Audit Committee
September 17, 2024

1 March 21, 2024
City of Santa Clara
City Auditor’s Office
Citywide Risk Assessment and Proposed 2024 - 2025
Audit Work Plan

Contents
Baker Tilly US, LLP, trading as Baker Tilly, is an independent member of Baker Tilly International. Baker Tilly International Limited is an English company. Baker Tilly International provides no professional services to clients. Each member firm is a separate and independent legal entity, and each describes itself as such.

Baker Tilly US, LLP is not Baker Tilly International’s agent and does not have the authority to bind Baker Tilly International or act on Baker Tilly International’s behalf. None of Baker Tilly International, Baker Tilly US, LLP nor any of the other member firms of Baker Tilly International has any liability for each other’s acts or omissions. The name Baker Tilly and its associated logo is used under license from Baker Tilly International Limited.

INTRODUCTION ............................................................................................................. 1 RISK ASSESSMENT APPROACH ................................................................................. 3 SURVEY RESULTS ........................................................................................................ 4 RISK ASSESSMENT RESULTS ..................................................................................... 6 PROPOSED 2024 - 2025 AUDIT PLAN ........................................................................ 12 APPENDICES ............................................................................................................... 14

1 Introduction
Overview
Background
The California Government Code Section 1236 requires all cities that conduct audit activities to conduct their work under the general and specified standards prescribed by the Institute of Internal Auditors (IIA) or the Government Auditing Standards (GAO) issued by the Comptroller General of the United States, as appropriate. The internal audit function will govern itself by adherence to the mandatory elements of the International Standards for the Professional Practice of Internal Auditing (the Standards). According to the IIA Standard 2010, the head of internal audit function “must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization’s goals” and consider the input from senior management and a governing board.

The City Auditor’s Office (CAO) engaged Baker Tilly US, LLP (Baker Tilly) in 2022 to conduct a citywide risk assessment and prepare an annual audit work plan for five years. The purpose of the internal audit function’s risk assessment is to develop an audit plan that assigns internal audit resources to the activities that add the most value to the City of Santa Clara (the City). The risk assessment process involves identifying and measuring risks associated with the audit universe (a list of specific departments, functions, processes, programs, etc. that can be subject to an audit, i.e. auditable units). Risk is defined as “the possibility of an event or condition occurring that will have an impact on the ability of an organization to achieve its objectives.”1

Audit Planning
This report summarizes Baker Tilly’s risk assessment methodology, analysis, and results. The 2024–2025 audit plan proposed in this report is based on the results of this risk assessment. The risk assessment involved collaboration with City Council and senior leadership from 14 main departments across the organization.

In conducting the 2023 risk assessment, we performed the following:
 Updated an understanding of the City’s environment, businesses, and objectives  Met with members of City Council and the Senior Leadership Team representing the major operations and administrative functions of the City
 Reviewed key documentation such as the City Council Priority Matrix, the annual budget documents, financial statements, departmental strategic plans, and prior audit reports  Conducted a risk assessment survey to gain additional insight from the City employees  Evaluated the results of interviews and documentation reviews and considered industry factors to identify areas of risk to the City

In developing the 2024–2025 Audit Plan, we considered the following:
 Risk assessment – Internal audit activities to target high and moderate risk areas based on the results of the risk assessment
 Adding value – Internal audit activities to add value through independent and objective analysis  City Council – The CAO reports to the City Council and seeks input on audit priorities  Coverage and other audits – Consideration of prior and other audits as well as pervasiveness of the process or control to ensure audit coverage and to avoid duplication of efforts  Scheduling – Consideration of the timing of an audit and other on-going initiatives in order to avoid putting an undue burden on City staff that may exacerbate the risk at hand or other interrelated risks

1 Rick A, Wright Jr., CIA, “The Internal Auditor’s Guide to Risk Assessment” The Institute of Internal Auditors Research Foundation (IIARF), 2018

2 INTRODUCTION

Organizational Strengths
Through the risk assessment, we observed certain strengths of the City. Key strengths include:
 Dedication to the citizens and business community
 High value on financial stability and public safety
 Focus on excellence and affordability
 Highly professional and dedicated management and staff

Risk Assessment Process Considerations
The starting point of the internal auditing is to conduct a risk assessment that is the basis for determining the internal audit activities. However, it is not a one-size-fits-all process. The scope and complexity of risk assessment are affected by various factors such as the maturity level of the internal audit function’s products and services, the organization’s enterprise risk management (ERM) efforts, coordination with other monitoring and risk management functions, and the stakeholders’ expectations. The best practice is to focus on risks related to the achievement of the organization’s strategies and objectives. The internal audit risk assessment needs to be conducted at least annually, and internal auditors should monitor the environment for changes and emerging risks.

In addition to the annual macro-level risk assessment, the internal audit function is required to perform an engagement-level risk assessment when starting each audit listed in the approved audit plan. The IIA Standard 2200 states, “Internal auditors must develop and document a plan for each engagement, including the engagement’s objectives, scope, timing, and resource allocations. The plan must consider the organization’s strategies, objectives, and risks relevant to the engagement.”

Risk assessment can also be conducted as part of risk management as one of the essential elements of organizational governance. The ERM is defined as “the culture, capabilities, and practices, integrated with strategy-setting and performance, that organizations rely on to manage risk in creating, preserving, and realizing value.”2 The ERM is more than having a list of all the risks for an organization. The COSO’s ERM principles covering governance to monitoring (including defining risk appetite and implementing risk responses), apply to all levels and functions of an organization although management has overall responsibility for managing risks and a governing body has an oversight role. The internal audit function may leverage ERM information, if available, for efficiency and quality of its risk assessment.

Fraud Considerations
While managing fraud risks is management’s responsibility, internal auditors should consider probability of significant errors, fraud, or noncompliance in exercising due professional care, according to the IIA Standard 1220.A1. For this annual macro-level risk assessment, only general fraud schemes, including the schemes listed in the professional publication and common cyber-attacks, were considered as described in Appendix B. A comprehensive citywide fraud risk assessment is scheduled to be conducted in 20243, and the results will be used as the City’s fraud risk baseline and considered for the future audit planning.

Like the engagement-level risk assessment described above, the IIA Standard (2210.A2) requires internal auditors to “consider the probability of significant errors, fraud, noncompliance, and other exposures when developing the engagement objectives.” Therefore, while we only considered general fraud schemes during this annual risk assessment, potential fraud schemes are considered in detail when an audit is commenced.

