Report to/Rapport au :

Corporate Services and Economic Development Committee

Comité des services organisationnels et du développement économique

and Council / et au Conseil

17 October 2006 / le 17 octobre 2006

Submitted by/Soumis par : Council Audit Working Group / Groupe de travail du Conseil sur la vérification

Contact Person/Personne ressource : Kent Kirkpatrick, City Manager / Directeur des services municipaux

(613) 580-2424 x 25657, kent.kirkpatrick@ottawa.ca

Ref N°: ACS2006-CMR-OCM-0010

SUBJECT:	2005 AUDIT RECOMMENDATIONS - ACTION STATUS REPORT
OBJET :	recommandations de la vérification de 2005 – rapport DE SITUATION SUR LES mesures prises

REPORT RECOMMENDATIONS

That the Corporate Services and Economic Development Committee recommend that Council:

1. Approve the changes with respect to implementation for the Procurement Audit recommendation numbers 2, 3, 13, 17 and 19, and related May 2006 Council Motions, as outlined in Document 1A;

2. Receive for information the action status tracking and next steps as outlined in Documents 1B, and 2 to 9.

RECOMMANDATIONS DU RAPPORT

Que le Comité des services généraux et du développement économique recommande au Conseil :

1. D’approuver les modifications relatives à la mise en place des recommandations numéros 2, 3, 13, 17 et 19 faisant suite à la vérification des achats ainsi que les motions afférentes de la séance du Conseil de mai 2006, comme l’indique le document n^o 1A;

2. De prendre connaissance du rapport de situation sur les mesures prises ainsi que des prochaines étapes, comme l’indiquent les documents n^os 1B, 2 et 9.

BACKGROUND

On May 24, 2006, City Council considered the City’s Auditor General 2005 Annual Report and 2005 Detailed Audit Reports (ACS2006-OAG-BVG-0001). Included in the 2005 Annual Report were the following audit reports:

• By-Law Enforcement and Inspections
• Drinking Water Services
• Emergency Management Program
• Internet Usage and Controls
• Management Control Framework
• Overtime
• Procurement Process
• Real Estate Management

In conjunction with consideration of the Annual Report and audit recommendations, City Council also passed the following two Motions:

That a special committee be established which would include four members of Council and Senior Management Team to ensure implementation of Council approved recommendations and that Councillors Glenn Brooks, Gord Hunter, Jacques Legendre and Rick Chiarelli be appointed to that special committee.

CARRIED

That the Special Committee report to the Corporate Services and Economic Development Committee on any issues raised.

CARRIED

Since the establishment of this Council/Management Audit Working Group in May 2006, three meetings have occurred as follows:

July 14, 2006

The Council Audit Working Group (City Manager and four members of Council) met to discuss process and endorse a tool that was developed to assist in tracking the status and implementation of the 2005 Audit Recommendations (reference Documents 2 to 9).

September 25, 2006

The Council Audit Working Group met with the full Executive Management Committee to review the action status tracking documents, concentrating on certain recommendations that either had 2007 or future budget implications or FTE requirements, or the management response was in conflict with the audit recommendation and required further discussion.

October 2, 2006

The Council Audit Working Group met with the Auditor General and the City Manager to begin discussion on some of the recommendations of issue with respect to implementation and in some cases where the management response was not in agreement with the Auditor General’s recommendation and where Council direction had not been provided.

The purpose of this report from the Council Audit Working Group is to provide the Corporate Services and Economic Development Committee and Council with a status update on implementation of the 2005 Audit recommendations as well as request approval for revisions regarding the implementation of recommendations from the Procurement Audit, as supported by the Auditor General and outlined in Document 1A attached to the report.

DISCUSSION

The majority of recommendations for the eight audits have either been implemented or are in progress. However, there are some areas in which the management response and Auditor General’s recommendation conflict and have been subject of some initial discussion between the Auditor General, the City Manager and the Council Audit Working Group. In some cases, consensus has been achieved on revisions to the implementation of the audit recommendations, however, in other cases further discussion is required.

Outlined in Document 1A are recommendations from the Procurement Audit that the Council Audit Working Group is requesting the CSEDC recommend that Council approve a revision with respect to the implementation. In three of the five cases, the change relates to the level of approval authority, and in the remaining two cases, the change reflects confirmation that staff have developed the necessary process and will commence with the reporting to Council through the next Annual Report which deals with several reporting requirements detailed in the Purchasing By-law. These implementation revisions were discussed and approved by the Auditor General at the October 2 meeting referenced above.

