[0:18] Good afternoon Mustafa, can you hear us.

[0:29] Yes, I can hear you guys, thank you. Perfect confirming,

[0:33] we can see your video as well. Thank you. I

[0:36] can see the video of all of this. Thank you.

[3:05] Sound check. Good afternoon councillor for centre taking you here

[3:11] us. I can five by five.

[3:21] Did you want to test your video today. No thank

[3:26] you. Thank you.

[5:49] Good afternoon everyone. I'll call the meeting to order. This

[5:52] is our audit and RISC Committee at the region appeal

[5:55] September 3rd if you can believe it is September. So

[5:58] I'll call the meeting to order and ask if there

[6:00] are any declarations of conflict of interests. Not seeing any,

[6:05] thank you. For the approval of the agenda, we're going

[6:08] to make a couple of shuffles around here. So we

[6:11] are going to maybe go close session first because I

[6:13] know member Emmerick has an issue deal with enclosed session.

[6:19] We're also going to bump 5. 5 after 5. 2

[6:22] because it flows more naturally from our A. G. discussion.

[6:26] So with that may have an approval for the agenda,

[6:29] please. Emperor Emmerich. Our chair. Very good. So we will

[6:34] start in closed session. I will read that here. The

[6:40] agenda. The agenifer, September 3rd 2006, 2026 audit risk committee

[6:46] meeting include a closed session item regarding the committee member

[6:51] inquiry gardening information technology management, the security of the property

[6:54] of the municipality or local board to be dealt with

[6:57] under closed session item 8. 3 and two that the

[7:01] agenda for September 3rd, 2026, odd and risk committee be

[7:05] approved and amended. And we had that approval just a

[7:07] second ago. And so the closed session. Topic right here.

[7:16] Shuffling papers who shuffle agenda. Presentations. Okay. That committee proceed

[7:25] to closed session to consider the reports related to the

[7:27] following 2026 SCADA. Governance and security review, the security of

[7:35] the property of municipality board. Capital project audit management audit

[7:41] seniors health and wellness village litigation or potential litigation, including

[7:44] matters before administrative tribunals. If anything, the municipality or local

[7:47] boards. And three, the committee members inquiry regarding information technology

[7:52] management and the security of the property and municipality or

[7:54] local board. Any objections. Seeing none, I'll call that. And

[7:58] we'll move into closed session.

[1:05:43] Is there language wrong on that or just motion.

[1:06:14] Okay, and moving back into open session. So I'll ask

[1:06:19] for a motion to approve our three in - camera

[1:06:22] items, memorac, all in favor. All right. Very good. And

[1:06:28] with that, we are gonna jump into 5. 1 Auditor

[1:06:32] General Update. Welcome, welcome, Nick. Good to see ya. Happy

[1:06:37] to see you for us. And over to you. Good

[1:06:43] afternoon, everyone. Thank you for the opportunity to speak to

[1:06:47] the committee today. It's my pleasure to provide an update

[1:06:50] of my office's operations. Today, I'll be updating the committee

[1:06:56] on five areas. My recruitment and hiring, the initial audits

[1:07:00] I've selected, the progress on the new confidential fraud and

[1:07:05] waste hotline, the development of my office's website. And a

[1:07:09] quick summary of two additional reports going to committee today

[1:07:12] regarding my audit and procurement authority. At this point, I'm

[1:07:19] pleased to inform the committee that I have been able

[1:07:21] to quickly secure a full all - star roster of

[1:07:24] top talent that will enable me to hit the ground

[1:07:28] running as we begin our initial audits. On that note,

[1:07:35] upon the completion of our risk assessment across PEALS programs,

[1:07:40] services, and activities, we have selected three initial audits. The

[1:07:45] Community Investment Program, PEAL Housing Corporation State of Good Repair

[1:07:50] Program. And Capitol Project Oversight, ChangeOrder Management. These audits have

[1:07:56] been initiated and are in the planning phase where we

[1:07:59] will be determining the scope, objectives, and criteria for each

[1:08:02] audit. While these audits are being conducted, we will also

[1:08:06] be developing the offices 2027 AuditPlan. Informed by our RISC

[1:08:12] assessment. And the forthcoming confidential fraud and waste hotline. With

[1:08:19] respect to the confidential fraud and waste hotline, I'm happy

[1:08:23] to inform the committee that we have signed the contract

[1:08:25] with the vendor and are in the progress of its

[1:08:28] development. The planned launch of the hotline is targeted for

[1:08:33] this fall alongside with the offices new website. The hotline

[1:08:37] will give both the public MEAL region employees a confidential

[1:08:40] channel to report concerns. In information stemming from this confidential

[1:08:45] fraud in waste hotline, will help inform our 2027 audit

[1:08:50] work plan. My team has been working alongside PELES communication

[1:08:57] department. To prepare the launch of my office's website. We

[1:09:01] have made excellent programs. All website content has been drafted

[1:09:07] and reviewed. And the website's initial design has been completed

[1:09:10] and reviewed also. We are in the planning. We are

[1:09:14] planning to go into a live demo site later this

[1:09:17] month in September with a full public launch planned with

[1:09:21] the planned in the fall with the confidential fraud and

[1:09:24] waste hotline. Lastly, there are two reports going to committee

[1:09:30] today with respect to my offices audit and procurement authority.

