Annual Report to the Audit Committee Internal Audit Division Work Plan and Activity

Transcription

1 STAFF REPORT ACTION REQUIRED Annual Report to the Audit Committee Internal Audit Division Work Plan and Activity Date: May 31, 2014 To: From: Wards: Audit Committee Director, Internal Audit All SUMMARY This report provides information to the Audit Committee relating to the audit work completed by the City's Internal Audit Division since the last issuance of its Annual Report in October The report includes audit activity over eight months from October 2013 to May Appendix A outlines reports issued since we last reported to the Audit Committee, audits in progress and those planned for the remainder of Audit work projected for 2015 and 2016 is outlined in Appendix B. Internal Audit Division has issued 10 reports in the past eight months. Some of the more significant reviews include a contract management audit of a large capital construction contract in Toronto Water, managed by Engineering and Construction Services (ECS), and a review of the administration of the 5 non-omers pension plans. The work planned for 2015 through 2016 focuses on contract management across the City and includes a follow up review on the Multi Residential Apartment Building Program in MLS that was highlighted in the 2013 annual report. Performance measures such as the percentage of Internal Audit recommendations implemented by City Divisions and overall client satisfaction level with Internal Audit services were exceeded in All except one of the 10 recommendations made by the Institute of Internal Auditors in their 2011 Quality Assurance Review of the Division have been implemented, with the remaining recommendation expected to be implemented by the end of Staff report 1

2 RECOMMENDATIONS The City Manager recommends that: 1. The Audit Committee receive this report for information. Financial Impact There are no financial impacts associated with this report. However, recommendations made by Internal Audit and implemented by management consistently provide program efficiencies and/or cost savings throughout the City. The Deputy City Manager and Chief Financial Officer has reviewed this report and agrees with the financial impact information. DECISION HISTORY In November 2011, the Internal Audit Division underwent an external Quality Assurance review conducted by the Institute of Internal Auditors. A recommendation stemming from this review was that Internal Audit report to the Audit Committee its activities and annual work plan. This is the third annual report to the Audit Committee since the issuance of that recommendation. ISSUE BACKGROUND Effective January 1, 2002, the Institute of Internal Auditors Professional Practices Quality Assurance Standards required "every internal audit department to have an external quality assessment at least once every five years by a qualified independent reviewer from outside the organization." The Quality Assessment was performed on the Internal Audit activity in November The Overall opinion provided by the Institute was that Internal Audit activity partially conforms to the Standards, Code of Ethics and Definition of Internal Audit. They state that a "generally conforms" rating (highest possible rating) could be attained by implementing the ten recommendations in their report. An update on the status of these recommendations is included in the body of the report under section Quality Assurance and Improvement Program and in Appendix C. COMMENTS Mandate and Mission The mission of the Internal Audit Division is to assist senior management meet their responsibilities for maintaining proper systems of internal controls, identify and evaluate significant risk exposures and strengthen risk management throughout the City. Staff report 2

3 The mission is achieved by providing senior management with the following services: assurance (audit) services including compliance, operational, financial, forensic and internal control reviews business and risk consulting including identifying risks and providing advice on the design and development of new or enhanced programs, policies, processes or information systems Key Operational Statistics audits completed Over 6,200 hours spent on audit services 520 hours spent on advisory services 90% average client satisfaction rating 89% of recommendations implemented from prior years 331 hours training undertaken to maintain certifications Staffing The Division has a complement of 6 professional staff and is headed by a Director, see organizational chart below. However the Division has not been at full complement for several years due to gapping, secondments and leaves of absence. In 2013 the average staffing was 5.5 full time equivalents (FTE's) and up to May 2014 the average staffing is 4.3 FTE's or a 28% reduction in staff as shown in the chart below. Staff report 3

4 Currently the Division is in the process of preparing a business case and is in discussion with Information and Technology staff to incorporate an Information Technology auditor to our staff complement. This position is necessary to ensure proper management accountability, benefits management and risk management for large scale business transformation projects that are part of the City's IT landscape. All professional staff in the Division have one or more professional accounting and/or auditing designations. Internal Audit staff hold 17 professional designations. Budget o Diploma in Investigative Forensic Accounting (DIFA) o Chartered Accountant (CA) o Certified Management Accountant (CMA) o Certified General Accountant (CGA) o Certified Fraud Examiner (CFE) o Certified Internal Auditor (CIA) o Certified Information Systems Auditor (CISA) o Certified Government Audit Professional (CGAP) The 2014 budget for the Division consists of gross expenditures of $1.144M, partially funded by divisional recoveries totalling $611K, for a net budget of $533K. The divisional recoveries are provided by the three Clusters as well as the Clerk's Office and Toronto Public Health. The majority of the Internal Audit budget consists of salaries and benefits, $1.121M or 98% of the gross budget. The budget has remained stable with no significant changes over the years as shown in the chart below. Staff report 4

