Loading...
HomeMy WebLinkAboutStaff Report 12022 City of Palo Alto (ID # 12022) City Council Staff Report Report Type: Action Items Meeting Date: 3/1/2021 City of Palo Alto Page 1 Summary Title: Approval of the FY21 Audit Plan and Related Reports Title: Policy and Services Committee Recommends the City Council Accept the City Auditor’s Risk Assessment Report, Annual Audit Plan, and Quarterly Status Report From: City Manager Lead Department: City Auditor Recommendation The City Auditor recommends that the City Council take the following actions: • Accept the Fiscal Year 2021 Risk Assessment Report and Recommend City Council Approval, as presented to the Policy and Services Committee meeting on February 9, 2021 • Accept the Fiscal Year 2021 Audit Plan Report and Recommend City Council Approval, as presented to the Policy and Services committee on February 9, 2021 and modified to include the Public Safety Building Construction audit activity (Attachment A) • Approve the following Task Orders, identified in the Audit Plan Report: o Construction Project Controls o Public Safety Building Construction o Asset Capitalization o Assessment of SAP Functionality and Internal Controls o IT Risk Management o Investment Management o Power Purchase Agreements o Economic Recovery Advisory • Accept the City Auditor’s Office Quarterly Status Report covering October – December 2020, as presented to the Policy and Services Committee meeting on February 9, 2021 Background In its capacity serving as the City Auditor function, and in accordance with Baker Tilly’s agreement with the City (Task #2 of the agreement), Baker Tilly performed a citywide risk assessment. The purpose of the assessment was to identify and prioritize risks in order to develop the annual audit plan (Task #1). During the risk assessment, Baker Tilly assessed a wide City of Palo Alto Page 2 range of risk areas, including strategic, financial, operational, compliance, technological, and reputation risks. The risk matrix is included as an appendix to the report. Baker Tilly provided a presentation to the Policy & Services Committee on February 9, 2021. The City Auditor is asking that the City Council approve the Risk Assessment Report. The Palo Alto Municipal Code (Section 2.08.130) requires the City Auditor prepare and submit an annual audit plan to the City Council for review and approval. The audit plan is normally submitted to the City Council at the beginning of the fiscal year. Given the timing of onboarding Baker Tilly to serve as the City Audit Function, the risk assessment and audit planning process spanned October 2020 through January 2021, the middle of fiscal year 2021. As a result, Baker Tilly has sought to identify audit activities across an 18-month horizon (through FY22). Baker Tilly presented the audit plan to the Policy and Services Committee and is now recommending that the City Council approve the Audit Plan Report (Attachment A). Approval will prompt finalization of the corresponding Task Orders by Baker Tilly and the City. Lastly, Baker Tilly presented a quarterly status report to the Policy & Services Committee on a variety of topics during the February 9, 2021 meeting. The City Auditor is recommending that the City Council accept the Quarterly Status Report. Respectfully submitted, Kyle O’Rourke City Auditor and Senior Manager, Baker Tilly Attachments: • Attachment A: City Auditor's Office - FY21 Audit Plan (FINAL DRAFT) Attachments: • City Auditor's Office - FY21 Audit Plan (FINAL DRAFT) City of Palo Alto City Auditor’s Office FY21/22 Annual Audit Plan January 15, 2021 FY2021/2022 Audit Plan 2 Overview Introduction The purpose of the City Audit function is “to ensure that city management is using its financial, physical, and informational resources effectively, efficiently, economically, ethically, and equitably, and in compliance with laws, regulations, contract and grant requirements, and city policies and procedures” (City of Palo Alto Contract No, C21179340). The Palo Alto Municipal Code (Section 2.08.130) requires the City Auditor prepare and submit an annual audit plan to the City Council for review and approval. The audit plan is normally submitted to the City Council at the beginning of the fiscal year. Given the timing of onboarding Baker Tilly to serve as the City Audit Function, the risk assessment and audit planning process spanned October 2020 through January 2021, the middle of Fiscal Year 2021. As a result, Baker Tilly has sought to identify audit activities across an 18-month horizon (through FY22). Note that Baker Tilly will seek approval of contract task orders iteratively during that timeframe in order to remain agile and accommodate changes to the plan as time passes. Note that this report address Task #2 of the Baker Tilly agreement. Other activities are addressed in separate Task Orders corresponding to the tasks in the Baker Tilly agreement. For example, the City Auditor performs follow up on audit findings and recommendations, as outlined in Task #5. Conformance with Local Ordinances and Standards According to City Ordinance, the mission of City Auditor’s Office is to “promote honest, efficient, effective, economical, and fully accountable and transparent city government. To fulfill this mission, the office of the city auditor conducts performance audits and performs nonaudit services of any city department, program, service, or activity as approved by the city council. (Section 2.08.130). Palo Alto City Charter Article IV Sec. 12 requires the City Auditor to: – Conduct audits in accordance with a schedule approved by the City Council and may conduct unscheduled audits from time to time – Conducts audits of financial transactions of the City Palo Alto Municipal Code Section 2.08.130 requires the City Auditor to: – Prepare an annual audit plan for city council approval – Identify the preliminary objectives of each audit to be performed, reflecting the purpose of the engagement and a preliminary description of the areas that may be addressed FY2021/2022 Audit Plan 3 Audit Activity Types The Office of the City Auditor will conduct performance audits and perform financial/operational analyses of any City department, program, service, or activity as approved by the City Council (City of Palo Alto Contract No, C21179340). Performance Audits According to the Government Auditing Standards (GAO-18-568G, Section 1.21 and 1.22, page 10-12), performance audits provide objective analysis, findings, and conclusions to assist management and those charged with governance and oversight with, among other things, improving program performance and operations, reducing costs, facilitating decision making by parties responsible for overseeing or initiating corrective action, and contributing to public accountability. Performance audits may include the following four (4) audit objectives. – Program effectiveness and results – Internal control design and effectiveness – Compliance with laws, regulations, and policies – Prospective analysis Audit Planning Considerations While maintaining its independence and objectivity in accordance with standards, The City Auditor considers a variety of matters when developing the Annual Audit Plan, including but not limited to: – Risk assessment – Baker Tilly performed a risk assessment and summarized the results in a separate report (Task #2). Generally speaking, audit activities target high(er) risk areas. Note that Key Risks are outlined on the following page. – Ability to add value – audit seeks to add value through independent