Item - 2025.TTA4.2

It is recommended that the Audit & Risk Management Committee:

1. Approve the ARC Audit Plan (2026) – attached as Attachment 2 to this report.

ARC Audit Plan
The Audit, Risk, and Compliance (ARC) Audit Plan outlines the reviews and nature of internal audit work that ARC intends to conduct in 2026. By focusing ARC internal audit resources on key areas, we aim to maximize benefits for the TTC, such as enhancing operational efficiency, ensuring regulatory compliance, and providing valuable insights for informed decision-making.

ARC takes into consideration a variety of inputs to identify planned audit work for the year. These inputs include:

• Interaction and discussion with Executive Management and select Senior Management;
• Interaction and discussion with the External Auditor;
• Interaction and discussion with the Audit & Risk Management Committee (ARMC);
• An audit universe risk assessment;
• Enterprise risks; and
• External literature and news events from professional bodies and organizations.

The Proposed Audit Plan for 2026 consists of four comprehensive assurance projects and four follow-up validation projects, the results of which will be reported to the ARMC as part of regular ARC Audit Plan Status Updates. This Proposed Plan (see Attachment 2) is being submitted for review and approval by the Committee.

An additional project on overtime management is being considered for inclusion in the audit plan. Analysis is being performed prior to making a final recommendation. This project or an alternative will be suggested at the next ARMC for approval.

This work will be completed in addition to any ad hoc advisory work and special requests submitted to ARC throughout the year.

ARC Audit Charter
An audit charter serves as a foundational document that defines the purpose, authority, and responsibility of the internal audit function and establishes its role within the organization.

It provides the TTC a blueprint for how internal audit will operate and explains the value of internal audit’s independence in providing assurance and advisory services to the TTC.

There is no update to the approved Audit Charter.

Independence and Objectivity
Per the new Institute of Internal Audit (IIA) standards, the internal audit function must be positioned within the organization to ensure independence and objectivity. The function must report functionally to the Board and administratively to Senior Management. There is a requirement to report any impairment(s) to the independence of the internal audit function. ARC notes that there have not been any impairments to independence to date for 2025.

Quality Assurance and Improvement Program (QAIP)
It is mandated in the Audit Charter that ARC will maintain a QAIP. The program covers all aspects of the ARC Internal Audit function and requires conformance with the Institute of Internal Audit (IIA)’s Standards.

The program consists of continuous oversight and review of each engagement, an annual internal assessment of conformance with the Standards, and the engagement of a qualified external party to perform an assessment of the internal audit function every five years.

An internal assessment is currently underway to identify opportunities for improvement. The findings will be reported at the next ARMC meeting.

The implementation of the 2026 ARC Audit Plan noted here does not require any additional funding and is substantially consistent with the approved 2025 Operating Budget. However, the inability to hire for open roles may impact the delivery of this plan.

The Interim Chief Financial Officer has reviewed this report and agrees with the financial impact information.