I can I can hear you well.

Thank you.

Okay, perfect.

Thank you.

We will begin the meeting shortly.

Okay, terrific.

It's Cara Kelly again.

Good morning, everyone.

Today is July twentieth, Monday, two thousand twenty-six, and this is the audit oversight committee meeting.

Agenda item number one, call to order and roll call.

The July twenty, twenty twenty-six audit oversight committee is called to order.

Will the city clerk call the roll, please?

Chair Price.

Present.

Member Kircher.

Present.

Member Bruni.

Present.

Member Kelly.

Present.

Thank you, Chair.

You have a quorum.

Thank you.

Agenda item number two.

An announcement regarding compliance with open meeting law.

City Clerk, has this meeting been noticed and posted in compliance with the open meeting law?

Yes, Chair, it has.

Thank you.

On to agenda item number three, public comment.

Agenda item number three is public comment.

Comment during this portion of the agenda must be limited to matters on the agenda for action.

If you wish to be heard, come forward and give your name for the record.

The amount of discussion as well as the amount of time any single speaker is allowed may be limited.

Is there anyone wishing to be heard at this time?

Seeing none, I'll close the public comment portion and we will move on to agenda item number four.

Agenda item number four for possible action to approve the final minutes by reference to the regular meeting of April twentieth, two thousand and twenty-six.

And the motion will carry.

We will now move on to agenda item number five.

Agenda item number five.

Discussion for possible action regarding the audit of innovation and technology department.

Mobile communication devices management.

Louis.

Louie, how do you say your last name?

It's Halad.

Halad.

I always get that.

Louis Aladd, senior IT auditor, will be discussing this audit.

Please go ahead, Mr.

Halad.

Thank you.

I get that a lot.

Sure, so do I.

All right.

Thank you and good morning.

Louis Hillad, Senior IT auditor.

I'm here to talk about our audit of mobile communication device management, which is a mouthful.

Our original name was cell phone audit, but that doesn't really capture the entire breadth of what we were looking at here.

So that's the name we landed on.

So as you likely know, the city issues communication devices to some of its employees in order to conduct official city business.

These devices can be separated into three main categories.

You have mobile mobile phones, which are mostly smartphones, but we do have some flip phones.

Tablets, we focused only on tablets with cellular capability, which means that we pay a monthly phone bill for them.

Tablets or other devices that we use exclusively over Wi-Fi for free were not part of our audit.

And the final category here is embedded chips.

What we mean here is uh it's basically the other devices bucket.

Um this is any device that can be used out in the field or away from uh city facilities.

Um they connect to a cellular network.

So think about uh ruggedized laptops that are used out in the field.

Um our emergency vehicles, a lot of them have vehicle gateways built into them.

So those are the devices for this last uh this last bucket here.

All of these devices are managed by the innovation and technology department.

Um they do a lot for us.

They order the phones, they stock them, they assign them out based on requests from each department, they upgrade them, swap them out for newer models, um, they collect them from departing employees, they wipe the data, they dispose of them.

Uh they do they hold the main relationship with the carriers.

Um they do pretty much everything except for pay the bill, finance pays the bill.

Um, but IT is doing a lot here.

So, in order to coordinate all these activities, IT maintains an inventory record of each device in a management platform called ServiceNow.

We'll be talking about the ServiceNow platform throughout this.

Here's some numbers.

Top table here shows the number of active mobile devices.

So these devices that we are uh paying a phone bill for, not devices that are in stock in a stock room somewhere not being used.

Um, as you can imagine, this number changes from month to month as new devices come on, old devices get retired.

Um, this is a snapshot of what it was as of last October.

Um, a total of 1946 devices across the three categories.

Um I believe that number is a little higher today over 2,000, but this is what it was back in October.

The bottom table here shows total service charges over a one-year period.

The one year period we chose was November 2024 through October 2025 billing cycles.

So this is 12 months of phone bill data.

