Loading...
HomeMy WebLinkAboutStaff Report 2605-6422CITY OF PALO ALTO Policy & Services Committee Special Meeting Tuesday, June 09, 2026 6:00 PM     Agenda Item     3.Recommend Approval of the Office of the City Auditor Annual Risk Assessment and FY 2027 Audit Plan and Corresponding Task Orders. CEQA Status: Not a Project Title Updated, Late Packet Report Added, Staff Presentation Policy & Services Committee Staff Report Report Type: ACTION ITEMS Lead Department: City Clerk Meeting Date: June 9, 2026 Report #:2605-6422 TITLE Recommend Approval of the Office of the City Auditor Annual Risk Assessment and FY 2027 Audit Plan and Corresponding Task Orders This will be a late packet report published on June 4, 2026. 9 3 8 0 Policy & Services Committee From: City Manager Report Type: ACTION ITEMS Lead Department: City Auditor Meeting Date: June 9, 2026 Report #:2602-5967 TITLE Recommend Approval of the Office of the City Auditor Annual Risk Assessment and FY 2027 Audit Plan and Corresponding Task Orders. CEQA Status: Not a Project RECOMMENDATION The City Auditor recommends that the Policy and Services Committee recommend the City Council approve the Citywide Annual Risk Assessment and FY 2027 Audit Plan. BACKGROUND The Palo Alto Municipal Code (Section 2.08.1301) requires the City auditor prepare and submit an annual audit plan to the City Council for review and approval. In its capacity serving as the City Auditor function, and in accordance with Baker Tilly’s agreement with the City, Baker Tilly performed a citywide risk assessment (Task 1 of the agreement2). The purpose of the assessment was to identify and prioritize risks to develop the annual audit plan (Task 2). During the risk assessment, Baker Tilly assessed a wide range of risk areas, including strategic, financial, technological, human capitol, operational, reputational, economic, and including compliance risk categories. ANALYSIS Baker Tilly, serving as the City Auditor, surveyed and interviewed City Council members and executive leadership across all departments within the City regarding risks to the City and individual departments. As part of this process, Baker Tilly also piloted a new risk assessment tool that enabled participants to engage in discussion around key risks to the City. Baker Tilly analyzed the results of all these inputs and other City documents, news articles, as well as information gathered from industry associations and publications. Identified risks were scored 1 https://codelibrary.amlegal.com/codes/paloalto/latest/paloalto_ca/0-0-0-60361 2 https://recordsportal.paloalto.gov/WebLink/DocView.aspx?id=80939&dbid=0&repo=PaloAlto 9 3 8 0 on their potential impact to the City and the likelihood that they might occur. The FY2027 Audit Plan was prepared based on the results of the FY2026 risk assessment. FISCAL/RESOURCE IMPACT STAKEHOLDER ENGAGEMENT ENVIRONMENTAL REVIEW ATTACHMENTS APPROVED BY: May 29, 2026 City of Palo Alto Office of the City Auditor Citywide Annual Risk Assessment and FY 2027 Audit Plan Contents network of Baker Tilly International Ltd., the members of which are separate and independent legal entities. Baker Tilly US, LLP is a licensed CPA firm that provides assurance services to its clients. Baker Tilly Advisory Group, LP and its subsidiary entities provide tax and consulting services to their clients and are not licensed CPA firms. INTRODUCTION ............................................................................................................... 1 RISK ASSESSMENT APPROACH .................................................................................. 4 RISK ASSESSMENT RESULTS ...................................................................................... 5 PROPOSED AUDIT PLAN FOR FY 2027 ........................................................................ 9 APPENDICES ................................................................................................................. 10 Introduction Overview According to the Palo Alto Municipal Code (Section 2.08.130) the mission of the Office of the City Auditor (OCA) is to promote honest, efficient, effective, economical, accountable, and transparent city government. To support this mission, the OCA conducts performance audits and financial and operational analyses of City departments, programs, services, and activities, and is responsible for preparing an annual audit plan for City Council approval. As the City’s outsourced Office of the City Auditor, Baker Tilly Advisory Group, LP (Baker Tilly) conducted the Fiscal Year (FY) 2026 citywide risk assessment in accordance with Baker Tilly’s agreement with the City. The purpose of the risk assessment was to develop the FY 2027 Annual Audit Plan by identifying and prioritizing areas of greatest risk and opportunity across the City. The resulting audit plan is designed to direct limited audit resources toward activities that provide the greatest value to the City and support effective stewardship of financial, physical, and informational resources. The City Auditor has the following responsibilities related to the planning and scope of internal audit activities: Palo Alto City Charter Article IV Sec. 12 requires the City Auditor to perform the following: • Conduct audits in accordance with a schedule approved by the City Council and may conduct unscheduled audits from time to time. • Conducts internal audits of all the fiscal transactions of the City. Title 2 Administrative Code Section 2.08.130 requires the City Auditor to perform the following: • Prepare an annual audit plan for City Council approval. • Identify the preliminary objectives of each audit to be performed, reflecting the purpose of the engagement and a preliminary description of the areas that may be addressed. • Conduct performance audits and perform non-audit services of any City department, program, service, or activity as approved by the City Council. California Government Code Section 1236 requires cities that conduct audit activities to perform their work in accordance with the standards prescribed by the Institute of Internal Auditors (IIA) or the Government Auditing Standards (GAO), as appropriate. Consistent with IIA Standard 2010, which requires the chief audit executive to establish a risk-based plan aligned with organizational objectives and informed by senior management and governing board input, Baker Tilly conducted a comprehensive assessment of the City’s audit universe, including departments, functions, processes, programs, and activities that may be subject to audit. Risk Assessment Process Considerations The annual risk assessment serves as the foundation for developing a risk-based internal audit plan. While risk assessment is a core component of the internal audit process, its scope and complexity vary based on factors such as the maturity of the internal audit function, the organization's risk management practices, coordination with other oversight functions, and stakeholder expectations. Because organizational risks and priorities INTRODUCTION continue to evolve, the results of the annual risk assessment reflect conditions and information available at the time of the assessment. The risk assessment process involved identifying, evaluating, and prioritizing risks that could affect the City's ability to achieve its strategic and operational objectives. To gather input, the Office of the City Auditor (OCA) surveyed members of the City Council, the Executive Leadership Team, and key management personnel across the organization. Responses were received from 15 departments and were supplemented by interviews, document reviews, and professional judgment. The results of this process were used to identify areas of elevated risk and develop the proposed FY 2027 Annual Audit Plan. Consistent with Institute of Internal Auditors (IIA) Standards, the annual risk assessment represents a high-level evaluation of risk across the City's audit universe. In addition, before the commencement of each audit included in the approved audit plan, the internal audit function will perform an engagement-level risk assessment to further define the audit objectives, scope, timing, and resource requirements. This process helps ensure that each engagement addresses the most relevant risks and remains aligned with the City's priorities and operating environment. Throughout the assessment, several organizational strengths were consistently observed, including: • A strong commitment to public service demonstrated by a dedicated and highly professional management team • A culture that values efficient and effective government operations • A focus on strategic planning and execution • Continued investment in innovation and sustainability initiatives • A commitment to continuous improvement and organizational excellence This report summarizes the risk assessment methodology, analysis, and results and presents the proposed FY 2027 Annual Audit Plan developed from those results. Audit Planning Considerations While maintaining its