2 “COSO Enterprise Risk Management-Integrating with Strategy and Performance”, The Committee of Sponsoring Organizations of the Treadway Commission (COSO), 2017
3 Item #18, Audit Status Report as of September 30, 2023, File #23-1283, https://santaclara.legistar.com/LegislationDetail.aspx?ID=6411701&GUID=8514483F-4EE0-49F9-BFD0-B61222F98093&Options=&Search=

3 Risk Assessment Approach
Baker Tilly’s risk assessment approach consisted of four phases as illustrated in the graphic below.

2023 RISK ASSESSMENT PHASES
Planning
 Prepared risk assessment survey questions and the online survey tool.  Scheduled the interviews with City Council members and Senior Leadership Team (SLT) members
Information
Gathering
 Reviewed the key documents such as Council Priority Matrix, the biennial budget documents, the annual comprehensive financial report, departmental strategic plans, audit reports, the information on the City’s website and other relevant documents.  Distributed a link to the online survey to the selected 56 City’s employees including SLT members who were not scheduled to be interviewed. The survey responses were downloaded in Excel spreadsheet.
 Interviewed all City Councilmembers and some of the City’s managers including SLT members (11 individuals) to identify the events and conditions that may affect the achievement of objectives
 Updated the risk assessment matrix with the information gathered Analysis
 Analyzed the survey responses
 Scored the auditable units (listed in Appendix A) in the risk matrix based on the likelihood and the impact4 of potential adverse events
o Each of the auditable units received scores for various risk factors related to the likelihood or impact (defined in Appendix B)
o Risk factor scores were summed to create a single score for the auditable unit  Identified potential internal audit activities for the auditable units with high risk scores Reporting  Summarized the approach and results of the risk assessment

Baker Tilly conducted the first risk assessment in 2022 by interviewing all City Council members and SLT members and reviewing the key documents and data. The Year 2 risk assessment was conducted as described above to update the first risk assessment. Our risk assessment process primarily measured inherent risk (the risk before mitigating controls/factors are applied) in the City’s current environment.

In Year 3, no risk assessment will be conducted in accordance with the contract. However, the existing audit plan will be evaluated based on discussions with City audit staff and amended if necessary. For the fourth year, a full risk assessment and a survey will be conducted.

4 Likelihood is the possibility that an event will occur. Impact is the extent to which an event might affect an organization.

4 Survey Results
The Baker Tilly team conducted an online risk assessment survey to gather management’s insights for all City departments and received 38 responses (67.9% response rate). The survey questions are listed in Appendix C.

Changes over the past 12 months
All organizations are subject to changing environments that can influence risk to organizations. The COSO5 Internal Control – Integrated Framework6 highlights the influence of change in one of the 17 principles. Principle 9 states, “the organization identifies and assesses changes that could significantly impact the system of internal control.” The survey participants were asked to select all significant changes for their team or department during the last 12 months.

Policies and Procedures
Policies and procedures provide a roadmap for
daily operations to ensure compliance with
laws and regulations, give guidance for
decision-making, and establish the standards
and internal controls.

The survey participants were also asked to
select the current state of the policies and
procedures necessary to perform their job
responsibilities.

5 The Committee of Sponsoring Organizations of the Treadway Commission (COSO) is sponsored jointly by five major professional associations headquartered in the United States: the American Accounting Association (AAA), the American Institute of Certified Public Accountants (AICPA), Financial Executives International (FEI), the Institute of Internal Auditors (IIA), and Institute of Management Accountants (IMA). https://www.coso.org/
6 Internal Control – Integrated Framework provides principles-based guidance for designing and implementing effective internal controls.

This framework has become the most widely used internal control framework in the U.S. https://www.coso.org/guidance-on-ic Changes for team or department # of ResponseNew/additional staff 25New workflows or business processes 24Change in workload 21Unfilled positions 20Change in compliance requirements 14Change in organizational structure 13New vendors and contractors 12Change in culture 10New or significant changes in information technology systems 10New software 9Change in goals/objectives/performance measures 8Significant changes in processes or controls 6Change in any risks previously identified for your team/department 6Workforce reduction 5Increased undesirable performance or instances 2Change in compliance requirements 1Other 1

5 SURVEY RESULTS
Barriers to meeting goals and objectives in FY2024
The COSO Enterprise Risk Management—Integrating with Strategy and Performance7 provides insight into the links between strategy, risk, and performance through 20 principles. Principle 10 states, “the organization identifies risk that impacts the performance of strategy and business objectives.”
The survey participants were asked about their team/department’s periodic reporting on significant goals and compliance requirements to monitor the performance. The pie chart shows the results.

The survey participants were also asked what can possibly prevent their team/department from meeting its goals and objectives in 2024. The results are summarized below.

Top risk areas selected by the survey participants
The survey participants were asked to select and rank the top five risk areas from 31 risk areas listed in the survey. Based on the number of selection and the ranking given by them, the top 15 risk areas were identified.

For the risks they selected:
 81.6% of the participants think the City management is aware of the risk, but more efforts are needed to help mitigate the risks.  10.5% of the participants think the City management is either not aware of the risks or has not developed sufficient activities to help mitigate the risks.
 7.9% of the participants think the City management is aware of the risks and has implemented activities to help mitigate the risks.

7 Enterprise Risk Management—Integrating with Strategy and Performance addresses the need for organizations to improve their approach to managing risk to meet the demands of an evolving business environment. https://www.coso.org/guidance-erm Rank Risk Area1 Succession Planning2 Human Capital Management3 Reputation4 Resource Allocation5 Governance6 Compliance Management7 Economy8 Security9 Efficiency10 Strategic Change11 Procurement/Sourcing12 Technologies13 Communication14 Leadership and Authority15 Regulatory

6 Risk Assessment Results
Citywide Key Risk Areas
Baker Tilly conducted interviews with members of the City Council and a few members of the Senior Leadership Team and reviewed the survey responses from the selected City employees. Baker Tilly asked them to describe the areas they view to be the top five risks facing the City overall, regardless as to whether it is specific to their area of focus/department or not. The following is a list of risk themes identified in those interviews and survey responses:
­ Strategic Workforce Planning
­ Resource Management
­ Organizational Governance
­ Compliance and Legal Risks
­ Information Technology
Strategic Workforce Planning
­ Succession Planning – As the City experienced turnover in key leadership positions in recent years, many of interviewees and survey respondents expressed a concern on the City’s planning to ensure that there are highly qualified people for leadership positions for the coming years. They expect many individuals with managerial positions to retire over the next several years. A robust citywide succession planning helps the City identify, develop, and train future leaders strategically and retain qualified employees while retention and recruitment continue to be challenging. ­ Staff Development – Human capital management is critical to the effectiveness of the City’s operations.

