Unfilled positions 20
Change in compliance requirements 14
Change in organizational structure 13
New vendors and contractors 12
Change in culture 10
New or significant changes in information technology systems 10 New software 9
Change in goals/objectives/performance measures 8
Significant changes in processes or controls 6
Change in any risks previously identified for your team/department 6 Workforce reduction 5
Increased undesirable performance or instances 2
Change in compliance requirements 1
Other 1
<G bakertilly
P&P are adequate and
up-to-date
21%
P&P are adequate but not
updated regularly
26%

5 SURVEY RESULTS
Barriers to meeting goals and objectives in FY2024
The COSO Enterprise Risk Management—Integrating with Strategy and Performance7 provides insight into the links between strategy, risk, and performance through 20 principles. Principle 10 states, “the organization identifies risk that impacts the performance of strategy and business objectives.”
The survey participants were asked about their team/department’s periodic reporting on significant goals and compliance requirements to monitor the performance. The pie chart shows the results.

The survey participants were also asked what can possibly prevent their team/department from meeting its goals and objectives in 2024. The results are summarized below.

Top risk areas selected by the survey participants
The survey participants were asked to select and rank the top five risk areas from 31 risk areas listed in the survey. Based on the number of selection and the ranking given by them, the top 15 risk areas were identified.

For the risks they selected:
 81.6% of the participants think the City management is aware of the risk, but more efforts are needed to help mitigate the risks.  10.5% of the participants think the City management is either not aware of the risks or has not developed sufficient activities to help mitigate the risks.
 7.9% of the participants think the City management is aware of the risks and has implemented activities to help mitigate the risks.

7 Enterprise Risk Management—Integrating with Strategy and Performance addresses the need for organizations to improve their approach to managing risk to meet the demands of an evolving business environment. https://www.coso.org/guidance-erm Rank Risk Area
1 Succession Planning
2 Human Capital Management
3 Reputation
4 Resource Allocation
5 Governance
6 Compliance Management
7 Economy
8 Security
9 Efficiency
10 Strategic Change
11 Procurement/Sourcing
12 Technologies
13 Communication
14 Leadership and Authority
15 Regulatory
Staffing constraints
Inefficiency in process and/or communication
Technology issue
Financial constraints
Limited ski I ls/know ledge/experience/training
Ambiguity in roles and responsibilities
State/Federal regulations
Community pressure
Lack of (or ineffective) internal controls
Other
-
..
0 5 10

PERFORMANCE MONITORING
15 20 25 30 35

6 Risk Assessment Results
Citywide Key Risk Areas
Baker Tilly conducted interviews with members of the City Council and a few members of the Senior Leadership Team and reviewed the survey responses from the selected City employees. Baker Tilly asked them to describe the areas they view to be the top five risks facing the City overall, regardless as to whether it is specific to their area of focus/department or not. The following is a list of risk themes identified in those interviews and survey responses:
Strategic Workforce Planning
Resource Management
Organizational Governance
Compliance and Legal Risks
Information Technology
Strategic Workforce Planning
Succession Planning – As the City experienced turnover in key leadership positions in recent years, many of interviewees and survey respondents expressed a concern on the City’s planning to ensure that there are highly qualified people for leadership positions for the coming years. They expect many individuals with managerial positions to retire over the next several years. A robust citywide succession planning helps the City identify, develop, and train future leaders strategically and retain qualified employees while retention and recruitment continue to be challenging. Staff Development – Human capital management is critical to the effectiveness of the City’s operations.

It requires investment in the workforce by enhancing employees’ skills with on-going training and education and monitoring their performance regularly. On-going training should include sharing institutional knowledge through cross-training and documented policies and procedures. Regular performance monitoring against well-designed and well-defined performance measures helps the development of employees and alignment of their performance with the City’s goals. Successful staff development can result in higher productivity, increased morale, and better retention rates.

Resource Management
Resource Allocation – Efficient resource allocation is important for the City to operate effectively. Some survey respondents mentioned redundancies in a process and responsibilities of staff while others noted multiple hats employees were in order to keep up with the workload and inadequate resources to meet the compliance requirements. As the City continues to change its population, environment, infrastructure, services, and complexity, it needs to continue to monitor and adjust the allocation of the City’s limited resources to provide an acceptable level of services to its citizens and comply with various laws and regulations. Careful strategic planning and prioritization of resource allocation is pivotal for driving economic growth and promoting social welfare.
Funding – The City faces difficult budget reductions necessary to bring the budget into balance. As a result, some essential accounts, programs, and capital projects remain unfunded.

Governance
Leadership – Effective local government governing body and officers must think and act strategically and collaborate with a network of community entities and institutions at the national, state, and local level. Operating in an environment where there are numerous stakeholders and key partners can strain the governance system and impair the ability to meet citizens’ needs and organizational objectives. A city’s reputation comes from perceptions of effective government that is affected by leadership. (G bakertilly

7 RISK ASSESSMENT RESULTS

Compliance/Legal
Compliance with Laws, Regulations, and Contracts – The City has a complex regulatory compliance environment, in which the City must comply with numerous laws and regulations, local ordinances, contracts and grant agreements, and policies and procedures. The survey respondents noted adequate resources to maintain compliance with changing requirements. Failure to track and update relevant laws and regulations may lead to external audit findings, fines, reputational harm and other negative outcomes.
Litigation – The City has been involved in multiple lawsuits and settlements in recent years.

Information Technology
Cybersecurity – Ransomware and malware attacks are growing threats facing all municipal governments. These cyberattacks may result in significant financial losses, costly service disruption, and loss of information. The City faces similar threats on a daily basis and seeks to ensure that its information security practices and controls mitigate these risks. Some survey respondents, however, mentioned inadequate resources to improve security measures.

Department Descriptions and Key Risk Areas
When identifying risks for the City, Baker Tilly considered each department and associated risks. The concerns listed by the interviewees included limited staffing and succession planning, specific accounts or programs with limited or no funding, aged infrastructure, lawsuits, and drought. Based on these concerns, departments’ functions, and their inherent risks, Baker Tilly identified the auditable risk areas for each department. Below is an overview of the City’s departments and their key risk areas.

City Attorney’s Office
The City Attorney’s Office provides hearing and trial counsel services and other legal advisory services such as
review/negotiation of contracts, preparation of resolutions and ordinances, attendance to all meetings of the City Council, and response to legal inquiries.

Key Risk Areas
Case management
Conflict of interest monitoring
City Clerk’s Office
The Elected City Clerk administers City elections. The Assistant City Clerk is responsible for various day-to-day operations, including attending and maintaining records of City Council and public meetings; complying with Records Retention Schedule; responding to Public Records Act requests, and administering campaign and disclosure laws.

Key Risk Areas
Public Records Act compliance
Records retention program

City Manager’s Office
The City Manager’s Office supports the City Council with policy decision making, provides direction and support to all City departments, and is responsible for strategic planning, citywide emergency preparedness, economic development, community outreach and engagement, property management, special
projects, and implementation of Council direction. It also provides general administration for citywide programs, citywide strategic programs and initiatives (such as sustainability), convention center, and stadium operations.

Key Risk Areas
Property management
Convention center operation
Stadium operation
Business continuity plan for the City
departments

8 RISK ASSESSMENT RESULTS
Community Development Department
The Community Development Department’s primary objectives are maintenance of the General Plan, proactive land use planning to meet the future needs of the community, delivery of professional services such as development review and permitting and inspection services, and administration of programs related to affordable housing.

Key Risk Areas
Building permitting & inspection
Housing inspection
Development projects review
Code enforcement
Affordable housing program
Electronic Utility Department
The Electric Utility Department (Silicon Valley Power, or SVP) owns power generation facilities, has investments in joint ventures that produce electric power, and trades power on the open market. SVP delivers electricity to the residents and businesses and provides diverse services such as dispatch services to all City departments, outdoor Wi-Fi services, dark fiber leasing service, and energy efficiency programs.

Key Risk Areas
Power Purchase Agreements
Safety program
Compliance program
Procurement and contract management
Work Order and Asset Management
Cybersecurity
Construction project controls
Finance Department
The Finance Department administers the City’s financial affairs.