Outlined in Document 1B are various Audit recommendations that represents conflicting management responses and may be subject to further discussion between the Auditor General, the City Manager and the Council Audit Working Group.

Outlined in Documents 2 to 9 is detailed status tracking information, inclusive of recommendations that have 2007 or future budget implications. Implementation of some these audit recommendations will be subject to 2007 budget consideration and approval.

On a related matter, an additional Motion approved by Council on May 24, 2006 is a follows:

That the City Solicitor and the City Clerk, in collaboration with the Auditor General, bring forward to Council a report detailing options and/or recommendations to clarify the reporting process for future years, and that this report is presented to Council no later than December 31, 2006.

The City Solicitor and City Clerk have had ongoing discussions with the Auditor General in this regard. Recommendations to clarify the Auditor General’s reporting process and role will be coming forward as part of the 2006-2010 governance report, to be tabled with Council at its final meeting on 22 November 2006. This report will also address the process to be used with respect to the Auditor General’s role in the implementation and follow-up on audit recommendations previously provided to Council.

CONSULTATION

The Auditor General has not been involved in the status tracking process on an ongoing basis, but upon request provided comments with respect to the revised implementation for the procurement audit recommendations outlined in Document 1. If requested, the Auditor General will review and provide further comment on the content of the status tracking documents at a future date, noting the desire to not interfere with the completion of the 2006 audit plan at this time.

Consultation was held with the Department Heads as part of drafting this report. Consultation will continue as part of the ongoing discussions related to the implementation surrounding some of the audit recommendations.

Public consultation is not applicable and was not conducted as part of this report. Members of the public may address the Corporate Services and Economic Development Committee during its consideration of the report on October 17, 2006.

FINANCIAL IMPLICATIONS

Recommendations that involve future budget impacts will be brought forward in conjunction with the 2007 budget.

SUPPORTING DOCUMENTATION

Documents 1A and 1B: 2005 Audit Recommendations and Management Comments – Requested revisions with respect to implementation of recommendations and status information (attached to the report).

Document 2: By-Law Enforcement and Inspections – Status Tracking Document

Document 3: Drinking Water Services – Status Tracking Document

Document 4: Emergency Management Program – Status Tracking Document

Document 5: Internet Usage and Controls – Status Tracking Document

Document 6: Management Control Framework – Status Tracking Document

Document 7: Overtime – Status Tracking Document

Document 8: Procurement Process – Status Tracking Document

Document 9: Real Estate Management – Status Tracking Document

(Documents 2 to 9 were issued separately and are on file with the City Clerk.)

DISPOSITION

The applicable Department Head and staff will continue to work on the implementation of the audit recommendations as noted.

The Council Audit Working Group and, when required, the City Manager will continue to work with the Auditor General on the implementation of recommendations that are subject to further discussion.

Implementation of audit recommendations that have 2007 or future budget implications will be subject to 2007 budget consideration and approval.

T

Document 1A

Recommendation No. 1

1. Approve the changes with respect to implementation for the Procurement Audit recommendation numbers 2, 3, 13, 17 and 19, and related May 2006 Council Motions, as outlined in Document 1A;

Audit Recommendation	Action Required Based on Dept. Head Action Plan	Comments (Risks, issues regarding implementation)	RELATED COUNCIL Motion	Status Update	Request for Approval of Revised Implementation
Procurement Audit Rec. 2 When a contract has been entered into on a sole source basis, the total value of the contract, including all amendments, should not exceed $50,000 without the approval of the City Manager.	Staff have been directed to follow this approach as of June 2006. Level 2 approval (Deputy City Manager, CCSO) will continue until the recommendations of the Council Audit Working Group are accepted.	Sole source contracting at the City, although permitted in the Purchasing By-Law under stipulated conditions, is strongly discouraged by Corporate Purchasing. Less than 10% of all purchases are sole sourced which is representative of best practices industry wide. Management does not support the City Manager approving sole source contracts over $50,000 and believes existing due diligence which includes review by either the Chief Corporate Services Officer or Deputy City Manager when necessary would continue to suffice. Need to discuss with Council Audit Working Group (CAWG) ability to distinguish between discretionary sole source and those monopoly type areas like Bell, Hydro, etc.	No	In progress: would like to review recommendation requiring City Manager approval with CAWC (see comments section).	When a contract has been entered into on a sole source basis, the total value of the contract, including all amendments, should not exceed $50,000 without the approval of the Chief Corporate Services Officer or Deputy City Manager.