5 The Division has benchmarked 2014 Internal Audit costs within other municipalities and/or agencies in Ontario. Municipality/Agency Comparison of Internal Audit Costs 2014 Municipal/Agency Operating Budget (in $000's) 2014 Internal Audit Costs (in $000's) Number of FTE Staff Audit Costs as a % of Municipal Operating Budget City of Toronto (Excludes ABCC's not audited) 6,500,000 1, % Toronto Community Housing Corporation 662,000 1, % Region of Peel 2,000,000 1, % Toronto Police Services 1,086,000 1, % Toronto Transit Commission 1,697, % City of Mississauga 676,617 1, % City of Brampton 530,000 1, % When benchmarking, it is difficult to make specific comparisons of internal audit costs to the organization's operating budgets as the services offered, size of the organizations, reporting structure, and the specific risks and controls in place for each organization Staff report 5

6 differ. Even though it is difficult to make comparisons, it is evident that the City allocates a lower percentage of the municipal operating budget (.02%) to the Internal Audit Division than other jurisdictions benchmarked (exclusive of the Auditor General's Office). Work Plan 2013/2014 The work plan includes both reviews initiated by Internal Audit based on risk assessment and requests for audit work from management. In 2013 Internal Audit enhanced its Risk Assessment Methodology to ensure a consistent treatment of the risks facing each division. The methodology encompasses ranking of specific risk criteria while taking into account concerns of senior management. One major area of focus for the Division continues to be contracts managed by City divisions. There are significant risks and exposures if these contracts are not managed appropriately. To address the potential risks, Internal Audit has conducted contract management audits every year. Though limited by staffing resources and less than a full complement of staff in the past several years, as noted on page 3, Internal Audit continues to annually: conduct a follow up on recommendations issued by Internal Audit co-ordinate AG annual follow up of recommendations co-ordinate the AG Continuous Controls Monitoring responses from Divisions several times a year conduct a vendor-employee match and report out on results at least once every year Other related work conducted on an as needed basis includes: providing risk and control advice to all City Divisions acting as a point person and providing advice relating to conflict of interest inquiries conducting, assisting as well as providing advice in fraud investigations assisting management in responding to AG audits upon request Appendix A details the 10 audit reports issued since the last Annual Report to the Audit Committee, projects in progress and projects scheduled for the remainder of Some notable reviews that are projected to be completed include a Review of the Complaints Handling process in selected City Divisions, Transportation Services contract managed by Engineering and Construction Services, Bridge Inspection Practices and the use of Consultants in Risk Management and Information Security and Enterprise Architecture Units within the City's Information & Technology Division. The table below provides details on a few of the more significant projects completed and reports issued since the last report to the Audit Committee. Staff report 6

7 Summary of Significant work since October 1, 2013 Audit Project Non-OMERS Pension Administration Pension Payroll and Employee Benefits (PPEB) Contract Management Review Engineering and Construction Services (ECS) managed Toronto Water Construction Contract Ashbridges Bay 2013 Annual Follow up on Internal Audit Recommendations Objective and Results Objective: Assess the adequacy of control pertaining to the administration of the 5 City sponsored pension plans. Results: As a result of our audit, PPEB will: enhance supervision of pension service representative activities and segregate incompatible functions improve the physical security over and completeness of pensioner files improve prevention and collection of overpayments made to pensioners perform regular confirmation of pension accounts on a go forward basis Objective: To assess whether there are adequate processes and controls in place to ensure the construction contract is properly managed. Results: As a result of our audit, ECS will: enhance oversight of consultant and contractor activities and document evidence of that oversight update the Capital Works Manual to reflect the various project delivery methods and change order process improve process for calculating contingency allowances Objective: To determine the adequacy, effectiveness and timeliness of corrective actions taken by management on IA reported findings. Results: A total of 509 recommendations have been made by IA since of these recommendations have been determined to be no longer relevant Of the 486 remaining recommendations, 431 (89%) have been fully implemented as of October 2013 and 48 (10%) have been partially implemented Staff report 7