Departmental functions include budget; general accounting; financial reporting; collection of taxes, fees, special assessments, and utility charges; investment; procurement; the City Warehouse operations; and debt management.

Key Risk Areas
Procurement Card Administration
Vendor master file
Timesheet processing
Utility billing and collection process
Investment management
Warehouse/inventory management
Fire Department
The Fire Department provides fire and emergency services and organized into Administration and six divisions: Field Operations (first responders providing immediate services); Emergency Medical Services (first responder medical services); Community Risk Reduction (fire prevention activities and hazardous materials regulation by providing plan review and inspection services); Training (State and Federal certification programs);
Administrative (grant management, payroll processing, budget development, etc.); Office of Emergency Services (emergency preparedness activities and disaster management plans).

Key Risk Areas
Overtime
Field inspection services
Training
Emergency medical services
Human Resources Department
The Human Resources Department is responsible for Benefits, Compensation, Recruitment, Testing, Classification, Employee and Labor Relations, Equal Employment Opportunity, Workers Compensation/Safety, and Employee development. The
department also negotiates the Memorandum of Understanding agreements with bargaining units.

Key Risk Areas
Staff development and succession
planning for the City departments
Workers' Compensation and Safety
Employee records management

Information Technology Department
The Information Technology Department's IT service provider provides most IT services including enterprise computing (City data centers and network), service desk, end-user support,

Key Risk Areas
- Cybersecurity Assessment

9 RISK ASSESSMENT RESULTS
application management, configuration and maintenance of over 150 applications, and security services (including security incident and event management). The City IT employees are responsible for IT governance and budget.
- Managed Service Provider (MSP)
contract management
- Application portfolio management
- Data management
Library Department
The Library Department has three libraries throughout the City and also provides Bookmobile service. It offers physical and digital collection of books/movies/music, technology and information access, literacy instruction, and programming such as young adults activities. The Library Department establishes partnerships with community organizations to leverage
resources.

Key Risk Areas
Memorandum of Understanding with the
Santa Clara Library Foundation &
Friends
Fee collection
Purchasing
Parks and Recreation Department
The Parks and Recreation Department consists of the Parks Division (planning, development, operation, maintenance and rehabilitation of City parks); the Recreation Division (classes and programs); the Cemetery Division (maintaining 33,000 interment sites), and the Senior Nutrition Program Division (a meals program). The Department offers the public with facility rentals, community services, cultural programs, and special events.

Key Risk Areas
Park infrastructure
Park revenue
Police Department
The Police Department is broken down into four divisions. The Field Operations Division is comprised of uniformed personnel that respond to calls for service and initiate proactive contacts.

The Investigations Division, which includes the Records Unit, handle follow-up investigations and bring cases forth for criminal prosecution. The Special Operations Division oversees law enforcement services for any major event within the city, including Levi’s Stadium. The Administrative Services Division encompasses the department’s Training Unit, School and
Community Services, and 911-Comunucations Center.

Key Risk Areas
Overtime
Body-worn camera
Use of force policies
Evidence processing and storage
Case management
Department of Public Works
The Department of Public Works is responsible for design, construction, and maintenance of the City infrastructure. The five divisions for engineering services are Administration, Traffic, Design, Land and Property Development, and Field services divisions. Operation and maintenance is provided by Facilities Services, Streets, and Feet Management divisions.

Key Risk Areas
Construction project controls
The Americans with Disabilities Act
(ADA) compliance
Maintenance service requests
Grant management
Water and Sewer Utilities Department
The Water and Sewer Utilities Department provides planning, design, construction, maintenance, and operation of the City’s water distribution system, sewer collection system, and recycled water system. The City jointly owns the San Jose-Santa Clara Regional Wastewater Facility.

Key Risk Areas
Construction project controls
Water conservation and sustainability
programs
Rate setting practices
Work order and asset management

10 RISK ASSESSMENT RESULTS

Overall Risk Scoring Distribution
Baker Tilly structured the audit universe based on the department/division/program from the budget document and management’s feedback, which resulted in 127 auditable units ( Appendix A). We scored them based on the information gathered for each risk factor related to the likelihood, impact, or fraud. Appendix B lists the risk factors, definitions, and scoring method. The maximum score for an auditable unit is 30. The following chart shows the distribution of overall risk scoring.

Baker Tilly rated the auditable units as follows:
 High Risk – Scores 16 and above
 Moderate Risk – Scores more than 9 and less than 16
 Low Risk – Scores below 9
Listed in the following page are the auditable units with a score over 14.5 based on our scoring. The list includes 29 functions rated as high risk (with a score between 16 and 30) and 13 functions rated as moderate risk (with a score between 14.5 and 16). The auditable units with the highest risks do not automatically listed in the new audit plan because some audits may have been already completed or currently being conducted 8, timing of an audit will not be ideal due to a change being/that will be implemented by a department in a coming year, and so on. In determining the audit activities to be performed in 2024 and 2025, we further reviewed specific risks and functional areas and considered risk-based priorities as well as other factors such as requirements by law or regulation, timing of activities, special projects, and requests from City Council and management. The proposed audit plan is included in the next section of this report.

8 As noted on page 3 of this report, scoring/rating is based on inherent risks (the risk before mitigating controls/factors are applied), which result in some audit units’ repeated appearance in the top risk group unless risk scoring changes due to new events and/or a change to the conditions.
-Scores 5 5-10 10-15 15-20 > 20

11 Already audited
Department Function Risk Area Total Risk
Score
Electric Utility Utility Operations - Substation Maintenance Cybersecurity / Work order and asset management / Construction project controls / Safety program 23.2 Electric Utility Utility Operations - Transmission & Distribution Cybersecurity / Work order and asset management / Construction project controls / Safety program 23.2 Electric Utility Utility Operations - Generation Cybersecurity / Work order and asset management / Construction project controls / Safety program 23.0 Police Field Operations - General Patrol Overtime / Body-worn camera management / Use of force policies 22.7 Electric Utility Utility Operations - Power System Controls Cybersecurity / Work order and asset management 22.0 Electric Utility Utility Operations - SVP Systems Support Cybersecurity 21.8 Fire Field Operations Overtime 20.1
Police Administrative Services - Departmental Support Evidence processing and storage 19.8 Public Works Streets Maintenance service requests / Grant management 19.7 Police Investigations - Records Case management 19.5
City Manager's Office Convention Center Convention center operation 19.2 Community Development Building - Field Inspection Building inspection process 19.1 Community Development Building - Permit Services Building permitting process 18.7 Parks & Recreation Parks Park operations (Infrastructure and revenue) 18.4 Finance General Accounting Payroll (including timesheet processing) / Vendor master file 18.1 City Manager's Office Stadium Operations Stadium operation 17.7 Public Works Engineering - Traffic Grant management / Administration of the Shared Mobility Permit Program 17.5 Electric Utility Resource Planning & Engagement - Resource Management Power Purchase Agreements / Energy wholesale trading risk management 17.3 Police Administrative Services - Administration Record management 17.3 Human Resources Employee Benefits and Records - Workers' Compensation & Safety Safety program 17.2 Information Technology Contract Services Cybersecurity / Managed Service Provider (MSP) contract management 17.2 Community Development Building - Plan Review Building permitting process 17.1 Police Administrative Services - 911 Dispatch/Communications 911 Dispatch operations 16.8 Police Field Operations - Traffic Traffic enforcement 16.8 Electric Utility Utility Operations - Electric Compliance Compliance program 16.7 Human Resources Recruitment, Classification and Staff Development - Selection & Classification Citywide succession planning and staff development/ Employee records management 16.6 Library Administration Memorandum of Understanding (MOU) with the Santa Clara Library Foundation & Friends 16.3 Water and Sewer Utilities Water Construction,Maintenance,Operations - Water Construction Construction project controls 16.3 Water and Sewer Utilities Water Construction,Maintenance,Operations - Water System Operations Rate setting practices 16.2 Information Technology Enterprise Services - Application Services Application portfolio management / Data classification / Payment Card Industry Data Security Standard (PCI DSS) compliance 15.8
Police Administrative Services - Professional Standards Training 15.8 City Manager's Office Citywide Strategic Programs & Initiative Property management / Santa Clara Tourism Improvement District (SCTID) 15.7 City Manager's Office Leadership and Management Services - Day to Day Operations Business Continuity / Enterprise Risk Management 15.6 Finance Purchasing Procurement process (including procurement card administration) 15.5 Public Works Engineering - Field Services Construction project control / ADA Compliance 15.4 Water and Sewer Utilities Water Engineering - Water Resources Water conservation and sustainability programs 15.2 Community Development Building - Code Enforcement Code enforcement 15.1 Water and Sewer Utilities Sewer - System Maintenance Work order process and asset management 15.0 City Clerk's Office Assistant City Clerk - Public Information/Legislation Records Management Public Records Act process efficiency and effectiveness / Record management and retention program 14.8
Electric Utility Resource Planning & Engagement - Greenhouse Gas Program Renewable energy program 14.7 Police Investigations - General Investigation Case management 14.6 Finance Municipal Services - Utility Billing Services Utility billing and collection process 14.6 <G bakertilly
lnclooea in the Proposed Audit Plan
-----

