Back to Archives

Austin's Tech Risks & Business Diversity

Wednesday, October 24, 2018 Audit and Finance Committee Regular Meeting
  • Boosting Business Equity:

    The City is streamlining minority and women-owned business certification by extending terms and eliminating annual renewals. A new pilot program aims to improve how firms are notified about contract opportunities, addressing concerns about participation.
  • Improving Ethical Accountability:

    A report highlighted low employee confidence in the city's ethics process and a significant gap in accountability, with the Ethics Review Commission acting on only 33% of cases compared to 100% by city management. New policies on gifts and resource use are in development.
  • Urgent IT Security & Strategy Lags:

    Critical recommendations from a 2013 audit on IT strategic planning and risk management remain "underway." Discussions revealed concerns over fragmented systems, resource shortages, and unclear authority for the Chief Information Security Officer, prompting calls for executive session and immediate action.
  • Scrutinizing City Contracting:

    A special report summarized findings from years of audits on the city's extensive $5.5 billion contracting practices, identifying recurring risks and ongoing areas for improvement in contract management.

Full Transcript

Audit and Finance Committee Meeting Transcript – 10/24/2018 Title: City of Austin Description: 24/7 Channel: 6 - COAUS Recorded On: 10/24/2018 6:00:00 AM Original Air Date: 10/24/2018 Transcript Generated by SnapStream ================================== [9:39:26 AM] >> Troxclair: We have a quorum so we're going to get started. Welcome to this month's meeting of the audit and finance committee. It's 9:39. The first item is approve the minutes of the September 26 meeting. Is there a motion? There is. Second? All those in favor? And the minutes are approved mayor pro tem tovo let me know she will be running a few minutes late and hopefully mayor Adler will be here soon. Citizen communication, I don't see anybody signed up. So we will move on to -- well, the next thing is item number 7 which is the quarterly update from the small and minority business resources department. We'll go ahead and do that and put the rest of our agenda in order. Hi, Veronica. >> Good morning, council. Director of small minority business resources department. Thank you for accommodating our request to go first. I appreciate it. We are here with our first quarterly report. As you all recall when the council committee system changed a bit and the council committee for mbe, WBE, was no longer in existence, one of the recommendations is we come to this committee and start presenting quarterly about the mbe, WBE program, smbr and what we have been up to. This is our first time to present to you, but we will come back quarterly moving forward. I wanted to highlight some of our major initiatives that we've been working on this past year. I wanted to start with our 2016 mobility bonds. Those are underway with a corridor improvement program in particular. Part of that included a requirement that there's a mbe/wbe outreach plan developed. [9:41:29 AM] The consultant has done that and we're in the process of implementing those action items from that plan. And you'll see those action items come before you in a series of steps moving forward. The first -- the first -- or one of the first changes that will be coming forward is on November 15 at your next council meeting in a couple of weeks. This is ordinance revisions that were recommended through the plan, specifically the two changes that will be made will be first to extend the term of a certified firm from three years to four years. And second to eliminate the annual requirement for a renewal of certification every year. So these two changes we believe will help make it more efficient, specifically for the corridor plan, but overall as the city does business, if a certified firm stays certified longer, that will ease the process for the prime -- so the prime would not have to deal with the issue if a certified firm loses their certification on life of a project. With eliminating the annual review, we're hopeful this will ease the administrative burden on a certified firm and reduce the opportunity for a certified firm to lose their certification. The next recommendation that we have been working on is our good faith effort pilot program. This was also one of the recommendations out of the mbe/wbe outreach plan for the corridor improvement program. And specifically this recommendation was that we when we're looking at if a firm is compliant through good faith efforts, good faith efforts, we'll back up, as you are aware, a prime consultant is compliant with our program either by meeting goals or providing good faith efforts. When we're looking at good faith efforts, it's a series of steps that the prime must take to show that they did demonstrate good faith efforts. What we are proposing in this pilot program is smbr will have the responsibility of the first step which is the step of notifying certified firms about the opportunity. [9:43:30 AM] In doing this we are hoping it increases opportunities for mbes, WBE -. They will be hearing from smbr directly and hearing from all the primes that intend to bid. We've heard feedback from mbes, wbes there is administrative burden because when they are being solicited they are receiving a lot of notifications. We are hoping to streamline that into one notification from smbr. The remaining steps, they are ride to do that and we'll have to show evidence they have done that. We amended the smbr rules to allow for this program. We have prescribed in the rules that we will identify three to five projects where we will see if this works, see if this does provide some efficiencies but also increases participation for our mbes and wbes. If at the end of the day we perform on these problems, we will reengage on our stakeholders, discuss with the primes and subs, get feedback and if it was a success, then we will look at rolling it out on the corridor improvement projects. If it didn't go well, if it didn't meet the metrics that we established, then we will not move forward with implementing this on the corridor improvement program. Are there any questions? That was a lot. Any questions on this particular program? >> Troxclair: Mayor Adler? >> Mayor Adler: The pilot program on good faith is something that at least some of us if not all of us have been contacted by some folks including the -- the hispanic contractors association. And I think they filed an appeal with the manager of the rule. Is it possible to get -- so that I can be clear on the issues, just a really short memo that says this is what we hope to accomplish and this is what we're going to be looking at in the pilot program to see whether it was successful? [9:45:44 AM] And also something so I can better understand it, this is the concerns that have been raised by the -- the subs, contractor association. This is their fears. So that we know when we do the pilot we're looking at those as well. Just so that when we do -- and then the projects that it's being piloted in. Those three things. If you could do that, then everybody knows up front how we're going to be evaluating at the end of the pilot, what we're going to be looking at so we'll know what success looks like or what problems we're going to be watching to see if they occur. That would be really helpful for me. >> Absolutely. We are well aware of the concerns raised by the hispanic contractors association and we have been working with them as well as other stakeholders. But in anticipation we had a memo to council on how we plan to move forward to assure concerns are addressed. >> Mayor Adler: Those three things. How we know it's a success, what we're looking at as objective as you can make that. I don't know if it's possible or not. Can look to see whether they materialize and then where it's being piloted. >> Yes. >> Troxclair: Councilmember pool. >> Pool: And just to pursue that line a little bit further, because the hispanic contractors association and various other subcontractors and smaller entities in the city have, as we all know, been concerned, I guess for almost the four years that I've been in office certainly, about their in ability to qualify for contracts. Like the tree trimming contract was a good example of that. In your conversations with these various minority and women-owned businesses, the gap that they have identified in the past, how do you feel that the city has worked -- how much of that gab do you feel like the city has closed for our women and minority owned businesses? [9:47:49 AM] >> I think it's a work in progress. I think we continue to have those discussions. It's certainly something we are concerned about. I will say specifically to the mobility bonds in the corridor program, what I'm really -- I've enjoyed seeing because we have a subconsultant and the subconsultant is actively working on engaging the mbe/wbe community, I see that needle moving a little more. We're having discussions on the front end about how these -- as you all know, this is a very large mobility bond package moving forward, how are we packaging the solicitations, where are the opportunities, where are opportunities to build capacity for mbes and wbes, where can we engage at the prime level as well. I'm hoping at the end of the day when the mobility bonds are complete it will be a success story of how we actively engaged and closed that gap. For the rest of city of Austin contracting, that's a discussion that I -- that we are always having with both James Scarborough, purchasing offer, and Ronaldo. We are interested in closing that gap and ensuring we have opportunities for mbes and wbes to work with us. I think we're going in the right direction. We can always do more. >> Pool: Great. I would be liking for the sustainability going forward with those efforts. >> Absolutely. >> Pool: And inclusion. Thanks so much. >> Troxclair: Thank you. >> Sure. >> Troxclair:. >> The next item is our software system that we're working on. It was included in our annual budget that you approved. The company is called b2g now and our goal is to automate the processes smbr has. There are a lot of our processes that are paper focused. So it will automate those processes for the vendor, but also streamline what we're doing on the back end. [9:49:53 AM] We're working to implement the system and we noted ctm, but also working closely with our finance department to ensure all the city's systems are communicating with each other. Our goal is this an efficient process, not make it more difficult for vendors or staff in the city. And then finally I have noted on here our next disparity touchdown I. Our -- the reality is our current data is dated. We're at the last disparity study looked at data that is now about ten years old, so we're bringing an rca forward to you in December to looking at a new contract to complete the next study. Also as a pre minder, our ordinance sunsets at the end of March 2020, so that gives us time to conduct. A disparity study takes a year to conduct. That gives us time before the ordinance sunsets. We're attempt to plan ahead. >> Troxclair: When was the last disparity study that we conducted? >> Let's see, we're in 2018. 2015. It started in 2012, finished in 2015. So I should say, although it was completed in 2015, when you are looking at when it started in 2012, 2013, it was looking at data starting in 2008. That's where I got the ten year study. A good study will look at the previous five years of data so that brought us back to to it 2008 so we're now in 2018. The interest in updating our data. >> Mayor Adler: When we did the last disparity study it got embroiled and held up on the enumerator and denominator. [9:51:54 AM] Have we squared all that? >> As we move forward, the consultant that will provide the new disparity study, we're very certain about how that data needs to be compiled. We've in this period of not doing a disparity study, we've worked at cleaning up our data on our end so we're already getting that in line. So yes, we had a lot of lessons learned in how we as a city need to provide that data to that it produces the study that has the accurate data reflected. >> Mayor Adler: Very good. Probably good to touch base with whatever the stakeholder groups were, I think there were probably three or four, so they know as you are entering into it that those concerns have now been addressed proactively. >> Absolutely. We will -- that's a good idea. We will schedule a meeting with the stakeholder groups to answer any questions they might have on the front end. This contract you will be considering will including I believe subconsulting for outreach. Our intent is include them and engage them actively in this process from the beginning. >> Mayor Adler: Thank you. >> So I wanted to include some of our -- we just closed our last fiscal year. This gives you an idea what we as a department do across the board. I'm going to start with our compliance division. These are just some of our performance measures. The first is the percent of compliance documents reviewed within seven business days. This is a -- this is stipulated in our mbe/wbe ordinance. Our goal is not slow down the solicitation process at any point. The goal was set for 90%. This past year we achieved 79%. Could do better and I will acknowledge that when we're looking at a performance measure like this, it's -- first of all, there's a lot of unknowns. We don't know the extent of