October 22, 2024 Item #1
RTL 24-765
Item #1 - Study Session:
Review of Citywide Risk Assessment
and Internal Audit Work Plan
-
CI
1852
THE MISSION CIT
October 22, 2024
1 City of
Santa Clara
The Center of What's Possible
Background
• The formal role of the City Auditor's Office was established by the Council approved Internal Audit Charter in July 2019.
• The Charter formalizes the internal audit activities, purpose, authority, and responsibility.
• Accountable to the City Council through the Audit Committee • The Auditor's Office activity will remain free from interference by any element in the timing for indule to mesotan is selecti a cape procedure, negleno • Maintain strict accountability for confidentiality and safeguarding records and information.
• The office is authorized to have full, free, and unrestricted access to all functions, 2 POST MEETING MATERIAL 1
October 22, 2024 Item #1
City of
Santa Clara
The Center of What's Possibic
Background
• The City Auditor's Office conducts its work under the auditing standards prescribed by the Institute of Internal Auditors (IIA) which requires the City Auditor's Office to "establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization's goals" and consider the input from senior management and a governing board.
• The Auditor's Office was established under a "co-source" model to perform its duties. • Accordingly, in 2022, the City Auditor's Office engaged Baker Tilly US, LLP (Baker Tilly) to conduct a citywide risk assessment and prepare an annual audit work plan for the next five years.
• In attendance from Baker Tilly to assist in the presentation of the report is Chiemi Perry, Manager, Risk Advisory.
3 3
Risk - The possibility of an
Risk Assessment event or condition occurring
that will have an impact on the
1.Risk ability of an organization to
7. Assessment
Assess the progress against the Assessment achieve its objectives* audit plan Idenlify, measure, and
prioritize nsk
6.Monitoring Purpose - To develop an audit
Monitor emerging ners 2.Risk-based
and changes an plan that assigns internal audit
organization and Audit Plan
environment. Allocate internal audit resources to the activities that Internal
Auditing resources add the most value to an
Annual Cycle organization
5. Follow-Up
3.Engagement Process - Identifying and
Follow up on managements
corrective actions Plan and execule approves measuring risks associated with audits
4 Reporting the audit universe
Communiciis wedt nes
4 2
October 22, 2024 Item #1
City of
Santa Clara
The Conter of What: Possible
Risk Assessment Methodology
Phase I Phase II Phase Ill Phase IV
Planning Information Analysis Reporting
gathering
Ongoing project management and collaboration
5 City of
Santa Clara
The Center of What's Possible
Risk Assessment Methodology
Risk Assessment Phases
Prepared risk assessment survey questions and the online survey too Planning • Scheduled interviews with council members and Senior Leadership Team members - Reviewed key documents such as Council Priority Matrix, the biennial budget documents, the annual comprehensive financial report, departmental strategic plans the information on the City's website, and other relevant documents Information - Sent a link to the online survey to the selected 56 City's employees including SL Gathering nembers who were not scheduled to be interviewed. The survey responses were - Updated the risks in the existing risk matrix based on interviews with City Council members and SLT members, survey responses, and review of key documents. - are here propa line is as bed on trailinand,
Analysis
Reporting - Summarized the approach and results of the risk assessment. 6 6 3
October 22, 2024 Item #1
City of
Santa Clara
The Center of What's Passible
Risk Assessment Methodology
Example of Audit Universe:
City Clerk's Office
• Assistant City Clerk - Council/Administration Support • Assistant City Clerk - Public Information/Legislation Records Management • Assistant City Clerk - Political Reform Act
• Elected City Clerk - Election
City Manager's Office
• City Council Support - Policy Support for Decision Making • City Council Support - Intergovernmental Relations & Advocacy Leadership and Management Services - Day to Day Operations Leadership and Management Services - Strategic Planning Leadership and Management Services - Community Outreach & Engagement Citywide Programs
Stadium Operations
Citywide Strategic Programs & Initiative
Convention Center
7 City of
Santa Clara
The Center of What's Possible
Risk Factor Impact/Definition:
Factor Definition Weight
Impact Factors (the effect on the organization)
A measure of materiality based on pervasiveness or volume of dolars or transactions; Scores based on the budgeted expendture amount
Extreme - 5: S50M or more
Material - 4: S10M or more: Less than S50M 30%
Magnitude Sigrificant - 3: 53M or more: Less than S10M
Moderate - 2: S1M or more; Less than 3M
Inconsequential - 1: Less than S1M
Aled 1 to the maontude of the Information Technology Department due to the pervasive nature of ts work legative experience by customers and residerts, such as perceived or actual safety concerns and unsatisfactory services. impacts negatively on the reputation/ credibility of the organization Customer / Extreme - 5: Direct impact on health and safety Resident Material - 4: Direct impact on transparency 35% Experience Significant - 3: Direct impact on customer satisfaction/City's reputation Moderate. 2: Indirect impact on customer satisfaction/City's reputation onsequential - 1: Immaterial impact on reputation / credibit greater the effect that a department or process has on the organization meeting strategic objectives and goals.