12 Proposed 2024 - 2025 Audit Plan
Summary
The projects included in the approved 2023-2024 audit plan were originally selected from the auditable units that were rated as High or Moderate as a result of the first risk assessment in 2022. The selection was made based on some factors such as risk rating, the pervasiveness of the process or control, the audit coverage, the timing of projects, and the value-adding activities that help the City enhance the ability to manage risks, strengthen accountability, and improve efficiency and effectiveness. Based on the CAO budget for the audit plan execution, two audits listed in the approved audit plan were initiated in 2023.

The proposed 2024-2025 audit plan was prepared by updating the 2023-2024 audit plan based on new information obtained on the listed projects and the results of the Year 2 risk assessment. The proposed audits and CAO projects for 2024 through 2025 are listed in the next page and include the following:
 Citywide processes: Succession Planning & Staff Development Review; Record Management and Retention
 Finance: Purchasing Process Review
 Compliance: Overtime Review; SVP Compliance Program Review; Review of Library Memorandum of Understanding with the Santa Clara Library Foundation & Friends  Operations: SVP Safety Program Review; Park Operation Review  Efficiency and effectiveness improvement: Code Enforcement Review  Capital assets: Construction Project Control Assessment; Work Order Process and Asset Management  CAO project: Follow-up on prior’ audits’ corrective actions

The preliminary audit objectives are described for each audit listed. These objectives and scope of each audit activity will be further defined based on the result of an audit planning risk assessment process performed at the beginning of each activity.

The proposed 2024-2025 audit plan consists of a variety of projects for a 24-month period to provide multiple project options to adjust the timing of audits among departments and divisions. It also incorporates time for follow-up on the corrective actions identified by management for the completed audits. The completion of the audit plan depends on the availability of the budget for a contractor to execute it. The audit plan will be updated annually based on the results of an annual risk assessment. However, amendments to the approved audit plan may be proposed during a year in response to changes in the City’s environment such as organizational structure, operations, risks, systems, and controls.

(G bakertilly

13 Proposed Audit Plan for 2024 - 2025

Department Project Title Preliminary Audit Objectives Estimated Hours
Human Resources / Citywide Citywide succession planning and staff development
• Determine whether adequate policies and procedures are in place for developing and maintaining a citywide succession plan to ensure continuity in key positions for all departments. • Determine whether the City provides adequate personal professional development training to staff to ensure that qualified staff are prepared to assume increased responsibilities when necessary. 300
Finance Department Purchasing
• Determine whether adequate controls are in place and working effectively to ensure that the appropriate vendors are selected in a timely manner and monitored properly to achieve desired objectives. • Determine whether procurement cards are administered to ensure that only the authorized users can make purchases in accordance with the requirements and guidelines.
• Determine whether internal controls over procurement card transactions are in place and working effectively to prevent and detect errors and irregularities, including duplicate, unauthorized, or improper transactions. 450
Police Department
Fire Department
Electric Utility Department Safety program
• Determine whether the Electric Utility Department has adequate mechanisms in place to identify and mitigate the safety hazards at workplace.
• Determine whether the Electric Utility Department's internal controls are working effectively to ensure a safe workplace. 400
Parks & Recreation Department Park operation • Determine whether the internal controls over the maintenance of parks are working effectively to ensure safety. • Determine whether the internal controls over fee collection are working effectively. 360 Department of Public Works Construction project control assessment Determine whether internal controls over construction projects are adequate and working effectively. 360 Community Development Department Code Enforcement Assess the efficiency and effectiveness of the code enforcement process. 350 Electric Utility Department Compliance program
• Determine whether the Electric Utility Department had adequate mechanisms in place to keep track of all federal, state, and other compliance requirements..
• Determine whether the Electric Utility Department assess risks associated with each compliance requirement and monitor the compliance status to ensure that the requirements are met. 300
Library Department Memorandum of Understanding (MOU) with the Santa Clara Library Foundation & Friends
Determine whether the internal controls to monitor the compliance with the MOU requirements are in place and working effectively 240
Water and Sewer Utilities Department Work order process and asset management Determine whether the internal controls over the work order process are adequate and working effectively. 420 City Clerk's Office Record management and retention program • Determine whether citywide record management and retention policies and procedures are properly established in accordance with laws and regulations.
• Determine whether internal controls are working effectively to ensure compliance with the record management and retention policies and procedures.
300
Community Development Department
Electric Utility Department Follow-up on corrective actions Follow up on previous audit reports to ensure corrective actions included in management responses in each completed audit report. 80
Public safety personnel overtime
• Determine whether adequate policies and procedures are in place to ensure the appropriate usage of overtime for the public safety personnel.
• Determine whether the overtime practices, including recording and reporting, comply with the City's policies and procedures. 360
-
(G bakertilly
-
I
~
~ -
~
~
I
I
~ l l I
~
-
I
~ I l I
I
I I

C I I I J
)

14 Appendix A: Resumes

Appendices

(9 baker,tilly

15 Appendix A: Audit Universe
City Attorney’s Office
Administration
Litigation
City Clerk’s Office
Assistant City Clerk - Council/Administration Support
Assistant City Clerk - Public Information/Legislation Records Management Assistant City Clerk - Political Reform Act
Elected City Clerk - Election
City Manager’s Office
City Council Support - Policy Support for Decision Making City Council Support - Intergovernmental Relations & Advocacy Leadership and Management Services - Day to Day Operations Leadership and Management Services - Strategic Planning Leadership and Management Services - Community Outreach & Engagement Citywide Programs
Stadium Operations
Citywide Strategic Programs & Initiative
Convention Center
Community Development Department
Planning- Development Review
Planning- Advanced Planning
Planning- Historical Preservation
Planning- Code Enforcement
Building - Plan Review
Building - Permit Services
Building - Field Inspection
Building - Code Enforcement
Housing Inspection
Housing and Community Services - Federal State Grant
Housing and Community Services - Neighborhood Conservation and Improvement Program Housing and Community Services - Tenant Based Rental Assistance Program (Funded by HUD HOME) Housing and Community Services - Below Market Rate Rental Program (BMR) Housing and Community Services - Below Market Rate Purchase Program (BMP) Housing and Community Services - Community Development Housing Successor Fund Housing and Community Services - Housing Development Lending (Various Funds) Electronic Utility Department
Administrative and Financial Services
Resource Planning & Engagement - Risk Management
Customer Develop. & Project Man. - Key Accounts
Customer Develop. & Project Man. - Fiber Program
Customer Develop. & Project Man. - SVP Engineering
Resource Planning & Engagement - Public Benefits
Resource Planning & Engagement - SVP Electric Vehicle Program Resource Planning & Engagement - Greenhouse Gas Program Resource Planning & Engagement - Resource Management
Resource Planning & Engagement – LCRE Program
Utility Operations - Electric Compliance
Utility Operations - SVP Systems Support
Utility Operations - Power System Controls
Utility Operations - Communications & Meter Technical Support Utility Operations - Substation Maintenance
Utility Operations - Transmission & Distribution
Utility Operations - Generation
Finance Department
General Accounting
Citywide Fiscal Planning & Administration
Budget & Financial Analysis
Municipal Services - Utility Billing Services
Municipal Services - Revenue Receipt-Cashiering
Municipal Services - Business Certificate