It requires investment in the workforce by enhancing employees’ skills with on-going training and education and monitoring their performance regularly. On-going training should include sharing institutional knowledge through cross-training and documented policies and procedures. Regular performance monitoring against well-designed and well-defined performance measures helps the development of employees and alignment of their performance with the City’s goals. Successful staff development can result in higher productivity, increased morale, and better retention rates.

Resource Management
­ Resource Allocation – Efficient resource allocation is important for the City to operate effectively. Some survey respondents mentioned redundancies in a process and responsibilities of staff while others noted multiple hats employees were in order to keep up with the workload and inadequate resources to meet the compliance requirements. As the City continues to change its population, environment, infrastructure, services, and complexity, it needs to continue to monitor and adjust the allocation of the City’s limited resources to provide an acceptable level of services to its citizens and comply with various laws and regulations. Careful strategic planning and prioritization of resource allocation is pivotal for driving economic growth and promoting social welfare.
­ Funding – The City faces difficult budget reductions necessary to bring the budget into balance. As a result, some essential accounts, programs, and capital projects remain unfunded.

Governance
­ Leadership – Effective local government governing body and officers must think and act strategically and collaborate with a network of community entities and institutions at the national, state, and local level. Operating in an environment where there are numerous stakeholders and key partners can strain the governance system and impair the ability to meet citizens’ needs and organizational objectives. A city’s reputation comes from perceptions of effective government that is affected by leadership.

7 RISK ASSESSMENT RESULTS

Compliance/Legal
­ Compliance with Laws, Regulations, and Contracts – The City has a complex regulatory compliance environment, in which the City must comply with numerous laws and regulations, local ordinances, contracts and grant agreements, and policies and procedures. The survey respondents noted adequate resources to maintain compliance with changing requirements. Failure to track and update relevant laws and regulations may lead to external audit findings, fines, reputational harm and other negative outcomes.
­ Litigation – The City has been involved in multiple lawsuits and settlements in recent years.

Information Technology
­ Cybersecurity – Ransomware and malware attacks are growing threats facing all municipal governments. These cyberattacks may result in significant financial losses, costly service disruption, and loss of information. The City faces similar threats on a daily basis and seeks to ensure that its information security practices and controls mitigate these risks. Some survey respondents, however, mentioned inadequate resources to improve security measures.

Department Descriptions and Key Risk Areas
When identifying risks for the City, Baker Tilly considered each department and associated risks. The concerns listed by the interviewees included limited staffing and succession planning, specific accounts or programs with limited or no funding, aged infrastructure, lawsuits, and drought. Based on these concerns, departments’ functions, and their inherent risks, Baker Tilly identified the auditable risk areas for each department. Below is an overview of the City’s departments and their key risk areas.

City Attorney’s Office
The City Attorney’s Office provides hearing and trial counsel services and other legal advisory services such as
review/negotiation of contracts, preparation of resolutions and ordinances, attendance to all meetings of the City Council, and response to legal inquiries.

Key Risk Areas
­ Case management
­ Conflict of interest monitoring
City Clerk’s Office
The Elected City Clerk administers City elections. The Assistant City Clerk is responsible for various day-to-day operations, including attending and maintaining records of City Council and public meetings; complying with Records Retention Schedule; responding to Public Records Act requests, and administering campaign and disclosure laws.

Key Risk Areas
­ Public Records Act compliance
­ Records retention program

City Manager’s Office
The City Manager’s Office supports the City Council with policy decision making, provides direction and support to all City departments, and is responsible for strategic planning, citywide emergency preparedness, economic development, community outreach and engagement, property management, special
projects, and implementation of Council direction. It also provides general administration for citywide programs, citywide strategic programs and initiatives (such as sustainability), convention center, and stadium operations.

Key Risk Areas
­ Property management
­ Convention center operation
­ Stadium operation
­ Business continuity plan for the City
departments

8 RISK ASSESSMENT RESULTS
Community Development Department
The Community Development Department’s primary objectives are maintenance of the General Plan, proactive land use planning to meet the future needs of the community, delivery of professional services such as development review and permitting and inspection services, and administration of programs related to affordable housing.

Key Risk Areas
­ Building permitting & inspection
­ Housing inspection
­ Development projects review
­ Code enforcement
­ Affordable housing program
Electronic Utility Department
The Electric Utility Department (Silicon Valley Power, or SVP) owns power generation facilities, has investments in joint ventures that produce electric power, and trades power on the open market. SVP delivers electricity to the residents and businesses and provides diverse services such as dispatch services to all City departments, outdoor Wi-Fi services, dark fiber leasing service, and energy efficiency programs.

Key Risk Areas
­ Power Purchase Agreements
­ Safety program
­ Compliance program
­ Procurement and contract management
­ Work Order and Asset Management
­ Cybersecurity
­ Construction project controls
Finance Department
The Finance Department administers the City’s financial affairs.

Departmental functions include budget; general accounting; financial reporting; collection of taxes, fees, special assessments, and utility charges; investment; procurement; the City Warehouse operations; and debt management.

Key Risk Areas
­ Procurement Card Administration
­ Vendor master file
­ Timesheet processing
­ Utility billing and collection process
­ Investment management
­ Warehouse/inventory management
Fire Department
The Fire Department provides fire and emergency services and organized into Administration and six divisions: Field Operations (first responders providing immediate services); Emergency Medical Services (first responder medical services); Community Risk Reduction (fire prevention activities and hazardous materials regulation by providing plan review and inspection services); Training (State and Federal certification programs);
Administrative (grant management, payroll processing, budget development, etc.); Office of Emergency Services (emergency preparedness activities and disaster management plans).

Key Risk Areas
­ Overtime
­ Field inspection services
­ Training
­ Emergency medical services
Human Resources Department
The Human Resources Department is responsible for Benefits, Compensation, Recruitment, Testing, Classification, Employee and Labor Relations, Equal Employment Opportunity, Workers Compensation/Safety, and Employee development. The
department also negotiates the Memorandum of Understanding agreements with bargaining units.