8 Audit Coverage by Area The work plan is based on risk. However, the work plan is also designed to provide audit and advisory services to each Cluster. The charts below show that Internal Audit has provided equitable service to all Clusters. Advice Hours by Area Advisory services are provided based on ad hoc requests by divisional management and staff. The chart below shows the amount of hours spent providing advice to each cluster. Cluster Hours on Advice To Dec. 31, 2012 Hours on Advice To Dec. 31, 2013 Cluster A Cluster B Cluster C Corp - city wide - 74 Other - Clerks, CMO, Legal ABC 13 4 Total Staff report 8

9 A Look Ahead Work Plan 2015/2016 The projected work plan for 2015 to 2016 will continue to focus on contract management with reviews planned in Solid Waste Management (deferred from 2014), Toronto Water (Basement Flooding Relief Program and other major capital contracts) and Information Technology Project Management. Other key reviews planned include MLS Integrated Business Management System controls and data integrity and a review of Medical and Fire emergencies response times. See Appendix B for further details. Performance Measures Performance metrics used to measure divisional performance are 1 : Internal Audit Recommendations Implemented Our goal is to facilitate the implementation of 90% of audit recommendations. Client Satisfaction Our goal is to maintain an 80% client satisfaction rate. An audit effectiveness survey is provided to clients after each audit which gauges client satisfaction, professionalism and knowledge of staff, and overall value added by Internal Audit Services. We have consistently exceeded our goal in the last 7 years. 1 Internal Audit will refine performance measure as more data is accumulated. Staff report 9

10 Number of Audits Completed Our goal is to complete 15 audits annually. This performance measure was implemented in Staff report 10

11 Challenges The audit work plan is formulated based on the availability of 6 professional staff. The 6 staff are responsible to conduct reviews across the more than 45 Divisions in the City and the three DCM offices. Given the magnitude of the City operations and the risks present in such a large organization, sufficient annual coverage cannot be provided with the limited resources available to the Division. Specifically, the number of professional staff does not allow Internal Audit to perform key audits of City Divisions and programs on a cyclical basis, which is the best practice in the field of internal auditing. As part of the KPMG Shared Service Report the City Manager received council approval on June 11, 2013 to implement the following recommendation in "Enhance the use of the City s Internal Audit Division for compliance, assurance and business risk consulting services by agencies that do not have their own audit resources." This recommendation in turn places further pressure on the Divisional human resources requiring the Division to market its services outside City Divisions and be available to service the audit needs of Agencies, Boards, Commissions and Corporations (ABCC's). This expanded scope of service will further impact the ability of the Division to provide value added services to its clients. The City Manager agrees with the aforementioned pressure in the staff Report "Results Arising from the Shared Services Study Related to Internal Audit and Jurisdictional Research Respecting Funding Models for Accountability Functions" dated February 1, He stated that "It is the City Manager's view that the City's audit resources, including for the Auditor General's Office, are lean relative to the size and complexity of Toronto's government and there are limited opportunities for further efficiencies." Quality Assurance and Improvement Program In November 2011, the Internal Audit division underwent a Quality Assurance review conducted by the Institute of Internal Auditors (IIA). The Overall opinion provided by the Institute was that Internal Audit activity "partially conforms" to the Standards and there were 10 recommendations included in their report, summarized in Appendix C. Internal Audit has successfully implemented 9 of the 10 recommendations. The remaining recommendation relates to the implementation of a Quality Assurance and Improvement Program (QAIP). In 2014, Internal Audit will begin an initiative to establish a QAIP. It will aim to provide a formal structured approach to ensure quality in Internal Audit activities and demonstrate compliance with the IIA standards of professional practice. The QAIP will be fully developed by 2015 and will encompass: ongoing monitoring periodic internal self assessment external quality assessment Staff report 11

