Council Audit Committee
August 15, 2022

This report is intended for the internal use of City of Stockton , and may not be provided to, used, or relied upon by any third parties.

Proprietary & Confidential

FINAL REPORT
City of Stockton

ENTERPRISE RISK ASSESSMENT
July 14, 2022
Moss Adams LLP
999 Third Avenue, Suite 2800
Seattle, WA 98104
(206) 302-6500
Attachment A

Enterprise Risk Assessment Report

FOR INTERNAL USE OF CITY OF STOCKTON ONLY

Table of Contents
Executive Summary 1
A. Scope and Methodology 1
Definition of Levels 1
B. Risk Assessment Results 3
Comparison to Questionnaire Results 4
Progress Since Prior Assessment 5
Project Scope and Approach 7
A. Scope 7
B. Approach 7
Risk Assessment Questionnaire 8
Risk Assessment Framework 8
Risk Assessment Results 11
A. High Risk Categories 11
Human Capital and Resources 11
Information Technology 13
Organization and Staffing 15
Procurement and Contracting 17
Public Safety and Security 19
B. Moderate-to-High Risk Categories 22
Capital Improvement Program 22
Management and Leadership 24
Policies, Procedures, and Processes 28
C. Moderate Risk Categories 29
Accounting and Finance 29
Asset Management Tracking 31
Compliance 32
Ethics, Fraud, Waste, and Abuse 34
External Environment 24
Attachment A
Table of Contents – Continued

Enterprise Risk Assessment Report

FOR INTERNAL USE OF CITY OF STOCKTON ONLY

Governance 35
Internal Controls 37
Reputation and Public Perception 38
Risk Programs 40
D. Low-to-Moderate Risk Categories 41
Funding and Economics 41
Operations and Service Delivery 43
Planning and Strategy 45
Appendix: Survey Results 48
Survey Respondent Profile 48
Perceived Risk 49

Attachment A

Enterprise Risk Assessment Report | 1

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

EXECUTIVE SUMMARY

The City of Stockton engaged its internal auditor, Moss Adams LLP, to conduct an independent enterprise risk assessment to assess the City’s overarching areas of risk. The risk assessment provides an objective perspective into the opportunities for improvement that exist across the City and serves as a helpful tool for management to prioritize initiatives. To assess the overall risk level of City government operations and the different risk categories, the enterprise risk assessment process followed conventional Enterprise Risk Management (ERM) methodology as defined by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and embraced by the Institute of Internal Auditors (IIA). This assessment was conducted under the oversight of the Audit Committee.

Within the context of City of Stockton’s (the City) established guiding principles and strategic goals, this enterprise risk assessment provides a way for the City’s leadership to measure uncertainty related to Stockton’s ability to achieve its strategic objectives and operate effectively. Risks are identified, analyzed, and measured by the level of inherent vulnerability, the level of preparedness to mitigate them, and the impact such negative events could have on Stockton should they occur. This assessment serves as our basis for determining possible actions for managing and mitigating uncertainty, both on an inherent and a residual basis.

For each of the risk factor categories, Moss Adams assigned an overall inherent risk level rating. The risk levels are intended to provide City leadership with a means of prioritizing remediation efforts.

Definitions of each risk level are explained in the tables below.

RISK LEVEL DEFINITIONS
Risk Significance
High  Represents significant risks that should be addressed immediately.

Moderate- to- High  Represents serious risks that should be addressed expeditiously.

Moderate  Represents moderate risks that should be addressed as soon as reasonably possible.

Low- to- Moderate  Represents ordinary risks that should be addressed during the next review cycle.

Low  Represents a minor threat to the organization.

Attachment A

Enterprise Risk Assessment Report | 2

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

IMPACT LEVEL DEFINITIONS
Impact Significance
High  Threatens the success of the organization/service delivery.

Moderate- to- High  Substantial impact on time, cost, or quality.

Moderate  Notable impact on time, cost, or quality.

Low- to- Moderate  Minor impact on time, cost, or quality.

Low  Negligible impact.

LIKELIHOOD LEVEL DEFINITIONS
Likelihood Significance
Almost Certain  Almost certain to occur with current risk conditions.

Likely  Very likely to occur with current risk conditions.

Reasonable Possibility  Likely to occur with current risk conditions.

Unlikely  May occur with current risk conditions.

Remote  Unlikely to occur with current risk conditions.

PREPAREDNESS LEVEL DEFINITIONS
Preparedness Significance
Substantial  Risk preparedness activities are robust and likely to be sustained, with readily available evidence attesting to this level of achievement.

Significant  Risk preparedness efforts are well established, documented, and stable.

Moderate  Deliberate risk preparedness efforts are under way; important gaps remain.

Limited  Preliminary risk preparedness efforts have been initiated, though few, if any, have been implemented.

Minimal  Minimal risk preparedness activity.

Attachment A

Enterprise Risk Assessment Report | 3

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

TRAJECTORY DEFINITIONS
Trajectory Significance
Increasing  Inherent risk is increasing in current conditions.

Flat  Inherent risk is holding steady in current conditions.

Decreasing  Inherent risk is decreasing in current conditions.

The risk assessment evaluated the City’s risk in 20 categories that cover strategy, staffing, finance and systems, and operations. Overall, the City’s risk rating increased over the last three years, which is consistent with trends in most municipalities. External factors including the COVID-19 pandemic, emphasis on social justice in policing, and the Great Resignation impact environmental uncertainty and are significant trends impacting local government operations.

The table below presents the summary results of the risk assessment, presenting each of the risk categories by overall risk level from highest risk ranking to lowest. Each risk category is assigned a rating in the categories of potential impact, likelihood, preparedness, and trajectory.

RISK CATEGORY IMPACT LIKELIHOOD PREPAREDNESS TRAJECTORY High Risk
Human Capital and Resources  High Likely Limited Increasing Information Technology  High Likely Limited Increasing Organization and Staffing  High Almost Certain Limited Increasing Procurement and Contracting  High Likely Limited Increasing Public Safety and Security  High Likely Limited Increasing Moderate- to- High Risk
Capital Improvement Program  Moderate-to-
High
Reasonable
Possibility Moderate Flat
External Environment  Moderate-to-
High
Reasonable
Possibility Moderate Increasing
Management and Leadership  High Likely Moderate Increasing Policies, Procedures, and
Processes  Moderate-to-
High
Reasonable
Possibility Significant Flat
Moderate Risk
Accounting and Finance  Moderate-to-
High
Reasonable
Possibility Limited Flat
Attachment A

Enterprise Risk Assessment Report | 4

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

RISK CATEGORY IMPACT LIKELIHOOD PREPAREDNESS TRAJECTORY Asset Management Tracking  Moderate Reasonable
Possibility Moderate Flat
Compliance  Moderate-to-
High
Reasonable
Possibility Moderate Decreasing
Ethics, Fraud, Waste, and Abuse  Moderate Unlikely Moderate Flat Governance  Moderate-to-
High
Reasonable
Possibility Moderate Flat
Internal Controls  Moderate Reasonable
Possibility Moderate Flat
Reputation and Public
Perception  Moderate Unlikely Moderate Flat
Risk Programs  Moderate Reasonable
Possibility Moderate Increasing
Low- to- Moderate Risk
Funding and Economics  Moderate Unlikely Significant Flat Operations and Service Delivery  Moderate Unlikely Significant Decreasing Planning and Strategy  Moderate Unlikely Significant Decreasing In addition to interviews and document review, Moss Adams conducted an employee survey to understand the perceived risk level of each category. In general, staff survey responses were either aligned with or lower than the Risk Assessment results.

RISK FACTOR
RISK

ASSESSMENT
SURVEY

RESULTS
Accounting and Finance Moderate Moderate
Asset Management Tracking Moderate Low-to-Moderate
Capital Improvement Program Moderate-to-High Low-to-Moderate Compliance Moderate Low-to-Moderate
External Environment Moderate-to-High Moderate
Ethics, Fraud, Waste, and Abuse Moderate Moderate
Funding and Economics Moderate Moderate
Attachment A

Enterprise Risk Assessment Report | 5

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

RISK FACTOR
RISK

ASSESSMENT
SURVEY

RESULTS
Governance Moderate Moderate
Human Capital and Resources High Moderate-to-High
Information Technology High Low-to-Moderate
Internal Controls Moderate Moderate
Management and Leadership Moderate-to-High Moderate
Operations and Service Delivery Low-to-Moderate Moderate Organization and Staffing High Moderate-to-High
Planning and Strategy Low-to-Moderate Moderate
Policies, Procedures, and Processes Moderate-to-High Moderate Procurement and Contracting High Moderate
Public Safety and Security High Moderate-to-High
Reputation and Public Perception Moderate Moderate
Risk Programs Moderate Moderate
Overall Risk Moderate Moderate
The assessment results show that the City of Stockton has reduced its overall risk level since 2013, but risks increased between 2019 and 2022. As noted previously, this is a trend among local governments in response to a variety of uncontrollable external factors that have intensified since 2020.

RATINGS
RISK CATEGORY 2013 2016 2019 2022
Accounting and Finance High Moderate-to-
High
Moderate-to-
High Moderate 
Asset Management Moderate-to-
High
Moderate-to-
High
Moderate-to-
High Moderate 
Capital Program Moderate-to-
High
Moderate-to-
High High Moderate-to-
High 
Compliance High Moderate-to-
High Moderate Moderate 
Attachment A

Enterprise Risk Assessment Report | 6

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

RATINGS
RISK CATEGORY 2013 2016 2019 2022
Ethics, Fraud, Waste, and
Abuse
Moderate-to-
High Moderate Low-to-
Moderate Moderate 
Funding and Economics High Moderate-to-
High Moderate Moderate 
Governance Low-to-
Moderate Moderate Low-to-
Moderate Moderate 
Human Capital and
Resources High Moderate-to-
High Moderate High 
Internal Controls High Moderate-to-
High Moderate Moderate 
Information Technology High Moderate Moderate-to-
High High 
Management High Moderate-to-
High Moderate Moderate-to-
High 
Operations and Service
Delivery
Moderate-to-
High Moderate Moderate Low-to-
Moderate 
Organization and Staffing High Moderate-to-
High
Moderate-to-
High High 
Policies, Procedures, and
Processes High Moderate-to-
High
Low-to-
Moderate Moderate

Planning and Strategy Not Assessed Not Assessed Moderate-to- High
Low-to-
Moderate 
Procurement and Contracting High High High High 
Public Safety and Security High Moderate-to-
High
Low-to-
Moderate High 
Risk Programs Moderate Moderate Moderate Moderate 
Reputation Not Assessed Not Assessed Moderate Moderate  External Environment Not Assessed Not Assessed Not Assessed Moderate-to- High N/A
Overall Risk Level High Moderate-to-
High Moderate Moderate-to-
High

Attachment A

Enterprise Risk Assessment Report | 7

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

PROJECT SCOPE AND APPROACH

The City of Stockton engaged its internal auditor, Moss Adams LLP, to conduct an independent enterprise risk assessment to assess the City’s overarching areas of risk. To assess the overall risk level of City government operations and the different risk categories, the enterprise risk assessment process followed conventional Enterprise Risk Management (ERM) methodology as defined by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and embraced by the Institute of Internal Auditors (IIA). This assessment was conducted under the oversight of the Audit Committee.