Key Risk Areas
­ Staff development and succession
planning for the City departments
­ Workers' Compensation and Safety
­ Employee records management

Information Technology Department
The Information Technology Department's IT service provider provides most IT services including enterprise computing (City data centers and network), service desk, end-user support,

Key Risk Areas
- Cybersecurity Assessment

9 RISK ASSESSMENT RESULTS
application management, configuration and maintenance of over 150 applications, and security services (including security incident and event management). The City IT employees are responsible for IT governance and budget.
- Managed Service Provider (MSP)
contract management
- Application portfolio management
- Data management
Library Department
The Library Department has three libraries throughout the City and also provides Bookmobile service. It offers physical and digital collection of books/movies/music, technology and information access, literacy instruction, and programming such as young adults activities. The Library Department establishes partnerships with community organizations to leverage
resources.

Key Risk Areas
­ Memorandum of Understanding with the
Santa Clara Library Foundation &
Friends
­ Fee collection
­ Purchasing
Parks and Recreation Department
The Parks and Recreation Department consists of the Parks Division (planning, development, operation, maintenance and rehabilitation of City parks); the Recreation Division (classes and programs); the Cemetery Division (maintaining 33,000 interment sites), and the Senior Nutrition Program Division (a meals program). The Department offers the public with facility rentals, community services, cultural programs, and special events.

Key Risk Areas
­ Park infrastructure
­ Park revenue
Police Department
The Police Department is broken down into four divisions. The Field Operations Division is comprised of uniformed personnel that respond to calls for service and initiate proactive contacts.

The Investigations Division, which includes the Records Unit, handle follow-up investigations and bring cases forth for criminal prosecution. The Special Operations Division oversees law enforcement services for any major event within the city, including Levi’s Stadium. The Administrative Services Division encompasses the department’s Training Unit, School and
Community Services, and 911-Comunucations Center.

Key Risk Areas
­ Overtime
­ Body-worn camera
­ Use of force policies
­ Evidence processing and storage
­ Case management
Department of Public Works
The Department of Public Works is responsible for design, construction, and maintenance of the City infrastructure. The five divisions for engineering services are Administration, Traffic, Design, Land and Property Development, and Field services divisions. Operation and maintenance is provided by Facilities Services, Streets, and Feet Management divisions.

Key Risk Areas
­ Construction project controls
­ The Americans with Disabilities Act
(ADA) compliance
­ Maintenance service requests
­ Grant management
Water and Sewer Utilities Department
The Water and Sewer Utilities Department provides planning, design, construction, maintenance, and operation of the City’s water distribution system, sewer collection system, and recycled water system. The City jointly owns the San Jose-Santa Clara Regional Wastewater Facility.

Key Risk Areas
­ Construction project controls
­ Water conservation and sustainability
programs
­ Rate setting practices
­ Work order and asset management

10 RISK ASSESSMENT RESULTS

Overall Risk Scoring Distribution
Baker Tilly structured the audit universe based on the department/division/program from the budget document and management’s feedback, which resulted in 127 auditable units (Appendix A). We scored them based on the information gathered for each risk factor related to the likelihood, impact, or fraud. Appendix B lists the risk factors, definitions, and scoring method. The maximum score for an auditable unit is 30. The following chart shows the distribution of overall risk scoring.

Baker Tilly rated the auditable units as follows:
 High Risk – Scores 16 and above
 Moderate Risk – Scores more than 9 and less than 16
 Low Risk – Scores below 9
Listed in the following page are the auditable units with a score over 14.5 based on our scoring. The list includes 29 functions rated as high risk (with a score between 16 and 30) and 13 functions rated as moderate risk (with a score between 14.5 and 16). The auditable units with the highest risks do not automatically listed in the new audit plan because some audits may have been already completed or currently being conducted8, timing of an audit will not be ideal due to a change being/that will be implemented by a department in a coming year, and so on. In determining the audit activities to be performed in 2024 and 2025, we further reviewed specific risks and functional areas and considered risk-based priorities as well as other factors such as requirements by law or regulation, timing of activities, special projects, and requests from City Council and management. The proposed audit plan is included in the next section of this report.

8 As noted on page 3 of this report, scoring/rating is based on inherent risks (the risk before mitigating controls/factors are applied), which result in some audit units’ repeated appearance in the top risk group unless risk scoring changes due to new events and/or a change to the conditions.

11 Already audited
Department Function Risk AreaTotal Risk ScoreElectric Utility Utility Operations - Substation Maintenance Cybersecurity / Work order and asset management / Construction project controls / Safety program 23.2Electric Utility Utility Operations - Transmission & Distribution Cybersecurity / Work order and asset management / Construction project controls / Safety program 23.2Electric Utility Utility Operations - Generation Cybersecurity / Work order and asset management / Construction project controls / Safety program 23.0Police Field Operations - General Patrol Overtime / Body-worn camera management / Use of force policies 22.7Electric Utility Utility Operations - Power System Controls Cybersecurity / Work order and asset management 22.0Electric Utility Utility Operations - SVP Systems Support Cybersecurity 21.8Fire Field Operations Overtime 20.1Police Administrative Services - Departmental Support Evidence processing and storage 19.8Public Works Streets Maintenance service requests / Grant management 19.7Police Investigations - Records Case management 19.5City Manager's Office Convention Center Convention center operation 19.2Community Development Building - Field Inspection Building inspection process 19.1Community Development Building - Permit Services Building permitting process 18.7Parks & Recreation Parks Park operations (Infrastructure and revenue) 18.4Finance General Accounting Payroll (including timesheet processing) / Vendor master file 18.1City Manager's Office Stadium Operations Stadium operation 17.7Public Works Engineering - Traffic Grant management / Administration of the Shared Mobility Permit Program 17.5Electric Utility Resource Planning & Engagement - Resource Management Power Purchase Agreements / Energy wholesale trading risk management 17.3Police Administrative Services - Administration Record management 17.3Human Resources Employee Benefits and Records - Workers' Compensation & Safety Safety program 17.2Information Technology Contract Services Cybersecurity / Managed Service Provider (MSP) contract management 17.2Community Development Building - Plan Review Building permitting process 17.1Police Administrative Services - 911 Dispatch/Communications 911 Dispatch operations 16.8Police Field Operations - Traffic Traffic enforcement 16.8Electric Utility Utility Operations - Electric Compliance Compliance program 16.7Human Resources Recruitment, Classification and Staff Development - Selection & Classification Citywide succession planning and staff development/ Employee records management 16.6Library Administration Memorandum of Understanding (MOU) with the Santa Clara Library Foundation & Friends 16.3Water and Sewer Utilities Water Construction,Maintenance,Operations - Water Construction Construction project controls 16.3Water and Sewer Utilities Water Construction,Maintenance,Operations - Water System Operations Rate setting practices 16.2Information Technology Enterprise Services - Application Services Application portfolio management / Data classification / Payment Card Industry Data Security Standard (PCI DSS) compliance15.8Police Administrative Services - Professional Standards Training 15.8City Manager's Office Citywide Strategic Programs & Initiative Property management / Santa Clara Tourism Improvement District (SCTID) 15.7City Manager's Office Leadership and Management Services - Day to Day Operations Business Continuity / Enterprise Risk Management 15.6Finance Purchasing Procurement process (including procurement card administration) 15.5Public Works Engineering - Field Services Construction project control / ADA Compliance 15.4Water and Sewer Utilities Water Engineering - Water Resources Water conservation and sustainability programs 15.2Community Development Building - Code Enforcement Code enforcement 15.1Water and Sewer Utilities Sewer - System Maintenance Work order process and asset management 15.0City Clerk's Office Assistant City Clerk - Public Information/Legislation Records ManagementPublic Records Act process efficiency and effectiveness / Record management and retention program14.8Electric Utility Resource Planning & Engagement - Greenhouse Gas Program Renewable energy program 14.7Police Investigations - General Investigation Case management 14.6Finance Municipal Services - Utility Billing Services Utility billing and collection process 14.6

