HomeMy WebLinkAbout2018-09-11 Policy & Services Committee Agenda PacketPolicy and Services Committee
1
MATERIALS RELATED TO AN ITEM ON THIS AGENDA SUBMITTED TO THE CITY COUNCIL AFTER DISTRIBUTION OF THE AGENDA
PACKET ARE AVAILABLE FOR PUBLIC INSPECTION IN THE CITY CLERK’S OFFICE AT PALO ALTO CITY HALL, 250 HAMILTON AVE.
DURING NORMAL BUSINESS HOURS.
Tuesday, September 11, 2018
Regular Meeting
Community Meeting Room
7:00 PM
Agenda posted according to PAMC Section 2.04.070. Supporting materials are available in
the Council Chambers on the Thursday 12 days preceding the meeting.
PUBLIC COMMENT
Members of the public may speak to agendized items. If you wish to address the Committee on any issue that is on this agenda, please complete a speaker request card located on the table at the entrance to the Council
Chambers/Community Meeting Room, and deliver it to the Clerk prior to discussion of the item. You are not
required to give your name on the speaker card in order to speak to the Committee, but it is very helpful. Public
comment may be addressed to the full Policy and Services Committee via email at City.Council@cityofpaloalto.org.
Call to Order
Oral Communications
Members of the public may speak to any item NOT on the agenda.
Action Items
1.Recommendation that Policy and Services Committee Review and
Recommend to the City Council Acceptance of the Business Registry
Audit
2.Auditor's Office Quarterly Report as of June 30, 2018
3.Staff Recommendation That the Policy and Services Committee Review
and Recommend to the City Council Acceptance of the Fiscal Year 2019
Audit Work Plan
Future Meetings and Agendas
Adjournment
AMERICANS WITH DISABILITY ACT (ADA) Persons with disabilities who require auxiliary aids or services in using City facilities, services or programs or who would like information on the City’s compliance with the Americans with Disabilities Act (ADA) of 1990, may
contact (650) 329-2550 (Voice) 24 hours in advance.
CITY OF PALO ALTO OFFICE OF THE CITY AUDITOR
September 11, 2018
The Honorable City Council
Palo Alto, California
Staff recommends the Policy and Services Committee review and
recommend to the City Council acceptance of the Business Registry
Audit
In accordance with the Fiscal Year 2018 Annual Audit Work Plan, the Office of the City Auditor
has completed the Business Registry audit. The audit report presents one finding and three
recommendations. The Office of the City Auditor recommends that the Policy and Services
Committee review and recommend to the City Council acceptance of the Business Registry
audit.
Respectfully submitted,
Harriet Richardson
City Auditor
ATTACHMENTS:
x Attachment A: Business Registry Audit (PDF)
Department Head: Harriet Richardson, City Auditor
Page 2
Business Registry Audit
August 28, 2018
Office of the City Auditor
Harriet Richardson, City Auditor
Houman Boussina, Senior Performance Auditor
Attachment A
Page intentionally left blank for double-sided printing
Attachment A
Office of the City Auditor ● 250 Hamilton Avenue, 7th Floor ● Palo Alto, CA 94301 ● 650.329.2667
Copies of the full report are available on the Office of the City Auditor website at:
http://www.cityofpaloalto.org/gov/depts/aud/reports/performance/default.asp
OFFICE OF THE CITY AUDITOR
EXECUTIVE SUMMARY
Business Registry Audit
August 28, 2018
PURPOSE OF THE AUDIT
The purpose of this audit was to assess the City’s business registry rules, processes, and data and provide
recommendations to improve and maintain data quality.
CONCLUSION
The City’s business registry data was not reliable. Data that MuniServices LLC started collecting under
contract with the City in 2018 should be more reliable, but there is opportunity for further improvement.
REPORT HIGHLIGHTS
Finding:
(Page 4)
Some of the City’s business registry data from 2015 to 2017 was inaccurate,
incomplete, and inconsistent, and the registry data showed business trends that
were inconsistent with comparable economic data. Although the City staff
planned to collect complete, accurate, and useful data, it did not have a process
to validate the accuracy and completeness of the registry data it collected and
the self-reporting nature of the program made it difficult to validate the data.
MuniServices’ processes to administer the City’s registry should result in more
reliable data starting in 2018, but there are opportunities to improve the quality
of the data even more.
Key Recommendations:
• Review and modify the questions, as necessary, that the City asks businesses
to self-report and identify the type and sources of other data that can
improve the accuracy of data collected.
• Develop a broader strategy to improve the reliability of the business registry
and supplement data that businesses self-report by exploring and assessing
the cost versus benefit of options such as obtaining data that is available
from external reliable sources, providing to MuniServices other business data
that the City has available, and conducting in-person observations of
businesses to physically identify where businesses are located.
• Update the Development Services Department’s business registry
administrative manual to reflect Development Services’ new project
management and contract administrator roles and responsibilities.
Attachment A
Page intentionally left blank for double-sided printing
Attachment A
TABLE OF CONTENTS
Objective ................................................................................................................................................. 1
Background ............................................................................................................................................. 1
Scope ...................................................................................................................................................... 2
Methodology .......................................................................................................................................... 2
Finding:
The City’s business registry data was not reliable. Data that MuniServices LLC started collecting
under contract with the City in 2018 should be more reliable, but there is opportunity for further
improvement. .................................................................................................................................... 4
Recommendations ............................................................................................................................. 8
Appendix: City Manager’s Response ................................................................................................... 10
ABBREVIATIONS
BID Business Improvement District
LLC Limited Liability Company
NAICS North American Industry Classification System
PAMC Palo Alto Municipal Code
SUSB U.S. Census Bureau’s Statistics of U.S. businesses
Attachment A
Page intentionally left blank for double-sided printing
Attachment A
Business Registry Audit 1
INTRODUCTION
Objective The purpose of this audit was to assess the City’s business
registry rules, processes, and data and provide recommendations
to improve and maintain data quality.
Background In 2014, City Council directed staff to quickly plan a business
registry program with the following specifications:
• Online, simple to use, and integrated with the City’s existing
permit management system (Accela) technology.
• Include useful information for planning purposes (e.g.,
number of employees, business type) on City businesses that
occupy commercial spaces.
• Cost recovery in nature (i.e., not meant to generate
additional revenue for the City).
• Include plans for outreach, marketing, and enforcement.
• Ready to launch by December 31, 2014.
The City launched the business registry program in March 2015,
and the City Council has since continued to provide specific
direction on program management to:
• Enhance and refine the business registry online system and
questionnaire.
• Exempt small businesses, small nonprofits, and religious
organizations.
• Explore mechanisms for ensuring compliance.
• Obtain a third-party database as a point of comparison for
the registry.
The Development Services Department (Development Services)
administers the City’s business registry in accordance with Palo
Alto Municipal Code (Municipal Code) Chapter 4.60, which
requires every person who conducts any business in a fixed place
in Palo Alto to complete an application and pay a fee to obtain a
business registration certificate annually. Starting in 2015, the
City required Palo Alto businesses, with some exemptions, to
provide information about their businesses based on Council-
approved questions.1 Development Services administered the
1 Small businesses and nonprofits with less than one employee on site, religious organizations, home-based businesses, and
transitory businesses are exempt from the business registration process.
