Good afternoon everyone and welcome to the audit committee on September 28th, 2026. Individuals interested in participating in today's meeting were eligible to register online using the delegation registration form at www.kitchener.ca/delegation or via email at delegation@kitcher.ca. Any written comments received prior to the commencement of the meeting have been circulated to council and uh will form part of the public record. The meeting live stream and archive videos are available at www.kitchener.ca/watch.now. Are there any disclosures of peerary interest? There being none, we will move right into item number three and it's the third quarter 2026 audit audit status report. and I will turn it over to you, Miss Tasker. >> Welcome. So, in my status update today, I'm going to share two compliance audits. Uh the first one is on the docuign software usage and the second is on the employment of relatives policy. Also in progress right now, I'm facilitating a capacity review of our legal services division and working as part of a broader keep talking. Practice talking. Test. Test. Let me know when you're good to go. Try testing now. Is that okay? >> I don't know what to say, but How does that sound? Two, three, four. >> How's that? Maybe if I move back a bit. Go closer. How's that? >> That better? Okay. All right. So, um, also in progress right now is the broader, um, I'm part of a broader project team for space planning project at the cough, um, for the yard and the annex. Um, for that one, I'm not the project manager, but we'll be assisting with training and advice related to the lean 5S method of sorting and organizing spaces. So, the first audit is the DocYsine compliance audit. Uh, docuine is the current electronic signature software that we use at the city. Um, which replaced Consigno just over a year ago. At the time, CLT had requested that an audit be done one year following the installation. So there were four different objectives for this audit. First, I wanted to see if the software was being used for um for approved use cases. Second, I wanted to make sure that staff were following the required records management practices, which includes saving a copy of the signed agreements someplace other than within the software itself. Third, I wanted to make sure that the staff signing documents on behalf of the city actually have signing authority to do so. And finally, management wanted to know what future volumes and potentially other use cases were for the software to ensure that we had the right pricing tier that was chosen with the vendor. So the methodology used to achieve those objectives was pretty straightforward. First, I compared the subject line of all 2500 documents created over the last year to the approved use cases to make sure that no one was using it for something that hadn't been vetted through the legal division. Next, I took a sample of five documents for each of the 29 users who had created documents. I then asked them to provide proof of where the document was stored through screenshots of directories or photos of the hard copy files. Since the reports generated by the software don't specify who actually signed the document, only who sent it and who received it, I sent out a survey to all recipients to see who was signing them versus who was just receiving copies for information. I then compared these names to the list of those with signing authority provided by legal services. In order to determine future capacity needs, I had an initial interview with HR who are the largest user of the platform to determine potential other use cases and then surveyed the remaining business units to ask them what quantity they would be needing in 2027 and whether they also had any new use cases. From there, I was able to put together a forecast and compare it to the contract with the vendor. Their pricing is based on the number of document sets called envelopes. And one final test that wasn't originally in scope but was added after the fact was to get the TIS division to test whether anyone had accessed the consign software since the document docuign uh software was implemented. So the findings were very positive. All of the uses of the software were linked back to approved use cases. Everyone was storing a copy of their signed documents either in hard copy or digital formats with only one exception. and all staff who signed the documents had permission to do so. I also found that the 2027 forecast of around 2400 envelopes is just slightly under the contracted amount of 2600, the actual usage of for 2025 was between these amounts at around 2500. TIS found while one person had accessed the Consigno software to retrieve the document, no one had used it to create any new documents. There were two main recommendations as well as some housekeeping items related to the user list. First, in order to ensure that legislated services who administer the platform don't accidentally give someone access to signed documents who shouldn't, it's recommended that legal services share the list of authorized signers with them so that they can check before granting access. And second, legal and legislative services should jointly remind all staff that they must have signing authority before signing documents on behalf of the city, whether those are are electronic or hard copy. Although there were no situations in the software where this happened with turnover of staff and the possibility that documents are signed in hard copy, it's important to periodically remind staff so that they know and they can check with legal if they aren't sure. So in conclusion, the docu docyign process in software is currently sitting at a lowrisisk level and there are no significant findings. So I will conduct a status update one year from now and have added this list to the recurring assurance audits. Are there any questions about this one? >> I got a couple. Um so on the manual documents that we do now, I mean this goes back to Carl's time. Um, legal puts a stamp on the back of this signing page which means that legal reviewed it and the clerk and and myself are authorized to sign it. No stamp, no no signature. How does that kind of get managed with with this with an electronic version? >> Um, I think it is through the user access and that's why it's important that only those signing authority. So, delegated authority um have the ability to do that within the system. >> Okay. And then I guess the second question that goes with it and I see Dan wants to add something. We'll come to you in a sec. Um the second part of