independence and objectivity in accordance with standards, the City Auditor considers a variety of matters when developing the Annual Audit Plan, including but not limited to: • Risk Assessment – the OCA performed a risk assessment and summarized the results in a separate report (Task #1). Generally speaking, audit activities target high(er) risk areas. The results are shown on the following page. • Ability to Add Value – audit and advisory projects seek to add value through independent and objective analysis. • City Council – the City Auditor reports to the City Council and seeks input on audit priorities. • Coverage and Prior Audits – the City Auditor considers prior audits conducted by the OCA, the financial audit, and other audit and consulting reports recently issued. • “Ripeness” and On-Going Initiatives – certain risk areas may be addressed through operational activities, which could mean they are not ripe for audit to add value. • Scheduling – the City Auditor takes into consideration the timing of an audit and other on-going initiatives that directly relate. Putting an undue burden on City staff may exacerbate the risk at hand or other interrelated risks. INTRODUCTION Audit Activity Type The OCA will conduct performance audits and perform financial/operational analyses of any City department, program, service, or activity as approved by the City Council in accordance with the Baker Tilly agreement. Performance Audits According to the Government Auditing Standards (GAO-24-206786) Section 1.21 and 1.22, page 11-12), performance audits provide objective analysis, findings, and conclusions to assist management and those charged with governance and oversight with, among other things, improving program performance and operations, reducing costs, facilitating decision making by parties responsible for overseeing or initiating corrective action, and contributing to public accountability. Performance audits may include the following four (4) audit objectives: • Program effectiveness and results • Internal control design and effectiveness • Compliance with laws, regulations, and policies • Prospective analysis Risk Assessment Approach Baker Tilly’s risk assessment approach this year focused on gathering information from the following inputs: • Surveying and/or interviewing City Council, Executive Leadership Team members and other key management staff • Analyzing key documents such as City Council Priorities, budget documents, the annual comprehensive financial report, news articles, and other relevant documents • Updating the risk assessment matrix with the gathered information • Scoring the auditable units (listed in Appendix A) in the risk assessment matrix based on the likelihood and impact of potential adverse events • Identifying potential internal audit topics for the auditable units with high-risk scores • Summarizing the approach and results for presentation At the start of our contract with the City, Baker Tilly conducted an initial comprehensive risk assessment in FY 2021 by interviewing all Council Members and Executive Leadership Team (ELT) members to create a risk assessment matrix. Each year, this matrix is updated to redevelop a comprehensive picture of the risk landscape which is continuously changing. For FY 2026, ELT members were asked to evaluate the functions under departments and identify any changes. Members then assessed these functional areas for key risks that could impact operations. While the risk assessment primarily measures inherent risk (the risk without mitigating controls/factors) for each risk factor, it also considers specific risks based on the above information and the City’s processes, controls, and other factors surfaced through internal audit activities. Using the information gathered, OCA identified risks and determined the likelihood and impact of those risks. Risk Assessment Results Department Descriptions and Key Risk Areas When identifying risk areas throughout the City, Baker Tilly worked with City management to identify each department’s key functions and potential risk areas. Based on this input, Baker Tilly identified the auditable risk areas for each department. Below is an overview of the City’s departments and their key risk areas. Administrative Services The Administrative Services Department provides financial and analytical support to the City. Departmental functions include finance and accounting, purchasing, administration, budget, real estate, and others. Key Risk Areas ­ Financial Management & Reporting ­ Procurement & Purchasing Controls ­ Asset & Property Management ­ Contract, Grants, & Consultant Oversight ­ Governance, Compliance & Operational Oversight City Attorney’s Office The City Attorney’s Office provides legal services to the City, including providing legal advice and training to City leaders, negotiating on behalf of the City, drafting contracts and other legal documents, investigating claims, and defending the City in litigation Key Risk Areas ­ Identification of Legal Risks ­ Contracts & Legal Documents oversight & Advisory City Clerk’s Office The City Clerk serves as a liaison between the public and City Council. Office functions include Public Records Act requests, public hearings, local elections, board and commission recruitments, record management, and others. Key Risk Areas ­ Election Administration ­ Record Retention & Management ­ Council Meeting Management ­ Board and Commission Recruitment ­ Public Records Request City Manager’s Office The City Manager’s Office provides leadership to the City departments and is responsible for facilitating City Council legislative actions, managing special interdepartmental projects, and more. The Communications Office is housed under the City Manager’s Office and is the primary correspondent between the City and the public. Key Risk Areas ­ Citywide Risk Management ­ Government Efficiency ­ Community & Economic Initiatives ­ Strategic Planning & Governance Office of Transportation The Office of Transportation works to enhance quality of life and improve the safety of the users of all modes of transportation. The Office is responsible for sustainable transportation systems, managing parking, and oversees the City’s traffic and transportation capital improvement projects. Key Risk Areas ­ Transportation Safety Improvements ­ Parking Management ­ Operations & Capital Project Oversight ­ Signals & Traffic Engineering Community Services Department The Community Services Departments offers a variety of services administered through the following three divisions and the Office of Human Services: Arts and Sciences; Open Spaces, Parks, and Golf; and Recreation. Key Risk Areas ­ Parks, Facilities & Asset Management ­ Recreation & Community Programming ­ Arts, Culture & Education Programs ­ Contract & Vendor Compliance RISK ASSESSMENT RESULTS Fire The Fire Department oversees emergency response such as ambulance transports and fire response/rescue, emergency protection services such as fire prevention, and hazardous materials planning. The department highlights safeguarding the community and compassionate care. Key Risk Areas ­ Emergency Response & Fire Operations ­ Fire Prevention & Hazardous Materials Management ­ Emergency Preparedness Human Resources The Human Resources (HR) Department is responsible for recruiting, developing, and retaining a well-qualified and professional workforce. The Department ensures compliance with relevant labor laws, adheres to record keeping practices, and serves as a strategic partner for executive decision making. Key Risk Areas ­ Talent Acquisition & Workforce Planning ­ Compensation, Benefits & Employee Support ­ HR Compliance, Safety & Risk Management ­ Human Resource Information System Information Technology The Information Technology Department's provides innovative technology solutions that support City departments. The department oversees IT project management, operations, enterprise systems, and security services. Key Risk Areas ­ IT Governance, Strategy & Project Management ­ Enterprise Systems & Technology Operations ­ Cybersecurity & Regulatory Compliance ­ Infrastructure & Network Services ­ Geographic Information System (GIS) Library The Library Department operates five libraries throughout the City, each offering unique resources. The Library provides educational programming, multi-cultural events, and large and diverse book, information and technology resources. Key Risk Areas ­ Library Operations & Resource Management ­ Community Programs, Events & Cultural Services ­ Volunteer & Public Engagement Office of Emergency Services The Office of Emergency Services is designed to prevent, prepare for, and recover from various hazards. The Office is responsible for overseeing various risk management programs. Key Risk Areas ­ Emergency Preparedness, Continuity & Risk Management ­ Educational Programming ­ Training & Compliance Administration ­ Intergovernmental & Interlocal Coordination Planning and Development Services The Planning Department