12 Shared Service Review In June 2013, Council approved the City Manager to begin implementation of the following recommendations made by KPMG in the shared service report that relate to Internal Audit: enhance the use of the City s Internal Audit Division for compliance, assurance and business risk consulting services by agencies that do not have their own audit resources establish a Quality Assurance Centre of Excellence to leverage tools, templates and specialized skills, coordinate work plans and share best practices The Division has provided and will continue to offer audit services to ABCC's by request on a fee for service basis. Internal Audit has in the past provided audit services to Exhibition Place and Toronto Community Housing Corporation and has 2 reviews planned for the Police Service Board in 2014/2015. Furthermore, a meeting has taken place with the Toronto Public Library to identify current outsourced audit services that can be potentially performed by Internal Audit Internal Audit has selected a sample of Quality Assurance units across the City divisions (Toronto Water, Toronto Public Health, Toronto Employment and Social Services, Children's Services, and the Shelter Support and Housing Administration) as a pilot group and has gathered information with the goal to get familiar with the various QA functions. Once completed, the Division will facilitate a group discussion to determine benefits of further meetings with stakeholders to share the practices, methods and tools used by individual QA groups. If it is decided sharing opportunities would be beneficial, alternatives for sharing this knowledge including extending this opportunity to ABCCs would then be explored and evaluated. In addition, an Internal Audit Working Group (IAWG) that includes senior internal audit representatives from the City of Toronto, Toronto Police Service, Toronto Transit Commission and Toronto Community Housing Corporation has been formed and is now in its second year. Meetings are held on a quarterly basis. Membership has been extended to the Toronto Parking Authority in Progress achieved to date by the IAWG include sharing of best practices in areas such as electronic staff time tracking, audit risk assessment methodology, utilizing electronic audit working papers, and minimizing costs of professional memberships. Staff report 12

13 CONTACT Ruvani Shaubel, Director Internal Audit Division SIGNATURE Ruvani Shaubel, Director Internal Audit ATTACHMENTS Appendix A Internal Audit Work Completed since Last Annual Report Appendix B Internal Audit Potential Projects for Appendix C Summary of Quality Assurance Recommendations Staff report 13

14 APPENDIX A INTERNAL AUDIT WORK COMPLETED AND IN PROGRESS SINCE LAST ANNUAL REPORT As of May 31, 2014 Name of Project/Division Project Objectives Project Start Date Report Date*** Project Results 2013 Projects Completed and In Progress 1. Review of Divisional Fraud Action Plans (FAP's) Clusters A & C To assess the effectiveness of divisional FAP's. The objective of this review is to address division specific fraud risks and assess related controls and furthers the objectives of the AG's Forensic Unit. March 2013 March 2013 "A" September 13, 2013 "C" October 16, 2013 Recommendations made to improve mitigation of fraud, including training and enhanced documentation in FAP. 2. Contract Management Review Engineering and Construction Services (ECS) Toronto Water 3. Review of Processes Surrounding the TESS Benefits Card Annual Follow Up of Internal Audit Recommendations Review of contract managed by ECS for adequacy of oversight and contract management practices. To conduct a postimplementation review on the Benefit Card processes. Follow up on the status of Internal Audit recommendations. May 2013 February 7, 2014 Recommendations made to improve management's oversight of consultant and contractor activities. August 2013 March 10, 2014 Recommendations made to improve security of cardholder personal information, issuance of benefit cards, reporting and system controls. October 2013 December 6, % of recommendations have been implemented. 14

15 APPENDIX A INTERNAL AUDIT WORK COMPLETED AND IN PROGRESS SINCE LAST ANNUAL REPORT As of May 31, 2014 Name of Project/Division Project Objectives Project Start Date Report Date*** Project Results 5. Administration of City Pension Plans** To assess the adequacy of controls pertaining to the administration of the 5 City sponsored pension plans. July 2013 December 12, 2013 Recommendations made to improve management oversight of system changes, physical security of pensioner files, overpayments, outstanding cheques, transfer funds and journal entries. 6. Labour Relations Grievance Process** To ensure the administration and reporting of grievance and arbitration activities is efficient and effective. May 2013 December 18, 2013 Recommendations made to improve grievance documentation, response time, administration and management reporting. 7. Review of Time & Attendance Processes PF&R** Review processes to ensure the completeness, validity and accuracy of payroll data. September 2013 February 6, 2014 Recommendations made to standardize payroll processes and improve supervisor oversight across all community centres. 15