Achievement of *treme - 5: Directly relates to the City Counci Priorities Organizational Material - 4: Supports the function/process directly related to the City Council Prioritie: 35% Goals Sianificant - 3: Has performance/workoad measures related to Strategic Plars Moderate - 2: Somewhat relates to the organizational goals Inconsequential - 1: Does not relate to City's prionities and goals HGHEST TOTAL SCORE FOR IMPACT 5 100% 8
4 October 22, 2024 Item #1
City of
Santa Clara
The Center of What's Possible
Risk Factor - Likelihood:
Likelihood Factors (the probability of the risk occurring) A measure of the difficuly in performing a process or function. As a process or function becomes more complex, the greater the opportunity for errors
5 - Very high complexity
Complexity 4 - High complexy 25%
- Medium complexit
Low complexit
1. Ves lo Cocodits are a complete set of witen instruction that guide persome in the successful execution of ther duties and the duties of the office for which they work If the policies and procedures are adequate and up-to-date, a risk is Policies and 10%
Procedures
2 - Adequate but outdated P&P
1 - Adequate and up-to-date P&P or Not Applicable
Measures the existence of and potential noncomplance with, government regulations and other applicable laws, standards, and policies/procedures
Regulatory 5 - Requirements to meet more than a few laws/regulations and professional standards specific to the divisions 25% Compliance responsibities
3 - Requirements to meet one or two laws/regations and professional standards specific to he division's responsibilities 1 - No requirement to meet any laws/regulations or professional standards specific to he division's responsibilties.
City of
Santa Clara
Risk Factor - Likelihood (cont.):
Consider the exstence of monitoring activities. including the results of last audits by Internal Auditor, External Auditor.
Regulators, etc. and other known deficiencies
5 - Overall, there is no mechanismto monitor the status of performance goals/compliance requrements 1- For only some significant performance goals/compliance requirements, there is an annual or semi-annual reporting management review process and/or audits by an external party to identify the status of performance goals/complance Monitoring 10%
reporting process to ensure performance goals/comphance requirements are met 1 - For all significant performance goals/compliance requirements, there is a periodic (weekly/monthly/quarterly) reporting process to ensure performance goals/compliance requirements are met Consider the existence of specific risk events/conditions and their significance Specific Risks 5 - Identfied risk events)/condition(s) seem to significantly affect the Skihood 30% - Identfied risk evertis condition's) seem to have some impact on the likihood 1- No or very minor risk events)/condition's) have been identified HGHEST TOTAL SCORE FOR LIKELIHOOD: 5 100%
10 10
5 October 22, 2024 Item #1
City of
Santa Clara
The Center of Whats Possible
Risk Factor - Other:
Other Risk Factor
Consider the susceptibility to fraud, which is the opportunity for employees/vendors/customers/fraudsters to misappropriate resources or defraud the organization* 5 - High Risk 100%
Fraud Schemes
3 - Moderate Risk
1 - Low Risk
HIGHEST TOTAL SCORE FOR OTHER: 5 100%
HIGHEST TOTAL SCORE 30
• Considered fraud schemes listed in the Fraud Tree provided in the "Occupational Fraud 2022: A report to the Nations" by Association of Certified Fraud Examiners. Also considered are cyber fraud schemes. 11 11
City of
Santa Clara
The Center of What's Possible
Excerpt of Risk Assessment Matrix:
Rea Facon deta
seatedomn.
