Toronto Transit Commission - Audit, Finance and Risk Management Committee
The full agenda, as filed
All 6 items in the clerk’s order. Each carries the city’s own words: the staff recommendation, what the body decided, and its status. Nothing below is written by us.
TTA1.1amended
Audit of the Toronto Transit Commission’s Non-Union Workforce Planning and Management
The Auditor General's 2024 Work Plan included an audit to assess the Toronto Transit Commission's (TTC's) workforce planning and management processes. Workforce planning and management, including succession planning, are critical to ensure the TTC's non-union workforce meets its operational requirements to support providing public transit services to the City of Toronto. In 2024, the TTC had a total average workforce of 16,300 full-time employees, comprised of 12,300 unionized (75 per cent) and 4,000 non-unionized employees (25 per cent). The scope of this audit was on the TTC's non-union workforce. An audit may be done in the future on the TTC's unionized workforce and is currently included in the backlog listing of the Auditor General's 2025 Work Plan. Between 2019 and 2023, there were an average of 100 retirements per year. Looking forward, 15 per cent of the TTC's non-union staff will be eligible for retirement by the end of 2025, a number that increases to 21 per cent by the end of 2027. Thus, approximately 1 in 5 non-union employees will be eligible for retirement in just over two years. This trend is consistent with general demographic trends in the Canadian working population. Furthermore, over the last few years, the TTC has experienced increasing challenges in attracting and retaining non-union talent due to increased labour competition in the transit industry. From January 2019 to December 2023, over 600 non-union employees voluntarily left the TTC (this figure includes resignations and excludes retirements), with the majority resigning between 2022 and 2023. Our report draws attention to opportunities for the Toronto Transit Commission to improve its workforce planning and management processes, by: A. Enhancing Workforce Planning, including Succession Planning, and Monitoring of Human Resource Related Key Performance Indicators B. Strengthening the Policy for Rehiring Pensioners C. Strengthening Monitoring of Employee Feedback and Engagement D. Improving the Process for Managing, Tracking, and Addressing Employee Concerns and Complaints
The Toronto Transit Commission - Audit & Risk Management Committee: 1. Requested that the Board request the Chief Executive Officer, Toronto Transit Commission, to conduct a review of best practices and determine appropriate human resource Key Performance Indicators (KPIs) and metrics, along with definitions and targets, and formalize the process/system to regularly monitor and report on these KPIs to senior management. 2. Requested that the request the Chief Executive Officer, Toronto Transit Commission, to develop and implement a corporate-wide succession planning program. 3. Requested that the Board request the Chief Executive Officer, Toronto Transit Commission (TTC), to strengthen the retirement policy and process and consider incorporating the following: a. a requirement for notice (written, at a minimum) to the employee's supervisor, Department head, and the TTC's People and Culture Group; b. a minimum retirement notification period requirement; and c. timely initiation of successor hiring and knowledge transfer after retirement notice is received. 4. Requested that the Board request the Chief Executive Officer, Toronto Transit Commission, to strengthen its rehired pensioner policy by: a. finalizing and obtaining approval of only one rehired pensioner policy and communicating the new policy to the organization; b. including restrictive measures to limit, minimize and/or prevent rehiring pensioners and their length of re-employment; c. including clear guidance as to when open and transparent job competitions are required; d. revisiting the need, including cost and benefit, for rehired pensioner pay premiums; and e. incorporating measures and processes for enhanced monitoring and increased accountability requirements from the operating department and their rehired pensioner(s) to achieve the goals they intended to complete during the contracted term initially requested, especially when considering contract extension requests. 5. Requested that the Board request the Toronto Transit Commission to regularly collect feedback from employees through engagement surveys and exit interviews and surveys, analyze the results, and take actions to address concerns, especially those that are impacting employee retention. 6. Requested that the Board request the Toronto Transit Commission to update current policies and procedures to ensure clear roles and responsibilities for each investigative unit and other involved personnel including management, Employee Relations, and Human Resources, and communicate this information to employees. 7. Requested that the Board request the Chief Executive Officer, Toronto Transit Commission, to develop a formalized process for: a. tracking complaints referred between investigative units; b. tracking complaints submitted directly to management from employees or referred to management from investigative units; and c. calculating and monitoring timeliness of complaint investigation and resolution (from initial submission to final closure). 8. Requested that the Board forward this report to City Council for information through the City's Audit Committee. 9. That staff report to the April 16, 2025 TTC Board meeting with an implementation schedule for the recommendations from the Auditor General's Non-Union Workforce Planning and Management report.
