[0:18] Good afternoon Mustafa, can you hear us.
[0:29] Yes, I can hear you guys, thank you. Perfect confirming,
[0:33] we can see your video as well. Thank you. I
[0:36] can see the video of all of this. Thank you.
[3:05] Sound check. Good afternoon councillor for centre taking you here
[3:11] us. I can five by five.
[3:21] Did you want to test your video today. No thank
[3:26] you. Thank you.
[5:49] Good afternoon everyone. I'll call the meeting to order. This
[5:52] is our audit and RISC Committee at the region appeal
[5:55] September 3rd if you can believe it is September. So
[5:58] I'll call the meeting to order and ask if there
[6:00] are any declarations of conflict of interests. Not seeing any,
[6:05] thank you. For the approval of the agenda, we're going
[6:08] to make a couple of shuffles around here. So we
[6:11] are going to maybe go close session first because I
[6:13] know member Emmerick has an issue deal with enclosed session.
[6:19] We're also going to bump 5. 5 after 5. 2
[6:22] because it flows more naturally from our A. G. discussion.
[6:26] So with that may have an approval for the agenda,
[6:29] please. Emperor Emmerich. Our chair. Very good. So we will
[6:34] start in closed session. I will read that here. The
[6:40] agenda. The agenifer, September 3rd 2006, 2026 audit risk committee
[6:46] meeting include a closed session item regarding the committee member
[6:51] inquiry gardening information technology management, the security of the property
[6:54] of the municipality or local board to be dealt with
[6:57] under closed session item 8. 3 and two that the
[7:01] agenda for September 3rd, 2026, odd and risk committee be
[7:05] approved and amended. And we had that approval just a
[7:07] second ago. And so the closed session. Topic right here.
[7:16] Shuffling papers who shuffle agenda. Presentations. Okay. That committee proceed
[7:25] to closed session to consider the reports related to the
[7:27] following 2026 SCADA. Governance and security review, the security of
[7:35] the property of municipality board. Capital project audit management audit
[7:41] seniors health and wellness village litigation or potential litigation, including
[7:44] matters before administrative tribunals. If anything, the municipality or local
[7:47] boards. And three, the committee members inquiry regarding information technology
[7:52] management and the security of the property and municipality or
[7:54] local board. Any objections. Seeing none, I'll call that. And
[7:58] we'll move into closed session.
[1:05:43] Is there language wrong on that or just motion.
[1:06:14] Okay, and moving back into open session. So I'll ask
[1:06:19] for a motion to approve our three in - camera
[1:06:22] items, memorac, all in favor. All right. Very good. And
[1:06:28] with that, we are gonna jump into 5. 1 Auditor
[1:06:32] General Update. Welcome, welcome, Nick. Good to see ya. Happy
[1:06:37] to see you for us. And over to you. Good
[1:06:43] afternoon, everyone. Thank you for the opportunity to speak to
[1:06:47] the committee today. It's my pleasure to provide an update
[1:06:50] of my office's operations. Today, I'll be updating the committee
[1:06:56] on five areas. My recruitment and hiring, the initial audits
[1:07:00] I've selected, the progress on the new confidential fraud and
[1:07:05] waste hotline, the development of my office's website. And a
[1:07:09] quick summary of two additional reports going to committee today
[1:07:12] regarding my audit and procurement authority. At this point, I'm
[1:07:19] pleased to inform the committee that I have been able
[1:07:21] to quickly secure a full all - star roster of
[1:07:24] top talent that will enable me to hit the ground
[1:07:28] running as we begin our initial audits. On that note,
[1:07:35] upon the completion of our risk assessment across PEALS programs,
[1:07:40] services, and activities, we have selected three initial audits. The
[1:07:45] Community Investment Program, PEAL Housing Corporation State of Good Repair
[1:07:50] Program. And Capitol Project Oversight, ChangeOrder Management. These audits have
[1:07:56] been initiated and are in the planning phase where we
[1:07:59] will be determining the scope, objectives, and criteria for each
[1:08:02] audit. While these audits are being conducted, we will also
[1:08:06] be developing the offices 2027 AuditPlan. Informed by our RISC
[1:08:12] assessment. And the forthcoming confidential fraud and waste hotline. With
[1:08:19] respect to the confidential fraud and waste hotline, I'm happy
[1:08:23] to inform the committee that we have signed the contract
[1:08:25] with the vendor and are in the progress of its
[1:08:28] development. The planned launch of the hotline is targeted for
[1:08:33] this fall alongside with the offices new website. The hotline
[1:08:37] will give both the public MEAL region employees a confidential
[1:08:40] channel to report concerns. In information stemming from this confidential
[1:08:45] fraud in waste hotline, will help inform our 2027 audit
[1:08:50] work plan. My team has been working alongside PELES communication
[1:08:57] department. To prepare the launch of my office's website. We
[1:09:01] have made excellent programs. All website content has been drafted
[1:09:07] and reviewed. And the website's initial design has been completed
[1:09:10] and reviewed also. We are in the planning. We are
[1:09:14] planning to go into a live demo site later this
[1:09:17] month in September with a full public launch planned with
[1:09:21] the planned in the fall with the confidential fraud and
[1:09:24] waste hotline. Lastly, there are two reports going to committee
[1:09:30] today with respect to my offices audit and procurement authority.