Moss Adams evaluated 20 categories of risk—and business processes within each—that collectively make up operations across the organization. Risk identification includes identifying current levels of risk, the City’s level of preparedness in terms of mitigation efforts, and what reasonably foreseeable risks may have a significant impact on the organization. The objective of risk identification is to identify the most important areas of risk and lay the foundation for subsequent management of these risks.

The enterprise risk assessment process is reported on at a specific point in time—the risk assessment phase, which was conducted from February 2022 through July 2022. Both the risk ratings and trajectory levels are directly connected to this timing.

The enterprise risk assessment process consists of four primary phases of work: 1) planning, 2) fact finding, 3) risk assessment, and 4) risk reporting. Planning included requesting documents, identifying who to interview, and identifying who to include in the survey process. Fact finding encompassed document review, analysis of existing data, interviews, and a web-based survey sent to City employees. The risk assessment included analysis of the level of uncertainty associated with each factor, including the potential for impact on the City’s operations. Risk reporting entails the development of draft and final deliverables, along with follow-up discussions with management and presentation to key stakeholders.

The activities and goals for each phase are described in detail below.

PLANNING
We began pl anning our assessment by requesting a standard set of documents from the City, including (but not limited to) prior risk assessments, audits, public website documents, and financial reports. We used these to identify the first round of individuals to interview and additional document needs based on business process/functional areas.

Attachment A

Enterprise Risk Assessment Report | 8

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

FACT FINDING
Fact-f inding encompasses analysis of received documents, employee and Councilmember interviews, and soliciting additional employee feedback via an online survey. In this phase, our aim is to gather information in order to gain a clear understanding of Stockton’s government and the way it operates to achieve its goals and purpose.

RISK ASSESSMENT
With the information collected and compiled, we performed a risk assessment that includes a comprehensive review and analysis of the 20 categories of risk factors. This analysis included the inherent vulnerabilities, the level of preparedness efforts to mitigate risks, and the likely impact a negative event may have.

RISK REPORTING
During this phase, we developed t he draft version of this report to engage in review and discussion with senior leadership. This report becomes the final deliverable, which is then presented to City of Stockton leadership and the Audit Committee.

The enterprise risk assessment process relies on evidence obtained from City of Stockton employees. By design, the assessment process requires access to all senior leadership and many department and division managers. Input was obtained from employees from all Stockton departments, through a combination of interviews and a web-based questionnaire. Full disclosure of information has been assumed in this process.

Distribution of a risk assessment questionnaire offered staff the opportunity to identify perceived strengths and weaknesses of Stockton’s government operations, which helps us assess potential opportunities for improvement and identify areas of specific vulnerability. The questionnaire posed a variety of statements to employees, including rating scale questions as well as open-ended questions for each of the risk categories. The questionnaire was sent out to supervisor level and above employees and was open for submission between March 29 and April 26. Out of the 1,738 employees invited to take the survey, 340 individuals submitted responses (a participation rate of

19.6%). The consolidated results of the survey are listed in the appendix of this report.

For each of the risk categories assessed, our risk assessment presents an overview of the risk condition at the City of Stockton, including the current risk level, risk preparedness, negative event impact, and risk level trajectory. Risk mitigation identifies potential strategies for each category, and the residual risk level represents the probable risk exposure shift after risk mitigation efforts. The elements below make up the risk assessment framework, which are industry standards and defined by COSO’s ERM methodology.

Attachment A

Enterprise Risk Assessment Report | 9

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

RISK LEVEL DEFINITIONS
Risk Significance
High  Represents significant risks that should be addressed immediately.

Moderate- to- High  Represents serious risks that should be addressed expeditiously.

Moderate  Represents moderate risks that should be addressed as soon as reasonably possible.

Low- to- Moderate  Represents ordinary risks that should be addressed during the next review cycle.

Low  Represents a minor threat to the organization.

IMPACT LEVEL DEFINITIONS
Impact Significance
High  Threatens the success of the organization/ service delivery.

Moderate- to- High  Substantial impact on time, cost, or quality.

Moderate  Notable impact on time, cost, or quality.

Low- to- Moderate  Minor impact on time, cost, or quality.

Low  Negligible impact.

LIKELIHOOD LEVEL DEFINITIONS
Likelihood Significance
Almost Certain  Almost certain to occur with current risk conditions.

Likely  Very likely to occur with current risk conditions.

Reasonable Possibility  Likely to occur with current risk conditions.

Unlikely  May occur with current risk conditions.

Remote  Unlikely to occur with current risk conditions.

Attachment A

Enterprise Risk Assessment Report | 10

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

PREPAREDNESS LEVEL DEFINITIONS
Preparedness Significance
Substantial  Risk preparedness activities are robust and likely to be sustained, with readily available evidence attesting to this level of achievement.

Significant  Risk preparedness efforts are well established, documented, and stable.

Moderate  Deliberate risk preparedness efforts are under way; important gaps remain.

Limited  Preliminary risk preparedness efforts have been initiated, though few, if any, have been implemented.

Minimal  Minimal risk preparedness activity.

TRAJECTORY DEFINITIONS
Trajectory Significance
Increasing  Inherent risk is increasing in current conditions.

Flat  Inherent risk is holding steady in current conditions.

Decreasing  Inherent risk is decreasing in current conditions.

Attachment A

Enterprise Risk Assessment Report | 11

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

RISK ASSESSMENT RESULTS

Overall Risk Rating High

Impact

Likelihood

Preparedness

Trajectory
High Likely Limited Increasing

Risk Mitigation
● Develop formalized HR policies and procedures.
● Clarify the roles, responsibilities, and authority of HR within the City’s decentralized structure.
● Complete a classification and compensation
study and implement changes to increase the
competitiveness of the City of Stockton as an
employer.
● Evaluate the feasibility of charter amendments to
streamline and modernize hiring and promotional
processes.

Survey Rating
Moderate

Residual Risk
Moderate

Risk Areas: Risks associated with labor management/contracts, employee performance, training, compensation, benefits, turnover, grievances, overtime, resource availability, and communication.

Scope: Human capital and resource practices can span functions including hiring, orientation, training, evaluating, counseling, career planning, compensation and benefits, and housing the policies that define an organization’s expected levels of integrity, ethical behavior and competence.

Current Risk Condition at City of Stockton
In FY 2021-22, the City’s Human Resources Department (HR) budgeted 19 full-time employees (FTEs). HR employees are responsible for a variety of activities, including workforce planning and training, employee and labor relations, benefits administration, and risk management activities.

Across the City, there is a lack of clarity around the roles, responsibilities, and authority of HR due to leadership turnover, the City’s preference for decentralized internal services, and gaps in policies and procedures. These challenges affect HR’s ability to effectively deliver services and meet Citywide HR- related goals.

While HR has taken steps to improve operations, including outsourcing the development of core policies and procedures, staffing challenges have affected the department’s ability to effectively deliver services. HR has experienced significant turnover in the department, particularly at the leadership level. In 2021, HR’s overall turnover rate was 48%. HR has been able to fill many of its vacancies, but many employees are new in their roles, including HR’s Director, Assistant Director, and Deputy Director. Even when new employees are strong, turnover can result in a loss of institutional knowledge and challenges in providing services while new staff are hired and trained.

Attachment A

Enterprise Risk Assessment Report | 12

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Additionally, the City’s ERP implementation efforts resulted in significant increases to HR’s workload, further exacerbating challenges effectively delivering services to other City departments.

Approximately 14% of positions across the City are vacant. As noted within the Organization and Staffing section, recruiting qualified employees continues to present challenges due to several factors including the City’s proximity to the Bay Area, which results in increased competition for qualified staff. Sixty-seven percent of survey respondents rated the City’s current efforts to attract, develop, and retain employees as poor or terrible and 60% rated the competitiveness of the City’s compensation and benefits packages as poor or terrible.

EMPLO YEE SURVEY

Additionally, the City’s civil service hiring requirements contribute to a sub-optimal process to fill positions. For example, a typical recruitment takes between 31 and 162 days and some departments report feeling that they are unable to hire the best candidate for the position due to rigid educational and testing requirements. This further exacerbates the City’s struggle to hire and retain candidates with expertise and innovative ideas that would elevate City operations. In response to its recruitment and retention challenges, HR plans to complete a job classification and compensation study and develop a recruitment and retention plan and reported efforts to market the City as an employer of choice.

Despite being one of the most diverse cities in the nation, the City does not have a formal diversity, equity, and inclusion program. Hiring a diverse workforce can be challenging due to the City’s civil service system, which is dictated by the City’s charter and does not align with best practices. The City’s charter also prescribes a testing-based process for most promotional opportunities, which can hinder retention of high-performing employees. Increasing staff diversity can lead to more innovation, better organizational performance, and increased employee morale. 1% 6% 26% 29% 38%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE THE CITY'S CURRENT EFFORTS TO
ATTRACT, DEVELOP, AND RETAIN EMPLOYEES?
Excellent Good Average Poor Terrible
2% 13% 26% 28% 32%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE THE COMPETITIVENESS OF THE
CITY'S COMPENSATION AND BENEFITS?
Excellent Good Average Poor Terrible
Attachment A

Enterprise Risk Assessment Report | 13

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Overall Risk Rating High

Impact

Likelihood

Preparedness

Trajectory
High Likely Limited Increasing

Risk Mitigation
● Ensure City employees receive adequate training
on the new ERP system.
● Evaluate the City’s ERP implementation process
to identify issues that could affect operations
moving forward and develop a plan for
addressing them.
● Develop and implement an IT disaster recovery
plan and business continuity plan.
● Continue to prioritize cybersecurity efforts.

Survey Rating
Moderate

Residual Risk
Moderate-to-High

Risk Areas: Risks associated with the design, development, implementation, administration, operations, and maintenance of information systems including change management and system development life cycle. Also includes risks to infrastructure, system performance, data architecture and management, integration, back-up, security, and controls.

Scope: The importance and pervasiveness of information technology and information systems continues to rapidly expand, regardless of the organization.

Current Risk Condition at City of Stockton
In FY 2021-22, the City’s Information Technology Department (IT) 52 budgeted FTEs. IT employees are responsible for a variety of activities, including overseeing the City’s information technology strategy, providing enterprise-wide technology support, and protecting and preserving the integrity of the City’s data. Overall, staff reported satisfaction with service from the City’s IT department.

However, supply chain issues resulting from the COVID-19 pandemic have affected the City’s ability to purchase new and replacement IT equipment in a timely manner, which has had some effect on business operations.

