Good morning. Uh, I've just been advised that Chair Pelosa uh will be running late, approximately 10 minutes. Uh, we do have 30 minutes within the council procedure bylaw within which to start the committee meeting. Uh from my understanding she'll be here uh within that time. I'll provide any updates uh should I receive any good morning. I don't know if you heard my uh recent announcement regarding Sher Poza. Um but she is uh running late. Uh so we will resume as uh or start uh once she uh gets here. I understand it'll be approximately 10 minutes. >> Thank you. Okay, good every good every that's not even a sentence. Good afternoon everyone. Apologies for the delay. This is the fourth meeting of the audit committee. The city of London is situated on the traditional lands of the Najbeck, Horeson, Lapawok, and Adawandrin. We honor and respect the history, languages, and culture of the diverse indigenous people who call this territory home. The city of London is currently home to many First Nation matey and Inuit today. As representatives of the people of the city of London, we are grateful to have the opportunity to work and live in this territory. I am joined in chambers by members of committee being councelor Cuddi and councelor Pribble. Member Chima is online and member Stevenson um has sent her regrets. The city of London is committed to making every effort to provide alternate formats of communication supports for meetings upon request. To make requests specific to this meeting, please contact accessibility at London.ca or 519661-2489 extension2425. I now look to the committee for disclosures of pecunary interest. I see none in chambers. I see none online. We have no consent items, no scheduled items. Items for direction we have three. Item 4.1 is the summary update in internal audit from MNP. This is going to be a motion to receive the report. Moved by councelor Pribble, seconded by councelor Cuddy. Um our presenters are in person today, so turning it over to them if they would like to give a brief introduction, then I'll open it up to questions uh from the floor and online. And if there's anyone online as well as part of your presentation, just let me know. We can certainly go to them as well. Thank you, Mr. Roco. >> Thank you through you, Madam Chair. Um, in front is the in front of you is the summary update. The only thing I would just like to take this opportunity to is as I recognize that this is the um last meeting in which internal audit will be presenting to this committee given this term of council. Just wanted to thank um the committee uh for its support throughout our tenure here. Uh and looking forward to continuing um to provide um this with the uh uh this this relationship with the city. Uh and just best of luck to each of the members in your future works. Thank you. >> Thank you. Looking to members of the committee are online for questions. This is just the uh summary update. Seeing none, it would be a vote by hand of all in favors of receipt. Motion carries. >> Thank you. That takes us on to item 4.2 being the internal audit follow-up activities dashboard also from MNP. This would also be a motion to receive. Looking for a mover and councelor Cuddy seconder and councelor Pribble as well. Uh turning this over to MNP for your update. >> Uh thank you through you madam chair. Um so of note uh for the committee with regards to the dashboard within this previous cycle um there were no management actions that were were closed. There are 19 actions that we are still tracking. As a reminder to the committee we track items from previous audits through to their target completion when they are rated to be of a high or medium risk. Um so management based upon our engagement with management and review of progress uh continues to uh work on items per their targeted completion dates and based upon the updates that we have uh sought from them. Those targeted completion dates are still set to be uh still set to be possible. So there has been no retargeting during this last cycle. Thank you. >> Thank you. Looking online or in chambers for questions regarding the activities dashboard. I will start my speakers list with councelor privile. Thank you sir chair to our staff on page six the 0.1 and point 2 both of them uh update from the staff that review prior will be done prior to the next multi-year budget 28 to31 if I look at due date Q4 2027 could you please be more specific if it's going to be same process as 4 years ago then the budget cases they were done in kind of August September and I just want to make sure that even though it says quarter for 2027 that there's going to be sufficient time to introduce it prior to the council. >> Thank you. I'll turn over to our team recognizing at that point there'll also be a new term of council and um so Miss Barbone >> I can uh pass that over to Cheryl Smith because the actual response refers to the um policy work as opposed to the budget. So Miss Smith will be able to answer Thank you and for the chair. As part of this review, it identified some opportunities that we had to refine the community lending community grants policy. So that policy will come to council probably in Q2 2027 as we need the policy finalized. our call for multi-year funding then opens up the uh the Q3 or the summer of 2027 and then any council