City of San Diego Official Website

July 2021 Annual Citywide Risk Assessment and Audit Work Plan Office of the City Auditor City of San Diego FISCAL YEAR 2022 DATE: July 22, 2021 TO: Honorable Members of the Audit Committee FROM: Andy Hanau, City Auditor SUBJECT: Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Attached is the Annual Audit Work Plan proposed by the Office of the City Auditor for Fiscal Year 2022. This report will be presented at the July 28, 2021 Audit Committee meeting for your review and consideration. The list of 18 proposed audit assignments for FY 2022 includes performance audits regarding various City programs and activities, and other audit projects and activities such as the Fraud Waste and Abuse Hotline. The Audit Work Plan was developed by considering the required audits mandated by the City Charter and the San Diego Municipal Code, results of the FY 2022 Citywide Risk Assessment, and input from the City Council, Audit Committee, and other sources. We designed our work plan to address what we considered to be risk areas, while limiting the scope of work to what we can realistically accomplish with the staff resources available. Respectfully submitted, Andy Hanau City Auditor cc: Honorable Mayor Todd Gloria Honorable City Councilmembers Honorable City Attorney Mara Elliott Jay Goldstone, Chief Operating Officer Matthew Vespi, Chief Financial Officer Matthew Helm, Chief Compliance Officer Andrea Tevlin, Independent Budget Analyst OFFICE OF THE CITY AUDITOR 600 B STREET, SUITE 1350, MS 605B SAN DIEGO, CA 92101 PHONE (619) 533-3165 CityAuditor@sandiego.gov TO REPORT FRAUD, WASTE, OR ABUSE, CALL OUR FRAUD HOTLINE (866) 809-3500 mailto:CityAuditor@sandiego.gov Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Table of Contents Mission Statement 1 Introduction 1 Audit Resources 1 Calculation of Estimated Audit Hours Available for FY 2022 2 Performance Audits and Other Audit Activities 3 Citywide Risk Assessment- Fiscal Year 2022 5 Interpreting Risk Assessment Results 9 Other Risk and Audit Factors Considered 9 Audit Work Plan (July 2021 through June 2022) 10 Additions to Audit Work Plan 10 Audit Work Plan Fiscal Year 2022 11 PERFORMANCE AUDITS FY 2022 CARRY OVER FROM FY 2021 AUDIT WORK PLAN 11 PERFORMANCE AUDITS FY 2022 PROPOSED AUDITS 13 ADDITIONAL AUDIT ACTIVITIES FY 2022 14 Next Steps 16 Attachment A Management Questionnaire 17 Attachment B Calculation of Weights Used for Risk Factors 20 Attachment C Risk Assessment 21 file://ad.sannet.gov/DFS/Auditor-Shared/Shared/AUDITORExec-SHARED/Risk%20Assessment/FY22%20Risk%20Assessment/Draft%20Report%20and%20Attachments/Citywide%20Risk%20Assessment%20and%20Audit%20Work%20Plan%20-%20FY2022.docx#_Toc74918867 Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 1 Mission Statement The mission of the Office of the City Auditor is to advance open and accountable government through accurate, independent, and objective audits and investigations that seek to improve the economy, efficiency, and effectiveness of City government. Introduction Government Auditing Standards and the Institute of Internal Auditors Standards encourage the chief audit executive to establish a risk-based approach to determine the priorities for City Auditor activities. The Office of the City Auditor has completed a fiscal year (FY) 2022 Citywide Risk Assessment to help identify, measure, and prioritize the Citys potential audits based on the level of risk to the City. Each Activity Groups risk score was considered when selecting audits for the City Auditors FY 2022 Audit Work Plan. Audit Resources The FY 2022 budget for the Office of the City Auditor includes 22 staff members at a budgeted cost of $4.35 million for salaries, fringe benefits, and non-personnel expenses, such as office equipment, training, and supplies. This total also includes $350,000 for the cost of the Citys Comprehensive Annual Financial Report (CAFR) audit that will be conducted by an outside independent audit firm. The City Auditor administers the CAFR audit contract. During FY 2022, the Office will have one City Auditor, one Assistant City Auditor, one Deputy City Auditor, four Principal Performance Auditors, and thirteen performance auditors to conduct audits and investigations with an estimated 23,840 audit hours available to perform audits, follow up and report on the status of audit recommendations, and administer the Fraud, Waste, and Abuse Hotline. The estimated audit hours available were calculated as follows: Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 2 Calculation of Estimated Audit Hours Available for FY 2022 One Full-Time Equivalent (FTE) Auditor: Hours Total Annual Hours Available 2,080 Less Hours For: Vacation and Sick Leave-160 (10) Holidays and (1) Floating Holiday-88 (3) Citywide Discretionary Leave Days Granted-24 Continuing Professional Education-40 Administrative Duties *-106 Other Audit Related Activities **-242 Total Annual Audit Hours Available per Auditor 1,420 Number of Auditors Audit Hours 2 Executive Management1 [(2 x 1,400) 1,500] 1,300 17 Auditors2 [(17 x 1,420) 1,600] 22,540 Total Estimated Audit Hours Available for FY 2021 23,840 Note: Audit supervision and administrative hours for the new permanent City Auditor and two Executive Assistants are not included. * "Administrative Duties" include completion of timecards; leave slips; annual OCA forms; Performance Self-Evaluation forms; organization of office/projects/tasks, etc.; research for training opportunities; Citywide mandated trainings; and any time not attributed to a specific project or task assigned by management. ** "Other Audit Related Activities" include tasks such as responding to City Council and other stakeholder requests; preparing for presentations; and attending Audit Committee, City Council, and other stakeholder meetings; outreach stakeholder meetings; R&D for future audit issues; etc. In FY 2021, these hours have also included significant staff time spent working on high-priority OCA improvement initiatives, such as developing and implementing the Recommendation Implementation Work Plan (RIWP) process, as well as continuing work to update OCAs report format. 1 Audit hours were reduced by 1,500 hours for executive management performing additional administrative duties. 2 Audit hours were reduced by 1,600 hours for Maternity Leave, Parental Leave, and staff vacancy. Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 3 Performance Audits and Other Audit Activities The City Charter requires the Office of the City Auditor to conduct all of its audits under Government Auditing Standards. There are three main types: financial statement audits, attestation engagements, and performance audits. The City of San Diego hires an outside independent audit firm to perform the Citys financial statement audit of the Citys Comprehensive Annual Financial Report (CAFR). The City Auditor conducts performance audits of the Citys departments, agencies, and their activities. Under Government Auditing Standards, performance audits provide objective analyses so that management and those charged with governance and oversight can use the information to improve program performance and operations, reduce costs, facilitate decision making, and contribute to public accountability. A performance audit is a dynamic process that includes consideration of applicable standards throughout the course of the audit. Performance audit objectives may vary widely and include assessments of program effectiveness, efficiency, equity, internal controls, compliance with laws and regulations, and prospective analysis. Examples of performance audit objectives may include, but are not limited to: Assessing the extent to which legislative, regulatory, and/or organizational goals and objectives are being achieved; Analyzing the relative efficiency and effectiveness of a program or activity; Evaluating whether the audited entity is following sound procurement practices; Assessing the reliability, validity, and/or relevance of performance measures concerning program effectiveness and results, or economy and efficiency; Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 4 Assessing internal controls designed to provide reasonable assurance of achieving effective and efficient operations, and reliable financial and performance reporting; and Determining if program activities are in compliance with laws, regulations, contract provisions, grant agreements, and other requirements. The Office of the City Auditor may also perform some attestation engagements based on agreed-upon procedures, which consists of specific testing procedures performed on a subject matter. Additionally, we perform other non-audit services such as investigating complaints received through the Citys Fraud Hotline regarding allegations of fraud, waste, and abuse. We perform investigations following the procedures recommended by the Association of Certified Fraud Examiners for allegations of improper financial activity, fraud, waste and/or abuse that appear to be material in nature. Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 5 Citywide Risk Assessment Fiscal Year 2022 Risk assessment is a process of systematically scoring (or rating) the relative impact of a variety of risk factors. A risk factor is an observable or measurable indicator of conditions or events that could adversely affect the organization. Risk factors can measure inherent risks (such as a large organizational structure) or organizational vulnerability (such as level of cash and assets easily converted to cash). The first step in creating the Citys risk assessment model was to define the audit universe. The audit universe is a listing of the Citys significant Auditable Units (all of the Citys potential audits that could be performed). We created a list of City departments and significant City agencies and their primary Activity Groups as the Auditable Units. To accomplish this, we utilized the Citys FY 2022 May Revise budget data from SAP and the component unit information in the Citys most current financial statements. We have reduced the number of Activity Groups by combining some activities within departments in order to target more areas of risk using our existing resources, address cross-cutting issues which impact multiple units within a department, and create efficiencies in conducting future audits of Activity Groups. However, a department may still be broken out into several Activity Groups as in the example shown in Exhibit 1. Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 6 Exhibit 1 Sample Department and Activity Groups The next step in creating the risk assessment model was to identify and rank the major risks associated with each of the Citys significant Auditable Units (Activity Groups). To achieve this, a management questionnaire which measured a variety of risk factors was developed, (See Attachment A Management Questionnaire). City Management completed Management Questionnaires for the associated Activity Groups. The questionnaire used had 10 measurable risk factors as follows: 1. Level of interface with the external public. 2. Mission critical nature of Activity Group for the department to achieve its goals and objectives. 3. Support of internal operations is considered critical to achieving the objectives of other departments missions or goals. 4. Failure to achieve the Activity Groups mission or goals leads to public displeasure or negative media coverage. Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 7 5. Level of cash or cash-convertible nature of Activity Groups transactions. 6. Activity Group's tracking and use of activity performance metrics. 7. Regulation effect or impact on operations. 8. Number of budgeted employees (FTE). 9. Level of budgeted annual revenues. 10. Level of budgeted annual expenses. A Management Questionnaire was completed for each of the Citys Auditable Units to determine a risk score of: 0 (low), 3 (mediumlow), 5 (medium), 7 (mediumhigh), or 9 (high) for each of the 10 risk factors listed above. The risk scores were used for risk factors 1 through 7 (listed above), and the risk scores for risk factors 8 through 10 (FTE, Revenue, Expenses) were updated based on the FY 2022 May Revise budget. Audit staff reviewed the results, and based on professional judgment, adjusted scores if needed. Additionally, weights were assigned to each factor based on relative importance as determined by input from audit staff (See Attachment B Calculation of Weights Used for Risk Factors). An increase in risk score was calculated for activities that have not been audited in the prior five fiscal years. Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 8 The final step in completing the Citywide Risk Assessment was to calculate the total risk score for each Auditable Unit (list of the potential audits) in order of highest to lowest risk score by tabulating the information gathered from the questionnaires and applying the weights assigned to the risk factors. We then calculated the overall risk score for each Activity Group by stratifying the resulting rating in descending order by tenths, and identifying the top 30 percent (or those ranking 10, 9, or 8) as High Risk. The next 40 percent (ranking 7, 6, 5, or 4) were identified as Medium Risk, and the bottom 30 percent (ranking 3, 2 or 1) were identified as Low Risk (See Attachment C Citywide Risk Assessment). Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 9 Interpreting Risk Assessment Results The weighted scores for 10 risk factors were tabulated for each significant Departmental Activity Group identified in Attachment C Citywide Risk Assessment. The risk assessment scores and information gathered during the interviews with key personnel were considered when preparing the FY 2022 Audit Work Plan that follows. If a department or Activity Group has a high risk score, this merely indicates that the services they provide, or the functions they are responsible for, are by nature a high risk activity because of such factors as having a large amount of expenditures and revenues, having a high level of liquid assets such as cash, or a high degree of public interest. A high risk score does not mean that an Activity Group is being managed ineffectively or that it is not functioning properly. High risk areas may indicate opportunities to address activities which are mission critical, provide substantial support for other internal City operations, reflect high public need, or consume significant financial resources. The overall results identify the activities with the highest risk factors that may warrant and benefit from additional management action or audit services. Other Risk and Audit Factors Considered In addition to the risk assessment model, we interviewed key City personnel to consider other potential vulnerabilities and risk factors, including the risk of fraud, that could impede the achievement of a departments mission, goals, and objectives. We also considered past audit report findings, reviewed other entities audit reports, and researched trending municipal issues. In addition, we solicited feedback on areas of interest and/or concern from the City Council, City Management, and other stakeholders. Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 10 Audit Work Plan (July 2021 through June 2022) In FY 2022, we are proposing a work plan to address areas of critical importance to the City. The following Audit Work Plan includes our scheduled performance audits as well as additional audit activities. Included is the tentative audit objective for each assignment and estimated audit hours. We will perform an in-depth risk assessment on each activity group selected for audit to ensure our audit objective covers the areas of highest risk for that activity and adjust the audit objective, procedures, and hours accordingly. Performance audit objectives vary widely and may include assessments of program effectiveness and efficiency; equity; internal control; compliance; and prospective analyses. Our estimated audit hours for each audit activity are based on an analysis of average audit hours for our prior years audits, and our knowledge of the complexity of the Activity Groups selected for audit. The actual hours may vary based on the audit scope determined by the detailed risk assessment for each engagement, as well as the extent and complexity of findings revealed during audit testing. Additions to Audit Work Plan Requests to add audits to the Audit Work Plan during the fiscal year will be presented to the Audit Committee with a City Auditor analysis of the impact the proposed audit will have on the other audits on the Work Plan. Audit priority will be given to those requests that pertain to the health and safety of residents and City employees, potential for significant financial impact, issues of equity, or issues of integrity. Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 11 2 44 594 Real Estate Assets Asset Acquisition The objective for this audit is to review the Citys acquisition and due diligence process for procuring new real estate assets, including the purchase of 101 Ash Street and other major acquisitions. 200 Report Writing 3 116 117 447 443 Department of Finance- User Fees The objective for this audit is to review the process and frequency of user fee updates to determine if they are being evaluated and updated in accordance with CP 100-05 and industry best practices. 550 Report Writing 4 55 594 Real Estate Assets Department The objectives are to (1) Evaluate whether READs process for monitoring and transitioning expiring and holdover agreements to long term leases aligns with best practices, and (2) Evaluate whether lease contracts contain best practice lease contract clauses. 1,100 Fieldwork 1 Risk Assessment scores and line number information for the carry over audits are from the FY 2021 Risk Assessment. PERFORMANCE AUDITS FY 2022 CARRY OVER FROM FY 2021 AUDIT WORK PLAN Work Plan Item No. Risk Assess Line #1 Risk Score Activity Group Audit Audit Objectives FY 2022 Audit Hours Status as of July 1, 2021 1 109 459 Office of the COO- CARES Act Funding The objectives for this audit are to determine if the City has sufficient internal controls to ensure that CARES Act funds are distributed in compliance with requirements; whether funds are being used to efficiently, effectively, and equitably address the effects of the pandemic; and evaluate whether internal controls are sufficient to mitigate fraud, waste, and abuse. 200 Report Writing Audit Work Plan Fiscal Year 2022 Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 12 PERFORMANCE AUDITS FY 2022 CARRY OVER FROM FY 2021 AUDIT WORK PLAN Work Plan Item No. Risk Assess Ln #2 Risk Score Activity Group Audit Audit Objectives FY 2022 Audit Hours Status 5 25 28 648 636 Parks & Recreation Program Equity The objectives are to (1) Determine whether the Department effectively identifies recreation programming equity needs in each community, (2) Determine whether the Department meets identified programming needs equitably through funding and staffing allocations, and (3) Determine whether the Department provides residents with equitable access to recreation programs. 1,100 Fieldwork 6 99 475 Risk Management Workers Compensation The tentative objective is to review the Workers Compensation and Industrial Leave claims and determine if adequate controls are in place to ensure payments are made appropriately. 2,000 Not Started 7 3 21 57 774 675 557 San Diego Police Department Body Camera Usage The original tentative objective of this audit was to review SDPDs Community Policing practices. We have updated this tentative objective based and are now proposing that this audit review SDPDs policies and procedures regarding body camera footage and determine if they are aligned with best practices and local, state, and federal regulations; and to determine whether internal controls are in place to ensure body camera footage is properly collected, maintained, and monitored by appropriate personnel and whether the appropriate audit trail is captured when information is accessed. 