and objective analysis. – City Council – the City Auditor reports to the City Council and seeks input on audit priorities. – Coverage and Prior Audits – the City Auditor considers prior audits conducted by the City Auditor’s Office, the financial audit, and other audit and consulting reports recently issued. – “Ripeness” and On-Going Initiatives – certain risk areas may be addressed through operational activities, which could mean they are not be ripe for audit to add value. – Scheduling – the City Auditor takes into consideration the timing of an audit and other on-going initiatives that directly relate. Putting an undue burden on City staff may exacerbate the risk at hand or other interrelated risks. FY2021/2022 Audit Plan 4 Key Risks Baker Tilly performed a citywide risk assessment to plan for FY21 and FY22 audit activities and documented the detailed results in a separate Risk Assessment Report. In summary, we identified the following key risks for each function: Function Key Risks Function Key Risks Administrative Services  Tax Revenue & Economic Recovery  Asset Management  Investment Management Information Technology  Cyber Security  Database/Data Management  Disaster Preparedness and Recovery City Clerk’s Office  Public Records Requests  Records Management Library Department  Inventory Management  Recourse Demand  Events and Programming Communication’s Office  External Affairs  Social Media Management  Internal Communications Planning Department  Long Term Planning  Code Enforcement Community Services Department  Contract Monitoring  Background Check Procedures Police Department  Employee/Officer Overtime  Officer Conduct and Use of Force Policies  Recruitment and retention Emergency Services Department  Disaster Response Public Works  Construction Project Management  Facilities Management  Fleet Management  Water Quality Control Fire Department  Recruitment and Retention  Compliance with SB 201 Office of Transportation  Contract Management  Safety Improvement Projects  Traffic Operations Human Resources Department  High Cost Claims  Records Management  Workforce and Succession Planning Utilities Department  Workforce and Succession Planning  Contract Management of Purchased Power  Capital Program Management  Work Order and Asset Management Refer to the Risk Assessment Report for more information about the risk assessment methodology and results of the risk assessment. FY2021/2022 Audit Plan 5 Proposed Audit Activities for FY2021-2022 Included in the tables below are the proposed audit activities for the remainder of FY2021 and FY2022. Each audit activity corresponds to a risk rated as High or Moderate in the Risk Assessment Report and selected based on other factors outlined on page 3. The preliminary audit objectives are described for each audit listed. These objectives and scope of each audit activity will be further defined based on the result of a project planning risk assessment processes performed at the beginning of each activity. Audits are planned in three overall phases – note that the timing may differ slightly for each audit activity: – Phase I – Activities projected to start in March 2021 and end by June 2021 – Phase II – Activities projected to start in May 2021 and end by December 2021 – Phase III – Activities projected to start in January 2022 and end by June 2022 Amendments to the proposed audit plan will be proposed either as needed or after conducting a follow up risk assessment and update the audit plan, as needed, at the on-set of FY22. Amendments may be proposed in response to changes in the City’s environment such as organizational structure, operations, risks, systems, and controls. Please note that the City Auditor will actively manage project and overall budgets and workload in its execution of the workplan. For each audit activity, a task order is submitted to the City Council for approval before the work is commenced. We have prepared and attached to this report multiple task orders that correspond to audit activities we have prioritized (e.g., those in Phase I). Those audit activities for are marked with an “X” in the ‘Seeking Approval’ column of the table below, and the Task Orders are included in the Appendix. FY2021/2022 Audit Plan 6 Phase I Activities Seeking Approval Function Project Title Audit Objectives Timeline Estimated Hours FY21 Cost FY22 Cost Total Cost X Public Works Construction Project Controls Assessment  Identify key processes and controls in the construction project management program.  Assess the control environment and make recommendations for improvement. March – June 310 $61,400 $61,400 X Administrative Services Asset Capitalization Audit  Evaluate process of capturing construction work in progress.  Document and evaluate key processes and controls related to categorizing and recording capital project costs.  Assess compliance with financial policies and relevant accounting standards. March – June 180 $38,600 $38,600 X Information Technology Assessment of SAP Functionality and Internal Controls (FY21)  Participate as an advisor to the project steering committee for Phase 2 of the ERP system upgrade.  Evaluate internal control design as system configuration is analyzed. March – June 100 $23,050 $23,050 X Information Technology IT Risk Management Assessment  Identify key risks and controls within the IT function – including IT governance and IT security.  Evaluate the adequacy of the control environment and offer recommendations for improvement. March – June 350 $61,550 $61,550 X Administrative Services Investment Management Review  Determine whether adequate controls are in place and operating effectively to ensure that investments are managed in accordance with the investment management and other relevant policies.  Assess the organizational structure and operations of the investment portfolio management function against best practice. TBD 400 $82,500 $82,500 X Utilities Power Purchase Agreement Review  Evaluate the process for evaluating and entering into power purchase agreements.  Assess the effectiveness of internal controls in the management of the power purchase agreements and accuracy and compliance of billings. TBD 375 $74,875 $74,875 TBD Ad Hoc Requests TBD TBD TBD $14,640 $14,640 Phase I Sub Total 1,715 $356,615 $356,615 FY2021/2022 Audit Plan 7 Phase II Activities Seeking Approval Function Project Title Audit Objectives (preliminary objectives for audits not currently subject to approval) Timeline Estimated Hours FY21 Cost FY22 Cost Total Cost X Administrative Services Economic Recovery Advisory  Review the City’s long-term financial planning model and offer recommendations for improvement.  Identify and evaluate key revenue source categories that present long term risk to the City's financial sustainability and perform scenario analysis.  Offer ad hoc advisory assistance during the FY22 budget process. March - December 400 $8,462 $76,153 $84,615 Planning Building Permit & Inspection Process Review  Identify highest impact area to focus the assessment (e.g., specific permit type(s), specific sub-processes, etc.).  Document corresponding process(es) and evaluate for efficiency and effectiveness.  Benchmark operational performance against industry practices and established standards. May – September 360 $12,548 $71,102 $83,650 Citywide Nonprofit Agreements Risk Management Review  Evaluate controls in place to ensure that nonprofit organizations are properly vetted prior to selection and monitored through the life of an agreement.  