EMPLOYEE SURVEY

21% 34% 29% 11% 5%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE THE QUALITY OF THE INTERNAL
CUSTOMER SERVICE PROVIDED TO STAFF BY THE IT TEAM?
Excellent Good Average Poor Terrible
Attachment A

Enterprise Risk Assessment Report | 14

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Additionally, the City has experienced numerous challenges implementing its new enterprise resource planning (ERP) system, the implementation of which is led by the Administrative Services Department (ASD). There has been difficulty in recruiting and retaining implementation team staffing, including at the leadership level. Without consistent leadership, there has been inconsistent oversight and project management over the ERP implementation process. Staff reported minimal communication and end- user involvement, confusion about processes, and significant unanticipated impacts on staff workload throughout implementation. Many of the challenges noted in interviews and survey responses appear to be driven by staff turnover and informal change management processes. These factors have also contributed to project delays.

The City’s ERP system is more than 30 years old and change management is a natural challenge.

Employees reported numerous change management concerns, including:
• Undefined accountability or ownership of the implementation process • Unclear roles and responsibilities related to the implementation process • A lack of effective communication across the organization • Insufficient training on the new system
Additionally, the City did not adequately redesign and improve business processes in advance of implementation to ensure its business processes took advantage of the new system’s capabilities.

Failure to reassess the implementation process in a timely manner could result in increased business costs over time and the system’s inability to meet business needs once fully implemented. For example, there is a risk that data in the system may be unusable or inconsistent given best practices do not appear to have been followed in system implementation, such as using consistent naming conventions. Departments reported the need for workarounds in the system and/or working outside of the system due to the system’s inability to meet their needs. This presents a risk that the system will not be fully utilized moving forward either due to system limitations or poor user adoption.

Cybersecurity
Cybersecurity is a known area of high risk for local governments across the country. It is also a rapidly changing environment, continually exposing the City to new and evolving risk areas. In alignment with best practice, the City has a dedicated cybersecurity position. The City also relies on outside contractors for additional cybersecurity monitoring. Management reported cybersecurity efforts have matured in recent years. The City has invested in education and training for employees, including twice-annual training and phishing tests. However, the City needs an IT disaster recovery plan and business continuity plan to ensure the City is prepared for potential cyberattacks or other disasters that could affect the City’s IT infrastructure and, ultimately, City operations. Continuing to prioritize these efforts will be critical given increases in the number and complexity of cyberattacks against local governments in recent years.

Attachment A

Enterprise Risk Assessment Report | 15

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Overall Risk Rating High

Impact

Likelihood

Preparedness

Trajectory
High Almost Certain Limited Increasing

Risk Mitigation
● Develop a workforce plan to strategically scale
staffing over time.
● Develop a workforce recruitment and retention
strategy to address staffing and hiring challenges.
● Develop and implement a formal and regularly
occurring succession planning process to ensure
continuity of business operations when staff leave
positions.

Survey Rating
Moderate

Residual Risk
Moderate

Risk Areas: Risks associated with how personnel are organized, as well as staffing levels and skills.

Scope: An entity’s organizational structure provides the framework to plan, execute, control, and monitor its activities. Organization and staffing encompass hierarchy, chain of command, span of control, and staffing levels. Staffing includes specific positions, counts, and capacity. A relevant organizational structure includes defining key areas of authority and responsibility and establishing appropriate lines of reporting.

Current Risk Condition at City of Stockton
The City’s lean staffing model, combined with increased turnover and difficulty with recruiting, has resulted in capacity challenges across the organization and increased risk in this area compared to the City’s 2019 Enterprise Risk Assessment. These are common challenges in cities across the country and many cities are experiencing increasing risk trajectories in this area.

Since FY 2018-19, the City’s staffing has increased by 27 budgeted FTE positions, to a total of 1,674 budgeted FTEs. In accordance with its Long-Range Financial Plan, the City has restricted staffing level increases that are not associated with a dedicated funding source. As a result, many positions post-bankruptcy have stretched to fulfill additional job functions and duties and City employees continue to experience high workloads. As vacancy rates rose, employees continued to take on additional tasks, which presents the risk of employee burnout and role confusion.

Sixty-one percent of survey respondents indicated that staffing levels within their department are inadequate, and 62% indicated staffing levels across the City are inadequate. In interviews, staff reported numerous impacts of inadequate staffing, including difficulty effectively delivering internal services like recruiting and contract management, as well as challenges implementing the City’s new ERP system. Insufficient staffing can result in chronic issues when unaddressed. Understaffed departments often become focused on crisis management or day-to-day operations, rather than operating strategically and identifying process efficiencies. Additionally, City staff may become burned out and less productive, thereby perpetuating increased turnover. Continuing a practice that began to save expenses during the bankruptcy, the City relies on staff augmentation and retired annuitants to Attachment A

Enterprise Risk Assessment Report | 16

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

fill key staffing gaps. While these strategies offer reduced costs, they are temporary measures that can also result in loss of internal capacity and knowledge over time.

EMPLOYEE SURVEY

According to the City’s proposed FY 2022-23 budget, the City is taking steps to begin strategically growing after several years of restricting staff growth post-bankruptcy. Formalizing a strategic workforce expansion plan could help the City prioritize and address staffing concerns, while continuing to take the City’s long-term financial health into account.

In addition to an already lean staff, the City is experiencing high vacancy and turnover rates. The City reports high vacancy and turnover rates due to several factors including a high number of retirements, difficulty recruiting, and the volatile job market. If the City does not address these high vacancy and turnover rates, it risks being unable to meet its goals as well as having to pay higher costs to provide services due to decreased productivity, increased hiring and training costs, and overtime costs. These costs can be even higher in public safety departments, where staff are more susceptible to workplace injuries. High vacancy and turnover rates can also lead to low staff morale due to remaining employees taking on increased workloads.

The City is also experiencing difficulty effectively recruiting for open positions. Staff report this is the result of several factors, including the salaries and flexibility offered by other public agencies, perceptions of the City’s image and reputation in the region, and the City’s civil service rules, which make positions difficult to fill and extends the length of time required for the hiring process.

Additionally, HR lacks adequate recruiting staff to support department recruiting efforts. For years, HR has limited recruitments to one recruitment per month for each department, which does not meet the demand for filling open positions and can create fairness concerns among larger departments. It is critical the City take steps, such as developing and implementing a recruitment and retention strategy, to address these challenges and fill vacancies.

The City’s difficulty with recruitment and retention are further challenged by the absence of a deliberate and standardized succession planning process. With increased turnover, there is a 2% 14% 22% 35% 26%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE THE ADEQUACY OF CURRENT
STAFFING LEVELS WITHIN YOUR DEPARTMENT?
Excellent Good Average Poor Terrible
1% 4% 33% 45% 17%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE THE CURRENT STAFFING LEVELS
ACROSS THE CITY AS A WHOLE?
Excellent Good Average Poor Terrible
Attachment A

Enterprise Risk Assessment Report | 17

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

significant amount of institutional knowledge and technical expertise at increased risk of being lost.

Institutionalizing succession planning efforts across departments will help the City decrease risk in this area.

Overall Risk Rating High

Impact

Likelihood

Preparedness

Trajectory
High Likely Limited Increasing

Risk Mitigation
● Centralize the City’s procurement function and
ensure the division receives appropriate
resources and authority.
● Review, update, and strengthen procurement
policies and procedures; provide employee
training on the updated policies and procedures.
● Consider adding additional resources to the
Procurement Division to increase employee
bandwidth and operational effectiveness.
● Reconsider the procurement approval process to
gain efficiencies.

Survey Rating
Moderate

Residual Risk
Moderate

Risk Areas: Risks associated with purchasing processes (e.g., specifications development, bidding, selection) and contract administration (e.g., compliance with terms and conditions, payments, change orders) for goods, services, and capital programs.

Scope: Procurement and contracting includes purchasing processes (e.g., purchase orders, bidding, selection) and contract administration (e.g., compliance with terms and conditions, payments, change orders) for goods, services, and capital programs.

Current Risk Condition at City of Stockton
The City’s Procurement Division is housed within the Administrative Services Department (ASD) and staffed by five FTEs: a procurement manager, two supervisors, and two specialists. This represents a reduction of two FTEs, from seven FTEs in the 2019 assessment. Multiple vacancies coupled with increased workload due to the ERP implementation and grant funding results in limited bandwidth to manage activities.

COVID-19 has also affected procurement processes. Supply chain issues impact available resources and the City’s ability to meet deadlines for grant funding, which has increased procurement activities.

Currently, the Procurement Division is not positioned to manage the amount of funds that will come into and be distributed by the City. For example, the City has not been able to spend most American Rescue Plan Act (ARPA) dollars due to procurement issues and delays. Staff report concerns about the potential for having to give back grant dollars because of procurement delays in Municipal Utilities Department (MUD) and Public Works (PW). To effectively balance the need to adhere to grant Attachment A

Enterprise Risk Assessment Report | 18

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

compliance requirements and expeditiously award contracts, the City should evaluate existing processes and systems for potential efficiencies.

ERP implementation has presented procurement-related challenges. Because processes have changed and system glitches are occurring, staff must divert time to responding to help desk tickets related to the ERP procurement module. The division currently struggles to process invoices on contracts in a timely manner. One roadblock in the approval process is that there is no delegated signature authority for the City Manager when they are unavailable, which presents both inefficiencies and does not align with best practices. In addition, there are currently no automated notifications sent to approvers, which continues to slow down the process.

Procurement in the City is decentralized, and departments are largely responsible for purchasing goods and services needed to accomplish their goals. For example, PW primarily conducts its own procurement activities, including the development, negotiation, and issuing of its contracts. This reportedly was due to the historical lack of technical knowledge about public works procurement needs and operations within the Procurement Division. Conversely, MUD moved, and continues to fund, a dedicated purchasing position from its own department to reside within the Procurement Division, which helps ensure that Procurement understands and responds to the operational needs of the department in a timely manner.

Decentralized purchasing and contract administration allows operating departments more autonomy and flexibility to meet their unique needs, but it also creates a significant risk of failure as purchasing capacity is not strong or reinforced with formal policies and procedures, frequent training, and accountability. This includes a lack of standard naming conventions or expectations for contracts, which results in inconsistencies in data management and reporting across the City, as noted previously in the Information Technology section. This could put the City at risk of noncompliance with procurement rules and regulations.

City employees report that procurement processes take a significant amount of time to complete, which results in frustrations and burdens as additional resources must be dedicated to the process and the delivery of needed goods and services is often delayed. Additionally, departments sometimes receive conflicting messages from Purchasing staff, further exacerbating unclear processes and expectations to fulfill the City’s purchasing needs. In the survey, staff reported the need training, standard policies and procedures, and enforcement of the policies and procedures as some employees are able to perform workarounds of the current, vague policies and procedures.