[1:09:35] You'll hear directly from me regarding the audit authority and

[1:09:40] Kristin Mazurka, the senior director of procurement regarding the procurement

[1:09:43] authority afterwards. Before I take questions, I'd like to highlight

[1:09:50] to the committee, and I think it's important to highlight

[1:09:52] to the committee. How much has been accomplished in just

[1:09:55] six months. During that time, I have established the office,

[1:10:01] attracted and hired top talent, developed the foundational framework and

[1:10:06] policies. And completed an initial risk assessment of the region's

[1:10:10] programs and services. To identify and commence my offices'initial audits.

[1:10:17] I thank you for your time and attention, and I'm

[1:10:20] happy to answer any questions at this point. Thank you

[1:10:23] very much. I'll open it up to committee. Any from

[1:10:27] committee. Member Emmerich? Go ahead. I'm not sure if you're

[1:10:35] able to, but are you able to share the name

[1:10:37] of the vendor we'll be going with. I don't think

[1:10:42] that there's a concern in identifying the vendor. The vendor's

[1:10:47] name is Ayveda Inc. They're a IT company that has

[1:10:52] been significantly used by the province before. I've had experience

[1:10:58] in auditing and assessing their work in talent in the

[1:11:01] past. Thank you. Very good. And I guess what kind

[1:11:07] of timelines are you thinking about for your first three.

[1:11:11] Targets? That's a great question, and thank you for that

[1:11:14] question. Subjects. We're targeting early to mid 2027 on delivering

[1:11:20] on those reports. A lot will be dependent on the

[1:11:23] scope in nature and the execution of those audits. But

[1:11:26] that's the timeframe that we're looking at. And we're potentially

[1:11:29] looking at other audits commencing at the end of this

[1:11:32] year. Depending on resources. Okay. And broadly, how many are

[1:11:37] you kind of thinking into the future as three kind

[1:11:39] of what you'd expect in an annual or can vary

[1:11:41] based on the subject matter, of course? Definitely, definitely more

[1:11:45] than three. Um, and I think it would depend on

[1:11:47] the subject matter and the resources available. Okay. Appreciate that.

[1:11:52] Any other comments from committee. Otherwise, very well done. I'll

[1:11:56] ask for a mover to accept that chair unica. Very

[1:12:00] good. All in favor. Very good. And, uh, next up,

[1:12:05] 5. 2 expansion of the Auto General's Authority and the

[1:12:08] regional appeal, board of health and long - term care

[1:12:11] committee of management. We were going to do it right

[1:12:15] after. Still on a theme here. With Nick. And Team.

[1:12:20] Um, Nick, over to you again, I guess. Sure. Thank

[1:12:23] you. Uh, through you, Chair. I'm speaking a recommendation from

[1:12:28] the committee to council for authority to conduct audits appeals

[1:12:32] public health programs and long - term care homes. Currently,

[1:12:36] my audit authority does not extend to peel board of

[1:12:40] health or peels long - term care of management. Sorry,

[1:12:43] long - term committee of management. And the programs that

[1:12:46] they oversee. For me to be able to audit these

[1:12:49] entities and their respective programs, they must each request or

[1:12:53] otherwise approve this authority. Since regional council acts as both

[1:12:59] peel board of health and the long - term care

[1:13:01] committee of management, council can request and approve that extension

[1:13:05] of my authority. This is the recommendation that I'm seeking

[1:13:09] from committee today. Okay. I think our chair is happy

[1:13:16] to move it. I would just comment that I feel

[1:13:18] that isn't keeping with what council was envisioning for your

[1:13:21] role. So I don't think you'll have any pushback on

[1:13:24] that. So our chair is saying, absolutely. So I think

[1:13:28] my comments are in good stead. So Chair, the board

[1:13:30] of health as well. There you go. So very good.

[1:13:34] Sounds good. And we've got a mover all in favor.

[1:13:36] Yes. Very good. All right. You got that one, Nick.

[1:13:39] And now 5. 5. The procurement bylaw amendments to incorporate

[1:13:45] the role of the audit general and improve vendor accountability.

[1:14:02] Welcome, welcome. Over to you. Good afternoon. Thank you. And

[1:14:08] good afternoon, chair and members of the audit and REST

[1:14:10] committee. Thank you for the opportunity to be here today.

