And on the roll call, we're gonna use it just a little bit different.

Um, just because we are reporting and to make sure that we have clarity on our recordings.

I'm gonna ask your things over on the room and just say your name and position that way can we do the voice with the voice you recording that's clear if you speaking.

So I'm Dina Infield, I'm chair of the committee, and I'm a citizen member.

Russell Bragg, uh citizen member Lacretia Parkinson's staff auditor.

Amanda Strange, director of internal audit Christie Fisher staff auditor's chief financial officer, Neil Martin board member Christina Gassava City Director.

Thank you all.

Um has provided the um agenda for the meeting and first on the agenda is approval and the minutes from the July 10th meeting.

Those were sent around to if there are any changes to those of those or accept a motion to make those approved.

So moved.

So all in favor say aye.

Aye, aye.

Those minutes are considered approved.

So next on the agenda is the draft of the um water and sewer risk assessment by silly and SICE is electronic and is going to use on the call and is going to go over the draft report with us.

Hey Stacy.

Yes, hi there, hi everyone, committee members.

Thanks so much for having me.

Um I am going to share my screen.

I will walk through the PowerPoint report that you should have a copy of.

As I'm going through, if there's any questions, um, you know, it may get answered in subsequent slides, but um if anything's really top of mind, feel free to just jump in um and interrupt.

Okay.

All right.

So we conducted the risk assessment of the water and sewer utility departments.

The scope of this was just within those two departments, and our objective here was to get a comprehensive perspective on risk that could potentially impact the strategic objectives specific to those departments, um, get insights into any opportunities, challenges, um, you know, or concerns as it relates to the various types of risk.

So this you know could encompass strategic risk, financial risk, operational compliance, public perception technology kind of across the board.

Um then lastly, it was to identify and be able to prioritize risk across these departments to propose potential audits to be conducted in the future by internal audit.

Our approach for this, um, we pulled together a survey, one for management and one for employees designated within those departments as well as at the upper management level to you know gain um sort of insights into the different functional areas, um, you know, what any potential issues, concerns, um, existing risks, uh, kind of the critical things that could potentially impact those areas in consideration of you know what the ultimate um purpose, intention, and objectives are for each of those areas.

We also had some subsequent um meetings, both with members of management employees, and spoke with um uh a number of the audit committee members.

We took the information that we gathered both obtained from the survey, interviews, as well as um some you know key background documentation that we gathered to really get an understanding of what are those areas where there are um those more high priority risks.

So the way that we did this is we developed what we call an audit universe, and that's really kind of starting with um within the departments.

So the way that we did this is we developed what we call an audit universe, and that's really kind of starting within the departments, what are the key functional areas within those departments?

And then we have a structured risk rating methodology.

So I'll get into that a little more later, but but that's really what we're using to conduct the risk assessment and to try and you know prioritize those risk that we identify across the board.

We used the information gathered from the survey, you know, pulled themes based on responses.

We leveraged you know things that we've seen kind of just within the industry that are top risk and top of mind and use that to you know incorporate into what we call our risk matrix matrix to be able to prioritize those risks.

So the way that we know assess risks is really based on a methodology that considers the impact and the likelihood of risk that exist.

So the impact is thinking through, you know, what would be the impact, what would be the severity of the consequences if these risk events were to occur, and then the likelihood would consider you know how probable is it that this risk event could happen.

So taking those two components, we come up with an overall risk score.

The survey results within this portion of the report, uh, it's just reporting and showing you a little insight into you know some of the more general survey questions, what those results looked like.

Um I'll go through this a little quickly, but if you have any questions, please let me know.

But this is really, you know, just gonna show you some graphs in terms of what responses were to some of these more general questions that we had.

So as far as the survey responses, like I said, we had a survey that went out to members of management, as well as a survey that went out to other lower levels employees.

So we had received 28 responses to the management survey and 81 staff responses.

So we got about an 85% response rate on the management one and 43% response rate on staff.

Some of the general responses that we got, you'll see here on the left, it's kind of showing, you know, in general we asked, you know, what they see as kind of the top five risk areas for these departments, and um across the board, the staff you can kind of see from one to 10 what those top areas were: reputation, planning, budgeting, economy, leadership, and citizen demands.

Um, and then on the right, that's sort of the management responses where you will see kind of a lot of similar themes across the two.

The second one is um, you know, where have there been areas of significant change?

So change is definitely something to consider when you're assessing risk and thinking about it.

So this is sort of what the responses looked like.

Obviously, having just recently gone through a change in org structure, um, that was the top area that participants noted.

We also ask about policies and procedures, and you know, this is something that gives a little bit of insight into you know ability to have consistent operations to be able to you know stay in compliance, um, you know, it it also shows you know, kind of the strength and implementation of internal controls, things like that.

So we asked about the adequacy policies and procedures in these areas, you know, 50% were saying that yes, we've got policies and procedures that are adequate and up to date, um, and then other responses range from you know they're documented, not updated regularly, or they need improvement.

Um, next is barriers to meeting goals and objectives.

So trying to gauge, you know, what are the things that could potentially impact your department or your functional areas ability to meet your objectives to be able to get done what you need to get done, and some of the things that came in at the top here were financial constraints, staffing constraints, um, limited skills, knowledge, experience, training, um, and efficiencies and process and communication there.

So going on to the next section, risk scores.

So as I mentioned before, we had structured that audit universe across departments and key functions, which gave us kind of 17 key functional areas that we were looking at and considered risk for.

So we considered those risks that are just inherent to these areas, so risk that exist regardless of the current state or internal controls or whatever's going on.

But we also considered, you know, what are any current departmental concerns, weaknesses, or potential threats that exist.

So you'll see here these are the 17 functional areas that we were looking at, and after going through the risk assessment, this is kind of how these fell from a risk perspective.

Those at the top really, you know, the highest risk areas down to the bottom of the lowest risk areas.