Attachment A
2 Business Registry Audit
business registry from 2015 to 2017. It collected and stored
business registry surveys electronically in its database to provide
information for managing land use, transportation, and zoning.
In January 2018, the City entered into a two-year, $85,000
agreement with MuniServices LLC to administer the City’s
business registry program. Development Services staff who
administered the business registry now manage the contract and
serve as a liaison between the City and MuniServices.
Scope We reviewed the City’s business registry administration process
and data from 2015 through 2017. Because the City transitioned
administration of its business registry to MuniServices in 2018,
we could not assess registration data for 2018, which
MuniServices was in process of gathering as we conducted the
audit.
Methodology To accomplish our objective, we:
• Identified and reviewed applicable regulations, policies, and
procedures, including PAMC Chapter 4.60 and the Business
Registry Administrative Manual.
• Interviewed Development Services staff to understand the
processes used to administer the business registry from 2015
to 2017.
• Reviewed the City’s contract with MuniServices and
interviewed MuniServices staff to understand how
MuniServices plans to administer the City’s business registry
starting in 2018.
• Compared the City’s business registry data with U.S. Census
Bureau business registration data for Palo Alto and Santa Clara
County.
• Assessed the completeness and consistency of existing
business registry data that the City collected from 2015 to
2017.
Data reliability Our audit objective included assessing the reliability of the
business registry data (see Objective, Scope, and Methodology
sections above). Because this was the focus of our audit, we
addressed our conclusions regarding the reliability of business
registry data in our audit finding. Because the U.S. Census Bureau
Attachment A
Business Registry Audit 3
is commonly accepted as a reliable source of data, we did not
assess the reliability of its business registration data
Compliance with government
auditing standards
We conducted this business registry audit in accordance with our
FY 2018 Annual Audit Work Plan and generally accepted
government auditing standards. Those standards require that we
plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the
evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objectives.
We would like to thank management and staff in the Development Services Department for their
time, cooperation, and assistance during the audit process.
Attachment A
4 Business Registry Audit
Finding The City’s business registry data was not reliable. Data that
MuniServices LLC started collecting under contract with the City
in 2018 should be more reliable, but there is opportunity for
further improvement.
Summary Some of the City’s business registry data from 2015 to 2017 was
inaccurate, incomplete, and inconsistent, and the registry data
showed business trends that were inconsistent with comparable
economic data. Although City staff planned to collect complete,
accurate, and useful data, it did not have a process to validate
the accuracy and completeness of the registry data it collected
and the self-reporting nature of the program made it difficult to
validate the data. MuniServices’ processes to administer the
City’s registry should result in more reliable data starting in 2018,
but there are opportunities to improve the quality of the data
even more.
Duplicate, inconsistent, and
incomplete data
The City’s 2015 to 2017 business registry data contained
numerous duplicate, inconsistent, or incomplete records, which
limit the usefulness of the data and could cause incorrect
conclusions about year-over-year business trends. For example:
• The registry included three fictional business records named
“Test Complete Application” that were entered in 2016, each
showing 618 employees, 739 leased parking spaces, and 860
provided parking spaces. The registry also included duplicate
records for some registered businesses. Development
Services staff cannot delete any registry records due to
system limitations but are aware of the test and duplicate
records, which they manually remove when making the data
available to others.2
• Some registry records had incomplete information (e.g.,
street number, phone number, email address). Some registry
records were also formatted inconsistently (e.g., inconsistent
capitalization and abbreviations). Incomplete and
inconsistent data make it difficult to identify duplicate or
missing business records, maintain an accurate registry
mailing list, and use software to visualize businesses on a
map.
2 The City provides public access to nonconfidential business registry data in its Open Data Portal at
http://data.cityofpaloalto.org/home.
Attachment A
Business Registry Audit 5
• Some businesses did not consistently classify themselves
from year to year. For example, a business may have
reported that it was a professional and general business
corporation in one year and general retail in another year.
Data standardization, including use of consistent and
commonly-accepted terms to classify businesses, makes it
possible to efficiently summarize, report, and analyze data
and trends. Having accurate business classifications can also
ensure that only businesses that meet the City’s business
registry exemptions are provided the exemption. Using an
industry-accepted classification methodology, such as the
North American Industry Classification System (NAICS) could
improve the reliability of business classifications.3 For
example, Retail Trade is one of 20 NAICS sectors, and
includes 66 broad industry subcategories, such as car
dealerships, clothing stores, pet stores, pharmacies, and
household appliance stores. The subcategories are further
broken down into specific types of establishments. For
example, the Nursery, Garden Center, and Farm Supply
Stores industry and the Hobby, Toy, and Game Stores
industry each include 6 specific types of establishments.
Businesses registry data
inconsistent with comparable
economic data
The business registry showed a significant decline in the number
of businesses and employees from 2015 to 2017 (Exhibit 1) that
may be in part due to:
• A Municipal Code amendment in 2016 to exempt small
businesses and nonprofit agencies from business registration.
• Businesses that did not respond to the City’s registry survey.
• Inconsistencies between how businesses counted the
number of employees to report to the City each year.
3 NAICS is used by federal statistical agencies to uniformly classify businesses based on the types of services and products
they provide for the purpose of collecting, analyzing, and publishing statistical data related to the U.S. business economy.
The U.S. Economic Classification Policy Committee, Statistics Canada, and Mexico’s Instituto Nacional de Estadistica y
Geografia jointly developed NAICS to allow for a high level of comparability in business statistics among the North
American countries.
Attachment A
6 Business Registry Audit
EXHIBIT 1
Business Registry Trends
Year Certificates+ Establishments+ Employees Square Feet Leased Parking Provided Parking
2015 2,589 2,912 75,082 32,644,221 3,746 69,053
2016 2,147 2,451 81,218 35,445,059 7,661 73,980
2017 1,929 2,225 68,514 29,364,348 7,289 67,624
Change from:
2015 to 2017 -25% -24% -9% -10% +95% -2%
+ Certificates correspond to the number of primary business establishments. Total establishments includes both the primary
business and any secondary business locations recorded in the registry.
SOURCE: City of Palo Alto Business Registry
However, the decline is inconsistent with other data showing
that the City had an overall positive economic trend during this
period. U.S. Census data and sales tax data can be used as a
proxy to show that the registry data is not sufficiently reliable.
U.S. Census data from 2011 to 2016 (the most recent data
available) show that the number of Palo Alto business
establishments increased at least 2 percent each year. It shows
that Palo Alto had 3,880 business establishments and 116,932
paid employees in 2016, compared to 2,451 establishments and
81,218 employees shown in the City’s business registry, a
difference of 1,429 establishments and 35,714 employees.4
Other comparable economic data show continued economic
growth that is also inconsistent with the business registry data.
For example, MuniServices’ data show a 5 percent year-over-
year increase in Palo Alto sales tax from 2015 to 2016 and from
2016 to 2017.