Staff recommendation as filed
The Auditor General recommends that: 1. The Board request the Chief Executive Officer, Toronto Transit Commission, to conduct a review of best practices and determine appropriate human resource Key Performance Indicators (KPIs) and metrics, along with definitions and targets, and formalize the process/system to regularly monitor and report on these KPIs to senior management. 2. The Board request the Chief Executive Officer, Toronto Transit Commission, to develop and implement a corporate-wide succession planning program. 3. The Board request the Chief Executive Officer, Toronto Transit Commission (TTC), to strengthen the retirement policy and process and consider incorporating the following: a. a requirement for notice (written, at a minimum) to the employee's supervisor, Department head, and the TTC's People and Culture Group; b. a minimum retirement notification period requirement; and c. timely initiation of successor hiring and knowledge transfer after retirement notice is received. 4. The Board request the Chief Executive Officer, Toronto Transit Commission, to strengthen its rehired pensioner policy by: a. finalizing and obtaining approval of only one rehired pensioner policy and communicating the new policy to the organization; b. including restrictive measures to limit, minimize and/or prevent rehiring pensioners and their length of re-employment; c. including clear guidance as to when open and transparent job competitions are required; d. revisiting the need, including cost and benefit, for rehired pensioner pay premiums; and e. incorporating measures and processes for enhanced monitoring and increased accountability requirements from the operating department and their rehired pensioner(s) to achieve the goals they intended to complete during the contracted term initially requested, especially when considering contract extension requests. 5. The Board request the Toronto Transit Commission to regularly collect feedback from employees through engagement surveys and exit interviews and surveys, analyze the results, and take actions to address concerns, especially those that are impacting employee retention. 6. The Board request the Toronto Transit Commission to update current policies and procedures to ensure clear roles and responsibilities for each investigative unit and other involved personnel including management, Employee Relations, and Human Resources, and communicate this information to employees. 7. The Board request the Chief Executive Officer, Toronto Transit Commission, to develop a formalized process for: a. tracking complaints referred between investigative units; b. tracking complaints submitted directly to management from employees or referred to management from investigative units; and c. calculating and monitoring timeliness of complaint investigation and resolution (from initial submission to final closure). 8. The Board forward this report to City Council for information through the City's Audit Committee.
TTA1.2adopted
Executive Compliance Certificates - CEO Submission (2024)
The Audit & Risk Management Committee (ARMC) Terms of Reference establishes the ARMC as having oversight responsibility for compliance with laws and regulations. As such, it is the responsibility of the TTC CEO and ARMC to maintain the public's trust by demonstrating transparency and accountability over legal compliance to reduce the risk of liability to the organization, its employees, officers, and directors. To support the ARMC in fulfilling its governance responsibilities over legal compliance, the Audit, Risk and Compliance Department (ARC) collaborated with the Legal Department to provide the CEO and ARMC a mechanism for demonstrating Executive accountability for compliance with statutes and by-laws through formal compliance assertion reporting. As such, the Executive Compliance Certificate (ECC) was implemented in October 2020 and identifies statutes that have an organization-wide impact, and which represent sources of significant responsibility for the TTC. By completing the ECC, Executives identify any non-compliance matters arising during the period of assertion not already reported through an existing policy, procedure, or process. They may also highlight any areas they believe would benefit from further assessment and possible procedural improvements. ARC's role is to initiate discussions on reported matters with the purpose of facilitating the development and completion of comprehensive Management Action Plans (MAPs). All TTC Executive members completed their Certificates for the period covering January 1, 2024 to December 31, 2024. Each Executive reported that they had exercised due diligence to meet the obligations set out in the statutes, regulations, and by-laws by ensuring that appropriate policies, procedures, and processes are in place to govern compliance and report non-compliance issues. This report summarizes the results and insights derived from ARC and the TTC General Counsel's review of signed 2024 ECCs and provides an overview of the various ECC-related enhancements and education activities conducted throughout 2024.
The TTC Audit & Risk Management Committee: 1. Received this report for information.
Staff recommendation as filed
It is recommended that the TTC Audit & Risk Management Committee: 1. Receive this report for information.
TTA1.3adopted
Audit, Risk and Compliance - 2024 Audit Plan Status Update
The Audit, Risk and Compliance Department (ARC) 2024 Audit Plan was presented and approved by the Audit & Risk Management Committee (ARMC) on November 14, 2023. The list of audit assurance projects identified for completion in 2024 is performed in addition to advisory and special requests subsequently put forward for ARC's consideration. As of the date of this update, final reports have been issued for three 2024 projects. ARC has also essentially completed fieldwork and is progressing through the reporting phase for two other 2024 projects. This report provides information with respect to ARC's progress on 2024 Audit Plan items, as well as details of the one final report issued since ARC's last update.