Assess the performance monitoring process against the best practice.  Follow up on relevant audit findings from past audit work. May – September 400 $12,375 $70,125 $82,500 Phase II Sub Total 1,160 $33,385 $217,380 $250,765 FY2021/2022 Audit Plan 8 Phase III Activities Seeking Approval Function Project Title Preliminary Audit Objectives Timeline Estimated Hours FY21 Cost FY22 Cost Total Cost Information Technology Assessment of SAP Functionality and Internal Controls (FY22)  Participate as an advisor to the project steering committee for Phase 2 of the ERP system upgrade.  Evaluate internal control design as system configuration is analyzed. June – April 200 $45,900 $45,900 Information Technology Application Lifecycle Management Audit  Determine whether adequate controls are in place and working effectively to ensure that application systems are properly implemented and maintained.  Assess the maturity level of application management against the IT framework and standards. December – April 340 $65,950 $65,950 Public Works Wastewater Treatment Plant Agreement Audit  Evaluate whether direct and indirect costs incurred by the City are properly allocated to the operation of the Wastewater Treatment Plant.  Review whether costs are properly allocated to the various parties to the Wastewater Treatment Plant Agreement. December – April 400 $82,500 $82,500 Utilities Work Order Process and Accounting Review  Perform an initial assessment to identify high risk subprocesses in the work order process (e.g., labor, materials, specific utility).  Document and evaluate the processes and controls in place to ensure proper recording of costs.  Perform tests to determine the accuracy of attributed costs for a sample of completed work orders. June – December 400 $84,900 $84,900 Construction Audit – Public Safety Building Public Works TBD TBD TBD $82,500 $82,500 TBD TBD / Ad Hoc Requests TBD TBD TBD $20,870 $20.870 Phase III Sub Total 2,100 $382,620 $382,620 FY2021/2022 Audit Plan 9 City Auditor – Budget Overview The following is a reconciliation between the audit plan above and the City Audit budget. Note that the annual budgets agree to the annual budget in the Baker Tilly agreement (Task #4). Budget Item Amount FY21 Cost $390,000.00 FY22 Cost $600,000.00 Total Cost $990,000.00 Total Budget - Task 4 $990,000.00 Net $ - FY2021/2022 Audit Plan 10 Appendix: Task Orders *Note that certain items are subject to change pending Council discussion and approval. 11 Audit Activity 4.1 – Construction Project Controls Assessment PROFESSIONAL SERVICES TASK ORDER TASK ORDER FY21-004.1 Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below. CONTRACT NO. OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE) 1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): 1B. TASK O RDER NO.: FY21-004.1 2. CONSULTANT NAME: Baker Tilly US, LLP 3. PERIOD OF PERFORMANCE: START: March 1, 2021 COMPLETION: June 30, 2021 4 TOTAL TASK ORDER PRICE: $61,400 BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT $TBD 5. BUDGET CODE_______________ COST CENTER________________ COST ELEMENT______________ WBS/CIP__________ PHASE__________ 6. CITY PROJECT MANAGER’S NAME & DEPARTMENT: Lydia Kou, Chair of the City Council’s Policy and Services Committee 7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A) MUST INCLUDE:  SERVICES AND DELIVERABLES TO BE PROVIDED  SCHEDULE OF PERFORMANCE  MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable)  REIMBURSABLE EXPENSES, if any (with “not to exceed” amount) 8. ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A I hereby authorize the performance of the work described in this Task Order. APPROVED: CITY OF PALO ALTO BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ I hereby acknowledge receipt and acceptance of this Task Order and warrant that I have authority to sign on behalf of Consultant. APPROVED: COMPANY NAME: ______________________ BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ 12 Attachment A DESCRIPTION OF SCOPE OF SERVICES Introduction Attachment A, the Description of Scope of Services, contains the following four (4) elements:  Services and Deliverables To Be Provided  Schedule of Performance  Maximum Compensation Amount and Rate Schedule (As Applicable)  Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables Baker Tilly’s approach to conducting the Construction Controls Assessment involves four (3) primary steps:  Step 1: Audit Planning  Step 2: Control review and analysis  Step 3: Reporting Step 1 – Audit Planning This step consists of the tasks performed to adequately plan the work necessary to address the overall audit objective and to solidify mutual understanding of the audit scope, objectives, audit process, and timing between stakeholders and auditors. Tasks include:  Gather information to understand the environment under review o Understand the organizational structure and objectives o Review the City code, regulations, and other standards and expectations o Review prior audit results, as applicable o Review additional documentation and conduct interviews as necessary  Assess the audit risk  Write an audit planning memo and audit program o Refine audit objectives and scope o Identify the audit procedures to be performed and the evidence to be obtained and examined  Announce the initiation of the audit and conduct kick-off meeting with key stakeholders o Discuss audit objectives, scope, audit process, timing, resources, and expectations o Discuss documentation and interview requests for the audit 13 Step 2 – Controls review and analysis During this step we will assess the adequacy of the City’s controls and whether documented controls have been implemented and are functioned as intended. We will focus on the following areas:  Construction contracts  Prime contractor bid and award  Contract administration  Schedule management  Communication and document control  Contractor billing review and approval  Change management  Allowance and contingency management  Verification of completed work  Project closeout activities Step 3 – Reporting In Step 3, the project team will perform tasks necessary to finalize audit working papers, prepare and review a draft report with the stakeholders, and submit a final audit report. Tasks include:  Develop findings, conclusions, and recommendations based on the supporting evidence gathered  Validate findings with the appropriate individuals and discuss the root cause of the identified findings  Complete supervisory review of working papers and a draft audit report  Distribute a draft audit report and conduct a closing meeting with key stakeholders o Discuss the audit results, finings, conclusions, and recommendations o Discuss management responses  Obtain written management responses and finalize a report  Review report with members of City Council and/or the appropriate Council Committee  Present the final report to the City Council and/or appropriate Council Committee Deliverables: The following deliverable will be prepared as part of this engagement:  Project controls assessment which will include the construction contract risk/opportunity register Schedule of Performance Anticipated Start Date: March 1, 2021 Anticipated End Date: June 30, 2021 14 Maximum Compensation Amount and Rate Schedule The not-to-exceed maximum for this Task is $61,400. The not-to-exceed budget is based on an estimate of 310 total project hours, of which 10 are estimated to be completed by the City Auditor. Reimbursable Expenses We plan to complete all work remote including all interviews and documentation review. If at any