HomeMy WebLinkAboutStaff Report 2402-2639CITY OF PALO ALTO
CITY COUNCIL
Special Meeting
Monday, March 04, 2024
Council Chambers & Hybrid
5:30 PM
Agenda Item
3.Approval of Office of the City Auditor FY2024 Task 4 Task Orders (CEQA Status - Not a
Project)
4
0
6
4
City Council
Staff Report
From: City Manager
Report Type: CONSENT CALENDAR
Lead Department: City Auditor
Meeting Date: March 4, 2024
Report #:2402-2639
TITLE
Approval of Office of the City Auditor FY2024 Task 4 Task Orders (CEQA Status - Not a Project)
RECOMMENDATION
The Policy and Services Committee and the Office of the City Auditor recommend that the City
Council approve the following Task 4 Task Orders identified in the FY 2024 Audit Plan Report:
•TASK ORDER FY24-4.23 Recruitment and Succession Planning
•TASK ORDER FY24-4.24 Grant Management
•TASK ORDER FY24-4.25 Emergency Preparedness
•TASK ORDER FY24-4.26 Utility Billing
•TASK ORDER FY24-4.27 Payment Card Industry Data Security Standard (PCI/DSS)
EXECUTIVE SUMMARY
The committee members approved the attached five task orders at the Policy and Services
Committee meeting on February 13, 20241.
MOTION: Council Member Lythcott-Haims moved, seconded by Chair Kou to
recommend the City Council approve the following Task 4 Task Orders:
a) TASK ORDER FY24-4.23 Recruitment and Succession Planning
b) TASK ORDER FY24-4.24 Grant Management
c) TASK ORDER FY24-4.25 Emergency Preparedness
d) TASK ORDER FY24-4.26 Utility Billing
e) TASK ORDER FY24-4.27 Payment Card Industry Data Security Standard (PCI/DSS)
MOTION PASSED: 2-0
1 Policy & Services Committee, February 13, 2024, Agenda Item #1, SR #2312-2460,
https://cityofpaloalto.primegov.com/Portal/Meeting?meetingTemplateId=14868
4
0
6
4
BACKGROUND
Task 4, Execute Annual Audit Plan, in the agreement between the City of Palo Alto (City) and
Baker Tilly US, LLP (Baker Tilly)2 states, “Conduct a minimum number of internal audits in
accordance with each approved annual audit plan based on the risk assessments. Each internal
audit will commence only upon the City’s approval of a Task Order (which may be at the task or
sub-task level) as required by this Agreement. Each internal audit requires the preparation of a
written report for review by the City Manager, City Attorney and appropriate Council
committee, and review/approval by the City Council as required.”
ANALYSIS
The Office of the City Auditor (OCA) is seeking approval from the Policy and Services Committee
of the following Task Orders for internal audits listed in the Fiscal Year 2024 audit plan that was
approved by the City Council on January 22, 20243:
•TASK ORDER FY24-4.23 Recruitment and Succession Planning
The preliminary audit objectives include:
•Determine the efficiency and effectiveness of the recruitment and hiring process
•Determine whether a formal succession plan and related policies procedures are
in place
•TASK ORDER FY24-4.24 Grant Management
The preliminary audit objective is to determine whether the City has adequate internal
controls to manage the grant lifecycle efficiently and effectively
•TASK ORDER FY24-4.25 Emergency Preparedness
The preliminary audit objective is to determine whether the City is working to prevent
wildfire and adequately prepared to respond to wildfire as part of the City’s emergency
management plan
•TASK ORDER FY24-4.26 Utility Billing
The preliminary audit objectives include:
2 Baker Tilly US, LLP, Agreement for Professional Services, C21179340;
https://www.cityofpaloalto.org/files/assets/public/v/5/agendas-minutes-reports/agendas-minutes/city-council-
agendas-minutes/2022/20220509/20220509pccsmamended-linked.pdf
3 City Council, January 22, 2024, Agenda Item #9, SR # 2311-2304
https://cityofpaloalto.primegov.com/Portal/Meeting?meetingTemplateId=13333
4
0
6
4
•Determine whether the internal controls over the utility billing process are
adequate and working effectively to ensure billing is accurate and in compliance
with the City's policy and regulations
•Determine whether billing adjustments are properly supported and approved
•TASK ORDER FY24-4.27 Payment Card Industry Data Security Standard (PCI/DSS)
The preliminary audit objective is to determine whether the internal controls over the
payment card processing are adequate and working effectively for the City and any third
party service provider
Each of these task orders begins March 1, 2024 and ends December 2024. Audit work will
commence in alignment with the identification and appointment of a new City Auditor.