decisions with respect to funding of that policy and funding of the London community grants program will be part of the next multi-year budget process but the policy uh to allow us to continue the community grants program will come forward in Q2 2027 and the changes as recommended by the audit will be incorporated into that policy. Thank you, councelor Pville. >> Thank you. And I would imagine that's for both one and two answer. Correct. I see not. Thank you very much. No more questions. >> Thank you. Looking for further speakers online or in person. Okay. Seeing none, um by a show of hands, all in favor of receipt. >> Motion carries. >> Thank you. This brings us on to item 4.3 being the City of London internal audit privacy audit. Um I believe MNP has a specialist online as well for this one. Uh I'll preface this one uh and we'll let MNP do it as well that it's a preparedness audit. Uh and you'll see in your package a big focus on bill 97 and where we're at in meeting um regulations and what's expected ahead. This is also going to be for receipt. So a receipt to get it on the floor moved by councelor Cuddy. seconded by councelor Perbble and I will turn over to Mr. Rako and your team to introduce this item for us. >> Uh thank you uh through you madam chair. Um and as was already just kind of highlighted with your preface there. Um before you is a privacy audit that was completed during this last cycle. It is a timely audit and it's viewed as a little bit of a readiness assessment that we were able to do um given uh changes that are pending or actually changes that have taken place and will become effective to the uh municipal freedom of information act um which is bill 97 as was referenced. Um so with regards to this an important thing that hopefully came through within the report but just as a preface is that when we look at these the recommendations and the findings that we have are thinking towards the effectiveness date that will be January 1st 2027. Um so this is a slight departure as you were reading the report potentially of as management was putting together their targets for completion. We usually as would have seen in the dashboard give a quarter right quarter 2026 quarter 2027 in order to complete it but given the um given the target of effectiveness of January 1st 2027 um management actually gave very specific dates for effectiveness which so it's a slight departure in process but I think an important one considering the purpose of this audit. Um the other thing I would just like to highlight is that uh when you when you look towards this um within the findings there were um six findings in total. One being ranked as a high risk, one being a medium risk and one being a low risk. If you look towards those two more uh material items which are uh the high and the medium, what they are really focused on is enhancements that are needed from the current processes and controls that are in place within the city's privacy regime that help to ensure that come January 1st, 2027, um you will be in line with the with the recommend uh with the requirements. Um it there is an appendix that has uh we included in in appendix C that highlights the legislative updates really what a big departure on this and I I do have Adriana from u from the firm uh online to answer any specific questions but in summary that the update to the act is much more prescriptive in the things that a municipality and other local governments have to do when it comes to the protection of privacy. Um so while they were leading practices before in come January 1st it is much more prescriptive in the privacy impact assessments that need to done and it is much more prescriptive in the maintenance of an inventory of personal information and that's what those two recommend uh those two risk areas and recommendations look to address. Uh so thank you. >> Thank you. Uh so as noted, Adriana's online as well uh for questions from MNP uh should we require that starting my speakers list with councelor Pribble and then if member Chima has anything as well a hand will indicate they're on the speakers list next. So for now I'll commence with councelor Pribble. >> Thank you and the chair to our staff. Uh on page 26 uh the observation number one the bottom management response states training will be provided to service areas etc. Can you please tell me how long this training will pro about take and when it will be starting to staff uh Mr. Sheltus. >> Thank you. Through the chair. Uh we'll be providing training documents uh in December of this year. Uh inerson and um virtual sessions will begin uh in the early in the year and they're going to be continuous. They're going to be ongoing uh training much like our other training uh throughout that that area provided for incoming staff. And then who it's going to be provided to. We have a number of service areas that have identified leads uh for records and MIFIPA uh pieces that typically deal with this type of information. That's who the training would be aimed for. >> Councelor PL. >> Okay. Thank you for that. On the following page, it says target Q1 2027 in place by January 2027. So I just want to make sure that the other points even though we have this target, but it says in place January 1st. So am I is my understanding correct that it will be done actually by