Audit Recommendation	Action Required Based on Dept. Head Action Plan	Comments (Risks, issues regarding implementation)	RELATED COUNCIL Motion	Status Update	Request for Approval of revised Implementation
Procurement Audit Rec. 3 Supply Management should ensure the total value of amendments to the scope of work of any contract should not exceed 50% of the original contracted amount without the approval of the City Manager.	In June 2006, a process was implemented to ensure that all such amendments are approved at senior management level 2. Also, all are captured for inclusion in the annual report to Council on consultants, sponsorships, legal, etc. To avoid unnecessarily high volume of reviews and approvals required (200+ contracts/yr), suggest revising recommendation to require approval for contracts exceeding 50% of contract and $50K. (See examples attached.) Also, as per Council amendment, recommend report be forwarded annually to CSEDC.	Amendments to contracts are typically in light of unforeseen changes in scope, and are scrutinized closely, in both the operating department and by Purchasing, with a view to ensuring that fair value is received by the City. The current approval process includes both the Manager of Supply Management and level 2 approval of either the Chief Corporate Services Officer or Deputy City Manager, and continues to be appropriate. Need to discuss with Council Audit Working Group the ability to define certain thresholds (like recommendation # 13 ), where the total value of the amendment would need to exceed 50% and $50K in order to be captured.	That “Supply Management should ensure the total value of amendments to the scope of work of any contact should not exceed 50% of the original contracted amount without the approval of the Deputy City Managers”, and that an information report be forwarded to the appropriate Standing Committee; and that staff reports to Council on the implementation of this recommendation no later than September 2006.	Complete Would like to discuss the following suggestions with CAWG: - that Council motion be amended to only apply in instances where the amendment has both a value of at least $50K AND is greater than 50% of the original contracted amount; - that the Council motion be amended to state that the "appropriate Standing Committee" be designated as CSEDC, and that reporting take place annually in conjunction with the existing report to Committee and Council which deals with several reporting requirements detailed in the Purchasing By-Law, such as consultants awarded contracts with an annual value >$100K, legal outsourcing costs for the year, and sponsorships.	That Supply Management should ensure that in instances where the amendment has both a value of at least $50,000 AND is greater than 50% of the original contracted amount, approval is required from the Chief Corporate Services Officer or the Deputy City Manager, and that reporting is forwarded to the Corporate Services and Economic Development Committee annually in conjunction with the existing report to Committee and Council that deals with several reporting requirements detailed in the Purchasing By-Law.

Audit Recommendation	Action Required Based on Dept. Head Action Plan	Comments (Risks, issues regarding implementation)	Related Council Motion	Status Update	Request for Approval of revised Implementation
Procurement Audit Rec. 13 Supply Management ensure that all Standing Offer Agreements have an original maximum cap for call-up of $100,000 with the total value of amendments not to exceed a further $50,000, or 50% of the original call-up, without the approval of the City Manager.	Standing Offers are reviewed in relation to the good or service required and the needs of the city client. The majority of standing offer call-ups are restricted in $$ to the 100k limit, although exceptions do make sense on occasion. Amendments to standing offer call-ups, which exceed 50% of the original approved call-up, will require approval of the City Manager.	Management agrees that there should be a 50% cap on amendments to call-ups but recognizes that in the case of PWS & Infrastructure Services, there are instances where there may be the need to exceed these limits. These exceptions require the City Manager's approval. Also recommend continuing to seek Level 2 management approval for amendments (as in recommendation #3).	No	Complete. Supply will seek level 2 (DCM or CCSO) approval for call-ups exceeding $100K and proceed to City Manager for approval where they exceed 50% of original call-up. Recommend revising recommendation to indicate that City Manager approval required for amendments exceeding 50% and $50K, to eliminate necessity for senior management review of relatively small amendments. Consistent with suggestion under #3. (See example attached.)	Supply Management ensure that all Standing Offer Agreements have an original maximum cap for call-up of $100,000 with the total value of amendments not to exceed a further $50,000, or 50% of the original call-up, without the approval of the Chief Corporate Services Officer or Deputy City Manager.

