Audit Committee
The full agenda, as filed
All 9 items in the clerk’s order. Each carries the city’s own words: the staff recommendation, what the body decided, and its status. Nothing below is written by us.
AU7.1adopted
Auditor General’s Office 2025 Work Plan and Budget Highlights
The purpose of this report is to provide City Council with the Auditor General's 2025 Work Plan, which contains projects that are in progress or will begin in 2025, and many new projects on the horizon to commence in either late 2025 or 2026. These audit projects are identified through a City-wide risk and opportunities assessment process that is conducted every five years and updated annually for changes in emerging issues, priorities, and trends in allegations made to the Fraud and Waste Hotline. The Auditor General also considers the views and experience of City Councillors and City management. The Auditor General may amend the Annual Work Plan if new priorities arise. This report also provides the 2025 Budget Highlights for information only, as the Audit Committee considers the Auditor General's 2025 Work Plan. The Auditor General is requesting $8.651 million and this 2025 budget request will be presented directly to the Budget Committee at its meeting on January 15-17, 2025 for consideration. The Auditor General's budget request reflects resources needed to address her 2025 Work Plan. The Auditor General would like to thank the Audit Committee and City Council for their continued support of this Accountability Office, and of the important work we do. We look forward to continuing to add value to the City, make a positive difference in the lives of Torontonians through improved outcomes from our report recommendations, while taking an approach that helps to build relationships with auditees and stakeholders in a respectful manner.
The Audit Committee recommends: 1. City Council receive the Auditor General's Office 2025 Work Plan and Budget Highlights for information.
Staff recommendation as filed
The Auditor General recommends: 1. City Council receive the Auditor General's Office 2025 Work Plan and Budget Highlights for information.
AU7.2adopted
The Auditor General's 2024 Work Plan included an audit on how the City acquires and manages its applications, corporate-wide software licences, and cloud subscriptions. In 2023, the City spent $44 million on software acquisitions and $34 million on software maintenance. Over the last five years from 2019 to 2023, the City's total expenditures for software acquisition, maintenance and support were approximately $235 million. The City currently uses over 7,500 software titles; over 1,200 titles are paid software. As the City continues to automate its processes and systems, the investment in technology systems and applications will continue to grow. This audit focused on assessing whether tracking of software licences, cloud subscriptions, and maintenance is accurate, and that unused software is identified and addressed in a timely manner. The audit scope included seven selected software applications. We estimated that the cost associated with unused licences for the assessed software applications was almost $11 million. This cost is related to unused or underutilized software licences and subscriptions for various periods of time, primarily from 2020 to 2024. A summary of the cost of unused licences by software application is provided in Table 1. Table 1: Summary of the Cost of Unused Licences Software Cost of Unused Subscriptions/ Licences Cost of Licences Assigned to Former Staff or Employees on Long-Term Leave Total Cost of Unused Licences Microsoft M365 $6,896,597 $1,046,795 $7,943,392 SAP S/4 HANA $1,932,376 -- $1,932,376 SAP ECC on-premises $20,080 $296,341 $316,421 Public Digital Access (PDA) $657,177 -- $657,177 Adobe Acrobat $119,800 $14,550 $134,350 Total Cost $9,626,030 $1,357,686 $ 10,983,716 Our report identifies the following four key areas for attention: - Improvements are required for licence acquisition, management, and utilization. In particular, improved project planning and stakeholder coordination to ensure timely deployment of licences when making bulk purchases. - Former employees' licences are not terminated or not re-assigned in a timely manner. The off-boarding process needs streamlining and automation to reduce the risk of licences remaining assigned to users who leave the City or are on long-term leave. - Governance over Information Technology asset management needs to be strengthened and a clear data strategy and plan is needed to manage the City's software assets. - The City, by virtue of its size, has an opportunity to achieve greater economies of scale through more effective bulk purchasing of software, if agencies and corporations are included in the procurement.