16 Municipal Services - Field Service
Municipal Services – Administration
Municipal Services - Contact Center/Communication
Purchasing
Purchasing - Warehouse
Fire Department
Administration
Community Risk Reduction - Development Services
Community Risk Reduction - Non-Development Services
Community Risk Reduction - Administration/Investigation/Education Community Risk Reduction - Certified United Program Agency (CUPA) Emergency Medical Services
Field Operations
Office of Emergency Services
Training
Human Resources Department
Employee Benefits and Records – Compensation
Employee Benefits and Records - Workers' Compensation & Safety Recruitment, Classification and Staff Development - Selection and Classification Recruitment, Classification and Staff Development - Labor Relations Information Technology Department
Enterprise Services - Application Services
Enterprise Services - IT Web Services
Enterprise Services - GIS Services
Infrastructure and Support
Contract Services
Telecommunication Services
Library Department
Administration
Adult Services
Branch Services - Mission Library
Branch Services - Northside Branch
Branch Services - Bookmobile & Mobile Library Services
Customer Services
Facilities
Technical and Technology Services
Youth Services
Parks and Recreation Department
Administration
Parks
Recreation
Cemetery
Police Department
Administrative Services - Administration
Administrative Services - Professional Standards
Administrative Services - Departmental Support
Administrative Services - Community Services
Administrative Services - 911 Dispatch/Communications
Field Operations - General Patrol
Field Operations – Traffic
Field Operations - Emergency Response/Temporary Holding Facility Investigations - General Investigation
Investigations - Special Enforcement Team
Investigations – Records
Special Operations – General
Special Operations - Specialized Teams
Special Operations - Reserves
Department of Public Works
Engineering – Traffic
Engineering – Design
Engineering - Land and Property Development
Engineering - Field Services

17 Facility Services
Fleet Management
Streets
Water and Sewer Utilities Department
Recycled Water Program - System Maintenance
Recycled Water Program - Storm Pump Maintenance
Sewer - System Administration
Sewer - System Maintenance
Sewer – Operations
Sewer - San Jose-Santa Clara Water Pollution Control Plant Sewer - Storm Pump Maintenance
Solar Utility - System Maintenance
Water Engineering - Admin Design
Water Engineering - Water Quality
Water Engineering - Water Resources
Water Construction, Maintenance, Operations - Water System Maintenance Water Construction, Maintenance, Operations - Water Construction Water Construction, Maintenance, Operations - Water System Operations

18 Appendix B: Risk Factor Definitions

Factor Definition WeightMagnitudeA measure of materiality based on pervasiveness or volume of dollars or transactions; Scores based on the budgeted expenditure amountExtreme - 5: $50M or moreMaterial - 4: $10M or more; Less than $50MSignificant - 3: $3M or more; Less than $10MModerate - 2: $1M or more; Less than 3MInconsequential - 1: Less than $1MAdded 1 to the magnitude of the Information Technology Department due to the pervasive nature of its work30%Customer / Resident ExperienceNegative experience by customers and residents, such as perceived or actual safety concerns and unsatisfactory services, impacts negatively on the reputation / credibility of the organizationExtreme - 5: Direct impact on health and safetyMaterial - 4: Direct impact on transparencySignificant - 3: Direct impact on customer satisfaction/City's reputationModerate - 2: Indirect impact on customer satisfaction/City's reputationInconsequential - 1: Immaterial impact on reputation / credibility35%Achievement of Organizational GoalsThe greater the effect that a department or process has on the organization meeting strategic objectives and goals, the greater the related risksExtreme - 5: Directly relates to the City Council PrioritiesMaterial - 4: Supports the function/process directly related to the City Council Priorities Significant - 3: Has performance/workload measures related to City Council Priorities Moderate - 2: Somewhat relates to the City Council PrioritiesInconsequential - 1: Does not relate to City's City Council Priorities35%100%ComplexityA measure of the difficulty in performing a process or function. As a process or function becomes more complex, the greater the opportunity for errors5 - Very high complexity4 - High complexity3 - Medium complexity2 - Low complexity1 - Very low complexity25%Policies and ProceduresPolicies and Procedures are a complete set of written instructions that guide personnel in the successful execution of their duties and the duties of the office for which they work. If the policies and procedures are adequate and up-to-date, a risk is lower5 - No or little written P&P4 - Some written P&P3 - Basic P&P requiring improvements2 - Adequate but outdated P&P1 - Adequate and up-to-date P&P or Not Applicable10%Regulatory ComplianceMeasures the existence of and potential noncompliance with, government regulations and other applicable laws, standards, and policies/procedures5 - Requirements to meet more than a few laws/regulations and professional standards specific to the division's responsibilities 3 - Requirements to meet one or two laws/regulations and professional standards specific to he division's responsibilities 1 - No requirement to meet any laws/regulations or professional standards specific to he division's responsibilities 25%MonitoringConsider the existence of monitoring activities, including the results of last audits by Internal Auditor, External Auditor, Regulators, etc. and other known deficiencies5 - Overall, there is no mechanism to monitor the status of performance goals/compliance requirements 3 - For only some of significant performance goals/compliance requirements, there is a periodic reporting process to ensure performance goals/compliance requirements are met1 - For all significant performance goals/compliance requirements, there is a periodic reporting process to ensure performance goals/compliance requirements are met10%Specific RisksConsider the existence of specific risk events/conditions and their significance5 - Identified risk event(s)/condition(s) seem to significantly affect the likelihood3 - Identified risk event(s)/condition(s) seem to have some impact on the likelihood1 - No or very minor risk event(s)/condition(s) have been identified30%100%Fraud SchemesConsider the susceptibility to fraud, which is the opportunity for employees/vendors/customers/fraudsters to misappropriate resources or defraud the organization*5 - High Risk3 - Moderate Risk1 - Low Risk100%100%HIGHEST TOTAL SCORE 30* Considered fraud schemes listed in the Fraud Tree provided in the “Occupational Fraud 2022: A report to the Nations” by Association of Certified Fraud Examiners. Also considered are cyber fraud schemes.

Impact Factors (the effect on the organization) HIGHEST TOTAL SCORE FOR IMPACT: 5Likelihood Factors (the probability of the risk occurring) HIGHEST TOTAL SCORE FOR LIKELIHOOD: 5Other Risk FactorHIGHEST TOTAL SCORE FOR OTHER: 5

19 Appendix C: Survey Questions
The City Auditor’s Office is conducting the 2023 Risk Assessment to identify and prioritize risks in order to update the annual audit plan. As part of our 2023 Risk Assessment, we are conducting a survey. This survey is used primarily to collect information related to changes in operations, emerging issues and risks the City faces, and to gather your perspective on key risks faced by your department. Your candid responses would be greatly appreciated to assess the risks that prevent the City of Santa Clara from achieving its mission, goals, and objectives.

1. Please provide your name, title, department, and email address:
 Name
 Title
 Department
o Mayor and City Council Offices
o City Attorney’s Office
o City Clerk’s Office
o City Manager’s Office
o Community Development
o Electric Utility
o Finance
o Fire
o Human Resources
o Information Technology
o Library
o Parks and Recreation
o Police
o Public Works
o Water and Sewer Utilities
 Email address

2. Describe any significant changes for your team or department during last 12 months. Click on all that apply.  New software
 New workflows or business processes
 Significant changes in processes or controls
 New or significant changes in information technology systems  Change in organizational structure
 Change in culture
 Workforce reduction
 Unfilled positions
 New/additional staff
 New vendors and contractors
 Change in workload
 Change in compliance requirements (due to changes in policies, contracts, laws, or regulations)  Change in goals, objectives, or performance measures
 Increased undesirable performance or instances (such as injuries, complaints, customer dissatisfaction, etc.)  Change in any risks previously identified for your team/department  Other (please specify)

3. Describe the complexity of the key processes in your team or department:

Complexity is a measure of the difficulty in performing a process or function. As a process or function becomes more complex, the greater the opportunity for errors.
 Very high complexity
 High complexity

20  Medium complexity
 Low complexity
 Very low complexity
Please provide any comment related to complexity, if any.

4. Are there adequate and up-to-date documented policies and procedures to perform your job responsibilities?  Yes, documented policies and procedures are adequate and up-to-date  Documented policies and procedures are adequate but not updated regularly  Documented policies and procedures need improvement
No – Please describe how the responsibilities and requirements are communicated in a clear and consistent manner.

