Article with Embedded Video Links

The Audit Committee reviewed the city's privacy-audit findings, Freedom of Information (FOI) practices and internal-audit follow-up actions. Provincial privacy-law changes are scheduled to take effect on January 1, 2027. Staff are also revising the London Community Grants Policy before the 2028–2031 funding cycle.

The Internal Audit Follow-Up Activities Dashboard identified 19 outstanding management actions classified as high or medium risk.

Topics Discussed

PRIVACY LAW PREPARATIONS

MNP presented a privacy-readiness assessment ahead of changes under provincial Bill 97, scheduled to take effect January 1, 2027. The assessment identified six findings, including one high-risk and one medium-risk finding.

The updated legislation will require municipalities to conduct formal privacy impact assessments and maintain inventories of personal information. City staff plan to distribute training materials to department leads in December, followed by training sessions early next year.

FOI PROCESSING AND TECHNOLOGY

Staff reported that the volume and complexity of requests under the Municipal Freedom of Information and Protection of Privacy Act have increased. Current processing relies on Adobe Acrobat, Camtasia and Excel, and staff spend approximately 90% to 95% of their time processing access requests.

Councillor Jerry Pribil questioned why the city's planned transition to dedicated FOI software is not expected until the third quarter of 2027. He asked whether the technology work could be accelerated:

"It doesn't seem to me efficient effective and very open to errors which was included actually in the report target Q3 2027 why so long and continue this way till that time could this time frame be shortened And so we actually get on the better, more effective, more efficient path."

The city is considering dedicated FOI software. Staff said initial costs may be managed within existing departmental budgets, while additional staffing could require future budget requests. Staff also said they were not aware of provincial funding to offset costs associated with Bill 97. The committee chair said the city would have to "absorb these cost pressures."

DISTRIBUTED PERSONAL INFORMATION

MNP reported that personal information is stored across multiple systems, paper records and digital formats, with limited centralized oversight outside the city's ongoing SharePoint migration. The consultants recommended a risk-based approach to protecting high-risk personal information while system consolidation continues.

INTERNAL-AUDIT FOLLOW-UP

The Internal Audit Follow-Up Activities Dashboard showed 19 outstanding management actions classified as high or medium risk. No actions were closed during the latest reporting period. MNP reported that management remains on track with its targeted completion dates.

COMMUNITY GRANTS

City staff are revising the London Community Grants Policy. Cheryl Smith told Pribil that the revised policy is expected to come to council in the second quarter of 2027.

"Our call for multi-year funding then opens up in the Q3 or the summer of 2027 and then any council decisions with respect to funding of that policy and funding of the London community grants program will be part of the next multi-year budget process."

The next multi-year funding cycle covers 2028–2031.

Motions

• Item 4.3 — City of London Internal Audit: Privacy Audit: Received for information. The motion passed unanimously.
• No other passed, rejected or deferred motions were identified in the provided meeting details.

Attendees

The councillors listed for the committee were:

• Paul Van Meerbergen
• Steve Lehman
• Steven Hillier
• Hadleigh McAlister
• Peter Cuddy
• Skylar Franke
• Josh Morgan
• Shawn Lewis
• Sam Trosow
• Elizabeth Peloza
• Susan Stevenson
• Jerry Pribil
• Anna Hopkins
• David Ferreira
• Corrine Rahman

Representatives of MNP and city staff, including Cheryl Smith, also addressed the committee.