supports the City in land use development, planning, transportation, housing and environmental policies, and plans and programs that “maintain and enhance the City as a safe, vital, and attractive community”. Key Risk Areas ­ Planning, Development & Land Use Services ­ Building Review, Inspection & Code Enforcement ­ Long-Range Planning & Housing Compliance ­ Development Services Administration RISK ASSESSMENT RESULTS Overall Risk Scoring Distribution Baker Tilly structured the audit universe based on the department/division/program from the budget document and management’s feedback, which resulted in 108 auditable units (Appendix A). We scored them based on the information gathered for each risk factor related to the likelihood, impact, or fraud. Appendix B lists the risk factors, definitions, and scoring method. The maximum score for an auditable unit is 20. The following chart shows the distribution of overall risk scoring. The Police Department oversees technical services such as dispatch and record management, field services such as patrol and emergency response, and animal control. The Police Department also places a high value on community relations. Key Risk Areas ­ Police Operations & Emergency Response ­ Investigations, Crime Reduction & Specialized Response Programs ­ Communications, Records & Dispatch Services ­ Traffic, Animal Control & Community Safety ­ Public Works The Public Works Department is broken into four divisions: Engineering, Airport, Public Services, and Environmental Services. The Divisions are responsible for a variety of tasks including design and implementation of capital projects, maintenance of City-owned and leased structures, and management of the solid waste programs. Key Risk Areas ­ Engineering, Infrastructure & Capital Project Management ­ Airport Operations & Transportation Services ­ Environmental Services, Sustainability & Climate Action ­ Public Services, Facilities & Infrastructure Maintenance ­ Fleet Operations, Regulatory Compliance & Accessibility Programs Utilities The Utilities Department owns and operates electric, gas, water, wastewater and fiber optic services to the City. The City purchases all their power from external sources. The mission of the Department is to “provide safe, reliable, environmentally sustainable and cost-effective services.” Key Risk Areas ­ Water, Wastewater & Utility Operations ­ Gas Utility Operations ­ Financial Management, Rates & Reserves ­ Billing & Customer Account Services ­ Infrastructure & Asset Management ­ Workforce Planning & Staffing Management Baker Tilly rated the auditable units as follows: • High Risk – Scores 16 and above • Moderate Risk – Scores from 11 to 15 • Low Risk – Scores 10 and below Appendix C of this report lists the risk rated auditable units with a score of 12 or over (out of 20) based on our scoring. The list includes 36 functions rated as High risk (with a score between 16 and 20) and 58 functions rated as Moderate risk (with a score between 11 and 15). In determining the audit activities to be performed in FY 2027, we further evaluated specific risks and functional areas and considered risk-based priorities as well as other factors such as requirements by law or regulation, timing of activities, special projects, and requests from City Council and management. The proposed audit plan for FY 2027 is on the following page. 0 10 20 30 40 50 60 70 2 to 10 (LOW)11 to 15 (MEDIUM)16 to 20 (HIGH) Risk Scoring Distribution PROPOSED AUDIT PLAN FOR FY 2027 Proposed Audit Plan for FY 2027 The proposed audits and special advisory projects for FY 2027 are listed in the table below. These projects were selected from the auditable units assessed as having High or Moderate risk based on the results of the citywide risk assessment. As mentioned in the previous section, in addition to risk ratings, project selection considered factors such as the significance and pervasiveness of underlying processes and controls, prior audit coverage, the timing of related initiatives or non-audit activities, and the potential for the engagement to provide meaningful value to the City through enhanced risk management, accountability, operational efficiency, and effectiveness. Preliminary objectives have been developed for each proposed project; however, the final scope and objectives will be refined through an engagement-level risk assessment conducted at the outset of each project. The annual audit plan is intended to remain flexible and may be modified during FY 2027 to address changes in the City's operating environment, organizational structure, strategic priorities, risks, systems, or control processes. Consistent with the City Auditor's established process, task orders will be submitted to the City Council for approval before each project begins. To facilitate timely execution of the FY 2027 audit plan, six task orders have been prepared and are included in Appendix D. The Office of the City Auditor is requesting City Council approval to initiate all six projects during the first half of FY 2027, with work commencing as resources and scheduling permit. Proposed FY 2027 Audit Plan Appendix A: Resumes Appendices Appendix A: Audit Universe City Attorney’s Office Contracts & Legal Documents Legal Risk & Identification City Clerk’s Office Board & Commission Recruitment Council Meeting Management Election Administration Public Records Requests City Manager’s Office Citywide Communications & Community Engagement Citywide Risk Management Consultant Management Coordination of Citywide Housing and Homelessness Efforts Economic Development Ensures Execution of Council Priorities Government Efficiency Human Services Administrative Services Department Accounting Budgeting Contract and Consultant Oversight Grant Management Long-Range Financial Planning Procurement Property Management Purchasing Cards Community Services Department Arts Children’s Theater Community Centers Equipment & Materials Management Golf Junior Museum & Zoo Parks Fire Department Emergency Response Emergency Medical Services (EMS) Fire Prevention Fire Response/Rescue Fire Suppression Human Resources Department Compliance with Labor Laws Employee Benefits & Workers Compensation Employee Retention Human Resources Information System (HRIS) Professional Development Recruitment Succession Planning Information Technology Department Adoption & Integration of New Technology Enterprise Systems Geographic Information Systems (GIS) Fiber Internet Services IT Project Management Library Department Collection Education Programming Library Branch Operations Information Resources Multi-Cultural Events Office of Emergency Services Continuity of Operations Plans Disaster & Emergency Preparedness Disaster Mitigation Planning Education Programming Interlocal Agreements Risk Management Office of Transportation Parking Management Safe Routes to School Signals & Traffic Engineering Transportation Capital Projects Transportation Contracts, Grants & Administration Planning and Development Services Department Code Enforcement Current Planning Development Center Long Range Planning Inspection Services Plan Review Services Police Department Animal Control Dispatch Emergency Response Investigations Patrol Public Safety Records Management Department of Public Works Airport Design & Implementation of Capital Projects Engineering Environmental Services Fleet Operations Infrastructure Maintenance Public Services Stormwater Utilities Department Billing Electric Fiber Gas Power Purchase Agreements Rate Setting & Adjustments Utility Asset Management Utility Reserves Wastewater Water Appendix B: Risk Factor Definitions Impact Score Description & Operational Resource Impact Reputational Legal, Regulatory & Political Impact 1 - Negligible No discernible impact or very minor, easily absorbed. Minor inconvenience; no disruption to core services. Minimal financial waste (e.g., < $10,000); no impact on budget. No public notice; minimal internal concern. No breach of law/policy; minor administrative error. 2 - Low Minor impact, manageable with existing resources, minimal disruption. Minor disruption to non-critical services; easily rectified. Low financial impact (e.g., $10,000 - $100,000); minor budget reallocation. Limited negative perception internally or among immediate stakeholders. Minor non- compliance with internal policies or less significant regulations. 3 - Medium Moderate impact, requiring additional resources to manage, some disruption. Moderate disruption to some core services; short-term delays or reduced quality. Moderate financial impact (e.g., $100,001 - $1,000,000); potential for budget shortfall requiring minor adjustments. Potential for negative local media attention or stakeholder concern; moderate erosion of trust. Non-compliance with significant policies or minor statutory requirements; potential for low- level public inquiry. 