12 Proposed 2024 - 2025 Audit Plan
Summary
The projects included in the approved 2023-2024 audit plan were originally selected from the auditable units that were rated as High or Moderate as a result of the first risk assessment in 2022. The selection was made based on some factors such as risk rating, the pervasiveness of the process or control, the audit coverage, the timing of projects, and the value-adding activities that help the City enhance the ability to manage risks, strengthen accountability, and improve efficiency and effectiveness. Based on the CAO budget for the audit plan execution, two audits listed in the approved audit plan were initiated in 2023.

The proposed 2024-2025 audit plan was prepared by updating the 2023-2024 audit plan based on new information obtained on the listed projects and the results of the Year 2 risk assessment. The proposed audits and CAO projects for 2024 through 2025 are listed in the next page and include the following:
 Citywide processes: Succession Planning & Staff Development Review; Record Management and Retention
 Finance: Purchasing Process Review
 Compliance: Overtime Review; SVP Compliance Program Review; Review of Library Memorandum of Understanding with the Santa Clara Library Foundation & Friends  Operations: SVP Safety Program Review; Park Operation Review  Efficiency and effectiveness improvement: Code Enforcement Review  Capital assets: Construction Project Control Assessment; Work Order Process and Asset Management  CAO project: Follow-up on prior’ audits’ corrective actions

The preliminary audit objectives are described for each audit listed. These objectives and scope of each audit activity will be further defined based on the result of an audit planning risk assessment process performed at the beginning of each activity.

The proposed 2024-2025 audit plan consists of a variety of projects for a 24-month period to provide multiple project options to adjust the timing of audits among departments and divisions. It also incorporates time for follow-up on the corrective actions identified by management for the completed audits. The completion of the audit plan depends on the availability of the budget for a contractor to execute it. The audit plan will be updated annually based on the results of an annual risk assessment. However, amendments to the approved audit plan may be proposed during a year in response to changes in the City’s environment such as organizational structure, operations, risks, systems, and controls.

13 Proposed Audit Plan for 2024 - 2025

Department Project Title Preliminary Audit ObjectivesEstimated HoursHuman Resources / CitywideCitywide succession planning and staff development• Determine whether adequate policies and procedures are in place for developing and maintaining a citywide succession plan to ensure continuity in key positions for all departments.• Determine whether the City provides adequate personal professional development training to staff to ensure that qualified staff are prepared to assume increased responsibilities when necessary.300Finance Department Purchasing• Determine whether adequate controls are in place and working effectively to ensure that the appropriate vendors are selected in a timely manner and monitored properly to achieve desired objectives.• Determine whether procurement cards are administered to ensure that only the authorized users can make purchases in accordance with the requirements and guidelines.• Determine whether internal controls over procurement card transactions are in place and working effectively to prevent and detect errors and irregularities, including duplicate, unauthorized, or improper transactions.450Police DepartmentFire DepartmentElectric Utility Department Safety program• Determine whether the Electric Utility Department has adequate mechanisms in place to identify and mitigate the safety hazards at workplace.• Determine whether the Electric Utility Department's internal controls are working effectively to ensure a safe workplace.400Parks & Recreation Department Park operation• Determine whether the internal controls over the maintenance of parks are working effectively to ensure safety.• Determine whether the internal controls over fee collection are working effectively.360Department of Public Works Construction project control assessment Determine whether internal controls over construction projects are adequate and working effectively. 360Community Development Department Code Enforcement Assess the efficiency and effectiveness of the code enforcement process. 350Electric Utility Department Compliance program• Determine whether the Electric Utility Department had adequate mechanisms in place to keep track of all federal, state, and other compliance requirements..• Determine whether the Electric Utility Department assess risks associated with each compliance requirement and monitor the compliance status to ensure that the requirements are met.300Library DepartmentMemorandum of Understanding (MOU) with the Santa Clara Library Foundation & FriendsDetermine whether the internal controls to monitor the compliance with the MOU requirements are in place and working effectively240Water and Sewer Utilities Department Work order process and asset management Determine whether the internal controls over the work order process are adequate and working effectively. 420City Clerk's Office Record management and retention program• Determine whether citywide record management and retention policies and procedures are properly established in accordance with laws and regulations.• Determine whether internal controls are working effectively to ensure compliance with the record management and retention policies and procedures.300Community Development DepartmentElectric Utility DepartmentFollow-up on corrective actionsFollow up on previous audit reports to ensure corrective actions included in management responses in each completed audit report.80Public safety personnel overtime• Determine whether adequate policies and procedures are in place to ensure the appropriate usage of overtime for the public safety personnel.• Determine whether the overtime practices, including recording and reporting, comply with the City's policies and procedures.360