[1:14:14] My name is Kristin Mizurka as Nick mentioned the senior

[1:14:17] director of Procurement. And I'm joined with Sarah Ramiteur. Remetaur,

[1:14:22] our procurement advisor. Um, so we're here today to present

[1:14:26] recommended amendments to the procurement bylaw, 45 - 2023. And

[1:14:31] we look forward to walking you through some of the

[1:14:33] proposed changes and happy to answer any questions at the

[1:14:35] conclusion of the presentation. So as I mentioned today, we're

[1:14:41] bringing forward two proposed amendments to PEAL regions procurement bylaw.

[1:14:45] The first supports the integration of the newly established Office

[1:14:49] of the Auditor General by formally recognising its rule and

[1:14:52] procurement authority within the bylaw. The second is focused on

[1:14:57] strengthening vendor accountability through the creation of Avendor suspension policy.

[1:15:01] To address identified risks and instances of vendor misconduct. Both

[1:15:07] changes are intended to strengthen good governance and support responsible

[1:15:11] stewardship of public funds. The Auditor General is an independent

[1:15:18] officer appointed by regional counsel reporting directly to council and

[1:15:23] operating independently from PEAL region administration. Though independent, the Auditor

[1:15:28] General is required to comply with the PEAL region policies

[1:15:31] and bylaws, including the procurement bylaw. As such, the Auditor

[1:15:36] General requires therefore amendments to the procurement bylaw to reflect

[1:15:39] the independent nature of their office. Currently, PEAL regions procurement

[1:15:44] bylaw does not contemplate the role of the Auditor General.

[1:15:49] The amendments proposed reflect distinct procurement authorities for the Auditor

[1:15:52] General and their office. The Auditor General will be the

[1:15:56] approval authority for all procurement processes carried out by their

[1:16:00] office. Without approval by regional administration. As would normally be

[1:16:05] the case for all other procurement activity across regional programs.

[1:16:10] The director procurement will maintain oversight and continue to approve

[1:16:13] all procurement processes carried out by the office of the

[1:16:15] Auditor General. Just to confirm compliance with the region of

[1:16:19] PEAE's procurement bylaw and any required policies only. This slide

[1:16:27] summarizes the key changes proposed through the amending bylaw. At

[1:16:31] a high level, the amendments formally incorporate the Auditor General

[1:16:34] and their office into the Procurement bylaw will recognising the

[1:16:38] independent nature of that role. Changes clarify that the procurement

[1:16:43] bylaw will apply to the auditor general procurements establish the

[1:16:47] Auditor General as the final approval authority for Procurement's conducted

[1:16:50] by their office and update schedule will be accordingly. They

[1:16:55] also confirm procurement's continued oversight rule in ensuring all procurement

[1:16:59] activities remain compliant with the bylaw policies and established procedures.

[1:17:04] In addition, the amendments provide the flexibility for the auditor

[1:17:08] general to conduct confidential procurements when required to fulfill their

[1:17:12] statutory responsibilities and make other related updates to the provisions.

[1:17:17] From a governance and accountability perspective, the reporting framework remains

[1:17:22] intact. The Auditor General will continue to provide annual reporting

[1:17:26] to council, including closed session reporting on any confidential procurement

[1:17:30] activity undertaken by their office. And procurement will also continue

[1:17:33] to provide its regular triannual procurement activity reports to council,

[1:17:38] which will include public procurement activities undertaken by the office

[1:17:41] of the Auditor General. Collectively, these amendments provide the clarity

[1:17:46] needed to support the Auditor General's independence while maintaining appropriate

[1:17:50] procurement oversight and transparency. The detail changes are reflected in

[1:17:55] Appendix 1 of the attached report. The second amendment focuses

[1:18:01] on strengthning vendor accountability and building on the strong procurement

[1:18:04] controls already in place at PEL. Since 2008, PEAL is

[1:18:09] maintained a robust vendor performance management program that is designed

[1:18:13] to monitor contract performance, support successful project delivery. And provide

[1:18:18] vendors with the opportunity to address performance concerns and improve

[1:18:21] outcomes. While the vendor performance management program focuses on contract

[1:18:26] performance, the proposed vendor suspension policy would complement that framework

[1:18:31] by providing a formal process to address more serious matters

[1:18:35] such as fraud, collusion, bid rigging, unethical bidding practices, and

[1:18:40] other forms of vendor misconduct. This represents an opportunity to

[1:18:46] further enhance PEAL's vendor accountability framework and ensure we have

[1:18:49] the appropriate tools to respond to a broader range of

[1:18:52] risks when they arise. The approach aligns with procurement best

[1:18:55] practices, and it reflects what many of our municipal peers

[1:18:59] are already doing, including the city of Toronto, York region,

[1:19:02] city of Brampton, and Mississauga and town of Caledon. Ultimately,

[1:19:08] the policy will strengthen accountability, enhance transparency, and support fair

[1:19:12] and ethical competition. Amendments to PEAL regions procurement bylaw are

[1:19:19] proposed to address the establishment of a vendor suspension policy

[1:19:22] consistent with PEAL regions approach into incorporating the vendor performance

[1:19:26] management program. Upon receiving council's approval, the amending bylaw, the

[1:19:31] director of procurement will develop and implement a vendor suspension

[1:19:34] policy in accordance with PEAL regions corporate policy framework. Under

[1:19:40] the vendor suspension policy, PEAE will have the ability to

[1:19:43] suspend vendors who have committed acts of misconduct from participating

[1:19:47] in PEAL procurement processes. For a prescribed duration of time

[1:19:51] based on severity of the actions or offences. Grounds for

[1:19:57] suspension may include convictions of crimes and offences, engaging in

[1:20:00] professional misconduct, providing false declarations, or committing other fraudulent or

[1:20:05] illegal activities. The duration of the suspensions may range between

[1:20:10] one to five - year period, depending on the severity.