Attachment A

Enterprise Risk Assessment Report | 19

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

EMPLOYEE SURVEY

Employees expressed confusion about procurement and contracting processes, citing constant change that is not communicated Citywide. Although the City has recently implemented new procurement policies, the procedures have not been developed or implemented. The City plans to update procurement procedures, but the initiative has been delayed with the ongoing ERP changes.

The lack of updated procurement policies and procedures also impacts the ability of City leaders to understand and enforce the policies.

Overall Risk Rating High

Impact

Likelihood

Preparedness

Trajectory
High Likely Limited Increasing

Risk Mitigation
● Develop comprehensive emergency operations
plans with associated training for City employees
and stakeholders.
● Continue to explore and strengthen strategies to
address public safety staffing needs.
● Continue to monitor crime trends and develop
strategies for reducing crime on an ongoing
basis.

Survey Rating
Moderate

Residual Risk
Moderate

1% 23% 35% 25% 17%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE THE DOCUMENTATION OF
PURCHASING POLICIES AND PROCEDURES?
Excellent Good Average Poor Terrible
2% 17% 45% 23% 14%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE THE PROCESS NEEDED TO ACQUIRE
THE GOODS AND SERVICES YOUR DIVISION NEEDS?
Excellent Good Average Poor Terrible
Attachment A

Enterprise Risk Assessment Report | 20

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Risk Areas: Risks associated with public safety services, including level of services, funding, and community issues.

Scope: Public safety includes emergency services such as law enforcement, fire, dispatch, and community disaster response programs.

Current Risk Condition at City of Stockton
The Police and Fire Departments comprise the City’s public safety functions. These two functions were responsible for 76% of the City’s FY 2021-22 general fund operating expenditures (56% Police and 20% Fire). The City has significantly improved public safety outcomes in recent years, although its reputation of being a high-crime community persists. Over half (55%) of employees reported the overall feeling of safety as below average. Additionally, 48% rated the effectiveness of the City’s public safety services delivered to the City as average and 23% rated effectiveness as below average.

EMPLOYEE SURVEY

Fire
In FY 2021-22, the Fire Department had 183 budgeted sworn firefighter FTEs, an increase of one position over the previous year. The Fire Department also had 41 budgeted non-sworn FTEs, equal to the previous year. The rate of firefighters per 1,000 people in Stockton is 0.5, which is low for a city the size of Stockton. A report by the National Fire Protection Association in 2019 found the rate of firefighters per 1,000 people in cities with 250,000 to 499,999 ranged from 0.47 to 2.37.

The Fire Department experienced high levels of turnover in recent years. Firefighters are reportedly leaving the City for several reasons, including retirement eligibility, higher benefits and pay in nearby cities, and an increasingly high workload. The department also had trouble recruiting new firefighters.

Management reported recruiting challenges are largely a result of pay and benefits being low in comparison to nearby cities, particularly given high workloads within the City. 10% 35% 32% 23%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE THE OVERALL FEELING OF SAFETY IN
THE COMMUNITY?
Excellent Good Average Poor Terrible
5% 24% 48% 17% 6%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE THE EFFECTIVENESS OF THE PUBLIC
SAFETY SERVICES DELIVERED TO THE CITY?
Excellent Good Average Poor Terrible
Attachment A

Enterprise Risk Assessment Report | 21

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

The Fire Department’s call volume continues to increase, resulting in increased risk of staff burnout and elevated workers’ compensation claims. The Stockton dispatch center experienced a 20% increase in call volume in 2020 and staff reported additional increases in 2021. The number of authorized sworn firefighters has not increased to accommodate these additional service calls.

Police
In FY 2021-22, the Police Department had 485 budgeted sworn police officers, which is the same number as in the previous fiscal year. Measure A, which expires in 2024, funds 120 of these officers.

The Police Department also had 228 budgeted civilian FTEs, an increase of two positions over the previous year. Similar to the Fire Department, officers face increased safety risks due to elevated call volume and the nature of calls in the City. The department has deprioritized responses to certain calls to avoid cutting patrol.

The former Police Chief retired at the end of 2021 and the City recently conducted a nationwide search that resulted in the appointment of a new Chief. The prior chief was a well-respected local leader who led significant cultural and operational reforms in the Department. Councilmembers have significant concerns about the potential cultural and community relations impacts of a change in Police Department leadership. Additionally, the Police Department is experiencing trouble recruiting new officers due to the same challenges the Fire Department is experiencing—high workload and low pay and benefits compared to other nearby cities.

The Police Department has a current strategic plan in place that includes goals and strategies related to reducing crime, increasing community trust, recruiting a qualified and diverse workforce, and employing highly trained and knowledgeable staff. Violent and property crime rates decreased overall between 2019 and 2021. However, first quarter crime rates in 2022 are higher than expected in certain areas, including criminal homicide and theft. The department monitors progress on its goals using a dashboard that is updated monthly, in alignment with best practices.

FIGURE 1: CRIME RATE TRENDS FROM FY 201 9 TO 2021

1416
1293
1151
0 200
400
600
800
1000
1200
1400
1600
2019 2020 2021
Violent Crime Rate
4041
3079
2625
0 500
1000
1500
2000
2500
3000
3500
4000
4500
2019 2020 2021
Property Crime Rate
Attachment A

Enterprise Risk Assessment Report | 22

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

The Office of Violence Prevention (OVP)
OVP works to reduce gang/group gun violence within the City of Stockton, using data-driven partnership programs and strategies. Staffing in OVP is at risk given positions are largely reliant on Measure A funding. Additionally, staff reported difficulty filling peacekeeper roles because candidates need to have existing community connections to be effective.

Overall Risk Rating Moderate-to-High

Impact

Likelihood

Preparedness

Trajectory
Moderate-to-High Reasonable Possibility Moderate Flat

Risk Mitigation
● Account for additional delays or increased costs
due to COVID-19 impacts and labor constraints in
budgets and project schedules.
● Develop policies, procedures, and processes to
effectively leverage available grant funding.
● Continue to plan for annual funded projects
based on prioritized CIP and quantified capital
needs.

Survey Rating
Moderate

Residual Risk
Moderate

Risk Areas: Risks associated with capital asset management (including preservation and maintenance), tracking, reporting, accountability, and inventory.

Scope: In construction, issues of risk are closely tied to schedule, site unknowns and budget issues. In addition, construction contracts must be monitored to ensure full compliance with equal employment opportunity, discrimination, and prevailing wage and fair labor standards laws.

Current Risk Condition at City of Stockton
The Capital Improvement Program includes buildings, parks, golf courses, utilities, and the transportation system. The Capital Improvement Plan (CIP) is a five-year planning document that is updated annually, along with the City’s operational budget. Budgeted funds for each project cover costs for design, construction, equipment and land purchases, project administration, and contingencies. PW is responsible for the delivery of a majority of the City’s capital projects, and funding primarily comes from taxes and grant funding.

The City has continually improved its financial state over the last 10 years, which indicates it may be positioned to focus on more strategic capital improvement projects in upcoming years. However, the City lacks staff capacity in MUD and PW, as well as internal service departments, to execute projects.

Attachment A

Enterprise Risk Assessment Report | 23

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Due to a lack of resources, the City has historically taken a deferred maintenance approach where the City prioritizes permanent or temporary repairs of infrastructure after significant issues are identified. For example, there is a backlog of roads that need resurfacing and potholes that need filled. Now that the City is more financially stable and can take advantage of state and federal infrastructure funding opportunities, it should start to redirect its focus on long-term improvements. Of the employees surveyed, 54% rate the City’s process to identify and prioritize CIP as average while only 18% rated the process as excellent or good.

EMPLOYEE SURVEY

The City’s 2021-2026 five-year CIP budget totaled $1.02 billion. The plan includes municipal utility projects valued at $328 million, transportation projects for $298 million, and other Citywide projects valued at $399 million. The CIP also included a one-time contribute to the Waterfront Office Towers in the amount of $12.4 million. Most of the CIP is focused on maintaining existing facilities and infrastructure with the exception of a new facility for library and recreation services. Operations for this facility will be funded through the Strong Communities fund (Measure M). • Public Safety Facilities – The Fire Department has outdated infrastructure and at least one fire station reportedly needs replacement in the upcoming years, but the Fire Department lacks funding and resources to manage these needs. The City’s CIP includes some projects to address these facilities, primarily related to asphalt repair, but does not address the bigger infrastructure needs. Reconstruction of Fire Station 1 is in the CIP with an anticipated start date of 2025 and $2,487,000 in expenses, which have not been funded.
• Transportation – The City received several federal and state grants totaling $14.1 million to improve its transportation system. These projects will improve traffic, safety, and personal mobility and accommodate for city growth and development. As many of these funds are grants, the City will need to ensure all grant funds are used appropriately and fully. • Utilities – Upgrades related to the Regional Wastewater Control Facility Modifications Project is 50% complete and is set to finish in 2024. These upgrades are necessary for the City to meet stricter treated wastewater discharge limits required by the State of California. Other improvements are also planned to maintain facilities and ensure state regulations are followed for compliance. MUD is working on creating master plans with the Water Master Plan adopted in 2020, and is developing the Wastewater and Stormwater plans next.

Many of the buildings currently housing City offices are in significant need of repair or remodel. The City acquired the Waterfront Office Towers buildings in January 2018 to serve as the permanent City Hall, but construction has been delayed and resulted in budget increases. Nationwide increases in construction costs likely contributed to a portion of increased costs associated with the Waterfront Tower renovation project.
1% 17% 54% 20%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE THE PROCESS THE CITY USES TO
IDENTIFY AND PRIORITIZE CIP?
Excellent Good Average Poor Terrible
Attachment A

Enterprise Risk Assessment Report | 24

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Another challenge in effectively implementing the City’s CIP relates to staffing levels. There are high levels of vacancies in MUD and PW, which present challenges in managing daily work. In order to execute projects, these roles will need to be filled by qualified employees who the City can retain.

Both departments reported that project completion often hinges on the ability to recruit qualified candidates, which presents difficulties in the ability to deliver projects when they are limited to one recruitment per month as large departments. The Procurement Division also lacks the capacity to timely manage bidding, contracts, and invoice processing, which leads to project delays.

Overall Risk Rating Moderate-to-High

Impact

Likelihood

Preparedness

Trajectory
Moderate-to-High Reasonable Possibility Moderate Increasing

Risk Mitigation
● Consider the impacts of a growing population on
City services and expanding community needs.
● Continue cross-functional efforts to collaborate
internally on homelessness and consider
engaging local service agencies for additional
support.

Survey Rating
Moderate

Residual Risk
Moderate

Risk Areas: Risks associated with events outside of an organization’s control.

Scope: External risks typically include economic trends, natural disasters, climate change, affordable housing, and regulatory changes.

Current Risk Condition at City of Stockton
The City’s population continues to expand, increasing the need to evolve community dynamics and City service delivery needs. As the population grows, the City should consider impacts to infrastructure, transportation, housing, and additional capacity at the City to handle the increase in community needs from public safety to systems and technology. The Great Resignation presents challenges in filling critical positions across a variety of industries and locations. This trend not only impacts the City’s ability to recruit and retain qualified applicants but may also impact local economy and small businesses.