5. Please select the compliance requirements with applicable Federal/State/Local laws and regulations and professional standards (e.g. CEQA, NERC, OSHA, EMT licensure/certification, California Data Privacy, HIPAA, GAAP) for each of divisions/functions of your department listed below:
 More than a few laws/regulations and/or professional standards specific to the division's responsibilities need to be met
 One or two laws/regulations and/or professional standards specific to the division's responsibilities need to be met  No requirement to meet any laws/regulations or professional standards specific to the division's responsibilities

6. Describe what can possibly prevent your team/department from meeting its goals and objectives in 2024.

Select all that apply.
 Financial constraints
 Staffing constraints
 Limited skills, knowledge, experience, training
 Technology issue
 Inefficiency in process and/or communication
 Ambiguity in roles and responsibilities
 Lack of, or ineffective, internal controls
 Community pressure
 State/Federal regulations
 Other (please specify)

7. Describe the activities to monitor the achievement of the goals in your team or department:

Example – Periodic reporting, periodic meetings, spot checks by management, periodic audits by external organizations such as consultants and the Federal government, etc.  For all significant performance goals/compliance requirements, there is a periodic reporting process to ensure performance goals/compliance requirements are met
 For only some of significant performance goals/compliance requirements, there is a periodic reporting process to ensure performance goals/compliance requirements are met  Overall, there is no mechanism to monitor the status of performance goals/compliance requirements Please provide comments related to monitoring the achievement of your department’s goals, if any.

To help us identify potential risks, please list your team/department’s Strengths, Weaknesses, Opportunities, and Threats (SWOT) for achieving its missions, goals, and objectives. Typically, strengths and weaknesses are internal aspects of team/department/organization, while opportunities and threats are found externally.

8. Describe up to three STRENGTHS of your team or department:

21 Strengths refer to the resources or capabilities that help the team/department accomplish its mission and serve the public. These can be things like competitive advantages, available resources, engaged community, strong balance sheet, utilized technology and so on.

9. Describe up to three WEAKNESSES of your team or department:

Weaknesses refer to the areas where the team/department needs to improve to accomplish its mission. These can include things like deficiencies in resources and capabilities, inefficient use of available technologies, barriers or inability to collaborate among different departments, lack of effective communication, mission or direction, high levels of debt, financial or human resources constraints and so on.

10. Describe up to three OPPORTUNITIES for your team or department:

Opportunities are any area where the team/department can grow. They are often related to the organization’s strengths. Outside factors that affect the organization in a favorable way can include things like; offering more products or services to citizens, lower costs through new technology and so on.

11. Describe up to three THREATS for your team or department:

Threats include the local or national economy, laws and regulations and any other external issue that can harm or affect the team/department successfully meeting goals. Common threats include things like rising costs for housing/living, increasing competition, tight labor supply, billing rates and so on.

12. Using the risks listed in the risk framework below, please select what you consider to be the top five enterprise risks to the City of Santa Clara.

Environmental (factors external to the organization)
• Reputation - The opinions and perceptions of the public and customers toward the organization. • Regulatory - Laws and standards, which the organization must comply with in its operations. • Citizen Demands - The effect that current citizens demands have on the decisions made by management for aligning tactical plans with the business strategy and the allocation of resources.
• Economy - The effect that current external conditions have on the decisions made by management for aligning tactical plans with the business strategy and the allocation of resources.
• Legal - The potential for an unforeseen event to cause civil or criminal litigation for the organization or its elected leaders, directors, officers, and employees.
• Technologies - The evolution of technology both within and outside of the organization’s industry.

Strategy (planning and decision-making)
• Strategic Change - The ability of the organization to modify its processes in order to either align with its current strategy and business model or to achieve a different strategic goal.
• Investments - The portfolio of both intangible and tangible investments held by the organization, and the implications of these assets on the resources, financial viability, and operations of the organization. The effect on liquidity the ability of current assets to meet current liabilities when due.
• Planning and Budgeting - Details of the organization’s goals and the financial management necessary to achieving those goals. • Financial - The goals of the organization in terms of the structure of its assets and liabilities, including the financing capability based on its credit worthiness, the ability to receive credit and the use of credit lines to achieve its business objectives. • Inter-government Relations - The relationship of the organization with other government agencies that have regulatory and oversight responsibilities and shared services or citizens.
• Compliance Management - The continuous monitoring of the organization’s ability to operate within regulatory requirements and community standards.
• Resource Allocation – The process for assigning and managing assets that support the organizations strategic goals.

Organization (attributes of departments)
• Governance - The role, composition, and major activities of the governing body of the organization in providing direction and oversight for the organization

22 • Empowerment and Values - The ability of senior members of the organization to effectively delegate power or authority to other members of the organization.
• Communication - The methods of communication commonly used in the organization and the effectiveness of this communication on the operations of the organization.
• Ethics and Code of Conduct - The set of rules outlining the ethical practices expected of management and employees of the organization.
• Leadership and Authority - The members of the organization who hold power and their ability to exercise this power effectively. • Organizational Structure - The configuration of units and workflows to align the behavior of the units to the higher-level goals of the organization.
• Succession Planning - The planning and processes to ensure that there are highly qualified people in key leadership positions today and in the future.
• Human Capital Management - The set of practices an organization uses for recruiting, managing, developing, and optimizing employees, including performance management (The process of creating expectations for performance, monitoring progress, and measuring the results) and training (The ability for employees to gain and develop necessary tools to ensure effective operations). • Safety - The organization strives to provide a safe working environment by effectively mitigating the risks to the safety of its employees.

Process and Operations (functional effectiveness and policies and procedures) Externa • Contracts - Contracts are adequately structured to address and mitigate risks. • Efficiency - Processes are up-to-date and efficient, resulting in efficient operations and output. • Accounting - The timely and accurate tracking of the financial position of the organization. • Payroll - The policies, processes, and systems in place to ensure that employee compensation is reliable, timely, and accurate. • Fraud - The organization uses internal controls to prevent and/or detect fraud. • Procurement/Sourcing – The ability to acquire the necessary goods and services for operation and the process of vetting, selecting and managing supplier, vendors and contractors.
• Human Resources - The knowledge, skills and experiences, and resources among personnel, which allow for the execution of the organization’s business plan and achievement of its critical success factors. • Information Systems - The facilities, systems, and connectivity in place to support data processing. • Vendor Management - The need for the organization to continuously monitor the quality and reliability of vendors it uses in the course of its business.
• Change Management - Management adapts appropriately to the evolution of the processes and operations of the organization.

Information (data governance)
• Data Integrity - Data used for making management decisions, recording information, and reporting financial activity is accurate, complete, and reliable.
• Access - The right to view or manipulate data is carefully granted and monitored to prevent the mishandling of data • Retention - The policies used by the organization to determine document retention in terms of the form of documents, how these documents are stored, and for how long these should be maintained. • Availability - Relevant critical information is available when needed in order to maintain the organization’s critical operations and processes, including when a disaster or unplanned disruption occurs • Privacy - Organization policies are in place to ensure the correct treatment of sensitive information held by the organization. • Security – Any event that could result in the compromise of organizational data. (I.e. unauthorized use, loss, damage, disclosure or modification of organizational data).

23 13. Please use the click and drag feature to rank the five enterprise risks that you selected into a priority order, with #1 being the highest.

14. Please describe why you selected them as the top five risks.

15. How well does the City of Santa Clara manage activities to mitigate these risks?  Well – the City management is aware of the risk and has implemented activities to help mitigate this risk  Somewhat well – the City management is aware of this risk, but more effort/activities are needed to help mitigate this risk
 Not well – the City management is either not aware of this risk or hasn’t developed sufficient activities to help mitigate this risk

16. OPTIONAL: Are there any other risks that could affect operations that were not included in the risk framework?

17. Please list any potential internal audit activities you recommend based on the risks you identified. The projects can be consultative/advisory in nature, or provide assurance:
 Advisory and related client service activities, the nature and scope of which are agreed to by the client and which are intended to add value and improve an organization’s governance, risk management, and control processes without the internal auditor assuming management responsibility.  Assurance – an objective examination of evidence for the purpose of providing an independent assessment on governance, risk management, and control processes for the organization.

