Item - 2023.AU1.4

The Audit Committee recommends that:

1. City Council direct that Confidential Attachment 1 to the Report (January 27, 2023) from the Auditor General remain confidential in its entirety, as it involves the security of property belonging to the City.

This report provides the results of our follow-up of selected recommendations conducted in the second half of 2022, and a high-level summary of outstanding recommendations for all City divisions and its agencies and corporations, as of December 30, 2022. Since inception (January 1999) to December 2022, the Auditor General has verified 80 percent of recommendations as fully implemented or no longer relevant.

As reported in the 2022 Auditor General’s work plan update[1], the Auditor General’s Office was impacted by unanticipated staff leaves, turnover, and vacancies which led to staffing and capacity constraints. This resulted in requiring our office to prioritize projects and work according to available resources, including deferring some work on the follow-up of implementation of audit recommendations. As a result, the Auditor General performed follow-up work of a select number of reports with high priority recommendations in 2022.

As of September 30, 2022, there were 704 outstanding recommendations. Management indicated that 331 of 704 recommendations were fully implemented, 5 were no longer applicable and 368 recommendations were still in progress. Figure 1 provides the length of time the 368 recommendations have been outstanding.

There will be significant work for our office to verify the outstanding recommendations reported by management as fully implemented or no longer applicable. Our office will continue to perform the follow-up work based on available resources and focus on verifying high priority recommendations first, including those recommendations that have been outstanding greater than five years and/or those with potential cost savings.

¹Auditor General's 2022 Work Plan Update and Request for Administrative Amendment to City Reserve Fund Accounts (toronto.ca)

(See Figure 1 titled "Outstanding NFI Audit Recommendations by

Age, as of September 30, 2022"),

in the Summary section of the report dated January 27, 2023 from the Auditor General

Note - Recommendations that remain open for more than 5 years are ranked as high priority for management to expedite implementation.

In this follow-up cycle, we have reviewed the status of 68 out of 331 recommendations reported by management as fully implemented from the following five divisions. The review focused mostly on information technology including cybersecurity related recommendations, with the exception of Fleet Services where recommendations were related to improving operational controls:

- Technology Services Division

- Office of the Chief Information Security Officer

- Fires Services

- Toronto Water

- Fleet Services

Of the 68 recommendations we selected for review, we determined 51 as fully implemented (FI) and 17 recommendations as not fully implemented (NFI). The NFI recommendations include 14 recommendations that are considered high priority where we believe management should expedite their implementation.

A recommendation is determined as NFI because the actions taken by management or the extent of improvements did not fully address the issue or management was not able to provide sufficient and appropriate evidence during the follow-up review.

The results of our follow-up review are summarized in Figure 2 below:

(See Figure 2 titled "Auditor General's Validation of Recommendations

Reported as Fully Implemented by Management"),

in the Summary section of the report dated January 27, 2023 from the Auditor General

The City is expected to realize $5.1 million in savings over five years as a result of management actions taken to implement the Auditor General’s report recommendations. These savings relate to a reduction in the mailing costs of employee pay statements and improvements in fleet management practices such as warranty administration that reduced vehicle repair and maintenance costs.