14 Appendix A: Resumes

Appendices

15 Appendix A: Audit Universe
City Attorney’s Office
Administration
Litigation
City Clerk’s Office
Assistant City Clerk - Council/Administration Support
Assistant City Clerk - Public Information/Legislation Records Management Assistant City Clerk - Political Reform Act
Elected City Clerk - Election
City Manager’s Office
City Council Support - Policy Support for Decision Making City Council Support - Intergovernmental Relations & Advocacy Leadership and Management Services - Day to Day Operations Leadership and Management Services - Strategic Planning Leadership and Management Services - Community Outreach & Engagement Citywide Programs
Stadium Operations
Citywide Strategic Programs & Initiative
Convention Center
Community Development Department
Planning- Development Review
Planning- Advanced Planning
Planning- Historical Preservation
Planning- Code Enforcement
Building - Plan Review
Building - Permit Services
Building - Field Inspection
Building - Code Enforcement
Housing Inspection
Housing and Community Services - Federal State Grant
Housing and Community Services - Neighborhood Conservation and Improvement Program Housing and Community Services - Tenant Based Rental Assistance Program (Funded by HUD HOME) Housing and Community Services - Below Market Rate Rental Program (BMR) Housing and Community Services - Below Market Rate Purchase Program (BMP) Housing and Community Services - Community Development Housing Successor Fund Housing and Community Services - Housing Development Lending (Various Funds) Electronic Utility Department
Administrative and Financial Services
Resource Planning & Engagement - Risk Management
Customer Develop. & Project Man. - Key Accounts
Customer Develop. & Project Man. - Fiber Program
Customer Develop. & Project Man. - SVP Engineering
Resource Planning & Engagement - Public Benefits
Resource Planning & Engagement - SVP Electric Vehicle Program Resource Planning & Engagement - Greenhouse Gas Program Resource Planning & Engagement - Resource Management
Resource Planning & Engagement – LCRE Program
Utility Operations - Electric Compliance
Utility Operations - SVP Systems Support
Utility Operations - Power System Controls
Utility Operations - Communications & Meter Technical Support Utility Operations - Substation Maintenance
Utility Operations - Transmission & Distribution
Utility Operations - Generation
Finance Department
General Accounting
Citywide Fiscal Planning & Administration
Budget & Financial Analysis
Municipal Services - Utility Billing Services
Municipal Services - Revenue Receipt-Cashiering
Municipal Services - Business Certificate

16 Municipal Services - Field Service
Municipal Services – Administration
Municipal Services - Contact Center/Communication
Purchasing
Purchasing - Warehouse
Fire Department
Administration
Community Risk Reduction - Development Services
Community Risk Reduction - Non-Development Services
Community Risk Reduction - Administration/Investigation/Education Community Risk Reduction - Certified United Program Agency (CUPA) Emergency Medical Services
Field Operations
Office of Emergency Services
Training
Human Resources Department
Employee Benefits and Records – Compensation
Employee Benefits and Records - Workers' Compensation & Safety Recruitment, Classification and Staff Development - Selection and Classification Recruitment, Classification and Staff Development - Labor Relations Information Technology Department
Enterprise Services - Application Services
Enterprise Services - IT Web Services
Enterprise Services - GIS Services
Infrastructure and Support
Contract Services
Telecommunication Services
Library Department
Administration
Adult Services
Branch Services - Mission Library
Branch Services - Northside Branch
Branch Services - Bookmobile & Mobile Library Services
Customer Services
Facilities
Technical and Technology Services
Youth Services
Parks and Recreation Department
Administration
Parks
Recreation
Cemetery
Police Department
Administrative Services - Administration
Administrative Services - Professional Standards
Administrative Services - Departmental Support
Administrative Services - Community Services
Administrative Services - 911 Dispatch/Communications
Field Operations - General Patrol
Field Operations – Traffic
Field Operations - Emergency Response/Temporary Holding Facility Investigations - General Investigation
Investigations - Special Enforcement Team
Investigations – Records
Special Operations – General
Special Operations - Specialized Teams
Special Operations - Reserves
Department of Public Works
Engineering – Traffic
Engineering – Design
Engineering - Land and Property Development
Engineering - Field Services

17 Facility Services
Fleet Management
Streets
Water and Sewer Utilities Department
Recycled Water Program - System Maintenance
Recycled Water Program - Storm Pump Maintenance
Sewer - System Administration
Sewer - System Maintenance
Sewer – Operations
Sewer - San Jose-Santa Clara Water Pollution Control Plant Sewer - Storm Pump Maintenance
Solar Utility - System Maintenance
Water Engineering - Admin Design
Water Engineering - Water Quality
Water Engineering - Water Resources
Water Construction, Maintenance, Operations - Water System Maintenance Water Construction, Maintenance, Operations - Water Construction Water Construction, Maintenance, Operations - Water System Operations