FISCAL/RESOURCE IMPACT
Work recommended in these tasks is within both the approved scope and compensation of the
agreement with Baker Tilly and funding levels in the Fiscal Year 2024 operating budget for the
OCA.
STAKEHOLDER ENGAGEMENT
No stakeholder outreach was necessary to create task orders for the tasks described in the
signed contract.
ENVIRONMENTAL REVIEW
Council action on this item is not a project as defined by CEQA because the Auditor task orders
are administrative activities that will not result in direct or indirect physical changes in the
environment. CEQA Guidelines section 15378(b)(5).
ATTACHMENTS
Attachment A: TASK ORDER FY24-4.23 Recruitment and Succession Planning
Attachment B: TASK ORDER FY24-4.24 Grant Management
Attachment C: TASK ORDER FY24-4.25 Emergency Preparedness
Attachment D: TASK ORDER FY24-4.26 Utility Billing
Attachment E: TASK ORDER FY24-4.27 Payment Card Industry Data Security Standard (PCI/DSS)
APPROVED BY:
Kate Crowley, Baker Tilly
PROFESSIONAL SERVICES TASK ORDER
TASK ORDER FY24-4.23 Recruitment and Succession Planning
Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the
Agreement referenced in Item 1A below. All exhibits referencedFY24 in Item 8 below are incorporated
into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional,
technical and supporting personnel required by this Task Order as described below.
CONTRACT NO. C21179340
OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE)
1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): C21179340
1B. TASK O RDER NO.: FY23-4.23
2. CONSULTANT NAME: Baker Tilly US, LLP
3. PERIOD OF PERFORMANCE: START: March 1, 2024 COMPLETION: December 31, 2024
4 TOTAL TASK ORDER PRICE: $58,890
BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT TBD
5. BUDGET CODE_______________
COST CENTER________________
COST ELEMENT______________
WBS/CIP__________
PHASE__________
6. CITY PROJECT MANAGER’S NAME & DEPARTMENT:
Lydia Kou, Chair of the City Council’s Policy and Services Committee
7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A)
MUST INCLUDE:
SERVICES AND DELIVERABLES TO BE PROVIDED
SCHEDULE OF PERFORMANCE
MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable)
REIMBURSABLE EXPENSES, if any (with “not to exceed” amount)
8. ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A
I hereby authorize the performance of the
work described in this Task Order.
APPROVED:
CITY OF PALO ALTO
BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________
I hereby acknowledge receipt and acceptance of
this Task Order and warrant that I have
authority to sign on behalf of Consultant.