a review until we receive the documents. It could be that arime contractor is not compliant or hasn't provided good faith efforts and that takes extended time. [9:53:56 AM] It also, if we have any kind of staff turnover, that could affect this as well. Seven-day business rn-around is tight but an important one. The next -- the next metric is the total percent of compliant bidders and proposals. The goal is 80% and we actually hit 91%. This is how many folks are compliant versus noncompliant. We're seeing that more prime contractors and consultants are compliant in 2018. And then the percent of prime firms that are meeting the goals, this is a number that we started tracking in the past several years because we kept on hearing in the community the contractors are never compliant by meeting the goals. They are only compliant by performing good faith efforts. And we have since then have hovered around that 90% mark. 90% of the time the contracts that you review on a council agenda are meeting the goals set in the solicitations. I think that's an important one to note. Moving on to our certification division, also stipulated in our ordinance is the percent of certification documents to be reviewed in 60 days. Our goal is 100%. We are at 97% so I'm confident in that number. It's not at 100%, there's room to improve, obviously, but again this is a tough one. It's a tight turn- around time. There's a lot of documentation that goes into a certification application. And again, if we have any kind of staff turnover, this could impact this number. But we will continue to strive to that 100%. >> Troxclair: Is 100% like a reachable goal? Is that the right number? Should you be able to account for staff turnover or -- >> I think anecdotally I should be able to account for staff turnover or unknowns. Some of these numbers are in our ordinance. The ordinance actually states we will complete a certification review in 60 days. So I do feel 100% is the correct goal. [9:55:58 AM] We should strive towards hitting that. The number of certified mbe's and wbes, the goal has been 1,000 for a while and this is the first year we hit it. It's the first year in a while. We had been at 1,000 certified firms many, many years ago, but we've been in that 900 range for a while and this year the team really made it a conscious effort, they really pushed and got it to over 1,000 and we've been over 1,000 since may so I'm really proud of the team for getting us to that number and increase in number of certified firms. And then finally, our resources group. So one of the things that we do is certify -- survey our mbes, wbes to see their -- if they are satisfied with what the service they are receiving from our department. Our goal is 97% and we achieved 98% last year so we're happy with that. Finally, we have an employee who works with businesses to talk about bonding. We don't provide bonding as a city, but he serves as a conduit to businesses and to the bonding resources in the community. So we track how many of these clients actually received bonding through his efforts and our goal is 15 and we achieved 16 this year. So we're proud of that number as well. And that concluding my presentation and our performance measures. Before I open it up for questions, I wanted to make note of one last thing. The mbe/wbe citizen advisory committee has had difficulty meet this year. I wanted to take opportunity to bring it to your attention. They've had a difficult time reaching quorum. They've had a series of recision nations and vacancies on the -- resignations. We submitted to the clerk's office but we could use help from you to make some appointments so that they can -- we have a core group of committee members that are very anxious to meet and it's very important to them and we would like to do what we can to assist in that. [9:58:01 AM] We're happy to recirculate that report to you as well. >> Troxclair: Councilmember pool. >> Pool: Just to follow up on that, is it 11 members total on that commission and how many are you down to now? >> So we have a core of five members that are active. We technically only have two vacancies, so there's nine committee members, but four have resigned and they haven't actively been removed from the committee is our understanding from the clerk's office. >> Pool: How come you have nine commission members? Tell me again the panel that you are talking about. >> This is the mbe/wbe advisory committee. There's a total of 11. We have two vacancies and nine committee members. >> Pool: Okay. All right. And just one more question. When they determine the quorum, they are determining a quorum of those in attendance, right, not of the total body? >> It's of the total body. >> Pool: I don't think that's necessary. I know it is for us, but in looking at our code and the requirements for quorum, the -- if I'm remembering right, and I just read it over the weekend, on commissions the quorum of those present is -- a majority of those present is the quorum for action. Which is different from the city council. So I don't know if this particular group that you are talking about is the same as regular boards and commissions, but that should be looked at and that may take care of some of the -- some of the problems. >> Absolutely, we can definitely look -- >> Pool: You would still need to have six people coming. >> Yes. >> Pool: And then back to your slides, the one right before questions where you have number of clients who received bonding, the goal is 15 and you got 16. What was the total universe of those applying for bonding? Do you have that? >> There's 51 we met with, 51 clients that came for services. [10:00:04 AM] Of those 51, 16 received bonding. >> Pool: Okay. Is that -- is that a typical number that -- I assume that it's a pretty rigorous process. >> I would like to see that number higher, but when we hear -- often we hear as one of the major barriers for small businesses is receiving bonding. It's so much of it is dependent on the individual's credit, on the financial strength of the business, so it is -- it is quite a difficult task. So we are proud in that we're moving forward with those 16. >> Pool: That you were able to get 16, right. I guess I would also be interested to know how much the city assists in the education and compilations of the data that's necessary, how much do we lend a hand. >> This is -- absolutely we think this is a very important. We do a series of outreach sessions. The individual that we have on staff is very knowledgeable and those requirements and he provides that one on one in the meeting, the meetings that we mentioned, but he also provides outreach sessions where we invite the entire contracting community in to learn about it. We've also partnered with other entities. Most recently with the hub program, I believe it was with the U.T. Systems, where they came on our office. We hosted a lunch, we talked about those requirements for bonding. So universally the contracting community sees this as an issue. It's not just the city of Austin, it's other governmental entities as well, so we work collaboratively with those groups to try to get that word out and educate what is needed. >> Pool: Is it -- is it appropriate to do kind of one on one mentoring if somebody has applied over a succession of years and they still have failed and we sit down with them and walk them through about where the gaps in their application may or or where they have fall even short and maybe has been a consistent problem or maybe it's a different and new problem and fix one and that kind of thing? [10:02:07 AM] You can tell I don't really know what's involved in getting the bonding, but I recognize that it's a pretty important status for a contractor. >> Absolutely. We do provide that one-on-one assistance, and I believe -- the individually have on staff has been with us many years. I believe he has long-lasting relationships and because it's such a personal matter, his approaches to respect where the business owner the coming from. He's willing to advise as much as they would like, but respecting the fact we're talking about an individual's finances and cognizant of that as well. >> Pool: I think if we send the message we are here to help and if they are interested and would request it we'll going to the map to try and help. >> Troxclair: Councilmember alter. >> Alter: Thank you. I have a broughter basic question I need clarification on with this program. So we usually see, you know, the prime and the prime is very often not minority or women-owned business and then you have the goals set for the minority and women-owned businesses. There are sometimes when we see that the primes are minority and women-owned businesses. How does that affect their goals? It seems like they have to do the same goals even though they are the prime and meet the goal, which doesn't seem all that -- like it's reaching the spirit. I'm wondering if I'm missing a piece of how this works. >> That's a great question. When a prime is themselves a mbe or WBE, they can count their participation towards that goal only. As you know, usually the goals you are seeing are what we call ethnic subgoals. You have a WBE goal for the women, African-American and hispanic and asian-american, native American goal. If I were the prime on a contract, I could count my participation to the hispanic goal or the W goal but not both. [10:04:08 AM] I contribute to the hispanic goal, I would still have to meet all those other goals or show that I performed good faith efforts. >> Alter: And you can't count them towards both. >> I can't count them towards both. >> Alter: Is that federal constraint or a state or city constraint that you can't count it towards both? >> To clarify, are you saying because of the women and hispanic or -- >> Alter: As I understood what you just said, you just said if you own a business, you would be able to qualify for either the women or the hispanic, but you can't count it towards both even though you could be doing 90% of the work. So I'm wondering if that is a constraint that's in our -- our ordinance or is that from state or federal guidance? >> It is in our city ordinance. A duly certified firm. So an ethnic minority female can only count towards one goal but not both on a contract. Now, I could receive two contracts and be counted towards hispanic goal on one and the women goal on another, but you can only go towards one goal. >> Alter: Doesn't that make it harder? I mean -- >> So the duly certified certification came forward, gosh, probably ten years ago in the ordinance, and I believe the council's intent at that point was to increase opportunities for others. So if hispanic woman has a contract while it encourages her to meet the hispanic goal, it also -- she's giving another opportunity to a woman-owned firm. I believe that was their intent but I don't want to speak for councils for years past. >> Alter: I would be curious if that's practice. I haven't deeply studied this, but seems part of what I've heard from my colleagues is trying to find those opportunities by checking the contracts in different ways so folks can be the prime, and it would seem to me we would want to do everything to get these businesses to be able to prime, not just subprime. [10:06:18 AM] And that would be a higher order goal. And so we would want to structure our ordinance to facilitate that. >> Then I think I maybe misunderstood your question. If you are a prime, your participation does count towards the goal, to be clear. >> Alter: Right, but you said it only counts towards one of the goals. Seems to me if you wanted to facilitate more minority and women-owned businesses to be the primes, allowing them to count it twice as long as they are doing that much percentage of the work would make it easier for them to be the primes. Which should, in my mind, be more of a goal than having so maybe we can -- you can maybe share with me off line a little more about where that originated and some background that might provide further information. It does lead to my second question which is how often have we gone out and looked at the best practices from other cities and states in this area? I know I have opportunities to speak with someone in new York that helps the minority and women-owned businesses get the contracts or -- and/or the companies to be able to be in partnership with those firms, and they seem to have much higher goals and it's not just based on the number of firms. You know, there's mandates and there's other things that they are doing and they seem to be achieving a lot more than we are, and so I just wasn't sure, when was the last time we went out and looked at the best practices and compared that to what's in our ordinance? >> We continuously look at best practices. It is -- one thing to note is that the procurement laws do have an impact on what we do in terms of our solicitation. So we do -- we do look at best practices nationally, but it's helpful to also focus on the state because they are dealing with the same procurement laws that we are. [10:08:24 AM] We are a member of the Texas unified certification program, that's the other main large cities in the state and we meet with them once a quarter, but we also continuously dialoguing. Any time we talk about looking at something we're doing, we look to our peers to see if they've done it or not. I will note Austin is seen as a best practice. We have a national conference in this arena and we are routinely asked to sit on panels, seen as a leader in our industry so I am often approached by peers. >> Alter: Thank you for the