point the City and Baker Tilly mutually determine it will be beneficial to perform a portion of the work on-site, we will submit an estimate of our reimbursable expenses for the City’s approval prior to traveling to Palo Alto. 15 Audit Activity 4.2 – Asset Capitalization Audit PROFESSIONAL SERVICES TASK ORDER TASK ORDER FY21-004.2 Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below. CONTRACT NO. OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE) 1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): 1B. TASK O RDER NO.: FY21-004.2 2. CONSULTANT NAME: Baker Tilly US, LLP 3. PERIOD OF PERFORMANCE: START: March 1, 2021 COMPLETION: June 30, 2021 4 TOTAL TASK ORDER PRICE: $38,600 BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT $TBD 5. BUDGET CODE_______________ COST CENTER________________ COST ELEMENT______________ WBS/CIP__________ PHASE__________ 6. CITY PROJECT MANAGER’S NAME & DEPARTMENT: Lydia Kou, Chair of the City Council’s Policy and Services Committee 7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A) MUST INCLUDE:  SERVICES AND DELIVERABLES TO BE PROVIDED  SCHEDULE OF PERFORMANCE  MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable)  REIMBURSABLE EXPENSES, if any (with “not to exceed” amount) 8. ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A I hereby authorize the performance of the work described in this Task Order. APPROVED: CITY OF PALO ALTO BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ I hereby acknowledge receipt and acceptance of this Task Order and warrant that I have authority to sign on behalf of Consultant. APPROVED: COMPANY NAME: ______________________ BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ 16 Attachment A DESCRIPTION OF SCOPE OF SERVICES Introduction Attachment A, the Description of Scope of Services, contains the following four (4) elements:  Services and Deliverables To Be Provided  Schedule of Performance  Maximum Compensation Amount and Rate Schedule (As Applicable)  Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables Baker Tilly’s approach to conducting a limited scope audit of asset capitalization involves three (3) primary steps:  Step 1: Audit Planning  Step 2: Control Review and Testing  Step 3: Reporting Step 1 – Audit Planning This step consists of the tasks performed to adequately plan the work necessary to address the overall audit objective and to solidify mutual understanding of the audit scope, objectives, audit process, and timing between stakeholders and auditors. Tasks include:  Gather information to understand the environment under review o Understand the organizational structure and objectives o Review the City code, regulations, and other standards and expectations o Review prior audit results, as applicable o Review additional documentation and conduct interviews as necessary  Assess the audit risk  Write an audit planning memo and audit program o Refine audit objectives and scope o Identify the audit procedures to be performed and the evidence to be obtained and examined  Announce the initiation of the audit and conduct kick-off meeting with key stakeholders o Discuss audit objectives, scope, audit process, timing, resources, and expectations o Discuss documentation and interview requests for the audit 17 Step 2 – Control Review and Testing This step involves executing the procedures in the audit program to gather information, interview individuals, and analyze the data and information to obtain sufficient evidence to address the audit objectives. The preliminary audit objective is to: (1) Evaluate process to capture construction work in progress, expensing or capitalizing items in accordance with accounting standards; (2) Determine whether adequate controls are in place and working effectively to ensure that assets are properly categorized and recorded in accordance with the accounting policy; (3) Assess the design of the internal controls against the best practice. Procedures include:  Interview the appropriate individuals to understand the process, the information system used, and the internal controls related to asset capitalization  Review policies and procedures as well as the regulations and standards to identify the criteria to be used for evaluation of control design and effectiveness  Perform test procedures including observation of controls (such as application controls) and review of selected documents (such as supporting documents for the recorded transactions)  Compare the process and controls against the best practices Step 3 – Reporting In Step 3, the project team will perform tasks necessary to finalize audit working papers, prepare and review a draft report with the stakeholders, and submit a final audit report. Tasks include:  Develop findings, conclusions, and recommendations based on the supporting evidence gathered  Validate findings with the appropriate individuals and discuss the root cause of the identified findings  Complete supervisory review of working papers and a draft audit report  Distribute a draft audit report and conduct a closing meeting with key stakeholders o Discuss the audit results, finings, conclusions, and recommendations o Discuss management responses  Obtain written management responses and finalize a report  Review report with members of City Council and/or the appropriate Council Committee  Present the final report to the City Council and/or appropriate Council Committee Deliverables: The following deliverable will be prepared as part of this engagement:  Audit Report 18 Schedule of Performance Anticipated Start Date: March 1, 2021 Anticipated End Date: June 30, 2021 Maximum Compensation Amount and Rate Schedule The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this Task is $38,600. The not-to-exceed budget is based on an estimate of 180 total project hours, of which 10 are estimated to be completed by the City Auditor. Reimbursable Expenses We plan to complete all work remote including all interviews and documentation review. If at any point the City and Baker Tilly mutually determine it will be beneficial to perform a portion of the work on-site, we will submit an estimate of our reimbursable expenses for the City’s approval prior to traveling to Palo Alto. 19 Audit Activity 4.3 – Assessment of SAP Functionality & Internal Controls PROFESSIONAL SERVICES TASK ORDER TASK ORDER FY21-004.3 Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below. CONTRACT NO. OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE) 1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): 1B. TASK O RDER NO.: FY21-001 2. CONSULTANT NAME: Baker Tilly US, LLP 3. PERIOD OF PERFORMANCE: START: March 1, 2021 COMPLETION: June 30, 2021 4 TOTAL TASK ORDER PRICE: $23,050 BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT $TBD 5. BUDGET CODE_______________ COST CENTER________________ COST ELEMENT______________ WBS/CIP__________ PHASE__________ 6. CITY PROJECT MANAGER’S NAME & DEPARTMENT: Lydia Kou, Chair of the City Council’s Policy and Services Committee 7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A) MUST INCLUDE:  SERVICES AND DELIVERABLES TO BE PROVIDED  SCHEDULE OF PERFORMANCE  MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable)  REIMBURSABLE EXPENSES, if any (with “not to exceed” amount) 8. ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A I hereby authorize the performance of the work described in this Task Order. APPROVED: CITY OF PALO ALTO BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ I hereby acknowledge receipt and acceptance of this Task Order and warrant that I have authority to sign on behalf of Consultant. APPROVED: COMPANY NAME: ______________________ BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ 20 Attachment A DESCRIPTION OF SCOPE OF SERVICES Introduction Attachment A, the Description of Scope of Services, contains the following four (4) elements:  Services and Deliverables To Be Provided  Schedule of Performance  Maximum Compensation Amount and Rate Schedule (As Applicable)  Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables Baker Tilly’s approach to conducting a limited scope Assessment of SAP Functionality and Internal Controls (FY21) involves three (3) primary steps:  Step 1: Audit Planning  Step 2: Control Review and Testing  Step 3: Reporting Step 1 – Audit Planning This step consists of the tasks performed to adequately plan the work necessary to address the overall audit objective and to solidify mutual understanding of the audit scope, objectives, audit process, and timing between stakeholders and auditors. Tasks include:  Gather information to understand the environment under review o Understand the organizational structure and objectives o Review the City code, regulations, and other standards and expectations o Review prior audit results, as applicable o Review additional documentation and conduct interviews as necessary  Assess the audit risk  Write an audit planning memo and audit program o Refine audit objectives and scope o Identify the audit procedures to be performed and the evidence to be obtained and examined  Announce the initiation of the audit and conduct kick-off meeting with key stakeholders o Discuss audit objectives, scope, audit process, timing, resources, and expectations o Discuss documentation and interview requests for the audit 21 Step 2 – Control Review and Testing This step involves executing the procedures in the audit program to gather information, interview individuals, and analyze the data and information to obtain sufficient evidence to address the audit objectives. The preliminary audit objective is to determine whether controls and segregation of duties are properly designed and in place for the upgraded ERP system. Procedures include, but are not limited to:  Interview the appropriate information technology (IT) personnel to understand the internal controls and segregation of duties considered during the SAP system upgrade project  Interview the appropriate users to understand the process and the internal controls changed as a result of prior audit findings and the SAP upgrade  Perform test procedures including observation of controls (such as application controls) and review of selected documents (such as user access reports) Note that the nature and extent of testing and control review will be dependent on the project delivery schedule. Step 3 – Reporting In Step 3, the project team will perform tasks necessary to finalize audit working papers, prepare and review a draft report with the stakeholders, and submit a final audit report. Tasks include:  Develop findings, conclusions, and recommendations based on the supporting evidence gathered  Validate findings with the appropriate individuals and discuss the root cause of the identified findings  Complete supervisory review of working papers and a draft audit report  Distribute a draft audit report and conduct a closing meeting with key stakeholders o Discuss the audit results, finings, conclusions, and recommendations o Discuss management responses  Obtain written management responses and finalize a report  Review report with members of City Council and/or the appropriate Council Committee  Present the final report to the City Council and/or appropriate Council Committee Deliverables: The following deliverable will be prepared as part of this engagement:  Audit Report Schedule of Performance Anticipated Start Date: March 1, 2021 22 Anticipated End Date: June 30, 2021 Maximum Compensation Amount and Rate Schedule The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this Task is $23,050 The not-to-exceed budget is based on an estimate of 100 total project hours, of which 10 are estimated to be completed by the City Auditor. Reimbursable Expenses We plan to complete all work remote including all interviews and documentation review. If at any point the City and Baker Tilly mutually determine it will be beneficial to perform a portion of the work on-site, we will submit an estimate of our reimbursable expenses for the City’s approval prior to traveling to Palo Alto. 23 Audit Activity 4.4 – IT Risk Management Assessment PROFESSIONAL SERVICES TASK ORDER TASK ORDER FY21-004.4 Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below. CONTRACT NO. OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE) 1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): 1B. TASK O RDER NO.: FY21-004.4 2. CONSULTANT NAME: Baker Tilly US, LLP 3. PERIOD OF PERFORMANCE: START: March 1, 2021 COMPLETION: June 30, 2021 4 TOTAL TASK ORDER PRICE: $61,550 BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT $TBD 5. BUDGET CODE_______________ COST CENTER________________ COST ELEMENT______________ WBS/CIP__________ PHASE__________ 6. CITY PROJECT MANAGER’S NAME & DEPARTMENT: Lydia Kou, Chair of the City Council’s Policy and Services Committee 7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A) MUST INCLUDE:  SERVICES AND DELIVERABLES TO BE PROVIDED  SCHEDULE OF PERFORMANCE  MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable)  REIMBURSABLE EXPENSES, if any (with “not to exceed” amount) 8. ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A I hereby authorize the performance of the work described in this Task Order. APPROVED: CITY OF PALO ALTO BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ I hereby acknowledge receipt and acceptance of this Task Order and warrant that I have authority to sign on behalf of Consultant. APPROVED: COMPANY NAME: ______________________ BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ 24 Attachment A DESCRIPTION OF SCOPE OF SERVICES Introduction Attachment A, the Description of Scope of Services, contains the following four (4) elements:  Services and Deliverables To Be Provided  Schedule of Performance  Maximum Compensation Amount and Rate Schedule (As Applicable)  Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables Baker Tilly’s approach to conducting the IT Risk Management Assessment involves three (3) primary steps:  Step 1: Audit Planning  Step 2: Control Testing and Review  Step 3: Reporting Step 1 – Audit Planning This step includes those tasks necessary to solidify mutual understanding of the assessment scope, objectives, deliverables, and timing as well as ensuring that appropriate client and consultant resources are available and well-coordinated. Tasks include:  Gather information to understand the environment under review o Understand the organizational structure and objectives o Review the City code, regulations, and other standards and expectations o Review prior audit results, as applicable o Review additional documentation and conduct interviews as necessary  Assess the audit risk  Write an audit planning memo and audit program o Refine audit objectives and scope o Identify the audit procedures to be performed and the evidence to be obtained and examined  Announce the initiation of the audit and conduct a kick-off meeting with key stakeholders o Discuss audit objectives, scope, audit process, timing, resources, and expectations o Discuss documentation and interview requests for the audit Step 2 – Control