And uh here's what we spent all together on the mobile devices during that year.

You can see at the bottom of that table, the 851,000 number.

Um, throughout this report, we'll be using the same one-year time frame for each of our analyses.

Um, as far as distribution is concerned, about a quarter of these devices are used by fire and safety, and then um another quarter of them are split more or less evenly between public works and public safety.

So those three departments, fire and safety, public works, and public safety account for about half of our mobile devices.

We decide to focus on three aspects of IT's mobile device operations for this report.

Um, you can read the objectives there in full, um, but basically there are three areas of objectives.

The first is charges and records.

Umly amounts by the carriers.

Are internal records accurate and complete?

Second one is utilization and need.

Are we making good uses good use of the devices that we're paying for?

And are we deactivating devices as they're no longer needed?

And third one is approvals and disposals.

Um devices being approved by supervisors according to city policy before being distributed at the beginning of their life cycle, and then at the end of their life cycle, are we disposing of the old devices in a responsible way?

Not represented on this list.

Hardware management.

We just finished an audit fairly recently of IT hardware.

So we didn't repeat that here.

We're not looking at keeping track of the physical devices in an inventory style.

That's not that.

Cost of devices, the devices themselves are not a huge cost to the city.

We didn't focus on that.

I think we end up actually making money on some of these iPhones when we recycle them.

So the cost of the actual devices themselves is not what we focused on.

We're more looking at monthly billing and internal processes.

Let's dive into each of these objectives.

First one is charges and our internal record keeping.

So we took all the devices listed on the phone bills during that one year period, November 2024 through October 2025, and we compared that list to IT's records in service now.

And before you ask, that number 2707 is higher than the number I showed you previously.

That number, the 1946 number, was a snapshot of one month's bill.

This number here includes every phone that showed up on a bill throughout an entire year.

So it included all of those October 2025 devices, as well as some devices that were on previous bills but got disconnected before October.

So the number here is 2707 over a year.

So we found over 97% of the devices that showed up on those phone bills were present in IT's inventory records.

And then we found 74 devices that were not represented in IT's inventory records.

So likely uh likely something that went around the official process, um, which we're gonna talk about in a future slide here.

Um T helped us perform this analysis and recognize that they hadn't performed a comparison like this in recent years.

In fact, there was no policy or procedure on the books that required such an analysis be done.

Um, and so stay tuned for our recommendation on that.

The very good news here is that though the inventory records were not 100% accurate, we found no evidence of improper billing.

With IT, we researched each of these uh 2,707 devices, and we determined that we did indeed intend to pay for all of them.

So no financial issues here, um, just need to clean up our records.

Here are our recommendations.

Uh the first one, 1.1.

We recommend that IT management should perform one-time data reconciliation similar to the one that we completed that compares what shows up on the phone bill to what's listed as an active device and service now, and see if those two sets match.

And then 1.2 is to create a procedure that requires the analysis to be done on a regular basis, so that we'll notice if there's ever a billing or record error.

Let's move on to our second objective.

This is based on utilization and need for our devices.

The question basically is are we using the phones that we've got?

Uh so using the phone bill data from that same one-year time span.

We looked at we looked for devices that showed no activity.

That means no calls were made, no text messages, and no data use.

Uh and you see the top table there, those are those devices.

375 of them that showed no activity during the year.

Um, the charges shown there are what we paid over the course of the year for those devices that uh almost 85,000 number there.

And then similarly on the bottom table, we widen our search a little bit.

We looked at mobile devices that showed no calls and no text and low data usage.

Um we define low as less than 500 megabytes per month, uh, which is a which is very low amount.

To put that in context, it's enough to check your email, maybe glance at a work app, um, but not enough to send even a short short video calls or uh files of any significant size.

So pretty low usage, and so that yielded another 215 devices there, and you can see the dollar amount down there.

Now, big caveats with this table.

On my next slide.