[1:20:13] The policy may also include suspension decisions being made collaboratively

[1:20:17] by a joint staff committee. Comprised of the PEAL region's

[1:20:21] Chief Administrative Officer, legal services, including the regional solicitor, procurement,

[1:20:26] and the impacted program areas. Best practices and applicable law

[1:20:32] case, case law, excuse me, will inform the policy with

[1:20:35] regards to the required documentation, clear suspension, notifications, and reinstatement

[1:20:40] processes. The introduction of a comprehensive vendor suspension policy in

[1:20:45] tandem with PEALS vendor performance management program. Supports value for

[1:20:50] money, vendor accountability, and reflects PEAL's expectations that vendors conduct

[1:20:54] business with PEAL and a professional legal and ethical manner.

[1:21:01] In conclusion, the proposed change is to PEAL regions procurement

[1:21:03] bylaw are intended to support the independent nature of the

[1:21:07] rule of the Auditor General and incorporating procurement authority for

[1:21:11] the auditor general within the procurement bylaw helps to reinforce

[1:21:15] this independence. And if the rule, while ensuring appropriate procurement

[1:21:18] oversight and accountability. Implementing a comprehensive vendor suspension policy will

[1:21:24] strengthen PEAL's existing vendor accountability framework. By providing a structured

[1:21:29] approach to addressing serious matters, such as fraud, unethical bidding

[1:21:34] practices, illegal activities, and health and safety violations. It will

[1:21:38] further support the protection of the region's financial, operational, and

[1:21:42] reputational interests while reinforcing public confidence in our procurement processes.

[1:21:48] Therefore, we are seeking audit and risks committees endorsement of

[1:21:52] the report recommendations and of the amending procurement bylaw as

[1:21:56] attached in AppendixOne. So that it can be presented to

[1:21:59] council for enactment on September 24, 2026. Thank you for

[1:22:05] your time and consideration, and we would be pleased to

[1:22:07] respond to any questions the committee has. Thank you so

[1:22:11] much, and I'll open it up to committee for questions.

[1:22:17] All right, well, I'll ask a couple. Uh, so Juan,

[1:22:20] I guess I will ask our fine auditor general. Nick,

[1:22:24] can you give me an example of what a confidential

[1:22:27] procurement would possibly include in your office and kind of

[1:22:31] lead us down that path? I think it would probably

[1:22:32] be related to perhaps experts on subject matters. You need

[1:22:37] assistance on, but what would you envision would kind of

[1:22:40] need that grant authority. Uh, through you, Chair, thank you

[1:22:47] for the question. Um, I don't foresee needing to go

[1:22:50] down the path of a confidential procurement, but say, for

[1:22:54] example, solicitor next door to me has, some concerns regarding

[1:23:03] the solicitor, and I'd want to do something confidential where

[1:23:06] it doesn't go through the solicitor understanding that I'm procuring

[1:23:09] something to be assessing some of the work that's being

[1:23:13] under her watch, for example. That would be the confidential

[1:23:17] nature of any procurement in that manner. Makes sense. Subject

[1:23:21] matter expert. You want to - Not that I plan

[1:23:23] to do that. Patricia, jeez. Very good. Um, and I

[1:23:29] guess another question I will ask if there's none other,

[1:23:32] some committees, uh, and I know the answer, but it's

[1:23:34] a loaded question, but why five years? Why not 10?

[1:23:38] Why not infinity when we have somebody who's possibly conducted

[1:23:41] some kind of fraud or negligence as you described for

[1:23:44] suspension. Thank you, through the chair. Um, it is a

[1:23:50] good question. Uh, we do want to do still an

[1:23:53] environmental scan and see what are the municipalities are doing,

[1:23:57] um, and look at some case law. Um, just working

[1:24:00] with our legal services. There is some opinion that once

[1:24:05] a vendor has done the actions to repair, you know,

[1:24:09] you've done your time, so to speak. What have they

[1:24:11] taken? And if that satisfies the region or the organisation,

[1:24:16] that there is a fairness to still then continue on

[1:24:19] and have an end point to that banning. But we

[1:24:23] still have to do a bit of research to see

[1:24:25] if they're truly is a case that it should be

[1:24:28] a life ban. Um, but we are seeing preliminary. It's

[1:24:33] anywhere between one and five years. And a second question

[1:24:36] would be. So let's say, um, Acme, ink, decided to

[1:24:41] do something nefarious with, uh, of reach and appeal. Uh,

[1:24:45] and then they opened up a subcompany. Would we have

[1:24:48] the ability to track that and know that the two

[1:24:51] are linked and thereby not do business with a new

[1:24:53] subcompany. Yeah, the ways, um, I mean, the easiest way

[1:24:59] we usually contact our legal services and they do a

[1:25:02] business search if they're using the same GST number, um,

[1:25:06] then we can see the connection. If it has the

[1:25:08] same, maybe, uh, president, um, we do look at those

[1:25:13] things today. And we even without having a standard approach.