2,000 Not Started 2 Risk Assessment scores and line number information for the carry over audits are from the FY 2021 Risk Assessment. Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 13 8 24 53 108 134 686 601 473 403 Public Works: Engineering & Capital Projects The original tentative objective for this audit was to evaluate the Engineering and Capital Projects Departments charges for services. We have updated this objective and we are now proposing that the objective of this audit be to determine the efficiency and effectiveness of the City's CIP project prioritization process; the extent to which the process aligns with Council Policy and best practices for allocating the Citys resources; and review CIP project priority parameters within the City's Enterprise Asset Management system. 2,400 Not Started PERFORMANCE AUDITS FY 2022 PROPOSED AUDITS Work Plan Item No. Risk Assess Ln # Risk Score Activity Group Audit Audit Objectives FY 2022 Audit Hours Status 9 72 541 City's Fiscal Sustainability and Financial Condition The objective for this audit is to review the fiscal sustainability and financial condition of the City of San Diego by analyzing trends in the City's financial data over the 10-year period of FY 2011 to FY 2020. 400 Not Started 10 143 379 Get It Done Application The tentative objective is to determine the efficiency and effectiveness of the City's Get It Done app and other methods of receiving and managing service requests, including areas such as response times and service levels, use of data to assess operating departments resource adequacy, technical challenges in responding to service requests, and the effectiveness of efforts to encourage public engagement with the City via notifying the City of service needs. 1,800 Not Started 11 11 728 San Diego Police Department Vehicle Towing Process The tentative objective is to review the Citys vehicle towing process, including evaluating towing service contracts and how the City monitors the towing process to ensure vehicles are towed appropriately, owners are charged appropriately, and that the owner vehicle retrieval process is reasonable and in line with best practices and applicable laws and/or regulations. 1,800 Not Started Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 14 12 105 465 Development Services Department- Code Enforcement The tentative objective is to determine the efficiency and effectiveness of the Code Enforcement Division, including areas such as response times for various types of code enforcement cases / priorities, case outcomes, and differences in caseloads and service levels across geographic areas. 1,800 Not Started 13 2 126 783 419 Homeless Strategies / Housing Commission The tentative objectives are to determine whether the homeless services provided to the City under contracts are necessary, aligned with best practices; whether the contracts include adequate performance measures; whether the City verifies contract compliance; whether services provided by different vendors are coordinated effectively; and whether the contracts are awarded through appropriate and effective bidding processes. 2,200 Not Started ADDITIONAL AUDIT ACTIVITIES FY 2022 Work Plan Item No. Risk Assess Ln # Risk Score Activity Description FY 2022 Audit Hours Status 14 N/A N/A Fraud, Waste, and Abuse Hotline The Office of the City Auditor administers the Citys Fraud Hotline to provide individuals a way to confidentially report evidence of fraud, waste, or abuse involving City of San Diego employees or operations. Investigations are performed for all material accusations. 2,960 On-going 15 N/A N/A Follow-up on Previously Issued Audit Reports The Office of the City Auditor tracks and follows-up on all audit recommendations to determine if they were properly implemented by City Management. 1,400 On-going 16 N/A N/A IT Audits The Office of the City Auditor will conduct a Risk Assessment on the Citys IT Infrastructure and based on the level of risk the OCA will create a schedule of on-going IT audits. See the FY 2022 IT Risk Assessment for more information. 1,570 Not Started Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 15 17 N/A N/A Annual Mission Bay Fund Audit FY 2021 The Annual Mission Bay Funds Audit is required by the City Charter, Article V, Section 55.2 (e). The objective of this audit is to verify the prior fiscal year collection, allocation, and use of Mission Bay Funds are in compliance with City Charter requirements. 300 Not Started 18 N/A N/A Annual Central Stores Inventory Audit FY22 San Diego Municipal Code Section 22.0501 requires an annual count of inventory in City storerooms and warehouses. The objective of this audit is to confirm the valuation of Central Stores inventory. 20 Not Started Total Planned Audit Hours for FY 2022 23,840 Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 16 Next Steps I will provide the Audit Committee with monthly activity reports describing the status and progress towards completing the audit assignments listed, as well as quarterly fraud hotline statistics reports. The Audit Committee will receive the results of all completed audits in the form of an audit report, and our Office will present audit results at scheduled Audit Committee and City Council meetings upon request. Respectfully submitted, Andy Hanau City Auditor Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 17 Attachment A Office of the City Auditor Annual Risk Assessment Management Questionnaire 1. To what extent does your activity group interface with the external public? Description / Purpose: Assess how frequently your activity group works/interacts directly with the public or City residents. Little to no interaction is not a negative indicator, but rather an indicator that your activity group serves internal customersinternal customer interaction is addressed in question 3. a. None b. Rarely or infrequently c. Monthly to quarterly level of interface d. Weekly level of interface e. Continual interface with the external public several times daily or more 2. To what extent is your activity group considered to be mission critical for the department to achieve its goals and objectives? Description / Purpose: Ascertain the significance that your activity group plays in your departments overall mission relative to other activity groups. Little to no contribution is not a negative indicator, but rather an indicator that your activity group may provide services and be focused on other internal customers. a. No contribution towards the departments goals / objectives b. Minimal contribution towards attaining the departments goals and objectives c. Moderate contribution towards attaining the