No past City process to validate
the accuracy and completeness
of 2015-2017 registry data
Palo Alto businesses are responsible for reporting accurate
information about their businesses, such as the number of
employees and parking spaces, in the City’s annual registry
survey. Development Services had a manual that provided an
overview of the registry administration process, but it did not
include a data dictionary or describe how to collect and maintain
reliable data. Development Services did not have sufficient
4 The U.S. Census Bureau’s Statistics of U.S. Businesses (SUSB) program provides the only source of annual, complete, and
consistent enterprise-level data for U.S. businesses, with industry detail at: https://www.census.gov/programs-
surveys/susb.html. SUSB data are from the Business Register, which contains the Census Bureau’s most complete,
current, and consistent data for U.S. business establishments taken from economic censuses, business surveys, Federal
tax records, and other departmental and federal statistics. SUSB data are available 24 months after each reference year
and include the number of firms, number of establishments, annual payroll, and employment.
Attachment A
Business Registry Audit 7
policies, procedures, tools, or practices to ensure data reliability,
such as:
• Business registry system settings to prevent errors or
inconsistencies in data entry and formatting.
• Data analytic software to identify and correct unreliable
records, including duplicate records.
• Unique accounts assigned for each Palo Alto business to help
better track businesses, maintain reliable data, and avoid the
manual process to update the registry mailing list each year.
Clarifying uses of the business
registry can help improve
reliability and relevance of the
data
The purpose of the business registry is broadly stated as to
provide information for managing land use, transportation, and
zoning. To provide reliable and useful information, the registry
should include all Palo Alto businesses and their addresses, even
if some are exempt from paying a registry fee. Although the City
Council and staff have provided input on the business registry
questionnaire, the questions have remained generally
unchanged since 2015. We did not identify any ongoing City
process that uses the data, which suggests that the data does not
currently meet the City’s business needs or address its changing
priorities. Being more specific about the potential uses of the
business registry can help inform the types of questions that
should be included in the registry questionnaire and the data the
City collects, as well as help focus the City’s efforts and resources
to maintain the reliability of the data.
MuniServices’s process to
administer the City’s registry
should result in more reliable
data
In 2018, Development Services contracted with MuniServices to
administer the City’s business registry. MuniServices has
established some quality control processes that should result in
more reliable data, including:
• Correcting the City’s existing mailing list of Palo Alto
businesses (e.g., removing duplicate business addresses).
• Assigning unique, password-protected user accounts for Palo
Alto businesses in the MuniServices online business registry
system.
Attachment A
8 Business Registry Audit
• Comparing business registry data with the City’s business
improvement district (BID) data to identify businesses that
may be included in one but not the other data set.5
However, the contract does not specify what comparable data
MuniServices should use to verify the accuracy of the business
registry or the frequency for making such comparisons.
MuniServices plans to use the City’s (BID) data and other data
available to them to ensure that the registry is reliable going
forward. Although this should help improve the reliability of
business registry data starting in 2018, the comparison with the
City’s (BID) data may be of limited value because that program
exempts businesses not within its boundaries.
Opportunities for improved data MuniServices offers services that are outside of the City’s
contract scope that could address some of the concerns we
identified and further improve the registry data such as:
• Comparing business registry records with other databases,
such as MuniServices’s proprietary data or the City’s utilities
customer billing data (e.g., customer name and address), to
identify businesses that are not registered.
• In-person observation of businesses to see where businesses
exist. According to MuniServices, this process may be costly
and unpopular with businesses. However, it would provide a
means of validating the completeness and accuracy of
registry data. A more limited approach is for City staff to
verify that a business is registered when the City receives a
code enforcement complaint about a business or when a
business applies for a permit.
Recommendations We recommend that the City Manager:
1. Identify and consult with key stakeholders (e.g., City Council,
Planning and Community Environment Department) who use
the business registry to clarify existing and potential uses and
priorities for business registry data. Based on these
consultations, review and modify the questions, as necessary,
that the City asks businesses to self-report.
5 MuniServices also administers the City’s Business Improvement District assessment program, which requires businesses within certain
geographic boundaries in Palo Alto to pay a fee that partially funds the activities of the Palo Alto Downtown Business and Professional
Association.
Attachment A
Business Registry Audit 9
2. As part of a broader strategy to improve the reliability of the
business registry, explore and assess the cost versus benefit
of the following options, which may work in synergy:
• Identify the type and sources of external data that can
improve the accuracy of data collected. This could
include, for example, using the U.S. Census Bureau’s
Statistics of U.S. Businesses program data, either by itself
or together with other available data, to validate business
registry data and identify potentially unregistered
businesses.
• Provide City data to MuniServices to help improve and
monitor the reliability of the registry data (e.g., validation
of registration when code violations are reported against
a business or when a business applies for a permit,
utilities customer data).
• Gather data from in-person observations of City
businesses. If the City decides to conduct in-person
observations, it should work with MuniServices to plan,
conduct, and accurately record the observations in a
useful format. Alternatively, this could include hiring
temporary help to physically identify where businesses
are located in the City to supplement data self-reported
by businesses or through other data sources and to
improve the accuracy of future updates.
3. Update the Development Services business registry
administrative manual to reflect Development Services’ new
project management and contract administrator roles and
responsibilities. The update should incorporate:
• The City’s guidelines for contract administration roles and
responsibilities that are available in the City’s Procurement
Fundamentals Training Guide.
• Specific steps to monitor the reliability of the registry data.
This can include basic steps to periodically review trends
and validate the consistency, accuracy, and completeness
of a sample of registry records by comparing them with
other City or publicly available databases.
Attachment A
10 Business Registry Audit
APPENDIX – City Manager’s Response
Attachment A
Business Registry Audit 11
Attachment A
12 Business Registry Audit
The City Manager has agreed to take the following actions in response to the audit recommendations in this report. The City Manager will report
progress on implementation six months after the Council accepts the audit report, and every six months thereafter until all recommendations have been
implemented.
Recommendation
Responsible
Department(s)
Agree, Partially Agree, or Do Not
Agree and Target Date and Corrective
Action Plan
To be completed 6 months after Council acceptance and every 6
months thereafter until all recommendations are implemented
Current
Status
Implementation Update and
Expected Completion Date
Finding: The City’s business registry data was not reliable. Data that MuniServices LLC started collecting under contract with the City in 2018 should
be more reliable, but there is opportunity for further improvement.
To improve and maintain the quality of the City’s business registry data, we recommend that the City Manager:
1. Identify and consult with key
stakeholders (e.g., City Council,
Planning and Community
Environment Department) who use
the business registry to clarify
existing and potential uses and
priorities for business registry data.
Based on these consultations, review
and modify the questions, as
necessary, that the City asks
businesses to self-report.
City Manager’s
Office,
Development
Services,
Planning and
Community
Environment,
and
Transportation
Agree
Target Date: June 30, 2019
Corrective Action Plan:
Development Services Department (DSD)
will lead an effort to gather feedback from
internal department stakeholders as
noted in the column to the left. The
department may also discuss the registry
with external stakeholders. Staff will
return to City Council for a
recommendation prior to the 2020
Business Registry cycle.
2. As part of a broader strategy to
improve the reliability of the business
registry, explore and assess the cost
versus benefit of the following
options, which may work in synergy:
• Identify the type and sources of
external data that can improve
the accuracy of data collected.