4 - High Significant impact, major disruption, significant resources required to manage. Significant disruption or failure of critical services; inability to meet key mandates. High financial impact (e.g., $1,000,001 - $10,000,000); significant budget deficit, requiring major financial intervention. Widespread negative media attention; significant loss of public trust; political scrutiny. Breach of significant laws, regulations, or constitutional mandates; potential for large fines, sanctions, or widespread public outcry. 5 - Critical Catastrophic impact, existential threat to an agency/program, severe and long- lasting consequences. Complete failure or sustained inability to deliver essential services; poses a threat to public safety or welfare. Catastrophic financial impact (e.g., > $10,000,000); severe budget crisis, jeopardizing long-term financial stability. Widespread public outrage, severe reputational damage, potential for loss of mandates, political fallout, loss of public confidence in government function. Major legal action, criminal charges, legislative intervention, loss of delegated authority, impeachment proceedings. Likelihood Score Description Probability/Frequency (Public Sector Context) 1 - Rare May occur only in exceptional circumstances. < 5% Has never happened in this or similar public entities; highly unlikely given current environment. 2 - Unlikely Could occur at some time. 5% - 20% sector entities, or there are very limited indicators it could happen here. 3 - Possible Might occur or is likely to occur at some time. 21% - 50% within this entity, or there are known, albeit manageable, conditions that could lead to it (e.g., pending legislative changes). 4 - Likely Will probably occur in most circumstances. 51% - 80% within this entity or sector; strong indicators or trends suggest it will occur (e.g., identified recurring audit findings, persistent capacity issues). 5 - Almost Certain Is expected to occur in most circumstances. > 80% Is a recurring event or a known systemic issue within the entity; current conditions make it highly probable or inevitable (e.g., critical staffing shortages, outdated systems, consistent public complaints). Appendix C: Possible Risks Rated1 1 Only risks rated 12 or higher are included in this report. 19 Appendix D: Audit Plan Task Orders PROFESSIONAL SERVICES TASK ORDER TASK ORDER FY27-4.42 City’s Capital Improvement Project (CIP) Management Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below. CONTRACT NO. C21179340 OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE) 1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): C21179340 1B. TASK ORDER NO.: FY27-4.42 2.CONSULTANT NAME: Baker Tilly Advisory Group, LP 3.PERIOD OF PERFORMANCE: START: September 1, 2026 COMPLETION: May 31, 2027 4.TOTAL TASK ORDER PRICE: $98,160 BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT TBD 5.BUDGET CODE_______________ COST CENTER________________ COST ELEMENT______________ WBS/CIP__________ PHASE__________ 6.CITY PROJECT MANAGER’S NAME & DEPARTMENT: Julie Lythcott-Haims, Chair of the City Council’s Policy and Services Committee 7.DESCRIPTION OF SCOPE OF SERVICES (Attachment A) MUST INCLUDE: SERVICES AND DELIVERABLES TO BE PROVIDED SCHEDULE OF PERFORMANCE MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable) REIMBURSABLE EXPENSES, if any (with “not to exceed” amount) 8.ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A described in this Task Order. APPROVED: CITY OF PALO ALTO BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ this Task Order and warrant that I have authority to sign on behalf of Consultant. APPROVED: COMPANY NAME: Baker Tilly Advisory Group, LP BY:____________________________________ Name __________________________________ Title___________________________________ Attachment A DESCRIPTION OF SCOPE OF SERVICES Introduction Attachment A, the Description of Scope of Services, contains the following four (4) elements: • Services and Deliverables To Be Provided • Schedule of Performance • Maximum Compensation Amount and Rate Schedule (As Applicable) • Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables Baker Tilly’s approach to conducting an internal audit of the City’s Capital Improvement Project (CIP) Management involves three (3) primary steps: • Step 1: Audit Planning • Step 2: Fieldwork and Testing • Step 3: Reporting Step 1 – Audit Planning This step consists of the tasks performed to adequately plan the work necessary to address the overall audit objective and to solidify mutual understanding of the audit scope, objectives, audit process, and timing between stakeholders and auditors. Tasks include: • Gather information to understand the environment under review o Understand the environment under assessment o Assess the City code, regulations, and other standards and expectations o Assess prior audit results, as applicable o Assess additional documentation and conduct interviews as necessary • Assess the audit risk • Prepare an audit planning memo and audit program o Refine audit objectives and scope o Identify the audit procedures to be performed and the evidence to be obtained and examined • Announce the initiation of the audit and kick-off meeting with key stakeholders o Discuss audit objectives, scope, audit process, timing, resources, and expectations o Discuss documentation and interview requests for the audit Step 2 – Fieldwork and Testing The step involves executing the procedures in the audit program to gather information, interview individuals, and analyze the data and information to obtain sufficient evidence to address the audit objectives. The preliminary audit objective is to determine (1) if the City’s Capital Improvement Project management provides adequate oversight to support the timely, coordinated, and cost-effective delivery of capital projects, and (2) determining whether projects are delivered operationally ready. Finally, the audit will evaluate the administration of CIP projects for adequate internal controls to safeguard the City from fraud, waste, and abuse. Procedures include, but are not limited to: • Obtain and review CIP policies, procedures, governance structures, project management standards, and reporting protocols. • Assess whether roles, responsibilities, approval authorities, and accountability mechanisms are clearly defined. • Select a risk-based sample of completed and active CIP projects. • Compare planned versus actual schedules, budgets, scope, and deliverables to evaluate whether projects were completed timely and cost-effectively. • Review project status reports, budget tracking tools, change orders, risk logs, and escalation procedures. • Determine whether management receives accurate, timely, and sufficient information to monitor project performance and address issues. • Examine whether projects included operational readiness activities such as staff training, testing/commissioning, documentation handoff, maintenance planning, and stakeholder acceptance prior to project closeout. • Verify whether completed projects were fully functional and capable of achieving intended operational objectives Step 3 – Reporting In Step 3, the project team will perform tasks necessary to finalize audit working papers, prepare and review a draft report with stakeholders, and submit a final report for management response. Tasks include: • Developing findings, conclusions, and recommendations based on the supporting evidence gathered • Validating findings with appropriate individuals and discuss the root cause of the identified findings • Complete supervisory review of working papers and a draft audit report • Distribute a draft audit report and conduct a closing meeting with key stakeholders o Discuss the audit results, findings, conclusions, and recommendations o Discuss management responses • Obtain written management responses and finalize a report • Review report with members of City Council and/or the appropriate Council Committee Deliverables: The following deliverables will be prepared as part of this engagement: • Audit Report • Policy & Services Committee Audit Report Presentation Schedule of Performance Anticipated Start Date: September 1, 2026 Anticipated End Date: May 31, 2026 Maximum Compensation Amount and Rate Schedule The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this Task is $98,160. The not- to-exceed budget is based on an estimate of 500 total project hours, of which a minimum of 50 are estimated to be completed by the City Auditor. Reimbursable Expenses We plan to complete all work remote including all interviews and documentation review. However, during the planning and fieldwork phases of this audit, the City and Baker Tilly may mutually determine it will be beneficial to perform a portion of the work on-site. Given this possibility, Baker Tilly could incur expenses for this Task. The not-to-exceed maximum for reimbursable expenses for this Task is $6,500. The following summarizes anticipated reimbursable expenses: • Round-trip Airfare – $2,000 (1 round trip flight x 2 auditors) • Ground transportation – $800 (car rental or Uber/taxi) • Hotel accommodation – $3,000 (2 rooms x 4 nights) • Food & Incidentals – $2,100 25 PROFESSIONAL SERVICES TASK ORDER TASK ORDER FY27-4.43 City and Departmental Performance Measures Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below. CONTRACT NO. C21179340 OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE) 1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): C21179340 1B. TASK ORDER NO.: FY27-4.43 2.CONSULTANT NAME: Baker Tilly Advisory Group, LP 3.PERIOD OF PERFORMANCE: START: August 1, 2026 COMPLETION: February 28, 2027 4.TOTAL TASK ORDER PRICE: $85,755 BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT TBD 5.BUDGET CODE_______________ COST CENTER________________ COST ELEMENT______________ WBS/CIP__________ PHASE__________ 6.CITY PROJECT MANAGER’S NAME & DEPARTMENT: Julie Lythcott-Haims, Chair of the City Council’s Policy and Services Committee 7.DESCRIPTION OF SCOPE OF SERVICES (Attachment A) MUST INCLUDE: SERVICES AND DELIVERABLES TO BE PROVIDED SCHEDULE OF PERFORMANCE MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable) REIMBURSABLE EXPENSES, if any (with “not to exceed” amount) 8.ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A described in this Task Order. APPROVED: CITY OF PALO ALTO BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ this Task Order and warrant that I have authority to sign on behalf of Consultant. APPROVED: COMPANY NAME: Baker Tilly Advisory Group, LP BY:____________________________________ Name __________________________________ Title___________________________________ Attachment A DESCRIPTION OF SCOPE OF SERVICES Introduction Attachment A, the Description of Scope of Services, contains the following four (4) elements: • Services and Deliverables To Be Provided • Schedule of Performance • Maximum Compensation Amount and Rate Schedule (As Applicable) • Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables Baker Tilly’s approach to conducting an internal audit of the City and Departmental Performance Measures involves three (3) primary steps: • Step 1: Audit Planning • Step 2: Fieldwork and Testing • Step 3: Reporting Step 1 – Audit Planning This step consists of the tasks performed to adequately plan the work necessary to address the overall audit objective and to solidify mutual understanding of the audit scope, objectives, audit process, and timing between stakeholders and auditors. Tasks include: • Gather information to understand the environment under review o Understand the environment under assessment o Assess the City code, regulations, and other standards and expectations o Assess prior audit results, as applicable o Assess additional documentation and conduct interviews as necessary • Assess the audit risk • Prepare an audit planning memo and audit program o Refine audit objectives and scope o Identify the audit procedures to be performed and the evidence to be obtained and examined • Announce the initiation of the audit and kick-off meeting with key stakeholders o Discuss audit objectives, scope, audit process, timing, resources, and expectations o Discuss documentation and interview requests for the audit Step 2 – Fieldwork and Testing The step involves executing the procedures in the audit program to gather information, interview individuals, and analyze the data and information to obtain sufficient evidence to address the audit objectives. The preliminary audit objective is to determine if the City tracks meaningful performance measures to ensure efficiency of operations and that processes are actively monitored and managed. Procedures include, but are not limited to: • Obtain and review policies, strategic plans, dashboards, and departmental performance management practices. • Assess whether performance measures are clearly defined, aligned with organizational objectives, and focused on operational efficiency and effectiveness. • Analyze a sample of departmental performance metrics to determine whether measures are meaningful, measurable, reliable, and outcome-oriented. • Assess whether management uses appropriate benchmarks, targets, and trend analysis to evaluate performance. • Review processes for collecting, validating, and reporting performance data. • Test a sample of reported metrics for accuracy, completeness, consistency, and supporting documentation. • Review management reports, dashboards, meeting minutes, and corrective action processes to determine whether performance information is routinely monitored and discussed. • Assess whether management takes timely action to address underperformance or operational inefficiencies. • Interview department leadership and staff to determine how performance results are used in decision- making, resource allocation, operational planning, and process improvement initiatives. • Assess whether departments establish accountability for achieving performance targets and implementing corrective actions. • Compare the City’s performance management processes and metrics to industry standards, peer municipalities, or recognized best practices. • Identify opportunities to improve operational efficiency, reporting transparency, and management oversight. Step 3 – Reporting In Step 3, the project team will perform tasks necessary to finalize audit working papers, prepare and review a draft report with stakeholders, and submit a final report for management response. Tasks include: • Developing findings, conclusions, and recommendations based on the supporting evidence gathered • Validating findings with appropriate individuals and discuss the root cause of the identified findings • Complete supervisory review of working papers and a draft audit report • Distribute a draft audit report and conduct a closing meeting with key stakeholders o Discuss the audit results, findings, conclusions, and recommendations o Discuss management responses • Obtain written management responses and finalize a report • Review report with members of City Council and/or the appropriate Council Committee Deliverables: The following deliverables will be prepared as part of this engagement: • Audit Report • Policy & Services Committee Audit Report Presentation Schedule of Performance Anticipated Start Date: August 1, 2026 Anticipated End Date: April 30, 2027 Maximum Compensation Amount and Rate Schedule The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this Task is $85,755. The not- to-exceed budget is based on an estimate of 445 total project hours, of which a minimum of 50 are estimated to be completed by the City Auditor. We don’t plan to complete any on-site work for this engagement. 22 PROFESSIONAL SERVICES TASK ORDER TASK ORDER FY27-4.44 Models/Approaches for Improving Outcomes for Individuals and Families Experiencing Homelessness Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below. CONTRACT NO. C21179340 OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE) 1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): C21179340 1B. TASK ORDER NO.: FY27-4.44 2.CONSULTANT NAME: Baker Tilly Advisory Group, LP 3.PERIOD OF PERFORMANCE: START: September 1, 2026 COMPLETION: May 31, 2027 4.TOTAL TASK ORDER PRICE: $60,455 BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT TBD 5.BUDGET CODE_______________ COST CENTER________________ COST ELEMENT______________ WBS/CIP__________ PHASE__________ 6.CITY PROJECT MANAGER’S NAME & DEPARTMENT: Julie Lythcott-Haims, Chair of the City Council’s Policy and Services Committee 7.DESCRIPTION OF SCOPE OF SERVICES (Attachment A) MUST INCLUDE: SERVICES AND DELIVERABLES TO BE PROVIDED SCHEDULE OF PERFORMANCE MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable) REIMBURSABLE EXPENSES, if any (with “not to exceed” amount) 8.ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A described in this Task Order. APPROVED: CITY OF PALO ALTO BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ this Task Order and warrant that I have authority to sign on behalf of Consultant. APPROVED: COMPANY NAME: Baker Tilly Advisory Group, LP BY:____________________________________ Name __________________________________ Title___________________________________ Attachment A DESCRIPTION OF SCOPE OF SERVICES Introduction Attachment A, the Description of Scope of Services, contains the following four (4) elements: • Services and Deliverables To Be Provided • Schedule of Performance • Maximum Compensation Amount and Rate Schedule (As Applicable) • Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables Baker Tilly’s approach to conducting an assessment of Models/Approaches for Improving Outcomes for Individuals and Families Experiencing Homelessness involves three (3) primary steps: • Step 1: Assessment Planning • Step 2: Fieldwork and Testing • Step 3: Reporting Step 1 – Assessment Planning This step consists of the tasks performed to adequately plan the work necessary to address the overall assessment objective and to solidify mutual understanding of the assessment scope, objectives, process, and timing between stakeholders and auditors. Tasks include: • Gather information to understand the environment under review o Understand the