Item - 2026.EP22.1

The Board of Governors of Exhibition Place:

1. Adopted the Confidential Recommendations in Confidential Attachment 1 to the report (March 25, 2026) from the Auditor General.

2. Subject to City Council approval, directed that Confidential Attachment 1 to the report (March 25, 2026) from the Auditor General be released at the discretion of the Auditor General, after discussions with the appropriate Exhibition Place and City officials.

3. Directed the Confidential Attachment 2 to the report (March 25, 2026) from the Auditor General remain confidential in its entirety, as it pertains to the security of the property of the City of Toronto or one of its agencies and corporations.

4. Forwarded this report and Confidential Attachment 1 to the report (March 25, 2026) from the Auditor General to City Council for information through the City's Audit Committee.

5. Recommends that City Council authorize the public release of Confidential Attachment 1 to the report (March 25, 2026) from the Auditor General at the discretion of the Auditor General, after discussions with the appropriate Exhibition Place and City officials.

The Board of Governors of Exhibition Place recessed its public meeting to meet in closed session to consider the item as it involves the security of the property of the City of Toronto or one of its agencies and corporations.

The Auditor General included a cybersecurity audit of Exhibition Place, an agency of the City of Toronto, in her 2025 Work Plan. Exhibition Place is Canada’s largest convention centre and entertainment and sports venue, generating $595 million^[1] in economic impact annually and $67.3 million in revenue in 2024.

Phase One of this cybersecurity audit was presented at Exhibition Place’s December 5, 2025, Board meeting. The Auditor General’s Phase One confidential report included results from testing physical security, user access management, and staff awareness of social engineering in relation to cybersecurity. The Phase One public cover report is available at:

Cybersecurity Audit of Exhibition Place – Phase One: Physical Security, User Access Management and Staff Training

Technology plays a vital role in all aspects of Exhibition Place's operations and services. This Phase Two report includes the results of our vulnerability assessment and penetration testing of the Exhibition Place’s network, systems, applications and devices, as well as cybersecurity incident logging and monitoring review.

This report includes five administrative recommendations. The confidential findings and recommendations are contained in Confidential Attachment 1 to this report. A separate, confidential and detailed technical report was provided to management with technical details to guide them in addressing the report findings and recommendations.

Management agrees with the recommendations contained in the Confidential Attachment 1, which also includes management's response.

^[1] Budget TO 2026 Budget Notes Exhibition Place