clarification. >> Troxclair: Thank you. >> Thanks. >> Mayor Adler: Wonderful event last night. >> Thank you. I should have noted that. We're coming on of the eve of our contractor appreciation event, it's our annual celebrating diversity event. We recognized great contractors and consultants that are champions for our program as well as city staff members that are not at smbr to really worked to achieve our goals as a program. We appreciate their support and appreciate you, mayor, for attending our event. Thank you. >> Troxclair: Thank you. Item number 3 is the integrity unit fiscal year 2018 report. >> This is a report that we give at least once and sometimes twice a year. It's an update on our investigation related activities and Brian Malloy, chief of investigations, will present. >> Good morning. Brian Malloy. Do we have our power point ready? >> It's right there. I'm sorry. >> Today I'd like to cover our activities over fiscal year 18. [10:10:28 AM] We're going to discuss allegation trends, investigations we've completed, accountability actions taken as a result of investigations and a note about the environment overall. So our office has received 275 reports of allegations in fiscal year 18. About a 9% increase over the previous year. But still fits within our general trend over the last four years so it's a number we expected to receive. Those reports led to eight investigations that were completed in fiscal year 2018. Those eight investigations ultimately resulted in one unsubstantiated case, two in in con exclusive cases. Sometimes the goal is to prove violations of city code occurred. And that's not our goal. Our goal is to conduct thorough and complete investigations so we're just as proud of a well run investigation that had an unsubstantiate finding. We reported on six cases. I just mentioned there were five completed substantiated case and the reason we reported six is the first one involving the -- finished right at the end of fiscal year 17, but the report was issued in fiscal year 18. Now, of our six published reports, four -- yeah, four followed our standard procedure where we published the report and then delivered to the department involved and the department involved then decides how to respond however they see fit. In all four of those cases, the relevant department took an accountability action to the -- administered some sort of disciplinary action, in two others the employee resigned. The remaining reports we had to file with the erc due to subject of T reports, in both cases we don't have an ultimate outcome due to delays in hearings. [10:12:30 AM] They are still just pending erc review. That brings us to our next slide, which is -- goes over all the reports that we've had to file with erc. The reason we wanted to include that today is your committee, the afc, has purview over the ethical environment and we think the accountability actions fit within that. Originally constructed the erc focused on campaign finance and election issues and they were given purview over ethics complaint for a subset of employees or city officials that aren't covered by municipal civil service. Started in 2016 we started filing complaints with them when he had investigation of one of those employees. In that time we've had six cases go through the whole erc review process. Only two of those was a accountability action taken at the end of the process. That's two out of six, 33%. Now over that same time frame we would like to compare to when we follow our normal process and report our substantiated finding to city management. In that time frame 100% of the time we filed a report, accountability has been taken by city management. So that disparity in accountability action is something that's got our attention, we've been focusing on recently. We would like to tie that into the overallette Cal environment of the city. Our office believes transparency and accountability are two of our goals and can have a big impact on thette Cal environment of the city -- ethical environment of the city. A you few stats is that when asked if I have a complaint in my department it will be handled fairly. Only 52% of city employees were able to answer yes to that question. When asked employees can report unevident Cal behavior -- only 59% answered yes. Proper action will be taken by my department if wrongdoing is discovered. Only 56% of employees were able to answer yes. [10:14:32 AM] And we see that possibly increased in accountability action may be able to help us increase these answers since there is clearly room for improvement. That concludes my presentation. I'll be happy to answer any questions you guys may have. >> Troxclair: Mayor? >> Mayor Adler: Two issues. First one that you point out that there's greater follow-up with the issues that are raised with city staff, the manager's office. But the percentages that reflected when employees react to that question, obviously lower than what you would like to see. What's the recommendation for changing those percentages? Is there a best practice for those? >> So I don't think we have any silver bullet recommendations. I know we want to -- we think if we have a higher percentage of cases that result in accountability actions, we'll start to see an increase in positive answers to that question. And so we're analyzing what we're doing right now with how can we be more persuasive when we present to the erc to hopefully get them to agree with us. We also think there might be an education issue at the bottom. As I noted I believe the erc was founded to look at campaign finance issues ab then given this new purview over ethical complaints. So it could be that some of those members could benefit from more education from city staff or the law department about city code, about city violations, what sort of evidence the law department is looking for when they are giving advice on whether a violation occurred. We rely on the law department to help us complete our investigations, and if we are all coming from the same understanding at the start, we would have a more -- we would be able to present a case that they are expecting to see and our expectations about what evidence is required would match their perception of that as well. [10:16:39 AM] >> Mayor Adler: So what we're talking about, there's the universe -- we're talking about the 275 allegations received. Is that the universe people are reacting to, do you think? >> I'm sure that has a factor in it. That the employees answering those questions. Are definitely coming from perspective of all allegations reported to our office. I think where we can have the biggest impact is the ones we report on that receive that trains -- transparency, being able to link those to accountability. >> Mayor Adler: The six. >> That six that go to the E rc are the ones we're looking at because of lack of accountability action there. >> But I do think, just to add to that going back to what you said, the 275 is a piece of the universe. There are even more complaints that would go directly to management or hrd. Within our purview we talk about the 275 that came through our hotline. Half of which, give or take, we refer out to somebody else. But there's definitely I think even a larger than that universe and I think you've asked questions about that in the past that either go to hrd or directly to departments. >> Mayor Adler: I just wonder if really the six drive the 59% and 55% numbers. My guess would be that it would be a greater universe than that. And I don't know if we're auditing or following up on what would really impact the 59 or 55% number, and I don't know what that would be. But in terms of this before you put this aside, you might want to think about what would be the thing that we could be doing proactively to impact that issue at that level. Maybe it's following up a little bit more to better understand the 59 and 55%, if we needed that to hone in on it. [10:18:42 AM] >> Absolutely. There's several avenues. >> Mayor Adler: It seems as if -- there's no comparison with that, but it seems as if that's a number where our employees are saying they are not confident in the process. >> Right. And I think we have been analyzing that in historic information and we have a grouped, management integrity committee, that's a citywide group that includes a representative from city manager, my office, H.R., law, various parties at the table. And I think this is something that we need to look at that kind of analysis of those numbers and see what do we need to change, what can we do differently. Is it improving or declining, those kinds of things certainly. And I wouldn't say our six cases are directly tied to those results. It's just that within at least the things that we've been doing, we feel like that's an area where we really need to focus and where we have control to focus. I don't think we can -- we aren't necessarily the party that's responsible for the entirety Cal environment of the city -- entire ethical environment of the city. >> Mayor Adler: My point exactly. That what you -- your universe is the six, and I think that's a good thing to take take a look at, but there's another universe probably impacts the 55 and 59% numbers that's not you, but from your perspective, you might be able to point to things the system could do proactively to look at or a body to take a closer look at what needs to happen internally with respect to the larger universe and the more general framework on how much confidence people have in the process. >> Troxclair: Councilmember alter. >> Alter: Thank you. I'm not sure that the word "Complaint" means the same thing to people responding as it does in this case and that is probably explaining part of it, but I definitely agree that it would be good to improve those numbers. I just wanted to ask Ms. Stokes to share a little bit about the working group's work. [10:20:47 AM] We had talked about kind of what policy changes might be in order in relationship to this audit, and you had brought up potential changes to the gift policy and the diminus use and that come back to audit and finance when you have moved far enough for us to review. >> Both the city's gift policy and diminus use policy, applies to use of city resources and we don't currently have a diminus use policy. Those are both things we've been discussing as part of the management integrity committee. Also we have kind of a subgroup working on that with law, human resources, ctm and my office. And the -- the concept there, I believe they are coming to come to audit and finance committee perhaps at the December meeting, but to present changes that make those policies a lot clearer or employees. I think that will help us. In terms of what we refer a lot of things, but there are a lot of things that people believe are violation of that policy that I think if the policy is clearer will not necessarily come through our office. Or if they do come through our office, they will be referred out to departments appropriately. So I think those clarifications have been warranted for a long time, but do need to come back through. There are still several stakeholders that need to weigh in on them, and once we collect that stakeholder input, we'll bring those back to this committee and ultimate will you -- ultimately full council. >> Alter: Thank you. >> Troxclair: Anyone else? Councilmember pool? >> Pool: I'm looking on the -- what did we report slide, and I just was curious the types of violations and the accountability action, and two of them -- I think I remember reading about almost all of these, but the two that are pending review, are you able to give us general information on what those two are about? [10:23:00 AM] >> Yeah, sure. The Austin energy case, that involves an employee who we believe falsified his time sheets. He took time off, either was out sick or not working for various reasons, but then recorded eight hours of regular time. He retired before the report issued so that's why he's going to erc. They have purview over former employees. And then he was paid out on all that vacation time he didn't use. That's gone through its preliminary hearing so a final hearing is scheduled for November 14 on that one. The mayor and council department, that involves a conflict of interest of an employee who worked in a councilmember's office and was also on a committee at one point as well. He no longer works for the city, so, again, he's a many toker employee. That's why it's in the purview of the erc. That hasn't had preliminary hearing yet and due to illness, original scheduled preliminary hear has been canceled and possibly rescheduling in December or January, but due to the nature of the agenda it hasn't been put on agenda yet. >> Pool: Is that a current issue, like this council or a previous council? >> This council. >> Pool: Okay. >> Just a quick reminder with the way things fall in my office, we in 2015, I think it was, you all made changes to make sure that the kind of separated my office from investigations of mayor and council and mayor and council staff, and so that work was conducted by an outside investigator, involves a former member of the mayor's office. >> Pool: That helps and I now know which incident we're talking about. Thank you so much. >> Troxclair: Okay. If there aren't other questions, thank you so much. >> Thank you very much. >> Troxclair: Agenda item 4, results of ongoing follow-up audit which verified the implementation of selected recommendations in fiscal years 2012-2016. [10:25:09 AM] >> In our follow-up efforts, I think I've discussed this individually with many or all of you, but