This could include, for example,
using the U.S. Census Bureau’s
DSD Agree
Target Date: June 30, 2019
Corrective Action Plan:
DSD agrees to explore and assess the cost
versus the benefit of the suggested
options. Staff will return to the City
Council during the Fiscal Year 2020
budget cycle with any associated program
recommendations.
Attachment A
Business Registry Audit 13
Recommendation
Responsible
Department(s)
Agree, Partially Agree, or Do Not
Agree and Target Date and Corrective
Action Plan
To be completed 6 months after Council acceptance and every 6
months thereafter until all recommendations are implemented
Current
Status
Implementation Update and
Expected Completion Date
Statistics of U.S. Businesses
program data, either by itself or
together with other available
data, to validate business registry
data and identify potentially
unregistered businesses.
• Provide City data to MuniServices
to help improve and monitor the
reliability of the registry data
(e.g., validation of registration
when code violations are
reported against a business or
when a business applies for a
permit, utilities customer data).
• Gather data from in-person
observations of City businesses. If
the City decides to conduct in-
person observations, it should
work with MuniServices to plan,
conduct, and accurately record
the observations in a useful
format. Alternatively, this could
include hiring temporary help to
physically identify where
businesses are located in the City
to supplement data self-reported
by businesses or through other
data sources and to improve the
accuracy of future updates.
Staff does intend to utilize MuniServices
business discovery and analytics services
prior to the 2019 Business Registry cycle.
This service will utilize external sources
acquired by MuniServices. Staff will also
meet with the Utilities and Information
Technology departments to discuss data
sharing.
3. Update the Development Services
business registry administrative
manual to reflect Development
DSD & ATT Agree
Target Date: December 31, 2018
Attachment A
14 Business Registry Audit
Recommendation
Responsible
Department(s)
Agree, Partially Agree, or Do Not
Agree and Target Date and Corrective
Action Plan
To be completed 6 months after Council acceptance and every 6
months thereafter until all recommendations are implemented
Current
Status
Implementation Update and
Expected Completion Date
Services’ new project management
and contract administrator roles and
responsibilities. The update should
incorporate:
• The City’s guidelines for contract
administration roles and
responsibilities that are available
in the City’s Procurement
Fundamentals Training Guide.
• Specific steps to monitor the
reliability of the registry data.
This can include basic steps to
periodically review trends and
validate the consistency,
accuracy, and completeness of a
sample of registry records by
comparing them with other City
or publicly available databases.
Corrective Action Plan:
DSD will update the administrative
manual prior to the 2019 Business
Registry Cycle. Staff does intend to review
reliability of the registry data prior to the
launch of each annual collection cycle and
to include reference to this practice in the
administrative manual.
Attachment A
CITY OF PALO ALTO OFFICE OF THE CITY AUDITOR
September 11, 2018
The Honorable City Council
Palo Alto, California
Auditor's Office Quarterly Report as of June 30, 2018
RECOMMENDATION
The City Auditor’s Office recommends the Policy and Services Committee review and
recommend to the City Council acceptance of the Auditor’s Office Quarterly Report as of June
30, 2018.
SUMMARY OF RESULTS
In accordance with the Municipal Code, the City Auditor prepares an annual work plan and
issues quarterly reports to the City Council describing the status and progress towards
completion of the work plan. This report provides the City Council with an update on the fourth
quarter for FY 2018.
Respectfully submitted,
Harriet Richardson
City Auditor
ATTACHMENTS:
Attachment A: Auditor's Office Quarterly Report as of June 30, 2018 (PDF)
Department Head: Harriet Richardson, City Auditor
Page 2
Quarterly Report as of June 30, 2018
Office of the City Auditor
“Promoting honest, efficient, effective, economical, and fully
accountable and transparent city government.”
Attachment A
PAGE 2
Fiscal Year (FY) 2018 Fourth Quarter Update (April – June 2018)
Overview
The audit function is essential to the City of Palo Alto’s public accountability. The mission of the Office of the City Auditor,
as mandated by the City Charter and Municipal Code, is to promote honest, efficient, effective, economical, and fully
accountable and transparent city government. We conduct performance audits and reviews to provide the City Council
and City management with information and evaluations regarding how effectively and efficiently resources are used; the
adequacy of internal control systems; and compliance with policies, procedures, and regulatory requirements. Taking
appropriate action on our audit recommendations helps the City reduce risks and protect its good reputation.
Activity Highlights
Senior Performance Auditor Mimi Nguyen presented a brown bag session to Utilities staff on the annual
performance report and key performance indicators.
City Auditor Harriet Richardson was nominated for and received the David M. Walker award for Excellence in
Government Performance and Accountability at the Biennial Intergovernmental Audit Forum in May 2018.
City Auditor Harriet Richardson, at the request of the Government Accounting Standards Board (GASB),
attended a GASB Board meeting to present the Association of Local Government’s position on the GASB’s
invitation to comment on major issues related to revenue and expense recognition.
City Auditor Harriet Richardson accepted an invitation and went to Keys School, along with other City staff, to
discuss activities and responsibilities and respond to students’ questions about how City government works.
Audit and Project Work
Below is a summary of our audit and project work for the fourth quarter of FY 2018:
Title Objective(s) Start
Date
End
Date
Status Results/Comments
Enterprise
Resource
Planning (ERP)
Planning Audit:
Data and System
Governance and
Security
Evaluate the adequacy of data and
system governance and security in the
current SAP system and make
recommendations to ensure that
identified deficiencies are corrected for
the new ERP system.
05/17 06/18 Complete This audit is complete and was
presented at the June 2018
Policy and Services Committee
meeting.
ERP Planning
Audit: Data
Reliability and
Integrity – Data
Standardization
This is the first in a series of audits that
focus on evaluating the integrity and
reliability of data in SAP and making
recommendations to ensure that
identified deficiencies are corrected
prior to transferring data to the new
ERP system. This audit focuses on
identifying where standardizing data
would be beneficial when
implementing the new ERP system
05/17 08/18 In Process This audit is in the report
writing phase, and we expect
to complete it in August 2018.
Attachment A
PAGE 3
Title Objective(s) Start
Date
End
Date
Status Results/Comments
Code
Enforcement
Audit
Evaluate the timeliness and
effectiveness of code enforcement
actions, the effectiveness of
communication with the public, and the
accuracy and completeness of code
enforcement case tracking for decision
making purposes. We conducted a
resident survey to help inform our audit
recommendations, as described below.
05/17 08/18 In Process The audit is in the report
writing phase, and we expect
to complete it in August 2018.
ERP Planning
Audit: Separation
of Duties
Evaluate the adequacy of separation of
duties for various activities in the
current SAP system and make
recommendations to ensure that
identified deficiencies are corrected for
the new ERP system.
05/17 08/18 In Process This audit is in the report
writing phase, and we expect
to complete it in August 2018.
ERP Planning
Audit: Data
Reliability and
Integrity – Data
Standardization‐
Human
Resources/
Payroll Data
This is the second in a series of audits
that focus on evaluating the integrity
and reliability of data in SAP and
making recommendations to ensure
that identified deficiencies are
corrected prior to transferring data to
the new ERP system. This audit focuses
on assessing the accuracy of employee
master data, such as name, address,
birthdate, and social security number.