environment under assessment o Assess the City code, regulations, and other standards and expectations o Assess prior audit results, as applicable o Assess additional documentation and conduct interviews as necessary • Prepare an assessment program o Refine assessment objectives and scope o Identify the procedures to be performed and the evidence to be obtained and examined • Announce the initiation of the assessment and kick-off meeting with key stakeholders o Discuss assessment objectives, scope, audit process, timing, resources, and expectations o Discuss documentation and interview requests for the assessment Step 2 – Fieldwork and Testing The step involves executing the procedures in the assessment program to gather information, interview individuals, and analyze the data and information to obtain sufficient evidence to address the assessment objectives. The preliminary objective for this advisory project is to assess what models in smaller cities have been most successful and sustainable in supporting and improving outcomes for individuals experiencing homelessness. Steps may include: • Obtain and review homelessness response plans, strategic initiatives, program documentation, and performance reports from selected smaller cities. • Identify and document homelessness intervention models implemented in comparable cities, including program design, target populations, governance structures, and service delivery approaches. • Collect and analyze outcome data, such as housing placement rates, housing retention, reductions in unsheltered homelessness, returns to homelessness, and other relevant performance measures. • Review funding sources, program costs, staffing requirements, and partnership structures to assess the financial and operational sustainability of selected models. • Conduct interviews with local officials, service providers, community organizations, and individuals with lived experience to identify perceived strengths, challenges, and lessons learned. • Compare models across selected cities and evaluate which approaches have demonstrated the most effective and sustainable outcomes, as well as the factors contributing to their success. Step 3 – Reporting In Step 3, the project team will perform tasks necessary to finalize assessment working papers, prepare and review a draft report with stakeholders, and submit a final report for management response. Tasks include: • Developing findings, conclusions, and recommendations based on the supporting evidence gathered • Validating findings with appropriate individuals and discuss the root cause of the identified findings • Complete supervisory review of working papers and a draft assessment report • Distribute a draft assessment report and conduct a closing meeting with key stakeholders o Discuss the assessment results, findings, conclusions, and recommendations o Discuss management responses • Obtain written management responses and finalize a report • Review report with members of City Council and/or the appropriate Council Committee Deliverables: The following deliverables will be prepared as part of this engagement: • Assessment Report • Policy & Services Committee Assessment Report Presentation Schedule of Performance Anticipated Start Date: September 1, 2025 Anticipated End Date: May 31, 2027 Maximum Compensation Amount and Rate Schedule The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this Task is $60,455. The not- to-exceed budget is based on an estimate of 300 total project hours, of which a minimum of 50 are estimated to be completed by the City Auditor. Reimbursable Expenses We plan to complete some fieldwork steps for this audit on-site if the City and Baker Tilly mutually determine it will be beneficial to perform a portion of the work on-site. Given this possibility, Baker Tilly could incur expenses for this Task. The not-to-exceed maximum for reimbursable expenses for this Task is $6,500. The following summarizes anticipated reimbursable expenses: • Round-trip Airfare – $2,000 (1 round trip flight x 2 auditors) • Ground transportation – $800 (car rental or Uber/taxi) • Hotel accommodation – $3,000 (2 rooms x 4 nights) • Food & Incidentals – $2,100 28 PROFESSIONAL SERVICES TASK ORDER TASK ORDER FY27-4.45 Council Meeting Management Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below. CONTRACT NO. C21179340 OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE) 1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): C21179340 1B. TASK ORDER NO.: FY27-4.45 2.CONSULTANT NAME: Baker Tilly Advisory Group, LP 3.PERIOD OF PERFORMANCE: START: October 1, 2026 COMPLETION: March 31, 2027 4.TOTAL TASK ORDER PRICE: $53,885 BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT TBD 5.BUDGET CODE_______________ COST CENTER________________ COST ELEMENT______________ WBS/CIP__________ PHASE__________ 6.CITY PROJECT MANAGER’S NAME & DEPARTMENT: Julie Lythcott-Haims, Chair of the City Council’s Policy and Services Committee 7.DESCRIPTION OF SCOPE OF SERVICES (Attachment A) MUST INCLUDE: SERVICES AND DELIVERABLES TO BE PROVIDED SCHEDULE OF PERFORMANCE MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable) REIMBURSABLE EXPENSES, if any (with “not to exceed” amount) 8.ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A described in this Task Order. APPROVED: CITY OF PALO ALTO BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ this Task Order and warrant that I have authority to sign on behalf of Consultant. APPROVED: COMPANY NAME: Baker Tilly Advisory Group, LP BY:____________________________________ Name __________________________________ Title___________________________________ Attachment A DESCRIPTION OF SCOPE OF SERVICES Introduction Attachment A, the Description of Scope of Services, contains the following four (4) elements: • Services and Deliverables To Be Provided • Schedule of Performance • Maximum Compensation Amount and Rate Schedule (As Applicable) • Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables Baker Tilly’s approach to conducting an assessment of the City’s Council Meeting Management Processes includes three (3) primary steps: • Step 1: Assessment Planning • Step 2: Fieldwork and Testing • Step 3: Reporting Step 1 – Assessment Planning This step consists of the tasks performed to adequately plan the work necessary to address the overall assessment objective and to solidify mutual understanding of the assessment scope, objectives, process, and timing between stakeholders and auditors. Tasks include: • Gather information to understand the environment under review o Understand the environment under assessment o Assess the City code, regulations, and other standards and expectations o Assess prior audit results, as applicable o Assess additional documentation and conduct interviews as necessary • Prepare an assessment program o Refine assessment objectives and scope o Identify the procedures to be performed and the evidence to be obtained and examined • Announce the initiation of the assessment and kick-off meeting with key stakeholders o Discuss assessment objectives, scope, assessment process, timing, resources, and expectations o Discuss documentation and interview requests for the assessment Step 2 – Fieldwork and Testing The step involves executing the procedures in the assessment program to gather information, interview individuals, and analyze the data and information to obtain sufficient evidence to address the assessment objectives. The preliminary objective for this advisory project is to assess what council meeting planning and agenda management processes best support efficient and timely execution of council business and policy direction. Steps include: • Review and map the City’s council meeting planning and agenda development processes, including roles, timelines, approvals, and coordination workflows. • Interview council members, City staff, and other stakeholders to identify challenges affecting meeting efficiency, agenda management, and execution of council priorities. • Analyze historical agendas, meeting schedules, deferred items, and supporting materials to evaluate the efficiency and effectiveness of current practices. • Assess interdepartmental coordination, communication processes, and agenda preparation procedures to determine whether they support timely and accurate council decision-making. • Benchmark the City’s council meeting and agenda management practices against peer municipalities and governance best practices to identify improvement opportunities. • Evaluate the effectiveness of agenda management tools and develop recommendations to improve meeting efficiency, transparency, prioritization, and execution of council business. Step 3 – Reporting In Step 3, the project team will perform tasks necessary to finalize assessment working papers, prepare and review a draft report with stakeholders, and submit a final report for management response. Tasks include: • Developing observations and recommendations based on the supporting evidence gathered • Validating observations