COVID-19 has impacted the City over the last two years and may continue to do so. Some of these impacts include a shifting workforce, changing policies, remote work options, additional precautions needed for frontline workers, communication with the community, shifting priorities, and supply chain issues. COVID-19 may not be the last pandemic or endemic impacting the entire community at one time. The City needs to be prepared for the next health or natural disaster, which could range from health concerns to earthquakes and fires.

Attachment A

Enterprise Risk Assessment Report | 25

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Like many cities in California, Stockton has also experienced an increase in homelessness.

Approximately 73% of survey respondents reported a perceived high risk of homelessness in the community. This risk impacts City employees at work and the community as a whole due to increased need for affordable housing, public transit, and mental health services.

EMPLOYEE SURVEY

The City intends to form an interdepartmental task force to help address homelessness collaboratively and has already instituted several groups to help with changes, including the following:
• The Fire Department has a homeless outreach team and is managing increases in emergency calls.
• The Police Department has a team of strategic community officers and mental health officers on bikes.
• Public Works has increased cleanup efforts in local spaces. • EDD is planning housing projects and managing more homeless work with the increase in homelessness-related grants.
5% 8% 22% 32% 32%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

WHAT IS THE PERCEIVED RISK OF THE LACK OF AFFORDABLE
HOUSING AT THE CITY?
Low Risk Low-to-Moderate Moderate Moderate-to-High High Risk 1%3% 5% 19% 73%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

WHAT IS THE PERCEIVED RISK OF HOMLESSNESS IN THE
COMMUNITY?
Low Risk Low-to-Moderate Moderate Moderate-to-High High Risk Attachment A

Enterprise Risk Assessment Report | 26

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Overall Risk Rating Moderate-to-High

Impact

Likelihood

Preparedness

Trajectory
High Likely Moderate Flat

Risk Mitigation
● Improve and enforce management training for
managers across the City to improve consistent
application of expectations.
● Streamline the communication process and
implement downward communication to all City
staff.
● Develop opportunities for managers to actively
collaborate across the City.

Survey Rating
Moderate

Residual Risk
Moderate

Risk Areas: Risks associated with organizational leadership, management practices, leadership strategic activities, and operating styles.

Scope: Management's philosophy and operating style affect the way an organization is managed, including the kinds of risks accepted. The attitude and daily operating style of top management affect the extent to which actions are aligned with risk philosophy and appetite.

Current Risk Condition at City of Stockton
Since 2019, there has been significant leadership turnover and subsequent culture changes within the organization. Turnover in some key positions, including the City Manager, all three Deputy City Managers, and all but one director-level position over the last three years has contributed to culture changes that also resulted in fluctuating expectations and business processes across the City. These changes can present challenges, but also bring about reinvigorated collaboration among the team.

Councilmembers reported confidence in the current department directors’ leadership and energy. As the City hires and retains new leadership, it should focus on supporting consistent management training. Staff surveyed reported there is little management training, and it is often self-motivated and not enforced or required for all managers. Management training is a critical factor in retaining and growing high-performing employees, developing leadership succession, and improving employee morale.

Approximately 24% of employees said that senior leadership at the City works extremely or very well together and approximately 20% of employees surveyed reported the quality of senior leadership is excellent or good. Comments in the survey noted that downward communication related to processes and changes is inconsistent. This can create confusion among staff and prolong new processes from being implemented timely and correctly. Staff report that leadership regularly communicates about broad topics like COVID-19 updates but infrequently shares messages related to City operations or strategy. In addition, while some department managers may communicate, staff often feel siloed from Attachment A

Enterprise Risk Assessment Report | 27

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

other departments and desire more opportunities to collaborate and improve Citywide customer service.

EMPLOY EE SURVEY

Staff surveyed report lack of communication about Citywide goals and vision. Full management support on projects can be a challenge as department directors have different priorities (see Planning and Strategy section). The ERP, for example, has run into challenges with adequately staffing and training employees on new implementations due to competing projects that take staff away from ERP implementation. This can contribute to budget, staffing, scheduling, and other resource conflicts between competing priorities. In addition, some staff report a lack of consistency in enforcing Citywide policies and procedures, which can contribute to confusion and negatively impact employee morale across teams.
3% 21% 34% 25% 26%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WELL DO YOU FEEL THAT THE SENIOR LEADERSHIP
TEAM AT STOCKTON WORKS TOGETHER?
Extremely well Very well Moderately well Slightly well Not well at all 5% 15% 35% 27% 19%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE THE QUALITY OF THE

COMMUNICATION YOU RECEIVE FROM THE CITY'S SENIOR
LEADERSHIP?
Excellent Good Average Poor Terrible
Attachment A

Enterprise Risk Assessment Report | 28

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Overall Risk Rating Moderate-to-High

Impact

Likelihood

Preparedness

Trajectory
Moderate-to-High Reasonable Possibility Limited Flat

Risk Mitigation
● Continue to update and develop City policies and
procedures.
● Communicate policy and procedures Citywide,
including appropriate messaging related to where
policies and procedures are stored for future
reference.
● Provide training on updated policies and
procedures to support consistency across
departments.

Survey Rating
Moderate

Residual Risk
Low-to-Moderate

Risk Areas: Risks associated with policies, processes, and procedures, including efficiency, effectiveness, and level of documentation.

Scope: Policies and procedures play a critical role in providing the guidance required to ensure all functions operate efficiently, effectively, safely, and consistently across the organization. A policy establishes what should be done, and procedures effect the policy. Policies and procedures also play an important role in protecting against the loss of institutional knowledge.

Current Risk Condition at City of Stockton
Several years ago, the Council Policy Manual and Administrative Directives were taken offline to change the format and evaluate appropriateness of authority. Although the City recently placed the Council Policy Manual back online, several policies were orphaned in the process. These policies were intended to be included in the Administrative Directives, which are incomplete. Finally, policies that are finalized are inaccessible to the majority of City staff.

Currently, the City has outdated policies and procedures in critical areas (HR, IT, and ERP-related) as well as draft policies and procedures that have not been approved yet. Some policies that are in place are vague and lack specific measures to support employee accountability.

The City operates in a highly decentralized manner, which enables departments to adjust processes to meet their needs but can also create inefficiencies in the event of insufficient guidance and oversight. It’s important for the City to have processes in place to mitigate the risks associated with decentralized operations. Areas that should be consistent include naming conventions, record keeping practices, procurement, and other administrative practices. In addition, with the continued implementation of the ERP, some processes have changed, but policies and procedures have not been updated to reflect these new changes.

Since the last risk assessment in 2019, only five new citywide policies and procedures have been updated and approved. Due to staff workloads, delays continue to persist. The City Manager’s Office Attachment A

Enterprise Risk Assessment Report | 29

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

recently expressed a renewed interest in prioritizing policy and procedure updates. The City has a plan in place to assign and track high priority policies and procedures over the next year. A key component to effectively adopting updated policies and procedures is ensuring that they are communicated and accessible to staff. The City created a central location to store policies and procedures, but some employees are still unaware of this location.

Overall Risk Rating Moderate

Impact

Likelihood

Preparedness

Trajectory
Moderate-to-High Reasonable Possibility Limited Flat

Risk Mitigation
● Continue to train employees on using the ERP
system to access financial reports and budget
data.
● Strategize ways to continue to gain efficiencies in
the ERP system.
● Continue recruiting efforts for the Payroll Division
and monitor the payroll ERP implementation to
ensure proper controls are in place and working
effectively.

Survey Rating
Moderate

Residual Risk
Low-to-Moderate

Risk Areas: Risks associated with fiscal control, budgeting, ongoing information tracking and management, revenue capture, and transaction processing. Also, risks associated with financial reporting (content, distribution, assembly, utilization, frequency, formatting, accuracy, and reliability).

Scope: The role of accounting and financial functions in risk mitigation is focused on recordkeeping and compliance through recording, classifying, summarizing, and reporting financial transactions. Financial reporting includes deliverables such as the Annual Comprehensive Financial Report (ACFR), monthly financials for budgetary comparison, and other compliance reports such as an organization’s Single Audit.

Reliable financial information is fundamental to planning, budgeting, evaluating vendor performance, assessing partnerships, and a range of other operational and strategic activities.

Current Risk Condition at City of Stockton
Overall, employees report satisfaction with the services provided by the Finance team, with 53% of survey respondents reporting that the quality of services is good or excellent. Most employees (76%) also report satisfaction with the budgeting process. These areas of strength within ASD should be commended and built upon, especially given the impact of ERP implementation on financial operations.

Attachment A

Enterprise Risk Assessment Report | 30

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

The City completed the first and second phases of the ERP system, which included core financial functions such as revenue, accounts receivable, and business licensing. The next phase of the ERP includes payroll, employee self-service, and expense reports. Though several financial functions have improved from the previous antiquated system, challenges remain particularly with reporting.

Throughout interviews and survey responses, staff reported challenges in pulling reports from the system and tracking budget data. Employees also reported receiving minimal training on how to use the system to complete tasks. Without proper training on the system, employees track budget information manually, decreasing efficiency and the intended use of the system. This also decreases the accuracy of the information and, due to lean staffing, budget information is not always updated timely or tracked.

With the transition to the new ERP system, employees are still learning the new system and how to retrieve correct and accurate reports for financial reporting. During FY 2021-22, some financial reports were still run from the legacy financial system. Most respondents (69%) reported the financial reporting information they received or have access to is moderately useful to slightly useful due in part to training around the ERP system.

EMPLOYEE SURVEY

5% 20% 35% 34% 5%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW USEFUL IS THE FINANCIAL REPORTING INFORMATION
THAT YOU RECEIVE/HAVE ACCESS TO ON A REGULAR BASIS?
Extremely useful Very useful Moderately useful Slightly useful Not useful at all

EMPLOYEE SURVEY

13% 40% 35% 9% 4%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE THE QUALITY OF THE INTERNAL
CUSTOMER SERVICE PROVIDED BY THE FINANCE TEAM?
Excellent Good Average Poor Terrible
6% 18% 52% 16% 8%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE YOUR EXPERIENCE OF THE CITY'S
BUDGETING PROCESS?
Excellent Good Average Poor Terrible
Attachment A

Enterprise Risk Assessment Report | 31

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

The Payroll Division has experienced recent turnover and faced challenges in providing accurate and timely W-2 information to employees. For example, hundreds of W-2 forms had to be corrected multiple times due to inaccurate benefit calculations errors and had to be re-sent this year. As payroll is not yet implemented into the ERP, the process is highly manual and relies on Excel spreadsheets that lack controls, which the ERP system is intended to provide. However, the success of this implementation requires that vacant positions for qualified staff be filled in a timely manner to support the project.

