Minneapolis Audit Committee Regular Meeting Summary – August 24, 2026

The Minneapolis Audit Committee convened on August 24, 2026, at 9:00 AM (Central) with Chair Elliot Payne presiding. The meeting included presentations on the 2025 State Auditor Management and Compliance Reports, an internal audit of software inventory and access management, a performance audit of the ShotSpotter gunshot detection system, and an advisory report on camera data security best practices. The committee also received and filed reports, approved a motion to conduct an independent audit of the Minneapolis Public Housing Authority's use of city funds, and discussed open corrective action plans.

Consent Calendar

• The agenda was adopted unanimously.
• Minutes from the June 22, 2026 regular meeting were accepted without opposition.

Public Comments & Testimony

• No public comments were made during the meeting.

Discussion Items

2025 State of Minnesota Office of the State Auditor Management and Compliance Reports

• Karen Stackin, Audit Director from the Office of the State Auditor, presented the audit results for the City of Minneapolis, the Municipal Building Commission (MBC), and the Minneapolis Park and Recreation Board for the year ended December 31, 2025.
• The city and park board received unmodified (clean) opinions on their financial statements and major federal programs.
• Four findings were reported for the city: two related to internal control (service organization controls and prompt payment of invoices) and two related to federal program compliance (suspension/debarment and subrecipient monitoring). The park board and MBC had no current-year findings.
• Audit Committee member Al Mwafok questioned the repeated SOC1 finding for a convention center service organization and asked about the inventory of third-party service organizations and the city's low-risk auditee status. Ms. Stackin explained that the city implemented additional controls but still lacked a full SOC report, and that the city could regain low-risk status after two consecutive years without material weaknesses.

The committee received and filed the reports.

Software Inventory and Access Audit

• Sarartha Pujol, Director of Internal Audit, presented the audit of the Information Technologies (IT) department's software inventory and access management practices, focusing on the ServiceNow system.
• Two findings were reported: (1) the centralized software inventory is incomplete and lacks a proactive process to capture new systems, and (2) IT does not conduct regular periodic reviews of ServiceNow user access; only ad hoc reviews occur when license limits are approached.
• IT management agreed to the recommendations: document software management procedures and conduct annual documented reviews of all ServiceNow accounts, with completion dates of December 31, 2026, and March 31, 2027, respectively.
• Committee members discussed the need for inventory completeness, self-reporting challenges, the use of SOC2 or FedRAMP reports for third-party software, and the appropriate frequency of access reviews. Member Hosbean suggested bi-annual reviews rather than annual, given the risk of terminated employees retaining access.
• The report was received, filed, and ordered published.

ShotSpotter Performance Audit Report

• City Auditor Robert Timmerman introduced the audit, emphasizing the need for independent oversight of public safety technologies. Michael "Mac" Kwaters, Director of Special Reviews, presented the findings.
• The audit covered calendar years 2023–2025 and found that the city relies on ShotSpotter data for performance oversight and operations but lacks independent mechanisms to verify the accuracy of alerts or evaluate public safety outcomes.
• Two key findings: (1) the city does not independently validate ShotSpotter reports for contract oversight (e.g., sensor location accuracy, vendor KPIs); (2) the city uses ShotSpotter data in strategy meetings but does not isolate its impact or document how it drives decisions.
• Recommendations include using city data for independent verification, establishing documented performance oversight, maintaining a confidential list of sensor locations, and documenting how verified data is used in strategies.
• Committee members expressed strong concerns. Member Chugtai questioned why the city accepts ShotSpotter data without verification, especially given the lack of a comprehensive sensor location list. Member Hosbean criticized the public dashboard as creating fear rather than providing useful information for community safety. Chair Payne noted that the current contract expires March 21, 2027, and that the audit results make renewal unlikely without independent evidence of effectiveness.
• MPD Chief of Staff Leslie Steletti appeared to answer questions but requested time to provide a written response memo due to limited subject matter knowledge.
• The report was received, filed, and ordered published.

Camera Data Best Practices Advisory Report

• Mac Kwaters presented an advisory review of the city's camera-based surveillance technologies (excluding body-worn cameras and ALPRs, which were previously covered).
• The review examined 19 contracts and found that contract provisions for data security vary across departments; policies and procedures are inconsistent; training for data and records liaisons is not enforced; and the city lacks a comprehensive list of data-sharing agreements with federal law enforcement.
• Four findings were reported: (1) inconsistent contract oversight for camera services; (2) incomplete or insufficient departmental policies referencing the city's information security policy; (3) inconsistent training and engagement of data and records liaisons; and (4) insufficient compliance documentation with Minnesota Government Data Practices Act (Section 1305).
• Recommendations include enforcing contract provisions, updating policies, formalizing training, ensuring compliance with state law, and adopting a periodic review of data security best practices.
• Committee members questioned the absence of a comprehensive list of federal data-sharing agreements and the lack of specific procedures for federal law enforcement requests. Member Al Mwafok asked for a follow-up memo on this topic. The advisory report's management action plan is under development.
• The report was received, filed, and ordered published.

Request for Independent Audit of Minneapolis Public Housing Authority (MPHA) Use of City Funds

• The committee considered a city council request for an independent audit of MPHA's use of city funds. City Auditor Timmerman expressed willingness to undertake the work but requested it be added to the 2027 audit plan.
• A motion to proceed was made and passed on a roll call vote: 5 ayes (Committee members Al Mwafok, Hosbean, Peterson, Vice Chair Singleton, Chair Payne) with two absences (Chugtai, Engelhardt – later noted as present and voting aye via voice).

City Auditor's Report on Open Corrective Action Plans

• City Auditor Timmerman provided an update on open audit findings and corrective action plans. A total of 68 open items exist, with 44 from 2026 (none past due yet).
• Five findings from 2025 and earlier were closed and validated since the last meeting. The committee was informed that MPD and fleet management have unresolved items and will be invited to the October audit committee meeting to provide updates.
• A new public dashboard for tracking corrective action plans has been released, and the Office of City Auditor is connecting it with the clerk's legislative directives dashboard.
• The committee discussed the upcoming peer review by the Association of Local Government Auditors (planned for January/February 2027) and the need for auditor independence. Chair Payne noted that the mayor's recommended budget includes cuts to the auditor's office, which he views as a challenge to independence. The committee agreed to include an annual independence discussion in the February meeting.
• The committee also discussed the process for inviting departments with overdue corrective action plans to future meetings. The October meeting will include MPD, finance/property services, and health departments.

Key Outcomes

• The agenda and minutes from June 22, 2026 were approved.
• The 2025 State Auditor reports, software inventory audit, ShotSpotter performance audit, and camera data advisory report were received, filed, and ordered published.
• A motion to request an independent audit of MPHA's use of city funds was approved (5-0-2, with later confirmation of a 6th aye). The audit will be included in the 2027 work plan.
• The city auditor's report was received and filed; follow-up on open corrective action plans is scheduled for the October 2026 audit committee meeting.