09/17 08/18 In Process This audit is in the report
writing phase, and we expect
to complete it in August 2018.
Business Registry Evaluate the rules and processes used
to establish the business registry and
make recommendations to help clean
up the data and ensure accuracy in the
future.
02/18 08/18 In Process This audit is in the report
writing phase, and we expect
to complete it in August 2018.
Mobile Device
Inventory and
Security
Determine if the City accurately
inventories and securely manages city‐
owned mobile devices, including
laptops, tablets, cell/smart phones, and
radios.
03/18 10/18 In Process This audit is in the planning
phase. We expect to complete
the audit in late 2018.
Transferable
Development
Rights
Determine if the City maintains an
accurate and complete record of the
transferable development rights (both
City‐owned and non‐City‐owned) that
have been certified, transferred, and
used to date.
06/18 02/19 In Process This audit is in the planning
phase. We expect to complete
the audit in early 2019.
Nonprofit
Organizations
Audit
Evaluate whether nonprofit
organizations that receive City funding
are achieving the outcomes we expect
from the funding we provide.
06/18 02/19 In Process This audit is in the planning
phase. We expect to complete
the audit in early 2019.
Attachment A
PAGE 4
Title Objective(s) Start
Date
End
Date
Status Results/Comments
Contract
Oversight
Select a sample of contracts to evaluate
the contract oversight process by
determining if the City has adequate
processes to ensure that the City
receives the goods and services it paid
for, that contracts did not result in
unnecessary overlaps in services, and
that contract extensions and change
orders were appropriate.
06/18 02/19 In Process This audit is in the planning
phase. We expect to complete
the audit in early 2019.
ERP Nonaudit
Service
Provide advisory services to the
Department of Information Technology
regarding its planning of a new ERP
system.
09/16 N/A Ongoing We attended 10 tactical team
meetings during the fourth
quarter of FY 2018 and
provided verbal advice based
on our technical expertise and
best practice information
readily available to us. Our
interaction with the tactical
team was limited because the
team was focused on
evaluating the responses
received to the Request for
Proposals for the new ERP
system. Once the City has
made a decision regarding
how to move forward with a
new ERP system, we will
resume our involvement in
this nonaudit service, with a
focus on assisting the City with
addressing the issues we
identified during the ERP
planning phase and prior
audits.
National Citizen
Survey™
Obtain resident opinions about the
community and services provided by
the City of Palo Alto and benchmark
our results against other jurisdictions.
06/18 01/19 In Process Surveyed City departments
and Councilmembers to
identify questions that could
be eliminated to reduce the
length of the survey and
potentially increase the
response rate. Coordinated
the changes with the National
Research Center to finalize the
survey document. Survey is
expected to be distributed to
4,500 residents, an increase of
1,500 residents over previous
years, in early August 2018.
Attachment A
PAGE 5
Other Monitoring and Administrative Assignments
Below is a summary of other assignments as of June 30, 2018:
Title Objective(s) Status Results/Comments
City Auditor
Advisory Roles
Provide guidance and advice to
key governance committees
within the City.
Ongoing The City Auditor serves as an advisor to the Utilities Risk
Oversight Committee and Information Security Steering
Committee. We are also serving as an advisor for the
strategic and technical planning groups for planning the
new ERP system (see comment in the Audit and Project
Work section above).
Sales and Use
Tax Allocation
Reviews
1) Identify businesses that do
business in Palo Alto that may
have underreported or misallo‐
cated their sales and use tax and
submit inquiries to the state for
review and tax reallocation.
2) Monitor sales taxes received
from the Stanford University
Medical Center Project and
notify Stanford of any differences
between their reported taxes
and state sales tax information,
in accordance with the
development agreement.
3) Provide Quarterly Status
Updates and Sales Tax Digest
Summaries for Council review.
Ongoing 1) Total sales and use tax recoveries for the fourth quarter
of FY 2018 were $56,810 from our inquiries and $100,333
from the vendor’s inquiries, for a total of $157,143 for the
quarter and $470,263 for the fiscal year‐to‐date. Due to
processing delays at the State Board of Equalization, 36
potential misallocations are waiting to be researched and
processed: 15 from our office and 21 from the vendor.
2) The City of Palo Alto received $784,802 as a result of
the Stanford Medicine development project for calendar
year 2017. The amount included $785,687 for calendar
year 2017 and reduction of $885 for prior year
adjustments. The City has received $3,681,743 for
calendar years 2011 through 2017 as a result of the
development agreement for this project.
3) Quarterly sales tax reports are published on the Office
of the City Auditor website at
www.cityofpaloalto.org/gov/depts/aud/reports/default.asp.
Status of Audit Recommendations
Fifty‐three recommendations were open at the beginning of the fourth quarter of FY 2018, and six were closed. We
added four recommendations during the quarter, which resulted in 51 recommendations open at the end of the quarter.
Five status reports were presented during the quarter, and two are past due. Those two, plus four others will be
scheduled for updates during the first quarter of FY 2019. Below is a summary of the open audit recommendations as of
June 30, 2018:
Audit Title and
Report Date
Due Date and
Prior Status
Report Dates
Total
Recommendations/
Number Open Summary of Open Recommendations
Citywide Cash
Handling and Travel
Expense
Issued 09/15/10
Due – 09/18
03/21/18
08/22/17
11/10/15
09/23/14
09/10/13
10/22/12
04/19/11
Recommendations: 11
Open: 1
Implemented during
quarter: 0
Review practice of reimbursing employee meals
when not in a travel status and report the amounts as
income to employees to conform to Internal Revenue
Service requirements (ASD)
Attachment A
PAGE 6
Audit Title and
Report Date
Due Date and
Prior Status
Report Dates
Total
Recommendations/
Number Open Summary of Open Recommendations
Inventory
Management
Issued 02/18/14
Past Due
11/02/17
09/23/14
Recommendations: 14
Open: 4
Implemented during
quarter: 0
Implement City’s inventory management policies and
procedures (ASD/UTL/PWD/IT)
Update and enforce inventory count policies and
procedures to ensure consistent and accurate
inventory records (ASD)
Identify, formalize, and communicate inventory
management goals and objectives to City
departments (ASD)
Ensure staff identify and use key SAP inventory
management reports and appropriately configure and
update SAP parameters that affect inventory levels
(ASD/IT)
Utility Meters:
Procurement,
Inventory, and
Retirement
Issued 03/10/15
Past Due
11/02/17
Recommendations: 15
Open: 1
Implemented during
quarter: 0
Correct purchase order documents to accurately
reflect engineering specifications (ASD)
NOTE: Two recommendations were closed because they
were deemed to be no longer relevant.
