2021 RISK ASSESSMENT AND AUDIT PLAN

PROGRAM EVALUATION AND AUDIT

November 17, 2020

Amended February 23, 2021
Metropolitan Council ― Program Evaluation and Audit
2021 RISK ASSESSMENT AND AUDIT PLAN
Introduction
Each year, the Metropolitan Council’s Program Evaluation and Audit Department creates a risk-
based audit plan for the next calendar year. Our risk-based approach is based on observations
and experience throughout the year, regular meetings with Executive Leadership and annual
risk discussions with senior managers from across the organization. This document describes
the requirements, methodology, general and specific risk environments, and contains the
planned list of projects the Audit team will work on in 2021.

If there are any questions or comments on this document, please submit them to Director, Matt
LaTour at [email protected].

About the Metropolitan Council

The Metropolitan Council operates in many public policy sectors:

• Environmental Services works to protect the public’s health and the environment by
preserving and managing the region’s water resources. It treats water and sewage,
processes industrial waste, and connects residents and businesses to the sewer system.
• Metro Transit is the transportation resource for the Twin Cities Metropolitan Area,
offering an integrated network of buses, light rail and commuter trains as well as
resources for those who carpool, vanpool, walk or bike. Metro Transit transitway
systems are growing through several projects including, the METRO Green Line
extension, the METRO Orange Line project, and the METRO Gold Line project.
• Metropolitan Transportation Services oversees transportation planning for the region,
as well as contracted transit services, funding for suburban transit providers, and Metro
Mobility. It also is responsible for distributing grant dollars throughout the region as the
Metropolitan Planning Organization.
• Community Development is responsible for the Council’s regional growth strategy and
provides planning and technical assistance to local communities. It also administers
grants for the regional parks system and the Livable Communities Act. Finally,
Community Development operates a Housing and Redevelopment Authority that
administers rental assistance programs in communities throughout the Twin Cities
Metropolitan Area.
• Regional Administration provides centralized support for all business units, including
Audit, Finance, Procurement, Information Services, Legal, Human Resources, Risk
Management, among others.

The Program Evaluation and Audit team has 9 full-time staff and 3 part-time interns and
operates out of the Regional Administration division. The Audit Director reports functionally to
the Audit Committee and administratively to the Regional Administrator.

Requirements
The Metropolitan Council’s Audit Committee Charter requires that the Audit Committee review
and approve proposed risk-based internal annual audit work plans and make recommendations
concerning internal audit projects.

2
Further, the Institute of Internal Auditors’ Standards for the Professional Practice of Internal
Auditing, standard 2010 deals with audit planning, and requires, in part that: 1

• The chief audit executive must establish a risk-based plan to determine the priorities of
the internal audit activity, consistent with the organization’s goals.
• The internal audit activity’s plan of engagements must be based on a documented risk
assessment, undertaken at least annually. The input of senior management and the
board must be considered in this process.
• The chief audit executive must identify and consider the expectations of senior
management, the board, and other stakeholders for internal audit opinions and other
conclusions.
• The chief audit executive should consider accepting proposed consulting engagements
based on the engagement’s potential to improve management of risks, add value, and
improve the organization’s operations. Accepted engagements must be included in the
plan.

This document represents a summary of the risk assessment for 2021 and the proposed audit
plan. The Council’s Thrive 2040 outcomes and principles were considered in selection of each
audit included in the 2021 plan.

Methodology
Each year, the Audit team completes the Minnesota Management and Budget’s (MMB) Control
Environment Self-Assessment Tool (CESAT). 2 While the Council is not an Executive Branch
Agency, the Audit team believes it is good practice to use the MMB’s CESAT help inform our
audit work. The CESAT helps identify potentially riskier areas for the Council, which are then
followed-up on in the risk assessment meetings.

