Office of the City Auditor

In addition to audit engagements, City Auditor staff provide advisory or other consulting services, as appropriate, or at the request of Council or senior management. These types of services may include:

The City Auditor is granted full, free and unrestricted access to any and all records, property and personnel relevant to any function under review.  Access to personal information is provided for under the Municipal Freedom of Information and Protection of Privacy Act (in particular, Subsections 31(c) and 32(d)). 

The City Auditor has the authority to conduct audits and reviews of all City departments, Members of Council, agencies, boards and commissions, as well as other entities the City is related to or has an interest in. All employees shall assist the City Auditor in fulfilling its objectives.

The City Auditor, through the appointment by Council  as an Auditor General, has the responsibilities, including the powers, duties and protections, under Sections 223.19 to 223.23 of the Municipal Act, 2001 for:

These responsibilities under Section 223.19 to 223.23 of the Municipal Act, 2001 include the powers to access information and to examine persons under Section 33 of the Public Inquiries Act, 2009; the duty to preserve secrecy with respect to all matters that come to its knowledge in the course of performing its functions; and the protection of not being a competent or compellable witness in a civil proceeding.

Independence is an essential component to building public trust and preserving objectivity and integrity associated with the audit function.

To provide for the independence of Office of the City Auditor, its personnel report to the City Auditor, who reports administratively to the City Manager, and functionally to the Audit, Finance and Administration Committee of Council.  Audit and review reports are sent directly to the Audit, Finance and Administration Committee for discussion and approval and then to Council.  These reporting relationships help ensure independence, promote comprehensive audit objectivity and coverage and assure adequate consideration of audit recommendations.

All City Auditor activities shall remain free of influence by any element in the organization, including matters of audit selection, scope, procedures, frequency, timing or report content to permit maintenance of an independent and objective attitude necessary in rendering reports.

The City Auditor shall have no direct operational responsibility or authority over any of the activities it reviews.  Accordingly, it shall not develop nor install systems or procedures, prepare records or engage in any other activity which would normally be audited.

The City Auditor has the responsibility to:

Each term of Council, the City Auditor prepares a multiyear work plan, setting out the proposed schedule of audits and other undertakings proposed for the term. The following sources are considered:

The Office of the City Auditor performs the following types of work:

Audits (Value for Money and Compliance)
Audits are designed to add value and improve an organization's operations. Audits help an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve risk management, control, governance processes and examine the efficiency, effectiveness and economy of operations to add value and improve the City of Hamilton’s service delivery.

Consulting and Risk Assessment

In addition to these planned activities the OCA is responsible for providing oversight of all special investigations conducted by the City to ensure quality and independence. Special investigations are not planned activities but are responsive to need. They are undertaken by the OCA pursuant to authorities given under the Whistleblower By-law (19-181) and the City of Hamilton’s Fraud Policy and Protocol. These include reviews or investigations of matters of alleged or suspected wrongdoing, per the Whistleblower By-law or fraud, waste or other similar activities reported by employees or residents through the Fraud and Waste Hotline or other mechanisms.

Also, the OCA performs follow-up audits that are conducted within 12-36 months of the initial audit and an annual report of the completion status of management action plans. These activities require that a portion of resource time be set aside as well.

The following projects are in progress and should be completed by the end of 2019:

Follow Up of Recommendations from Previous Audit Reports (Audit)
This work relates to the verification of the status of the implementation of audit recommendations from audit reports issued. The International Standards for the Professional Practice of Internal Auditing requires the follow up of recommendations made. This work includes both follow up of individual audit reports and recommendations from various reports that have not yet been resolved by Management.
Timeline: Throughout 2019-2022.

Spot Cash Counts (Audit and Fraud Prevention)
A type of “pop-up” audit. Cash counts will occur at a select number of locations across all operations to ensure compliance with the City’s Corporate Cash Handling Policy, safeguard assets and act as a deterrent. Five to ten locations will be selected for this project per year. An overall report about the state of cash handling in the organization will be provided.
Timeline: Throughout 2019-2022, reported on annually.