January 1st >> Mr. Schultz? >> Yes there's wording there where it speaks to an MNP tracking and that's what Mr. Rocker was talking about the Q1 but you'll note in the brackets in place by January 1st 2027 that's what the legislation speaks to is a coming into force state. So those pieces the legislative required pieces will be in place by that date. Councelor Pval, >> thank you for that. On page 28, management response at the bottom bullet point, actively working on creating a corporatewide view. Does this view include the five bullet points in recommendation by MNP? >> Mr. Schultz, >> thank you through the chair. Yes, >> councelor Privile. >> That was a quick answer. Uh, now question to MNP on page 30. your two recommendations, how will they fully address the observations on the next page? Because when I read throughout the document your recommendations, they address three observations. This one, I wasn't really sure. If you can please clarify that. >> Can you answer that, Mr. Reco? >> Uh through you, Madam Chair, and thank you for the question. Uh and it's a it's an interesting one when you take a look at it. So what that um item is particularly looking at is the um the the city has um information that is contained in several different systems in in uh hard copy, soft copy, so on so forth. Uh what this was looking at particularly is that there is that limited oversight, centralized oversight, right? When we do not have things particularly within SharePoint. Uh and that's what that was that was looking towards understanding and appreciating that the city is already doing several things to look towards better consolidation putting things within SharePoint which is a system that allows for better management and tracking of this information. Um understanding that that is still something that the city will work towards. Um what we wanted to highlight within the recommendations is that while that good work still needs to continue there are other things that we can do. Can we take a riskbased approach even while that SharePoint progression is taking place, but can we take a risk-based approach to understand where the high-risisk areas are that maybe need to be prioritized a little bit more? And then as to management's comments with regards to training, continue with training and awareness to folks that even though we're continuing that migration towards SharePoint, this has to we have to be mindful of this that it's outside of that system. So I would love to um say to you towards the question that you know we can snap our fingers and move everything towards a centralized repository system such as SharePoint but we wanted to put these recommendations forward recognizing that that good work is still continuing. In the meantime, we need to make sure that we're taking a risk-based approach to compliance and continuing with ongoing dialogue with risk owners, right, that own this information or that oversee this information to continue to be mindful of it until we get to that place on the hill where SharePoint manages everything. >> Approval. >> Okay, thank you for that answer. And I have last question which I actually would like to it's going to I will address it to our staff but I would like a feedback from MNP as well. uh on page 32 uh the observation for 90 95% of their time processing access requests and we have Adobe Acrobat platform uh Camtasia Excel programming it doesn't seem to me efficient effective and very open to errors which was included actually in the report target Q3 2027 why so long and continue this way till that time could this time frame be shortened And so we actually get on the better, more effective, more efficient path. >> Mr. Schultz, >> thank you through the chair. So on page 32, uh the middle of the page, it uh speaks to the 95% of the time processing and the processing part of it is more than a simple workflow of an intake of a document or request. There's uh redactions that are required. And you'll note that one of the uh platforms we use is Camtasia. That is for video uh redaction. Uh for the Adobe Acrobat, that would be for other types of redactions. Typically, the workflow or FOI systems that um we're aware of, uh they deal with workflows for managing the the timing of uh intakes, uh trigger points. Uh we already have a robust uh system for that. Um but we are certainly uh uh as we've indicated in our response going to be looking at that software which there is a cost to um to um either supplement or replace our existing workflow. But on the other pieces of processing related to redaction or video pieces which are part of their their uh work um that's something that we would u not want to be relying entirely on technology. For example, we would not want to rely entirely on AI assisted reduction without a human uh check on that. Uh we take that very seriously the redactions and the protection of privacy. Uh so we would want staff to be looking at that and that may speak to the efficiency part of it. So we want to make sure that we get this right and that's why the timing is the Q3. There's a cost component, there's an integration with our uh systems and currently what we're doing works and we know that it works. Could there be an efficiency perhaps? But we would need to review that after looking at the FOI software. Thank you. >> Council