Overall Risk Rating Moderate

Impact

Likelihood

Preparedness

Trajectory
Moderate Reasonable Possibility Moderate Flat

Risk Mitigation
● Complete a physical inventory of existing assets
and review fixed asset tracking processes and
procedures.
● Continue to collect, curate, and strengthen asset
data to more efficiently and effectively operate,
maintain, and replace assets.
● Provide training on asset management and
tracking expectations to departments.

Survey Rating
Moderate

Residual Risk
Low-to-Moderate

Risk Areas: Risks associated with ongoing maintenance, management, tracking, reporting, accountability, accounting, and physical safeguarding of assets.

Scope: Asset management includes the supply, deployment, and maintenance of the City’s resources; it includes physical or logical access to data and locations (offices, warehouses, etc.). Asset management is inclusive of the connected strategies, processes, people, and technology that are the foundation for enabling the City to meet service levels and minimize the overall cost of asset ownership.

Current Risk Condition at City of Stockton
The City’s asset management activities are primarily led by (but not limited to) the Public Works Department (which manages facilities, forestry, solid waste, transportation, fleet, and parks maintenance) and the Municipal Utilities Department (which manages water, wastewater, and stormwater infrastructure). The Economic Development Department (EDD) is responsible for parking assets, marina assets, and entertainment venues.

Due to financial constraints, the City has historically approached asset management reactively, and has not adequately kept up with maintenance and repair needs. As a result, deferred facility maintenance, aging equipment, and obsolete technologies continue to be Citywide concerns. As of 2018, the last time the City had a comprehensive evaluation of City facilities, it was estimated deferred maintenance costs totaled approximately $48 million, with an additional $1.1 million needed Attachment A

Enterprise Risk Assessment Report | 32

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

for material costs. As noted previously in the Capital Improvement Program section, millions of dollars in unfunded projects has rendered the City unable to address ongoing needs like resurfacing and filling potholes. Deferred maintenance presents a financial and liability risk to the City, as routine maintenance almost always costs less than extraordinary or corrective maintenance or replacement.

When routine maintenance is deferred, the life of an asset is shortened, and infrastructure typically needs to be rebuilt or replaced earlier than expected.

Since 2019, the City has made some improvements to asset tracking. For example, IT asset management has reportedly improved, and the City is able to more easily and accurately track hardware provided to employees. Additionally, the City is currently implementing a fleet management system. While the City made improvements, asset tracking expectations remain decentralized, with different departments using unique systems to track information and some departments not tracking assets at all. For example, EDD does not have an asset management system for parking and lacks plans related to asset replacement. Since accounting for assets is decentralized to the departments, more training should be provided to personnel to ensure employees know how assets should be tracked. Citywide oversight of asset management should also be improved to ensure all departments are tracking assets appropriately.

Overall Risk Rating Moderate

Impact

Likelihood

Preparedness

Trajectory
Moderate-to-High Reasonable Possibility Moderate Decreasing

Risk Mitigation
● Address the internal control deficiencies noted in
the 2021 Financial Statement Audit.
● Prioritize the development of grants management
policies, procedures, and resources to support
compliance with requirements.

Survey Rating
Moderate

Residual Risk
Low-to-Moderate

Risk Areas: Risks associated with compliance with laws, regulations, and requirements, including grants.

Scope: Risks organizations face when they are unable to follow internal policies, government laws and regulations, and may be subject to legal penalties and financial fines.

Current Risk Condition at City of Stockton
With the implementation of the ERP across the core financial functions, ASD has implemented better controls, such as adjusting approvals necessary for purchases and transactions. There have also been changes around access controls and roles and responsibilities within the system. These improvements will help resolve some historical audit findings related to internal controls and Attachment A

Enterprise Risk Assessment Report | 33

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

strengthen the City’s overall control environment. Although control improvements have been made, the City has not yet realized efficiencies that were intended to be gained from the new ERP.

Implementation of the ERP led to some deficiencies in Internal Controls over Financial Reporting in the 2021 Financial Statement Audit. This included the following:
• The City did not reconcile its bank in a timely fashion and was unable to reconcile its operating account. As a result, there was a discrepancy in the amount of $785,277. • Instruction was not clear on the data input and, as a result, the depreciation was miscalculated. • There are fewer options for reporting and providing details in the ERP system. This caused some differences in the subsidiary ledgers and the general ledgers that the accounting team was still resolving during the year-end audit.

As the City continues to refine its use of the new ERP system, it should take these findings into account to appropriately remediate them and prevent future audit findings.

EMPLOYEE SURVEY

The City currently does not have a system to track grants, nor is there standard process for tracking and monitoring. Only 16% of survey respondents would rate the quality of systems used to track and monitor grants for compliance purposes as excellent or good. Most respondents (39%) responded systems are average, with the final third (32%) of respondents reporting concerns with existing grant monitoring systems.

The City has received increased levels of grant funding in the last few years, particularly COVID-19 relief funds. To manage the additional workload associated with grants management, the City recently hired a Grants Manager and has a Grants Analyst position currently in recruitment. These positions are in place to help the City manage and monitor grants on an ongoing basis. However, grant policies and procedures have not been developed, which presents challenges and risk in the City’s decentralized environment.

Employees reported previous grants had to be returned because they were not spent down due to a lack of proper monitoring or issues related to conflicts of interest. With approximately $14.1 million in in federal and state grant funds for transportation purposes alone, it is imperative that the City have systems and processes in place to accurately and efficiently monitor grants to ensure all funds are spent down and used in accordance with the contract and other relevant guidance. This funding should also support the hiring of sufficient staff to manage the projects, as noted in the Organization and Staffing and Capital Improvement Program sections.
3% 13% 39% 22% 10%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE THE QUALITY OF SYSTEMS USED TO
TRACK AND MONITOR GRANTS FOR COMPLIANCE PURPOSES?
Excellent Good Average Poor Terrible
Attachment A

Enterprise Risk Assessment Report | 34

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Compliance is decentralized to owner departments throughout the City. Currently, the City relies primarily on reactive evaluations of its compliance with regulatory requirements and City policies, which involve ongoing monitoring, testing, and reporting completed by the internal and external auditors. However, the City lacks an effective proactive approach to ensuring compliance, which is characterized by employees being aware of requirements and actively operating to comply with them.

Development of grant-related policies and procedures that also define employee accountability should be prioritized to support compliance across the City.

Overall Risk Rating Moderate

Impact

Likelihood

Preparedness

Trajectory
Moderate Unlikely Moderate Flat

Risk Mitigation
● Develop and implement policies and procedures
to reduce fraud, waste, and abuse (FWA) risk,
including an FWA policy and procedure,
procurement procedures, and segregation of
duties procedures.
● Provide regular FWA training to City employees.
● Continue strengthening internal controls and
assess opportunities for control automation.

Survey Rating
Moderate

Residual Risk
Low-to-Moderate

Risk Areas: Risks associated with misappropriation of funds, extravagant spending, using one’s position to accomplish a specific outcome, and/or the intent to deceive.

Scope: The employees of the City are entrusted with public funds and have a duty to use those funds economically, efficiently, effectively, and ethically. When employees do not honor this obligation, it could result in instances of fraud, waste, or abuse. Fraud, waste, and abuse are defined as follows:
● Fraud: A dishonest and deliberate course of action that results in obtaining money, property, or an advantage to which employees or an official committing the action would not be normally entitled. ● Waste: The needless, careless, or extravagant expenditure of funds, incurring of unnecessary expenses, or mismanagement of resources or property.
● Abuse: The intentional, wrongful, or improper use or destruction of resources, or seriously improper practice that does not involve prosecutable fraud.

Current Risk Condition at City of Stockton
In accordance with best practices, the City operates an ethics hotline that provides a mechanism for employees and residents to anonymously report ethical concerns and potential instances of FWA.

The City has also established a code of ethics for employees and City officials and policies and procedures related to conflicts of interest. However, the City does not have key policies related to discrimination, harassment, and retaliation, which are critical to promote and enforce an ethical environment.

Attachment A

Enterprise Risk Assessment Report | 35

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

The City has undertaken a multi-year process to strengthen its internal controls and reduce fraud, waste, and abuse (FWA) risks. However, the City does not have formalized FWA policies or procedures and has not conducted regular fraud training for employees. Supervisors, managers, and business analysts across the City should be provided regular FWA training since they are in positions that enable access to data and information that could reveal anomalies. Additionally, the City does not have specific financial management procedures that could reduce the risk of FWA, including procedures related to procurement and segregation of duties.

Sixty-nine percent of survey respondents rated FWA risks as moderate or higher. This is an increase from the 2019 Risk Assessment, where 60% of employees rated FWA risk as moderate or higher.

The increase may be due to additional awareness of FWA opportunities and weaknesses in City controls.

EMPLOYEE SURVEY

Overall Risk Rating Moderate

Impact

Likelihood

Preparedness

Trajectory
Moderate-to-High Reasonable Possibility Moderate Flat

Risk Mitigation
● Provide improved onboarding to governance
board members, including Councilmembers and
Commissioners.
● Consider the development of a long-term
strategic plan.
● Clarify the roles and responsibilities of
governance board members, including
Councilmembers and Commissioners.

Survey Rating
Moderate

Residual Risk
Low-to-Moderate

7% 25% 44% 15% 10%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
2022 RISK RATING FOR ETHICS, FRAUD, WASTE, AND ABUSE
Low Low-to-Moderate Moderate Moderate-to-High High
Attachment A

Enterprise Risk Assessment Report | 36

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Risk Areas: Risks associated with ongoing oversight; ethics and values; control environment; policy management; risk management; accountability; performance management; coordination and communication; and defined roles, responsibilities, and authorities.

Scope: Governance is a process of overseeing an organization’s management of risk and control processes and is ultimately the responsibility of an organization’s board of directors. Management is responsible for identifying and managing risks.

Current Risk Condition at City of Stockton
The Council sets annual priorities during a joint Council-City management retreat at the beginning of each fiscal year. Councilmembers report this practice is highly informative and collaborative.

However, the City does not maintain a long-term strategic plan and some Councilmembers are concerned about the stability of goals and priorities year-over-year in a revenue constrained environment. Additionally, Councilmembers expressed a desire for better onboarding and more information on key issues facing the City.

Most survey respondents rated the quality of the strategic direction for the City provided by City Council as average or higher. However, Councilmembers and Commissioners often submit ad hoc requests for additional information, which creates additional work for staff and, depending on the nature of the request, may contribute to tension between Councilmembers and City staff. Increasing clarity on the roles and responsibilities between Councilmembers/Commissioners and staff could improve these relationships and reinforce policy governance. In addition to these internal collaboration efforts, the City should also work with local service provider agencies to support outreach and connection with needed services.

Attachment A

Enterprise Risk Assessment Report | 37

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

EMPLOYEE SURVEY

Overall Risk Rating Moderate

Impact

Likelihood

Preparedness

Trajectory
Moderate Reasonable Possibility Moderate Flat

Risk Mitigation
● Ensure internal controls are incorporated into
ERP implementation.
● Train employees on internal controls and the
importance of proper controls.
● Balance the need for appropriate checks and
balances with efficient operations.