16 APPENDIX A INTERNAL AUDIT WORK COMPLETED AND IN PROGRESS SINCE LAST ANNUAL REPORT As of May 31, 2014 Name of Project/Division Project Objectives Project Start Date Report Date*** Project Results 8. Review of Fleet Asset Acquisition** Review the vehicle acquisition process to ensure vehicles are approved for purchase or replacement, specifications are provided and reserve monies are in place. August 2013 September 16, 2013 Recommendations made to improve the processes of disposition and acquisition of vehicles. 9. Review of Management Oversight and Controls Relating to Attendance and Overtime Management Cluster A To review management of attendance and overtime in selected Divisions within Cluster A. This review complements the AG Continuous Audit Monitoring efforts. February 2014 In Progress Overtime portion of this review has been cancelled. Preliminary work and Auditor General Continuous Auditing of this area has minimized the risk and shown that overall overtime has consistently decreased. Attendance Management portion started in Review of Processes and Controls Revenue Services Vacancy Rebates Review to be conducted relating to adequacy of controls for the vacancy rebate for commercial properties. Q (Tentative) Deferred from 2013 due to the implementation of new system. 16

17 APPENDIX A INTERNAL AUDIT WORK COMPLETED AND IN PROGRESS SINCE LAST ANNUAL REPORT As of May 31, 2014 Name of Project/Division Project Objectives Project Start Date Report Date*** Project Results 2014 Projects Completed and In Progress 1. Review of Seaton House Processes** To investigate FWH allegations and provide recommendations for improvement. February 2014 March 14, 2014 Recommendations made to improve cash handling, security, process documentation and training. 2. Pension Investigation** To assess the completeness of documentation retained and existence of active pensioners. March 2014 In Progress 3. EDC IMIT Grants** To ensure adequate documentation and controls exists around processes of application, financial incentive agreement, annual review and payment. March 2014 In Progress 17

18 APPENDIX A INTERNAL AUDIT WORK COMPLETED AND IN PROGRESS SINCE LAST ANNUAL REPORT As of May 31, 2014 Name of Project/Division Project Objectives Project Start Date Report Date*** Project Results 4. Review of a Transportation Services Contract Administered by Engineering & Construction Services (F.G. Gardiner Expressway Structure Repair York Street to Jarvis Street) To assess the processes and adequacy of controls in place to ensure the construction contract is properly managed. March 2014 In Progress 5. Review of Internal Quality Assurance Functions in Employment & Social Services, Children's Services, Toronto Water, Shelter, Support, Housing & Administration and Toronto Public Health divisions The objective is to determine similar processes and best practices in each of the programs that could be leveraged and expertise shared. March 2014 In Progress 6. Compliance with Bridge Inspection Standards and Legislation To assess the procedures in place to support the ongoing safety and repair of bridges and compliance with the Public Transportation and Highway Improvement Act. Q

19 APPENDIX A INTERNAL AUDIT WORK COMPLETED AND IN PROGRESS SINCE LAST ANNUAL REPORT As of May 31, 2014 Name of Project/Division Project Objectives Project Start Date Report Date*** Project Results 7. Management of Consultants in the Risk Management & Information Security Unit and the Enterprise Architecture Unit. To assess the adequacy of process and controls in place to manage consultants. May 2014 In Progress 8. Review Effectiveness of Complaints Handling Processes in Selected Cluster B Divisions To determine the effectiveness of the complaints handling process. June Review of Payroll Processing Controls To assess controls to ensure payroll is processed accurately and timely. July Transportation Services Toronto Hydro Street Lighting Contract Review** To assess the processes and adequacy of controls in place to ensure the contract is properly managed. June OMBI Measures** To determine the integrity of information. Q (Tentative) 19

20 APPENDIX A INTERNAL AUDIT WORK COMPLETED AND IN PROGRESS SINCE LAST ANNUAL REPORT As of May 31, 2014 Name of Project/Division Project Objectives Project Start Date Report Date*** Project Results 12. Review of Vacancy Rebate Program Processes and Controls 13. Review of Processes and Controls Pertaining to the Life Cycle Management of the Water Infrastructure 14. Conduct two (2) reviews requested by the Toronto Police Services Board Control of Evidence/Property Human Rights 15. Development of Internal Audit's Quality Assurance Improvement Program To assess the adequacy of controls for the vacancy rebate for commercial properties. To ensure a strategy to maintain infrastructure is in place and adhered. Requests from the Toronto Police Services Board (Objectives TBD when reviews are approved) To provide a formal structured approach to ensure quality in Internal Audit activities and demonstrate compliance with the IIA standards of professional practice. Q (Tentative) Q (Tentative) Q (Tentative) Q (Tentative) 20