The Audit Committee recommends that: 1. City Council request the Chief Technology Officer in consultation with the Chief Procurement Officer and the City Solicitor to: a. Evaluate whether the cost of unused software licences identified in this report can be reduced or deferred to future periods to align with changes in the deployment dates for projects that are still in progress. b. Identify other technology projects that are delayed and evaluate whether the cost of the unused software licences can be reduced or deferred to future periods to align with changes in the project rollout dates. 2. City Council request the Chief Technology Officer in consultation with the Chief Procurement Officer and the City Solicitor, to evaluate whether future software subscription contracts can include provisions to allow the City to defer the licence purchases or adjust the contracted volume of software subscriptions, in situations where: a. Projects are delayed, or b. Requirement for software subscription volume changes. 3. City Council request the Chief Technology Officer and the Chief Information Security Officer, in consultation with the Chief Procurement Officer and the City Solicitor, to evaluate whether: a. Financial compensation can be obtained for non-compliance with expected product features required under the contract. b. The cost of unused software licences can be reduced or deferred to future periods to align with changes in the project rollout dates. 4. City Council request the Chief Technology Officer to improve on the project planning and coordination for the remaining phases of implementing the Public Digital Access Solution. 5. City Council request the City Manager in coordination with the Chief Technology Officer to develop a reporting mechanism and criteria for reporting on City-wide technology projects (or projects that span across multiple divisions) to the General Government Committee of City Council by the appropriate City officials, on project implementation delays and related accumulated financial impact or costs from the delays, including unused software licences, with reports to include as a minimum: a. Accumulated financial impact of project delays, including forgone benefits b. Cost of unused software licences, and solutions c. Plans in place to mitigate the impact of delays, and d. How the expected benefits will be measured once the project or contract is fully completed. 6. City Council request the Chief Technology Officer evaluate the current email back-up procedure to: a. Finalize the related procedure and guidelines to ensure M365 licences assigned to employees who leave the City are terminated in a timely manner; and b. Terminate or re-assign, as needed, active M365 licences of former staff identified in this report. 7. City Council request the Chief People Officer and Chief Financial Officer and the Chief Technology Officer to develop an automated process for employee offboarding, including to: a. Integrate and update the employment separation checklist with the current Information Technology Service Management process to identify and disable unused accounts of employees who leave the City, in a timely manner. b. Conduct periodic automated comparisons of active licences with inactive or dormant accounts and ensure unused licences or licences assigned to former employees or employees on long-term leave are disabled or re-assigned in a timely manner, and c. Unassigned or unused licences identified in this report are re-assigned or terminated as needed. 8. City Council request the Chief Technology Officer to: a. Establish criteria to identify and select software titles that should be managed through the Information Technology Asset Management System b. Develop a data strategy and migration plan for managing the City's software licences and subscriptions c. Develop a plan to decommission the existing system, and d. Evaluate whether the existing data import process from the financial system is required for the new system and fix the data accuracy and reconciliation issues if the data are to be used. 9. City Council request the Chief Technology Officer to develop and implement a governance framework to improve ownership and accountability of the Information Technology asset management process. This should include: a. Updating policies, guidelines, and procedures on Information Technology asset management, ensuring appropriate reporting and staff roles are established to facilitate ongoing monitoring of Information Technology assets through the new system. b. Developing reports, to monitor the accuracy and completeness of data updated in the new Information Technology Asset Management system. 10. City Council request the City Manager to coordinate the work of the City's agencies and corporations with the City's Chief Procurement Officer and Chief Technology Officer to explore joint purchasing on key software programs to achieve volume discounts and savings for the City as a whole.
Staff recommendation as filed
The Auditor General recommends that: 1. City Council request the Chief Technology Officer in consultation with the Chief Procurement Officer and the City Solicitor to: a. Evaluate whether the cost of unused software licences identified in this report can be reduced or deferred to future periods to align with changes in the deployment dates for projects that are still in progress. b. Identify other technology projects that are delayed and evaluate whether the cost of the unused software licences can be reduced or deferred to future periods to align with changes in the project rollout dates. 2. City Council request the Chief Technology Officer in consultation with the Chief Procurement Officer and the City Solicitor, to evaluate whether future software subscription contracts can include provisions to allow the City to defer the licence purchases or adjust the contracted volume of software subscriptions, in situations where: a. Projects are delayed, or b. Requirement for software subscription volume changes. 3. City Council request the Chief Technology Officer and the Chief Information Security Officer, in consultation with the Chief Procurement Officer and the City Solicitor, to evaluate whether: a. Financial compensation can be obtained for non-compliance with expected product features required under the contract. b. The cost of unused software licences can be reduced or deferred to future periods to align with changes in the project rollout dates. 