Survey Rating
Moderate

Residual Risk
Low-to-Moderate

Risk Areas: Risks associated with preventive controls (e.g., tone at the top, policies and procedures, passwords), detective controls (e.g., segregation of duties, reconciliations, variance reports), and corrective controls (e.g., changes to policies and procedures, training, and loss of privileges).

Scope: Control activities are the processes and procedures that help ensure that management’s risk responses are carried out; they are not performed simply for their own sake or because it seems to be the “right or proper” thing to do. Control activities occur throughout the organization, at all levels and in all functions. They include a range of activities—as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets, and segregation of duties. Internal controls are designed to provide reasonable assurance about the achievement of an organization’s objectives with regard to the reliability of financial reporting, efficiency and effectiveness of operations, and compliance with applicable laws and regulations.

Current Risk Condition at City of Stockton
Many departments noted that work quality is highly dependent on the employee conducting the work due to the lack of comprehensive policies and procedures and related training. With the implementation of ERP, there have been some improvements in internal controls. However, lack of training and staff expertise in the ERP limits the effectiveness of some internal controls and 4% 15% 51% 20% 10%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE THE QUALITY OF THE STRATEGIC

DIRECTION FOR THE CITY OVERALL PROVIDED BY CITY
COUNCIL?
Excellent Good Average Poor Terrible
Attachment A

Enterprise Risk Assessment Report | 38

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

contributes to staff workarounds to get tasks done. Further exacerbating these additional steps are staffing level constraints. Without sufficient staff to properly process activities in a manual and time- intensive way, there are limitations on the quality of the work and robust checks and balances to review activities.

Some new control procedures have slowed down processes and there are still many hard copy approvals required. For example, staff reports used to take around 3 weeks to prepare and review prior to submission to Council. Additional reviews were added, and this process now takes around 6 to 8 weeks, which can slow operations.

Internal controls over procurement continue to be an area of elevated risk due to decentralization and a lack of standardization across the City. Procurement and the routing of contracts were identified by multiple staff as an area of both confusion and difficulty, in terms of review, authorization, and approvals. Due to cumbersome and time-consuming processes, some employees may try to find workarounds or resort to more manual processes that are not in compliance.

Overall Risk Rating Moderate

Impact

Likelihood

Preparedness

Trajectory
Moderate Unlikely Moderate Flat

Risk Mitigation
● Engage with community members to analyze
threats and opportunities to strengthen the City’s
reputation and identify opportunities to celebrate
City “wins” with the public.
● Develop and implement a reputation
management framework, a supporting
communications plan that incorporates
participation from all departments, and supporting
policies and procedures.

Survey Rating
Moderate

Residual Risk
Low-to-Moderate

Risk Areas: Risks associated with the City’s reputation and the public’s perception of the organization, including its competency (financial performance, safety and security, responsiveness), transparency (openness and integrity) and guardianship (demonstrating care and consideration).

Scope: The reputation of an organization refers to how a broad group of stakeholders perceive the accumulated decisions, actions, and behaviors of the people within an organization. This social judgement is influenced both directly and indirectly by interactions with employees, with programs and services, and by commentary in the public domain (e.g., news stores, press releases, social media).

Current Risk Condition at City of Stockton
The operations of a local government like the City of Stockton are complex, multi-faceted, and impact the lives of residents directly and indirectly every single day. In a society that is connected to the Attachment A

Enterprise Risk Assessment Report | 39

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

instantaneous, 24-hour news cycle across the internet, residents have increasingly high expectations around transparency of decision-making, effective use of financial resources, and instant action or results. Given the City of Stockton’s history with bankruptcy and high crime rates, it will likely continue to be a challenge to overcome the public’s perception of City operations. Additionally, the City’s reputation continues to be hampered by a struggle to find lasting solutions to homelessness.

Employees and elected officials report the need to build trust across the community and to tell the story of successful local government programs and services. Some 58% of employees believe that the City has a negative (poor or terrible) reputation with the community, up from 44% in the 2016 Risk Assessment. No respondents reported that the City has an excellent reputation and only 6% reported that it had a good reputation.

EMPLOYEE SURVEY

The City’s methods of communication have historically been decentralized across various departments, without a proactive, clear, and consistent “voice” of the City. Additionally, the City does not have a marketing or strategic public information program to keep the community informed on City initiatives and respond to media attention. This is especially important since the City lacks a robust local newspaper, and staff and Councilmembers report limited access to the community through traditional media. A public information program could help the City demonstrate its efforts to the community and rebuild trust.

Like many other West Coast cities, homelessness is a significant challenge for Stockton. Currently, the City lacks a designated point person and process to coordinate homelessness solutions. This function spans both the Police Department and Economic Development; however, neither has clear roles or responsibilities to effectively manage homeless populations. Additionally, homelessness is a multi-jurisdictional issue that requires significant collaboration not only within the City, but also with other partners such as the County, State, and non-profit organizations. The City’s reputational impact of increasing homelessness has resulted in a greater local burden to address the issue. 6% 36% 44% 14%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

WHAT KIND OF REPUTATION DOES THE CITY OF STOCKTON
HAVE WITH THE COMMUNITY?
Excellent Good Average Poor Terrible
Attachment A

Enterprise Risk Assessment Report | 40

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Overall Risk Rating Moderate

Impact

Likelihood

Preparedness

Trajectory
Moderate Reasonable Possibility Moderate Increasing

Risk Mitigation
● Balance Public Safety workloads to a
manageable level to reduce ongoing impacts of
workers’ compensation claims.
● Hire an emergency manager to oversee
emergency management planning.

Survey Rating
Moderate

Residual Risk
Low-to-Moderate

Risk Areas: Risks associated with administration of the employee health and safety and operational risk management programs, as well as emergency management and business continuity planning programs.

Scope: Risk programs include administration of the general liability, workers’ compensation, safety, disability management, and property programs. Risk efforts also include contract/insurance certificate review, insurance procurement, emergency preparedness programs, and continuity of operations planning.

Current Risk Condition at City of Stockton
The City established the General liability and Workers’ Compensation funds to create financial stability for the impacts of liability, property damage, and workers’ compensation claims. The City self- insures a portion of its claims, up from $1 million to $1.25, to reduce its costs; excess insurance is used for large claims.

The Fire Departments has realized a significant increase in workers’ compensation and post- traumatic stress injury (PTSI) retirements in the last few years due to staffing shortages and high levels of overtime among staff (see “Public Safety and Security” section). As workloads increase, so does the risk of injuries, which further compounds staffing in public safety departments. Workload increases and COVID-19 have also increased the number and duration of workers’ compensation claims in the Police Department.

Emergency Management
The City has increased its focus on emergency management in response to the COVID-19 pandemic and is currently seeking a dedicated emergency manager to oversee emergency management planning. Currently, this function is not adequately staffed to develop a comprehensive Emergency Operations Plan and ensure adequate education, training, and exercises required to prepare staff for an emergency.

Attachment A

Enterprise Risk Assessment Report | 41

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Approximately 74% of those surveyed reported they have not received emergency properness training in the last year and several employees responded there is little communication about emergency planning.

EMPLOYEE SURVEY

Overall Risk Rating Low-to-Moderate

Impact

Likelihood

Preparedness

Trajectory
Moderate-to-High Reasonable Possibility Significant Flat

Risk Mitigation
● Seek innovative funding solutions to support the
increased prioritization of addressing deferred
maintenance needs and major capital projects.
● Continue efforts to revise the L-RFP to allow for
strategic and fiscally responsible growth.
● Seek continuation of Measure A funding to
support ongoing public safety needs.

Survey Rating
Moderate

Residual Risk
Low-to-Moderate

Risk Areas: Risks associated with revenue sources (rates, fees, grants, and taxes), funding levels, cash management, liquidity, expenditure rates and commitments, debt management, and inter-organizational business.

Scope: The internal, local, regional, and other funding and economics factors that impact the organization’s ability to maintain operations and deliver programs and services. Whether within the City’s realm of influence (or outside of their control), the funding and economic factors impact the City’s long-term fiscal stability as well as its ability to mitigate the negative impacts of extraordinary risk such as earthquakes, fires, floods, and national economic volatility.
7% 74%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HAVE YOU RECEIVED TRAINING IN EMERGENCY

PREPAREDNESS PROVIDED BY THE CITY WITHIN THE LAST
YEAR?
Yes, delivered online No, no training Yes, In person Yes, both online and in-person Attachment A

Enterprise Risk Assessment Report | 42

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Current Risk Condition at City of Stockton
Fiscal sustainability is one of the City’s key strategies to achieving its goals. The state of the City’s various funds continues to improve since its exit from bankruptcy in FY 2014-15 and the City now ranks in the top five most fiscally healthy cities in California, based on debt (or surplus) per capita. As of 2020, the investment research firm Standard & Poor’s rated most of the City’s Enterprise Fund Debt with an A or A- rating, which are upper medium grade ratings. The exception was the City’s Parking Revenue Bonds, which received a lower medium grade rating (BBB-). While the City of Stockton is generally fiscally healthy, some of the City’s funding is at risk of expiring, such as funding from Measure A, which expires in 2024. Measure A provides funding for law enforcement, crime prevention services, and other public safety-related City services.

As part of its fiscal sustainability efforts, the City maintains a comprehensive Long-Range Financial Plan (L-RFP) to help guide and inform financial decisions. The L-RFP is routinely updated based on current revenue and expenditure trends. While the City has largely focused on maintaining service levels post-bankruptcy, the City recently updated assumptions in the L-RFP to plan for strategic growth in future years. According to the City’s proposed FY 2022-23 budget, these changes will allow the City to add one to two new full-time positions on an annual basis and allocate an additional $750,000 annually to maintenance needs.

The City’s Reserve Policy calls for the City to maintain a 17% operating reserve (approximately two months of expenditures) and establish additional reserves for known contingencies, unforeseen revenue changes, infrastructure failures, and catastrophic events. In FY 2021-22, the General Fund is projected to end with an available fund balance of $74.9 million, of which $47.2 million is required to be put into reserves. While the City’s reserve policy is strong, the City’s need for known contingencies is far greater than its available reserve funds. For example, the City estimates its unfunded infrastructure needs are nearly $700 million.

According to the City’s FY 2022-23 proposed budget, General Fund expenditures are projected to generally exceed or be level with General Fund revenues for the next 15 years, except for FY 2022- 23, when expenditures are projected to be higher than revenues due to one-time expenses for capital projects and Council priority projects funded by savings in prior years.

Attachment A

Enterprise Risk Assessment Report | 43

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

FIGURE 2: GENERAL FUND BUDGET FROM LONG RANGE FIN ANCIAL PLAN, UPDATED FY 2022- 23

Overall Risk Rating Low-to-Moderate

Impact

Likelihood

Preparedness

Trajectory
Moderate Unlikely Significant Decreasing

Risk Mitigation
● Continue to evaluate opportunities to leverage
performance data to increase efficiency and
effectiveness in operations.
● Conduct a regular resident engagement survey to
inform improvements to services as the
community grows.
● Evaluate the capacity of departments, including
EDD, to effectively serve the community.