Parking Funds
Issued 12/15/15
Due – 12/18
06/21/18
11/14/17
Recommendations: 8
Open: 1
Implemented during
quarter: 2
Develop policies and procedures to clarify roles and
responsibilities and ensure accurate calculation and
reporting of parking‐in‐lieu fees (PCE, ASD, PWD, CLK)
Disability Rates and
Workers’
Compensation
Issued 05/10/16
Due – 08/18
02/13/18
Recommendations: 15
Open: 8
Implemented during
quarter: 0
Update the safety manual/supplemental tools (HR)
Review departmental procedures and safety
requirements to ensure they align with citywide
policies and procedures (HR)
Identify and provide industry‐specific ergonomics and
general wellness training opportunities (HR)
Address the disability leave benefits incorrectly
reported as compensation to CalPERS (HR)
Review claims that had differences in additional city
benefits and correct any errors identified (HR)
Determine optimal structure, update tools and
procedures, and allocate sufficient and skilled
resources to ensure accuracy of benefit eligibility and
work status of injured employees (HR)
Ensure that data for managing disability leave is
accurately captured through SAP time reporting (HR)
Identify useful performance measures and establish
procedures to ensure reliable reporting (HR)
Attachment A
PAGE 7
Audit Title and
Report Date
Due Date and
Prior Status
Report Dates
Total
Recommendations/
Number Open Summary of Open Recommendations
Cable Franchise and
Public, Education,
and Government
(PEG) Fees
Issued 06/14/16
Due – 09/18
03/21/18
08/22/17
Recommendations: 9
Open: 6
Implemented during
quarter: 0
Assess ongoing need for PEG fees; place fees in
restricted account until decisions are made about use
of fees (CMO/ATTY/ASD/IT)
Determine whether to allocate unrestricted funds,
instead of PEG fees, to subsidize the Media Center’s
operations. (CMO/ATTY/ASD/IT)
Send letters to cable companies to demand payment
of underpaid franchise and PEG fees
(CMO/ATTY/ASD/IT)
Develop criteria for assessing the accuracy of future
cable franchise and PEG fee payments and require
more detail with payment remittances (ASD)
Assign responsibility for the cable communications
program and provide effective oversight of the
program (CMO/CLK)
Draft an ordinance to update the Palo Alto Municipal
Code based on clarified assignment of responsibility
(CMO/ASD/ATTY/CLK)
Community Services
Department (CSD):
Fee Schedule Audit
Issued 02/14/17
Due – 12/18
06/21/18
11/14/17
Recommendations: 3
Open: 2
Implemented during
quarter: 0
Revise City’s cost recovery policy to align with
relevant laws and reconfigure the Questica budget
system to support fees that recover more than
100 percent of costs (ASD)
Configure SAP or the new ERP system to align cost
centers with CSD programs (CSD)
Continuous
Monitoring:
Payments
Issued 04/13/17
Due – 09/18
03/21/18
Recommendations: 7
Open: 5
Implemented during
quarter: 0
Build a continuous monitoring process into the new
ERP system to identify potential duplicate invoices
and seek recovery of duplicate payments (ASD)
Update invoice processing policies and procedures to
facilitate identification of duplicate payments (ASD)
Update policies and procedures to clarify guidance for
creation of vendor master records and develop
standardized coding vendor records (ASD)
Build a continuous monitoring process into the new
ERP system to identify duplicate, incomplete, or
unused vendor records (ASD)
Clean vendor master file before merging data into
new ERP system (ASD)
Attachment A
PAGE 8
Audit Title and
Report Date
Due Date and
Prior Status
Report Dates
Total
Recommendations/
Number Open Summary of Open Recommendations
Green Purchasing
Practices
Issued 04/13/17
Due – 12/18
06/21/18
Recommendations: 8
Open: 6
Implemented during
quarter: 0
Clearly define department(s) responsible for
implementing green purchasing policies and
determine if additional staffing and funding are
needed to implement the policies (ASD/CMO)
Develop consolidated procedures to implement green
purchasing policies (CMO/ASD/PWD)
Educate City staff on green purchasing policies (ASD)
Evaluate potential for use of 40 percent post‐
consumer fiber paper towels/other green janitorial
products and monitor janitorial contractor’s
compliance with green purchasing requirements
(PWD)
Evaluate if new e‐procurement system or other
technology solution can help with tracking and
reporting green purchases and establish appropriate
green purchasing performance measures (ASD/PWD)
Require vendors to provide data on amounts of green
products and services that City purchases from them
(ASD/PWD)
Utilities
Department: Cross
Bore Inspection
Contract
Issued 06/01/17
Due – 12/18
06/21/18
Recommendations: 4
Open: 4
Implemented during
quarter: 0
Prioritize uninspected sewer pipelines for inspection
and disclose potential inspection challenges in future
contract solicitations (UTL)
Identify and update missing data in laterals database
(UTL)
Incorporate relevant provisions from National
Association of Sewer Service Companies’ contract
template in future sewer inspection contracts (UTL)
Identify gaps in staff expertise and develop a training
and certification plan for field staff who will monitor
field inspections (UTL)
Accuracy of Water
Meter Billing
Issued 08/16/17
Due – 12/18
06/21/18
Recommendations: 11
Open: 7
Implemented during
quarter: 4
Review and correct meter records for meters larger
than 2 inches (UTL)
Explore options for addressing equity in meter size
rates (UTL)
Develop a policy and procedures to report significant,
systemic infrastructure changes to Council and
update City of Palo Alto Utilities’ (CPAU) Rules and
Regulations as needed (UTL)
Seek direction from Council before proceeding with
installing additional electronic meters (UTL)
Determine if installed eMeters should be replaced
and if billing adjustments are required (UTL)
Clarify purchasing policy and procedures for product
standardization and sole source (ASD)
Retrain staff on purchasing policies and procedures
and completion of required forms (ASD)
Attachment A
PAGE 9
Audit Title and
Report Date
Due Date and
Prior Status
Report Dates
Total
Recommendations/
Number Open Summary of Open Recommendations
Continuous
Monitoring:
Overtime
Issued 09/06/17
Due – 10/18
None
Recommendations: 2
Open: 2
Implemented during
quarter: 0
Explore potential of developing a continuous
monitoring process for overtime (ASD)
Form a work group to design standardized overtime
management processes in the new ERP environment
(ASD)
Information
Technology and
Data Governance
Due – 2/19
None
Recommendations: 4
Open: 4
Implemented during
quarter: 0
Assign roles and responsibilities for IT governance to
ensure that governance coveralls all key aspects of
the City’s information systems (IT)
Adopt an industry standard IT governance framework
and create a plan to achieve a process capability
model of “established” or higher (IT)
Assign roles and responsibilities for data governance
to ensure that governance coveralls all key aspects of
the City’s information systems (IT)
Adopt an industry standard data governance
framework and create a plan to achieve a process
capability model of “established” or higher (IT)
9
1
11
6
0
2
4
6
8
10
12
Q1 Q2 Q3 Q4
Number of Implemented
Recommendations by Quarter
21
17
13
0
20
40
60
80
100
Number of Open Recommendations
FY 18
FY 17
Prior Fiscal
Years
Attachment A
PAGE 10
Open Recommendations by Audit Issuance Date
Fiscal
Year
Audit Title Number of Open
Recommendations
2011 Citywide Cash Handling and Travel Expense 1 of 11
2014 Inventory Management 4 of 14
2015 Utility Meters: Procurement, Inventory, and Retirement 1 of 15
2016 Parking Funds 1 of 8
Cable Franchise and Public, Education, and Government (PEG) Fees 6 of 9
Disability Rates and Workers’ Compensation 8 of 15
2017 Community Services Department: Fee Schedule 2 of 3
Continuous Monitoring: Payments 5 of 7
Green Purchasing Practices 6 of 8
Utilities Department: Cross Bore Inspection Contract 4 of 4
2018 Accuracy of Water Meter Billing 7 of 11
Continuous Monitoring: Overtime 2 of 2
Information Technology and Data Governance 4 of 4
Fraud, Waste, and Abuse Hotline Administration
The hotline review committee, composed of the City Auditor, the City Attorney, and the City Manager, or their
designees, meets as needed to review hotline‐related activities. No complaints were received during the fourth quarter
of FY 2018. All prior‐year complaints have been closed. The chart below summarizes the status of complaints received in
each fiscal year since the hotline was implemented.