[1:09:35] You'll hear directly from me regarding the audit authority and
[1:09:40] Kristin Mazurka, the senior director of procurement regarding the procurement
[1:09:43] authority afterwards. Before I take questions, I'd like to highlight
[1:09:50] to the committee, and I think it's important to highlight
[1:09:52] to the committee. How much has been accomplished in just
[1:09:55] six months. During that time, I have established the office,
[1:10:01] attracted and hired top talent, developed the foundational framework and
[1:10:06] policies. And completed an initial risk assessment of the region's
[1:10:10] programs and services. To identify and commence my offices'initial audits.
[1:10:17] I thank you for your time and attention, and I'm
[1:10:20] happy to answer any questions at this point. Thank you
[1:10:23] very much. I'll open it up to committee. Any from
[1:10:27] committee. Member Emmerich? Go ahead. I'm not sure if you're
[1:10:35] able to, but are you able to share the name
[1:10:37] of the vendor we'll be going with. I don't think
[1:10:42] that there's a concern in identifying the vendor. The vendor's
[1:10:47] name is Ayveda Inc. They're a IT company that has
[1:10:52] been significantly used by the province before. I've had experience
[1:10:58] in auditing and assessing their work in talent in the
[1:11:01] past. Thank you. Very good. And I guess what kind
[1:11:07] of timelines are you thinking about for your first three.
[1:11:11] Targets? That's a great question, and thank you for that
[1:11:14] question. Subjects. We're targeting early to mid 2027 on delivering
[1:11:20] on those reports. A lot will be dependent on the
[1:11:23] scope in nature and the execution of those audits. But
[1:11:26] that's the timeframe that we're looking at. And we're potentially
[1:11:29] looking at other audits commencing at the end of this
[1:11:32] year. Depending on resources. Okay. And broadly, how many are
[1:11:37] you kind of thinking into the future as three kind
[1:11:39] of what you'd expect in an annual or can vary
[1:11:41] based on the subject matter, of course? Definitely, definitely more
[1:11:45] than three. Um, and I think it would depend on
[1:11:47] the subject matter and the resources available. Okay. Appreciate that.
[1:11:52] Any other comments from committee. Otherwise, very well done. I'll
[1:11:56] ask for a mover to accept that chair unica. Very
[1:12:00] good. All in favor. Very good. And, uh, next up,
[1:12:05] 5. 2 expansion of the Auto General's Authority and the
[1:12:08] regional appeal, board of health and long - term care
[1:12:11] committee of management. We were going to do it right
[1:12:15] after. Still on a theme here. With Nick. And Team.
[1:12:20] Um, Nick, over to you again, I guess. Sure. Thank
[1:12:23] you. Uh, through you, Chair. I'm speaking a recommendation from
[1:12:28] the committee to council for authority to conduct audits appeals
[1:12:32] public health programs and long - term care homes. Currently,
[1:12:36] my audit authority does not extend to peel board of
[1:12:40] health or peels long - term care of management. Sorry,
[1:12:43] long - term committee of management. And the programs that
[1:12:46] they oversee. For me to be able to audit these
[1:12:49] entities and their respective programs, they must each request or
[1:12:53] otherwise approve this authority. Since regional council acts as both
[1:12:59] peel board of health and the long - term care
[1:13:01] committee of management, council can request and approve that extension
[1:13:05] of my authority. This is the recommendation that I'm seeking
[1:13:09] from committee today. Okay. I think our chair is happy
[1:13:16] to move it. I would just comment that I feel
[1:13:18] that isn't keeping with what council was envisioning for your
[1:13:21] role. So I don't think you'll have any pushback on
[1:13:24] that. So our chair is saying, absolutely. So I think
[1:13:28] my comments are in good stead. So Chair, the board
[1:13:30] of health as well. There you go. So very good.
[1:13:34] Sounds good. And we've got a mover all in favor.
[1:13:36] Yes. Very good. All right. You got that one, Nick.
[1:13:39] And now 5. 5. The procurement bylaw amendments to incorporate
[1:13:45] the role of the audit general and improve vendor accountability.
[1:14:02] Welcome, welcome. Over to you. Good afternoon. Thank you. And
[1:14:08] good afternoon, chair and members of the audit and REST
[1:14:10] committee. Thank you for the opportunity to be here today.