Baker Tilly US, LLP, trading as Baker Tilly, is a member of the global network of Baker Tilly International Ltd., the members of which are separate and independent legal entities. © 2022 Baker Tilly US, LLP.

Citywide Risk
Assessment and
Annual Internal
Audit Work Plan
March 21, 2024
Ct bakertilly
2 2I. Internal Audit’s Risk Assessment for Audit PlanningII. Risk Assessment MethodologyIII. Risk Assessment ResultsIV. Proposed Audit Work PlanTable of Contents Internal Audit’s Risk Assessment for Audit Planning
4 The Institute of Internal Auditorshttps://www.theiia.org/en/standards/what-are-the-standards/definition-of-internal-audit/“Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.” 5 Risk AssessmentI N TE R N AL AU D I T’ S R I S K AS S E S S M E N T F O R AU D I T P L AN N I N GRisk – The possibility of an event or condition occurring that will have an impact on the ability of an organization to achieve its objectives* Purpose – To develop an audit plan that assigns internal audit resources to the activities that add the most value to an organizationProcess - Identifying and measuring risks associated with the audit universeIdentify, measure, and prioritize riskIdentify, measure, and prioritize riskRisk-based Audit PlanRisk-based Audit PlanRisk-based Audit PlanIdentify, measure, and prioritize riskAllocate internal audit resourcesRisk-based Audit PlanRisk-based Audit PlanRisk-based Audit PlanAssess the progress against the audit plan Follow up on management’s corrective actionsCommunicate audit results

1.Risk AssessmentPlan and execute approved auditsMonitor emerging risks and changes in organization and environment3.EngagementIdentify, measure, and prioritize riskAllocate internal audit resources2.Risk-based Audit Plan4.Reporting5.Follow-Up6.Monitoring7.AssessmentInternal AuditingAnnual Cycle Risk Assessment Methodology
7 Rick A. Wright Jr., CIA (2018), The Internal Auditor’s Guide to Risk Assessment (p. 159), Internal Audit Foundation“Risk measurement is the attempt to quantify the risk that is identified for each auditable unit. I say attempt because risk measurement is very much an inexact science.” 8 Phase

R I S K AS S E S S M E N T ME TH O D O L O G Y
Phase I Phase II Phase Ill Phase IV
Plann . g Information A alys·s Reporting
gathering
Li °o
Ongoing project management and collaboration
9 PhaseR I S K AS S E S S M E N T ME TH O D O L O G YFY2023 Risk Assessment PhasePlanning− Prepared risk assessment survey quesƟons and the online survey tool.− Scheduled interviews with council members and Senior Leadership Team members.Information Gathering− Reviewed key documents such as Council Priority Matrix, the biennial budget documents, the annual comprehensive financial report, departmental strategic plans, the information on the City’s website, and other relevant documents.− Sent a link to the online survey to the selected 56 City’s employees including SLT members who were not scheduled to be interviewed. The survey responses were downloaded in Excel spreadsheet. − Updated the risks in the exisƟng risk matrix based on interviews with City Council members and SLT members, survey responses, and review of key documents. Analysis− Analyzed the survey responses.− Scored the auditable units (Appendix A) in the risk matrix based on the likelihood and the impact of potential adverse events for various risk factors (Appendix B).− IdenƟﬁed potenƟal internal audit acƟviƟes with high risk scores.Reporting− Summarized the approach and results of the risk assessment. 10 Audit Universe

R I S K AS S E S S M E N T ME TH O D O L O G Y
Appendix A: Aud·t Universe
City Attorney 's Office
Administration
Litigation
City Clerk's Office
Assistant City Clerk - Council/Administration Support
Assistant City Clerk - Public Information/Legislation Records Management Assistant City Clerk - Political Reform Act
Elected City Clerk - Election
City Manager's Office
City Council Support - Policy Support for Decision Making City Council Support - Intergovernmental Relations & Advocacy Leadership and Management Services - Day to Day Operations Leadership and Management Services - Strategic Planning Leadership and Management Services - Community Outreach & Engagement Citywide Programs
Stadium Operations
Citywide Strategic Programs & Initiative
Convention Center
Commun ity Development Department
11 Risk Factor - Impact

R I S K AS S E S S M E N T ME TH O D O L O G Y
Appendix B: Risk Factor Definitions
Magnit~e
Customer/
Residertt
Experienc,e
Achievement of
Organ izationa.1
Goals
A meas11re of ~ter:iality based on pervasiveness or volume-of dallars or tr:ansa.ctio:ns; Scores basedi 0.11 the budgeted e:xpenditur e amount
B:treme• - 5: $50M or rno:re
Ma.ter.ial - 4: $1 OM or more-; Le,ss than $50M
Significant - 3: $3r1111. or more; Less than $1 OM
Moderate - 2: $1 .M o.r morn; Less t:ha:n 3M
I nc onse ql!le nti.a I - 1 : Le•s s th an $1 M
Add:edl 1 to the ma· r:iitude ,of the I nforrnation Technolo De , .rtment due to, the ervasi.ve nature· of its work N eg1at~,e e)q)e r,ienc e by customers and re·sider:its; such as per ce rved ,or actuaJ safety ,concerns and u11s ati sfa.ctmy services, impacts ne,gab1ely or;i the re·pLltation I credibllity of the· organization Btrn me - 5: Di red impact on health and safety
Material - 4~ Direct impact on transp3rency
Significant - 3: Direct: impa;ct ,on cL1storner ·satisfactio,~Citys reputation Moderate- 2: I ncfirect impact ,on customer satisfaction/City's re,putat:ion I nc onse ue nti a I - 1 : 'I rnmate rial im act on re , utation I er edi bilit .

The grreate,,r the, effect that a department or process has on the organi:zation meeting strategic obF,e,tives an<l ·go,als, the greater the related risks .

E>d,rerne - 5: piredJy relate,s to the-City Council Prioritie•s Mate ria I - 4: Supports the fun ct,ior:i/pm c e ss dir,e d ly ,rel atedl to the City Co u111cil Priorities Sig1nificant - 3': Has p erfmrnance✓wor kl oad me~sures rnlatedi to St.ra:teg1ic Plll'ars Moderate - 2: Somewhat ·relates to, the organi:zational ,go,als I nconse, ueH'lt.ial - 1: Does 11ot relat.e to Ci s riorities a<ndl 01als 35%
HIGHESf TOTAL SCORE FOR I MPPCT: 5, 1.00%
12 Risk Factor - Likelihood

R I S K AS S E S S M E N T ME TH O D O L O G Y
Complexity
Policies .and
Proc,ed ures
~ulat~
1Gomplianoe.

A measure of the· dffficulty ,in performing a pmce·ss or function. 11,s a pwce,ss or function becomes mo·rn, comp1ex., the• ,great.er the ,opportunity for err-ors
5 - Very high complexity
4 - High ,comple,xity
3 - Medium compl e,,oty
.2 - Lo,w cornpl e}ljty
1 - Ver .low 1co I e·>ci"t .