Testing and Review This step involves gathering information, through various means, that will enable the project team to understand Palo Alto’s IT Risk Management and Governance strategy. Tasks include: 25  Request and review background information – the project team will develop an information request(s) in order to obtain an understanding of the Risk Management and Governance strategy within the City of Palo Alto. The request will include, but not be limited to: o Organizational Strategic plan(s) o Organizational Governance Documents o IT Risk Management Strategy o IT Strategic Roadmaps o Organizational Security and Privacy Policies o System- level Security and Privacy Policies o Operational policies and procedures o Consulting reports o Security Baselines and Cybersecurity frameworks o Other relevant information and reports  Conduct interviews with IT management to gain understanding of Palo Alto’s: o Risk Management Strategy to gain an understanding of the organization’s priorities, constraints, risk tolerances, and assumptions that are established and used to support operational risk decisions. o Risk Assessment Process to gain an understanding of how Palo Alto identifies its cybersecurity risks to its organizational operations (including mission, functions, image and reputation) o Organization security baselines and frameworks o Continuous Monitoring strategy  Conduct research into key risks in order to identify relevant information to assess risks  Test design and implementation of controls related to assessment objectives to determine whether controls are adequately designed and implemented to support the IT Risk Management Strategy  Compare the current IT risk management process against appropriate IT governance framework Step 3 – Reporting In Step 3, the project team will perform tasks necessary to finalize audit working papers, prepare and review a draft report with the stakeholders, and submit a final audit report. Tasks include:  Develop findings, conclusions, and recommendations based on the supporting evidence gathered  Validate findings with the appropriate individuals and discuss the root cause of the identified findings  Complete supervisory review of working papers and a draft audit report  Distribute a draft audit report and conduct a closing meeting with key stakeholders o Discuss the audit results, finings, conclusions, and recommendations o Discuss management responses 26  Obtain written management responses and finalize a report  Review report with members of City Council and/or the appropriate Council Committee  Present the final report to the City Council and/or appropriate Council Committee Deliverables: The following deliverables will be prepared as part of this engagement:  Audit Report Schedule of Performance Anticipated Start Date: March 1, 2021 Anticipated End Date: June 30, 2021 Maximum Compensation Amount and Rate Schedule The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this Task is $61,550. The not-to-exceed budget is based on an estimate of 350 total project hours, of which 20 are estimated to be completed by the City Auditor. Reimbursable Expenses We plan to complete all work remote including all interviews and documentation review. If at any point the City and Baker Tilly mutually determine it will be beneficial to perform a portion of the work on-site, we will submit an estimate of our reimbursable expenses for the City’s approval prior to traveling to Palo Alto. 27 Audit Activity 4.5 – Investment Management Review PROFESSIONAL SERVICES TASK ORDER TASK ORDER FY21-004.5 Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below. CONTRACT NO. OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE) 1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): 1B. TASK O RDER NO.: FY21-001 2. CONSULTANT NAME: Baker Tilly US, LLP 3. PERIOD OF PERFORMANCE: START: March 1, 2021 COMPLETION: June 30, 2021 4 TOTAL TASK ORDER PRICE: $82,500 BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT $TBD 5. BUDGET CODE_______________ COST CENTER________________ COST ELEMENT______________ WBS/CIP__________ PHASE__________ 6. CITY PROJECT MANAGER’S NAME & DEPARTMENT: Lydia Kou, Chair of the City Council’s Policy and Services Committee 7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A) MUST INCLUDE:  SERVICES AND DELIVERABLES TO BE PROVIDED  SCHEDULE OF PERFORMANCE  MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable)  REIMBURSABLE EXPENSES, if any (with “not to exceed” amount) 8. ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A I hereby authorize the performance of the work described in this Task Order. APPROVED: CITY OF PALO ALTO BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ I hereby acknowledge receipt and acceptance of this Task Order and warrant that I have authority to sign on behalf of Consultant. APPROVED: COMPANY NAME: ______________________ BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ 28 Attachment A DESCRIPTION OF SCOPE OF SERVICES Introduction Attachment A, the Description of Scope of Services, contains the following four (4) elements:  Services and Deliverables To Be Provided  Schedule of Performance  Maximum Compensation Amount and Rate Schedule (As Applicable)  Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables Baker Tilly’s approach to conducting a Review of Investment Management involves three (3) primary steps:  Step 1: Audit Planning  Step 2: Control Review and Testing  Step 3: Reporting Step 1 – Audit Planning This step consists of the tasks performed to adequately plan the work necessary to address the overall audit objective and to solidify mutual understanding of the audit scope, objectives, audit process, and timing between stakeholders and auditors. Tasks include:  Gather information to understand the environment under review o Understand the organizational structure and objectives o Review the City code, regulations, and other standards and expectations o Review prior audit results, as applicable o Review additional documentation and conduct interviews as necessary  Assess the audit risk  Write an audit planning memo and audit program o Refine audit objectives and scope o Identify the audit procedures to be performed and the evidence to be obtained and examined  Announce the initiation of the audit and conduct kick-off meeting with key stakeholders o Discuss audit objectives, scope, audit process, timing, resources, and expectations o Discuss documentation and interview requests for the audit 29 Step 2 – Control Review and Testing This step involves executing the procedures in the audit program to gather information, interview individuals, and analyze the data and information to obtain sufficient evidence to address the audit objectives. The preliminary audit objective is to: (1) Determine whether adequate controls are in place and working effectively to ensure that investments are properly managed in accordance with the investment policy; (2) Assess the efficiency and the effectiveness of the investment portfolio management against the best practice. Procedures include, but not limited to:  Interview the appropriate individuals to understand the process, the information system used, and the internal controls related to investment management  Review policies and procedures as well as the regulations and standards to identify the criteria to be used for evaluation of control design and effectiveness  Perform test procedures including observation of controls (such as application controls) and review of selected documents (such as supporting