Audit Recommendation	Action Required Based on Dept. Head Action Plan	Comments (Risks, issues regarding implementation)	Related Council Motion	Status Update	Request for Approval of revised Implementation
Procurement Audit Rec. 17 Supply Management should ensure that all purchasing activity is included in its report to Council, regardless of the source of the information or the means of acquisition and be presented in a clear and easily understood format.	The recommendation deals mainly with the issue of payment without reference, and Finance is working towards a meaningful method of providing Council with the information. The next annual report to Council, as identified by the AG, is Q2-2007. Finance staff to meet and agree on the format and level of detail to comply with the Council motion. It is proposed that the CAWG provide feedback on the reporting enhancements prior to implementation. Suggest reporting on purchasing activity of more thank $50K, to reduce unnecessary volume of information in report.	Management agrees with the intent of this recommendation. Management believes that the current reporting meets the standards established within the City Purchasing By-Law, which requires that Supply Management submit to Council on a quarterly basis the details of contracts in excess of $25K which were awarded under delegated authority. A much simpler and more cost effective approach would be for Accounts Payable to produce an annual listing of all vendors to whom payments totalling $25,000 or more in aggregate were made, together with the total payments made for the year. Management agrees that it is time to look at how reporting standards to Council for contracts and purchasing could be improved. Supply Management will investigate best-practice reporting for Council oversight and bring recommendations for improvement forward for the next term of Council. With #19, will require addition of 1 FTE (senior purchasing officer).	That “Supply Management should ensure that all purchasing activity (by type, more than $25,000) is included in an annual report to Council, regardless of the source of the information or the means of acquisition and be presented in a clear and easily understood format”	In progress	That Supply Management should ensure that all purchasing activity (by type, more than $25,000) is included in an annual report to Council, regardless of the source of the information or the means of acquisition and be presented in a clear and easily understood format. Reporting will be provided to the CSEDC and Council in conjunction with the existing Annual Report to Council that deals with several reporting requirements detailed in the Purchasing By-law.

Audit Recommendation	Action Required Based on Dept. Head Action Plan	Comments (Risks, issues regarding implementation)	Related Council Motion	Status Update	Request for Approval of revised Implementation
Procurement Audit Rec. 19 Supply Management should ensure Payments without Reference to a Purchase Order are adequately monitored, in order to identify and include cases of non-compliance in regular reports to Council, and the City Manager, in order to minimize their occurrence.	Purchasing does review the P w/o R listing in order to identify areas where a move to a competitive process (see recommendations 14 & 17 which relate). Including cases of non-compliance in regular reports to Council, and the associated review suggested does have staffing and resource implications.	Management agrees with the intent of this recommendation. To expand reviews to 100% would require a significant increase in staffing. Implementation of this recommendation will be identified and resourcing sought in the 2007 budget. As above #17, 1 FTE (combined) to complete both activities.	That “Supply Management should ensure Payments without Reference to a Purchase Order (by type, more than $25,000) are adequately monitored and included in an annual report, in order to identify and include cases of non-compliance in regular reports to Council, and the City Manager, in order to minimize their occurrence”, and that staff reports to Council on the implementation of this recommendation no later than September 2006.	In progress As with previous recommendations, recommend monitoring for Payments without Reference to a Purchase Order of more than $50K, to reduce unnecessary volume. The consistent application of the $50K threshold is in keeping with recent Council-approved changes to the Purchasing By-Law, which have raised the tender limits to $50K.	That Supply Management should ensure Payments without Reference to a Purchase Order (by type, more than $25,000) are adequately monitored and included in an annual report, in order to identify and include cases of non-compliance in regular reports to Council, and the City Manager, in order to minimize their occurrence. Reporting will be provided to the CSEDC and Council in conjunction with the existing Annual Report to Council that deals with several reporting requirements detailed in the Purchasing By-law.

Document 1B

Recommendation No. 2

2. Receive for information the action status tracking and next steps as outlined in Documents 1B and 2 to 9.

Audit Recommendation	Management Comments	Related Council Motion	Next Steps
Procurement Audit Rec. 23 Supply Management and Financial Support Units should ensure Terms and Conditions are sent out with both Corporate and Departmental Purchase Orders, regardless of value, and their receipt and acknowledgement by suppliers kept on record.	Management disagrees with this recommendation. The existing approach will continue until the CAWG has a chance to comment on the AG recommendation and the merits of the current Supply Management approach. Management believes that the process currently being followed is preferable to the recommendation. Currently, all bid solicitation documents, Tender, Standing Offer, Proposal, etc., contain up to 40 standard terms and conditions (6 to 7 pages typically), designed by Purchasing, Risk Management, and Legal Services to protect the City from a number of perspectives. Issues addressed include Conduct of Work, Insurance, Indemnification and Liability, Workplace Safety, Occupational Health, MFIPPA, Conflict of Interest, Need for Confidentiality, Audit and Reporting Requirements, among others. Bidders, in their proposal or tender submission, are obligated (at the bidding stage, where the City clearly has leverage in that regard), to accept the City terms and conditions. (See samples attached.)	No		Subject of continued discussion between the Auditor General and the CAWG