departments goals and objectives d. Significant contribution towards attaining the departments goals and objectives e. The success of the departments goals and objectives is fully dependent on this activity group 3. To what extent does your activity group support internal operations or is considered critical to achieving the objectives of other entitys/departments mission/goals? Description / Purpose: Determine the level of support and role your department plays in helping other departments achieve their overall mission. This question identifies the interconnectedness that one activity group has with other internal operations. a. No support provided to other operations / departments b. Infrequent (i.e., annual) support provided to other operations / departments c. Periodic (i.e., monthly) support provided to other operations / departments d. Regular (i.e., weekly) support provided to other operations / departments e. Ongoing support provided to other operations / departments every day Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 18 4. To what extent would failure to achieve your activity groups mission or goals lead to public displeasure or negative media coverage? Description / Purpose: Assess how the activity groups level of visibility to the public, public interest in the groups activities, interest of the media, or other public safety related factors would lead to an increased potential loss or embarrassment if the activity group did not perform its critical mission or goals. This could also be called the newspaper testhow much negative press or public disapproval would a failure cause? a. No risk of loss or embarrassment b. Low risk of loss or embarrassment c. Moderate risk of loss or embarrassment d. Significant risk of loss or embarrassment e. Very high risk of loss or embarrassment 5. To what extent is there potential loss due to the cash or cash convertible nature of your activity groups transactions? Description / Purpose: Assess the risk associated with cash or cash-convertible assets. Be sure to factor in the amount of cash collected as compared to business transacted by other means (credit card, electronic funds transfer, invoice, journal entry, etc.), as well as risks associated with the volume, type, and nature of existing assets that are susceptible to theft such as equipment, supplies, and inventories. a. None b. Minimal amount of cash transactions or assets are difficult to convert to cash c. Moderate amount of cash transactions or assets can be converted to cash with some difficulty d. Nature of operations is primarily cash or assets are easily converted to cash e. Fully cash or cash equivalent operations 6. To what extent does your activity group track activity performance / metrics? Description / Purpose: Determine the extent to which your activity group captures, assesses, and responds to performance measurement data. a. We continuously capture performance metrics on key operations, assess achievement of goals and trends in the information, and adjust operations to improve upon our performance in all key areas. b. We track performance information in all key operations, assess and use data to improve operations, but we do not engage this process in a continuous, fluid manner. c. We track performance information in all our key operations and may assess data to some extent, but we do not use data to improve performance in all key areas. d. We collect some performance information, but the information does not account for all our key operations or we do not assess the data. e. We do not track performance measures or metrics. Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 19 7. To what extent do regulations affect or have impact on operations? Description / Purpose: Assess how government regulations (federal, state, or local) impact your activity group operations and the exposure to sanctions and potential penalties for noncompliance. Please be sure to factor in the complexity, volume, and change in regulations, including ordinances, municipal codes, administrative regulations, MOUs, federal and state laws and regulations, contract conditions, and grant provisions that pertain to your department. a. None b. Few regulations and little risk of noncompliance c. Risk of either substantial regulations or significant penalties d. Complex, voluminous, or frequently changing regulations with significant penalties e. Heavily regulated with serious consequences for noncompliance The information detailed below was obtained from the FY 2021 May Revise Budget and scored accordingly. 8. Total number of budgeted full-time employees (FTEs) for this Activity Group a. None b. 0 to 10 c. 11 to 25 d. 26 to 75 e. Greater than 75 9. Total annual budgeted revenues for this Activity Group a. $0 to $500,000 b. $500,001 to $5,000,000 c. $5,000,001 to $10,000,000 d. $10,000,001 to $25,000,000 e. Greater than $25,000,000 10. Total annual budgeted expenditures for this Activity Group a. $0 to $1,000,000 b. $1,000,001 to $10,000,000 c. $10,000,001 to $25,000,000 d. $25,000,001 to $40,000,000 e. Greater than $40,000,000 Annual Citywide Risk Assessment and Audit Work Plan Fiscal Year 2022 Page 20 City of San Diego Attachment C Citywide Risk Assessment FY 2022 See Footnotes for explanations of columns [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] Ln # Department Activity Group Wt FTEs Wt Exp Wt Rev Wt ExP Wt MC Wt InOp Wt Pub Wt Csh Wt Met Wt Regs Risk Score Adjustments Adjusted Risk Score Rank 10ths FTEs 8 Exp 18 Rev 14 ExP 6 MC 13 InOp 11 Pub 7 Csh 9 Met 8 Regs 6 1 Public Utilities Water System Operations 9 72 9 162 3 42 9 54 9 117 7 77 9 63 3 27 3 24 9 54 692 173.0 865 10 2 San Diego Housing Commission 9 72 9 162 9 126 9 54 5 65 5 55 5 35 3 27 0 0 5 30 626 156.5 783 10 3 Police Police Operations 9 72 9 162 7 98 9 54 9 117 9 99 9 63 5 45 0 0 9 54 764 764 10 4 Environmental Services Disposal & Environmental Protection 9 72 7 126 9 126 9 54 7 91 9 99 9 63 5 45 3 24 9 54 754 754 10 5 City Attorney Civil Advisory 7 56 5 90 3 42 9 54 9 117 9 99 9 63 3 27 0 0 9 54 602 150.5 753 10 6 City Attorney Civil Litigation 7 56 5 90 3 42 9 54 9 117 9 99 9 63 3 27 0 0 9 54 602 150.5 753 10 7 READ-Facilities Services 9 72 5 90 3 42 3 18 9 117 9 99 7 49 5 45 5 40 5 30 602 150.5 753 10 8 Parks & Recreation Developed Regional Parks 9 72 9 162 7 98 9 54 7 91 7 77 9 63 5 45 7 56 5 30 748 748 10 9 Stormwater 9 72 9 162 7 98 9 54 9 117 7 77 9 63 3 27 3 24 9 54 748 748 10 10 Parks & Recreation Open Space 7 56 9 162 9 126 9 54 7 91 5 55 9 63 3 27 5 40 9 54 728 728 10 11 Police Traffic, Youth & Event Services 9 72 9 162 9 126 9 54 7 91 7 77 7 49 3 27 5 40 5 30 728 728 10 12 Transportation Street 9 72 9 162 9 126 9 54 9 