Before we before we read too much into these uh these dollar amounts, we use data from the phone company for this analysis, and that data does not capture any activity over Wi-Fi, such as the city Wi-Fi throughout this building that we're all connected to now.

Um so for instance, there were 300 plus tablets on those two tables.

They could all be sitting in City Hall being used furiously all day.

Um, I don't want you to jump to the conclusion that these are definitely not being used.

We can't assume that they're unused, but maybe there's a fair question over whether we need to be paying a monthly service charge for these devices, whether we could disconnect that.

Another caveat is there are cases where we purposefully decide to keep a phone active, even if it's rarely used or minimally used.

Think about like an on-call phone.

We don't use it a lot, but we're glad it's there.

Some departments choose to keep emergency backup devices.

So I want to make sure we mention that that some of these may we may be paying for them and know that we're paying for them for good purpose.

So given those caveats, we, the audit team, have no way to determine the necessity of a given device and whether it makes sense for the department to continue paying for the device.

Only the individual departments that requested the device can make the decision over whether the need still exists for that device.

To that end, it would be nice if each department had access to the data that we analyzed here, the usage data from the phone bill for their particular devices.

They currently don't, which brings us to our recommendation in this area.

We recommend that IT departments should regularly regularly publish out to the management of the other departments this usage information to increase visibility to help them make good decisions about the need for their assigned devices.

Then working together, the IT department and these departments, they can deactivate any unnecessary service devices, any unnecessary service lines, and capture savings for the city.

All right, and our final uh area of objective is around our approval and disposal processes.

We selected a sample of 20 phones that were assigned to employees who had recently separated from employment with the city.

And for those phones, we reviewed the records of approvals on the front end of the device's uh lifecycle and then disposals on the back end, just to get a full picture of whether these devices were fully following the process throughout their life.

For approvals, uh, the process by which a department requests a new mobile device from IT is to fill out a form and service now and submit it electronically.

This kicks off an automated workflow that requires an electronic approval from the device uh the device user's supervisor or other assigned approver.

Um, and then when that approval comes in, this creates a record of the approval within ServiceNow and attaches it to the inventory record of the device, keeping everything in one place.

We reviewed the records of these 20 phones in our sample, and we found the following.

Um, that top line there, the 80%, that's 16 of the 20 phones went through the established process, and they showed a record of approval in Service Now.

Three of the phones were approved via email and not inside of ServiceNow.

So we were able to see the approval in an email, um, but it's outside the regular process.

And then for one of the phones, we couldn't find evidence of the approval in either email or service now.

So this test showed that some approvals are going around the established process.

Uh disposals.

We also tested the disposals for that same 20-phone sample.

Uh, when the employees separate from employment with the city, the standard process is for IT to collect their phones, wipe any data off of them, and then either reuse them or send them to our third-party recycler, which is an outside vendor that we use.

And so let's go through these disposals line by line.

That top line, um, five of the 20 phones were reset and then reassigned out to other employees.

The middle line there it says 70%.

So 14 of these 20 phones had an unclear record of disposal.

And I want to explain what we mean by unclear.

So when IT sends these phones to the recycler, they basically they wait until there's a pile of phones built up until we've received a bunch of phones from employees that no longer need them.

Then they put those in a box, send them to this recycling vendor, and they mark them in service now as recycled.

I don't know exactly what the term is.

Recycled.

Um, then the vendor sends back a receipt that lists the phones it received in the box.

Now, the frustrating part for IT is that the vendor doesn't include serial numbers or any other unique identifiers on this list that they send me, this receipt that they send back.

Um, so it only lists the make and model.

So they'll say we got 10 iPhone 14s, we got 15 iPhone 15s and two Galaxy, whatever the number of galaxies is.

Um so when we go to research this, ServiceNow says the phones were sent to the recycler.

The recycler says they received some phones.

Um, but it's not clear which of the devices were sent in which box.

That was the difficulty we had in tracking this.