we think follow-up is an important part of our process. Following up basically on recommendations that we've previously issued is our way of making sure change has actually occurred after we've invested a lot of resources and conducted an audit. We want to make sure our recommendations get implemented and this has been an area of focus for me since taking the city auditor position, and I really think this is an area where we have stepped up and maybe closed a gap where we used to let recommendations go for a long time or really never follow up on them, we've been trying to really focus in on this. Olga, our quality assurance coordinator, has been the lead and she's done a great job with it. Jojo Cruz was the lead on this particular section of follow-up over the last year and Olga is going to present the results of our work. >> Good morning. I'm really excited. This is my personal favorite topic. So between 2012 and 2016, our office issued 155 recommendations to improve city operations. To date as corrie was describing we've been working in our program and able to test 108 of those recommendations. Overall included in the results of this year's efforts we saw that 80 recommendations are fully implemented and 28 are underway. Specifically to this year we tested 41 recommendations, which is the largest amount of recommendations we ted in a year. We saw that 29 of them were fully implemented and 12 are underway. A few examples of the 29 recommendations that are implemented include collections of over $150,000 of additional tax revenue from the hotel occupancy tax. More accurate tracking of the cemetery sales and improved code investigations. [10:27:16 AM] Some of the examples of the 12 recommendation that are underway are three recommendations from our governance audit, strategic plan, the risk management plan. And also another example is two recommendations related to affordable housing. Out of the five we issued, two underway, the remaining three fully implemented. So that underweight recommendations have to do with achieving core values and measuring how that's coming along and the tracking projects with affordability restrictions. The full list of the recommendations and results for each one is in the document that we have in the backup. One more piece of information that I wanted to share is we continue to improve this program. Next year we're planning to roll out the new electronic system that's going to manage recommendations and our follow-up process. Departments will have an opportunity to enter the information directly in the system and upload documentation such as updated policies and procedures. We will be able to access that information through the system and we hope our test is going to be more efficient and we'll be able to tell more of the recommendations. And controller's office is going to be using the same information for their reporting. I know that's a lot of information. I would say the main take-away is we issue a lot of recommendations to improve city operations. At this point we he got into being able to follow up on three-quarters of them and we see that more than half is implemented and we're continuing to work to increase both of those numbers, the one we get back to and the ones fully implemented. I'm happy to take any questions. >> Troxclair: Councilmember alter. >> Alter: So the items that are listed as underway in this audit, were those all items that departments had agreed to implement in the first place? [10:29:24 AM] >> Yes, they agreed to implement all of them. >> Alter: Okay. So -- and I think this is interesting from the point of view of what the audit department is doing, but I'm concerned that we have, you know, things from 2012 and 2013 that are still not implemented, but departments agreed to implement it. And I'm not -- you know, I appreciate that this audit sheds light on that, but then do we get a report -- you know, you've done this report, you've identified this number that are not implemented. Does the city manager then come back to the audit and finance and tell us these are the plans for these? Because simply telling me the update for ctm is underway doesn't give me a lot of confidence if it's been underway five years. I'm just picking on that one because that was the first one in the order. What is the next step to close the loop on accountability? It's great you are showing light they are not. >> So I think there's a few things there. One is the -- the timeline, so I think -- I think in more recent years, I would say 2015, 2016, through present, we actually have -- have spent more time scrutinizing the dates that are provided in management's responses, so management provides a response at the end of every audit and they put in when they think they're going to complete the recommendation. I think maybe several years ago we said, whatever you say is great, we're good, and we've actually started looking at those dates and saying, either do you think this is a little too aggressive, like should this date be further out, seems like you have a lot to do in a short amount of time, or seems like on 2021 is really far off. Is there a way for us to commit to doing that sooner or what would it take to do it sooner. So we're having those conversations which I think is part of real implementation dates and being able to get those done more quickly -- so that's one piece of it was just was the date realistic to begin with? [10:31:35 AM] I think maybe, maybe not. In the ctm example you gave I think one of the things we saw is we're coming back in five years later, so they did some things, they made a lot of progress. Now they've realized, oh, wait, we need to update this plan and we need kind of a better communication strategy or we need to make some changes, and so, you know, again, five years later we're asking, where are you at? And they're like, well, we have -- we have more work to do, but some of that is more updating work than was originally intended in the recommendation. So it's kind of -- that was specific to that recommendation. But then I think the other piece is so the city controller is responsible for -- I think there's a long-standing resolution that makes it the responsibility of the city manager to come to the audit committee every six months with just a report on where are these -- what was the original report, where are the recommendations at, what's the current status, and that's something I think you get periodically. Diana wants to speak more on to that. >> Diana Thomas, city controller. What we do is twice a year we send out a list to all the departments with an outstanding list and ask what's the current status. And they give us a write-up what the accomplishments have been since they last reported. They give us a new date of when they think they're going to be able to complete that recommendation, and we compile that into a single report that is submitted to this committee twice a year. And, in fact, today is the due date for all of those, so for city departments who are listening, get your stuff turned in, please. [Chuckle] But we do gather that, excuse me, and share that with this committee twice a year. And we look at those. Oftentimes it can be as simple as something has changed about the process, or the procurement process took longer to purchase because of a budgetary reason or a contracting reason than what they originally planned, or something got in the way of what they were planning to do, some other event took more precedence over this particular -- over that particular issue. [10:33:41 AM] >> Alter: And then this report that you're providing today doesn't cover the full universe because you couldn't look at all of them in this report. You're going to continue that process and in the next year or two it seems like you probably get on track for the backlog. But it doesn't cover things like Zucker report. >> So the Zucker report is not issued by us so that's not something that's covered under here. We do have an audit currently under way that is actually looking at implementation, not just the Zucker report but various recommendations made relating to the permitting process so that is separately being covered but wouldn't be covered under follow-up on our own recommendations. And you'll see we have 2016 here, but since then we also have 2017 numbers and 2018 numbers, so it's kind of a rolling program. Our hope was to catch up on the backlog so that we're not looking back at 2013 or 2014, that we get those confirmed as implemented and can kind of work on more recent recommendations on an ongoing basis. >> Alter: Okay. Thank you. >> Troxclair: If the -- if a council member -- or would it be possible -- I know that you didn't issue the Zucker report, but if the committee or council member wanted to get that on a future audit plan, is it possible? >> Yes, so Zucker -- specifically we have -- we have an audit that was actually on the fiscal year '17 plan that we're wrapping up now that covers the recommendations issued in that audit, or in that consultant review when it occurred, and so we are looking at that, and I think anytime that there's been consultant work, I think we have another one on this year's plan that y'all just approved related to the matrix consulting work around community policing, and so when the audit committee is interested in making sure that, you know, consultants' reports, recommendations get implemented then that's something we can absolutely put on the plan. >> Troxclair: But when it comes to those two reports specifically you feel like you're covering them? >> Yes, they're both on either -- one of them is almost completed and the other one is the plan for next year. [10:35:44 AM] >> Troxclair: Okay. And then I -- you know, I had the same concerns that council member alter did about the information technology, government and planning audit. You know, this -- some of the other things that are in this report are maybe more narrowly focused or it's like an issue that we still have but it's not -- it's not really broad-based and truly detrimental. It seems like these things together, I mean, that we don't really have a strategic plan that we are, you know, developing a citywide risk management plan that includes detailed steps to mitigate it risks on an ongoing basis effective. It hasn't been done -- seems like these three things together are -- really speak to a lack of not just a strategic plan but a lack of how to keep the city's information technology safe in an age that that is becoming more and more of a risk and a threat, and so I'm really kind of worried -- and combine that with the fact that these recommendations were issued in February -- or October of 2013 and it's been five years, so I -- so is there more -- and this item in particular, is there more information about kind of where it is in the process? I know you said that, you know, some things have been accomplished but they may be reviewing it, but I would be -- I'd be interested in -- maybe there's staff here to address it. >> Yeah, we have staff here today from ctm. >> Great, I'd love to hear from you. >> We have staff here. And in terms of risk overall one of the things we're doing this year is we actually have put a new it project on the plan to look at how effectively are we at managing technology risk. So vulnerability management I guess is a topic on our plan for this coming year. And then ctm is here to answer your question -- [10:37:44 AM] >> Troxclair: Just generally before we turn to them, how many -- did you say about how many recommendations you're able to go back and audit whether or not -- or report on whether or not they were implemented, of all the recommendations that you issue during the year? >> In a particular year we are at least -- or at least last year we were able to confirm that about 30 were implemented out of 41, I think is the -- it's 29 out of 41. >> Troxclair: Okay. >> So about three-quarters. That's -- 41 was our highest number tested in any year that we've done and I think we're going to try to stay around that level going forward. >> Troxclair: I see. So is that 41 number -- is that the total number of recommendations you made? >> That's the total number that we tested in the last year. The total made is back to the 155 in that five- year period, and then of those we've tested 108. And then confirmed 80 are implemented, so kind of cascades. >> Troxclair: 155 total recommendations and you're able to test 105 of them. So like two-thirds. Okay. >> Okay. Thank you guys. >> My name is paco, I'm with communications technology management. I've had responsibility for the citywide it strategic plan and we have spent the last two years actually chasing after the council's efforts to what has become the strategic direction. About two and a half years ago we began an effort to collaborate, facilitate a strategic planning effort across the multiple it shops in the city of Austin. Ctm is the central it department. It's headed by the cio, city of Austin, but there are other shops but the trick is trying to bring them together and we started the process to move in that direction. Then we learned that the council would begin a process to develop its own strategic plan, which is exciting, and so we actually delayed for about six months for the first workshop, so we tried to use the insights from that, and so we followed approximately three or four months behind y'all's process so that we could incorporate that. [10:39:51 AM] We completed in may of this year the first citywide it strategic plan and at the very center of it and quite literally we've kind of created a single