[1:14:14] My name is Kristin Mizurka as Nick mentioned the senior
[1:14:17] director of Procurement. And I'm joined with Sarah Ramiteur. Remetaur,
[1:14:22] our procurement advisor. Um, so we're here today to present
[1:14:26] recommended amendments to the procurement bylaw, 45 - 2023. And
[1:14:31] we look forward to walking you through some of the
[1:14:33] proposed changes and happy to answer any questions at the
[1:14:35] conclusion of the presentation. So as I mentioned today, we're
[1:14:41] bringing forward two proposed amendments to PEAL regions procurement bylaw.
[1:14:45] The first supports the integration of the newly established Office
[1:14:49] of the Auditor General by formally recognising its rule and
[1:14:52] procurement authority within the bylaw. The second is focused on
[1:14:57] strengthening vendor accountability through the creation of Avendor suspension policy.
[1:15:01] To address identified risks and instances of vendor misconduct. Both
[1:15:07] changes are intended to strengthen good governance and support responsible
[1:15:11] stewardship of public funds. The Auditor General is an independent
[1:15:18] officer appointed by regional counsel reporting directly to council and
[1:15:23] operating independently from PEAL region administration. Though independent, the Auditor
[1:15:28] General is required to comply with the PEAL region policies
[1:15:31] and bylaws, including the procurement bylaw. As such, the Auditor
[1:15:36] General requires therefore amendments to the procurement bylaw to reflect
[1:15:39] the independent nature of their office. Currently, PEAL regions procurement
[1:15:44] bylaw does not contemplate the role of the Auditor General.
[1:15:49] The amendments proposed reflect distinct procurement authorities for the Auditor
[1:15:52] General and their office. The Auditor General will be the
[1:15:56] approval authority for all procurement processes carried out by their
[1:16:00] office. Without approval by regional administration. As would normally be
[1:16:05] the case for all other procurement activity across regional programs.
[1:16:10] The director procurement will maintain oversight and continue to approve
[1:16:13] all procurement processes carried out by the office of the
[1:16:15] Auditor General. Just to confirm compliance with the region of
[1:16:19] PEAE's procurement bylaw and any required policies only. This slide
[1:16:27] summarizes the key changes proposed through the amending bylaw. At
[1:16:31] a high level, the amendments formally incorporate the Auditor General
[1:16:34] and their office into the Procurement bylaw will recognising the
[1:16:38] independent nature of that role. Changes clarify that the procurement
[1:16:43] bylaw will apply to the auditor general procurements establish the
[1:16:47] Auditor General as the final approval authority for Procurement's conducted
[1:16:50] by their office and update schedule will be accordingly. They
[1:16:55] also confirm procurement's continued oversight rule in ensuring all procurement
[1:16:59] activities remain compliant with the bylaw policies and established procedures.
[1:17:04] In addition, the amendments provide the flexibility for the auditor
[1:17:08] general to conduct confidential procurements when required to fulfill their
[1:17:12] statutory responsibilities and make other related updates to the provisions.
[1:17:17] From a governance and accountability perspective, the reporting framework remains
[1:17:22] intact. The Auditor General will continue to provide annual reporting
[1:17:26] to council, including closed session reporting on any confidential procurement
[1:17:30] activity undertaken by their office. And procurement will also continue
[1:17:33] to provide its regular triannual procurement activity reports to council,
[1:17:38] which will include public procurement activities undertaken by the office
[1:17:41] of the Auditor General. Collectively, these amendments provide the clarity
[1:17:46] needed to support the Auditor General's independence while maintaining appropriate
[1:17:50] procurement oversight and transparency. The detail changes are reflected in
[1:17:55] Appendix 1 of the attached report. The second amendment focuses
[1:18:01] on strengthning vendor accountability and building on the strong procurement
[1:18:04] controls already in place at PEL. Since 2008, PEAL is
[1:18:09] maintained a robust vendor performance management program that is designed
[1:18:13] to monitor contract performance, support successful project delivery. And provide
[1:18:18] vendors with the opportunity to address performance concerns and improve
[1:18:21] outcomes. While the vendor performance management program focuses on contract
[1:18:26] performance, the proposed vendor suspension policy would complement that framework
[1:18:31] by providing a formal process to address more serious matters
[1:18:35] such as fraud, collusion, bid rigging, unethical bidding practices, and
[1:18:40] other forms of vendor misconduct. This represents an opportunity to
[1:18:46] further enhance PEAL's vendor accountability framework and ensure we have
[1:18:49] the appropriate tools to respond to a broader range of
[1:18:52] risks when they arise. The approach aligns with procurement best
[1:18:55] practices, and it reflects what many of our municipal peers
[1:18:59] are already doing, including the city of Toronto, York region,
[1:19:02] city of Brampton, and Mississauga and town of Caledon. Ultimately,
[1:19:08] the policy will strengthen accountability, enhance transparency, and support fair
[1:19:12] and ethical competition. Amendments to PEAL regions procurement bylaw are
[1:19:19] proposed to address the establishment of a vendor suspension policy
[1:19:22] consistent with PEAL regions approach into incorporating the vendor performance
[1:19:26] management program. Upon receiving council's approval, the amending bylaw, the
[1:19:31] director of procurement will develop and implement a vendor suspension
[1:19:34] policy in accordance with PEAL regions corporate policy framework. Under
[1:19:40] the vendor suspension policy, PEAE will have the ability to
[1:19:43] suspend vendors who have committed acts of misconduct from participating
[1:19:47] in PEAL procurement processes. For a prescribed duration of time
[1:19:51] based on severity of the actions or offences. Grounds for
[1:19:57] suspension may include convictions of crimes and offences, engaging in
[1:20:00] professional misconduct, providing false declarations, or committing other fraudulent or
[1:20:05] illegal activities. The duration of the suspensions may range between
[1:20:10] one to five - year period, depending on the severity.