Without more detailed record keeping, we can't say unequivocally that this particular device that we were looking for was in a particular shipment and got received.

So this was the case for 14 of those 20 phones.

And then the last phone you see here on this last line is a success story.

Before we even started conducting this test, IT had already identified that this was all an issue.

And they begun to improve its record the record keeping, now keeping a list of which devices were sent in which shipments, which helped immensely.

This allowed for comparative reconciliation between the two, between the shipment info and the vendor's receipt.

And so one of the phones in our sample was captured by this new process, and thus we had sufficient evidence of its disposal.

And that is now the process moving forward that IT is using.

And this is just one of the cases where IT was already improving its processes as we were looking at its processes.

That was true throughout this audit.

So we have two recommendations in this category.

3.1, IT management should ensure that all approvals are captured in service now and not accepted via email.

Don't let people go around the process and just email someone to, you know, hey, I need a phone, go through, make them go through the process.

3.2, IT management should do exactly the thing they've already implemented, which is to keep more detailed records on their disposals so that we can track these devices all the way to the grave and make sure that they get where they're going.

At this time, I'd like to invite representatives from the IT department to join me up here to provide more information on the mobile operations.

And while Chris is making his way up here, I would like to mention that IT, their staff and management have been great to work with through this.

Many of the issues they had already identified on their own, and they were already in the process of improving.

You'll notice if you look in the uh in my report at the management responses in the back, some of these recommendations had already been addressed before the report was uh published.

The date of them fixing it was prior to the date of the report going out.

So they've really been on top of this.

And uh, I just we really appreciate the the great relationship we have with IT department, um, all the help they gave us.

We also work with finance on this report.

Um, they managed to escape any recommendations, but they were great to work with and were really instrumental in helping us to look at all these processes as well.

And with that, I'm gonna turn it over to Chris for an update on his end.

Good morning, Chris Craig, Director of Innovation and Technology for the Record, and just wanted to first start by thanking Mr.

Halad and the whole entire auditor's office for what their performance here.

It's been really good working with them, and we appreciate all the effort they put into this.

And I also want to thank my team for being so proactive and getting things taken care of with this audit.

Um, just a quick highlight, something that we really want to highlight for the record that we find very important when you talk about mobile device communication, there are multiple paths for the devices to be able to connect to the internet and to the activities that you need to perform on them.

And as Mr.

Halad pointed out in the caveats that he mentioned, this was based on mobile device usage through the cellular network, and a large portion of our devices work over Wi-Fi.

And it's not, it should not be seen as a cost center from the perspective of we can save a lot of money if we deactivate some of these devices because it's extremely important for many of these devices to stay connected, even if they're marginally used.

Um, myself, for instance, I have a embed what we call embedded chip in my laptop, and I but I'm almost always on Wi-Fi, but I don't think you'd want your IT director traveling somewhere without connectivity possibilities.

So my usage is extremely low on my laptop, for instance, but we also have a lot of reasons why people may go on vacations, FMLA, those sorts of things.

So I just want to make sure as we provide a responses in future meetings that that's noted on the record that there is really good use cases and reasons why mobile device data usage would be low on some of these units.

We are, however, going to be working with the departments, sharing the information with them and letting them make a data-driven decision on if their employees should maintain those devices or not.

Thank you.

Thank you very much.

I one of the uh question that I may have is just data security, you know, and that those phones when they when they go out or when they leave, uh, how we know that they've been wiped properly or that or they have access codes that cannot, you know, they can lock the phone so they don't end up in the wrong hands.

Uh that's just one of the concerns over this, as Mr.

Halad talked about.

The phones themselves, you can get a credit, or even if you don't, the cost is de minimis, and that the the potential cost savings as a cost center de minimis compared to everything and vague uh uh estimates.

Um what I tend to think about is just data security.

So um do we see any issues with data security on phones that that are that are leaving that we may not have properly tracked?

Is that something to be concerned about at all?