APPROVED:
COMPANY NAME: ______________________
BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________
Attachment A
DESCRIPTION OF SCOPE OF SERVICES
Introduction
Attachment A, the Description of Scope of Services, contains the following four (4) elements:
Services and Deliverables To Be Provided
Schedule of Performance
Maximum Compensation Amount and Rate Schedule (As Applicable)
Reimbursable Expenses, if any (With “Not To Exceed” Amount)
Services & Deliverables
Baker Tilly’s approach to conducting an internal audit of Recruitment and Succession Planning
involves three (3) primary steps:
Step 1: Audit Planning
Step 2: Control Review and Testing
Step 3: Reporting
Step 1 – Audit Planning
This step consists of the tasks performed to adequately plan the work necessary to address
the overall audit objective and to solidify mutual understanding of the audit scope,
objectives, audit process, and timing between stakeholders and auditors. Tasks include:
Gather information to understand the environment under review
o Understand the organizational structure and objectives
o Review the City code, regulations, and other standards and expectations
o Review prior audit results, as applicable
o Review additional documentation and conduct interviews as necessary
Assess the audit risk
Write an audit planning memo and audit program
o Refine audit objectives and scope
o Identify the audit procedures to be performed and the evidence to be obtained
and examined
Announce the initiation of the audit and conduct kick-off meeting with key
stakeholders
o Discuss audit objectives, scope, audit process, timing, resources, and
expectations
o Discuss documentation and interview requests for the audit
Step 2 – Control Review and Testing
This step involves executing the procedures in the audit program to gather information,
interview individuals, and analyze the data and information to obtain sufficient evidence to
address the audit objectives. The preliminary audit objective is to (1) determine the efficiency
and effectiveness of the recruitment and hiring process; (2) determine whether a formal
succession plan and related policies and procedures are in place. Procedures include, but not
limited to:
Interview the appropriate individuals to gain an understanding of the organizational
structure, processes, and controls related to recruitment and succession planning.
Review policies and procedures as well as the legislative and regulatory requirements
to identify the criteria to be used for evaluation of control design and effectiveness.
Select a sample of the recruitment activities for documentation review
Review the existing succession plan
Compare the process and controls against the best practices.
Step 3 – Reporting
In Step 3, the project team will perform tasks necessary to finalize audit working papers,
prepare and review a draft report with the stakeholders, and submit a final audit report. Tasks
include:
Develop findings, conclusions, and recommendations based on the supporting
evidence gathered
Validate findings with the appropriate individuals and discuss the root cause of the
identified findings
Complete supervisory review of working papers and a draft audit report
Distribute a draft audit report and conduct a closing meeting with key stakeholders
o Discuss the audit results, finings, conclusions, and recommendations
o Discuss management responses
Obtain written management responses and finalize a report
Review report with members of City Council and/or the appropriate Council
Committee
Deliverables:
The following deliverable will be prepared as part of this engagement:
Audit Report
Schedule of Performance
Anticipated Start Date: March 1, 2024
Anticipated End Date: December 31, 2024
Maximum Compensation Amount and Rate Schedule
The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this
Task is $58,890. The not-to-exceed budget is based on an estimate of 290 total project hours, of
which 20 are estimated to be completed by the City Auditor.
Reimbursable Expenses
We plan to complete all work remote including all interviews and documentation review. If at
any point the City and Baker Tilly mutually determine it will be beneficial to perform a portion
of the work on-site, we will submit an estimate of our reimbursable expenses for the City’s
approval prior to traveling to Palo Alto.
PROFESSIONAL SERVICES TASK ORDER
TASK ORDER FY24-4.24 Grant Management
Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the
Agreement referenced in Item 1A below. All exhibits referencedFY24 in Item 8 below are incorporated
into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional,
technical and supporting personnel required by this Task Order as described below.
CONTRACT NO. C21179340
OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE)
1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): C21179340
1B. TASK O RDER NO.: FY23-4.24
2. CONSULTANT NAME: Baker Tilly US, LLP
3. PERIOD OF PERFORMANCE: START: March 1, 2024 COMPLETION: December 31, 2024
4 TOTAL TASK ORDER PRICE: $60,330
BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT TBD
5. BUDGET CODE_______________
COST CENTER________________
COST ELEMENT______________
WBS/CIP__________
PHASE__________
6. CITY PROJECT MANAGER’S NAME & DEPARTMENT:
Lydia Kou, Chair of the City Council’s Policy and Services Committee
7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A)
MUST INCLUDE:
SERVICES AND DELIVERABLES TO BE PROVIDED
SCHEDULE OF PERFORMANCE
MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable)
REIMBURSABLE EXPENSES, if any (with “not to exceed” amount)
8. ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A
I hereby authorize the performance of the
work described in this Task Order.