Audit Recommendation	Management Comments	Related Council Motion	Next Steps
Management Control Framework Audit Rec. 1 i) c) That the Chief Corporate Planning and Performance Reporting (CCPPR) Officer assess the City Corporate Plan and process, and budgeting process for 2006, once completed, to identify lessons learned, and develop an action plan to address issues or outstanding items, including: c) incorporating capacity planning in the planning process and the plan	We disagree with this observation. Capacity planning was included in the planning process and the CCP. The planning process followed specifically took capacity constraints into account. The feasibility of implementing each action item included in the CCP and DBPs within the existing resource base was evaluated by the City department(s) involved. Where this was not possible, the additional resources required were highlighted and included in the costing of the plans that were submitted to Council. This is a simple, cost-effective approach to capacity assessment.	No	Subject of continued discussion between the Auditor General and the CAWG
Rec. 4 That the CCPR Officer introduce integrated risk management within the City, as part of the planning and performance management cycle. This would include such activities as: a) development of an integrated risk management policy, b) development of tools and approaches for risk management, and c) provision of risk management training.	We do not believe it would be practical to implement this recommendation at this point. The cost/benefit of implementing a full blown, organization-wide risk management initiative, as suggested by the Auditor General, is not clear, nor is it clear that this is a widely accepted best practice in municipal governance. To our knowledge, in the few cases where Canadian municipalities have experimented with them, implementation has not been successful. Our priority at this point, from a management control framework perspective, is on rolling out the planning framework and developing and implementing the performance measurement and reporting framework, throughout the organization over the next 2-3 years. Nonetheless, certain steps we are taking to enhance the Corporate planning process, such as the presentation of a comprehensive environmental scan, which will identify risks to be considered in developing the City Corporate Plan and Departmental Business plans, will address this issue. We have also developed an estimate of the cost involved in implementing an integrated risk framework on a Corporate-wide basis and will include this activity for consideration by Council in the 2007 budget submission.	No	Subject of continued discussion between the Auditor General and the CAWG

Audit Recommendation	Management Comments	Related Council Motion	Next Steps
Internet Usage and Controls Audit Rec. 7 h) That IT Services: h) enable system logging on all devices.	Disagree with recommendation. Industry best practices do not support full logging on all devices at all times due to the high cost. A study awarded to Allstream in 2006 to examine logging and monitoring processes confirmed that full logging was inappropriate and not cost effective. However, where additional logging was recommended by Allstream, a budget pressure of $240,000 has been identified in 2007 to implement additional network intrusion monitoring, logging and alerting and outbound firewall controls.	No	Subject of continued discussion between the Auditor General and the CAWG
Rec. 10 That IT Services ensure the policy prohibit the use of non-City approved computing resources for processing City data and assets.	Management does not agree with this recommendation. Such restrictions would prohibit the use of web-mail from home computers. However, the Responsible Computing Policy does stress employee obligations to safeguard electronic information whether being processed at a City facility or not. To further formalize the existing approval process for non-City devices, IT Security has drafted a procedure for assessing and safely utilizing non-city assets on the City network with the approval of IT Security. No further action required.	No	Subject of continued discussion between the Auditor General and the CAWG
Rec. 15 That IT Services identify tools for encryption of sensitive e-mail content.	Management disagrees with this recommendation. The revised Computing Policy stipulates that sensitive information should not be transmitted via e-mail. An enterprise wide e-mail encryption solution would be for internal use only and would not be compatible with external partners. Should this be required, it is estimated that it will cost $100,000 and require 2 FTEs to administer.	No	Subject of continued discussion between the Auditor General and the CAWG

Additional audit recommendations that have 2007 or future budget implications are outlined in Documents 2 to 9. Implementation of these recommendations will be subject to 2007 budget consideration and approval.