page or a single poster of this plan. It's bull's eye looking diagram and at the very center are the six council outcomes. And so we have then arrayed around that some of the major capabilities that it at the city is offering across the organization, and we this year for our budgeting process for fy 19, build roadmaps for those capabilities and they directly address the question of how does this particular technology capability meet or achieve the council outcomes. And that became the guide for our spending. More work is under way. We have begun doing some work to benchmark it strategic plan is in the static document, it needs to evolve but we have now for the first time something that's pretty comprehensive about how technology will be managed and run at the city. >> This is Linda pounds, Linda pounds Adams. I might add to that as far as the five-year span we did have goals in place during that five-year period so it's not like we didn't have any outcomes, anything we were trying to achieve. Based on what we saw, infrastructure, based off projects that are going on. We just -- to have a comprehensive plan it takes bringing everybody together on a citywide basis from the it perspective. The different technology departments that are here, and to do that with you guys doing a 2013 direction and having those different goals that the city needs to achieve, it really has focused our -- what we're doing is revising what we have as far as our goals to make sure that they are align with the missions of the city. >> Troxclair: When can we expect for these things -- will they -- will these stay on the checklist for you to go back and review in future years and for the staff when -- when is a reasonable expectation that we can see these are completed? [10:42:02 AM] >> Well, you can see our current it strategic plan on the city's web site. It's been published, you know, probably about two months ago, and it's there. There's a narrative that explains it, so, you know, if the diagram doesn't work, you know, there's a narrative that explains how it comes together. We are continuing to move forward. One of the efforts that we've begun is a benchmarking effort, in which we're going to be looking at a citywide it spend. I'm gathering that data for the first time, and then we're also working to see about how we can attach clear values to these capabilities and their impact on the outcomes the council needs. So this is a plan for the year. It's not in the documentation you have but it is in the documentation we've sent to Diana. I know that because I was one of the people that was furiously trying to get it in on time. >> So in essence we're going to put measures on the items that have been identified for the plan and work plans are going to be implemented in those to ensure -- once we have the benchmark, the metrics are going to be implemented and then we're going to report on those, so -- >> So -- and just to give you an example some of the metrics that we have we're going to use to identify what our outcomes are is we will be able to come up with an estimate of it spend per city of Austin employee. We can similarly do the math per resident, and we're going to work on benchmarking that against peer cities but also using some consulting firms, Gardner for one, to see how we compare by similar size governmental organizations to give us a landmark. We are also working on trying to come up with some value estimation so that we can kind of say, you know, as a result of these investments, this is the impact that it's having on things that the citizens, residents, you, care about, and you know those are some of the metrics that we're working towards. [10:44:04 AM] We realize that, you know, putting down high-minded statements mean nothing until you've got something that sort of says, okay, here's a needle that moves back and forth and indicates our movement towards something that's credible. >> Troxclair: Okay. Do you have anything to add? >> Illustrate I just wanted to point out, we spoke about recommendation one so far and then there's two and three. They're a little bit different. We have a pretty high standard for what strategic plan is and it's a 13-step process, and ctm was able to go through a lot of those steps already, so a lot of progress has been made and we continue talking about what else needs to be done. And I don't know, if you have questions about the other recommendations too under this audit -- >> You may respond. >> I'm Kevin Williams, I'm the chief information security officer for the city of Austin. I was hired November 30 of 2015 and I had no pred predecessor so I was the first person to hold the title. I can't tell you what happened or I can't speak to the gap between the 2013 audit and when I was hired, but it's my understanding that audit along with several others like the person that did [inaudible] Information, [inaudible] To the creation of my position but we have experienced a number of challenges in trying to move the needle on the risk management plan. I've had conversations with the auditor's office. Is it enough that we have the plan or do we have to have a plan that's actually achievable and that we actually have the resources, you know, and the -- the backing the city to make that happen. And the challenges we've run into, in particular there's three of them, would be lack of clearly documented authority to implement standards and policies. We recently have made significant ground on this in just the last two weeks by a policy letter coming from the records management committee. So now we can clearly -- since they've been charged with the protection of the data within the city, and then my office can be the ones to help do that with our tools and technology schools and personnel, now we can establish security policy and standards that we can tie all the way back to city code, which will allow us to then create these programs, enforce them and hold -- the other comment about accountability and transparency of the city. [10:46:31 AM] The second factor would be resourcing. We -- my office was created as a -- as a division, essentially, of ctm. There were not dedicated resources set aside to create was essentially an entirely new function that the city has never done before. So I was given resources within ctm to repurpose for this task, but this falls into the third one, which is our mission compared to ctm's mission and the organizational alignment of that. So if we just look purely at the securing of it owe sources, ctm does not manage all the it resources for the city. They manage approximately half of them, but then the scope of what I have been tasked with is above and beyond simply securing it resources on a daily basis. There's a number of things we get involved with that don't necessarily deal with computers. For instance, I have a team that provides all of the electronic investigation services for the auditor's office, legal, hrd, all department directors, hr managers and law enforcement support. So any of the previously discussed investigations, if any of those required a search of email, a search of records, we are the ones that perform that. So I -- I think it goes without saying that's obviously above and beyond the scope of a department who's supposed to manage the day-to-day resources of it equipment, and so that -- that has been a bit of a challenge for us, you know, to try to get, you know, into those conversations, you know. >> So what can be done to help you address those things that you just laid out? I mean from, I guess -- I guess from the council. >> Sure. Conversations like this certainly help. There is a state law that allows us to claim exemptions for publicly disclosing details of vulnerabilities to the city or its networks, and so in those cases, you know, we would probably need to have executive sessions or something where we could be a little more frank as to how bad or how good things are, you know, things that we wouldn't necessarily want to advertise, so to say. [10:48:45 AM] I believe the auditor has an upcoming audit focusing specifically on information security. I believe that will help bring some of these to light. >> Troxclair: Thanks, yeah, I would be interested in having an executive session on -- maybe after the -- when is the audit supposed to be completed? >> The one that's on this year's plan I think is -- hasn't started -- it's starting right now so it's probably -- it will probably be several months. >> Troxclair: I mean, whatever makes sense, but I would be -- I would be interesting in hearing more in an executive session about what we need to do, because I think this is a really important area. Council member alter? >> Alter: Thank you. So part of the reason, you know, I was noticing that in there is because I think what you're doing is really important. I want to see it advance and that's why I was championing the human capital management system, which I think falls under you, and also the ability to change the legislation or the rules at the state level so that we can purchasing in the cloud using bonding and what not. I would like you to send out the link to the strategic plan, or resend it if it has already been sent to us and I happened to miss it, and I would second the request for an executive session on some of these it things at some point soon. Part of what you said, though, is I don't feel as a council member that I understand what your needs are and where the investments need to take place, the human capital management system, you know, as I learned about it was something that I could really very easily understand what we were missing, and it is one of those departments and resources of the city that affects our efficiency and our ability to deliver high-quality services, but it is not always the sexy department for funding or for other kinds of things. [10:50:48 AM] And so I would just -- we need to have a better understanding of what the obstacles and the needs are and where there are things that we can move because it may be that certain investments now that may be painful or require cuts elsewhere or what's going to allow us to get to be able to spend more in other areas later or to deliver better services, but if you, the experts, aren't communicating that to us in a way that we can absorb, we can't make those decisions. So I just want to invite you to make sure that you're providing us that information. We're not going to be able to do everything, but the fact that we don't have electronic time sheets, for instance, you know, this is Austin, this is an innovation capital. We don't necessarily have to have the cutting edge of everything, but we should have basic abilities to deliver it that we need so that our 13,000 employees can do their jobs and help our citizens. So just please keep that communication open, and where -- there may be times when it's not appropriate in a full session, and I just want to have my door open for my office if you feel like there's something that we can be helpful with to come back. >> Troxclair: Mayor? >> Mayor Adler: Just following up, I think you're hearing what is a concern for everybody. So you said some things that would be helpful would be the ability for the council to get a full briefing on this, which would require perhaps executive session, which we will certainly do, I think given the sentiment. You also said that there were some questions with respect to authority to be able to do the job. I don't know if that's something that we need to fix or if that's a manager issue within managing the department. The resourcing question you asked, again, probably a manager question that we can bring up with him in terms of prioritization of resources and the like. [10:52:56 AM] And then there's the ctm issue where the department you're in is only half of the responsibility that you have. It almost sounds like that relates back to no. 1, which is when you're embedded in one department what gives you the authority to be acting outside of that department. And if any of these three things are council -- where you need the council to act in a certain way, if you'd let us know that. Otherwise they sound like management-type functions, which we'll bring up directly with the manager. But if I'm missing something and there's action that we need to be taking separate and apart from that, let us know if there is. >> I would agree with everything you said, yeah. I believe what you can do for us is to continue sharing that message of supporting those initiatives. >> Mayor Adler: Gotcha. >> I think there's a challenge that, you know, technology certainly has evolved very rapidly. It's easy enough to say that, but I think the model we've had for a while where we used to have the server in the basement and it was easy to centralize that, then we had the explosion of distributed pcs everywhere, and I think we still have that model where everything is very distributed. There are some things that make real good sense to have kind of a central governance around, and there are some things that makes good sense to be divested to the department specifically. I think one of the challenges we run into is the cio for the city of Austin is effectively a department director of a department, has perhaps responsibility for all of the city but only has authority in a single department, and that has been one of the things that -- we see that with the [inaudible] Chief security officer role but I think it's a challenge that in these modern times we maybe need to think about what that role is and how that functions, because there are some places where it makes