APPROVED:
CITY OF PALO ALTO
BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________
I hereby acknowledge receipt and acceptance of
this Task Order and warrant that I have
authority to sign on behalf of Consultant.
APPROVED:
COMPANY NAME: ______________________
BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________
Attachment A
DESCRIPTION OF SCOPE OF SERVICES
Introduction
Attachment A, the Description of Scope of Services, contains the following four (4) elements:
Services and Deliverables To Be Provided
Schedule of Performance
Maximum Compensation Amount and Rate Schedule (As Applicable)
Reimbursable Expenses, if any (With “Not To Exceed” Amount)
Services & Deliverables
Baker Tilly’s approach to conducting an internal audit of Grant Management involves three (3)
primary steps:
Step 1: Audit Planning
Step 2: Control Review and Testing
Step 3: Reporting
Step 1 – Audit Planning
This step consists of the tasks performed to adequately plan the work necessary to address
the overall audit objective and to solidify mutual understanding of the audit scope,
objectives, audit process, and timing between stakeholders and auditors. Tasks include:
Gather information to understand the environment under review
o Understand the organizational structure and objectives
o Review the City code, regulations, and other standards and expectations
o Review prior audit results, as applicable
o Review additional documentation and conduct interviews as necessary
Assess the audit risk
Write an audit planning memo and audit program
o Refine audit objectives and scope
o Identify the audit procedures to be performed and the evidence to be obtained
and examined
Announce the initiation of the audit and conduct kick-off meeting with key
stakeholders
o Discuss audit objectives, scope, audit process, timing, resources, and
expectations
o Discuss documentation and interview requests for the audit
Step 2 – Control Review and Testing
This step involves executing the procedures in the audit program to gather information,
interview individuals, and analyze the data and information to obtain sufficient evidence to
address the audit objectives. The preliminary audit objective is to determine whether the City
has adequate internal controls to manage the grant lifecycle efficiently and effectively.
Procedures include, but not limited to:
Interview the appropriate individuals to gain an understanding of the organizational
structure, processes, and controls related to grant management.
Review policies and procedures as well as the legislative and regulatory requirements
to identify the criteria to be used for evaluation of control design and effectiveness.
Select a sample of grants for documentation review.
Compare the process and controls against the best practices.
Step 3 – Reporting
In Step 3, the project team will perform tasks necessary to finalize audit working papers,
prepare and review a draft report with the stakeholders, and submit a final audit report. Tasks
include:
Develop findings, conclusions, and recommendations based on the supporting
evidence gathered
Validate findings with the appropriate individuals and discuss the root cause of the
identified findings
Complete supervisory review of working papers and a draft audit report
Distribute a draft audit report and conduct a closing meeting with key stakeholders
o Discuss the audit results, finings, conclusions, and recommendations
o Discuss management responses
Obtain written management responses and finalize a report
Review report with members of City Council and/or the appropriate Council
Committee
Deliverables:
The following deliverable will be prepared as part of this engagement:
Audit Report
Schedule of Performance
Anticipated Start Date: March 1, 2024
Anticipated End Date: December 31, 2024
Maximum Compensation Amount and Rate Schedule
The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this
Task is $60,330. The not-to-exceed budget is based on an estimate of 315 total project hours, of
which 23 are estimated to be completed by the City Auditor.
Reimbursable Expenses
We plan to complete all work remote including all interviews and documentation review. If at
any point the City and Baker Tilly mutually determine it will be beneficial to perform a portion
of the work on-site, we will submit an estimate of our reimbursable expenses for the City’s
approval prior to traveling to Palo Alto.
PROFESSIONAL SERVICES TASK ORDER
TASK ORDER FY24-4.25 Emergency Preparedness
Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the
Agreement referenced in Item 1A below. All exhibits referencedFY24 in Item 8 below are incorporated
into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional,
technical and supporting personnel required by this Task Order as described below.