7
3 2
13
9
00
2
4
6
8
10
12
14
FY 2013 FY 2014 FY 2015 FY 2016 FY 2017 FY 2018
Status of Complaints Received by Fiscal Year
Closed Complaints
Open Complaints
Attachment A
CITY OF PALO ALTO OFFICE OF THE CITY AUDITOR
September 11, 2018
The Honorable City Council
Palo Alto, California
Staff Recommendation That the Policy and Services Committee
Review and Recommend to the City Council Acceptance of the Fiscal
Year 2019 Audit Work Plan
The Palo Alto Municipal Code requires the City Auditor to submit an annual audit work plan to
the City Council for review and approval. The attached report presents the proposed audit work
plan for Fiscal Year 2019, prepared based on Council priorities, risk, and the City Auditor’s
professional judgment. Once approved, we will issue quarterly reports summarizing the status
of each assignment. The work plan may be amended during the fiscal year subject to approval
of the City Council.
Respectfully submitted,
Harriet Richardson
City Auditor
ATTACHMENTS:
Attachment A: Fiscal Year 2019 Audit Work Plan (PDF)
Department Head: Harriet Richardson, City Auditor
Page 2
Attachment A
Fiscal Year 2019 Audit Work Plan
Office of the City Auditor
“Promoting honest, efficient, effective, economical, and fully
accountable and transparent city government”
Attachment A
Fiscal Year 2019 Audit Work Plan 2
Overview
The Palo Alto Municipal Code requires the City Auditor to submit an annual audit work plan to the City
Council for approval. This proposed audit work plan represents ongoing administrative responsibilities
of the Office of the City Auditor, as well as required audit and nonaudit service responsibilities. It
estimates approximately 8,900 hours of direct time1 for six full‐time staff. The hours allotted to each
audit and nonaudit service reflect our efforts to continue to increase our efficiency in conducting
performance audits.
The proposed audit work plan considers risk factors that, if addressed, will provide opportunities to
mitigate those risks and improve operations:
Operational – Are City programs/activities performed and City services delivered in the most
efficient, effective, and economical manner possible, and do they represent sound business
decisions, including appropriate responses to changes in the business environment?
Financial – Is there an opportunity to improve how the City manages, invests, spends, and
accounts for its financial resources?
Regulatory – Do City programs and activities comply with applicable laws and regulations?
Health and Safety – Are City services delivered in a manner that protects our residents and
employees from injury or unnecessary exposure to factors that can affect an individual’s
health?
Information Security – Is City, resident, and employee information (electronic or physical)
protected against unauthorized access, use, disclosure, disruption, modification, inspection,
recording, or destruction?
In addition, the proposed audit work plan considers several factors:
Relevance – Does the audit have the potential to affect Council or City management decision‐
making or impact City residents?
Best Practices – Does the audit provide the opportunity to compare current performance to
best practices?
Return on Investment – Does the audit have the potential for cost savings, cost avoidance, or
revenue generation?
Improvement – Does the audit have the potential to result in meaningful improvement in how
the City does its business?
Actionable – Is it likely that the audit will produce actionable recommendations that are
feasible and practical?
Manageable – Is the audit scope narrow enough to ensure it is completed in a timely manner?
The audit work plan also considers risks related to major functions within the Utilities Department, as
identified through a 2011 Utilities Risk Assessment, a 2013 Utilities Organizational Assessment
conducted by external consultants, and prior audits, as well as potential risks related to the planned
implementation of a new Enterprise Resource Planning (ERP) system.2
1 The estimated hours consider available time after accounting for holidays, vacation, required training, and administrative time.
2 An ERP System is the software and technology used to manage core business processes, such as accounting, payroll, and
human resources in an integrated manner.
Attachment A
Fiscal Year 2019 Audit Work Plan 3
Nonaudit Services and Special Projects
The following table lists nonaudit services and special projects for the FY 2019 audit work plan:
Project Scope Planned Hours
Annual Performance
Report
Annual. The annual performance report provides the City Council, City staff,
Palo Alto residents, and other stakeholders with relevant information and data
regarding the performance of City programs, functions, and activities.
275
Annual Performance
Report Transition
One Time. Provide training and assistance to departments on how to develop
relevant and meaningful performance measures and work with the City
Manager’s Office to develop a reporting process in preparation for
transitioning performance reporting to the City Manager’s Office.
125
Annual Citizen
Centric Report
Annual. The four‐page report highlights key financial data and data from the
annual Performance Report, and provides an overview of our City's economic
outlook. The Citizen Centric Report follows the Association of Government
Accountants' recommended format, which is designed to provide information
to the public about Palo Alto’s financial condition and performance in an easy‐
to‐understand and visually appealing format.
12
National Citizen
Survey
Annual. The National Research Center (NRC) conducts The National Citizen
Survey™ on behalf of the City of Palo Alto. The survey contains a series of
standardized questions that the NRC uses to benchmark Palo Alto residents’
opinions of City services against other jurisdictions, as well as several custom
questions. In addition to the NRC’s report, we analyze the results of key quality
of living indicators and tabulate the survey results in Tableau software to allow
users of the Palo Alto Open Data website to perform an interactive analysis of
the results (e.g., how people within different demographic categories
answered a question).
150
Sales Tax Allocation
Reviews
Ongoing. We identify misallocations and underreporting of local sales and use
tax through in‐house monitoring and a contract with an outside vendor
(currently MuniServices, LLC). We also look for opportunities to receive direct
allocation of sales and use tax on large commercial construction projects. We
report sales and use tax recoveries in quarterly reports to Council, and also
provide a quarterly sales and use tax information report which includes
information from MuniServices, LLC.
230
Fraud, Waste, and
Abuse Hotline
Administration and
Training
Ongoing. We receive notification of complaints filed through the hotline, reply
to the complainant, route and monitor cases for investigation, and convene
the Hotline Review Committee (City Manager, City Attorney, and City Auditor)
to determine the routing of cases and their closing upon completion of an
investigation. The hours include time to develop marketing materials that will
encourage employees to report fraud, waste, or abuse when they see it.
40
Annual External
Financial Audit
Annual. The Palo Alto Municipal Code requires the Office of the City Auditor to
contract with an independent certified public accounting firm (currently
Macias, Gini, & O’Connell, LLP) to conduct the annual external audit of the
City’s financial statements. The firm also conducts the federally required Single
Audit. We coordinate those efforts between the Administrative Services
Department and Macias, Gini, & O’Connell, LLP.
30
Enterprise Resource
Planning (ERP)
Advisory Project
Ongoing. Provide advisory services to the Department of Information
Technology regarding its planning of a new ERP system.