[1:20:13] The policy may also include suspension decisions being made collaboratively
[1:20:17] by a joint staff committee. Comprised of the PEAL region's
[1:20:21] Chief Administrative Officer, legal services, including the regional solicitor, procurement,
[1:20:26] and the impacted program areas. Best practices and applicable law
[1:20:32] case, case law, excuse me, will inform the policy with
[1:20:35] regards to the required documentation, clear suspension, notifications, and reinstatement
[1:20:40] processes. The introduction of a comprehensive vendor suspension policy in
[1:20:45] tandem with PEALS vendor performance management program. Supports value for
[1:20:50] money, vendor accountability, and reflects PEAL's expectations that vendors conduct
[1:20:54] business with PEAL and a professional legal and ethical manner.
[1:21:01] In conclusion, the proposed change is to PEAL regions procurement
[1:21:03] bylaw are intended to support the independent nature of the
[1:21:07] rule of the Auditor General and incorporating procurement authority for
[1:21:11] the auditor general within the procurement bylaw helps to reinforce
[1:21:15] this independence. And if the rule, while ensuring appropriate procurement
[1:21:18] oversight and accountability. Implementing a comprehensive vendor suspension policy will
[1:21:24] strengthen PEAL's existing vendor accountability framework. By providing a structured
[1:21:29] approach to addressing serious matters, such as fraud, unethical bidding
[1:21:34] practices, illegal activities, and health and safety violations. It will
[1:21:38] further support the protection of the region's financial, operational, and
[1:21:42] reputational interests while reinforcing public confidence in our procurement processes.
[1:21:48] Therefore, we are seeking audit and risks committees endorsement of
[1:21:52] the report recommendations and of the amending procurement bylaw as
[1:21:56] attached in AppendixOne. So that it can be presented to
[1:21:59] council for enactment on September 24, 2026. Thank you for
[1:22:05] your time and consideration, and we would be pleased to
[1:22:07] respond to any questions the committee has. Thank you so
[1:22:11] much, and I'll open it up to committee for questions.
[1:22:17] All right, well, I'll ask a couple. Uh, so Juan,
[1:22:20] I guess I will ask our fine auditor general. Nick,
[1:22:24] can you give me an example of what a confidential
[1:22:27] procurement would possibly include in your office and kind of
[1:22:31] lead us down that path? I think it would probably
[1:22:32] be related to perhaps experts on subject matters. You need
[1:22:37] assistance on, but what would you envision would kind of
[1:22:40] need that grant authority. Uh, through you, Chair, thank you
[1:22:47] for the question. Um, I don't foresee needing to go
[1:22:50] down the path of a confidential procurement, but say, for
[1:22:54] example, solicitor next door to me has, some concerns regarding
[1:23:03] the solicitor, and I'd want to do something confidential where
[1:23:06] it doesn't go through the solicitor understanding that I'm procuring
[1:23:09] something to be assessing some of the work that's being
[1:23:13] under her watch, for example. That would be the confidential
[1:23:17] nature of any procurement in that manner. Makes sense. Subject
[1:23:21] matter expert. You want to - Not that I plan
[1:23:23] to do that. Patricia, jeez. Very good. Um, and I
[1:23:29] guess another question I will ask if there's none other,
[1:23:32] some committees, uh, and I know the answer, but it's
[1:23:34] a loaded question, but why five years? Why not 10?
[1:23:38] Why not infinity when we have somebody who's possibly conducted
[1:23:41] some kind of fraud or negligence as you described for
[1:23:44] suspension. Thank you, through the chair. Um, it is a
[1:23:50] good question. Uh, we do want to do still an
[1:23:53] environmental scan and see what are the municipalities are doing,
[1:23:57] um, and look at some case law. Um, just working
[1:24:00] with our legal services. There is some opinion that once
[1:24:05] a vendor has done the actions to repair, you know,
[1:24:09] you've done your time, so to speak. What have they
[1:24:11] taken? And if that satisfies the region or the organisation,
[1:24:16] that there is a fairness to still then continue on
[1:24:19] and have an end point to that banning. But we
[1:24:23] still have to do a bit of research to see
[1:24:25] if they're truly is a case that it should be
[1:24:28] a life ban. Um, but we are seeing preliminary. It's
[1:24:33] anywhere between one and five years. And a second question
[1:24:36] would be. So let's say, um, Acme, ink, decided to
[1:24:41] do something nefarious with, uh, of reach and appeal. Uh,
[1:24:45] and then they opened up a subcompany. Would we have
[1:24:48] the ability to track that and know that the two
[1:24:51] are linked and thereby not do business with a new
[1:24:53] subcompany. Yeah, the ways, um, I mean, the easiest way
[1:24:59] we usually contact our legal services and they do a
[1:25:02] business search if they're using the same GST number, um,
[1:25:06] then we can see the connection. If it has the
[1:25:08] same, maybe, uh, president, um, we do look at those
[1:25:13] things today. And we even without having a standard approach.
