City of Stockton
Enterprise Risk Assessment
City Council Meeting
November 1, 2022
Agenda Item 15.1
Overview
I. Introduction
II. Risk Assessment Process
III. Risk Assessment Results
2 Introduction
3 As the City’s chartered internal auditor, Moss Adams
conducted its triennial enterprise risk assessment.
The Enterprise Risk Assessment (ERA) was conducted
between March 2022 and July 2022 and focused on
assessing at a high level the current state of the City’s:
• Risk conditions
• Internal controls
• Operational efficiency and effectiveness
• Policies and procedures
• Compliance
City of Stockton Enterprise Risk Assessment
The process to identify and assess risks considers both internal and external factors.
As part of this risk assessment, Moss Adams used a variety of techniques, both qualitative and quantitative, to identify external and internal factors that contribute to risk. Risk assessments involve a dynamic and iterative process to identify and analyze risks to the City’s ability to achieve its objectives, forming a basis for determining how risks should be managed.
We leveraged best practices to identify opportunities for improvement and provide recommendations. Moss Adams performed this work under AICPA consultancy standards
.
Introduction
City of Stockton Enterprise Risk Assessment4
Project
Methodology
5 City of Stockton Enterprise Risk Assessment
Assessment
Framework
For each of the risk categories
assessed, our assessment
includes an overview of each
risk condition, including the
current risk level, likelihood,
impact, preparedness, and
trajectory.
6 City of Stockton Enterprise Risk Assessment
Risk Trends
7 In general, municipalities have faced increasing levels of risk due to external factors over the last two years. • COVID-19 pandemic
• Public safety
• Supply chain issues
• Labor shortages
• Inflation
City of Stockton Enterprise Risk Assessment
Risk
Assessment
Results
8 RISK CATEGORY OVERALL RISK LEVEL
Human Capital and Resources High
Information Technology High
Organization and Staffing High
Procurement and Contracting High
Public Safety and Security High
Capital Improvement Program Moderate to High
External Environment Moderate to High
Management and Leadership Moderate to High
Policies, Procedures, and Processes Moderate to High
Accounting and Finance Moderate
Asset Management Tracking Moderate
Compliance Moderate
Ethics, Fraud, Waste, and Abuse Moderate
Governance Moderate
Internal Controls Moderate
Reputation and Public Perception Moderate
Risk Programs Moderate
Funding and Economics Low to Moderate
Operations and Service Delivery Low to Moderate
Planning and Strategy Low to Moderate
City of Stockton Enterprise Risk Assessment
• Ongoing efforts to automate and modernize processes with ERP im
plementation
• Strong financial position
• Implementation of the Office of Performance and Data Analytics Effective Practices
9 City of Stockton Enterprise Risk Assessment
High Risk Categories
10 City of Stockton Enterprise Risk Assessment
Impact Likelihood Preparedness Trajectory
Human Capital and Resources HIGH LI K E LY LIMITED INCREASING Information Technology HIGH LI K E LY LIMITED INCREASING Organization and Staffing HIGH ALMOST CERTAIN LIMITED INCREASING Procurement and Contracting HIGH LI K E LY LIMITED INCREASING Public Safety and Security HIGH LI K E LY LIMITED INCREASING Moderate-to-High Risk Categories
11 City of Stockton Enterprise Risk Assessment
Impact Likelihood Preparedness Trajectory
Capital Improvement Program MODERATE TO HIGH
REASONABLE
POSSIBILITY
MODERATE FLAT
External Environment MODERATE TO HIGH
REASONABLE
POSSIBILITY
MODERATE INCREASING
Management and Leadership HIGH LI K E LY MODERATE INCREASING Policies, Procedures, and Processes MODERATE TO HIGH
REASONABLE
POSSIBILITY
SIGNIFICANT FLAT
Questions?
12 City of Stockton Enterprise Risk Assessment
The material appearing in this presentation is for informational purposes only and should not be construed as advice of any kind, including, without limitation, legal, accounting, or investment advice. This information is not intended to create, and receipt does not constitute, a legal relationship, including, but not limited to, an accountant-client relationship. Although this information may have been prepared by professionals, it should not be used as a substitute for professional services. If legal, accounting, investment, or other professional advice is required, the services of a professional should be sought.
Assurance, tax, and consulting offered through Moss Adams LLP. Investment advisory offered through Moss Adams Wealth Advisors LLC. 13 City of Stockton Enterprise Risk Assessment