[1:25:18] But I suspect there's always probably ways that they can

[1:25:21] get away. What the difference here is that we have

[1:25:24] things in our terms and conditions that can terminate contracts.

[1:25:28] But this is really going to put out in the

[1:25:30] forefront that they're signing up for it so that they

[1:25:32] know that anytime they could be suspended and these are

[1:25:35] the periods of time and it'd be a committee. So

[1:25:38] there are always ways, I think, that people can try

[1:25:41] to skirt or get through, but I think this adds

[1:25:44] another layer of us being able to detect that sooner.

[1:25:48] Okay. Good to hear. And I see RAG's nodding in

[1:25:50] the background there. By the way, I heard Acme makes

[1:25:52] some really terrible products. They're very defective and the movie

[1:25:55] coming out of. Okay. Uh, any questions from committee? Last

[1:25:59] chance? No. We're seeing head shake. Okay. Memory. I'll ask

[1:26:03] you to put that forward. Very good. All in favor.

[1:26:07] All right. And I believe we got 5. 3 assistance

[1:26:11] payment oversight monitoring is up next. And Anila. Come on

[1:26:19] down. And over to you when you're ready.

[1:26:44] Our time is a charm. Now I have Elizabeth Stortey

[1:26:48] to co - present the results of the Assistance payment

[1:26:51] oversight and monitoring audit. Completed in collaboration with housing services.

[1:26:57] This audit focused on controls over housing related financial assistance

[1:27:02] payments. And assessed weather management, oversight was effective in ensuring

[1:27:09] client eligibility. Appropriate approvals and monitoring of program expenditures. Today

[1:27:16] we will provide an overview of the audit objectives. Scope.

[1:27:22] Key observations and managements planned and completed corrective actions. At

[1:27:31] the time of the audit, internal controls were not overall

[1:27:36] effective. To oversee and monitor housing related financial payments to

[1:27:42] clients in ensuring, compliance with internal eligibility criteria. In preventing

[1:27:50] the potential for funds being used for unintended purposes. There

[1:27:55] is a need to strengthen management oversight in areas, including

[1:28:00] payment approvals. Client eligibility at reassessments. Banking information handling and

[1:28:08] system access. Housing services is responsible for administering

[1:28:17] housing and homelessness programs. That provide financial assistance and housing

[1:28:23] support to residents across PEAL region. Due to the volume

[1:28:29] of financial assistance provided. And the importance of ensuring funds

[1:28:34] are directed to eligible clients. Housing services was selected for

[1:28:38] this review. This audit represent phase one of the internal

[1:28:44] audits review of assistance payment controls. Phase two will focus

[1:28:50] on income and social supports processes and controls. Thank you,

[1:28:55] Anila. As Anila stated at the time of the audit

[1:28:59] controls related to client payments were not satisfactory. The issuance

[1:29:02] of funds to clients is a core component of our

[1:29:05] service and helps us ensure that housing is both obtained

[1:29:09] and maintained for those most in need. The housing leadership

[1:29:12] team welcomes these observations and has taken action to address

[1:29:15] them. It has also signalled housing services to review other

[1:29:20] areas of financial investment to ensure monitoring and audit controls

[1:29:24] are effective. The objective of the audit was to determine

[1:29:32] whether management of housing services has implemented effective controls to

[1:29:37] oversee and monitor financial payments made to clients. The audit

[1:29:43] also evaluated with the such oversight and monitoring were effective

[1:29:48] in ensuring compliance with internal eligibility criteria. And preventing distribution

[1:29:53] of funds for unintended purposes. Specifically the audit focused on

[1:30:00] assessing that payment approvals and eligibility decisions were supported with

[1:30:05] required documentation on client files. Management oversight and review of

[1:30:12] financial assistance decisions to clients were effective. In identifying noncompliance

[1:30:18] and anomalies. Financial monitoring processes for the overall spending of

[1:30:25] funds were appropriately designed and followed. And finally, internal control

[1:30:31] procedures in place were effective in guiding assistance processes as

[1:30:37] well as monitoring user activity within the systems. The audit

[1:30:46] focus on T2 key processes, sorry, the audit focuses on

[1:30:52] two key housing services programs. First, needs - based subsidy.