18 Appendix B: Risk Factor Definitions

Factor Definition WeightMagnitudeA measure of materiality based on pervasiveness or volume of dollars or transactions; Scores based on the budgeted expenditure amountExtreme - 5: $50M or moreMaterial - 4: $10M or more; Less than $50MSignificant - 3: $3M or more; Less than $10MModerate - 2: $1M or more; Less than 3MInconsequential - 1: Less than $1MAdded 1 to the magnitude of the Information Technology Department due to the pervasive nature of its work30%Customer / Resident ExperienceNegative experience by customers and residents, such as perceived or actual safety concerns and unsatisfactory services, impacts negatively on the reputation / credibility of the organizationExtreme - 5: Direct impact on health and safetyMaterial - 4: Direct impact on transparencySignificant - 3: Direct impact on customer satisfaction/City's reputationModerate - 2: Indirect impact on customer satisfaction/City's reputationInconsequential - 1: Immaterial impact on reputation / credibility35%Achievement of Organizational GoalsThe greater the effect that a department or process has on the organization meeting strategic objectives and goals, the greater the related risksExtreme - 5: Directly relates to the City Council PrioritiesMaterial - 4: Supports the function/process directly related to the City Council Priorities Significant - 3: Has performance/workload measures related to City Council Priorities Moderate - 2: Somewhat relates to the City Council PrioritiesInconsequential - 1: Does not relate to City's City Council Priorities35%100%ComplexityA measure of the difficulty in performing a process or function. As a process or function becomes more complex, the greater the opportunity for errors5 - Very high complexity4 - High complexity3 - Medium complexity2 - Low complexity1 - Very low complexity25%Policies and ProceduresPolicies and Procedures are a complete set of written instructions that guide personnel in the successful execution of their duties and the duties of the office for which they work. If the policies and procedures are adequate and up-to-date, a risk is lower5 - No or little written P&P4 - Some written P&P3 - Basic P&P requiring improvements2 - Adequate but outdated P&P1 - Adequate and up-to-date P&P or Not Applicable10%Regulatory ComplianceMeasures the existence of and potential noncompliance with, government regulations and other applicable laws, standards, and policies/procedures5 - Requirements to meet more than a few laws/regulations and professional standards specific to the division's responsibilities 3 - Requirements to meet one or two laws/regulations and professional standards specific to he division's responsibilities 1 - No requirement to meet any laws/regulations or professional standards specific to he division's responsibilities 25%MonitoringConsider the existence of monitoring activities, including the results of last audits by Internal Auditor, External Auditor, Regulators, etc. and other known deficiencies5 - Overall, there is no mechanism to monitor the status of performance goals/compliance requirements 3 - For only some of significant performance goals/compliance requirements, there is a periodic reporting process to ensure performance goals/compliance requirements are met1 - For all significant performance goals/compliance requirements, there is a periodic reporting process to ensure performance goals/compliance requirements are met10%Specific RisksConsider the existence of specific risk events/conditions and their significance5 - Identified risk event(s)/condition(s) seem to significantly affect the likelihood3 - Identified risk event(s)/condition(s) seem to have some impact on the likelihood1 - No or very minor risk event(s)/condition(s) have been identified30%100%Fraud SchemesConsider the susceptibility to fraud, which is the opportunity for employees/vendors/customers/fraudsters to misappropriate resources or defraud the organization*5 - High Risk3 - Moderate Risk1 - Low Risk100%100%HIGHEST TOTAL SCORE 30* Considered fraud schemes listed in the Fraud Tree provided in the “Occupational Fraud 2022: A report to the Nations” by Association of Certified Fraud Examiners. Also considered are cyber fraud schemes.

Impact Factors (the effect on the organization) HIGHEST TOTAL SCORE FOR IMPACT: 5Likelihood Factors (the probability of the risk occurring) HIGHEST TOTAL SCORE FOR LIKELIHOOD: 5Other Risk FactorHIGHEST TOTAL SCORE FOR OTHER: 5

19 Appendix C: Survey Questions
The City Auditor’s Office is conducting the 2023 Risk Assessment to identify and prioritize risks in order to update the annual audit plan. As part of our 2023 Risk Assessment, we are conducting a survey. This survey is used primarily to collect information related to changes in operations, emerging issues and risks the City faces, and to gather your perspective on key risks faced by your department. Your candid responses would be greatly appreciated to assess the risks that prevent the City of Santa Clara from achieving its mission, goals, and objectives.

1. Please provide your name, title, department, and email address:
 Name
 Title
 Department
o Mayor and City Council Offices
o City Attorney’s Office
o City Clerk’s Office
o City Manager’s Office
o Community Development
o Electric Utility
o Finance
o Fire
o Human Resources
o Information Technology
o Library
o Parks and Recreation
o Police
o Public Works
o Water and Sewer Utilities
 Email address

2. Describe any significant changes for your team or department during last 12 months. Click on all that apply.  New software
 New workflows or business processes
 Significant changes in processes or controls
 New or significant changes in information technology systems  Change in organizational structure
 Change in culture
 Workforce reduction
 Unfilled positions
 New/additional staff
 New vendors and contractors
 Change in workload
 Change in compliance requirements (due to changes in policies, contracts, laws, or regulations)  Change in goals, objectives, or performance measures
 Increased undesirable performance or instances (such as injuries, complaints, customer dissatisfaction, etc.)  Change in any risks previously identified for your team/department  Other (please specify)

3. Describe the complexity of the key processes in your team or department:

Complexity is a measure of the difficulty in performing a process or function. As a process or function becomes more complex, the greater the opportunity for errors.
 Very high complexity
 High complexity

20  Medium complexity
 Low complexity
 Very low complexity
Please provide any comment related to complexity, if any.

4. Are there adequate and up-to-date documented policies and procedures to perform your job responsibilities?  Yes, documented policies and procedures are adequate and up-to-date  Documented policies and procedures are adequate but not updated regularly  Documented policies and procedures need improvement
No – Please describe how the responsibilities and requirements are communicated in a clear and consistent manner.

5. Please select the compliance requirements with applicable Federal/State/Local laws and regulations and professional standards (e.g. CEQA, NERC, OSHA, EMT licensure/certification, California Data Privacy, HIPAA, GAAP) for each of divisions/functions of your department listed below:
 More than a few laws/regulations and/or professional standards specific to the division's responsibilities need to be met
 One or two laws/regulations and/or professional standards specific to the division's responsibilities need to be met  No requirement to meet any laws/regulations or professional standards specific to the division's responsibilities

6. Describe what can possibly prevent your team/department from meeting its goals and objectives in 2024.

Select all that apply.
 Financial constraints
 Staffing constraints
 Limited skills, knowledge, experience, training
 Technology issue
 Inefficiency in process and/or communication
 Ambiguity in roles and responsibilities
 Lack of, or ineffective, internal controls
 Community pressure
 State/Federal regulations
 Other (please specify)

7. Describe the activities to monitor the achievement of the goals in your team or department:

Example – Periodic reporting, periodic meetings, spot checks by management, periodic audits by external organizations such as consultants and the Federal government, etc.  For all significant performance goals/compliance requirements, there is a periodic reporting process to ensure performance goals/compliance requirements are met
 For only some of significant performance goals/compliance requirements, there is a periodic reporting process to ensure performance goals/compliance requirements are met  Overall, there is no mechanism to monitor the status of performance goals/compliance requirements Please provide comments related to monitoring the achievement of your department’s goals, if any.

To help us identify potential risks, please list your team/department’s Strengths, Weaknesses, Opportunities, and Threats (SWOT) for achieving its missions, goals, and objectives. Typically, strengths and weaknesses are internal aspects of team/department/organization, while opportunities and threats are found externally.

8. Describe up to three STRENGTHS of your team or department:

21 Strengths refer to the resources or capabilities that help the team/department accomplish its mission and serve the public. These can be things like competitive advantages, available resources, engaged community, strong balance sheet, utilized technology and so on.