FY24 Duspe Depo romant
Bunge Reas Ananald Ponks Compete nass
2%
AA
0115134410
The 127 auditable units (Appendix A) are scored using the Risk Factors (Appendix B) 12 12
6 October 22, 2024 Item #1
City of
Santa Clara
The Center of What's Possibie
Top Risk Areas:
Electric Utty Uttity Operations - Substation Maintenance Cipersecurty/ Work order and asset management / Construction project controls / Safety program Electric Utity Urity Operations - Transmission & Distribution )binsecunty/Work order and isset management Comtruction project controls/ Safety program Electric Ubity Utity Operations - Generation ©itersecurty/Work order and asset management /Comtruction profest control/ Safety program Police Fleld Operations - General Patrol Ovenime / Body worn camera management / Use of force polices Urity Operations - Power System Controts Cybersecurity / Work order and asset management 22:0 Electric Ulity
Electric Utity tlity Operations - SVP Systems Suppa Cybersecurty Fire eld Operatior
Police Administrative Services - Departmental Support Evdence processing and storage Public Works Streets Mantenance service requests / Grant management Police Investigations - Records Case management
City Manager's Office Convertion Center Convention center operation Community Development Bulding - Field Inspection Bulding Inspection process Community Developmert Bulding - Permit Services Butting permitting process Parks & Recrestion Parke Pare coerations (infrastructure and revenue) General Accounting Payral (including timesheet processing) / Vendor master fle City Manager's Office Stadium Operations Stadium operation Public Works Engineering - Traffic Grant management / Administration of the Shared Mobdity Permit Program Electric Uttity Resource Planning & Engagement - Resource Power Purchase Agreemerts / Energy wholesale trading rak management Management
Police Administratve Services - Administration Record management Employee Benefits and Records - Workers' Safety program Human Resources Compensation & Safety
Information Technology Contract Services Cybersecurity / Managed Service Provider (MSP) contract managemen:
Commurly Deveropment Building - Plan Review Butting permiling process 13 13
City of
Santa Clara
The Center of What's Possible
Top Risk Areas:
Administrative Services - 911 911 Dispalch operallors
Pance
mensen cominines
Police Field Operations - Traffic Traffic enforcement
Electrie Utiny Utaity Operations - Electric Compllance
Recrukmenl, Classication and Staff Chyde succession plaring and stalt deseopment Employee records management Human Recourtes
Development, - Selection & Classicaton
Library Administration Memorandum of Understandira (MOU) with the Santa Clara LIbrary. Epondation. A Frieods Water and Sewer Unites Water Construction, Maintenance, Operations - Construction praject controls 15) Water Construction
Water Construction, Maintenance, Operations • Rate setting practices 152 Water Systen Operations
pplication portfolo management / Data dassifcation / Paymert Card Industry Data Secunty Standan 15.8 Information Technology Enterprise Services - Application Services PCI DSS) compliance Administrative Services - Professional Standards Training 158 City Manager's Office Property management / Santa Clara Tourism Improvemerd District (SCTID) 15.7 Caywide Strategic Programs & Inflative
City Manager's Office Leadership and Management Services - Day to Business Continuty / Enterpree Risk Managemert 156 Day Operations
Finance Purchasing Procuremeet process (includina procurement card adminitrition): 15 5:
Puble Works Engineering - Fiels Serices Construtt on preect control/:AD% Complance 154 Water and Sewer Uttitles Water Eng heering - Water Resources Water conservation and sustainability programs 152
15.1 Community Development Buiding - Code Enforcement
Water and Sewer Utties Sewer - Systen Maintenance 15:0
City Clerk's Office Assislant City Clerk - Public Puble Records Act process efficiency and effectiveness / Record managemert and retention program 148 Informatoni cals atin Records Manscement
Resource Planning & Engagement - Greenhouse Renewable energy program 14.70 Electric Utilly
Gas Proaram
