Indianapolis Marion County Audit Committee - October 2025 Meeting Summary

The Indianapolis Marion County Audit Committee convened on October 30, 2025, for its final meeting of the year. The session focused on a comprehensive year-end review of the Office of Audit and Performance (OAP), including updates on risk management, cybersecurity, internal controls, and performance training initiatives. The meeting included detailed presentations from the Office of Financial Management (OFM) Risk Management, Information Systems Agency (ISA), and OAP leadership, alongside committee questions regarding compliance, staffing, and emerging technologies.

Consent Calendar

• The minutes from the July 2025 meeting were approved by unanimous consent.
• Proposed meeting dates for 2026 (March 13, July 31, and October 30) were reviewed, with a request for committee members to contact Director Jones regarding any scheduling conflicts, noting the goal of maintaining quorum for all three sessions.

Public Comments & Testimony

• Councillor Hart: Expressed concern regarding a 2026 compliance deadline for Section 508 (ADA compliance) regarding PDF and image tagging for municipal entities. He stated that organizations with over 50,000 population must be compliant by 2026 and requested that Director Hill be made aware of this timeline. He indicated that the Audit Committee Chairperson is aware of this requirement.
• Councillor [Name Redacted]: Voiced strong frustration regarding the city's permitting process for the construction industry, describing the sequential nature of storm water, site plan, electrical, and mechanical permits as causing significant delays. The speaker expressed a position that the current timeline is "borderline unacceptable" and stated that the city must focus on creating efficiencies, potentially through a concurrent permitting model, to prevent businesses from losing building seasons.
• Councillor Hart: Asked specifically if the peer review status of the Elevation Grant Program recipients was being reviewed in depth, noting that funds are tied to these grants.

Discussion Items

OFM Risk Management & Safety Update

• Presentation: The unit presented on 2025 operational risk priorities, including workers' compensation data, motor vehicle accident tracking, and business continuity planning.
• Key Statistics: As of the meeting date, the city paid approximately $5.9 million in workers' compensation, while the county paid approximately $582,000.
• Safety Drill: The committee discussed the September 26th City County Building Occupancy Emergency Plan Evacuation Drill, which resulted in the evacuation of 362 people. The average time to evacuate a floor was recorded at 9 minutes and 45 seconds, with a total drill duration of just under 28 minutes. The committee members were informed that the drill proceeded smoothly.
• Training: Updates were provided on 6 OSHA training classes (87 employees trained) and a defensive driving course completed by 205 employees.

ISA Cybersecurity Update

• Presentation: The Information Systems Agency (ISA) presented on 2025 cybersecurity priorities, emphasizing a phishing awareness campaign that has reportedly resulted in declining click rates on test links across the enterprise.
• Speaker Testimony: Director Jones admitted that he personally failed a phishing test in September, resulting in mandatory remedial training. He noted that the click rate has gone downward since the campaign began.
• Compliance & Training: Updates included the implementation of multi-factor authentication, sensitivity labeling for data files, and the development of a future data roadmap. The committee discussed the integration of ISA data classification policies into OAP training.
• 508 Compliance: Councillor Hart raised an inquiry regarding the 2026 deadline for 508 compliance, prompting confirmation that Director Hill is actively working on the process.

OAP Audit & Performance Deep Dive

• Cash Count Review: Audit Manager Heather Jones presented on cash count procedures, referencing 17 key internal control principles.
  • Position on Staffing: The team noted that due to a vacant senior auditor position, the annual goal of 9 cash counts was reduced to 6, which was completed by year-end.
  • Data Analysis: The team confirmed that they do not currently track the total annual volume of cash collected by the Treasury versus small departments (e.g., Parks), acknowledging the variance in risk. Councilor Hart suggested that future audits might incorporate volume data to prioritize high-risk locations.
  • Regulatory Context: It was clarified that state regulations do not require immediate deposit of cash unless it exceeds $500, a caveat that was incorporated into audit testing protocols.
• Performance Training (IndyPerform): Performance Manager Caitlin Edwards presented on the success of the data literacy course.
  • Statistics: The team reported 46 participants from 17 agencies in 2025, with a specific focus on dashboards created by participants (e.g., Department of Public Works having nearly 30 participants and 500 training hours over the course's lifetime).
  • New Initiatives: The team announced a new "Indy Manages Change" training course (expected in 2026) and a self-paced "Lean Continuous Improvement" course completed by 96 individuals.
  • AI Integration: The committee discussed the use of ISA's internal AI model (Co-pilot). Edwards stated that while the team is in the early stages and experiencing "hit or miss" results, they are already leveraging the tool for tasks like generating Gantt charts and are identifying themselves as internal "AI gurus" to guide other agencies.
• Future Audit Plan: Director Jones outlined a shift in the annual risk assessment process, moving from a highly quantitative approach to one that places greater weight on qualitative measures derived from face-to-face interviews with agency leaders. He also announced plans to utilize a staffing firm for the vacant senior auditor role in 2026.
• Permitting Issue: Director Jones relayed that the Mayor's cabinet is actively discussing efforts by DPW, BNS, and DMD to align permitting processes and move from sequential to concurrent approvals to address industry concerns regarding time delays.
• Elevation Grant: Regarding the Office of Public Health and Safety (OPHS) review, the team clarified that while the general operational compliance was reviewed, they have not yet completed a deep dive into the specific usage of Elevation Grant funds but are preparing to do so.

Key Outcomes

• Staffing Strategy: The committee approved the plan to engage a staffing firm to fill the senior auditor vacancy for the beginning of 2026, with the intent to convert the interim to a full-time hire.
• Calendar Confirmation: The tentative dates for 2026 meetings (March 13, July 31, October 30) are pending final confirmation based on committee feedback regarding conflicts.
• Training Schedule: The 2026 IndyPerform Symposium is scheduled for January 29, 2026.
• Risk Assessment Methodology: A directive was established to truncate the quantitative portion of the annual risk assessment and increase the use of qualitative, face-to-face risk interviews.
• Permitting Observation: While no audit action was taken on permitting, the committee was formally notified that the Mayor's cabinet is actively investigating concurrent permitting processes in response to industry complaints.
• Peer Review: The committee noted the necessity of scheduling an ALGA peer review for the audit office in 2026.
• Public Health Audit: The audit of the Office of Public Health and Safety is nearing completion, with a commitment to investigate Elevation Grant fund usage in the coming months.
• Recognition: Committee member Tanya Anjai was publicly acknowledged for her long-standing service and contributions, with a hope for her reappointment.