San Diego Audit Committee Meeting - June 17, 2020

The San Diego Audit Committee met on Wednesday, June 17, 2020, via teleconference due to the COVID-19 pandemic. The committee discussed and acted on several audits, including the recruitment process for a new City Auditor, a performance audit of the city's public liability management, and audits of the Mission Bay and Regional Parks Improvement Funds and citywide data classification and encryption. All votes were unanimous. The meeting concluded with a monthly activity report from the City Auditor and a commitment to reconvene on July 22, 2020 at 9 a.m.

Approval of Minutes

• The minutes from the May 20, 2020 meeting were approved with a vote of 3-0, with two abstentions (Members Valdivia and Tabshouri, who were not present/members at that meeting).

Consent Calendar

• No consent calendar was presented; the meeting proceeded directly to agenda items.

Public Comments & Testimony

• Non-Agenda Public Comment: One caller, Louis Relico, attempted to comment on the SDSU Mission Valley project, but was redirected because that item was not on the agenda and was scheduled for the City Council meeting later that day.
• Item 1 (City Auditor Recruitment): No public comments were received.
• Item 2 (Public Liability Management Audit): No public comments were received.
• Item 3 (Mission Bay and Regional Parks Improvement Funds Audit): No public comments were received.
• Item 4 (Data Classification and Encryption Audit): No public comments were received.
• Item 5 (Recommendation Follow-Up Report): No public comments were received.
• Item 6 (City Auditor Monthly Activity Report): No public comments were received.

Discussion Items

Item 1: City Auditor Recruitment Process

• The committee discussed the process for recruiting a new City Auditor. The Office of the Independent Budget Analyst (IBA) offered to assist, and there was debate on whether to use an outside hiring firm or conduct the search in-house.
• Several committee members, including Councilmember Moreno and Member Valdivia, expressed support for an in-house search, citing past dissatisfaction with a private recruiter. Member Halpern and Member Tabshouri raised concerns about capacity and timing but ultimately supported the in-house approach.
• The committee voted to direct the IBA to work with city departments to create a job posting and begin recruitment, and to form a subcommittee composed of Members Halpern and Valdivia to assist in the process. The motion passed unanimously.

Item 2: Performance Audit of the City's Public Liability Management

• The Office of the City Auditor presented findings showing that the city spent approximately $220 million on public liability claims from FY10 to FY18, with an average of 2,200 claims closed per year. The audit found the city's approach to risk management was reactive and siloed, recommending an enterprise risk management (ERM) approach.
• Key findings included that 60% of trip-and-fall claims occurred in high pedestrian areas, but those areas received only 38% of sidewalk replacements and 27% of sidewalk slicing. Larger sidewalk uplifts (>1.5 inches) accounted for 55% of trip-and-fall claims and six of seven claims costing over $100,000.
• City COO Kris Michell expressed strong support for the audit, noting ongoing efforts to implement ERM, including a risk oversight committee and a new chief compliance officer. She also noted that a proactive vehicle training policy (AR 7512) had been agreed to with four of six labor unions.
• Committee Member Tabshouri expressed skepticism about the city's ability to implement ERM, suggesting hiring an outside risk management firm. He also highlighted employment and civil rights claims, which totaled $40 million over the period, and recommended a deeper dive into that area.
• Councilmember Moreno moved to accept the report and forward it to the City Council, additionally requesting that it be presented to the Active Transportation and Infrastructure Committee. The motion passed unanimously.

Item 3: Performance Audit of Mission Bay and San Diego Regional Parks Improvement Funds, FY2019

• The Deputy City Auditor presented a clean audit of the improvement funds. The Mission Bay Improvement Fund had revenues of $8.1 million, expenditures of $3.5 million, and a balance of $42.7 million as of June 30, 2019. The San Diego Regional Parks Improvement Fund had revenues of $4.3 million, expenditures of $3.4 million, and a balance of $18.2 million.
• The audit found that all expenditures were allowable, appropriate, and compliant with city charter requirements. The only issue was two Mission Bay Park Committee members exceeding term limits, which the mayor's office had resolved by selecting new appointees.
• The committee accepted the report unanimously. Member Tabshouri suggested expanding future audits to include project-level sampling, but the auditor noted that they already review invoices for all projects.

Item 4: Performance Audit of Citywide Data Classification and Sensitive Data Encryption

• The audit found that the city lacks a centralized data management strategy, with three departments (Department of IT, Performance & Analytics, and City Clerk) operating in silos. This led to redundant inventories and classification efforts, and security risks.
• The audit made five recommendations, including creating a centralized strategy, establishing a classification scheme, and defining the role of a Chief Data Officer. Management agreed to all recommendations, with target implementation dates extending to 2023.
• Several committee members expressed concern about the long timelines, with Member Tabshouri initially voting against the motion due to the delays. Councilmember Moreno amended her motion to include a request that the administration provide the City Council with a detailed rationale for the timelines and potential ways to accelerate implementation before the report is heard at council.
• The amended motion passed unanimously.

Item 5: Recommendation Follow-Up Report (through December 31, 2019)

• The Office of the City Auditor reported 142 open recommendations across 40 audit reports. During the period, 25 recommendations were implemented, two were deemed no longer applicable, and two were designated as "will not implement."
• Four recommendations were highlighted for committee attention: curb painting process (transportation/stormwater), central stores handheld devices, a contract oversight recommendation, and a fraud hotline report recommendation.
• The committee discussed the curb painting recommendation, with Member Sherman expressing concern about the reactive approach. The committee voted to keep the two "will not implement" recommendations as "in process" rather than dropping them, and to drop the two "no longer applicable" recommendations.
• The motion, as amended, passed unanimously.

Item 6: City Auditor Monthly Activity Report

• City Auditor Kyle Elser reported that since the last meeting, the office had issued four audit products, with two more in report writing, three in field work, and two in planning. He also noted that the City Council had restored cuts to the auditor's budget and that the Rules Committee had approved a ballot measure proposal for independent legal counsel.
• Committee members asked about the climate action plan audit (expected in 3-6 months) and the Ash Street building audit (to be added to next year's audit plan). Member Valdivia raised concerns about prime contractors hiring subcontractors to meet EOC goals but not actually using them; the auditor confirmed this is part of the ongoing Equal Opportunity Contracting audit.

Key Outcomes

• City Auditor Recruitment: Directed the IBA to begin an in-house recruitment process and formed a subcommittee (Members Halpern and Valdivia) to assist. Timeline: job posting to close by August 31, 2020, with interviews expected in September or October.
• Public Liability Management Audit: Approved the report and forwarded it to the City Council and the Active Transportation and Infrastructure Committee. Management agreed to implement all recommendations.
• Mission Bay and Regional Parks Improvement Funds Audit: Accepted the report and forwarded it to the City Council.
• Data Classification and Encryption Audit: Approved the report and forwarded it to the City Council, with a request for the administration to provide the Council with more detailed rationale for the implementation timelines and potential acceleration.
• Recommendation Follow-Up Report: Accepted the report and approved the recommendation to drop two items deemed no longer applicable; kept two "will not implement" items as "in process" for future review.
• City Auditor Monthly Activity Report: Accepted as informational.
• All votes were unanimous.