Audit Reveals Millions in Overbillings - Audit Committee - May 1, 2026

The Audit Committee reviewed three major oversight issues: contract change orders in capital projects, a forensic investigation into the Pay It procurement, and Metrolinx’s failure to invoice the City for SmartTrack costs dating back to 2018. The committee adopted the Auditor General’s recommendations and approved an expanded, city-wide review of change orders on high-risk capital projects.

Topics Discussed

Construction Change Orders: Audit Finds Contract-Term Violations and Overbillings

The Auditor General presented an audit of “corporate real estate management divisions oversight and management of change orders in capital projects.” The review examined 105 change orders worth more than $51 million across eight capital projects.

The audit confirmed $58,000 in overbillings where general contractors billed the City more than subcontractors invoiced, and the Auditor General said of a separate $500,000 issue: “There is a confidential attachment related to that and yes, there is currently an investigation.”

The committee heard that “in our sample of 105 change orders, almost half had charges that were not consistent with the contract terms, including change orders where markups exceeded contractual limits and/or additional fees were charged on top of the quoted costs for the work itself and contracted markups.” Staff also told the committee there is “no consistent way that project managers are capturing whether there are design errors and omissions.”

Councillors pressed whether the problems were broader than the sample. The Auditor General’s office responded: “Our audit sample was sufficient and our findings showed that they were systemic as opposed to being isolated in nature.”

Pay It Platform: Policy Breaches Identified, But Auditor General Says Threshold for Wrongdoing Not Met

The Auditor General reported on a forensic investigation into the Pay It procurement and related conduct. The report stated: “Emailing a city report prior to the publication date is a violation of the confidentiality requirements of the Toronto public service bylaw and the use of personal email is a violation of the city's acceptable use of information technology assets policy.”

Committee discussion also focused on personal devices and freedom-of-information implications. One speaker said, “The use of the personal device is never something that should be happening to conduct city business for all of the reasons that were highlighted in the Auditor General's report, but just in general, it's not allowed within our policies from an IT perspective,” adding that if a personal device is used, “it's open to an FOI.”

The Auditor General’s report concluded that, despite the breaches and the relationship described in the correspondence reviewed, “this did not meet the threshold of wrongdoing as defined in the Toronto Public Service bylaw.”

SmartTrack: City Says Metrolinx Has Not Invoiced Since 2018

The committee heard that the City has incurred approximately $184 million in SmartTrack-related costs since 2018 without receiving invoices from Metrolinx. A staff report excerpt read into the record warned: “Despite efforts from transit expansion to follow up invoices from Metrolinx, no invoices have been received to date,” and cautioned there is a risk the City “may have difficulty assessing the validity of billings that pertain to prior years.”

Asked directly whether Metrolinx had failed to meet its obligations by not providing invoices or backup, Mr. Toyo responded: “At yes, at this point in time, I would say yes.”

A councillor questioned why council had not been alerted earlier, stating: “So for eight years on a monthly basis, written requests were being made to Metroinks to provide invoices and nobody from Metroinks ever provided an invoice and nobody at the city ever decided to tell council, ‘Hey, there's a problem here. This is not normal.’”

Another member said they had spoken with Metrolinx leadership: “Chair, I spoke with the CEO of Metrolinks yesterday and we expect to get an invoice this month.”

Change Order Review Expanded Beyond One Division

Councillor Myers argued the change-order issues were not confined to one unit, saying councillors “have a sense that the problem is bigger than what's just contained within the samples of the report.” The committee approved an amended direction to extend review work beyond Corporate Real Estate Management to other divisions, using a risk-based approach.

During discussion about whether similar issues would appear more broadly, the Auditor General’s office answered: “So the answer is yes. If you looked at all the change orders over this period that similar issues would be found.”

Exhibition Place Cyber Security Audit Approved

The committee approved Phase 2 of the Exhibition Place cyber security audit, described as an “overall network security and cyber security assessment of select critical systems.”

Motions

Passed: - AU12.1: Corporate Real Estate Management audit recommendations adopted, with direction to report back in 2027 on implementation - AU12.1 (amended): Additional review of change orders on high-risk capital projects city-wide from May 1, 2024 to May 1, 2026 - AU12.2: Pay It Platform investigation recommendations adopted - AU12.3: Exhibition Place Cyber Security Audit Phase 2 approved - AU12.4: SmartTrack contract considerations recommendations adopted - AU12.5: Moss Park Arena 2024 financial statements approved

Deferred: - Request for Toronto Lobbyist Registrar to attend full council meeting

Attendees

The transcript did not include a complete attendance list. Members who spoke included: - Chair (name not specified in transcript) - Councillor Myers - Councillor Cotroni

Staff who spoke included: - Deputy Auditor General Aa Chan - Eay Ting (Solicitor, Municipal Group) - Senior managers and staff from Corporate Real Estate Management, Transit Expansion, and IT divisions