approval. >> Okay, I'll just leave it. Oh, actually do you I I did want to get because MMP is this was actually from their observations. So if you can comment on that including the timeline Q3 2027. >> Mr. Reco. >> Uh thank you through the chair. I'll actually so I would be speaking out of turn with regards to this one. I would just ask my colleague Adriana who this is her world uh so she heads up the firm's privacy uh practice so I would just ask her Adriana do you have any comments on uh councelor Pribble's uh question >> sure uh thank you for the question uh just to answer that um uh that question regarding our view so as uh as we uh completed the assessment uh we we concluded that the activities are happening so this is something that will be an enhancement to the to the processes and uh uh what we notice when this legislation is implemented usually this type of requests increase in number. So uh the the reason for looking into having products that can um make it more efficient is to ensure that there is um there there is enough time to to address these requests in the future. But we recognize that the processes that are in place today are working properly. >> Thank you councelor Pville. Just a followup if I can get a confirmation that if we already know certain details regarding what's going to come in 1 of January 2027, do we currently fulfill the requirements the way we are doing it now or would it make more sense to speed up and to speed up the IT part? Should we start new year already on the new platform? >> Okay, I'll start with Mr. Schultz and then Adrienne can certainly add in anything. >> Thank you through the chair. So, uh, uh, as indicated by MNP, this would be an enhancement. So, the question as I understand it is legislative compliance. We would be legislatively compliant by January 1st, 2027 as is. >> Adriana, a comment on that? Yeah, I I concur. The the processes today meet the legislative requirement. >> Thank you, councelor Privile. >> No more questions, just a comment. If there's always an opportunity to do it potentially sooner, I think it's better if there is a enhancement in plants anyways. So, if there's an opportunity to do it earlier, I think it would be beneficial. Thank you. >> Thank you. I do have a question but looking to other members of the committee first in chambers or online with Mr. Chima. Okay. Um if you allow me to ask direct from the chair just realizing this report outlines uh staff timelines um for training resources and some potential technology investment. Does staff have access to those things in that monetary potential monetary budget at their disposal to fully implement what they deem required? >> Thank you uh madam chair. So for the FOI software uh we are aware that there's a cost. We have not got precise uh quotations or costing uh from uh FOI software specialist specialty uh providers. uh we don't anticipate that it would be exorbitant but there will be a cost so hopeful that we can uh manage that within our existing budget envelope as far as uh staff components and uh uh the comment by M&P that likely there will be or there potentially could be an increase in in work uh we're already experiencing that as are many municipalities across the province in a growing number of MIP requests and growing complexity of those MIPER requests We are trying to manage as best as we can uh within existing budgets to uh provide staff levels that can accommodate increased workflows but should there be an additional requirement obviously we would need to go through the appropriate processes to request uh additional budget. >> Thank you. as uh bill 97 uh comes into effect, if you could just remind me, did the government allow any funding to municipalities to help with the costs of increased technology and uh staff increased workflow? >> Madam Chair, not that I'm aware of. >> Thank you. I'm sure if something comes available uh council be informed at the earliest opportunity as we absorb uh these cost pressures as well. Looking to committee for further questions or comments as this is a move to receipt. I see nothing online. I see nothing in chambers. A show of hands of all in favor of receipt of 4.3. >> Motion carried. >> Thank you. Deferred matters and additional business. I'm not aware of any. So just looking quickly to community and online. Seeing none, I will concur that this is our last meeting of the audit committee um for this term of council. The next scheduled date for the audit committee is December 9th for the new term. The advertisement for the chartered accountant position on the audit committee has been posted and is open until November 4th for anyone who would like to apply. And I want to just take this opportunity to also extend gratitude to member Chima for serving uh for this entire term of council with us again and the knowledge and the questions that he's brought to the table. So thank you for that. We have no confidential items that would leave us with adjournment. I have a mover and councelor Cuddy a seconder and councelor Pribble. This would be a show of hands and thank you to MNP uh and all those who supported this committee throughout this term. You've made it to the end and a show of hands of a German of this meeting. >> Motion carried. >> Thank you everyone and I wish you a wonderful and productive day.