21 APPENDIX A INTERNAL AUDIT WORK COMPLETED AND IN PROGRESS SINCE LAST ANNUAL REPORT As of May 31, 2014 Name of Project/Division Project Objectives Project Start Date Report Date*** Project Results 16. Annual Follow Up on the Status of Outstanding Internal Audit Recommendations in 2014 Follow up on the status of IA recommendations Q (Tentative) 17. Contract Management Review of the Renovation of the St. Lawrence Market North Building To assess the processes and adequacy of controls in place to ensure the construction contract is properly managed. Q (Tentative) 18. Review of Bid Packages Transportation Services To ensure that bids are reviewed and assessed accurately. Q (Tentative) 19. Review of MLS Progress System Controls and Data Integrity To ensure the adequacy of controls and integrity of data. Deferred Deferred due to client reviewing the processes and IT systems. 20. Review of Business License Issuance Processes and Controls in MLS Review of processes and controls to ensure effective and efficient issuance of various business licenses. Deferred Deferred due to client reviewing the processes and IT systems. 21

22 APPENDIX A INTERNAL AUDIT WORK COMPLETED AND IN PROGRESS SINCE LAST ANNUAL REPORT As of May 31, 2014 Name of Project/Division Project Objectives Project Start Date Report Date*** Project Results 21. Review of a Solid Waste Management Contract Administered by Engineering & Construction Services To assess the processes and adequacy of controls in place to ensure the construction contract is properly managed. Deferred Deferred due to no significant SWM contracts involving ECS in progress in Contract Management Review for the Supply and Cleaning of Work Garments for Toronto Water, Solid Waste Management and Transportation Services To assess the processes and adequacy of controls in place to ensure the goods and services contract is properly managed. Deferred to 2015 Deferred until 2015 as new contract has not yet been awarded. 22

23 APPENDIX B POTENTIAL PROJECTS Contract Management Reviews: Contract management review of various Major Capital Projects in Toronto Water Contract management review of the Basement Flooding Relief Program administered by Toronto Water Contract management review of Agreements to Supply Water to other municipalities Contract management review of Construction of new Data Centre Effectiveness of Information & Technology Project Management Review of management of Lease Agreements processes and controls Contract management review of the Implementation of Automated Water Meters Compliance and Operational Reviews and Special Projects: Review the efficiency and effectiveness of the Multi Residential Apartment Building (MRAB) program Review effectiveness of Complaints Handling Processes in selected divisions within Cluster A and C Review of MLS Integrated Business Management System (IBMS) controls and data integrity Compliance with Environmental and Health & Safety regulations and standards in Solid Waste Management Review of processes and controls in the tracking and use of development charges Review effectiveness of emergency plans and performance Review of processes and controls with respect to the Enforcement of Property Standards 23

24 APPENDIX B Review of medical and fire emergencies response times Other Projects & Reviews: Annual follow up on the status of outstanding Internal Audit recommendations in 2015 and 2016 External Quality Assurance Self Assessment of Internal Audit Division Original Approved by: Director, Internal Audit City Manager 24

25 APPENDIX C SUMMARY OF QUALITY ASSURANCE RECOMMENDATIONS Recommendation Management Response Status 1. Enhance Independence of the IA Activity and the Accountability of Management s Acceptance of Risks Ensure that IA activity is given adequate access to the Audit Committee and adopt the practice of reporting to the Audit Committee on audit plan and results. The City Manager and Deputy City Managers, in consultation with the CAE, will re-assess the role, responsibility and reporting relationship for the City's internal audit function as part of the overall service review of shared functions across the City. Starting in 2012 the CAE will submit to the Audit Committee an annual summary report on the activity undertaken by the Internal Audit Division and the Divisional Work plan for the next two years. Complete 2. Revise the Internal Audit Charter Revise the Internal Audit Charter to include the following: Purpose refer to Internal Audit s role in assisting management to determine that processes are functioning in a manner to ensure programs, plans and objectives are achieved Reporting Relationship enhance to include periodic reporting to the Audit Committee on the Internal Audit annual plan, performance against plan, and key matters raised, as referred to in Part I, item 1 Refer to the mandatory nature of the Standards as required by Standard 1010 Review the charter annually, as part of the Quality Assurance and Improvement Program, to ensure its continued appropriateness, and submit to the Audit Committee for re-approval. 25 Internal Audit will revise the Charter accordingly and include the revised charter in their annual reporting to the Audit Committee in Going forward the charter will be reviewed and its appropriateness determined on an annual basis. Complete