with appropriate individuals • Complete supervisory review of working papers and a draft assessment report • Distribute a draft assessment report and conduct a closing meeting with key stakeholders o Discuss the observations and recommendations o Discuss management responses • Obtain written management responses if appropriate and finalize a report • Review report with members of City Council and/or the appropriate Council Committee Deliverables: The following deliverables will be prepared as part of this engagement: • Assessment Report • Policy & Services Committee Assessment Report Presentation Schedule of Performance Anticipated Start Date: July 1, 2026 Anticipated End Date: January 31, 2027 Maximum Compensation Amount and Rate Schedule The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this Task is $53,885. The not- to-exceed budget is based on an estimate of 280 total project hours, of which a minimum of 35 are estimated to be completed by the City Auditor. Reimbursable Expenses We plan to complete all work remotely including all interviews and documentation review. However, during the planning and fieldwork phases of this assessment, the City and Baker Tilly may mutually determine it will be beneficial to perform a portion of the work on-site. Given this possibility, Baker Tilly could incur expenses for this Task. The not-to-exceed maximum for reimbursable expenses for this Task is $6,500. The following summarizes anticipated reimbursable expenses: • Round-trip Airfare – $2,000 (1 round trip flight x 2 auditors) • Ground transportation – $800 (car rental or Uber/taxi) • Hotel accommodation – $3,000 (2 rooms x 4 nights) • Food & Incidentals – $2,100 31 PROFESSIONAL SERVICES TASK ORDER TASK ORDER FY27-4.46 AI Governance & Usage Best Practices & Pit Falls Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below. CONTRACT NO. C21179340 OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE) 1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): C21179340 1B. TASK ORDER NO.: FY27-4.46 2.CONSULTANT NAME: Baker Tilly Advisory Group, LP 3.PERIOD OF PERFORMANCE: START: August 1, 2026 COMPLETION: January 31, 2027 4.TOTAL TASK ORDER PRICE: $63,815 BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT TBD 5.BUDGET CODE_______________ COST CENTER________________ COST ELEMENT______________ WBS/CIP__________ PHASE__________ 6.CITY PROJECT MANAGER’S NAME & DEPARTMENT: Julie Lythcott-Haims, Chair of the City Council’s Policy and Services Committee 7.DESCRIPTION OF SCOPE OF SERVICES (Attachment A) MUST INCLUDE: SERVICES AND DELIVERABLES TO BE PROVIDED SCHEDULE OF PERFORMANCE MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable) REIMBURSABLE EXPENSES, if any (with “not to exceed” amount) 8.ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A described in this Task Order. APPROVED: CITY OF PALO ALTO BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ this Task Order and warrant that I have authority to sign on behalf of Consultant. APPROVED: COMPANY NAME: Baker Tilly Advisory Group, LP BY:____________________________________ Name __________________________________ Title___________________________________ Attachment A DESCRIPTION OF SCOPE OF SERVICES Introduction Attachment A, the Description of Scope of Services, contains the following four (4) elements: • Services and Deliverables To Be Provided • Schedule of Performance • Maximum Compensation Amount and Rate Schedule (As Applicable) • Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables Baker Tilly’s approach to conducting an assessment of the AI Governance & Usage Best Practices & Pit Falls includes three (3) primary steps: • Step 1: Assessment Planning • Step 2: Fieldwork and Testing • Step 3: Reporting Step 1 – Assessment Planning This step consists of the tasks performed to adequately plan the work necessary to address the overall assessment objective and to solidify mutual understanding of the assessment scope, objectives, process, and timing between stakeholders and auditors. Tasks include: • Gather information to understand the environment under review o Understand the environment under assessment o Assess the City code, regulations, and other standards and expectations o Assess prior audit results, as applicable o Assess additional documentation and conduct interviews as necessary • Prepare an assessment program o Refine assessment objectives and scope o Identify the procedures to be performed and the evidence to be obtained and examined • Announce the initiation of the assessment and kick-off meeting with key stakeholders o Discuss assessment objectives, scope, assessment process, timing, resources, and expectations o Discuss documentation and interview requests for the audit Step 2 – Fieldwork and Testing The step involves executing the procedures in the assessment program to gather information, interview individuals, and analyze the data and information to obtain sufficient evidence to address the assessment objectives. The preliminary objective is to determine what AI governance, usage, and training policies and practices should the City adopt to best leverage AI and what are the biggest risks the City should be aware of. Steps include • Review existing City policies, procedures, and governance structures related to AI, data management, cybersecurity, privacy, procurement, and technology oversight. • Interview City leadership, IT staff, legal counsel, department representatives, and other stakeholders to understand current and planned AI usage, operational needs, and governance concerns. • Assess how AI technologies are currently being used or evaluated across departments, including controls related to data privacy, security, transparency, accuracy, and human oversight. • Evaluate employee training, awareness, and acceptable use practices to determine whether staff are adequately prepared to responsibly and effectively use AI tools. • Benchmark the City’s AI governance, risk management, and training practices against peer municipalities, industry standards, and emerging regulatory guidance to identify leading practices and gaps. • Identify key risks associated with AI adoption—including cybersecurity, data privacy, bias, legal liability, misinformation, and operational dependency—and develop recommendations to support responsible AI governance and implementation. Step 3 – Reporting In Step 3, the project team will perform tasks necessary to finalize assessment working papers, prepare and review a draft report with stakeholders, and submit a final report for management response. Tasks include: • Developing observations and recommendations based on the supporting evidence gathered • Validating observations with appropriate individuals • Complete supervisory review of working papers and a draft assessment report • Distribute a draft assessment report and conduct a closing meeting with key stakeholders o Discuss the observations and recommendations o Discuss management responses • Obtain written management responses if appropriate and finalize a report • Review report with members of City Council and/or the appropriate Council Committee Deliverables: The following deliverables will be prepared as part of this engagement: • Assessment Report • Policy & Services Committee Assessment Report Presentation Schedule of Performance Anticipated Start Date: August 1, 2026 Anticipated End Date: January 31, 2027 Maximum Compensation Amount and Rate Schedule The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this Task is $63,815. The not- to-exceed budget is based on an estimate of 315 total project hours, of which a minimum of 35 are estimated to be completed by the City Auditor. Reimbursable Expenses We plan to complete all work remote including all interviews and documentation review. However, during the planning and fieldwork phases of this assessment, the City and Baker Tilly may mutually determine it will be beneficial to perform a portion of the work on-site. Given this possibility, Baker Tilly could incur expenses for this Task. The not-to-exceed maximum for reimbursable expenses for this Task is $6,500. The following summarizes anticipated reimbursable expenses: • Round-trip Airfare – $2,000 (1 round trip flight x 2 auditors) • Ground transportation – $800 (car rental or Uber/taxi) • Hotel accommodation – $3,000 (2 rooms x 4 nights) • Food & Incidentals – $2,100 34 PROFESSIONAL SERVICES TASK ORDER TASK ORDER FY27-4.47 Employee Mental Health & Wellness Consultant shall perform the Services detailed below in accordance with all the terms and conditions of the Agreement referenced in Item 1A below. All exhibits referenced in Item 8 below are incorporated into this Task Order by this reference. The Consultant shall furnish the necessary facilities, professional, technical and supporting personnel required by this Task Order as described below. CONTRACT NO. C21179340 OR PURCHASE ORDER REQUISITION NO. (AS APPLICABLE) 1A. MASTER AGREEMENT NO. (MAY BE SAME AS CONTRACT / P.O. NO. ABOVE): C21179340 1B. TASK ORDER NO.: FY27-4.47 