70
Attachment A
Fiscal Year 2019 Audit Work Plan 4
Project Scope Planned Hours
Review and Monitor
the Implementation
Status of Prior Audit
Recommendations
Ongoing. Review and provide feedback to departments on their reports of the
implementation status of prior audit recommendations. We include a
summary of the status in our Quarterly Reports.
220
Office of the City
Auditor Quarterly
Reports
Quarterly. Prepare and issue quarterly reports to the City Council to provide
the status and progress toward completion of our annual work plan, as
required by the Palo Alto Municipal Code.
60
Advisory Roles Ongoing. The City Auditor is a nonvoting, advisory member of the Utilities Risk
Oversight Committee, the Information Technology Governance Review Board,
the Information Security Steering Committee, and ERP Strategic and Technical
Planning Committees.
15
Grant Management/
Internal Control
Training
One‐time. Provide grant management and internal control training to
department staff who manage federal grants.
25
Total Hours for Special and Ongoing Projects 1252
Performance Audits
The following audits from our FY 2018 audit work plan are in progress and will continue into the
FY 2019 audit work plan. The hours shown represent the remaining hours expected for FY 2019.
Audit Department Audit Objective(s) Planned
Hours
Code Enforcement Planning and
Community
Environment
Evaluate code enforcement policies and practices for
responsiveness, consistency, and follow‐up, particularly for
repeat offenders and complex cases.
160
ERP Planning:
Separation of Duties
Information
Technology
Evaluate the adequacy of separation of duties for various
activities in the current SAP system and make
recommendations to ensure that any identified deficiencies
are corrected for the new ERP system.
50
ERP Planning: Data
Integrity and
Reliability – Data
Standardization
Information
Technology and
Citywide
Determine if the city has procedures that govern the
standardization of master data in SAP and to give examples
for types of standardization that would be beneficial when
implementing the new ERP system.
70
ERP Planning: Data
Integrity and
Reliability – Human
Resources Data
Information
Technology,
Human
Resources, and
Administrative
Services
Assess the reliability of employee data that Human
Resources maintains in the City’s SAP system and make
recommendations to help ensure that deficiencies are
corrected prior to transferring data to the new ERP system.
50
ERP Planning: Data
Integrity and
Reliability – Utility
Customer Data
Information
Technology and
Utilities
Assess the reliability of Utilities’ customer data in the City’s
SAP system and make recommendations to help ensure that
deficiencies are corrected prior to transferring data to the
new ERP system.
580
Business Registry
(limited scope)
City Manager Evaluate the rules and processes used to establish the
business registry and make recommendations to help clean
up the data and ensure accuracy in the future.
85
Attachment A
Fiscal Year 2019 Audit Work Plan 5
Audit Department Audit Objective(s) Planned
Hours
Mobile Device
Inventory and Security
Information
Technology and
Citywide
Determine if the City accurately inventories and securely
manages city‐owned mobile devices.
610
Transferrable
Development Rights
Planning and
Community
Environment
Determine if the City maintains an accurate and complete
record of the transferable development rights (both City‐
owned and non‐City‐owned) that have been certified,
transferred, and used to date.
575
Nonprofit Services
Agreements
Community
Services,
Transportation,
Public Works,
and
Development
Services
Evaluate whether nonprofit organizations that receive City
funding are achieving the outcomes we expect from the
funding we provide. The audit focuses primarily on nonprofit
organizations that provide senior services.
575
Contract Risk and
Oversight
Administrative
Services
Department
Develop a systematic, data‐driven process to identify high‐
risk expenditures and revenues that occur under formal
contracts. Select a sample of high‐risk contracts to
determine if the City has received the goods and/or services
it paid for and/or the revenues to which it is entitled, that
the contracts are needed and do not result in unnecessary
overlaps in services, and that potential contract extensions
are appropriately disclosed in the original contract
documents.
700
Total Hours for In‐Progress Performance Audits 3,455
The following audits are proposed for the FY 2019 audit work plan; some of these may not be
completed until FY 2020:
Audit Department Preliminary Audit Objective(s)3 Planned Hours
ERP Planning: Data
Integrity and
Reliability – Utilities
Bill/Price Class and
Rate Schedule Data
Information
Technology and
Utilities
Assess the reliability of utilities bill/price class and rate
schedule data in the City’s SAP system and make
recommendations to help ensure that deficiencies are
corrected prior to transferring data to the new ERP system.
380
ERP Planning: Data
Integrity and
Reliability – Payroll
Rates and Deductions
Data
Information
Technology,
Human
Resources, and
Administrative
Services
Assess the reliability of payroll rates and deductions data in
the City’s SAP system and make recommendations to help
ensure that deficiencies are corrected prior to transferring
data to the new ERP system.
380
ERP Planning: Data
Integrity and
Reliability – Inventory
Materials Data
Information
Technology and
Administrative
Services
Assess the reliability of Human Resources Department data
in the City’s SAP system and make recommendations to help
ensure that deficiencies are corrected prior to transferring
data to the new ERP system.
380
3 The preliminary scope and planned hours may change after completing the planning phase of the audit.
Attachment A
Fiscal Year 2019 Audit Work Plan 6
Audit Department Preliminary Audit Objective(s)3 Planned Hours
ERP Planning: Data
Integrity and
Reliability –
Accounting General
Ledger Data
Information
Technology and
Administrative
Services
Assess the reliability of accounting general ledger data in the
City’s SAP system and make recommendations to help
ensure that deficiencies are corrected prior to transferring
data to the new ERP system.
350
Parking Assessment
Districts
Examine the City’s parking assessment districts to assess the
equity of costs and benefits to the City and property owners
in the districts.
345
Residential Parking
Permit Program and
City Parking Facilities
Evaluate the effectiveness of how the residential parking
permit programs were implemented to identify where
efficiencies can be gained in how the program is managed,
both financially and operationally, by looking at the program
citywide rather than by neighborhoods (or sections thereof).
Audit would also evaluate whether the number of employer
parking permits is appropriate based on proximity of
available parking garages and their usage in an RPP area.
720
Construction Audit Assess the effectiveness of the City’s construction
management practices as they relate to the bidding and
change order processes.
700
SCADA System and
Security Audit
Evaluate the effectiveness of processes related to installing,
maintaining, and securing SCADA operations.
340
Procurement/Request
for Proposals (RFP)
Bidding Process
Assess the effectiveness of the procurement process, with
a focus on consistency in application of processes,
compliance with City regulations and policies, and cost
estimating practices.
460
Total Hours for New Performance Audits 4,055
Other Suggested Topics Not Included Above
The following lists other suggested topics for which we do not expect to have capacity to do during
FY 2019. However, we will start audits from this list if time allows.
Citywide Audits:
Asset Management
Direct (FV 60) Payments
Facilities Management
Facilities Rental Fees and Usage
Financial Condition Report
Impact Fees
Long‐term Liabilities, Including Infrastructure
Permitting Processes
Planning Codes
Public Benefits
Succession Planning
Attachment A
Fiscal Year 2019 Audit Work Plan 7
Utilities Audits:
Accuracy of Gas Utility Billings
Accuracy of Electric Utility Billings
Utility Meter Routes
Net Metering Program