Policies, and! Procedures ar-e a complete set of wirttten 1nstrucfions that guide• personnel, in the• su-0cessful execl:Jtion of th.eir dutie·s and the,.dutiies of the office-for which they work. ff the policie·s and procedures are- ade<g:Jate and up-to-date·. a risk 1s lower
5 - No or 1little, written P'&P
4 - Some w.ritten P&P
3 - Basic P&P requiring i mpr.ov ements
,2 - J1idequate· but outdatedi P,&P
1 - Me 1uate· and u -to--date P-&P o:r Not , I ic.abl e Measures the e)cistence of andi potenti1:i_l noncompliance with. ,government .regulations afld! other a:pplicahle li;iws, starid'ards, andi pol-iciesl prncedures
5 - 'Requirements to me.et more than a1 few laws/regulations and! profess.ional standards specif~ to, the division's:
re spansi bil rtie·s
3 - Reqb!liremerrt.s to meet ,one or two 'laws/rngulatio.ns and! JJ"Ofessional standiards specific to1 he drvision's responsibilities 1 - No re uir-eme,nt to meet .a . 'laiArslire · wlations o,r , rofe.ssio;nal standiardis s ecific toi he drr,isian's res o.nsibilitie•s 25%
13 Risk Factor – Likelihood

R I S K AS S E S S M E N T ME TH O D O L O G Y
Consider the• e>istence of montor'ing actiltilies, including-the results of .last audits by Internal AJJditor. Ex.emal .AJ..1cfitor, Re giul ato rs, etc. and ,other know.n deficiencies
5 - JOverall, there 'IS.no mechanism to monitor the status ,of pa rfor ma.nee :go,a]slc ornpl iance re quir eme nt s 4 - For ·only so~· s·ignifica11t performance goalslcornpliance, requirements, there IS an annual ,or se rri--annual re·po:rti11g1, ma nag:eme:nt relfleW l}'"Ocess andf.or audits ~ an e,:xt,emal party to ldentify the status of pe rfo rma.nc e go,alslco rnpli ance '1ihnitering
re quir•ernents
10% 3 -For all sigr,iifiicBnt performa.nce go1a.ls!,c:omplianc,e requirements, there· is an annual ,or sem,-.annual reporting, management FeVl 8W process and/or audls by an e»errn.al party to, identify the status ,of perforniance go,als/oompliance re,qu ire ments 2-Fo:r only some of significant perforrn.:H11ce goals/c.ornpl ian ce re,quirements, there IS a, periodic {we.e kly/month ly/ quarte r'iy) reportjng1 process lo ensure· performal'iil~e· goals/compliatilce requirements are n,et ·1 -Fma:11 s ig,rlifica mt pe rf orrna n ce, goa Is/compliance requirements, there IS a periodic. ljVe e,kfy/monthlyl q1Ja rte-rly) rep:rFiing process to e.nsme perfo:rrnance goal~lcornp:I ia:nc e, requirements are met Gonsidw the e:xiste1::1Ce of specific-risk eventsk ,ond~ioos .and their si•g1nifiiea nee .Specific Risks 5 - ldent.ifiedi risk event,(s)!co:ndition(s) seem to si•gnifieant:ly affect the liklihoodi 30Wo 3' - lde·ntified1 r.isk event( s )Jconditi on s) se·em to have some il"llpact on the liklihood 1 - No or verv mi1'!lo:r risk eventfsl/oonditi.on(sl haMe· be en .identified Hl GHEST TOT N... SCORE FOR LI KELI HOOD: 5, 100%
'----
14 Risk Factor – Other

R I S K AS S E S S M E N T ME TH O D O L O G Y
Other Risk Factor .

Consider the susceptibility to fraud, which is the opportunity for employees/vendors/customers/fraudsters to misappropriate resources or defraud the organization* Fraud Schemes 5 - High Risk 100% 3 - Moderate Risk
1 - Low Risk
HIGHEST TOTAL SCORE FOR OTHER: 5 100%
HIGHEST TOTAL SCORE 30
* Considered fraud schemes listed in the Fraud Tree provided in the "Occupational Fraud 2022: A report to the Nations" by Association of Certified Fraud Examiners. Also considered are cyber fraud schemes. 15 Other
Magnitude
Customer/Reside
nt Experience
Achievement of
Goals
Complexity
Policies and
Procedures
Regulatory
Compliance
Monitoring
Specific Risks
Fraud Schemes
[Tab 12]
FY24 Budget
Expenditures
[Tab 4a]
[Magnitude]
Staff Turnover
Ratio at
Department
level
[Tab 7]
Strategic Risks Operational Risks Financial Risks Compliance Risks Weighting 30% 35% 35% 25% 10% 25% 10% 30%
City Clerk's Office
Assistant City Clerk - Public
Information/Legislation Records
Management
1 5 3 3.1 4 2 5 5 5 4.45 1

14.795 831,265$
22,2%
• High staff turnover rate
• Short staffed
• Limited availability of the backup personnel for Assistant City Clerk
• New online PRA Request Portal (NextRequest)
• New document management system (Laserfiche)
• Retention schedule requiring an update
• Long process to scan all older paper documents
• Reduced training budget
• Costs incurring for storing paper
documents offsite
• Extremely high volume of
CPRA requests
• 2018 grand jury findings
regarding compliance with
CPRA
• Possibility of HIPPA violation
Electric Utility
Department
Utility Operations - Substation
Maintenance 4 5 3 4 4 4 5 4 5 4.55 5

23.2 12,324,587$

8.3%
DOE’s new Building a Better Grid
Initiative that Investments to Build
Stronger State and Tribal Electricity
Grids Resilient to Climate Change
• One of the top five department with more frequent and severe claims with a loss
• A lot of overtime due to multiple vacant positions
• Safety concern
• Delay in contracts
• Increased amount of emergency work
• Need staffing to work on aging equipment for residential customers
• Blackouts due to State of California to provide power and transmission
• Cyber and physical security threats; business continuity threats
State and Federal requirements
Department
[Tab 2 & 4a]
Function / Program
[Tab 4a]
Risk Factors (see definitions in Tab 10) Specific Risks (Risk Categories and Event/Condition that may affect the achievement of objectives) [See Tab 13]
Texts in Red are update for Year 2
Impact Factors Likelihood Factors For Total Risk Score, low risk (Green) < 9; 9 ≤ moderate risk (Yellow)
< 16; 16 ≤ high risk (Red)
Total Impact Score
Total Likelihood Score
Total Risk Score
Risk Assessment Matrix

R I S K AS S E S S M E N T ME TH O D O L O G Y
I
-- ----I ,JIii' Risk Factors (~ finitions in Tab 10)
Department Functi on / Program /4act Factors Likelihood Factors ~ Other For Total Ri [Tab 2 &4a] [Tab 4a]
V ~
low risk (Gr
<1 6; 16:S~
I
m
. '
,,
'ii
1l '5
&! . j ---
C:
~ ~
,, . ~ 1l
~ i-,.. m 1:: m ; ~ "' . ,, m ·c: ~ ~
·;. . , 0 C: C ii! ~
.a E 8. m -.. ·.: 0
~ ~ N' Strategic Risks Operational Risks Financial Risks Compliance Ris~ I-" 0 ,, I'll= ·1:
~ill t . cl!
C. :Q
0 ~ Q. 2
l
.., ~
Cl :Eri E e
Cl E ·c
I
, "'
i ' i ac
o 0
ti
0 0 &! 8
0 it !:. "' "' u 0.. 0.. :;
'
[ ::
~
.5
V
.
:J ii!
~ %
'ii
J J Weightin 35% 35% ~ 25% 10% 25% 10% 30%
.. ,
r--,... ~ /
-- --Assistant City Cieri< - Public
CityQerk's Office Information/Legislation Recort 1 5 3 3 .1 4 2 5 5 5 445 1 Management
<"1 14.795
Electric UU.y Uility Operations - Substation 4 5 3 4 4 4 5 4 5 4 .55 5 Department Maintenance •

23.2 Risk Assessment Results
17 Risk Assessment Survey

R I S K AS S E S S M E N T R E S U LTS
• Appendix C: Survey Questions
• The 56 employees were invited to
respond to the risk assessment
survey online.
• The 38 employees completed the
survey (67.9% response rate).