When we pardon me, Chris Craig for the record again.

When we talk about tracking the devices in the sense of Service Now, that is that is one aspect of it, which we are uh improving on.

The other aspect is how we manage the devices, and we use a specialized piece of software to manage all the mobile devices, so we have complete control of them no matter where they're at or how they're connected.

So we can remotely wipe a device, we can brick a device, make it to where it's useless.

So from a data security perspective, the concern is extremely low.

It's never zero in an IT environment, but it's extremely low in this in this circumstance.

There's very little you can actually do on one of our mobile devices that would compromise our network, and we would certainly know about it and be able to prevent it.

Fantastic, thank you so much.

Uh if anyone um has any questions, I'd like to open that up for questions.

Yeah, good question.

Um I didn't hear you mention the carrier for the services, and I don't know if this is a part of the audit, but I'm just curious.

Were we able to shop um the price that we have looking at the $851,000 in service fees for that year to see if we are getting the best price for the services, or maybe we're just locked into one carrier for the entire city.

But I'm just curious as to that whole process of making sure we're getting the best deal possible, given the volume.

Well, as you can imagine, we do have carriers reach out to us.

There's really a very small space from a competitive perspective in this market.

We used to have both carriers, ATT and Verizon.

We have mostly centralized on ATT.

I believe we have a few, possibly a few.

I'd have to check with my staff Verizon units out there.

But um, around the what's called First Net, they have a strong partnership with ATT, and that is very important for our public safety and first responders to have first net.

And so we've gotten really great pricing with ATT, and we're also working with them through FirstNet on lower data use packages where we can lower the monthly bill based on the data use on certain devices, not all devices.

Um, so but we're primarily ATT for this use case.

Great, thank you.

Any additional questions either on the phone?

Yes, hi, it's it's Kara Kelly, if I may, and I uh received uh the information a little late, so I may have missed this, and if I did, I apologize.

Uh what how do the point about security, the chairman's point about security?

How do we um ensure security for devices uh that uh have been lost or misplaced or may never get turned back in upon an employee separation?

Councilwoman, this is Chris Craig for the record.

We have uh remote connectivity tools that allow us to control those devices, and we have the ability to disable them from our systems and make them useless to the end user.

Great, perfect.

Thank you.

That's all uh does anyone else have any additional questions either here or on the phone?

All right.

Well, having none, thank you, Mr.

Halod, and thank you, and thank you, Chris.

Uh, are there any questions from any other members?

Seeing none, uh, may I have a motion.

I move that we accept the report.

Any recommendations.

Second.

Kara Kelly and I have that motion.

Thank you.

All uh all in favor?

Aye.

Aye.

Aye.

Any opposed, having none, uh, please go ahead and post, and the motion will carry.

Thank you.

Moving on to agenda item number six, report by staff regarding current staffing.

Brian Smith, City Auditor, will give this report.

Please go ahead, Mr.

Smith.

Thank you, Chair Price.

Good morning, committee members.

Um before I get started, I just like to uh thank our city clerk's office.

Sometimes they go unrecognized, but I appreciate all their help in coordinating these meetings.

So thank you very much.

Um Brian Smith City Auditor.

Um this slide, you will see our current org chart.

And I'm pleased to uh share with you that we actually have filled our two vacant positions.

And first of all, I'd like to introduce you to Samantha Dinicola sitting next to me here.

And we're very happy to have her as a part of our team.

She previously worked in the city clerk's office, and prior to that worked at the DMV.

And also she has a degree in criminal justice.

So with that background, she's a great addition to our office and has been a lot of help in preparing for this meeting.

And we welcome her aboard.

We also starting tomorrow, we'll be welcoming an internal auditor to our team.

And her name is Patrice Hartwell.

And she most recently was an internal auditor at Resorts World.

And she has a master's in business administration.

She also is working on getting her CPA designation.

And we're looking forward to her joining us tomorrow.

