City Council on January 27 and 28, 2009, appointed the following members-at-large to the Audit Committee for a term of office starting on January 28, 2009, and  ending on November 30, 2010, and until successors are appointed:

 

Councillor Mike Del Grande

Councillor Rob Ford

Councillor Doug Holyday

Councillor Chin Lee

Councillor John Parker

Councillor Anthony Perruzza

 

(The Audit Committee elects its Chair from its Members)

The Audit Committee recommends that:

 

1.         City Council request the City Manager to direct management staff to regularly review and evaluate the adequacy of internal controls within their area of responsibility.  Where appropriate, action be taken to strengthen controls, with a view to preventing and detecting instances of fraud and other wrongdoing.

The Audit Committee:

 

1.         requested the City Manager to report to the Audit Committee:

 

             a.        on the policy changes required in order to allow for recoveries made as a result of investigations by the Auditor General to be allocated to a general reserve fund, instead of being returned to the subject division where the losses occurred; and

 

             b.        with policy guidelines respecting termination of employees due to integrity issues, such as the ones described in the 2008 Fraud and Waste Hotline report; and

 

2.         requested the Auditor General to consider reporting to the Audit Committee:

 

             a.        for its next meeting, on incidents, by division, agency, board or commission, which have substantiated complaints; and

 

             b.        with any follow-up information respecting the Manulife Financial issues.

 

The Audit Committee met in closed session to consider this Item as it relates to:

 

1.         personal matters about identifiable individuals, including municipal or local board employees;

2.         labour relations and employee negotiations; and

3.         litigation or potential litigation affecting the municipality or local board.

In June 2000, Audit Committee requested that the Auditor General submit an annual report on the status of fraud and related matters.  This report represents the Auditor General’s eighth annual report on the activities of the Fraud and Waste Hotline Program for the period of January 1, 2008 to December 31, 2008.

 

Managing the risk of fraud or other wrongdoing must be a continuous and collective effort involving all levels of staff.  The primary responsibility for maintaining appropriate internal controls to prevent and detect wrongdoing remains with divisional management.

 

The risk of fraud and wrongdoing is an inherent part of conducting business in all organizations including the public sector.

 

Often fundamental and basic internal controls that help reduce the risk of wrongdoing are overlooked when controls are not regularly reviewed.  Inadequate internal controls are a primary contributing factor to the occurrence of fraud while the lack of management review and the override of existing controls are also factors.

 

Corrective controls, such as improved policies and procedures, are key to remedying problems that are discovered ensuring that future wrongdoing is better prevented and detected, especially in areas subject to greater levels of risk.

 

In 2008, based on our review of complaints, a number of substantiated complaints may have been mitigated through the active application of internal controls, policies and procedures.  In these cases, basic controls were disregarded and their effectiveness not actively monitored.  The recommendation made in this report will re-emphasize management’s responsibility to regularly review and re-evaluate internal controls.

The Audit Committee:

 

1.         authorized the Auditor General to report to the Audit Committee in the event he determines that additional Audit staff are required to properly support his Office; and

 

2.         received for information, the report (January 19, 2009) from the Auditor General. 

This report responds to a request from the Audit Committee that the Auditor General “provide the value added of his department by identifying:

 

1.         actual dollar savings to the City;

2.         potential savings to the City of Toronto;

3.         at risk dollars to the City of Toronto; and

4.         for non-identifiable dollar activities, the impact of the audit review on those items.”

 

At the request of the Audit Committee, attempts have been made to identify the extent of the quantifiable financial benefits which have resulted from the work conducted by the Auditor General’s Office.

 

While certain reports have resulted in tangible cost savings, the more important benefits provided relate to the avoidance of future costs, as well as the protection of City assets.  Nevertheless, tangible annual cost savings have occurred, or will occur, as a result of the work conducted by the Auditor General.  Over the five-year period commencing January 1, 2004, the estimated potential savings to the City are in the range of $91 million compared to a cumulative audit expenditure of $16 million.  In simple terms, for every $1 invested in the audit process the return on this investment has been $5.60.  Many of the estimated cost savings are ongoing and occur on an annual basis.

The Audit Committee recommends that:

 

1.         City Council request the City Manager, in consultation with the Chief Information Officer, to give consideration to the establishment of an IBMS governance model which provides for senior management approval and prioritization of all IBMS related projects.  The governance model follow the process recently established in relation to the development of SAP projects.

 

2.         City Council request the City Manager, in consultation with the Chief Information Officer, to require that divisions identify business risks relating to the IBMS Information Technology System.  The Chief Information Officer review all such risks and ensure strategies and processes are in place to address all such risks.

 

3.         City Council request the City Manager, in consultation with the Chief Information Officer and divisions, to develop IBMS performance measures.  Such measures be used to monitor ongoing performance.  Where performance does not meet such measures, corrective action be taken.

 

4.         City Council request the City Manager and the Chief Information Officer, as part of the IBMS governance process, to give priority to the development of IBMS business continuity plans.  Such plans should include disaster and recovery planning.

 

5.         City Council request the City Manager, in consultation with the Chief Information Officer, to develop and formalize service level agreements for information technology services provided to City divisions by the Information and Technology Division.

 

6.         City Council request the City Manager, in consultation with the Chief Information Officer, to review current levels of training available to IBMS users, and solicit input from divisional users in relation to training effectiveness.  Deficiencies in regard to training identified by users be appropriately addressed.