117 7 77 9 63 3 27 0 0 5 30 728 728 10 13 City Treasurer Business Tax 3 24 3 54 9 126 9 54 7 91 9 99 5 35 5 45 0 0 9 54 582 145.5 728 10 14 City Attorney Criminal Litigation 9 72 5 90 0 0 9 54 9 117 9 99 9 63 3 27 0 0 9 54 576 144.0 720 10 15 Citywide Other/Special Funds 0 0 9 162 9 126 3 18 9 117 5 55 5 35 0 0 3 24 5 30 567 141.8 709 10 16 Transportation Admin & Right-of-Way Management 5 40 9 162 9 126 9 54 9 117 7 77 9 63 3 27 3 24 3 18 708 708 10 17 Police Patrol Operations Division 9 72 9 162 3 42 9 54 9 117 9 99 9 63 3 27 0 0 9 54 690 690 9 18 Fire-Rescue Lifeguard Services 9 72 7 126 7 98 9 54 9 117 9 99 9 63 3 27 0 0 5 30 686 686 9 19 Police Centralized Investigations Division 9 72 9 162 5 70 9 54 9 117 5 55 9 63 3 27 3 24 7 42 686 686 9 20 Public Utilities Public Utilities 5 40 9 162 9 126 7 42 7 91 7 77 7 49 5 45 0 0 9 54 686 686 9 21 Redevelopment Agency 0 0 9 162 7 98 5 30 7 91 7 77 5 35 0 0 3 24 5 30 547 136.8 684 9 22 Engineering & Capital Projects Business Operations & Fiscal Services 7 56 7 126 9 126 9 54 9 117 3 33 9 63 3 27 3 24 9 54 680 680 9 23 Fire-Rescue Emergency Operations 9 72 9 162 5 70 9 54 9 117 7 77 7 49 3 27 0 0 7 42 670 670 9 24 Public Utilities Water Operations- Construction & Maint 9 72 9 162 0 0 9 54 9 117 9 99 9 63 3 27 3 24 7 42 660 660 9 25 Development Services Cannabis Permit Bureau 0 0 3 54 0 0 9 54 9 117 7 77 7 49 5 45 9 72 9 54 522 130.5 653 9 26 Fleet Operations Fleet Maintenance 9 72 7 126 9 126 0 0 7 91 9 99 7 49 5 45 0 0 7 42 650 650 9 27 Department of Information Technology Department of Information Technology 3 24 9 162 9 126 3 18 9 117 9 99 5 35 3 27 0 0 5 30 638 638 9 28 City Attorney Community Justice 5 40 3 54 0 0 9 54 9 117 9 99 9 63 3 27 0 0 9 54 508 127.0 635 9 29 City Attorney Management/Administration 5 40 3 54 0 0 9 54 9 117 9 99 9 63 3 27 0 0 9 54 508 127.0 635 9 30 Public Utilities WWTD 9 72 9 162 0 0 7 42 9 117 5 55 9 63 5 45 3 24 9 54 634 634 9 31 Police Support Operations 9 72 9 162 0 0 9 54 9 117 9 99 9 63 0 0 3 24 7 42 633 633 9 32 City Clerk Legislative Services 3 24 3 54 0 0 7 42 9 117 9 99 9 63 3 27 3 24 9 54 504 126.0 630 8 33 Fleet Operations Vehicle Acquisition 0 0 9 162 9 126 0 0 7 91 9 99 7 49 5 45 5 40 3 18 630 630 8 34 Emergency Medical Services 3 24 5 90 7 98 9 54 7 91 5 55 7 49 0 0 0 0 7 42 503 125.8 629 8 35 Public Utilities Pure Water Program Management 3 24 5 90 0 0 7 42 7 91 9 99 7 49 3 27 3 24 9 54 500 125.0 625 8 36 Parks & Recreation Community Parks II 9 72 7 126 3 42 9 54 7 91 5 55 7 49 5 45 7 56 5 30 620 620 8 37 City Clerk Administration 0 0 3 54 0 0 9 54 9 117 9 99 9 63 3 27 3 24 9 54 492 123.0 615 8 38 Office of the Mayor 3 24 3 54 0 0 9 54 9 117 9 99 9 63 3 27 3 24 5 30 492 123.0 615 8 39 Parks & Recreation Community Parks I 9 72 7 126 3 42 9 54 7 91 5 55 7 49 5 45 7 56 3 18 608 608 8 40 Engineering & Capital Projects Construction Management & Field Engineer 9 72 7 126 3 42 9 54 9 117 5 55 9 63 0 0 3 24 9 54 607 607 8 41 PETCO Park 0 0 5 90 7 98 5 30 7 91 7 77 3 21 0 0 7 56 3 18 481 120.3 601 8 42 Environmental Services Collection Services 9 72 9 162 3 42 9 54 9 117 3 33 7 49 3 27 0 0 7 42 598 598 8 Page 21 City of San Diego Attachment C Citywide Risk Assessment FY 2022 See Footnotes for explanations of columns [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] Ln # Department Activity Group Wt FTEs Wt Exp Wt Rev Wt ExP Wt MC Wt InOp Wt Pub Wt Csh Wt Met Wt Regs Risk Score Adjustments Adjusted Risk Score Rank 10ths 43 Mobility 3 24 3 54 3 42 7 42 9 117 5 55 7 49 3 27 3 24 7 42 476 119.0 595 8 44 Real Estate Assets 5 40 3 54 9 126 7 42 9 117 9 99 5 35 3 27 3 24 5 30 594 594 8 45 Department of Information Technology Enterprise Resource Planning 5 40 7 126 9 126 3 18 7 91 9 99 9 63 0 0 0 0 5 30 593 593 8 46 Police Neighborhood Policing 7 56 7 126 0 0 9 54 9 117 9 99 9 63 0 0 3 24 9 54 593 593 8 47 Parks & Recreation Golf Operations 9 72 5 90 7 98 9 54 5 65 5 55 7 49 7 63 3 24 3 18 588 588 8 48 Public Utilities EMTS 9 72 7 126 0 0 9 54 9 117 7 77 9 63 0 0 3 24 9 54 587 587 7 49 Fire-Rescue Administrative Operations 5 40 3 54 5 70 9 54 7 91 9 99 9 63 3 27 7 56 5 30 584 584 7 50 City Clerk Records Management 3 24 3 54 0 0 5 30 9 117 9 99 9 63 0 0 3 24 9 54 465 116.3 581 7 51 Public Utilities Pure Water Operations 3 24 3 54 0 0 7 42 7 91 9 99 7 49 3 27 3 24 9 54 464 116.0 580 7 52 Fire-Rescue Communications 7 56 5 90 3 42 9 54 9 117 9 99 9 63 3 27 0 0 5 30 578 578 7 53 Public Facilities Planning 3 24 3 54 7 98 9 54 9 117 9 99 7 49 3 27 3 24 5 30 576 576 7 54 Environmental Services Waste Reduction 9 72 5 90 3 42 9 54 9 117 5 55 7 49 3 27 3 24 7 42 572 572 7 55 Parks & Recreation Environmental Growth 2/3 0 0 5 90 7 98 9 54 7 91 5 55 9 63 3 27 5 40 9 54 572 572 7 56 Public Utilities Customer Support Service 9 72 5 90 0 0 9 54 9 117 9 99 9 63 5 45 0 0 5 30 570 570 7 57 City Treasurer Parking Meter Operations 3 24 3 54 7 98 9 54 5 65 3 33 9 63 5 45 0 0 3 18 454 113.5 568 7 58 Engineering & Capital Projects Engineering Support & Technical Services 9 72 5 90 3 42 3 18 9 117 3 33 5 35 9 81 3 24 9 54 566 566 7 59 Development Services Building & Safety 9 72 7 126 0 0 9 54 9 117 7 77 7 49 0 0 3 24 7 42 561 561 7 60 Public Utilities EPM 9 72 7 126 0 0 7 42 7 91 9 99 7 49 3 27 3 24 5 30 560 560 7 61 Transportation Traffic Engineering 5 40 5 90 5 70 9 54 9 117 5 55 9 63 3 27 3 24 3 18 558 558 7 62 Development Services Business Operations Support Services 5 40 5 90 9 126 9 54 9 117 0 0 7 49 3 27 3 24 5 30 557 557 7 63 Planning 5 40 5 90 5 70 9 54 9 117 5 55 9 63 0 0 3 24 7 42 555 555 7 64 Special Promotional Programs Support to Other Funds 0 0 9 162 0 0 0 0 7 91 5 55 7 49 0 0 7 56 5 30 443 110.8 554 6 65 Development Services Project Submittal & Management 7 56 3 54 3 42 9 54 7 91 9 99 9 63 3 27 3 24 7 42 552 552 6 66 Environmental Services Environmental Services 5 40 5 90 7 98 9 54 5 65 9 99 7 49 0 0 3 24 5 30 549 549 6 67 San Diego Convention Center Corporation 0 0 7 126 9 126 9 54 3 39 0 0 7 49 3 27 0 0 3 18 439 109.8 549 6 68 Library Central Library 9 72 5 90 3 42 9 54 9 117 5 55 7 49 3 27 3 24 3 18 548 548 6 69 City Clerk Elections & Information Services 0 0 0 0 0 0 9 54 9 117 9 99 9 63 3 27 3 24 9 54 438 109.5 548 6 70 Public Utilities Wastewater Collection 9 72 9 162 0 0 5 30 9 117 7 77 5 35 0 0 3 24 5 30 547 547 6 71 Library Branch Libraries 9 72 7 126 0 0 9 54 9 117 5 55 7 49 3 27 3 24 3 18 542 542 6 72 Office of the Chief Operating Officer 3 24 3 54 3 42 5 30 9 117 7 77 5 35 0 0 3 24 5 30 433 108.3 541 6 73 Office of the IBA 3 24 3 54 0 0 7 42 9 117 7 77 7 49 3 27 3 24 3 18 432 108.0 540 6 74 Development Services Engineering 9 72 5 90 3 42 9 54 9 117 9 99 5 35 0 0 0 0 5 30 539 539 6 75 Department of Information Technology