Audit, Risk and Compliance - 2026 Audit Plan and Departmental Evaluation

These inputs include: Interaction and discussion with Executive Management and select Senior Management; Interaction and discussion with the External Auditor; Interaction and discussion with the Audit & Risk Management Committee (ARMC); An audit universe risk assessment; Enterprise risks; and External literature and news events from professional bodies and organizations. The Proposed Audit Plan for 2026 consists of four comprehensive assurance projects and four follow-up validation projects, the results of which will be reported to the ARMC as part of regular ARC Audit Plan Status Updates. This Proposed Plan (see Attachment 2) is being submitted for review and approval by the Committee. An additional project on overtime management is being considered for inclusion in the audit plan. Analysis is being performed prior to making a final recommendation. This project or an alternative will be suggested at the next ARMC for approval. This work will be completed in addition to any ad hoc advisory work and special requests submitted to ARC throughout the year. ARC Audit Charter An audit charter serves as a foundational document that defines the purpose, authority, and responsibility of the internal audit function and establishes its role within the organization. It provides the TTC a blueprint for how internal audit will operate and explains the value of internal audit's independence in providing assurance and advisory services to the TTC. There is no update to the approved Audit Charter. Independence and Objectivity Per the new Institute of Internal Audit (IIA) standards, the internal audit function must be positioned within the organization to ensure independence and objectivity. The function must report functionally to the Board and administratively to Senior Management. There is a requirement to report any impairment(s) to the independence of the internal audit function. ARC notes that there have not been any impairments to independence to date for 2025. Quality Assurance and Improvement Program (QAIP) It is mandated in the Audit Charter that ARC will maintain a QAIP. The program covers all aspects of the ARC Internal Audit function and requires conformance with the Institute of Internal Audit (IIA)'s Standards. The program consists of continuous oversight and review of each engagement, an annual internal assessment of conformance with the Standards, and the engagement of a qualified external party to perform an assessment of the internal audit function every five years. An internal assessment is currently underway to identify opportunities for improvement. The findings will be reported at the next ARMC meeting.