Organization-Wide Fraud Prevention and Detection Program: Intake, Investigation and Reporting (Fraud and Waste Hotline management)
Development and implementation of a comprehensive fraud prevention and detection program. Includes developing and providing education/training to the organization, investigation support, case documentation and management and maintaining a roster of fraud/forensic accounting specialists. Management of the Fraud and Waste Hotline that was launched in July 2019.
Timeline: 2019-2022 

Light Rail Transit (LRT) (Risk Assessment/Consulting)
Working with the LRT Office, periodic risk assessments will be conducted throughout the lifespan of the LRT to assist the project to ensure that risks and opportunities are identified, and that management has action plans in place to manage, mitigate or avoid risks and realize benefits from opportunities.
Timeline: 2019-2022

Enterprise Risk Management (Risk Assessment/Consulting)
Raising awareness in the organization about the importance of enterprise risk management throughout the organization by providing educational sessions to support the development of a corporate risk profile and related corporate policy by management by enabling management to complete risk self-assessments and to develop corresponding action plans. Note: Requires significant time commitment from the Senior Leadership Team
Timeline: 2021 (Support the development of a corporate risk profile and action plans by management.) 

Transit: DARTS (Audit, type to be determined)
Council provided direction in 2017 to conduct an annual audit of DARTS. Specified procedures audits will be performed. This audit may be co-sourced and would need to be funded by the Transit Division. Dependent on funding being received from Transit. This item is pending the completion of a Master Operating Agreement between the City and DARTS. Topics may include: Complaints, dispatch, ridership accuracy compared to demand, DARTS budgeting, benchmarking against other jurisdictions, vehicle maintenance, service model evaluation.
Timeline: 2019-2022 

Performance Excellence Advice and Education (Consulting)
Advice and support to ongoing corporate performance excellence initiatives. Work may include giving educational presentations to staff/management meetings about the importance of internal controls, business procedures and a consistent work product. Other activities may include support to assist with data analysis using audit analytics software and assisting departments with performing control self-assessments to identify areas for improvement. Also provide commentary on lessons learned for how to apply this approach to other areas in the organization.
Timeline: 2019-2022

Continuous Auditing - Various Topics (Compliance Auditing)
Topics may include procurement cards, accounts payable, corporate cell phones. Continuous auditing is ongoing monitoring that leverages technology to flag potential anomalies and/or high-risk items. Note: Investment in software licenses for monitoring technology may be required in the future.

Red Hill Valley Parkway: Judicial Investigation Participation (Other)
Support of the judicial investigation for Red Hill Valley Parkway as requested by the Commissioner.
Timeline: 2019-2020 (or until completed)

Financial Sustainability (Research Report)
One of the biggest challenges facing Canadian municipalities is long-term financial sustainability. This is a research-focused consulting project that would research best practices across North American municipalities assess current practices at the City of Hamilton. Recommendations will be made to enhance the City of Hamilton’s long-term financial sustainability.
Timeline: 2020

Housing Services: Homeless and Shelter Programs (Value for Money Audit)
Audit of contracts for the provision of emergency shelter services and homelessness programs to determine if value for money is being achieved, with a focus on the achievement of outcomes (effectiveness).
Timeline: 2020 

Housing Services (Value for Money Audit or Risk Assessment)
An audit or risk assessment in the area of Housing Services, with the specific topic and type of project to be determined after initial research is completed.
Timeline: 2022 

Diversity, Equity and Inclusion (Consulting or Audit)
A project that includes a research component that benchmarks for best practices in other leaders in this work in the MASH (municipalities, academic, school and hospital) sector. Compare the City’s strategy to these benchmarks and assess progress made and effectiveness of efforts.
Timeline: 2021