Information Technology 5 40 3 54 3 42 9 54 7 91 9 99 9 63 0 0 5 40 9 54 537 537 6 76 Police Training/Employee Development 9 72 9 162 0 0 5 30 9 117 7 77 7 49 0 0 0 0 5 30 537 537 6 77 City Retirement System 5 40 3 54 0 0 5 30 9 117 5 55 7 49 3 27 3 24 5 30 426 106.5 533 6 78 Engineering & Capital Projects Transportation & Utility Engineering 9 72 5 90 0 0 9 54 9 117 5 55 9 63 0 0 3 24 9 54 529 529 6 79 Ethics Commission 0 0 3 54 0 0 9 54 9 117 3 33 9 63 0 0 7 56 7 42 419 104.8 524 6 80 Risk Management Department Management 3 24 3 54 7 98 3 18 9 117 5 55 5 35 0 0 0 0 3 18 419 104.8 524 5 81 Purchasing & Contracting Central Stores 3 24 3 54 5 70 9 54 7 91 9 99 7 49 7 63 0 0 3 18 522 522 5 82 Development Services Land Development Review 7 56 3 54 3 42 9 54 9 117 7 77 7 49 0 0 3 24 7 42 515 515 5 83 Engineering & Capital Projects Architectural Engineering & Parks 7 56 5 90 0 0 9 54 9 117 5 55 9 63 0 0 3 24 9 54 513 513 5 84 Parks & Recreation Environmental Growth 1/3 0 0 3 54 5 70 9 54 7 91 5 55 9 63 3 27 5 40 9 54 508 508 5 Page 22 City of San Diego Attachment C Citywide Risk Assessment FY 2022 See Footnotes for explanations of columns [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] Ln # Department Activity Group Wt FTEs Wt Exp Wt Rev Wt ExP Wt MC Wt InOp Wt Pub Wt Csh Wt Met Wt Regs Risk Score Adjustments Adjusted Risk Score Rank 10ths 85 Commission on Police Practices 0 0 3 54 0 0 7 42 5 65 5 55 9 63 0 0 9 72 9 54 405 101.3 506 5 86 Cultural Affairs 0 0 3 54 0 0 9 54 9 117 7 77 7 49 0 0 3 24 5 30 405 101.3 506 5 87 City Treasurer City Treas and Suppt 3 24 3 54 0 0 7 42 7 91 7 77 5 35 3 27 3 24 5 30 404 101.0 505 5 88 Purchasing & Contracting Purchasing & Contracting 5 40 5 90 0 0 9 54 7 91 9 99 7 49 3 27 3 24 5 30 504 504 5 89 Purchasing & Contracting Publishing Services 0 0 3 54 3 42 0 0 7 91 9 99 5 35 3 27 3 24 5 30 402 100.5 503 5 90 Department of Information Technology Wireless Technology Services 5 40 5 90 5 70 3 18 3 39 9 99 9 63 3 27 0 0 9 54 500 500 5 91 Fleet Operations Fleet Administration 5 40 5 90 7 98 0 0 7 91 9 99 3 21 0 0 5 40 3 18 497 497 5 92 Public Utilities Finance & Budget 5 40 5 90 0 0 5 30 7 91 9 99 9 63 3 27 0 0 9 54 494 494 5 93 Public Utilities Innovation & Technology 5 40 5 90 0 0 5 30 7 91 9 99 9 63 3 27 0 0 9 54 494 494 5 94 Engineering & Capital Projects Capital Asset Management 7 56 5 90 0 0 5 30 9 117 5 55 9 63 0 0 3 24 9 54 489 489 5 95 City Treasurer Parking Administration 3 24 3 54 0 0 9 54 5 65 5 55 9 63 5 45 0 0 5 30 390 97.5 488 5 96 Human Resources 5 40 3 54 3 42 3 18 9 117 9 99 9 63 0 0 0 0 9 54 487 487 4 97 Fire-Rescue Emergency Medical Services-Fire 0 0 0 0 5 70 9 54 9 117 9 99 9 63 3 27 0 0 9 54 484 484 4 98 Parks & Recreation Administrative Services 3 24 3 54 3 42 9 54 7 91 5 55 7 49 3 27 5 40 7 42 478 478 4 99 Fire-Rescue Community Risk Reduction 5 40 5 90 3 42 9 54 7 91 5 55 9 63 0 0 0 0 7 42 477 477 4 100 Risk Management Workers' Compensation 5 40 3 54 0 0 0 0 9 117 7 77 5 35 3 27 0 0 5 30 380 95.0 475 4 101 Debt Management 3 24 3 54 3 42 5 30 9 117 7 77 7 49 3 27 3 24 5 30 474 474 4 102 City Treasurer Investments 0 0 3 54 0 0 5 30 7 91 9 99 9 63 0 0 0 0 7 42 379 94.8 474 4 103 Department of Finance Department of Finance 0 0 3 54 3 42 5 30 9 117 9 99 9 63 0 0 3 24 7 42 471 471 4 104 Economic Development Business Expansion, Attraction & Retention 3 24 5 90 3 42 7 42 9 117 7 77 5 35 0 0 3 24 3 18 469 469 4 105 Development Services Code Enforcement 5 40 3 54 3 42 9 54 9 117 5 55 7 49 0 0 3 24 5 30 465 465 4 106 City Treasurer Delinquent Accounts 5 40 3 54 3 42 9 54 7 91 9 99 3 21 5 45 0 0 3 18 464 464 4 107 Personnel Recruiting & Exam Management 3 24 3 54 0 0 9 54 9 117 9 99 5 35 3 27 3 24 5 30 464 464 4 108 Public Utilities Employee Services & Quality Assurance 7 56 5 90 0 0 7 42 7 91 7 77 7 49 3 27 0 0 5 30 462 462 4 109 Stadium Operations 0 0 3 54 0 0 9 54 5 65 7 77 5 35 3 27 3 24 5 30 366 91.5 458 4 110 Economic Development Community Development 3 24 3 54 3 42 7 42 9 117 7 77 5 35 0 0 3 24 7 42 457 457 4 111 Economic Development Economic Development 3 24 3 54 3 42 7 42 9 117 7 77 5 35 0 0 3 24 7 42 457 457 4 112 Engineering & Capital Projects Contracting 5 40 3 54 5 70 3 18 9 117 5 55 7 49 0 0 0 0 9 54 457 457 4 113 City Treasurer Treasury Accounting 3 24 3 54 0 0 7 42 7 91 9 99 5 35 0 0 0 0 3 18 363 90.8 454 3 114 Sustainability 5 40 3 54 5 70 7 42 7 91 5 55 5 35 0 0 3 24 7 42 453 453 3 115 City Attorney Family Justice Center 0 0 3 54 0 0 9 54 7 91 5 55 9 63 0 0 3 24 3 18 359 89.8 449 3 116 Special Promotional Programs Discretionary Funding 0 0 5 90 0 0 0 0 7 91 5 55 7 49 0 0 7 56 3 18 359 89.8 449 3 117 Department of Information Technology Citywide IT Fixed Expenses 0 0 5 90 7 98 0 0 0 0 7 77 3 21 0 0 9 72 0 0 358 89.5 448 3 118 Department of Finance External Financial Reporting 5 40 3 54 0 0 5 30 9 117 7 77 9 63 0 0 3 24 7 42 447 447 3 119 Office of Compliance & Labor Standards 3 24 3 54 0 0 7 42 7 91 5 55 5 35 0 0 3 24 5 30 355 88.8 444 3 120 Department of Finance Internal Financial Reporting 5 40 3 54 0 0 5 30 9 117 9 99 7 49 0 0 3 24 5 30 443 443 3 121 Fire-Rescue Special Operations 5 40 5 90 3 42 7 42 7 91 3 33 9 63 0 0 0 0 7 42 443 443 3 122 Personnel Classification & Liaison 5 40 3 54 0 0 7 42 9 117 9 99 5 35 0 0 3 24 5 30 441 441 3 123 Office of Race & Equity 0 0 3 54 0 0 3 18 5 65 5 55 7 49 0 0 9 72 5 30 343 85.8 429 3 124 Department of Finance Financial Planning & CIP 5 40 3 54 0 0 5 30 9 117 7 77 7 49 0 0 3 24 5 30 421 421 3 125 Risk Management Public Liability & Loss Recovery 3 24 3 54 0 0 9 54 9 117 7 77 7 49 3 27 0 0 3 18 420 420 3 126 Homelessness Strategies 3 24 5 90 3 42 5 30 5 65 7 77 7 49 0 0 0 0 7 42 419 419 3 127 City Treasurer Parking Meter Transfers 0 0 3 54 0 0 3 18 5 65 7 77 7 49 3 27 3 24 3 18 332 83.0 415 3 Page 23 City of San Diego Attachment C Citywide Risk Assessment FY 2022 See Footnotes for explanations of columns [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] Ln # Department Activity Group Wt FTEs Wt Exp Wt Rev Wt ExP Wt MC Wt InOp Wt Pub Wt Csh Wt Met Wt Regs Risk Score Adjustments Adjusted Risk Score Rank 10ths 128 Fire-Rescue Logistics 3 24 3 54 0 0 7 42 7 91 5 55 7 49 0 0 7 56 7 42 413 413 3 129 Personnel Personnel Management 3 24 3 54 0 0 5 30 9 117 9 99 5 35 0 0 3 24 5 30 413 413 2 130 Government Affairs 0 0 3 54 0 0 3 18 9 117 7 77 3 21 0 0 3 24 3 18 329 82.3 411 2 131 Concourse & Parking Garage 0 0 3 54 3 42 5 30 5 65 3 33 5 35 3 27 3 24 3 18 328 82.0 410 2 132 Risk Management Employee Benefits 0 0 3 54 0 0 0 0 9 117 7 77 3 21 3 27 0 0 5 30 326 81.5 408 2 133 Fire-Rescue Fire-Rescue 0 0 3 54 0 0 9 54 9 117 7 77 9 63 0 0 0 0 7 42 407 407 2 134 Special Events & Filming 0 0 3 54 0 0 9 54 9 117 7 77 7 