Baker Tilly US, LLP, trading as Baker Tilly, is a member of the global network of Baker Tilly International Ltd., the members of which are separate and independent legal entities. © 2022 Baker Tilly US, LLP.
Citywide Risk Assessment and Annual Internal Audit Work PlanMarch 21, 2024 2 2I. Internal Audit’s Risk Assessment for Audit PlanningII. Risk Assessment MethodologyIII. Risk Assessment ResultsIV. Proposed Audit Work PlanTable of Contents Internal Audit’s Risk Assessment for Audit Planning
4 The Institute of Internal Auditorshttps://www.theiia.org/en/standards/what-are-the-standards/definition-of-internal-audit/“Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.” 5 Risk AssessmentI N TE R N AL AU D I T’ S R I S K AS S E S S M E N T F O R AU D I T P L AN N I N GRisk – The possibility of an event or condition occurring that will have an impact on the ability of an organization to achieve its objectives* Purpose – To develop an audit plan that assigns internal audit resources to the activities that add the most value to an organizationProcess - Identifying and measuring risks associated with the audit universeIdentify, measure, and prioritize riskIdentify, measure, and prioritize riskRisk-based Audit PlanRisk-based Audit PlanRisk-based Audit PlanIdentify, measure, and prioritize riskAllocate internal audit resourcesRisk-based Audit PlanRisk-based Audit PlanRisk-based Audit PlanAssess the progress against the audit plan Follow up on management’s corrective actionsCommunicate audit results
1.Risk AssessmentPlan and execute approved auditsMonitor emerging risks and changes in organization and environment3.EngagementIdentify, measure, and prioritize riskAllocate internal audit resources2.Risk-based Audit Plan4.Reporting5.Follow-Up6.Monitoring7.AssessmentInternal AuditingAnnual Cycle Risk Assessment Methodology
7 Rick A. Wright Jr., CIA (2018), The Internal Auditor’s Guide to Risk Assessment (p. 159), Internal Audit Foundation“Risk measurement is the attempt to quantify the risk that is identified for each auditable unit. I say attempt because risk measurement is very much an inexact science.” 8 PhaseR I S K AS S E S S M E N T ME TH O D O L O G Y
9 PhaseR I S K AS S E S S M E N T ME TH O D O L O G YFY2023 Risk Assessment PhasePlanning− Prepared risk assessment survey quesƟons and the online survey tool.− Scheduled interviews with council members and Senior Leadership Team members.Information Gathering− Reviewed key documents such as Council Priority Matrix, the biennial budget documents, the annual comprehensive financial report, departmental strategic plans, the information on the City’s website, and other relevant documents.− Sent a link to the online survey to the selected 56 City’s employees including SLT members who were not scheduled to be interviewed. The survey responses were downloaded in Excel spreadsheet. − Updated the risks in the exisƟng risk matrix based on interviews with City Council members and SLT members, survey responses, and review of key documents. Analysis− Analyzed the survey responses.− Scored the auditable units (Appendix A) in the risk matrix based on the likelihood and the impact of potential adverse events for various risk factors (Appendix B).− IdenƟfied potenƟal internal audit acƟviƟes with high risk scores.Reporting− Summarized the approach and results of the risk assessment. 10 Audit UniverseR I S K AS S E S S M E N T ME TH O D O L O G Y
11 Risk Factor - ImpactR I S K AS S E S S M E N T ME TH O D O L O G Y
12 Risk Factor - LikelihoodR I S K AS S E S S M E N T ME TH O D O L O G Y
13 Risk Factor – Likelihood R I S K AS S E S S M E N T ME TH O D O L O G Y
14 Risk Factor – Other R I S K AS S E S S M E N T ME TH O D O L O G Y