The Audit & Risk Management Committee: 1. Received this report for information; and 2. Received the Confidential Attachment and authorized that the information contained in the Confidential Attachment remain confidential as it relates to the security of the property of the municipality or local board.
Staff recommendation as filed
It is recommended that the Audit & Risk Management Committee: 1. Receive this report for information; and 2. Receive the Confidential Attachment and authorize that the information contained in the Confidential Attachment remain confidential as it relates to the security of the property of the municipality or local board.
TTA1.4adopted
Audit, Risk and Compliance - 2025 Enterprise Risk Management Update
The Audit, Risk and Compliance Department (ARC) has been tasked with facilitating the maturity of the Enterprise Risk Management (ERM) Program at the TTC and provides this report to the Audit & Risk Management Committee (ARMC) to share information on the status of the ERM Program and to facilitate risk owners to report on their Key Enterprise Risks. In summary, this report provides an overview of the following items: - ERM Framework Review: The ERM Framework was approved by the ARMC on March 19, 2024, and sets out roles and responsibilities, including the responsibility of the ARMC to annually review and approve any further changes to the ERM Framework. In response to consultant recommendations to align the ERM Program with industry best practice, ARC has added a Vision Statement to the ERM Framework to articulate the vision and guiding principles of the ERM Program. No further changes are being proposed except for this addition. - 2025 ERM Roadmap: This report provides the details of ARC's annual roadmap so that deliverables are highlighted early in the year. Systematically evaluating progress against annual goals ensures adequate progress and allows for refinement of actions, if necessary, to adapt to any changing priorities or emerging threats in the business environment. - ERM Multi-Year Maturity Roadmap: A comprehensive roadmap outlining all planned activities necessary to develop and sustain a mature ERM Program is provided within this report. The Roadmap is based on consultant recommendations for implementation and is aligned with best practices. Based on these recommendations, the ERM Multi-Year Maturity Roadmap identifies short-, medium- and long-term actions across a five-year period that are required to bring the TTC's ERM Program to a desired level of maturity. It provides a holistic view of the program's planned ERM evolution. - Risk on a Page Summary Reports: ARC has facilitated the completion of Risk on a Page Summary Reports for all 10 Key Enterprise Risks, which will allow for tracking and monitoring of progress on identified action plans to achieve desired control capability targets. In 2025, ARC will update all Risk on a Page Summary Reports to address feedback provided by Executive risk owners, including the addition of information regarding current control activities. Key Enterprise Risks 1. Capital Funding Requirements 6. Disruption 2. Cybersecurity 7. Governance and Decision-Making 3. Recruitment and Retention 8. Strategy Development and Execution 4. Financial Sustainability 9. Third Party Vendor 5. Public Safety and Transit Security 10. Worker and Customer Safety - Risk on a Page Summary Report Presentation by Risk Owners: ARC designed the Risk on a Page Summary Report template to assist management in providing a high-level overview of their risks, risk response strategies, and current state.
The Audit & Risk Management Committee: 1. Approved changes to the TTC's Enterprise Risk Management Framework. 2. Received the confidential information and authorized that the information remain confidential in its entirety as it contains information about the security of the property of the TTC.
Staff recommendation as filed
It is recommended that the Audit & Risk Management Committee: 1. Approve changes to the TTC's Enterprise Risk Management Framework. 2. Receive the confidential information and authorize that the information remain confidential in its entirety as it contains information about the security of the property of the TTC.