4. City Council request the Chief Technology Officer to improve on the project planning and coordination for the remaining phases of implementing the Public Digital Access Solution. 5. City Council request the City Manager in coordination with the Chief Technology Officer to develop a reporting mechanism and criteria for reporting on City-wide technology projects (or projects that span across multiple divisions) to the General Government Committee of City Council by the appropriate City officials, on project implementation delays and related accumulated financial impact or costs from the delays, including unused software licences, with reports to include as a minimum: a. Accumulated financial impact of project delays, including forgone benefits b. Cost of unused software licences, and solutions c. Plans in place to mitigate the impact of delays, and d. How the expected benefits will be measured once the project or contract is fully completed. 6. City Council request the Chief Technology Officer evaluate the current email back-up procedure to: a. Finalize the related procedure and guidelines to ensure M365 licences assigned to employees who leave the City are terminated in a timely manner; and b. Terminate or re-assign, as needed, active M365 licences of former staff identified in this report. 7. City Council request the Chief People Officer and Chief Financial Officer and the Chief Technology Officer to develop an automated process for employee offboarding, including to: a. Integrate and update the employment separation checklist with the current Information Technology Service Management process to identify and disable unused accounts of employees who leave the City, in a timely manner. b. Conduct periodic automated comparisons of active licences with inactive or dormant accounts and ensure unused licences or licences assigned to former employees or employees on long-term leave are disabled or re-assigned in a timely manner, and c. Unassigned or unused licences identified in this report are re-assigned or terminated as needed. 8. City Council request the Chief Technology Officer to: a. Establish criteria to identify and select software titles that should be managed through the Information Technology Asset Management System b. Develop a data strategy and migration plan for managing the City's software licences and subscriptions c. Develop a plan to decommission the existing system, and d. Evaluate whether the existing data import process from the financial system is required for the new system and fix the data accuracy and reconciliation issues if the data are to be used. 9. City Council request the Chief Technology Officer to develop and implement a governance framework to improve ownership and accountability of the Information Technology asset management process. This should include: a. Updating policies, guidelines, and procedures on Information Technology asset management, ensuring appropriate reporting and staff roles are established to facilitate ongoing monitoring of Information Technology assets through the new system. b. Developing reports, to monitor the accuracy and completeness of data updated in the new Information Technology Asset Management system. 10. City Council request the City Manager to coordinate the work of the City's agencies and corporations with the City's Chief Procurement Officer and Chief Technology Officer to explore joint purchasing on key software programs to achieve volume discounts and savings for the City as a whole.
AU7.3adopted
At its meeting on October 18, 2024, the Toronto Community Housing Corporation Board of Directors considered the attached report entitled, "Cybersecurity Audit of Toronto Community Housing and Toronto Seniors Housing Corporations - Phase Two: User Access Management and Event Logging." The Board adopted the following recommendations, as made in the report: 1. The Board adopt the confidential instructions to staff in Confidential Attachment 1 to this report from the Auditor General. 2. The Board forward this report including the Confidential Attachment 1 to City Council for information through the City's Audit Committee. 3. The Board recommend City Council authorize the public release of Confidential Attachment 1 to the report from the Auditor General at the discretion of the Auditor General, after discussions with the appropriate Toronto Community Housing Corporation, Toronto Seniors Housing Corporation, and City Officials. A copy of the Secretary's Certificate regarding this matter is attached along with the Auditor General's Report and its Confidential Attachment.
The Audit Committee recommend that: 1. City Council authorize the public release of Confidential Attachment 1 to the report (September 13, 2024) from the Auditor General at the discretion of the Auditor General, after discussions with the appropriate Toronto Community Housing Corporation, Toronto Seniors Housing Corporation, and City Officials.
Staff recommendation as filed
The Toronto Community Housing Corporation Board of Directors recommend that: 1. City Council authorize the public release of Confidential Attachment 1 to the report from the Auditor General at the discretion of the Auditor General, after discussions with the appropriate Toronto Community Housing Corporation, Toronto Seniors Housing Corporation, and City Officials.
AU7.4adopted
Status Update on the Information Technology Disaster Recovery Program
This report provides an update to the Audit Committee on the City's Enterprise Information Technology Disaster Recovery Program, as directed by 2023.AU3.7. This report provides an overview of progress made by the City of Toronto's Technology Services Enterprise Disaster Recovery Program, including business continuity and cyber major incident management, as well as the status of Information Technology disaster recovery plans from City of Toronto divisions, agencies, and corporations.
The Audit Committee recommend that: 1. City Council direct that the Confidential Attachment 1 to the report (November 25, 2024) from the Chief Technology Officer, the Chief Information Security Officer, and the Executive Director, Toronto Emergency Management, remain confidential in its entirety, as it involves the security of property of the City.
Staff recommendation as filed
The Chief Technology Officer, the Chief Information Security Officer, and the Executive Director, Toronto Emergency Management recommend that: 1. City Council direct that the Confidential Attachment 1 to this report remain confidential in its entirety, as it involves the security of property of the City.