sense to have a more centralized kind of coordination, and that's what we're hoping with the it district plan, that it is beginning to pull those pieces together. [10:54:56 AM] >> Mayor Adler: And that's consistent with what the manager has been doing across departmental responsibilities and blcts. So we'll make sure we raise that issue -- >> There's an interesting race condition that happens when we evaluate security and its required budget as a part of the it budget, because for -- capital management projects, you know, everything that we implement and turn on are now additional resources that we need to protect. And so if that conversation isn't happening separately, then we are directly competing with that project for funds. And so now the money to do the thing and the money to protect the thing, you know -- so it's like -- it's a chicken or an egg problem. So why talk about them in one vein? Those should be two different discussion that is we have. >> Mayor Adler: I understand. Thank you. >> Troxclair: Council member pool? >> Pool: I'm glad we're talking about this. This was an issue that came to mind with one of the investigations that we had with an employee and lost emails and two separate computer systems, because we're not all linked, and I wondered, with the cloud, using the cloud, are we not able to combine -- even if you have separate -- so I know a little bit but not a whole lot about how the systems work, but even if you have separate servers and separate systems, can they both accumulate together at the cloud level? >> The possibility of that exists. The challenge is, is that there's long-established needs that have been established -- set up in departments or different functional parts of the city -- >> Pool: And they don't speak to one another? >> That's basically what it is. >> Overcoming that is always a challenge. >> Pool: And expensive. >> There's additional concerns, you know, when you get into particular departments that may be beholden to compliance legal or regulatory frameworks that commingling with other departments that wouldn't have such requirements, so then it becomes a discussion of do you secure everybody to the high water mark, do you have separate logical separations with different, you know -- and so it requires a level of coordination and architecture, which we normally didn't have to do in the traditional realm of you buy a piece of equipment and you stick it under a desk. [10:57:15 AM] >> Pool: Right. And some departments are more flush with money or more able to move money around than others, so they could be outstripping the rest of the city. >> Right. >> Pool: With regard to the security aspects and the Tur that they use for their -- architecture they use for their internet and computer systems. I understand that and I also understand how difficult it would be to go back to square 1, to redesign if we were starting from nothing today, what would it look like? But I guess that's a little bit of kind of what you guys have to go through in your exercises in order to find the most -- effect and efficient path to bring everybody together and highlight which ones would be or can't be done at a later time. Really interesting work. >> Partnerships are so important that we have right now when we're talking about the other departments that are it, because if you don't have -- we don't all -- are all the same page and we're not aligned with each other, that's how disconnection occurs, so -- >> So our strategic plan is one place we've brought members of it governance, which has basically -- a cross section of city leaders, of the technologists and the direct director advisory council for one, which are made up of representatives from each of the city service areas. They'll probably be revamped to accommodate the new outcome structure, but we've brought them together and were able to get kind of this synthesis of thinking around our current strategic plan and that's -- the same thing is going to happen with our benchmarking in that we're gathering this information kind of capturing a citywide capture of it spend and investment, which will be the first time we've had that view because it's typically occurred inside particular departments and what we've found is a real strong desire on the part of all of staff at senior levels to collaborate and coordinate across that. The sensibility of that and the need for that is very clear. The difficulty is, you know, find being the common language and the common forums for people to do that in, and that's why we're kind of excited by -- with what we've done with the it strategic plan thus far but there's more to do in that direction and that's what we're hoping this next year with the benchmarking -- [10:59:31 AM] >> The good thing is we have an it steering committee and we have a CIOC council that are guiding us as far as getting those principles out. So it's very important that they establish for us what's important, and from them working together and coming together that way it gives us how we can actually come up with our metrics and our goals. >> Pool: And then last question for y'all, separate from the operations and the specific technologies of kind of the connections and talking to one system and another. As far as our policies are -- as far as our policies go, do we have alignment across -- and I'm looking over at our city auditor -- do we have city alignment across all of our departments and all of our offices that everybody understands what the general bent of our policy are so that, for example, on records retention and things like that. >> Kevin? Kevin can -- >> Pool: Because if we could at least have an agreement that we all are working from the same set of policies and we may need to have some systems that are independent, but if they're still working from the same bedrock, then we should be able to speak to one another and not have unnecessary obstacles in our way. >> Certainly in terms of records management and protection of sensitive data we've looked at that from an audit perspective. My understanding is that's an area that ctm has been really focused on, making sure that the employees have a common understanding of the various policies that apply. >> So the -- the challenge I ran into was one of the first things I tried to solve when I came to the city is how do we create policy, like what is the process to establish new policy and then -- you know, in the city. And the best that I was able to find out is there's two avenues. Either comes from city code or admin bulletins directly from the city manager. Anything short of that I don't believe we can actually uphold, you know, as policy to the extent, like the auditor could investigate and so forth. [11:01:35 AM] And so that put us in the position where either do we need though change city code or do we need to find existing city code that we can leverage for this purpose. Fortunately there was a section in there for the records management that among other things charges them with protecting that information. You know, but the reality is the clerk's office, they don't have the technology, the skills, the people, even to do that kind of stuff. So essentially what we did was a dup yutize us, and -- deputize us and that's what we're here for. So that's the avenue we're taking. That just got approved by the records management committee two weeks ago. So now we have a roadmap to move forward with establishing that policy and the standards. You know, the reason we have -- you know, the reason we can be handed a personnel policy book, you know, is because city code calls for it, so there's not an equivalent, you know, line in city code that says there must be an it policy, there must be a security policy. So this is what we've used at least on the security front to establish that. And so now that that's in place, we can start building out the framework for what that policy looks like and then going through the individual sections and coming up with the technical standards for either how we create passwords or how we delete files or other things along those lines. >> Pool: Right, and how long we archive emails and for what class of employee and that sort of thing. >> Right. And so if we go down that rabbit hole, for instance, we can get those standards from state law, the records office, you know, what have you, and then we've got to turn to the technology providers and say, you need to configure the mail server in this way to meet those rules. >> Pool: Mm-hmm. >> And so -- but because of the decentralized nature of that we're not just going to ctm, we have to go to the airport, the convention center, you know, Austin energy, et cetera, and then there's the matter of now how do we ensure that those standards are being upheld within the technology. [11:03:39 AM] >> Pool: Right. >> That's a combination of, for lack of a better term, audit, you know, and so, you know, for instance they did an audit a while ago about the ability to log into, I think it was the utility billing system, and I told them, I'm jealous of their ability to do that, because I need to be able to do that 24/7 for every computer system in the entire city for perpetuity. And so to establish something like that, that takes resources, you know, because now it's not -- it's a matter of we need a tool to watch all the other tools, and so then that grows in orders of magnitude every year as the it budget and system grows as well. So - - I think you can see the challenge -- >> Pool: Oh, yes. Thank you all very much. >> Troxclair: Appreciate you getting this on our radar. So -- >> Thank you. >> Mayor Adler: Anything else from the auditor's office on this list that you want to bring to our attention or that you feel like we covered -- or you feel like we covered it? >> I guess not unless you have any specific questions. >> Troxclair: Okay. Well, thank you so much. Are we on item 5? Special report on city contracting practices. >> So caveat, this is not an audit. It is actually the summary of many audits, both to this committee and even predating many of the members of this committee we have presented many a counter audit to you guys. We're often talking about kind of city contracting practices, but we're usually talking about it from a single audit perspective. So we went and looked at this one contract or this type of contract. And so today we want to present a little bit more kind of broadly what all of those audits have been showing us over the last several years. So Katie Houston was the manager of that audit and Henry came tomb what was the auditor in charge and Katy will present. [11:05:40 AM] >> Good morning. So like corrie said, the purpose of this project was to evaluate the city's approach to contract management and it's really what I like to call compilation-type project. So we looked back at all of our contracting work going back to 2010, which is the last time we did a project of this nature, and for the last eight years we focused on kind of the recommendations we've made and the risks we've seen that relate to contracting in the city. Our work focused on 28 projects, 21 were audits and 7 were investigaons. And as you can see here, contracting is a big deal. We have almost 2700 throughout the city, and it's a big investment of about 5.5 billion. Recently we have seen quite a few risks in many audits that have indicated we need to take a look at this a little more thoroughly and this is a summary of that work. So here you can see a depiction of the contract management process. Starts with a -- at the top with initiation, which is ianteslly when the departments identify the need to contract for goods and services. Next we go to the award, which is when we're evaluating and selecting the appropriate vendor. Then we develop a contract, which is just the formal agreement between the two parties. Then we monitor. This is primarily when the city departments are evaluating contractor performance and ensuring they're complying with the contract terms, and lastly we close it out. For the most part you're just wrapping up the final details and doing vendor evaluation. On the right you can see the key department responsibilities. Essentially the corporate purchasing office is responsible for developing contracts and dealing with vendor disputes. They also provide citywide guidance on how departments should be managing these contracts. The law department really protects the city's interests and provides legal advice to the city. Capital contracting procures construction and public works for professional services, and then the individual departments, like I said, they kind of initiate the process by identifying a need, and then they do the bulk of the monitoring. [11:07:42 AM] So as we looked back at our work, we found that three of the 21 audits that related to contracts address some issue relating to contract initiation and some of the key issues we found there are that there were projects designed without a full quality review, and partially due to the city's decentralized contract management approach, we saw that there was limited coordination between the various departments. We also found that three of the 21 audits we reviewed identified issues relating to contract award, and more specifically we saw that there are contracts awarded that didn't follow established procedures, some of which bypassed competitive procurement rules, and then we also saw inconsistent use of vendor evaluations. Moving into development, we saw quite a few more problems in this area, about half of the audits we looked at and one investigation identified issues relating to contract development, and some of the key issues we found here are poorly developed terms. A good example of that is the term undub listed -- duplicated clients serves and we see that in social contracts and that's not clear enough to be monitored by the departments. We saw incidents where key clauses were modified or left out. We saw that last months when we heard about the cultural arts audit. No unlimited legal review and sometimes there were instances where contracts were developed based more on what third parties offered to provide rather than established city priorities. The next step in the process is contract monitoring, and this is the area where we saw kind of the most pervasive problems. 