CONTRACT NO. C21179340
OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE)
1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): C21179340
1B. TASK O RDER NO.: FY23-4.25
2. CONSULTANT NAME: Baker Tilly US, LLP
3. PERIOD OF PERFORMANCE: START: March 1, 2024 COMPLETION: December 31, 2024
4 TOTAL TASK ORDER PRICE: $73,110
BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT TBD
5. BUDGET CODE_______________
COST CENTER________________
COST ELEMENT______________
WBS/CIP__________
PHASE__________
6. CITY PROJECT MANAGER’S NAME & DEPARTMENT:
Lydia Kou, Chair of the City Council’s Policy and Services Committee
7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A)
MUST INCLUDE:
SERVICES AND DELIVERABLES TO BE PROVIDED
SCHEDULE OF PERFORMANCE
MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable)
REIMBURSABLE EXPENSES, if any (with “not to exceed” amount)
8. ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A
I hereby authorize the performance of the
work described in this Task Order.
APPROVED:
CITY OF PALO ALTO
BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________
I hereby acknowledge receipt and acceptance of
this Task Order and warrant that I have
authority to sign on behalf of Consultant.
APPROVED:
COMPANY NAME: ______________________
BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________
Attachment A
DESCRIPTION OF SCOPE OF SERVICES
Introduction
Attachment A, the Description of Scope of Services, contains the following four (4) elements:
Services and Deliverables To Be Provided
Schedule of Performance
Maximum Compensation Amount and Rate Schedule (As Applicable)
Reimbursable Expenses, if any (With “Not To Exceed” Amount)
Services & Deliverables
Baker Tilly’s approach to conducting an internal audit of Emergency Preparedness involves three
(3) primary steps:
Step 1: Audit Planning
Step 2: Control Review and Testing
Step 3: Reporting
Step 1 – Audit Planning
This step consists of the tasks performed to adequately plan the work necessary to address
the overall audit objective and to solidify mutual understanding of the audit scope,
objectives, audit process, and timing between stakeholders and auditors. Tasks include:
Gather information to understand the environment under review
o Understand the organizational structure and objectives
o Review the City code, regulations, and other standards and expectations
o Review prior audit results, as applicable
o Review additional documentation and conduct interviews as necessary
Assess the audit risk
Write an audit planning memo and audit program
o Refine audit objectives and scope
o Identify the audit procedures to be performed and the evidence to be obtained
and examined
Announce the initiation of the audit and conduct kick-off meeting with key
stakeholders
o Discuss audit objectives, scope, audit process, timing, resources, and
expectations
o Discuss documentation and interview requests for the audit
Step 2 – Control Review and Testing
This step involves executing the procedures in the audit program to gather information,
interview individuals, and analyze the data and information to obtain sufficient evidence to
address the audit objectives. The preliminary audit objective is to determine whether the City
is working to prevent wildfire and adequately prepared to respond to wildfire as part of the
City’s emergency management plan. Procedures include, but not limited to:
Interview the appropriate individuals in all relevant departments to gain an
understanding of the organizational structure, processes, and controls related to
wildfire prevention and response as well as the City’s overall emergency
preparedness.
Review policies and procedures as well as the legislative and regulatory requirements
to identify the criteria to be used for evaluation of control design and effectiveness.
Review the existing emergency management plan and other related documents such
as prevention activities, training and exercises, equipment, and service contracts.
Compare the process and controls against the best practices.