[1:25:18] But I suspect there's always probably ways that they can
[1:25:21] get away. What the difference here is that we have
[1:25:24] things in our terms and conditions that can terminate contracts.
[1:25:28] But this is really going to put out in the
[1:25:30] forefront that they're signing up for it so that they
[1:25:32] know that anytime they could be suspended and these are
[1:25:35] the periods of time and it'd be a committee. So
[1:25:38] there are always ways, I think, that people can try
[1:25:41] to skirt or get through, but I think this adds
[1:25:44] another layer of us being able to detect that sooner.
[1:25:48] Okay. Good to hear. And I see RAG's nodding in
[1:25:50] the background there. By the way, I heard Acme makes
[1:25:52] some really terrible products. They're very defective and the movie
[1:25:55] coming out of. Okay. Uh, any questions from committee? Last
[1:25:59] chance? No. We're seeing head shake. Okay. Memory. I'll ask
[1:26:03] you to put that forward. Very good. All in favor.
[1:26:07] All right. And I believe we got 5. 3 assistance
[1:26:11] payment oversight monitoring is up next. And Anila. Come on
[1:26:19] down. And over to you when you're ready.
[1:26:44] Our time is a charm. Now I have Elizabeth Stortey
[1:26:48] to co - present the results of the Assistance payment
[1:26:51] oversight and monitoring audit. Completed in collaboration with housing services.
[1:26:57] This audit focused on controls over housing related financial assistance
[1:27:02] payments. And assessed weather management, oversight was effective in ensuring
[1:27:09] client eligibility. Appropriate approvals and monitoring of program expenditures. Today
[1:27:16] we will provide an overview of the audit objectives. Scope.
[1:27:22] Key observations and managements planned and completed corrective actions. At
[1:27:31] the time of the audit, internal controls were not overall
[1:27:36] effective. To oversee and monitor housing related financial payments to
[1:27:42] clients in ensuring, compliance with internal eligibility criteria. In preventing
[1:27:50] the potential for funds being used for unintended purposes. There
[1:27:55] is a need to strengthen management oversight in areas, including
[1:28:00] payment approvals. Client eligibility at reassessments. Banking information handling and
[1:28:08] system access. Housing services is responsible for administering
[1:28:17] housing and homelessness programs. That provide financial assistance and housing
[1:28:23] support to residents across PEAL region. Due to the volume
[1:28:29] of financial assistance provided. And the importance of ensuring funds
[1:28:34] are directed to eligible clients. Housing services was selected for
[1:28:38] this review. This audit represent phase one of the internal
[1:28:44] audits review of assistance payment controls. Phase two will focus
[1:28:50] on income and social supports processes and controls. Thank you,
[1:28:55] Anila. As Anila stated at the time of the audit
[1:28:59] controls related to client payments were not satisfactory. The issuance
[1:29:02] of funds to clients is a core component of our
[1:29:05] service and helps us ensure that housing is both obtained
[1:29:09] and maintained for those most in need. The housing leadership
[1:29:12] team welcomes these observations and has taken action to address
[1:29:15] them. It has also signalled housing services to review other
[1:29:20] areas of financial investment to ensure monitoring and audit controls
[1:29:24] are effective. The objective of the audit was to determine
[1:29:32] whether management of housing services has implemented effective controls to
[1:29:37] oversee and monitor financial payments made to clients. The audit
[1:29:43] also evaluated with the such oversight and monitoring were effective
[1:29:48] in ensuring compliance with internal eligibility criteria. And preventing distribution
[1:29:53] of funds for unintended purposes. Specifically the audit focused on
[1:30:00] assessing that payment approvals and eligibility decisions were supported with
[1:30:05] required documentation on client files. Management oversight and review of
[1:30:12] financial assistance decisions to clients were effective. In identifying noncompliance
[1:30:18] and anomalies. Financial monitoring processes for the overall spending of
[1:30:25] funds were appropriately designed and followed. And finally, internal control
[1:30:31] procedures in place were effective in guiding assistance processes as
[1:30:37] well as monitoring user activity within the systems. The audit
[1:30:46] focus on T2 key processes, sorry, the audit focuses on
[1:30:52] two key housing services programs. First, needs - based subsidy.