17 of the 21 audits, or 81%, had a problem in this area, in addition to six investigations. And some of the key issues we noted were that monitoring procedures are not always documented, that we're not always performing on-site review of contractors, that contractors are not monitored to ensure they're really complying with the terms. Some good examples of that would be departments maybe not obtaining or reviewing good supporting documentation for requests for reimbursements, invoices, receipts, things of that nature. [11:09:53 AM] And then we also saw that some contracts were signed before all the required approvals were obtained. So at the end of the contract or after the contract has been finished out, it goes for a close-out process, and kind. -- This is the area where we saw the fewest problems, but what we did see related to the vendor evaluation component. Many times those are not done, or when they are done they're not used in future contracting decisions, and we saw some of that on the capital projects audit. So in addition to that we also noted a couple observations. The first is that many recommendation are made or have been made to address these contracting risks over the last eight years, but there's a lot of work that's still needed. We know that there are some instances where recommendations really weren't implemented at all. We heard about that a little bit in follow-up already and we know there are other cases where maybe the recommendation was implemented but the risk environment has changed or something, maybe it wasn't kept up after it was implemented. So the risks noted in the original audits still remain or aren't really fully addressed. Beyond that we know that the purchasing department provides some training to city staff on how they should manage and monitor these contracts, but the trainings that are mandatory that city staff are required to go to are systems focus. So it's kind of training staff on how to use the city's financial system or how to upload data to ecapri. There are Bert trainings or trainings that give you more information on really how to monitor contractor performance and look at receipts and obtain good supporting documentation, those types of things, but those aren't required and few city employees are attending those. And our understanding is the purchasing department is working on those now. So that concludes my presentation and I'm happy to answer that he questions questions -- to answer any questions you have. [11:11:55 AM] >> Council member alter? >> Alter: Thank you. Looking at contract issues and trying to understand how we can improve them. We had a conversation the other day about the training and how that might need to be improved. Is that something that is a -- you know, something that we have to write up a resolution on or is that something that we simply talk with the city manager -- I mean, there's a fine line there about getting into the management, but it seems to be creating systemic issues in maybe policies. I wanted to get a sense of what would maybe be the best avenue on that, with the training, because I've heard that from multiple departments as well as, you know, from your audit. >> Mm-hmm. So the training -- the purchasing department has a toolbox that has lots of tools in it, checklists, good resources on how to really monitor these contracts, so the resources are available. I think the issue is what we were previously requiring folks to go do and what we offer as sort of optional training are not the same. And so I don't necessarily think there would need to be policy direction for that, just express interest that maybe we decide that some of those other optional trainings are now made mandatory, and I think the purchasing department is on board with that and they're -- they're considering that now. >> James Scarborough, purchasing office. I appreciate the question, I appreciate the conversation and the review of contracting and procurement operations. Most of the standards in the context of which the analysis in this report or the past audits were done were based on approaches, techniques and tools that were established and have been maintained for years by the purchasing office, and that is correct, we provide a variety of resources, including training. Some of them are mandatory, because you'r working in a financial system and so you can't make mistakes in the financial system. Other activities are voluntary because different departments have different levels of authority and to the extent that some departments need to know certain procedures and use them and certain departments do not need to know those procedures because they don't ever perform that function. [11:14:10 AM] That has been a point of discussion in the past. So -- so the financial services group, the chief financial officers management team, we're reviewing this report now and considering it internally in determining if a better approach with regard to training might be an element in solving the problem. But just making folks go to training won't necessarily cause the outcome to change. We also need to look at, you know, what -- what do we do when the outcome is not what we want to see, and how do we monitor that so that we don't have to wait for an audit, we don't have to wait for a report. We catch it when it happens. So we're also looking at not just inputs to the problems but also looking at outputs so that we catch it before it happens. >> I'll take the rest of my questions off-line with you. >> Sure. >> Troxclair: So I had a lot of questions about -- about this. I thinkhis was a really helpful format, first of all, for you all to kind of compile the work that you've done on lots of audits so that we can really see where the issues were. Looking at the -- the special report, so I have a couple of specific questions, if that's okay. So the -- on page 6, it said the capital project delivery process audit found public works staff, on the design for the new central library. As a result staff submitted the designs for bid and construction without submitting them to the full quality management process. In some cases external pressure time- sensitive projects resulted in modified or expedited quality reviews. Did that -- I mean, I understand that when you have a high-profile project -- I mean, I understand the different external pressure that people are wanting to get completed in time. Did you -- was that specific? But I also notice that there have been some design flaws in the new library that have led to sewage issues and some other things. [11:16:17 AM] Do you know if -- if there was anything specifically -- specific that resulted from the quality -- the kind of lack of following protocol and quality management in regards to the central library? >> So this comes out of an audit that we issued, I'm trying to remember the timeline, maybe October 2017, give or take, about a year ago, give or take, and certainly the library was one of the projects that we spoke about in the audit. I don't know specifically about, you know, sewage issues or -- there is one specific issue in there certainly where we note that a design issue resulted in additional cost. It basically had to do with a fire, kind of protection where they didn't have electricity exactly where they needed it. But I think that was one example. We used several examples in that report where we say, we think that if we had done this design review a little more thoroughly we would have resolved some of the issues that came up later in construction, maybe than post-construction. So we can get you more detail on what we specifically said about that project, but kind of this is the -- the very summarized version of what that larger audit spoke to. >> [Inaudible] Director -- oops. I was -- sorry about that. Jorge morales, public works. Capital program. That was part of the capital delivery audit we did a couple years ago. I would have to get the specific, but the quality management issue what they do is review for quality assurance and some of the the comments are addressed, sometimes they're not. So we can go back and get specifics on what that was referring to. It doesn't necessarily mean that they were overriding a design type requirement as relates to the sewer issues, we're investigating that right now so there's a lot of information we're evaluating on what occurred there. May be design-related, may be construction-related. [11:18:21 AM] >> Troxclair: Okay, yeah, I'd be interested to know the results of your investigation. We just obviously want to make sure that we're avoiding expensive issues and safety issues as much as possible. Let me see what else -- oh, I know -- how do we make sure -- I don't know who this question is for, but how do we make sure -- seemed like there was a reoccurring issue where the -- if projects were going over our -- over the agreed-upon deadline, that the city wasn't assessing -- and there were fees related to the late delivery of projects within the contract, that we weren't assessing the fees, and that really worries me because obviously it's costing the city money when projects aren't completed on time. So how do we -- why is that happening and how do we make sure that we are assessing those fees when projects aren't delivered on time? >> Good question, and I think that was referenced in that audit as well. So generally speaking, I'm not speaking on one particular project, all projects have a contractual time requirement, and through -- through the construction process, if there's design changes or there's unforeseen conditions through the change order pcess we evaluate that, we negotiate that with the contractor. We add days sometimes as needed on that particular contract. When we get to the end of the project, when the project is exceed -- has exceeded the time that was allowed by contract or by negotiated change order, there is a clause where we do liquidate the damages and that's probably what you're referring to. So on a case by case we work with the contractors. And we do assess, if we have a problem where they don't meet the schedule and it's the contractor's fault, we assess damages but I would have to get more specifics on what you're talking about. Generally that is part of the project and the project management we do. In some cases we'll work with the contractor if there's rain delays or response time, either on the city side or the design team, but that's part of the process. [11:20:24 AM] >> Troxclair: I mean, there is one specific example on page 10 that talks about final completion of sand hill contract was behind, liquidated damages of about $32,000 were not assessed, and decisions no the to assess damages were not documented. >> So I can speak to that one specifically, and that was really Austin energy was the primary -- the department responsible for that at the time. That was in 2011, so in reaching back our eight years we are pulling in some fairly older projects. Our concern with that was not only that it wasn't assessed and it went pretty significantly over just the -- the way that the contract was written, it was clear that the damages should have been assessed. And when the department explained that to us they had what we thought was kind of a reasonable explanation, but coming in after the fact it's very hard for us to tell, should they or should they have not assessed those given that the contracts absolutely will assess a certain amount for every day. So at the time we made that recommendation, I believe that the Austin energy -- in fact, we followed up later, Austin energy implemented that recommendation and made sure that if they weren't going to assess it, that they had clear documentation of why. I think in that case it was kind of a -- an adjustment between one project and another project, but the contractor was involved in, and they felt like it was a fair way to handle it. From an auditor perspective, you know, we really like the documentation. So we were coming in and saying we felt like if you're not going to assess something that's required in the contract, then you need to evaluate that and document why you did not. >> Troxclair: So who -- and I guess who was -- there are -- as you mentioned, this is such a huge important issue because we have $5.5 billion that we're spending on these contracts, and I think that it's difficult because they're in different departments and, you know, we're doing a lot of different things in a lot of different areas as a city, and so it's hard to have, I guess, specific procedures always followed. [11:22:29 AM] But it does seem like there are -- were some reoccurring issues that could be easily addressed, like making sure that the legal -- that when we are doing our contracts, that the recommended legal language that protects the city if work is not done properly or if work is going over budget or, you know, over the time deadline, that the city is