Code Red (Value for Money Audit)
It has been 10 years since Code Red first identified challenges in various neighbourhoods across the city. This audit will assess the volume of spending the city has invested in addressing Code Red Concerns and ask questions such as: what has been the impact of this investment – are we getting value and good outcomes and consider the risks and opportunities of this investment.
Timeline: 2022

Grants and Transfer Payments (Compliance and Value for Money Audit)
An audit that will critically consider all the City’s various grant and transfer payment programs. Once initial planning work is completed, the project scope will be narrowed to focus on the highest risk payment streams at the City.
Timeline: 2021

Hamilton Waterfront Trust (Value for Money Audit)
An audit to determine if there are ways to improve the value for money achieved from the City’s investment and spending at the Hamilton Waterfront Trust, with a focus on future performance improvements that can be achieved.
Timeline: 2020

Transit Route Management (Value for Money Audit)
An audit to critically assess if transit route management is optimized from a value for money perspective.
Timeline: 2022

Budget Process and Variance Management (Audit or Consulting, to be determined after initial research)
Common complaints are that the budget process is difficult to understand and evaluate, it is hard to link actuals to budget. This is an audit to evaluate the efficiency and effectiveness of the budget process. Service based budgeting will also be considered in the audit. Recommendations will be made improve engagement and understanding of the budget process.
Timeline: 2021

Cybersecurity (Audit or Risk Assessment, to be determined after initial research)
Cybersecurity attacks are becoming more and more common. This is a project that will include penetration testing to determine where the City’s key vulnerabilities are located. Note: Additional funding may be required to engage the required external experts.
Timeline: TBD

IT Disaster Recovery/Business Continuity Planning (Compliance Audit)
IT is critical to the City’s operations in all service areas. Includes a review of the organization’s disaster recovery plan, evaluates the risks covered, and assess if the plan includes appropriate measures to enable recovery from threats or incidents.
Timeline: TBD 

Growth Planning: Coordination Across City of Hamilton Departments (Consulting)
Growth Planning is complex and involves expertise across the organization. This audit will include reviewing related processes and assessing if the City organizes itself in a manner that enables the achievement of value for money spent in Growth Planning.
Timeline: 2022

Use of City Vehicles Audit (Value for Money Audit)
An audit of the processes related to the usage of City vehicles. There have been significant advances in technology in recent years for GPS technology and fleet administration. The effectiveness of oversight, management processes and the use of technology will be examined.
​Timeline: TBD

The following audits were included in the 2016-2018 Work Plan. Due to a high proportion of staff vacancies (7 vacancies at various points during 2016-2019) in the Office of the City Auditor, these projects will be carried over for completion in 2019-2022. 

Procurement By-law Analysis (Consulting)
A data-driven project with the purpose of taking the Procurement By-law and designing procedures for how to effectively analyze procurement data using audit analytics software to effectively identify risks, irregularities and non-compliance with the procurement by-law. The goal will be to develop reports that can easily be run on a regular basis based on criteria developed during the project so that Procurement is able to follow up in a timely manner with the various Divisions.
Timeline: 2020 

Quality Assessment Review (QAR) (Other)
To comply with Institute of Internal Auditor’s International Standards for the Professional Practice of Internal Auditing, it is required that internal audit shops have independent quality assessments every five years. The most recent assessment occurred in 2012. This item is dependent on receiving adequate budget to have a QAR performed.
Timeline: 2021

Audit Universe Update and Risk Assessment (Risk Assessment)
A full-scale update of the audit universe and a related risk assessment is typically performed every five years with an update performed during the other years. The most recent full-scale audit universe update and risk assessment occurred in 2012.
Timeline: 2022 

The following projects were included in the 2016-2018 Work Plan. Due to changing circumstances, risks and corporate priorities, some of these projects have been moved to the “B”-List (Appendix “B” to Report AUD19004) and will be considered for completion in future years and some have been removed from consideration due to the volume of other higher priority items, proposed changes in municipal service offerings. Management is still responsible to ensure the provision of these services in an appropriate manner.