[1:30:57] Which provides ongoing rent assistance. And second, housing stability fund,
[1:31:03] which provides one - time financial assistance to support housing
[1:31:07] stability. The audit scope covered the period from January 1st,
[1:31:13] 2023, through June 30, 2025. And included detailed review of
[1:31:20] select client files. Payment transactions and supporting records.
[1:31:34] Procedures for existing processes. The first group of observations relates
[1:31:40] to the process documentation and governance. We noted opportunities to
[1:31:45] strengthen procedures involving conflict of interest and applications involving PEL
[1:31:51] regions employees. Documentation and security of prioritization tools used to
[1:31:58] identify high - need clients. Formal procedures to client ruffles
[1:32:04] to private landlords. And formalization of monthly that are review
[1:32:09] and clean up activities. Operational practices existed in some cases.
[1:32:16] They were not always formally documented, approved or consistently applied.
[1:32:22] To address these concerns, housing has completed the following. The
[1:32:26] PEALE region staff applications for housing supports policy has been
[1:32:30] developed. This policy speaks to the identification, declaration, and management
[1:32:34] of actual and perceived conflicts of interest. And speaks directly
[1:32:38] how to handle an application from appeal employee. The housing
[1:32:42] stability program policy clearly establishes roles and responsibilities related to
[1:32:46] eligibility, assessment, decision - making, and conflict of interest. The
[1:32:51] needs - based subsidy policy has been revised to reflect
[1:32:53] the previous two - mentioned policies. It details the purpose,
[1:32:57] objective, and criteria for the administration of subsidy based on
[1:33:01] need. In addition, and currently underway. The core housing knee
[1:33:05] policy, the methodology used to identify and prioritize those in
[1:33:10] greatest need is currently under review and a power BI
[1:33:13] report is being developed to assist in client identification. Upon
[1:33:17] completion, processes, procedures, and training, as well as permission regulation
[1:33:21] will be put in place. Procedures and training are being
[1:33:25] to develop to support the by - name list policy
[1:33:27] in its administration. This process supports housing clients who are
[1:33:30] experiencing homelessness, whereas the A4 mentioned policy on core housing
[1:33:34] need. Supports those that are precariously housed and on our
[1:33:38] end or on our centralized wait list. Training has been
[1:33:41] updated and administered to reflect the above note of policy
[1:33:44] changes and subsequent procedural changes as well. A reinforcement plan
[1:33:49] has been developed, which includes an audit component and leaders
[1:33:52] in housing have been trained. All of the above action
[1:33:55] will support the integrity of housing's data, ensuring client records,
[1:34:00] housing records, and subsidy payments are administered within policy. In
[1:34:04] addition, a monthly audit review process has been established and
[1:34:08] audited mated to improve consistent and oversight. The second theme
[1:34:15] relates to management oversight and monitoring controls. These observations were
[1:34:20] assessed as high risk because they involved key financial and
[1:34:24] eligibility controls. The most significant findings included lack of independent
[1:34:30] review of banking information changes for need - based subsidy
[1:34:34] recipients. Delayed are missing annual eligibility reassessments. In our samples
[1:34:43] showed no evidence of reassessment. Limited monitoring of user access
[1:34:49] privileges and system activity within the system. Weak supervised recontrols
[1:34:56] over housing stability funds payments under 5, 000. In our
[1:35:01] sample, about 68 percent of payments lacked sufficient supporting documents.
[1:35:06] These observations highlight the need for stronger supervisory review. Monitoring
[1:35:13] and documentation controls. To address the observations noted, regarding needs
[1:35:18] - based subsidy housing will implement enhanced verification and oversight
[1:35:22] controls for the creation of new PEs and changes to
[1:35:26] direct - positive information. Examples include a landlord verification process
[1:35:30] and a process to improve the timely actioning of returned
[1:35:33] mail. The eligibility assessment and reassessment controls are being strengthened
[1:35:37] through file audit documentation as well. Training has been updated
[1:35:41] and expectations have been reinforced with staff and leadership. This
[1:35:45] work will be completed by December of 2026. For HSF
[1:35:49] payments, by October, management will have strengthened oversight and monitoring
[1:35:54] controls. Through enhanced audit requirements, targeted risk - based reviews
[1:35:59] and system controls that will flag payments that do not
[1:36:01] meet program eligibility. A check pickup procedure and check pickup
[1:36:06] tracker were created in July of 2026. Staff have been
[1:36:10] trained and a memorand of understanding between housing and income
[1:36:13] and social supports has been updated to reflect this standard.
[1:36:17] We thank ISS for its quick response to these audit
[1:36:19] findings, and we will continue to work together to ensure
[1:36:22] compliance. Lastly, by December 2026, a formal user - assessment
[1:36:27] management and monitoring process for Salesforce will be developed to
[1:36:31] strengthen security over Kline Information. Housing inventory and payment processes.