So we've got some work ahead and helping to train her and introduce her to the city, but we're uh looking forward to expanding our team.

Um let's see.

And also, as you look at the uh the York chart, uh my previous position, internal audit section manager, is still frozen due to the city's uh budget issues.

And that concludes my report.

Thank you, Mr.

Smith, and welcome, Samantha.

I'm sure your experience at the end DMV will be very will be very helpful to you in dealing with all the departments and everything that comes your way.

Um there any questions from any of the members.

None on the phone, seeing none.

This item is report only, and no mesh motion is required.

And we will now move on to agenda item number seven.

Agenda item number seven, report by staff regarding current audits and issued audit recommendations.

Brian Smith, City Auditor, will give this report.

Please go ahead, Mr.

Smith.

Thank you, Chair Price.

Brian Smith City Auditor.

Our office is currently finalizing a couple audits, including one in the facilities division of public works.

And this audit has focused on controls over tools, equipment, and supplies.

And Nancy Cardoza is the lead auditor on this audit, and she is currently in the reporting phase of this audit.

In addition, we are finalizing an audit of the process and controls over the distribution of bus passes to municipal court constituents.

And James Burnett, he is the lead auditor on this audit.

And once again, this is in the reporting phase of our of our audits.

And more details on the objectives and the scope of these audits will be forthcoming.

As you are aware, we have a follow-up phase to every audit where we verify completion of issued audit recommendations.

With each audit, we obtain an action plan and an estimated date of completion for each recommendation from management.

Once management believes they have uh fully addressed the recommendation, they contact us and then we verify that indeed the audit recommendation has been addressed.

As of today, here's a summary of the status of issued audit recommendations over the past few fiscal years.

As you can see, most of the audit recommendations have been addressed, and I'd like to thank our city management team for their support of our audits and their efforts in addressing these recommendations.

I'm grateful as the city auditor to work with a city management team that uh takes internal control seriously and works with us in getting these recommendations addressed.

You don't find that in all cities.

Um thank you to city management team.

Uh the three departments within complete audit recommendations continue to keep us apprised of their progress in addressing their recommendations, and you may recall they were here at the last audit committee meeting.

The three departments with incomplete uh recommendations include business licensing, human resources, and municipal court.

But they have kept kept us apprised of these of their progress, and I anticipate that most, if not all of these recommendations will be completed before our next meeting.

Um in fact, so far as the HR recommendations, we are just waiting for the the final updated uh employee separation policy to be formally approved by all those that need to review it.

And uh that concludes my report.

Thank you, Mr.

Smith.

Are there any questions from the members, either in person or on the phone?

Seeing and hearing none, this item is report only, and the motion and no motion is required.

We will now move on to agenda item number eight.

Agenda item number eight, discussion regarding topics for future agenda items.

Comments made during this portion of the agenda by individual members shall refer solely to proposals for future audit items, and any discussion shall be limited to whether or not such proposed items are within the purview of the committee and or whether such proposed items shall be placed on a future agenda.

No discussion regarding the substance of any such proposed topic shall occur and no action shall be taken.

Does anyone have suggestions regarding future agenda item topics either here or on the phone?

Seeing and hearing none, we will move on to item number nine.

Item number I item number nine is citizens' participation.

Public comment during this portion of the agenda must be limited to matters within the jurisdiction of the committee.

No subject may be acted upon by the committee members unless that subject is on the agenda and is scheduled for action.

If you wish to be heard, come forward and give your name for the record.

The amount of discussion on any single subject as well as the amount of time any single speaker is allowed may be limited.

Is there anyone wishing to be heard at this time?

Looks like nobody has arrived since the beginning of the meeting.

So I'll close citizens' partition uh participation and we shall move on to item number 10.

Item number 10 adjournment.

The next audit oversight committee meeting is scheduled for Monday, October 12th, 2026.

And with that, this meeting is adjourned.

Thank you, everyone very much.

Thank you.