15 OtherMagnitudeCustomer/Resident ExperienceAchievement of GoalsComplexityPolicies and ProceduresRegulatory ComplianceMonitoringSpecific RisksFraud Schemes [Tab 12]FY24 Budget Expenditures[Tab 4a][Magnitude]Staff Turnover Ratio at Department level[Tab 7]Strategic Risks Operational Risks Financial Risks Compliance RisksWeighting30% 35% 35% 25% 10% 25% 10% 30%City Clerk's OfficeAssistant City Clerk - Public Information/Legislation Records Management1 5 3 3.1 4 2 5 5 5 4.45 114.795831,265$ 22,2%• High staff turnover rate• Short staffed• Limited availability of the backup personnel for Assistant City Clerk • New online PRA Request Portal (NextRequest)• New document management system (Laserfiche)• Retention schedule requiring an update• Long process to scan all older paper documents• Reduced training budget• Costs incurring for storing paper documents offsite• Extremely high volume of CPRA requests• 2018 grand jury findings regarding compliance with CPRA• Possibility of HIPPA violationElectric Utility DepartmentUtility Operations - Substation Maintenance 4 5 3 4 4 4 5 4 5 4.55 523.212,324,587$ 8.3%DOE’s new Building a Better Grid Initiative that Investments to Build Stronger State and Tribal Electricity Grids Resilient to Climate Change• One of the top five department with more frequent and severe claims with a loss• A lot of overtime due to multiple vacant positions• Safety concern• Delay in contracts• Increased amount of emergency work• Need staffing to work on aging equipment for residential customers• Blackouts due to State of California to provide power and transmission• Cyber and physical security threats; business continuity threatsState and Federal requirementsDepartment[Tab 2 & 4a]Function / Program[Tab 4a]Risk Factors (see definitions in Tab 10) Specific Risks(Risk Categories and Event/Condition that may affect the achievement of objectives) [See Tab 13]Texts in Red are update for Year 2 Impact Factors Likelihood FactorsFor Total Risk Score, low risk (Green) < 9; 9 ≤ moderate risk (Yellow) < 16; 16 ≤ high risk (Red)Total Impact ScoreTotal Likelihood ScoreTotal Risk ScoreRisk Assessment MatrixR I S K AS S E S S M E N T ME TH O D O L O G Y
Risk Assessment Results
17 Risk Assessment SurveyR I S K AS S E S S M E N T R E S U LTS • Appendix C: Survey Questions• The 56 employees were invited to respond to the risk assessment survey online.• The 38 employees completed the survey (67.9% response rate).We appreciate everyone who completed the survey or met with us to answer our questions! Q12. Top 5 Risk Areas
18 Overall Risk Scoring DistributionR I S K AS S E S S M E N T R E S U LTS • The 127 auditable units (Appendix A) scored using Risk Factors (Appendix B)• Maximum score = 30 19 Citywide Key Risk AreasR I S K AS S E S S M E N T R E S U LTS• Strategic Workforce PlanningoSuccession PlanningoStaff Development• Resource Management oResource AllocationoFunding• GovernanceoLeadership • Compliance and Legal RisksoCompliance with Laws, Regulations, and ContractsoLitigation• Cybersecurity 20 Top 42 Risk AreasR I S K AS S E S S M E N T R E S U LTSDepartment Function Risk AreaTotal Risk ScoreElectric Utility Utility Operations - Substation Maintenance Cybersecurity / Work order and asset management / Construction project controls / Safety program 23.2Electric Utility Utility Operations - Transmission & Distribution Cybersecurity / Work order and asset management / Construction project controls / Safety program 23.2Electric Utility Utility Operations - Generation Cybersecurity / Work order and asset management / Construction project controls / Safety program 23.0Police Field Operations - General Patrol Overtime / Body-worn camera management / Use of force policies 22.7Electric Utility Utility Operations - Power System Controls Cybersecurity / Work order and asset management 22.0Electric Utility Utility Operations - SVP Systems Support Cybersecurity 21.8Fire Field Operations Overtime 20.1Police Administrative Services - Departmental Support Evidence processing and storage 19.8Public Works Streets Maintenance service requests / Grant management 19.7Police Investigations - Records Case management 19.5City Manager's Office Convention Center Convention center operation 19.2Community Development Building - Field Inspection Building inspection process 19.1Community Development