2.CONSULTANT NAME: Baker Tilly Advisory Group, LP 3.PERIOD OF PERFORMANCE: START: October 1, 2026 COMPLETION: May 31, 2027 4.TOTAL TASK ORDER PRICE: $60,455 BALANCE REMAINING IN MASTER AGREEMENT/CONTRACT TBD 5.BUDGET CODE_______________ COST CENTER________________ COST ELEMENT______________ WBS/CIP__________ PHASE__________ 6.CITY PROJECT MANAGER’S NAME & DEPARTMENT: Julie Lythcott-Haims, Chair of the City Council’s Policy and Services Committee 7.DESCRIPTION OF SCOPE OF SERVICES (Attachment A) MUST INCLUDE: SERVICES AND DELIVERABLES TO BE PROVIDED SCHEDULE OF PERFORMANCE MAXIMUM COMPENSATION AMOUNT AND RATE SCHEDULE (as applicable) REIMBURSABLE EXPENSES, if any (with “not to exceed” amount) 8.ATTACHMENTS: A: Task Order Scope of Services B (if any): N/A described in this Task Order. APPROVED: CITY OF PALO ALTO BY:____________________________________ Name __________________________________ Title___________________________________ Date ___________________________________ this Task Order and warrant that I have authority to sign on behalf of Consultant. APPROVED: COMPANY NAME: Baker Tilly Advisory Group, LP BY:____________________________________ Name __________________________________ Title___________________________________ Attachment A DESCRIPTION OF SCOPE OF SERVICES Introduction Attachment A, the Description of Scope of Services, contains the following four (4) elements: • Services and Deliverables To Be Provided • Schedule of Performance • Maximum Compensation Amount and Rate Schedule (As Applicable) • Reimbursable Expenses, if any (With “Not To Exceed” Amount) Services & Deliverables Baker Tilly’s approach to conducting an assessment of the Employee Mental Health & Wellness includes three (3) primary steps: • Step 1: Assessment Planning • Step 2: Fieldwork and Testing • Step 3: Reporting Step 1 – Assessment Planning This step consists of the tasks performed to adequately plan the work necessary to address the overall assessment objective and to solidify mutual understanding of the assessment scope, objectives, process, and timing between stakeholders and auditors. Tasks include: • Gather information to understand the environment under review o Understand the environment under assessment o Assess the City code, regulations, and other standards and expectations o Assess prior audit results, as applicable o Assess additional documentation and conduct interviews as necessary • Prepare an assessment program o Refine assessment objectives and scope o Identify the procedures to be performed and the evidence to be obtained and examined • Announce the initiation of the assessment and kick-off meeting with key stakeholders o Discuss assessment objectives, scope, assessment process, timing, resources, and expectations o Discuss documentation and interview requests for the assessment Step 2 – Fieldwork and Testing The step involves executing the procedures in the assessment program to gather information, interview individuals, and analyze the data and information to obtain sufficient evidence to address the assessment objectives. The preliminary objective is to determine what are the most effective processes and programs to support employee mental health, wellness, and resilience in high-stress work environments. Steps include • Review existing City policies, programs, and resources related to employee mental health, wellness, resilience, critical incident support, and workplace safety. • Interview employees, supervisors, Human Resources staff, union representatives, and department leadership to identify workforce stressors, program needs, utilization barriers, and organizational culture concerns. • Assess the availability, accessibility, and effectiveness of wellness resources such as employee assistance programs, peer support, counseling services, wellness training, and stress management initiatives. • Evaluate how the City supports employees in high-stress work environments through workload management, supervisor training, incident response protocols, leave practices, and return-to-work processes. • Benchmark the City’s employee wellness and resilience practices against peer municipalities, public safety organizations, and industry best practices to identify effective strategies and program gaps. • Identify opportunities to improve employee mental health support, reduce burnout and turnover risks, strengthen organizational resilience, and promote a healthy and sustainable work environment. 36 Step 3 – Reporting In Step 3, the project team will perform tasks necessary to finalize assessment working papers, prepare and review a draft report with stakeholders, and submit a final report for management response. Tasks include: •Developing observations and recommendations based on the supporting evidence gathered •Validating observations with appropriate individuals •Complete supervisory review of working papers and a draft assessment report •Distribute a draft assessment report and conduct a closing meeting with key stakeholders o Discuss the observations and recommendations o Discuss management responses •Obtain written management responses if appropriate and finalize a report •Review report with members of City Council and/or the appropriate Council Committee Deliverables: The following deliverables will be prepared as part of this engagement: •Assessment Report •Policy & Services Committee Assessment Report Presentation Schedule of Performance Anticipated Start Date: October 1, 2026 Anticipated End Date: May 31, 2027 Maximum Compensation Amount and Rate Schedule The not-to-exceed maximum, inclusive of reimbursable expenses (as summarized below) for this Task is $60,455. The not- to-exceed budget is based on an estimate of 300 total project hours, of which a minimum of 40 are estimated to be completed by the City Auditor. Baker Tilly US, LLP, trading as Baker Tilly, is a member of the global network of Baker Tilly International Ltd., the members of which are separate and independent legal entities. © 2023 Baker Tilly US, LLP. City of Palo Alto Office of the City Auditor (OCA) Policy & Services Committee Meeting Citywide Risk Assessment & FY26 Audit Plan June 9, 2026 2 Risk Assessment Overview P R E S E N TAT I O N •Annual activities required for the OCA: o Task 1 – Citywide Risk Assessment o Task 2 – Annual Audit Plan •FY26 Risk Assessment (November 2025 through May 2026): o Interviews, Risk Synergy sessions with ELT and key staff members; interviewsand survey of City Council o Analyzed documents and data •FY27 Annual Audit Plan (July 2026 through June 2027): 3 Risk assessment considerations R I S K AS S E S S M E N T M E T H O D O L O G Y In f o r m a t i o n G a t h e r i n g • • Financial reports Budget documents Strategic Plan Prior audits Policies Org. Charts Data News articles Ri s k T y p e s • • • • • • • • • • • 4 Risk Analysis R I S K AS S E S S M E N T M E T H O D O L O G Y Risk Synergy sessions with ELT and key staff from 15 departments  review of departmental functions and possible risks  organizational changes  emerging departmental risks  risk scoring – impact x likelihood = risk rating  identification of top risks Survey responses from all City Council members  risk identification/input  risk prioritization 5 Risk Factors – Impact and Likelihood R I S K AS S E S S M E N T M E T H O D O L O G Y Impact (effect on organization) •Magnitude - Budget expenditure of department/function area •Customer/Resident Experience – health, safety, customer satisfaction •Organizational Goals – City Council Priorities Likelihood (probability of risk occurring •Complexity – difficulty performing process or function •Policies & Procedures – present, up-to-date •Regulatory Compliance – existence of and compliance with regulations •Monitoring – monitoring activities and known deficiencies •Specific Risks – current conditions and significance Fraud – consider the function’s susceptibility to fraud 6 Audit Universe (example) R I S K AS S E S S M E N T M E T H O D O L O G Y City Attorney’s Office Identification of Legal Risks Contracts & Legal Document Advisory & Oversight City Clerk’s Office Election Administration Record Retention & Management Council Meeting Management Board & Commission Recruitment Public Records Requests City Manager’s Office Citywide Risk Management Government Efficiency Community & Economic Initiatives Strategic Planning & Governance Office of Transportation Transportation Safety Improvements Parking Management Operations & Capital Project Oversight Signals & Traffic Engineering Information Technology Office of the CIO Enterprise Systems Operations Project Services Community Services Parks, Facilities & Asset Management Recreation & Community Programming Arts, Culture & Education Programming Contract & Vendor Compliance 7 Top Rated Risk Areas R I S K AS S E S S M E N T R E S U LT S 8 Top Rated Risk Areas R I S K AS S E S S M E N T R E S U LT S 9 Top Rated Risk Areas R I S K AS S E S S M E N T R E S U LT S 10 FY27 Proposed Audit Plan R I S K AS S E S S M E N T R E S U LT S Questions?