49 0 0 3 24 5 30 405 405 2 135 Economic Development BID & Commercial MAD 0 0 3 54 3 42 7 42 5 65 3 33 9 63 3 27 7 56 3 18 400 400 2 136 Office of Homeland Security 3 24 3 54 3 42 3 18 5 65 5 55 7 49 3 27 3 24 5 30 388 388 2 137 Library Library Administration 3 24 3 54 0 0 7 42 9 117 5 55 7 49 3 27 0 0 3 18 386 386 2 138 Parks & Recreation Los Penasquitos Reserve 0 0 0 0 0 0 9 54 7 91 5 55 9 63 3 27 5 40 9 54 384 384 2 139 Major Revenues 0 0 0 0 9 126 3 18 7 91 5 55 9 63 0 0 0 0 5 30 383 383 2 140 Special Promotional Programs Arts, Culture, & Community Festivals 0 0 3 54 0 0 3 18 3 39 5 55 7 49 0 0 9 72 3 18 305 76.3 381 2 141 Communications 5 40 3 54 0 0 9 54 7 91 5 55 5 35 3 27 3 24 0 0 380 380 2 142 Development Services Information Technology 3 24 3 54 0 0 9 54 9 117 0 0 7 49 3 27 3 24 5 30 379 379 2 143 Performance & Analytics 3 24 3 54 0 0 3 18 7 91 7 77 3 21 0 0 0 0 3 18 303 75.8 379 2 144 Purchasing & Contracting Equal Opportunity Contracting 3 24 0 0 0 0 9 54 7 91 9 99 7 49 0 0 3 24 5 30 371 371 2 145 Risk Management Safety & Environmental 0 0 0 0 0 0 3 18 9 117 9 99 3 21 0 0 0 0 5 30 285 71.3 356 1 146 Citywide Program Expenditures 0 0 9 162 0 0 0 0 5 65 5 55 0 0 0 0 7 56 3 18 356 356 1 147 Development Services Administration & Support Services 0 0 3 54 0 0 9 54 9 117 0 0 7 49 3 27 3 24 5 30 355 355 1 148 Engineering & Capital Projects Engineering & Capital Projects 0 0 0 0 0 0 7 42 9 117 7 77 7 49 0 0 3 24 7 42 351 351 1 149 Department of Information Technology IT Contract Management 0 0 3 54 3 42 3 18 7 91 7 77 5 35 0 0 0 0 5 30 347 347 1 150 City Treasurer Revenue Audit 3 24 3 54 0 0 7 42 5 65 3 33 5 35 0 0 0 0 3 18 271 67.8 339 1 151 Office of Boards & Commissions 0 0 0 0 0 0 9 54 9 117 7 77 3 21 0 0 3 24 5 30 323 323 1 152 Department of Information Technology Enterprise IT Sourcing Operations 0 0 0 0 0 0 3 18 7 91 9 99 7 49 3 27 0 0 5 30 314 314 1 153 Airports 3 24 3 54 5 70 5 30 3 39 0 0 3 21 3 27 0 0 5 30 295 295 1 154 Special Promotional Programs Economic Development 0 0 0 0 0 0 0 0 3 39 3 33 7 49 0 0 9 72 3 18 211 52.8 264 1 155 City Treasurer Minimum Wage 0 0 0 0 0 0 9 54 3 39 0 0 7 49 0 0 3 24 5 30 196 49.0 245 1 156 City Treasurer Community Parking Districts Admin 0 0 0 0 0 0 3 18 3 39 7 77 5 35 0 0 3 24 3 18 211 211 1 157 Parks & Recreation Parks & Recreation 0 0 0 0 0 0 0 0 3 39 3 33 0 0 3 27 0 0 3 18 117 117 1 158 Purchasing & Contracting Purchasing & Contracting Mgmt 0 0 0 0 0 0 0 0 3 39 3 33 0 0 3 27 0 0 3 18 117 117 1 Note: Individual City Council Offices were not surveyed due to a conflict of interest, since the Office of the City Auditor reports directly to the Audit Committee of the City Council [1] FTE- Risk score associated with the number of budgeted full time employees (FTE). See Exhibit A- Management Questionnaire, question number 8. [2] Wt FTE- A weight (wt) of 8 was multiplied by the FTE risk score. See Exhibit B- Calculation of Weights Used for Risk Factors, line number 8. [3] Exp- Risk score associated with the amount of budgeted expenditures (Exp). See Exhibit A- Management Questionnaire, question number 10. [4] Wt Exp- A weight (wt) of 18 was multiplied by the Exp risk score. See Exhibit B- Calculation of Weights Used for Risk Factors, line number 10. [5] Rev- Risk score associated with the amount of budgeted revenue (Rev). See Exhibit A- Management Questionnaire, question number 9. [6] Wt Rev- A weight (wt) of 14 was multiplied by the Rev risk score. See Exhibit B- Calculation of Weights Used for Risk Factors, line number 9. [7] ExP- Risk score associated with Interface with the external public (ExP). See Exhibit A- Management Questionnaire, question number 1. [8] Wt ExP- A weight (wt) of 6 was multiplied by the ExP risk score. See Exhibit B- Calculation of Weights Used for Risk Factors, line number 1. Footnotes: Page 24 City of San Diego Attachment C Citywide Risk Assessment FY 2022 See Footnotes for explanations of columns [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] Ln # Department Activity Group Wt FTEs Wt Exp Wt Rev Wt ExP Wt MC Wt InOp Wt Pub Wt Csh Wt Met Wt Regs Risk Score Adjustments Adjusted Risk Score Rank 10ths [9] MC- Risk score associated with the "Mission Critical" activities (MC). See Exhibit A- Management Questionnaire, question number 2. [10] Wt MC- A weight (wt) of 13 was multiplied by the MC risk score. See Exhibit B- Calculation of Weights Used for Risk Factors, line number 2. [11] InOp- Risk score associated with the Internal Operations (InOp). See Exhibit A- Management Questionnaire, question number 3. [12] Wt InOp- A weight (wt) of 11 was multiplied by the InOp risk score. See Exhibit B- Calculation of Weights Used for Risk Factors, line number 3. [13] Pub- Risk score associated with public (Pub) exposure and interest. See Exhibit A- Management Questionnaire, question number 4. [14] Wt Pub- A weight (wt) of 7 was multiplied by the Pub risk score. See Exhibit B- Calculation of Weights Used for Risk Factors, line number 4. [15] Csh- Risk score associated with Cash or cash convertible (Csh). See Exhibit A- Management Questionnaire, question number 5. [16] Wt Csh- A weight (wt) of 9 was multiplied by the Csh risk score. See Exhibit B- Calculation of Weights Used for Risk Factors, line number 5. [17] Met- Risk score associated with Performance/Metrics (Met). See Exhibit A- Management Questionnaire, question number 6. [18] Wt Met- A weight (wt) of 8 was multiplied by the Met risk score. See Exhibit B- Calculation of Weights Used for Risk Factors, line number 6. [19] Regs- Risk score associated with compliance with laws and regulations (Regs). See Exhibit A- Management Questionnaire, question number 7. [20] Wt Regs- A weight (wt) of 6 was multiplied by the Regs risk score. See Exhibit B- Calculation of Weights Used for Risk Factors, line number 7. [21] Risk Score- This is the total risk score calculated by adding together all of the nine weighted risk scores. [22] Adjustment for areas never being audited or not audited within the last 5 years. [23] Adjusted Risk Score- This is the total adjusted risk score calculated adjusting [21] as appropriate. [24] Rank 10ths- The activity groups were divided into tenths. Rank 10, 9, 8 (High Risk) 7, 6, 5, 4 (Medium Risk) 3, 2, 1 (Low Risk). Page 25 Fiscal Year 2022 Mission Statement Introduction Audit Resources PERFORMANCE AUDITS FY 2022 CARRY OVER FROM FY 2021 AUDIT WORK PLAN PERFORMANCE AUDITS FY 2022 CARRY OVER FROM FY 2021 AUDIT WORK PLAN PERFORMANCE AUDITS FY 2022 PROPOSED AUDITS ADDITIONAL AUDIT ACTIVITIES FY 2022 Calculation of Estimated Audit Hours Available for FY 2022 Audit Work Plan Fiscal Year 2022 Attachment A Office of the City Auditor Annual Risk Assessment Management Questionnaire