AU7.5adopted
Audit of Parks Branch Operations - Phase 1: December 2024 Status Update
On October 7, 2024, the Auditor General released a report entitled "Audit of Parks Branch Operations - Phase 1: Improving Oversight of Day-to-Day Maintenance Helps to Ensure City Parks are Beautiful, Clean and Safe", which was considered by the Audit Committee on October 15, 2024, and City Council at its meeting on November 13 and 14, 2024. City Council subsequently adopted recommendations aimed at improving how the parks branch performs maintenance operations to keep parks clean, safe and beautiful. One such recommendation requested that Parks Forestry and Recreation report to the Audit Committee in December 2024, as well as July and November 2025 with a status update. This report provides the December 2024 update on the review and quality assurance outcomes of the Daily Activity Sheets process.
The Audit Committee recommend that: 1. City Council receive the report (November 25, 2024) from the General Manager, Parks, Forestry and Recreation for information.
Staff recommendation as filed
The General Manager, Parks, Forestry and Recreation recommends that: 1. City Council receive this report for information.
AU7.6adopted
Status Update on Enterprise Risk Management
This report provides an update on the implementation and development of the City-wide Enterprise Risk Management program, including the completion of an Enterprise Risk Management Framework that will contribute to enhancing the risk culture at the City of Toronto. The report also outlines the next phase of the Enterprise Risk Management implementation involving the communication and education / training of the Enterprise Risk Management framework across the City. Future phases will include the formal integration of risk management into the organization's strategic planning, decision making and reporting processes.
The Audit Committee: 1. Received the report (November 25, 2024) from the Director, Internal Audit for information.
Staff recommendation as filed
The Director, Internal Audit recommends that: 1. Audit Committee receive this report for information.
AU7.7received
At its meeting of June 29, 2020, in item 2020.AU5.7, City Council appointed KPMG LLP as the auditor licensed under the Public Accounting Act, 2004 responsible for annually auditing the accounts and transactions of the City and certain of its local boards and expressing an opinion on the financial statements of these bodies based on the audit. KPMG LLP submits this Management Letter for the City of Toronto with management responses for period ended December 31, 2023.
The Audit Committee: 1. Received the KPMG Management Letter including Management Responses - for the year 2023 ending December 31, 2023 (November 25, 2024) from KPMG LLP for information.
AU7.8adopted
Update on Action Plans - KPMG Management Letter Recommendations
This report responds to the direction from Council and Audit Committee arising from Item AU13.2 and AU1.8. AU13.2 - The City of Toronto Audit Findings Report for the Year Ended December 31, 2021, as adopted by City Council at its meeting on July 19, 20, 21 and 22, 2022, for the Chief Financial Officer and Treasurer to report to Council on the status of the 55 recommendations in the Management Letter (December 15, 2021) from KPMG LLP. AU1.8 - Update from the Controller on Action Plans and implementation of recommendations arising from the KPMG Audit for the Year 2020, as adopted at Audit Committee at its meeting on Feb 13, 2023, for the Controller to provide an update on each of outstanding KPMG letters recommendations.
The Audit Committee: 1. Received the report (November 21, 2024) from the Director, Internal Audit for information.
Staff recommendation as filed
The Director, Internal Audit recommend that: 1. Audit Committee receive this report for information.
AU7.9adopted
Business Improvement Areas - Update on 2023 Audited Financial Statements
The purpose of this report is to present the Audit Committee and City Council with the 2023 audited financial statements and management letters of 71 Business Improvement Areas. All of the audited financial statement included in this report received unqualified audit opinions, and have been approved by the Business Improvement Areas' respective Boards of Management (Board). One Business Improvement Area, ShoptheQueensway.com, received recommendations to strengthen internal controls and operations. These are minor in nature and have been accepted by the Business Improvement Area's management and Board (Appendix BV). There are 83 active Business Improvement Areas in the City of Toronto. The financial statements for the remaining 12 Business Improvement Areas are in the process of being finalized, and will be presented to the Audit Committee and City Council at a future date.
The Audit Committee recommend that: 1. City Council approve the 2023 audited financial statements and management letters of the Business Improvement Areas as attached in Appendices A to BY to the report (November 21, 2024) from the Chief Financial Officer and Treasurer.
Staff recommendation as filed
The Chief Financial Officer and Treasurer recommends that: 1. City Council approve the 2023 audited financial statements and management letters of the Business Improvement Areas as attached in Appendices A to BY to this report.