it is is there no way to set up the system so that only the people who are authorized to sign things actually actually can sign off on it as opposed to sort of trusting that they're aware that they know they either are allowed to sign or aren't allowed to sign. >> That is the intent and that's why we want to make sure that the folks setting up the access legislated services know who actually have signing authority. >> Gotcha. Okay. >> List that legal um administers. >> Okay. Gotcha. Uh Mr. Chapman. >> Uh three. Mr. Mayor, I can confirm much like you have relied on that stamp and hard copy documents, there is now an electronic cover page that is ahead of the agreement that's completed by legal staff that essentially fulfills the same purpose as the stamp on the back of the documents. So without that form, we would not sign the document. >> Okay. Thank you. >> Okay. There don't appear to be any other questions, so you can continue. Mr. task group. >> So the next compliant audit is one that I've done on multiple occasions previously as part of the hiring transparency audit. Since the employment of relatives policy was recently updated, this standalone part of the audit was conducted now. So the objective is simply to test for compliance with the revised policy which was approved by yourselves in May of this year. So, similar to previous iterations of this audit, I performed two tests to check for relationships between employees. The first test was to sort all employee records by address to find people living at the same address. I then analyzed each relationship to see if they were in conflict with the policy. The second test was to sort all records by last name. But since having the same surname doesn't necessarily mean that you're related to someone, I checked which relationships would actually be a conflict and then got HR to look at the personnel records to determine if they were related or not. Just to refresh your memories, the revised policy says that no relatives of the CEO, GMs, directors, or elected officials may work at the city and that all other management or in other words, managers and supervisors cannot have relatives working in the same division. and any other intersecting responsibilities such as acting as an adviser or an associate or overseeing financial matters must be reviewed by HR on a case-byase basis to ensure the intent of the policy is upheld. Basically, we want to make sure that no one has influence over any part of their relatives employment at the city. So, what I found was that there were 347 employees that are in 157 relationships. This number has stayed fairly constant over time, ranging from around 250 to 400 employees in 100 to 190 relationships. And in case you're wondering why the number of relationships is simply not the number of employees cut in half, it's because in some cases we have more than two relatives in a relationship. So you may have um parents and siblings or uh children all within the same relationship. In addition to the address and surname matches, there could be other relationships that those tests wouldn't catch, such as relatives with different surnames living at different addresses. Job candidates seeking to work at the city must identify on their application if they are related to anyone currently working here and who that is. I had asked HR if they have a database of this information um that I could reference for the audit. Although they use this information at the time of hire um to screen for conflicts. Unfortunately, they did not store the information in a central place that I could review. However, as a result of this audit, I have created a shared repository that both HR and myself can reference and it includes all of the matches and conflicts that I identified as well as any relationships divulged on the job applications going forward. This database can then be referenced by HR for any internal job changes to ensure there are no conflicts with the policy. For this audit, I did find five conflicts with the revised policy. One was a situation where two existing employees were related and one got a promotion to a director level. While this is against the policy, the roles are not in the same department. So there was no direct reporting relationship. A further complication in this situation is the second employee works in finance and has access to the financial transactions related to the director. So, mitigating controls have been put in place to ensure the employee does not handle any transactions for their relative. There are two situations where one of the people in the relationship is a manager or supervisor position within the same division as their relative. In both of these cases, they are within large divisions with multiple sections and they are not in a direct reporting relationship. While not ideal, letters have been put on their files for them to acknowledge not participating in any decisions relating to their relatives. The final two situations were ones where one of the people in the relationship has access to financial transactions related to their relatives. Similar to the director example, mitigating controls have been put in place to ensure the employees do not handle any transactions for their relatives. So, as I noted, the tracking database has been created to allow real-time analysis of possible policy conflicts before hiring decisions are made. And all conflicts have letters on file which the employees acknowledge outlining outlining mitigating actions. So, in conclusion, there were no significant findings in this audit. None of the conflicts represented a situation where a family member had direct control over their relative's employment. Um, this audit will remain on the list of recurring assurance audits. Are there any questions? >> There don't appear to be any. >> All right, that's it. >> That's it. Well, thank you. Uh, thank you very much. There is um no motion. Thanks uh for all of your good work during this uh during this term of council. Um I know uh this is it's an important body of work and uh I know uh you know obviously from a management point of view there's work that you do that's important but uh the fact that council has an opportunity to shape that work uh with inputs into sort of the the work that you take on uh at different points during the term is also appreciated. So um on behalf of all of us just want to say thanks for all for a job well done. Great. >> Thank you. >> Awesome. Motion to adjurnn. Moved by councelor Mitchell, second by councelor Johnson. All those in favor opposed.