[1:30:57] Which provides ongoing rent assistance. And second, housing stability fund,

[1:31:03] which provides one - time financial assistance to support housing

[1:31:07] stability. The audit scope covered the period from January 1st,

[1:31:13] 2023, through June 30, 2025. And included detailed review of

[1:31:20] select client files. Payment transactions and supporting records.

[1:31:34] Procedures for existing processes. The first group of observations relates

[1:31:40] to the process documentation and governance. We noted opportunities to

[1:31:45] strengthen procedures involving conflict of interest and applications involving PEL

[1:31:51] regions employees. Documentation and security of prioritization tools used to

[1:31:58] identify high - need clients. Formal procedures to client ruffles

[1:32:04] to private landlords. And formalization of monthly that are review

[1:32:09] and clean up activities. Operational practices existed in some cases.

[1:32:16] They were not always formally documented, approved or consistently applied.

[1:32:22] To address these concerns, housing has completed the following. The

[1:32:26] PEALE region staff applications for housing supports policy has been

[1:32:30] developed. This policy speaks to the identification, declaration, and management

[1:32:34] of actual and perceived conflicts of interest. And speaks directly

[1:32:38] how to handle an application from appeal employee. The housing

[1:32:42] stability program policy clearly establishes roles and responsibilities related to

[1:32:46] eligibility, assessment, decision - making, and conflict of interest. The

[1:32:51] needs - based subsidy policy has been revised to reflect

[1:32:53] the previous two - mentioned policies. It details the purpose,

[1:32:57] objective, and criteria for the administration of subsidy based on

[1:33:01] need. In addition, and currently underway. The core housing knee

[1:33:05] policy, the methodology used to identify and prioritize those in

[1:33:10] greatest need is currently under review and a power BI

[1:33:13] report is being developed to assist in client identification. Upon

[1:33:17] completion, processes, procedures, and training, as well as permission regulation

[1:33:21] will be put in place. Procedures and training are being

[1:33:25] to develop to support the by - name list policy

[1:33:27] in its administration. This process supports housing clients who are

[1:33:30] experiencing homelessness, whereas the A4 mentioned policy on core housing

[1:33:34] need. Supports those that are precariously housed and on our

[1:33:38] end or on our centralized wait list. Training has been

[1:33:41] updated and administered to reflect the above note of policy

[1:33:44] changes and subsequent procedural changes as well. A reinforcement plan

[1:33:49] has been developed, which includes an audit component and leaders

[1:33:52] in housing have been trained. All of the above action

[1:33:55] will support the integrity of housing's data, ensuring client records,

[1:34:00] housing records, and subsidy payments are administered within policy. In

[1:34:04] addition, a monthly audit review process has been established and

[1:34:08] audited mated to improve consistent and oversight. The second theme

[1:34:15] relates to management oversight and monitoring controls. These observations were

[1:34:20] assessed as high risk because they involved key financial and

[1:34:24] eligibility controls. The most significant findings included lack of independent

[1:34:30] review of banking information changes for need - based subsidy

[1:34:34] recipients. Delayed are missing annual eligibility reassessments. In our samples

[1:34:43] showed no evidence of reassessment. Limited monitoring of user access

[1:34:49] privileges and system activity within the system. Weak supervised recontrols

[1:34:56] over housing stability funds payments under 5, 000. In our

[1:35:01] sample, about 68 percent of payments lacked sufficient supporting documents.

[1:35:06] These observations highlight the need for stronger supervisory review. Monitoring

[1:35:13] and documentation controls. To address the observations noted, regarding needs

[1:35:18] - based subsidy housing will implement enhanced verification and oversight

[1:35:22] controls for the creation of new PEs and changes to

[1:35:26] direct - positive information. Examples include a landlord verification process

[1:35:30] and a process to improve the timely actioning of returned

[1:35:33] mail. The eligibility assessment and reassessment controls are being strengthened

[1:35:37] through file audit documentation as well. Training has been updated

[1:35:41] and expectations have been reinforced with staff and leadership. This

[1:35:45] work will be completed by December of 2026. For HSF

[1:35:49] payments, by October, management will have strengthened oversight and monitoring

[1:35:54] controls. Through enhanced audit requirements, targeted risk - based reviews

[1:35:59] and system controls that will flag payments that do not

[1:36:01] meet program eligibility. A check pickup procedure and check pickup

[1:36:06] tracker were created in July of 2026. Staff have been

[1:36:10] trained and a memorand of understanding between housing and income

[1:36:13] and social supports has been updated to reflect this standard.

[1:36:17] We thank ISS for its quick response to these audit

[1:36:19] findings, and we will continue to work together to ensure

[1:36:22] compliance. Lastly, by December 2026, a formal user - assessment

[1:36:27] management and monitoring process for Salesforce will be developed to

[1:36:31] strengthen security over Kline Information. Housing inventory and payment processes.

[1:36:36] This will be reviewed by annually to ensure alignment with

[1:36:40] job responsibility changes. Salesforce audit an activity reports will also

[1:36:44] be reviewed to identify high - risk functions. The final

[1:36:50] set of observations focused on financial monitoring and reconciliation activities.