9. Describe up to three WEAKNESSES of your team or department:

Weaknesses refer to the areas where the team/department needs to improve to accomplish its mission. These can include things like deficiencies in resources and capabilities, inefficient use of available technologies, barriers or inability to collaborate among different departments, lack of effective communication, mission or direction, high levels of debt, financial or human resources constraints and so on.

10. Describe up to three OPPORTUNITIES for your team or department:

Opportunities are any area where the team/department can grow. They are often related to the organization’s strengths. Outside factors that affect the organization in a favorable way can include things like; offering more products or services to citizens, lower costs through new technology and so on.

11. Describe up to three THREATS for your team or department:

Threats include the local or national economy, laws and regulations and any other external issue that can harm or affect the team/department successfully meeting goals. Common threats include things like rising costs for housing/living, increasing competition, tight labor supply, billing rates and so on.

12. Using the risks listed in the risk framework below, please select what you consider to be the top five enterprise risks to the City of Santa Clara.

Environmental (factors external to the organization)
• Reputation - The opinions and perceptions of the public and customers toward the organization. • Regulatory - Laws and standards, which the organization must comply with in its operations. • Citizen Demands - The effect that current citizens demands have on the decisions made by management for aligning tactical plans with the business strategy and the allocation of resources.
• Economy - The effect that current external conditions have on the decisions made by management for aligning tactical plans with the business strategy and the allocation of resources.
• Legal - The potential for an unforeseen event to cause civil or criminal litigation for the organization or its elected leaders, directors, officers, and employees.
• Technologies - The evolution of technology both within and outside of the organization’s industry.

Strategy (planning and decision-making)
• Strategic Change - The ability of the organization to modify its processes in order to either align with its current strategy and business model or to achieve a different strategic goal.
• Investments - The portfolio of both intangible and tangible investments held by the organization, and the implications of these assets on the resources, financial viability, and operations of the organization. The effect on liquidity the ability of current assets to meet current liabilities when due.
• Planning and Budgeting - Details of the organization’s goals and the financial management necessary to achieving those goals. • Financial - The goals of the organization in terms of the structure of its assets and liabilities, including the financing capability based on its credit worthiness, the ability to receive credit and the use of credit lines to achieve its business objectives. • Inter-government Relations - The relationship of the organization with other government agencies that have regulatory and oversight responsibilities and shared services or citizens.
• Compliance Management - The continuous monitoring of the organization’s ability to operate within regulatory requirements and community standards.
• Resource Allocation – The process for assigning and managing assets that support the organizations strategic goals.

Organization (attributes of departments)
• Governance - The role, composition, and major activities of the governing body of the organization in providing direction and oversight for the organization

22 • Empowerment and Values - The ability of senior members of the organization to effectively delegate power or authority to other members of the organization.
• Communication - The methods of communication commonly used in the organization and the effectiveness of this communication on the operations of the organization.
• Ethics and Code of Conduct - The set of rules outlining the ethical practices expected of management and employees of the organization.
• Leadership and Authority - The members of the organization who hold power and their ability to exercise this power effectively. • Organizational Structure - The configuration of units and workflows to align the behavior of the units to the higher-level goals of the organization.
• Succession Planning - The planning and processes to ensure that there are highly qualified people in key leadership positions today and in the future.
• Human Capital Management - The set of practices an organization uses for recruiting, managing, developing, and optimizing employees, including performance management (The process of creating expectations for performance, monitoring progress, and measuring the results) and training (The ability for employees to gain and develop necessary tools to ensure effective operations). • Safety - The organization strives to provide a safe working environment by effectively mitigating the risks to the safety of its employees.

Process and Operations (functional effectiveness and policies and procedures) Externa • Contracts - Contracts are adequately structured to address and mitigate risks. • Efficiency - Processes are up-to-date and efficient, resulting in efficient operations and output. • Accounting - The timely and accurate tracking of the financial position of the organization. • Payroll - The policies, processes, and systems in place to ensure that employee compensation is reliable, timely, and accurate. • Fraud - The organization uses internal controls to prevent and/or detect fraud. • Procurement/Sourcing – The ability to acquire the necessary goods and services for operation and the process of vetting, selecting and managing supplier, vendors and contractors.
• Human Resources - The knowledge, skills and experiences, and resources among personnel, which allow for the execution of the organization’s business plan and achievement of its critical success factors. • Information Systems - The facilities, systems, and connectivity in place to support data processing. • Vendor Management - The need for the organization to continuously monitor the quality and reliability of vendors it uses in the course of its business.
• Change Management - Management adapts appropriately to the evolution of the processes and operations of the organization.

Information (data governance)
• Data Integrity - Data used for making management decisions, recording information, and reporting financial activity is accurate, complete, and reliable.
• Access - The right to view or manipulate data is carefully granted and monitored to prevent the mishandling of data • Retention - The policies used by the organization to determine document retention in terms of the form of documents, how these documents are stored, and for how long these should be maintained. • Availability - Relevant critical information is available when needed in order to maintain the organization’s critical operations and processes, including when a disaster or unplanned disruption occurs • Privacy - Organization policies are in place to ensure the correct treatment of sensitive information held by the organization. • Security – Any event that could result in the compromise of organizational data. (I.e. unauthorized use, loss, damage, disclosure or modification of organizational data).

23 13. Please use the click and drag feature to rank the five enterprise risks that you selected into a priority order, with #1 being the highest.

14. Please describe why you selected them as the top five risks.

15. How well does the City of Santa Clara manage activities to mitigate these risks?  Well – the City management is aware of the risk and has implemented activities to help mitigate this risk  Somewhat well – the City management is aware of this risk, but more effort/activities are needed to help mitigate this risk
 Not well – the City management is either not aware of this risk or hasn’t developed sufficient activities to help mitigate this risk

16. OPTIONAL: Are there any other risks that could affect operations that were not included in the risk framework?

17. Please list any potential internal audit activities you recommend based on the risks you identified. The projects can be consultative/advisory in nature, or provide assurance:
 Advisory and related client service activities, the nature and scope of which are agreed to by the client and which are intended to add value and improve an organization’s governance, risk management, and control processes without the internal auditor assuming management responsibility.  Assurance – an objective examination of evidence for the purpose of providing an independent assessment on governance, risk management, and control processes for the organization.