Building - Permit Services Building permitting process 18.7Parks & Recreation Parks Park operations (Infrastructure and revenue) 18.4Finance General Accounting Payroll (including timesheet processing) / Vendor master file 18.1City Manager's Office Stadium Operations Stadium operation 17.7Public Works Engineering - Traffic Grant management / Administration of the Shared Mobility Permit Program 17.5Electric Utility Resource Planning & Engagement - Resource Management Power Purchase Agreements / Energy wholesale trading risk management 17.3Police Administrative Services - Administration Record management 17.3Human ResourcesEmployee Benefits and Records - Workers' Compensation & SafetySafety program 17.2Information Technology Contract Services Cybersecurity / Managed Service Provider (MSP) contract management 17.2Community Development Building - Plan Review Building permitting process 17.1
21 Top 42 Risk AreasR I S K AS S E S S M E N T R E S U LTSDepartment Function Risk AreaTotal Risk ScorePoliceAdministrative Services - 911 Dispatch/Communications 911 Dispatch operations 16.8Police Field Operations - Traffic Traffic enforcement 16.8Electric Utility Utility Operations - Electric Compliance Compliance program 16.7Human ResourcesRecruitment, Classification and Staff Development - Selection & ClassificationCitywide succession planning and staff development/ Employee records management 16.6Library Administration Memorandum of Understanding (MOU) with the Santa Clara Library Foundation & Friends 16.3Water and Sewer UtilitiesWater Construction,Maintenance,Operations - Water ConstructionConstruction project controls 16.3Water and Sewer UtilitiesWater Construction,Maintenance,Operations - Water System OperationsRate setting practices 16.2Information Technology Enterprise Services - Application Services Application portfolio management / Data classification / Payment Card Industry Data Security Standard (PCI DSS) compliance15.8Police Administrative Services - Professional Standards Training 15.8City Manager's Office Citywide Strategic Programs & Initiative Property management / Santa Clara Tourism Improvement District (SCTID) 15.7City Manager's OfficeLeadership and Management Services - Day to Day OperationsBusiness Continuity / Enterprise Risk Management 15.6Finance Purchasing Procurement process (including procurement card administration) 15.5Public Works Engineering - Field Services Construction project control / ADA Compliance 15.4Water and Sewer Utilities Water Engineering - Water Resources Water conservation and sustainability programs 15.2Community Development Building - Code Enforcement Code enforcement 15.1Water and Sewer Utilities Sewer - System Maintenance Work order process and asset management 15.0City Clerk's OfficeAssistant City Clerk - Public Information/Legislation Records ManagementPublic Records Act process efficiency and effectiveness / Record management and retention program 14.8Electric Utility Resource Planning & Engagement - Greenhouse Gas Program Renewable energy program 14.7Police Investigations - General Investigation Case management 14.6Finance Municipal Services - Utility Billing Services Utility billing and collection process 14.6For Total Risk Score: low risk (Green) < 9; 9 ≤ moderate risk (Yellow) < 16; 16 ≤ high risk (Red) Proposed Audit Work Plan
23 Audit Project Update for 2024-2025P R O P O S E D AU D I T W O R K P L AN• Update of the 2023-2024 audit plan based on some factors such as:oRisk ratingoPervasiveness of the process or control oAudit coverageoTiming of projectsoValue-added activities that help the City enhance the ability to manage risks, strengthen accountability, and improve efficiency and effectiveness• A variety of projects for a 24-month period oFlexibility to adjust the timing of auditsoAmendments during a year in response to changes in the City’s environment such as organizational structure, operations, risks, systems, and controls 24 Proposed 2024 - 2025 PlanP R O P O S E D AU D I T W O R K P L AN
Questions?