INTERNAL AUDIT REPORT Operational Audit - Delegation of Authority January 2023 – October 2024 Issue Date: November 18, 2024 Report No. 2024-19 TABLE OF CONTENTS Executive Summary 3 Background 4 Audit Scope and Methodology 6 Appendix A: Risk Ratings 7 Executive Summary Internal Audit (IA) completed an audit of the Delegation of Authority for the period January 2023 through October 2024. The purpose of the audit was to assess the effectiveness and compliance of the Delegation of Authority and Responsibility (DORA) Policy Directive in achieving its intended goals. On January 24, 2023, Resolution No. 3810 was adopted, repealing all prior resolutions related to the Commission’s Delegation of Authority and Responsibility to the Executive Director (ED). This resolution increased the ED's signatory authority from $300K to $2 million, with certain exceptions, and took effect on April 3, 2023. Section 3 of Resolution No. 3810 stated “The Internal Audit Department shall review the effectiveness and adherence to the DORA Policy Directive and as part of that review, shall interview Commissioners about their understanding and functioning of the Delegation of Authority, and shall provide this audit report to the Commission within four years of the passage of this resolution.” In general, we concluded that Port management’s internal controls were operating effectively. We did not identify any issues that warranted reporting. Glenn Fernandes, CPA Director, Internal Audit Responsible Management Team Steve Metruck, Executive Director Karen Goon, Deputy Executive Director Background The Port’s DORA Policy Directive, adopted on January 24, 2023, and effective April 3, 2023, repealed prior resolutions and established new delegations from the Commission to the Executive Director (ED). This directive increased the ED’s signatory authority from $300,000 to $2 million, with some exceptions. The DORA review process is managed through SharePoint and Microsoft Power Automate, where staff submit standardized request forms and documentation to the sponsoring Executive Leadership Team (ELT) member. The ELT member reviewed, approved, and forwarded requests to the Deputy Executive Director (DED), who then consulted with the Commission Chief of Staff, Executive Chief of Staff, Finance, and Legal departments, as needed. For specific cases, Central Procurement was also notified. The DED then submitted the request, along with any additional clarifications, to the ED for approval. Items that might have drawn Commissioner interest were flagged in “Look Ahead” and “Agenda Review” meetings with the Commission President, where decisions were made on whether to place the item on the consent agenda or highlight it in the weekly briefing. A monthly report of approvals was submitted at the first Commission meeting each month, and contracts resulting from the ED’s delegation process were accessible on the Port’s contracts webpage. See the workflow below: Source: DORA one year update to Commissioners We interviewed management and staff who frequently used the DORA process to gather feedback on their understanding of the new process and on any perceived benefits or challenges compared to the previous approach. Under the former process, items requiring Commission approval often took up to eight weeks for authorization. According to users, the new process significantly reduced this timeline, with approvals typically granted within a few weeks. Some delays exist at the ELT member approval level, often due to demanding schedules or periods of leave. From April 2023 to August 2024, 112 requests were approved. The tables below present estimated time savings based on our discussions with management: Metric Time/Value Estimated Time for full Commission Process 8 weeks Estimated Time for ED Approval Process (3810) 2 weeks Estimated Time Savings 6 weeks Total Approved Requests during Audit Period 112 Estimated Time Taken to create a Presentation for the Commission Agenda 10-13 hours Estimated Time Taken through ED Delegation Process 1-2 hours Estimated Time Savings per Request 10 hours Estimated Total Time Savings 1120 hours The audit also reviewed a citizen’s concerns about the Port’s issuance of 2024 tariffs under a potentially outdated delegation of authority and a delay in implementing re-delegations after the adoption of Resolution 3810. After the citizen raised this concern, a typo was identified in a Maritime memo, which was not a legal document and did not affect the delegated authority. Maritime subsequently corrected it, confirming that the governing authority was Resolution 3810, and the re-delegation policy was EX-2A, Part III.E. Aside from this initial error, the Port was in compliance with current policy requirements. Audit Scope and Methodology We conducted the engagement in accordance with Generally Accepted Government Auditing Standards and the International Standards for the Professional Practice of Internal Auditing. These standards require us to plan and execute the engagement to obtain sufficient, appropriate evidence to support our findings and conclusions based on the engagement objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusions. In some instances, we used judgmental sampling methods to determine the samples selected for our audit test work. In those cases, the results of the work cannot be projected to the entire population. The period audited was January 2023 through October 2024 and included the following procedures: Policy and Procedure Review * Reviewed foundational documents, including the Port’s Delegation of Responsibility and Authority to the Executive Director, as amended January 01, 2023, Policies EX-2 and EX-2A, and Schedule EX-2A * Reviewed communication, training, and monitoring processes Management and Staff Interviews * Conducted interviews with management and staff from various departments, to gain anecdotal evidence of the time and resources required to compile material and to present to the Commission, when seeking authorization * Gauged staff’s general understanding of the delegation schedules, monitoring and ratification processes, and training opportunities * Elicited feedback, using open-ended questions, to identify opportunities that may improve the limits and delegation process Commission Interviews * Obtained feedback from Commissioners on time savings and areas for potential improvement in the delegation process Substantive Tests * Selected contracts approved within the new ED delegation limits to verify compliance with schedule limits and directive requirements * Reviewed the ratification log and supporting documentation for compliance and corrective action as necessary Appendix A: Risk Ratings Observations identified during the audit are assigned a risk rating, as outlined in the table below. Only one of the criteria needs to be met for an observation to be rated High, Medium, or Low. Low rated observations will be evaluated and may or may not be reflected in the final report. Rating Financial/ Operational Impact Internal Controls Compliance Public Commission/ Management High Significant Missing or partial controls Non-compliance with Laws, Port Policies, Contracts High probability for external audit issues and / or negative public perception Requires immediate attention Medium Moderate Partial controls Not functioning effectively Partial compliance with Laws, Port Policies Contracts Moderate probability for external audit issues and / or negative public perception Requires attention Low Minimal Functioning as intended but could be enhanced Mostly complies with Laws, Port Policies, Contracts Low probability for external audit issues and/or negative public perception Does not require immediate attention Delegation of Authority