We appreciate everyone who
completed the survey or met with us
to answer our questions!
Q12. Top 5 Risk Areas
Rank Risk Area
1 Succession Planning
2 Hurren Capital Management
3 Reputation
4 Resource Allocation
5 Governance
6 Corrpliance Management
7 Economy
8 Security
9 Efficiency
10 Strategic Change
11 Procurement/Sourcing
12 Technologies
13 Comrunication
14 Leadership and Authority
15 Regulatory ..
18 Overall Risk Scoring Distribution

R I S K AS S E S S M E N T R E S U LTS
• The 127 auditable units (Appendix A) scored using Risk Factors (Appendix B) • Maximum score = 30
Score~ 5 5 - 10 10 - 15 15 - 20 > 20
19 Citywide Key Risk AreasR I S K AS S E S S M E N T R E S U LTS• Strategic Workforce PlanningoSuccession PlanningoStaff Development• Resource Management oResource AllocationoFunding• GovernanceoLeadership • Compliance and Legal RisksoCompliance with Laws, Regulations, and ContractsoLitigation• Cybersecurity 20 Top 42 Risk Areas

R I S K AS S E S S M E N T R E S U LTS
Department Function Risk Area Total Risk
Score
Electric Utility Utility Operations - Substation Maintenance Cybersecurity / Work order and asset management / Construction project controls / Safety program 23.2 Electric Utility Utility Operations - Transmission & Distribution Cybersecurity / Work order and asset management / Construction project controls / Safety program 23.2 Electric Utility Utility Operations - Generation Cybersecurity / Work order and asset management / Construction project controls / Safety program 23.0 Police Field Operations - General Patrol Overtime / Body-worn camera management / Use of force policies 22.7 Electric Utility Utility Operations - Power System Controls Cybersecurity / Work order and asset management 22.0 Electric Utility Utility Operations - SVP Systems Support Cybersecurity 21.8 Fire Field Operations Overtime 20.1
Police Administrative Services - Departmental Support Evidence processing and storage 19.8 Public Works Streets Maintenance service requests / Grant management 19.7 Police Investigations - Records Case management 19.5
City Manager's Office Convention Center Convention center operation 19.2 Community Development Building - Field Inspection Building inspection process 19.1 Community Development Building - Permit Services Building permitting process 18.7 Parks & Recreation Parks Park operations (Infrastructure and revenue) 18.4 Finance General Accounting Payroll (including timesheet processing) / Vendor master file 18.1 City Manager's Office Stadium Operations Stadium operation 17.7 Public Works Engineering - Traffic Grant management / Administration of the Shared Mobility Permit Program 17.5 Electric Utility Resource Planning & Engagement - Resource Management Power Purchase Agreements / Energy wholesale trading risk management 17.3 Police Administrative Services - Administration Record management 17.3 Human Resources Employee Benefits and Records - Workers' Compensation & Safety Safety program 17.2
Information Technology Contract Services Cybersecurity / Managed Service Provider (MSP) contract management 17.2 Community Development Building - Plan Review Building permitting process 17.1 Already audited
--
For Total Risk Score: low risk (Green)< 9; 9 S moderate risk (Yellow)< 16; 16 S high risk (Red) 21 Top 42 Risk Areas

R I S K AS S E S S M E N T R E S U LTS
Department Function Risk Area Total Risk
Score
Police Administrative Services - 911
Dispatch/Communications 911 Dispatch operations 16.8
Police Field Operations - Traffic Traffic enforcement 16.8 Electric Utility Utility Operations - Electric Compliance Compliance program 16.7 Human Resources Recruitment, Classification and Staff
Development - Selection & Classification Citywide succession planning and staff development/ Employee records management 16.6 Library Administration Memorandum of Understanding (MOU) with the Santa Clara Library Foundation & Friends 16.3 Water and Sewer Utilities Water Construction,Maintenance,Operations - Water Construction Construction project controls 16.3
Water and Sewer Utilities Water Construction,Maintenance,Operations - Water System Operations Rate setting practices 16.2
Information Technology Enterprise Services - Application Services Application portfolio management / Data classification / Payment Card Industry Data Security Standard (PCI DSS) compliance 15.8
Police Administrative Services - Professional Standards Training 15.8 City Manager's Office Citywide Strategic Programs & Initiative Property management / Santa Clara Tourism Improvement District (SCTID) 15.7 City Manager's Office Leadership and Management Services - Day to Day Operations Business Continuity / Enterprise Risk Management 15.6 Finance Purchasing Procurement process (including procurement card administration) 15.5 Public Works Engineering - Field Services Construction project control / ADA Compliance 15.4 Water and Sewer Utilities Water Engineering - Water Resources Water conservation and sustainability programs 15.2 Community Development Building - Code Enforcement Code enforcement 15.1 Water and Sewer Utilities Sewer - System Maintenance Work order process and asset management 15.0 City Clerk's Office Assistant City Clerk - Public
Information/Legislation Records Management Public Records Act process efficiency and effectiveness / Record management and retention program 14.8 Electric Utility Resource Planning & Engagement - Greenhouse Gas Program Renewable energy program 14.7
Police Investigations - General Investigation Case management 14.6 Finance Municipal Services - Utility Billing Services Utility billing and collection process 14.6 For Total Risk Score: low risk (Green) < 9; 9 ≤ moderate risk (Yellow) < 16; 16 ≤ high risk (Red) -
Proposed Audit Work Plan
23 Audit Project Update for 2024-2025P R O P O S E D AU D I T W O R K P L AN• Update of the 2023-2024 audit plan based on some factors such as:oRisk ratingoPervasiveness of the process or control oAudit coverageoTiming of projectsoValue-added activities that help the City enhance the ability to manage risks, strengthen accountability, and improve efficiency and effectiveness• A variety of projects for a 24-month period oFlexibility to adjust the timing of auditsoAmendments during a year in response to changes in the City’s environment such as organizational structure, operations, risks, systems, and controls 24 Proposed 2024 - 2025 Plan

P R O P O S E D AU D I T W O R K P L AN
- = --- -··· ,. ·- .. ,,
II :. • !l:la:• - I:.. ~ ••11,1·• •. ;1!?:Tlm, ..
• Determne whether adequate policies and procedures are in place for developing and maintaining a c lywide successbn plan to HllTlan Resources I Citywide Citywide succession planning and staff ensure continuity in key poslions for al departments. 300 development • Determne whether the City provides adequate personal professional development training to staff to ensure tnat qualified staff are prepared to assL1T1e increased responst>ilities when necessary. • Determne whether adequate controls are in place and working effectively to ensure tnat the appropriate vendors are selected in a timely manrer and monitored properly to actlieve desired objectives.

Fnance Department Purctlasing • Determne whether procurement cards are administered to ensure tnat only the auttlorized users can make purcnases in 450 accordance wittl the requirements and gudelires. • Determne whether internal controls over procurement card transactions are in place and working effectively to prevent and detect errors and irreaularities. inclid na duolc ate. unauttlorized, or imorooer transactions.

Police Department • Determne whether adequate policies and procedures are in place to ensure the appropriate usage of overtime for the public Public safety personrel overti'ne safety personrel. 360 Fi"e Department • Determne whether the overti'ne practices, including recording and reporting, comply wittl the City's policies and procedures. • Determne whether the Electric Utii ty Department nas adequate mecnanisms i1 place to identify and mitigate the safety Electric Utility Department Safety program Ila.lards at workplace. 400 • Determine whether the Electric Utii ty Department's internal controls are working effectively to ensure a safe workplace.

Parks & Recreation Department Park operation • Determne whether the internal controls over the maintenance of parks are working effectively to ensure safety. 360 • Determne whether the internal controls over fee collection are workina effectivelv.

Department or Public works Construction prqect control assessment Determire whether internal controls over construction projects are adequate and working effectively. 360 Commurity Development Department Code Enforcement Assess the efficiency and effectiveress of the code enforcement process. 350 • Determne whether the Electric Utii ty Department tlad adequate mecnanisms in place to keep track of al federaL state, and Electric Utility Department Compliance program other compliance requirements .. 300 • Determne whether the Electric Utiity Department assess risks associated w itn eacn compliance requi"ement and monitor the compliance status to ensure tnat the requirements are met. library Department MemorandllTl of Understanding (MOU) with Determire whether the internal controls to monitor the complance witn the MOU requirements are in place and working 240 the Santa Clara Lbrary Foundation & Friends effectively Waler and Sewer Utilities Department Work order process and asset management Determire whether the internal controls over the work order process are adequate and working elfectivel'f. 420 • Determne whether clywi de record management and retention policies and procedures are property established in accordance City Clerk's Office Record management and retention program with laws and regulations. 300 • Determne whether internal controls are workng effectively to ensure compliance with the record management and retentbn oolicies and orocedures.

Community Development Department Folow-up on corrective actions Follow up on previous audit reports to ensure corrective actions included in management responses i1 each completed audit 80 Electric Utility Department report.

Questions?

Audit CommitteeMarch 21, 2024

Audit Committee
March 21, 2024