[1:36:36] This will be reviewed by annually to ensure alignment with
[1:36:40] job responsibility changes. Salesforce audit an activity reports will also
[1:36:44] be reviewed to identify high - risk functions. The final
[1:36:50] set of observations focused on financial monitoring and reconciliation activities.
[1:36:56] Housing Stability Fund Expenditures exceeded budget each year reviewed, ranging
[1:37:01] from approximately 26 percent to 46 percent over budget. While
[1:37:07] management attributed this to increasing housing pressures within PEAL, internal
[1:37:13] audit noted, opportunities to strengthen analytical review of spending trends
[1:37:19] and payment activity. Or it also identified the disbursement records
[1:37:25] were not reconciled directly to banking rackets. An enhanced financial
[1:37:31] monitoring plan has been implemented. That defines steps to analyse,
[1:37:36] record, and report on financial payments, trends, anomalies. And overall
[1:37:42] budget expenditures. This information is reviewed monthly and quarterly with
[1:37:46] our finance business partners and documented in our financial narrative
[1:37:50] to inspenditures align with budget. Reconciliation between bankroids and sales
[1:37:56] force has been enhanced through daily and monthly reconciliation and
[1:37:59] monitoring. Recording within a financial narrative as well in partnership
[1:38:04] with our financial business partners. An example is the review
[1:38:07] of daily sales force reports of issue checks cross -
[1:38:11] reference with information oftained from RBC Express. In conclusion, at
[1:38:19] the time of Audit, internal controls were not overall effective
[1:38:23] to oversee and monitor financial payments to clients in ensuring
[1:38:28] compliance with internal eligibility criteria. And preventing the potential for
[1:38:33] funds being used for unintended purposes. There is a need
[1:38:36] to strengthen management oversight in areas, including payment approval. Client,
[1:38:42] eligibility, reassessment. Banking information handling and system access and activity.
[1:38:49] Management has developed or completed action plans since the conclusion
[1:38:53] of the audit to address the RESC's identified. This concludes
[1:38:58] our presentation and we are happy to take any questions.
[1:39:02] Okay, I'll open it up to committee members first. There's
[1:39:05] any questions members. I could climb down a few rabbit
[1:39:13] holes here, but I guess maybe I'll ask one where,
[1:39:15] uh, you're talking about enhancing the reconciliations between the bank
[1:39:18] statements and the FONSO going. Who's going to perform the
[1:39:22] reconciliation? Is it finance or is it the department? It
[1:39:25] is the program area in partnership with our finance area.
[1:39:30] Okay, and you said, what was the frequency again? You
[1:39:33] were going to do? There are daily audits that are
[1:39:35] done to cross - reference payments that go out on
[1:39:36] a daily basis and then there's also a series of
[1:39:38] monthly audits as well. Okay. And what will be the
[1:39:43] escalation method. When the differences that occur. They'll be on
[1:39:47] a daily method. There'll be immediately escalated to the manager
[1:39:49] for consideration for discussion across with our business finance partners
[1:39:53] and on the monthly basis LBS leaded to the director
[1:39:55] level as well if they, if the seriousness requires such.
[1:39:58] Okay, and I guess you've got financial thresholds around all
[1:40:00] that. Um, supervisors have financial thresholds and then anything above
[1:40:05] that goes forward to the manager for approval. And that's
[1:40:08] where we stop within the limits of the programs. Okay.
[1:40:13] And you also mentioned about check pickup. Do we do
[1:40:17] still a substantial amount of physical check. For the, um,
[1:40:22] we do, um, solely check pickup. Okay. We are working
[1:40:27] towards an automated system that is on our technology list
[1:40:30] of projects. Um, and we would work with ISS and
[1:40:32] partnership on that process because that actual process is managed
[1:40:35] by them. Check pickup window and human services. So is
[1:40:38] that our internal challenge with systems or is that also
[1:40:42] what the applicants are looking for because they're unbanked? It
[1:40:45] is a priority on our IT work plan. All right.
[1:40:52] And I see I've triggered member Emmerick. Go ahead. Oh,
[1:40:59] commissioner, did you want to hop in first or would
[1:41:00] you. See the chair? Just on that last point, it
[1:41:06] is the, uh, recipients discretion as to whether or not
[1:41:10] they want to participate in an automatic. Deposit or check
[1:41:15] pickup. As you noted, some are do not belong to
[1:41:19] a bank. But some do wish to pick that up.
[1:41:22] We always encourage individuals to take the direct deposit. We
[1:41:27] help them with any identification issues that they have, get
[1:41:30] them set up with the bank of their choice, let
[1:41:32] them know what their options are within the community. We
[1:41:35] really encourage them to do that. Otherwise, they're going to
[1:41:38] a third party COT check caching, which we know is
[1:41:41] very, very expensive. Um, to them, um, and, um, so
[1:41:45] we really do that. But the reason we still have
[1:41:48] check pickup and Czech production is because individuals have said,
[1:41:52] I don't want or they end up opting out for
[1:41:55] a variety of reasons of automatic deposits. So unfortunately, um,
[1:42:01] it's still going to be, hopefully a small percentage of
[1:42:04] the work that we do and how we issue it.