Police Investigations - General investigation Case management 14.0 Municipal Services - Ultity Biling Services Ultty bling and collection process 14 6 Finance
For Total Risk Score: low risk (Green) < 9; 9 ≤ moderate risk (Yellow) < 16; 16 ≤ high risk (Red) 14 14
7 October 22, 2024 Item #1
City of
Santa Clara
The Center of What's Possible
Proposed Audit Workplan:
Audit Project Update for 2024-2025
• Update of the 2023-2024 audit plan based on factors such as:
• Risk rating
• Pervasiveness of the process or control
• Audit coverage
• Timing of projects
• Value-added activities that help the City enhance the ability to manage risks, strengthen accountability, and improve efficiency and effectiveness • A variety of projects for a 24-month period
o Flexibility to adjust the timing of audits
• Amendments during a year in response to changes in the City's environment such as organizational structure, operations, risks, systems, and controls 15 15
City of
Santa Clara
Proposed Audit Workplan: The Center of What's Possible
Proposed 2024-2025 Plan
Estmated
Project Title Preminary Aude Oopcuves
• Determine whether adequnte poxcies and procedures are in place for developing and maintaing a tyide succession plan to Conde succession plain and stat 300
Hunan Rescurtes / Citywide seveipeert • Determine a hether the City proves adequate personal protes sion development training to stall to ensure that quanfed statt e prepared to assume increased respors t
Perme tele occute cortroo ate in pie and one effectively to eure that the appropriate vendors are senect In a tumey marner and montored property 1o acteve desred deectives • Determine whetner procurement cards are adminstered to ensure inal orty the authorzed users can make putnases in 150 Enance Departnent Purchasng
- Determine tetner femar controls over procurement card transactions are in place and working effectinety to prevent and defect enors and inequartes in late dipocate uninthose or apropet transactions Posce Department - Deterine whether adequate poices art procedures are in place to ersure the appropriate usage of overtme for the pukic tatety per sorrel 350
Fre Departmera • Debertone whether the overtme pracies atluding recording and reporting comply with the Clys poles and procedures - Determine whether the Elecine Unity Department ras adequate mechums, ms i place lo iderify and negate the safety Encine cany Departmect Satety program nazards al workplace 400 • Determne whether the Electrc Wildy Departe n's etent cortros are onung effectiety to ensure a sale wongese • Determine whether the remal controls over ihe martenance of parks are working enecinety io ensure savery 350 Pade & Recruition Departount Park operation • Determhe tether the stemal controts over ice colection are working effectively Determine whether interal contross over coratruction profects are adequate and working effestrety 360 Departmert of Puttic Works Contarion wont toro mersmen
Communty Development Department Code Enforcerert Assess the efficiency and effecliveness of the code enforcement process 350 • Deteitine whether the Electre Ully Departmeni nad adequate mechansms in piace 10 keep frack of al federal state and 300
Elecine Lasty Departmest Complance program Determine whether the Electe Ulty Department assess naks assocused with each complance repurement and montor the Detentane fether the vera contron to montor the complant e with the MOU requrements are in place and wonkang 240 Lenay Department the Sanka Clara Lorary Foundation & Friends Water and Serer Utates Depertment Work order process and asset managemert Deterine whether the internal controls over the work order process are adequate and working effectivety 120 deed management, and relesson potees and procedures are property escapesea in accordance Record management and retenton program with laws and reguatom 300 Coy Charts Ofice - Determine hether internal cortrols are working effectively lo ensure complance win the record management and resenton Communty Development Departmert Folom-up on corrective actone (report up on presus act reports to ersure soreline actions related on managemert respores nest competed suit 16 Electric Unity Department
16 8
October 22, 2024 Item #1
City of
Santa Clara
The Center ol What's Possible
Questions?
17 17
9