Survey Rating
Moderate

Residual Risk
Low-to-Moderate

Risk Areas: Risks associated with community expectations, level of service commitments, scheduling, program/service delivery, sustainability, quality, process efficiencies, and resource allocation.

Scope: Day-to-day operations across the organization and efficient and effective delivery of the City’s programs and services in alignment with goals, vision, and mission.

Attachment A

Enterprise Risk Assessment Report | 44

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

Current Risk Condition at City of Stockton
The City of Stockton covers approximately 64.75 square miles and is the 13th most populous city in California. According to the US Census Bureau, an estimated 322,120 residents resided in the City as of July 2021, an increase of approximately 10% since 2010. The City provides a full range of services to residents, including:
• Emergency services
• Police
• Animal control
• Fire suppression and
rescue
• Fire prevention
• Water distribution
• Wastewater treatment
• Stormwater collection
• Road construction and
maintenance
• Solid waste and recycling
• Park, tree, and streets
maintenance
• Development planning
• Library services
• Recreation services
• Golf courses
• Business attraction and
retention
• Commercial loan programs
• Parking
• Affordable housing
• Venue management,
including marina and
ballpark
The City has established performance measures related to key areas of service delivery. In May 2020, the City of Stockton established the Office of Performance and Data Analytics (ODPA).

According to the City’s FY 2021-22 budget, ODPA is responsible for establishing and implementing a comprehensive performance management program for the City of Stockton that includes:
• A performance scorecard tied to the City’s One Page Strategic Plan • A StocktonStat program to drive cross-departmental performance management • An Innovation Lab focused on streamlining municipal processes • An open data portal featuring datasets and dashboards Management reported the City’s increased focus on data and the implementation of the City’s open data portal has helped the City better identify what’s working and what’s not working to improve processes. These efforts will help the City continue to improve its operations and service delivery moving forward.

The COVID-19 pandemic has significantly impacted City operations over the last several years. The City adjusted services to comply with regional stay-at-home orders and support the health and safety of residents. Additionally, EDD significantly shifted operations to focus on distributing aid to the community during the pandemic. The City of Stockton received $27 million of Coronavirus Relief Funds (CRF). With these funds, the City supported small businesses, provided millions in dollars to families for rental and mortgage assistance, and strengthened support for homelessness initiatives.

Additionally, the City distributed personal protective equipment (PPE) and provided other support to the community.

As the pandemic slows, EDD has been able to shift some of its focus back to economic development.

However, EDD has also largely focused on housing and homelessness efforts, which affects its ability to effectively focus on economic development needs in the City. It’s important EDD has the capacity to focus on economic development needs in the City to encourage job creation and business Attachment A

Enterprise Risk Assessment Report | 45

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

retention and expansion, both of which support an improved economy due to increased tax revenue for the community and improved quality of life for residents.

With the economy recovering, the City experienced substantial development growth in 2021. The Community Development Department (CDD) issued approximately 2,700 more permits in 2021 than in 2020. Alongside this growth, CDD has become more efficient and reduced the amount of time it takes to process a permit. Still, the effectiveness of development and permitting processes are challenged by changes in the development market, such as changes in cannabis legislation.

Development and permitting processes are also reliant on other departments, which can cause challenges if other departments are untimely or if coordination is ineffective. The City has been working to improve communication and coordination between departments to improve service delivery.

Overall Risk Rating Low-to-Moderate

Impact

Likelihood

Preparedness

Trajectory
Moderate Unlikely Significant Decreasing

Risk Mitigation
● Continue to strengthen and evolve strategic
planning and performance monitoring efforts.
● Align Citywide planning and provide feedback
opportunities to employees and community
members.

Survey Rating
Moderate

Residual Risk
Low-to-Moderate

Risk Areas: Risks associated with how the organization plans for operations, strategy, and the future, including both short-term and long-range planning.

Scope: A comprehensive planning framework builds upon the strategic goals and dives into the next layer of planning, which looks at the strategic objectives for not only the enterprise, but sets objectives for the departments, divisions, programs, and individual roles.

Current Risk Condition at City of Stockton
The City conducts annual planning efforts that include establishing tiered goals and an associated work plan. Goals are limited to an annual basis and therefore lack long-term outcome focus. The City’s short-term focus continues to be on crime, homelessness, education, and short-term economic development efforts.

In FY 2020-21, the City’s annual goals included:

Tier 1
Attachment A

Enterprise Risk Assessment Report | 46

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

1. Develop solutions to address homelessness, including increasing the affordable housing supply

2. Focus on crime reduction in focus areas

3. Prioritize resource allocation to focus areas within Council Districts

4. Develop the core downtown
Tier 2

1. Develop business incentives and tools for underserved neighborhoods

2. Work with education partners to improve quality of life, increase literacy, fund college scholarships, and develop the workforce

3. Engage private employers and the business community in workforce development and job placement (including people with criminal records) and develop an employment pipeline for Stockton residents to City of Stockton employers
These goals are also tied to the City’s newly formed performance measures to enable improved monitoring and evaluation of initiatives.

The City completed the Envision Stockton 2040 General Plan in 2018 that outlines goals and policies related to the City’s land use in the coming decades. Several key topics in this plan include land use, transportation, safety, community health, and housing along with applicable policies and action items to guide the City in making decisions about each of the above topics. The City is now in a place financially to focus on long-term strategic planning with a focus on growth.

Only 33% of survey respondents rated the quality of the City’s strategic planning activities as excellent or good. Most employees reported the reason for low rating is due to a lack of involvement in planning. More than half (68%) of survey respondents believe that the City involves key stakeholders either slightly well or not well at all. Employees reported that they are rarely involved in planning or decision-making. As the City’s greatest asset, involving employees in decision-making supports employee investment and dedication to a project or goal.

Attachment A

Enterprise Risk Assessment Report | 47

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

EMPLOYEE SURVEY

Some employees report that Citywide organizational planning is not cohesive throughout the organization. This weakens planning efforts, since it does not give staff the opportunity to dialogue, collaborate, and plan for upcoming changes. Some departments report that staff receive little communication from management about updates to planning or strategy. When decisions are made and employees must carry out the tasks associated with new plans, employees may have little time to dedicate to new tasks, may have competing priorities, or may need to update policies and procedures, which can lead to rushed projects and employee burnout. Adequate staffing has a major impact on planning and strategy.
4% 29% 41% 18% 8%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WOULD YOU RATE THE QUALITY OF THE CITY'S
STRATEGIC PLANNING ACTIVITIES?
Excellent Good Average Poor Terrible
2% 8% 33% 32% 36%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

HOW WELL DOES THE CITY SOLICIT INPUT FROM ALL
IMPACTED STAKEHOLDERS DURING PLANNING ACTIVITIES?
Extremely well Very well Moderately well Slightly well Not well at all Attachment A

Enterprise Risk Assessment Report | 48

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

APPENDIX: SURVEY RESULTS1

RESPONENT TENURE WITH

THE CITY OF STOCKTON

SURVEY PARTICIPATION BY DEPARTMENT

1 Data in this section is reported as a% of total responses; the values may not total to 100% due to rounding. 11% 10% 21% 21% 9% 29%
<1 year 1-2 years 3-5 years 6-10 years 11-15 years >15 years 4%
2%
1%
7%
3%
14%
3%
3%
4%
7%
16%
1%
25%
9%
Administrative Services
City Attorney
City Clerk
City Manager
Community Development
Community Services
Economic Development
Fire
Human Resources
Information Technology
Municipal Utilities
Office of the Mayor
Police
Public Works
Attachment A

Enterprise Risk Assessment Report | 49

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

AVERAGE EMPLOYEE SURVEY RISK RATINGS

Answer Scoring Values
1 Low
2 Low- to- Moderate
3 Moderate
4 Moderate- to- High
5 High

ACCOUNTING & FINANC E

2.9 2.6

2.9 2.9

3.0 3.4

3.0 3.2

3.5 2.7

3.0 3.3

3.1 3.7

3.0 2.9

3.3 3.5

3.3 3.1
Accounting and Finance
Asset Management Tracking
Capital Improvement Program
Compliance
Ethics, Fraud, Waste, and Abuse
External Environment
Funding and Economics
Governance
Human Capital and Resources
Information Technology
Internal Controls
Management and Leadership
Operations and Service Delivery
Organization and Staffing
Planning and Strategy
Policies, Procedures, and Processes
Procurement and Contracting
Public Safety and Security
Reputation and Public Perception
Risk Programs
6% 29% 42% 13% 10%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
Attachment A

Enterprise Risk Assessment Report | 50

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

ASSET MANAGEMENT

TRACKING

CAPITAL IMPROVMEENT

PROGRAM

COMPLIANCE

11% 32% 44% 5% 7%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
27% 40% 13% 11%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
3% 24% 54% 13% 6%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
Attachment A

Enterprise Risk Assessment Report | 51

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

EXTERNAL ENVIRONMENT

FUNDING & ECONOMICS

ETHICS, FRAUD, WASTE &
ABUSE

2% 13% 41% 29% 15%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
6% 27% 44% 12% 12%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
7% 25% 44% 15% 10%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
Attachment A

Enterprise Risk Assessment Report | 52

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

GOVERNANCE

HUMAN CAPITAL &

RESOURCES

INFORMATION TE CHNOLOGY

2% 19% 49% 15% 15%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
4% 14% 36% 22% 24%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
9% 36% 38% 8% 9%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
Attachment A

Enterprise Risk Assessment Report | 53

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

INTERNAL CONTROLS

MANAGEMENT & LEADERSHIP

OPERATIONS & SERVICE

DELIVERY

7% 23% 45% 13% 13%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
4% 21% 41% 17% 18%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
6% 26% 41% 12% 16%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
Attachment A

Enterprise Risk Assessment Report | 54

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

ORGANIZATION & STAFFING

PLANNING & STRATEGY

POLICIES , PROCEDURES &

PROCESSES

2% 11% 31% 28% 28%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
5% 27% 38% 18% 12%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
12% 22% 40% 16% 11%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
Attachment A

Enterprise Risk Assessment Report | 55

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

PROCUREMENT &

CONTRACTING

PUBLIC SAFETY
& SECURITY

REPUTATION & PUBLIC

PERCEPTION

6% 15% 39% 24% 17%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
3% 17% 31% 25% 24%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
5% 16% 42% 19% 17%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
Attachment A

Enterprise Risk Assessment Report | 56

FOR INTERNAL USE OF THE CITY OF STOCKTON ONLY

RISK PROGRAMS

5% 25% 41% 16% 12%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Low Low-to-Moderate Moderate Moderate-to-High High
Attachment A

Attachment A