title
ADOPT THE FISCAL YEAR 2016-17 ENTERPRISE RISK ASSESSMENT FINAL REPORT
recommended action
RECOMMENDATION
The Council Audit Committee recommends that by motion action the City Council adopt the Fiscal Year 2016-17 Enterprise Risk Assessment Final Report.
body
SUMMARY
This project was initiated to assess the City’s overarching risk, and it was conducted under the direction of the City’s Audit Committee. This risk assessment provides the City of Stockton with a way to measure uncertainty related to City functions and processes. For the purpose of this assessment, risk is defined as the uncertainty that could impair the City’s ability to achieve defined goals and plans. Risk is measured by the probability of negative events occurring, the significance of those events, and the impact such negative events could have on the City should they occur.
The enclosed Enterprise Risk Assessment (Attachment A) defines the City’s risk profile and ways to mitigate risks. The risk assessment analyzed risk by evaluating 17 factors that define the City’s business. The risk ratings for each of the 17 factors were aggregated to define an overarching risk level.
In aggregate, the City’s overall risk level is gauged as moderate to high. Of the 17 factors evaluated, one risk area was identified as high risk, while 11 were gauged as having moderate to high levels of risk. In comparison, the 2013 risk assessment rated 11 risk areas as high. For 2016, one risk area was assessed as having an increasing risk trajectory, while eight were decreasing and eight were flat. Assessment results show that the City has made progress towards reducing risk since 2013.
As part of the risk assessment, 161 City employees responded to a web-based survey asking them to rate areas of risk. Overall, City employees reported lower risk than the Internal Auditor, as indicated by an overall employee rating of moderate versus an Internal Auditor rating of moderate to high. Employees rated risks lower than the Internal Auditor for most categories.
All City departments were included in the risk assessment process. This assessment includes information provided by City Council members, senior leadership, managers, and supervisors. The risk assessment is reported at a specific point in time, which is May 2016 except where noted. Both the risk rating and trajectory are tied to this timing.
FINANCIAL SUMMARY
The financial impact of the risk assessment will be determined by the proposed actions proposed by City Management to reduce risks identified in the report.
Attachment A - Enterprise Risk Assessment Final Report, dated November 1, 2016