TTA1.5adopted
Audit, Risk, and Compliance - 2025 Audit Plan and Departmental Evaluation
ARC Audit Plan The Audit, Risk, and Compliance (ARC) Audit Plan outlines the reviews and nature of internal audit work that ARC intends to conduct in 2025. By focusing ARC internal audit resources on key areas, we aim to maximize benefits for the TTC, such as enhancing operational efficiency, ensuring regulatory compliance, and providing valuable insights for informed decision-making. ARC takes into consideration a variety of inputs to identify planned audit work for the year. These inputs include: • Interaction and discussion with Executive Management and select Senior Management; • Interaction and discussion with the External Auditor; • Interaction and discussion with the Audit & Risk Management Committee (ARMC); • An audit universe risk assessment; • Enterprise risks; and • External literature and news events from professional bodies and organizations. The Proposed Audit Plan for 2025 consists of four comprehensive assurance projects and four follow-up validation projects, the results of which will be reported to the ARMC as part of regular ARC Audit Plan Status Updates (see Attachment 1). This Proposed Plan is being submitted for review and approval by the Committee. ARC has also discussed with Senior Management a variety of topics and lines of inquiry that will be proactively pursued in an advisory and limited capacity for purposes of gaining insights and understanding of key risks. For example, ARC may explore lessons learned following major disruption incidents. While generally the outcome of such work would not require public reporting, if any major control gaps or significant observations are identified and warrant reporting to the ARMC, details will be provided in ARC Audit Plan Status Updates. This work will be completed in addition to any ad hoc advisory work and special requests submitted to ARC throughout the year. ARC Audit Charter An audit charter serves as a foundational document that defines the purpose, authority, and responsibility of the internal audit function, and establishes its role within the organization. It provides the TTC a blueprint for how internal audit will operate and explains the value of internal audit's independence in providing assurance and advisory services to the TTC. The ARC audit charter has been updated to reflect the organizational change for the Head of ARC to report administratively to the Deputy Chief Executive Officer, instead of to the Chief Executive Officer. The updated Audit Charter is included in Attachment 2 of this report. Independence Per the Institute of Internal Audit's (IIA) standards, there is a requirement to report any impairment(s) to independence of the internal audit function. ARC notes that there have not been any impairments to independence to report for 2024. Quality Assurance and Improvement Program (QAIP) It is mandated in the Audit Charter that ARC will maintain a QAIP. The Program covers all aspects of the ARC Internal Audit function and requires conformance with the Institute of Internal Audit's (IIA) Standards. The Program consists of continuous oversight and review of each engagement, an annual internal assessment of conformance with the Standards, and the engagement of a qualified external party to perform an assessment of the internal audit function every five years. An internal assessment was conducted in 2024, and efforts to address required enhancements are being pursued as part of continuous improvement efforts. Enhancements being planned/performed are as follows: • Conducting an external assessment of the program in 2027. • Documented a methodology to capture audit resource management and optimize the use of available resources in 2025. Complete. • Developing processes in 2025 to encourage transparency in sharing information by management and other stakeholders (such as AG) that can guide audit coverage, including results. Institute of Internal Audit (IIA) Standards Update The Standards that guide the worldwide professional practice of internal auditing and serve as a basis for evaluating and elevating the quality of an internal audit function were updated and released on January 9, 2024. The new Standards became effective on January 9, 2025. Before the effective date, we compared the new Standards with the 2017 version and noted that the updates primarily reflect the IIA's structural reorganization rather than fundamental changes to the Standards themselves. The goal of the new Standards is to make them easier to understand and use, while emphasizing certain areas that align with evolving business needs. Key highlights include: • Streamlined Framework. • New emphasis on Risks and Governance. • Enhanced Clarity in Terminology. • Focused Guidance on Emerging Risks (increased focus on areas, such as cybersecurity). ARC has already implemented certain changes to align with the emphasis of the new Standards and identified further changes as part of ongoing continuous improvement efforts. These include finalizing an internal audit strategy and following new methodologies/policies to ensure new IIA standards are met. ARC Internal Audit Strategy The new IIA Standards state that "the chief audit executive must develop and implement a strategy for the internal audit function that supports the strategic objectives and success of the organization and aligns with the expectation of the Board, Senior Management, and other key stakeholders". An internal audit strategy is a plan of action designed to achieve a long-term or overall objective. It includes a vision, strategic objectives, and supporting initiatives for the internal audit function. It also helps guide the internal audit function toward the fulfillment of the internal audit mandate. The TTC's internal audit function sets annual goals that align with its strategies. Details of ARC's Internal Audit Strategy will be reviewed with ARMC and Senior Management.
The Audit & Risk Management Committee: 1. Approved the ARC Audit Plan (2025) - attached as Attachment 1 to this report. 2. Approved the updated ARC Audit Charter - attached as Attachment 2 to this report.
Staff recommendation as filed
It is recommended that the Audit & Risk Management Committee: 1. Approve the ARC Audit Plan (2025) - attached as Attachment 1 to this report. 2. Approve the updated ARC Audit Charter - attached as Attachment 2 to this report.
TTA1.6adopted
Fare Compliance Action Plan - Update
The Audit & Risk Management Committee will receive an in-camera presentation, providing an update on the Fare Compliance Action Plan.
The Audit & Risk Management Committee: 1. Received the Confidential Attachment and authorized that the information contained in the Confidential Attachment remain confidential as it relates to the security of the property of the municipality or local board.
Staff recommendation as filed
It is recommended that the Audit & Risk Management Committee: 1. Receive the Confidential Attachment and authorize that the information contained in the Confidential Attachment remain confidential as it relates to the security of the property of the municipality or local board.