26 APPENDIX C SUMMARY OF QUALITY ASSURANCE RECOMMENDATIONS Recommendation Management Response Status 3. Expand the Quality Assurance and Improvement Program Establish, as part of the QAIP, a schedule of periodic assessment of conformance to Standards. Provide an annual report on the overall results of the QAIP in order to ensure maximum benefit and improvement from the program. Consider additional meaningful performance metrics from the Quality Assessment Manual, GAIN (Global Audit Information Network) and other sources, to improve measurement of Internal Audit effectiveness in carrying out its mandate. Internal Audit will review the IIA guidelines for periodic assessments scheduled to be released in March 2012 and consider adjusting performance metrics to improve measurement of internal audit effectiveness. In Progress 4. Improve Coordination with other Audit, Compliance and Assurance functions Establish disciplined protocols for regular coordination with the Auditor General, external auditors, and other appropriate internal and external providers of assurance compliance or consulting services. This should include timely sharing of the approved audit plan and changes thereto, and copies of internal audit reports. Internal Audit has initiated and will continue meetings with the external auditor on an annual basis and will continue to the ongoing practice of co-ordinating work with the Auditor General's Office to ensure there is no duplication and inefficiency in the City's overall audit programs. Written protocols will be formulated for inclusion in the Internal Audit manual outlining the co-ordination activity between the audit functions in the City and sharing of audit work plans and reports. Complete 5. Enhance the Risk Assessment and Annual Planning Process Enhance the Internal Audit risk assessment and annual plan 26 The Risk assessment and annual plan methodology will be reviewed and enhanced to consider the above and to ensure balance between assurance and advisory/consulting Complete

27 APPENDIX C SUMMARY OF QUALITY ASSURANCE RECOMMENDATIONS Recommendation Management Response Status methodology to ensure: the audit universe includes all programs, major projects, systems, and management processes that are considered essential to the accomplishment of the organization s objectives the risk assessment and prioritization of audits follows consistent criteria, is adequately documented and aligns with the audit universe staff time for each audit in the plan is estimated to enhance resource management and as input to performance measurement as addressed in item 9 below the plan and performance against it is communicated to the Audit Committee as addressed in PART I, No. 1 above services. Specific requests of management for assistance will be considered based on risk assessment. 6. Formalize and Document Communication and Approval of the Audit Plan Formalize and document Audit Committee approval of the annual Internal Audit Plan and significant changes thereto. 7. Institute a Standard Procedure to Assess Risk at the Engagement Level As per Part I, item 1, Internal Audit's role and reporting relationship will be re-assessed as part of the City's overall review of Internal Audit functions across the City. Starting 2012 the CAE will submit to the Audit Committee an annual summary report on the activity undertaken by the Internal Audit Division which will include planned areas of work for the two upcoming years. Internal Audit will develop a standardized format to assess risk at the project engagement level. Complete Complete Implement a standard procedure for assessing risk at the engagement level to complement the existing planning 27

28 APPENDIX C SUMMARY OF QUALITY ASSURANCE RECOMMENDATIONS Recommendation Management Response Status disciplines for objective and scope. This will help ensure consistency in the confirmation of the risk on which the project selected and that individual risks within the area are adequately assessed. 8. Reassess Process for Evaluating Management Requests for Services Reassess the process for evaluating management requests to ensure an appropriate consideration of risk and the effective and efficient deployment of resources toward the greatest risk and added value. Management requests for assistance will be considered in light of risk and availability of resources. Complete 9. Establish Periodic Formal Reporting on the IA Activities and Results Internal Audit reporting should be enhanced to include periodic (quarterly) reports to senior management and the Audit Committee on: the Annual Internal Audit Plan and any changes thereto progress against the plan, significant risk exposures and issues raised, results of follow up audits, and Internal Audit performance against QAIP metrics. Internal audit will report on a regular basis to the City Manager on the above noted topics and on an annual basis to the Audit Committee. Complete 10. Consider Implementing Additional Reporting, Efficiency and Effectiveness Improvements 28 The Division will copy the City Manager on all audit reports; continue to strengthen follow up procedure started Complete

29 APPENDIX C SUMMARY OF QUALITY ASSURANCE RECOMMENDATIONS Recommendation Management Response Status Ensure that existing guidelines on report distribution include the requirement that all audit reports be copied to City Manager. in 2011 and consider further enhancements to audit tools and techniques currently in use. Continue strengthening the recently initiated process of follow up of Internal Audit recommendations. Develop and make use of further audit tools and techniques currently available to the profession; i.e., risk analysis, automated working papers etc. 29