documents for the recorded transactions)  Compare the process, controls, and organization against the best practices Step 3 – Reporting In Step 3, the project team will perform tasks necessary to finalize audit working papers, prepare and review a draft report with the stakeholders, and submit a final audit report. Tasks include:  Develop findings, conclusions, and recommendations based on the supporting evidence gathered  Validate findings with the appropriate individuals and discuss the root cause of the identified findings  Complete supervisory review of working papers and a draft audit report  Distribute a draft audit report and conduct a closing meeting with key stakeholders o Discuss the audit results, finings, conclusions, and recommendations o Discuss management responses  Obtain written management responses and finalize a report  Review report with members of City Council and/or the appropriate Council Committee Deliverables: The following deliverable will be prepared as part of this engagement:  Audit Report Schedule of Performance Anticipated Start Date: March 1, 2021 Anticipated End Date: June 30, 2021 30 Maximum Compensation Amount and Rate Schedule The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this Task is $82,500. The not-to-exceed budget is based on an estimate of 400 total project hours, of which 20 are estimated to be completed by the City Auditor. Reimbursable Expenses We plan to complete all work remote including all interviews and documentation review. If at any point the City and Baker Tilly mutually determine it will be beneficial to perform a portion of the work on-site, we will submit an estimate of our reimbursable expenses for the City’s approval prior to traveling to Palo Alto. 31 Audit Activity 4.6 – Power Purchase Agreement Review PROFESSIONAL SERVICES TASK ORDER TASK ORDER FY21-004.6 Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below. CONTRACT NO. OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE) 1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): 1B. TASK O RDER NO.: FY21-001 2. CONSULTANT NAME: Baker Tilly US, LLP 3. PERIOD OF PERFORMANCE: START: March 1, 2021 COMPLETION: June 30, 2021 4 TOTAL TASK ORDER PRICE: $74,875 BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT $TBD 5. BUDGET CODE_______________ COST CENTER________________ COST ELEMENT______________ WBS/CIP__________ PHASE__________ 6. CITY PROJECT MANAGER’S NAME & DEPARTMENT: Alison Cormack, Chair of the City Council’s Policy and Services Committee 7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A) MUST INCLUDE:  SERVICES AND DELIVERABLES TO BE PROVIDED  SCHEDULE OF PERFORMANCE  MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable)  REIMBURSABLE EXPENSES, if any (with “not to exceed” amount) 8. ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A I hereby authorize the performance of the work described in this Task Order. APPROVED: CITY OF PALO ALTO BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ I hereby acknowledge receipt and acceptance of this Task Order and warrant that I have authority to sign on behalf of Consultant. APPROVED: COMPANY NAME: ______________________ BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ 32 Attachment A DESCRIPTION OF SCOPE OF SERVICES Introduction Attachment A, the Description of Scope of Services, contains the following four (4) elements:  Services and Deliverables To Be Provided  Schedule of Performance  Maximum Compensation Amount and Rate Schedule (As Applicable)  Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables Baker Tilly’s approach to conducting the Power Purchase Contracts Review involves three (3) primary steps:  Step 1: Audit Planning  Step 2: Control Review and Testing  Step 3: Reporting  Step 1 – Audit Planning This step consists of the tasks performed to adequately plan the work necessary to address the overall audit objective and to solidify mutual understanding of the audit scope, objectives, audit process, and timing between stakeholders and auditors. Tasks include:  Gather information to understand the environment under review o Understand the organizational structure and objectives o Review the City code, regulations, and other standards and expectations o Review prior audit results, as appropriate o Review additional documentation and conduct interviews as necessary  Assess the audit risk  Write an audit planning memo and audit program o Refine audit objectives and scope o Identify the audit procedures to be performed and the evidence to be obtained and examined  Announce the initiation of the audit and conduct a kick-off meeting with key stakeholders o Discuss audit objectives, scope, audit process, timing, resources, and expectations o Discuss documentation and interview requests for the audit 33 Step 2 – Control Review and Testing This step involves gathering information, through various means, that will enable the project team to understand the current work order process. Tasks include:  Request and review background information – the project team will develop an information request(s) in order to obtain various background information from the City. The request will include, but not be limited to: o Organizational charts o Contact information for key process owners o Active power purchase agreements (PPA) o Policy and procedures documentation related to procuring and managing PPAs and related billings/invoice processing  Conduct interviews with key process owners and management o Interviews aimed at understanding the processes surrounding PPAs and related billings/invoice processing  Perform risk assessment, analysis and testing o Identify initial control or process gaps o Quantify and analyze PPA spend by contract o Perform testing of key controls o Review contract billings for accuracy and contract compliance o Benchmark active PPA terms and conditions against other Baker Tilly client PPAs o Compare current state to industry best practices Step 3 – Reporting In Step 3, the project team will perform tasks necessary to finalize audit working papers, prepare and review a draft report with the stakeholders, and submit a final audit report. Tasks include:  Develop findings, conclusions, and recommendations based on the supporting evidence gathered  Validate findings with the appropriate individuals and discuss the root cause of the identified findings  Complete supervisory review of working papers and a draft audit report  Distribute a draft audit report and conduct a closing meeting with key stakeholders o Discuss the audit results, finings, conclusions, and recommendations o Discuss management responses  Obtain written management responses and finalize a report  Review report with members of City Council and/or the appropriate Council Committee  Present the final report to the City Council and/or appropriate Council Committee Deliverables: The following deliverables will be prepared as part of this engagement: 34  Audit Report Schedule of Performance Anticipated Start Date: March 1, 2021 Anticipated End Date: June 30, 2021 Maximum Compensation Amount and Rate Schedule The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this Task is $74,875. The not-to-exceed budget is based on an estimate of 375 total project hours, of which 10 are estimated to be completed by the City Auditor. Reimbursable Expenses We plan to complete all work remote including all interviews and documentation review. If at any point the City and Baker Tilly mutually determine it will be beneficial to perform a portion of the work on-site, we