Step 3 – Reporting
In Step 3, the project team will perform tasks necessary to finalize audit working papers,
prepare and review a draft report with the stakeholders, and submit a final audit report. Tasks
include:
Develop findings, conclusions, and recommendations based on the supporting
evidence gathered
Validate findings with the appropriate individuals and discuss the root cause of the
identified findings
Complete supervisory review of working papers and a draft audit report
Distribute a draft audit report and conduct a closing meeting with key stakeholders
o Discuss the audit results, finings, conclusions, and recommendations
o Discuss management responses
Obtain written management responses and finalize a report
Review report with members of City Council and/or the appropriate Council
Committee
Deliverables:
The following deliverable will be prepared as part of this engagement:
Audit Report
Schedule of Performance
Anticipated Start Date: March 1, 2024
Anticipated End Date: December 31, 2024
Maximum Compensation Amount and Rate Schedule
The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this
Task is $73,110. The not-to-exceed budget is based on an estimate of 385 total project hours, of
which 25 are estimated to be completed by the City Auditor.
Reimbursable Expenses
We plan to complete all work remote including all interviews and documentation review.
However, during the planning and fieldwork phases of this audit, the City and Baker Tilly may
mutually determine it will be beneficial to perform a portion of the work on-site. Given this
possibility, Baker Tilly could incur reimbursable expenses for this Task.
The not-to-exceed maximum for reimbursable expenses for this Task is $6,500.
The following summarizes anticipated reimbursable expenses:
Round-trip Airfare – $2,000 (1 round trip flights x 2 auditors)
Ground Transportation (car rental or Uber/taxi) - $800
Hotel accommodation - $3,000 (2 rooms x 4 nights)
Food and incidentals – $700
PROFESSIONAL SERVICES TASK ORDER
TASK ORDER FY24-4.26 Utility Billing
Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the
Agreement referenced in Item 1A below. All exhibits referencedFY24 in Item 8 below are incorporated
into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional,
technical and supporting personnel required by this Task Order as described below.
CONTRACT NO. C21179340
OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE)
1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): C21179340
1B. TASK O RDER NO.: FY23-4.26
2. CONSULTANT NAME: Baker Tilly US, LLP
3. PERIOD OF PERFORMANCE: START: March 1, 2024 COMPLETION: December 31, 2024
4 TOTAL TASK ORDER PRICE: $72,010
BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT TBD
5. BUDGET CODE_______________
COST CENTER________________
COST ELEMENT______________
WBS/CIP__________
PHASE__________
6. CITY PROJECT MANAGER’S NAME & DEPARTMENT:
Lydia Kou, Chair of the City Council’s Policy and Services Committee
7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A)
MUST INCLUDE:
SERVICES AND DELIVERABLES TO BE PROVIDED
SCHEDULE OF PERFORMANCE
MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable)
REIMBURSABLE EXPENSES, if any (with “not to exceed” amount)
8. ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A
I hereby authorize the performance of the
work described in this Task Order.
APPROVED:
CITY OF PALO ALTO
BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________
I hereby acknowledge receipt and acceptance of
this Task Order and warrant that I have
authority to sign on behalf of Consultant.
APPROVED:
COMPANY NAME: ______________________
BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________
Attachment A
DESCRIPTION OF SCOPE OF SERVICES
Introduction
Attachment A, the Description of Scope of Services, contains the following four (4) elements:
Services and Deliverables To Be Provided
Schedule of Performance
Maximum Compensation Amount and Rate Schedule (As Applicable)
Reimbursable Expenses, if any (With “Not To Exceed” Amount)
Services & Deliverables
Baker Tilly’s approach to conducting an internal audit of Utility Billing involves three (3)
primary steps:
Step 1: Audit Planning
Step 2: Control Review and Testing
Step 3: Reporting
Step 1 – Audit Planning
This step consists of the tasks performed to adequately plan the work necessary to address
the overall audit objective and to solidify mutual understanding of the audit scope,
objectives, audit process, and timing between stakeholders and auditors. Tasks include:
Gather information to understand the environment under review
o Understand the organizational structure and objectives
o Review the City code, regulations, and other standards and expectations
o Review prior audit results, as applicable
o Review additional documentation and conduct interviews as necessary
Assess the audit risk
Write an audit planning memo and audit program
o Refine audit objectives and scope
o Identify the audit procedures to be performed and the evidence to be obtained
and examined
Announce the initiation of the audit and conduct kick-off meeting with key
stakeholders
o Discuss audit objectives, scope, audit process, timing, resources, and
expectations
o Discuss documentation and interview requests for the audit
Step 2 – Control Review and Testing
This step involves executing the procedures in the audit program to gather information,
interview individuals, and analyze the data and information to obtain sufficient evidence to
address the audit objectives. The preliminary audit objective is to (1) determine whether the
internal controls over the utility billing process are adequate and working effectively to
ensure billing is accurate and in compliance with the City's policy and regulations; (2)
determine whether billing adjustments are properly supported and approved. Procedures
include, but not limited to:
Interview the appropriate individuals to gain an understanding of the organizational
structure, processes, and controls related to utility billing.