[1:42:06] And we really do encourage individuals to, to get onto
[1:42:09] that automated process for their own protection and to ensure
[1:42:12] that they're getting all the funds that, that are due
[1:42:15] to them. Thank you, Commissioner. That was some of what
[1:42:17] I was thinking and more than I had thought to
[1:42:20] myself as well. Cause yeah, that's a real challenge I
[1:42:23] can think. And also checks go missing. Checks get damaged.
[1:42:26] And then for reconciliation, you get checks that never get
[1:42:28] cached. And then the physical cost of producing them in
[1:42:31] the first place. All right. Um, memo Emmerick. Go for
[1:42:33] you. Thank you through you, Mr. Chair. You mentioned monitoring
[1:42:38] user activity. It'd be audited using Salesforce Audit tools. That
[1:42:43] answered part of my question. Second part is will audit
[1:42:46] be involved in helping to review or configure those, uh,
[1:42:49] audit triggers? Yes. Weekend for what. Through you chair. We
[1:42:56] can provide advice on the processes that they have created
[1:43:00] and work with them. Thank you. All right. Some good
[1:43:06] questions. I don't see any more. So motion two accept.
[1:43:12] Emmer Emmerich. Very good. All in favor. Excellent. All right.
[1:43:16] We have one last item. 5. 4 status of 2026
[1:43:20] internal audit risk based on work plan. Jennifer, over to
[1:43:25] you. Thank you through the chair. I
[1:43:35] just wanted to, uh, provide a few words, um, on
[1:43:38] the report before you. It's, uh, September. So we're at
[1:43:43] almost 75 percent of the year. And my team has
[1:43:46] had a successful year in terms of their progress on
[1:43:50] our 2026 work plan. We have or will have started
[1:43:56] all projects that are possible for us to start as
[1:44:00] indicated in the Appendix to the report. And as, uh,
[1:44:03] Nick has also talked about, uh, his team is going
[1:44:06] to be doing the community investment program audit, um, was
[1:44:10] on the initial work plan, uh, for internal audit. And
[1:44:13] then, uh, we also have a project around, uh, quality
[1:44:17] assurance, a limited quality assurance review work for the next
[1:44:21] phase of the SAP implementation. And we await when that,
[1:44:26] that work progresses to start to provide our quality assurance,
[1:44:30] uh, on that, on that project. So that has not
[1:44:32] commenced at this time. But otherwise, we are, uh, on
[1:44:35] pace to start all the remaining projects in the work
[1:44:38] plan. Thank you. Excellent to hear any questions. I don't
[1:44:43] believe so. Thank you and Chair Anicua will, uh, we'll
[1:44:47] move that. Very good. Well, that brings us to the
[1:44:49] end of our discussion. I just want to say this.
[1:44:51] The last meeting we're going to have in this, uh,
[1:44:53] you know, uh, memo Emmerick, you have a comment before
[1:44:56] we go. It's been four years and I still have
[1:45:04] trouble with the speaker. No, I just wanted to, uh,
[1:45:07] to thank you and the elected members of the, of
[1:45:10] the committee for allowing me to participate these last few
[1:45:13] years. It's been an interesting experience. I found it quite,
[1:45:17] quite, uh, challenging at times. And I feel it's been
[1:45:21] a good experience. Staff may not be able the same
[1:45:23] way. But, uh, but, but I certainly do. And, and
[1:45:27] one other thing, because it is, uh, an election year,
[1:45:30] I do want to congratulate all candidates, both incumbents and
[1:45:35] those hopefuls looking for a position. They've put their names
[1:45:38] forward. Takes a great deal of courage. Uh, shows, uh,
[1:45:42] willingness for public service. And you should all be congratulated,
[1:45:46] whether successful or not. So good luck with everything. Thank
[1:45:49] you very much. That's very kind of you to say.
[1:45:52] And with the wisdom of our public, maybe we'll be
[1:45:54] back, hopefully, for those who are trying. And I just
[1:45:57] want to thank the staff, uh, both the internal audit
[1:46:00] staff, uh, you know, I've worked with you the most
[1:46:02] over the last couple of years. You've always been fantastic.
[1:46:04] The senior leadership staff. Thank you for all your support
[1:46:06] on all the different files and all the different audits
[1:46:09] that have come through your departments. Greatly appreciated. And our
[1:46:12] new auditor general, Nick, it's been good to the short
[1:46:14] period of time. We've had the chance to work together.
[1:46:17] And, you know, in the support staff who make the
[1:46:18] meetings happen. And who give us nudges when we need
[1:46:22] chairs, appreciate that kind of thing, don't they, Mr. Chair?
[1:46:25] All right. And with that, I will, uh, call the
[1:46:27] meeting to close. And I will see you in 2027.
[1:46:30] Fingers crossed. Thank you. Bye - bye.