[1:36:56] Housing Stability Fund Expenditures exceeded budget each year reviewed, ranging

[1:37:01] from approximately 26 percent to 46 percent over budget. While

[1:37:07] management attributed this to increasing housing pressures within PEAL, internal

[1:37:13] audit noted, opportunities to strengthen analytical review of spending trends

[1:37:19] and payment activity. Or it also identified the disbursement records

[1:37:25] were not reconciled directly to banking rackets. An enhanced financial

[1:37:31] monitoring plan has been implemented. That defines steps to analyse,

[1:37:36] record, and report on financial payments, trends, anomalies. And overall

[1:37:42] budget expenditures. This information is reviewed monthly and quarterly with

[1:37:46] our finance business partners and documented in our financial narrative

[1:37:50] to inspenditures align with budget. Reconciliation between bankroids and sales

[1:37:56] force has been enhanced through daily and monthly reconciliation and

[1:37:59] monitoring. Recording within a financial narrative as well in partnership

[1:38:04] with our financial business partners. An example is the review

[1:38:07] of daily sales force reports of issue checks cross -

[1:38:11] reference with information oftained from RBC Express. In conclusion, at

[1:38:19] the time of Audit, internal controls were not overall effective

[1:38:23] to oversee and monitor financial payments to clients in ensuring

[1:38:28] compliance with internal eligibility criteria. And preventing the potential for

[1:38:33] funds being used for unintended purposes. There is a need

[1:38:36] to strengthen management oversight in areas, including payment approval. Client,

[1:38:42] eligibility, reassessment. Banking information handling and system access and activity.

[1:38:49] Management has developed or completed action plans since the conclusion

[1:38:53] of the audit to address the RESC's identified. This concludes

[1:38:58] our presentation and we are happy to take any questions.

[1:39:02] Okay, I'll open it up to committee members first. There's

[1:39:05] any questions members. I could climb down a few rabbit

[1:39:13] holes here, but I guess maybe I'll ask one where,

[1:39:15] uh, you're talking about enhancing the reconciliations between the bank

[1:39:18] statements and the FONSO going. Who's going to perform the

[1:39:22] reconciliation? Is it finance or is it the department? It

[1:39:25] is the program area in partnership with our finance area.

[1:39:30] Okay, and you said, what was the frequency again? You

[1:39:33] were going to do? There are daily audits that are

[1:39:35] done to cross - reference payments that go out on

[1:39:36] a daily basis and then there's also a series of

[1:39:38] monthly audits as well. Okay. And what will be the

[1:39:43] escalation method. When the differences that occur. They'll be on

[1:39:47] a daily method. There'll be immediately escalated to the manager

[1:39:49] for consideration for discussion across with our business finance partners

[1:39:53] and on the monthly basis LBS leaded to the director

[1:39:55] level as well if they, if the seriousness requires such.

[1:39:58] Okay, and I guess you've got financial thresholds around all

[1:40:00] that. Um, supervisors have financial thresholds and then anything above

[1:40:05] that goes forward to the manager for approval. And that's

[1:40:08] where we stop within the limits of the programs. Okay.

[1:40:13] And you also mentioned about check pickup. Do we do

[1:40:17] still a substantial amount of physical check. For the, um,

[1:40:22] we do, um, solely check pickup. Okay. We are working

[1:40:27] towards an automated system that is on our technology list

[1:40:30] of projects. Um, and we would work with ISS and

[1:40:32] partnership on that process because that actual process is managed

[1:40:35] by them. Check pickup window and human services. So is

[1:40:38] that our internal challenge with systems or is that also

[1:40:42] what the applicants are looking for because they're unbanked? It

[1:40:45] is a priority on our IT work plan. All right.

[1:40:52] And I see I've triggered member Emmerick. Go ahead. Oh,

[1:40:59] commissioner, did you want to hop in first or would

[1:41:00] you. See the chair? Just on that last point, it

[1:41:06] is the, uh, recipients discretion as to whether or not

[1:41:10] they want to participate in an automatic. Deposit or check

[1:41:15] pickup. As you noted, some are do not belong to

[1:41:19] a bank. But some do wish to pick that up.

[1:41:22] We always encourage individuals to take the direct deposit. We

[1:41:27] help them with any identification issues that they have, get

[1:41:30] them set up with the bank of their choice, let

[1:41:32] them know what their options are within the community. We

[1:41:35] really encourage them to do that. Otherwise, they're going to

[1:41:38] a third party COT check caching, which we know is

[1:41:41] very, very expensive. Um, to them, um, and, um, so

[1:41:45] we really do that. But the reason we still have

[1:41:48] check pickup and Czech production is because individuals have said,

[1:41:52] I don't want or they end up opting out for

[1:41:55] a variety of reasons of automatic deposits. So unfortunately, um,

[1:42:01] it's still going to be, hopefully a small percentage of

[1:42:04] the work that we do and how we issue it.