will submit an estimate of our reimbursable expenses for the City’s approval prior to traveling to Palo Alto. 35 Audit Activity 4.7 – Economic Recovery Advisory PROFESSIONAL SERVICES TASK ORDER TASK ORDER FY21-004.7 Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below. CONTRACT NO. OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE) 1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): 1B. TASK O RDER NO.: FY21-004.7 2. CONSULTANT NAME: Baker Tilly US, LLP 3. PERIOD OF PERFORMANCE: START: March 1, 2021 COMPLETION: December 31, 2021 4 TOTAL TASK ORDER PRICE: $84,615 BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT $TBD 5. BUDGET CODE_______________ COST CENTER________________ COST ELEMENT______________ WBS/CIP__________ PHASE__________ 6. CITY PROJECT MANAGER’S NAME & DEPARTMENT: Lydia Kou, Chair of the City Council’s Policy and Services Committee 7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A) MUST INCLUDE:  SERVICES AND DELIVERABLES TO BE PROVIDED  SCHEDULE OF PERFORMANCE  MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable)  REIMBURSABLE EXPENSES, if any (with “not to exceed” amount) 8. ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A I hereby authorize the performance of the work described in this Task Order. APPROVED: CITY OF PALO ALTO BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ I hereby acknowledge receipt and acceptance of this Task Order and warrant that I have authority to sign on behalf of Consultant. APPROVED: COMPANY NAME: ______________________ BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ 36 Attachment A DESCRIPTION OF SCOPE OF SERVICES Introduction Attachment A, the Description of Scope of Services, contains the following four (4) elements:  Services and Deliverables To Be Provided  Schedule of Performance  Maximum Compensation Amount and Rate Schedule (As Applicable)  Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables Baker Tilly’s approach to conducting the Economic Recovery Advisory project involves four (4) primary steps:  Step 1: Project Planning & Management  Step 2: Information Gathering  Step 3: Analysis  Step 4: Reporting Step 1 – Audit Planning This step consists of the tasks performed to adequately plan the work necessary to address the overall audit objective and to solidify mutual understanding of the audit scope, objectives, audit process, and timing between stakeholders and auditors. Tasks include:  Gather information to understand the environment under review o Understand the organizational structure and objectives o Review the City code, regulations, and other standards and expectations o Review prior audit results, as applicable o Review additional documentation and conduct interviews as necessary  Assess the audit risk  Write an audit planning memo and audit program o Refine audit objectives and scope o Identify the audit procedures to be performed and the evidence to be obtained and examined  Announce the initiation of the audit and conduct kick-off meeting with key stakeholders o Discuss audit objectives, scope, audit process, timing, resources, and expectations o Discuss documentation and interview requests for the audit 37 Step 2 – Information Gathering This step involves gathering information, through various means, that will enable the project team to understand the various risks facing the City. Tasks include:  Request and review background information – the project team will develop an information request(s) in order to obtain various background information from the City. The request will include, but not be limited to: o Financial reports, including the past five years City Budgets and Comprehensive Annual Financial Report (CAFR) especially major revenue sources including:  Net sales  Property tax  Sales tax  Utility user tax  Transient occupancy tax  Documentary transfer tax  Charges for services  Permits and licenses  Rental income  Other o Existing financial and revenue planning projections o Other relevant information and reports  Conduct up to twelve (12) interviews with City Council and management o Information gathering and assessment interviews, aimed at understanding City functions and identifying revenue and expense risks, will be conducted with City Council members as well as department and division  Conduct research to identify relevant information to assess risks. The following items may be relevant depending on the revenue source or expense type. o Diversity and distribution of each revenue source  Economic base by NAICS code  Major contributors to each source  Geographic location/concentration  Office and industrial rental vacancies  Transient occupancy  Property values  Property turnover (sales)  Student enrollment  Household income  Unemployment rate  Employment and number of jobs  Sales tax base per capita  Property tax base per capita  Other o Projected economic trends 38 Step 3 – Analysis In Step 3, the project team will analyze each revenue source. The analysis, which will focus on a subset of high risk revenue sources, will include the following:  Historical trends  Distribution of revenue sources by revenue type: o Source(s) o Concentration/distribution of revenue received to identify:  Largest payors  Geographic location o Historical relationship between economic factors and other relevant factors to revenue amounts o Perform a sensitivity analysis to determine the range of likely variability based on relevant drivers of sensitivity o Comparison of per-capita revenues by type to other similar cities  Review analysis with City staff  Modify analysis incorporating City staff recommendations as appropriate Step 4 – Reporting In Step 4, the project team will perform tasks necessary to finalize audit working papers, prepare and review a draft report with the stakeholders, and submit a final audit report. Tasks include:  Develop findings, conclusions, and recommendations based on the supporting evidence gathered  Validate findings with the appropriate individuals and discuss the root cause of the identified findings  Complete supervisory review of working papers and a draft audit report  Distribute a draft audit report and conduct a closing meeting with key stakeholders o Discuss the audit results, finings, conclusions, and recommendations o Discuss management responses  Obtain written management responses and finalize a report  Review report with members of City Council and/or the appropriate Council Committee  Present the final report to the City Council and/or appropriate Council Committee *Note – Baker Tilly has budgeted to provide ad hoc, as-needed assistance to the City and City Council during the budgeting process. The nature and extent of that work will be determined through discussion with Council. Deliverables: The following deliverables will be prepared as part of this engagement:  Final Report Schedule of Performance Anticipated Start Date: March 1, 2021 39 Anticipated End Date: December 31, 2021 Maximum Compensation Amount and Rate Schedule The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this Task is $84,615. The not-to-exceed budget is based on an estimate of 400 total project hours, of which 20 are estimated to be completed by the City Auditor. Reimbursable Expenses We plan to complete all work remote including all interviews and documentation review. If at any point the City and Baker Tilly mutually determine it will be beneficial to perform a portion of the work on-site, we will submit an estimate of our reimbursable expenses for the City’s approval prior to traveling to Palo Alto.