protected. There -- you know, the monitoring, there were some comments about what happens when work was not performed in accordance with the contract or inability to recover money, et cetera. So who is ultimately responsible -- like who was ultimately responsible for making -- making sure that these things are improved upon? >> That's a great question. [Laughter] >> I look to Mr. Scarborough to answer that question. [Laughter] >> Well, as we discussed before, I'm a lifelong procurement professional, so my -- my patent answer is the person who holds the pen is responsible. So ultimately it's a function of delegation. The city charter and the council authorized city manager to enter into and to execute and to expend monies against contracts, and then that authority is subsequently delegated out through the city's management and operations staff. So -- so through that structure of delegation, that is the city's procurement organization, and it lives in our office, it lives in capital contracting office and it lives in larger and smaller amounts throughout the city. But ultimately it's the person who signs the contract who's kind of responsible for making sure all the players on that contract are doing what they're supposed pob -- to be doing, and I think some of what we're observing here is that connection needs some further examination. [11:24:30 AM] So like I said, chief financial officers management team is looking closely at this report, and intend to circle back with the city manager's office to see if there's some tightening up and some further review of city contract organization that may benefit some of the challenges that are identified in the report. >> Troxclair: I mean, it's hard as -- I guess I'll just speak for myself -- as -- well, these -- these kind of things are always difficult when the ultimate accountability for the success of these contracts is so scattered throughout the city, and so we have to figure out a way -- I mean, I don't know how many people are ultimately signing contracts and how do we get this information to them. Are they all -- you know, I don't know if they're watching the audit and finance committee or if the -- or if there is some -- someone who is bringing all those people together and highlighting the issues that have been found. To me, this is pretty clearly under, you know, the government that works strategic outcome, and so maybe when there is -- maybe when the city manager -- when the city manager kind of completes his realignment, then there's going to be an assistant city manager who's -- whose ultimate job it is to make sure that these things are considered. But I just feel like there's a lot of -- there's a lot of money at stake here and there's a lot of really good information in this audit, and I want to make sure that we're actually following through on the -- on the recommendations that are made and addressing the problems that are highlighted, and I'm not seeing a clear path of how to do that right now. >> Can I address on the capital delivery side? >> Troxclair: Sure. >> As it relates to that? Public works has the majority of the project managers in the city, and the inspectors, we also have construction inspectors that are the eyes on the ground under construction projects. We work with capital contracting office in putting the contracts together, but when it comes to actually executing the work our team is on the ground making sure that we're adhering to that contract and the capital contracting offices assists us in reviewing and pointing out when things aren't done so we can take care of that. [11:26:45 AM] Capital wide citywide, [inaudible] Does not manage every project in the city as was discussed earlier, and right now under Mr. Goode we are doing this initiative from capital delivery, reevaluating what's the most effective, make sure we have standardization, training, and so a lot of tools that we already have in place we're looking to improve them so we can make sure that everybody is adhering to the policies required for delivering capital projects. >> Good morning. >> Troxclair: Good morning. >> My name is [inaudible] Hernandez. I want to add a couple things. Certainly the review, the ownership of documents and the signature authorities of the documents for construction-related contracts, the processes are there. I believe fully that the processes are there. We Meade regularly with the law department and public works and other departments that manage their own capital improvement projects. I think what you see is maybe the consistency -- we do a lot of projects. We do a lot of construction, professional services projects across the board. And I think the dynamics between, you know, this kind of contracting with -- other kind of contracting the city does is, you know, you have a project manager that owns the responsibility on-site. The contract -- the contracting manager is not on- site, they're not in the field working on a day-by-day basis with the project -- with the contractor, you know, overseeing the work. What we do is on the back end side, when there's a change order, when there is an issue on-site, then we work with the project manager, law department and my office to, you know, mitigate the best we can each -- each issue. And so that's -- that's there, but, you know, every project is different, and so what I will say, though, and stand firm on is, is the contract requirements are there. The liquidated damage, we have that in every project. Every project we determine the dollar value for that contract. Have our evaluation on every contract, just being consistent on that side of it. [11:28:48 AM] >> Troxclair: Council member alter? >> Alter: I just wanted to suggest to the chair that we have public works and other related departments who were involved with that particular audit to -- as I understand it, this is a report on all of the contracts in that audit -- contract audits, but I think it has raised the need for us to be looking at that a second time and understanding the progress that's being made as a check-in, preferably in December or possibly, you know, in January, but I think in December if we have time. I don't know if we have some kind of big thing on the agenda. But I think it would be valuable to dig into this a little bit deeper and to see if there are policy things that have to be done and just as our role in audit and finance, I think we should be taking a deeper dive on that one. That one -- some of our audits cover 100,000 programs, this one is millions and millions of dollars, and so I think it would merit additional attention. >> Troxclair: We can certainly schedule that. >> We certainly can schedule that. We have an upcoming item -- upcoming meeting. We have the December 5 agenda is somewhat full, but things always change. So we will put this on for a placeholder for the December meeting. Are you specifically asking about to have further discussion about just contracting in general, or capital contracts specifically? Or really the topic of this audit, which is the many areas of contracting that we have looked at in the past? >> Whatever was covered in the audit that had the public works stuff that -- where the design issues were coming up and the other -- >> So looking back to the capital project delivery audit? >> That is what I am requesting, councilmember troxclair may have something else in mind. [11:30:55 AM] But that on the audit. >> Troxclair: I always appreciate your comments, but it always worries me when we have an audit report that is highlighting areas that we need to improve and then we have city staff saying, well, we're already doing it. So it is like, there is clearly a disconnect somehow. It seems like -- I understand you are managing a lot of projects. It seems like there are relatively easy fixes that are outlined in this report. I want to make sure that we're recognizing -- you are doing a lot of things well, but it is important tow recognize where things need improvement as well. >> We will come back in December. I didn't have the other report. The report of 2017, we have done action and done quick wins, that is the report on the update. We will be glad to give you more specifics at the next meeting. >> Troxclair: If you have a copy of the report, I think it is helpful for you to read through and give feedback. >> If I may make a suggestion, probably within the next six weeks, you will get a complete six-month report from my office with all of the items that are included in the audits. I could pull out a special report of just the ones that were looked at as part of the contract audits and give you a special status of where all those recommendations are. Because I do believe, as we look back over the contract audits that were done -- I apologize, I haven't seen the full report either. But we look back, some were over the last three or four years. A lot of progress has been made since the items were brought before you. Departments have made significant efforts to make improvements, and I think if I can pull those out into a special report for you, that might give comfort as to where we are in the process. [11:33:02 AM] After that, if you still feel a need to bring all of the departments to this meeting for an update, we can bring them at that time. >> Tovo: We did make a report in the last status to the controller, that is in the appendix. This is one where we completed work in 2017, haven't done follow-up and haven't hit the point where they needed until now where they needed to report the status to the controller. This is recent enough that we haven't done enough follow-up work and they haven't had to provide an implementation. With these conversations with these folks and director of public works, I know they have been making progress on implementing the recommendations. >> Councilmember alter. >> Alter: It is high-profile enough, and I'm pleased there is progress. My assumption is there is progress. But I there is concern in the public about what we're doing as follow on. I'm perfectly pleased if you come and tell us we have taken all the steps, done everything, great. I would much prefer that than to find other challenges. But I think we need to have that in an open session where people can hear about it. >> This issue in general, whether competitive bidding, awarding points or get into legal trouble with a contract. This issue area occupies a lot of the council's time, ultimately, when it is not -- when issues come up, after the fact, it is a thing that we spend a lot of time, whether in executive session or the dais, having discussions about. So to the extent that we can really make sure we're tightening up our processes on the front end, I think it will be -- it will save us time on the backend. [11:35:09 AM] And, you know, of course, help to protect the city and taxpayers' dollars. Thank you. >> We are losing people. I know we are getting crows to time here as well. So let's speak quickly about upcoming dates. >> Did you need us to adopt this? >> No. >> Ok. >> Tovo: In -- >> So in terms of dates, I believe you asked us to come back. In terms of dates, November 1, you will talk about council dates next year. We're early in discussion. We have an item for December 5, the final approval. The next audit finance meeting of the dates. The proposal, when I looked at the very draft council calendar, it looks like the fourth Wednesday spot, which is where we have been before now, would fall on a council week. I there was some desire to not have a work session audit finance council meeting. I propose maybe the third Wednesday, rather than the fourth Wednesday. And that gets us through maybe June or July without any conflicts. And then I think as always, we adapt the -- between the July break and the budget calendar. We adapt our dates for July, August, September. Suggestions. >> Thanks for pulling this together, Ms. Stokes. I was looking at this, thinking that the third Wednesday works as you mentioned with the exception of August, when that is a budget and tax rate hearing, which is in the evening, so I mean, depending on what happens with the rest of the day, we may still be able to meet. Are you looking at 1:30 or 9:30? >> 9:30 to 11:30. >> Last thing I would say -- two things. [11:37:09 AM] I'm not sure the 23rd of January is a good date. >> I believe that we cannot convene because we lose at least one committee member, but we cannot convene until the council sets the committees. So given that the first council meeting is either in February or maybe the -- it is late. >> Yeah. >> Definitely late enough in January that we probably would not have a January meeting at all. >> Correct. The last thing I would say, I'm looking at December and would suggest that we look at the 11th, instead of the 18th, which would be the second, because people do tend to start focusing on the family the last couple of weeks of December. >> I think, like, this month -- not this month, but this year, sometimes we end up, we don't have a December meeting at all or have early December. This year, I think we have early December instead of November, December. >> Yeah. >> Once y'all approve the dates of the council calendar on November 1 or at least in November, then I will come back for the December audit finance committee with a schedule for 2019. >> And then no meeting in July. >> Right. >> Great. >> Tovo: Ok. Do we need to officially adopt anything. >> Discussion for now. Adoption in December. >> Tovo: Great. Any other items for future meetings? All right. Thank you, guys, so much. Appreciate it. We will adjourn at 11:38. [Adjourned] [1:23:44 PM]