 

7.         City Council request the City Manager, in consultation with the Chief Information Officer, to  develop and implement a change management protocol for IBMS.  Such a protocol take into account the SAP change management protocol.

 

8.         City Council request the City Manager, in consultation with the Chief Information Officer, to  develop security plans, standards and related staff responsibilities for managing and overseeing IBMS security.

 

9.         City Council require the City Manager, in consultation with the Chief Information Officer, to conduct periodic reviews of current IBMS user security to ensure access is compatible with user roles.  Such review should also include an analysis of the last date of use.  Dormant users should be eliminated from system access.

 

10.       City Council request the Chief Information Officer to develop formal written procedures for granting, changing or removing IBMS user access.

 

11.       City Council request the City Manager and the Chief Information Officer to develop as a priority an electronic interface between IBMS and the City’s SAP Financial System.  Such an interface would reduce the requirement for manual analysis and processing.

 

12.       City Council request the City Manager, in consultation with the Chief Information Officer and the City Clerk, to review the record retention policy for all IBMS related records.  Such a review include the establishment of policies and procedures for archiving IBMS records.

 

13.       City Council request the Chief Information Officer to obtain a copy of the System source code for the current release of the System software and ensure future releases are accompanied with System software under the terms of the agreement.

 

14.       City Council request the City Manager to conduct a review of related System users in the City and its Agencies, Boards and Commissions and update the existing software maintenance contract as required.

 

15.       City Council request the City Manager to ensure staff from business units perform the procedure for revising service fees maintained in IBMS and that the process be appropriately documented.

The objective of this audit was to determine whether the City’s management and oversight of the Integrated Business Management System (IBMS) ensures the reliability, integrity and confidentiality of information produced and maintained by the system.

 

For IBMS to serve the City efficiently and effectively improvements in management and oversight are required.  The establishment of an IBMS information technology governance structure will go along way in helping to coordinate IBMS related decision-making and change management.

 

Implementation of a long range strategic plan, performance measures and a business continuity plan will also ensure coordinated growth and development for system users and ensure reliable service to IBMS user divisions.  There are also opportunities for improvement relating to user training, process for making changes to the system, security management and administration of software licences.

 

Although recommendations in this report focus on improving existing controls and administration of IBMS related resources the recommendations may be relevant to information technology systems throughout the City and its Agencies, Boards, Commissions and Corporations and should be reviewed, evaluated and implemented as deemed appropriate.

The Audit Committee received for information, the report (February 16, 2009) from the Acting Deputy City Manager and Chief Financial Officer.

The Audit Committee received for information, the report (February 5, 2009) from the Auditor General.

The purpose of this report is to advise Audit Committee of the audit work to be conducted at Toronto Police Services by the Auditor General in 2009.  In accordance with the City of Toronto Act, the Auditor General’s mandate does not extend to the Toronto Police Services.  The Auditor General is able to conduct audit work at the Toronto Police Service only at the request of the Toronto Police Services Board.  This work has been requested by the Toronto Police Services Board.

 

The two projects relate to a follow-up of previously issued reports on:

 

-           “The Auditor General’s Follow-up Review on the October 1999 Report Entitled Review of the Investigation of Sexual Assaults – Toronto Police Service” submitted to the Toronto Police Services Board in February 2005.

 

-           “Review of Police Training – Opportunities for Improvement” submitted to the Toronto Police Services Board in January 2007.

 

The Auditor General advised the Toronto Police Services Board at the meeting held on December 18, 2008 that these particular audits are included in the Auditor General’s 2009 Audit Work Plan.

The Audit Committee recommends that:

 

1.         City Council receive the 2007 audited financial statements and management letter of Leaside Memorial Community Gardens Arena.

The Audit Committee recommends that:

 

1.         City Council approve the 2007 audited financial statements and management letters of the three Business Improvement Areas attached as Appendices A-1 to C-2.

The Audit Committee:

 

1.         requested the Acting Treasurer to report to the Audit Committee on:

 

             a.        the feasibility of posting on the City’s web page, information regarding outstanding credit balances collected from the taxpayer (for such things as trees, sidewalks, property taxes, and water) with a view to returning them; and

 

             b.        steps that might usefully be taken to address the issue of unclaimed credit balances; and

 

2.         received for information, the report (October 17, 2008) from the Acting Treasurer.

The Audit Committee:

 

1.         requested the Deputy City Manager and Chief Financial Officer to report to the Budget Committee, as part of the 2010 budget process, on the impacts of the recent equity market losses on the City-sponsored and TTC-sponsored pension plans and the financial consequences of these losses on the City’s 2010 Operating Budget and forecast; and

 

2.         received for information, the report (October 17, 2008) from the Acting Treasurer.

The Audit Committee received for information, the following:

 

1.         the Toronto Community Housing Corporation’s 2007 Consolidated Financial Statements and Auditor’s Report dated March 28, 2008; and

 

2.         letter (February 25, 2009) from Keiko Nakamura, Chief Operating Officer and Acting Chief Executive Officer, Toronto Community Housing Corporation.

City Council on July 15, 16 and 17, 2008, adopted Executive Committee Item EX22.10, headed "Toronto Community Housing Corporation - Annual Report to Shareholder, 2007 Audited Consolidated Annual Financial Statements and Annual General Meeting", without amendment, and in so doing, referred the Toronto Community Housing Corporation’s 2007 audited annual consolidated financial statements and the auditor’s report dated March 28, 2008, to the City Audit Committee for its information.