Review policies and procedures as well as the legislative and regulatory requirements
to identify the criteria to be used for evaluation of control design and effectiveness.
Select a sample of utility invoices and a sample of billing adjustments for testing.
Compare the process and controls against the best practices.
Step 3 – Reporting
In Step 3, the project team will perform tasks necessary to finalize audit working papers,
prepare and review a draft report with the stakeholders, and submit a final audit report. Tasks
include:
Develop findings, conclusions, and recommendations based on the supporting
evidence gathered
Validate findings with the appropriate individuals and discuss the root cause of the
identified findings
Complete supervisory review of working papers and a draft audit report
Distribute a draft audit report and conduct a closing meeting with key stakeholders
o Discuss the audit results, finings, conclusions, and recommendations
o Discuss management responses
Obtain written management responses and finalize a report
Review report with members of City Council and/or the appropriate Council
Committee
Deliverables:
The following deliverable will be prepared as part of this engagement:
Audit Report
Schedule of Performance
Anticipated Start Date: March 1, 2024
Anticipated End Date: December 31, 2024
Maximum Compensation Amount and Rate Schedule
The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this
Task is $72,010. The not-to-exceed budget is based on an estimate of 385 total project hours, of
which 24 are estimated to be completed by the City Auditor.
Reimbursable Expenses
We plan to complete all work remote including all interviews and documentation review. If at
any point the City and Baker Tilly mutually determine it will be beneficial to perform a portion
of the work on-site, we will submit an estimate of our reimbursable expenses for the City’s
approval prior to traveling to Palo Alto.
PROFESSIONAL SERVICES TASK ORDER
TASK ORDER FY24-4.27 Payment Card Industry Data Security Standard (PCI DSS)
Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the
Agreement referenced in Item 1A below. All exhibits referencedFY24 in Item 8 below are incorporated
into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional,
technical and supporting personnel required by this Task Order as described below.
CONTRACT NO. C21179340
OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE)
1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): C21179340
1B. TASK O RDER NO.: FY23-4.27
2. CONSULTANT NAME: Baker Tilly US, LLP
3. PERIOD OF PERFORMANCE: START: March 1, 2024 COMPLETION: December 31, 2024
4 TOTAL TASK ORDER PRICE: $69,680
BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT TBD
5. BUDGET CODE_______________
COST CENTER________________
COST ELEMENT______________
WBS/CIP__________
PHASE__________
6. CITY PROJECT MANAGER’S NAME & DEPARTMENT:
Lydia Kou, Chair of the City Council’s Policy and Services Committee
7. DESCRIPTION OF SCOPE OF SERVICES (Attachment A)
MUST INCLUDE:
SERVICES AND DELIVERABLES TO BE PROVIDED
SCHEDULE OF PERFORMANCE
MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable)
REIMBURSABLE EXPENSES, if any (with “not to exceed” amount)
8. ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A
I hereby authorize the performance of the
work described in this Task Order.
APPROVED:
CITY OF PALO ALTO
BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________
I hereby acknowledge receipt and acceptance of
this Task Order and warrant that I have
authority to sign on behalf of Consultant.