[1:42:06] And we really do encourage individuals to, to get onto

[1:42:09] that automated process for their own protection and to ensure

[1:42:12] that they're getting all the funds that, that are due

[1:42:15] to them. Thank you, Commissioner. That was some of what

[1:42:17] I was thinking and more than I had thought to

[1:42:20] myself as well. Cause yeah, that's a real challenge I

[1:42:23] can think. And also checks go missing. Checks get damaged.

[1:42:26] And then for reconciliation, you get checks that never get

[1:42:28] cached. And then the physical cost of producing them in

[1:42:31] the first place. All right. Um, memo Emmerick. Go for

[1:42:33] you. Thank you through you, Mr. Chair. You mentioned monitoring

[1:42:38] user activity. It'd be audited using Salesforce Audit tools. That

[1:42:43] answered part of my question. Second part is will audit

[1:42:46] be involved in helping to review or configure those, uh,

[1:42:49] audit triggers? Yes. Weekend for what. Through you chair. We

[1:42:56] can provide advice on the processes that they have created

[1:43:00] and work with them. Thank you. All right. Some good

[1:43:06] questions. I don't see any more. So motion two accept.

[1:43:12] Emmer Emmerich. Very good. All in favor. Excellent. All right.

[1:43:16] We have one last item. 5. 4 status of 2026

[1:43:20] internal audit risk based on work plan. Jennifer, over to

[1:43:25] you. Thank you through the chair. I

[1:43:35] just wanted to, uh, provide a few words, um, on

[1:43:38] the report before you. It's, uh, September. So we're at

[1:43:43] almost 75 percent of the year. And my team has

[1:43:46] had a successful year in terms of their progress on

[1:43:50] our 2026 work plan. We have or will have started

[1:43:56] all projects that are possible for us to start as

[1:44:00] indicated in the Appendix to the report. And as, uh,

[1:44:03] Nick has also talked about, uh, his team is going

[1:44:06] to be doing the community investment program audit, um, was

[1:44:10] on the initial work plan, uh, for internal audit. And

[1:44:13] then, uh, we also have a project around, uh, quality

[1:44:17] assurance, a limited quality assurance review work for the next

[1:44:21] phase of the SAP implementation. And we await when that,

[1:44:26] that work progresses to start to provide our quality assurance,

[1:44:30] uh, on that, on that project. So that has not

[1:44:32] commenced at this time. But otherwise, we are, uh, on

[1:44:35] pace to start all the remaining projects in the work

[1:44:38] plan. Thank you. Excellent to hear any questions. I don't

[1:44:43] believe so. Thank you and Chair Anicua will, uh, we'll

[1:44:47] move that. Very good. Well, that brings us to the

[1:44:49] end of our discussion. I just want to say this.

[1:44:51] The last meeting we're going to have in this, uh,

[1:44:53] you know, uh, memo Emmerick, you have a comment before

[1:44:56] we go. It's been four years and I still have

[1:45:04] trouble with the speaker. No, I just wanted to, uh,

[1:45:07] to thank you and the elected members of the, of

[1:45:10] the committee for allowing me to participate these last few

[1:45:13] years. It's been an interesting experience. I found it quite,

[1:45:17] quite, uh, challenging at times. And I feel it's been

[1:45:21] a good experience. Staff may not be able the same

[1:45:23] way. But, uh, but, but I certainly do. And, and

[1:45:27] one other thing, because it is, uh, an election year,

[1:45:30] I do want to congratulate all candidates, both incumbents and

[1:45:35] those hopefuls looking for a position. They've put their names

[1:45:38] forward. Takes a great deal of courage. Uh, shows, uh,

[1:45:42] willingness for public service. And you should all be congratulated,

[1:45:46] whether successful or not. So good luck with everything. Thank

[1:45:49] you very much. That's very kind of you to say.

[1:45:52] And with the wisdom of our public, maybe we'll be

[1:45:54] back, hopefully, for those who are trying. And I just

[1:45:57] want to thank the staff, uh, both the internal audit

[1:46:00] staff, uh, you know, I've worked with you the most

[1:46:02] over the last couple of years. You've always been fantastic.

[1:46:04] The senior leadership staff. Thank you for all your support

[1:46:06] on all the different files and all the different audits

[1:46:09] that have come through your departments. Greatly appreciated. And our

[1:46:12] new auditor general, Nick, it's been good to the short

[1:46:14] period of time. We've had the chance to work together.

[1:46:17] And, you know, in the support staff who make the

[1:46:18] meetings happen. And who give us nudges when we need

[1:46:22] chairs, appreciate that kind of thing, don't they, Mr. Chair?

[1:46:25] All right. And with that, I will, uh, call the

[1:46:27] meeting to close. And I will see you in 2027.

[1:46:30] Fingers crossed. Thank you. Bye - bye.

Audit and Risk Committee

Agenda

Transcript