APPROVED:
COMPANY NAME: ______________________
BY:____________________________________
Name __________________________________
Title___________________________________
Date ___________________________________
Attachment A
DESCRIPTION OF SCOPE OF SERVICES
Introduction
Attachment A, the Description of Scope of Services, contains the following four (4) elements:
Services and Deliverables To Be Provided
Schedule of Performance
Maximum Compensation Amount and Rate Schedule (As Applicable)
Reimbursable Expenses, if any (With “Not To Exceed” Amount)
Services & Deliverables
Baker Tilly’s approach to conducting an internal audit of Payment Card Industry Data Security
Standard (PCI DSS) Compliance involves three (3) primary steps:
Step 1: Audit Planning
Step 2: Control Review and Testing
Step 3: Reporting
Step 1 – Audit Planning
This step consists of the tasks performed to adequately plan the work necessary to address
the overall audit objective and to solidify mutual understanding of the audit scope,
objectives, audit process, and timing between stakeholders and auditors. Tasks include:
Gather information to understand the environment under review
o Understand the organizational structure and objectives
o Review the City code, regulations, and other standards and expectations
o Review prior audit results, as applicable
o Review additional documentation and conduct interviews as necessary
Assess the audit risk
Write an audit planning memo and audit program
o Refine audit objectives and scope
o Identify the audit procedures to be performed and the evidence to be obtained
and examined
Announce the initiation of the audit and conduct kick-off meeting with key
stakeholders
o Discuss audit objectives, scope, audit process, timing, resources, and
expectations
o Discuss documentation and interview requests for the audit
Step 2 – Control Review and Testing
This step involves executing the procedures in the audit program to gather information,
interview individuals, and analyze the data and information to obtain sufficient evidence to
address the audit objectives. The preliminary audit objective is to determine whether the
internal controls over the payment card processing are adequate and working effectively for
the City and any third party service provider. Procedures include, but not limited to:
Interview the appropriate individuals to gain an understanding of the organizational
structure, processes, and controls related to compliance with PCI/DSS for payment
card processing.
Review policies and procedures as well as the legislative and regulatory requirements
(including PCI/DSS) to identify the criteria to be used for evaluation of control design
and effectiveness.
Review the documentation related to ensuring third party providers’ PCI/DSS
compliance
Compare the process and controls against the best practices.
Step 3 – Reporting
In Step 3, the project team will perform tasks necessary to finalize audit working papers,
prepare and review a draft report with the stakeholders, and submit a final audit report. Tasks
include:
Develop findings, conclusions, and recommendations based on the supporting
evidence gathered
Validate findings with the appropriate individuals and discuss the root cause of the
identified findings
Complete supervisory review of working papers and a draft audit report
Distribute a draft audit report and conduct a closing meeting with key stakeholders
o Discuss the audit results, finings, conclusions, and recommendations
o Discuss management responses
Obtain written management responses and finalize a report
Review report with members of City Council and/or the appropriate Council
Committee
Deliverables:
The following deliverable will be prepared as part of this engagement:
Audit Report
Schedule of Performance
Anticipated Start Date: March 1, 2024
Anticipated End Date: December 31, 2024
Maximum Compensation Amount and Rate Schedule
The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this
Task is $69,680. The not-to-exceed budget is based on an estimate of 370 total project hours, of
which 10 hours are estimated to be completed by the City Auditor.
Reimbursable Expenses
We plan to complete all work remote including all interviews and documentation review.
However, during the planning and fieldwork phases of this audit, the City and Baker Tilly may
mutually determine it will be beneficial to perform a portion of the work on-site. Given this
possibility, Baker Tilly could incur reimbursable expenses for this Task.
The not-to-exceed maximum for reimbursable expenses for this Task is $6,500.
The following summarizes anticipated reimbursable expenses:
Round-trip Airfare – $2,000 (1 round trip flights x 2 auditors)
Ground Transportation (car rental or Uber/taxi) - $800
Hotel accommodation - $3,000 (2 rooms x 4 nights)
Food and incidentals – $700