After completing the CESAT, the Audit team meets with management and staff from around the
Council in all divisions. Beginning in late August, the Audit team met with around 40 Council
departments. Given the breadth of the activities of the Metropolitan Council, Program Evaluation
and Audit takes an inclusive approach to risk assessment and audit planning. Once the
meetings were complete, Audit staff scored each area across six risk areas:

- Financial Significance: The level of budgeted annual expenditures and revues. When
complete financial information is not readily available, a metric of full-time employees (FTEs)
and overall area impact is used.
- External and Internal Risk: Includes external risks such as political, economic, social,
technological, legal compliance, environmental. Internal risks include capital, people,
process, technology.
- Information Technology Complexity: Number of systems or mission critical information
systems within the department.
- Equity Impact: New in 2020. It is a relative score that measures the degree to which each
business process affects equity goals, outcomes or objectives either internally or externally.
- Time Since Last Audit: Length of time since last known internal or external assurance
services.

1
Institute for Internal Auditors. (2017). International Standards for the Professional Practice of Internal
Auditing (Standard 2010 – “Planning”).
2
Minnesota Management and Budget. (2020). “Internal Control Framework.” Web. Link:
https://mn.gov/mmb/internalcontrol/internalcontrolframework/

3
- Directional Change: Indicates if the area’s leadership has changed or if there is significant
staff turnover.

Each risk area is weighted differently and scored on a scale of 1 (low risk) to 3 (high risk) by the
Auditor-in-Charge that conducts the risk assessment meeting. Then, the Audit team meets to
standardize scores. The sum total scores present a general sense of the relative risk assigned
to each line on the risk register. Finally, the Audit Director selects the projects and prepares the
audit plan.

A draft of the planned audit project list was shared with senior executives prior to presentation to
the Audit Committee.

4
General Risk Environment
After consulting with leadership across the Council, several risks emerged that are Council-wide
in nature and could affect the Council as a whole. Those are summarized here to provide a
picture of the Council’s general risk environment. Risks to specific program/policy areas of the
Council will appear in the next section, “Risks to Specific Council Programs.”

COVID-19 Pandemic
The novel coronavirus (COVID-19) pandemic has severely impacted Council operations and
budgets. As the pandemic developed, some services were reduced; by Executive Order,
workers that were able to telework were required to do so; and emergency procedures were
activated. In late April, the Council received $226 million from the Federal Transit Administration
through the federal Coronavirus Aid, Relief, and Economic Security (CARES) Act to help offset
increased costs and reduced revenues due to the pandemic. Personnel have also had to
navigate the federal Families First Coronavirus Response Act (FFCRA) as they or a loved one
got sick.

The Council has stood up an Incident Command Structure and continues to respond and adjust
to the pandemic’s realities and will continue to do so into 2021.

Equity at the Council

On May 25, George Floyd was killed in Minneapolis by Minneapolis Police officers. This
resulted in weeks of protests, a state-wide emergency, and a reinvigorated focus on equity.
Council departments have reacted to these events through town halls, small team
discussions, and by reassessing how they implement or contribute to equity in their work.

As part of the risk assessment process, Audit asked department heads and staff about how
they contribute to equity, if there are barriers in their work causing inequities, and how they
implement Thrive in their work. Audit has also created a new risk factor, “Equity Impact” to
capture departments’ risk of contributing to inequitable practices. Audit will be performing
audits with an equity focus in 2021.

Economic Trends
Council operations in 2020 have been severely impacted by the COVID-19 pandemic. Each
division’s operations and budgets have been affected by the economic downturn, shutdowns,
and workforce disruptions. Many of the Council’s revenue sources including fares, taxes and
charges that depend on economic activity face uncertainty in the short and long term. Economic
impacts are expected to continue into 2021 and potentially beyond.

Due to the COVID-19 pandemic, unemployment is high in the Twin Cities metropolitan area. 3
The Council has been under a soft-hiring freeze since April as a result of the pandemic, and
positions are filled on a case-by-case basis.

The overall landscape changes daily due to the impacts of federal policy affecting government
at the federal, state and local level. Among issues that could affect the Council throughout 2021
are federal appropriations, and proposals for immigration and infrastructure policy. In addition,
there remains uncertainty surrounding the level and commitment to funding future transit

3
The U.S. Bureau of Labor Statistics reported the preliminary unemployment rate for September 2020
is 5.9%. This is the most current data available. https://www.bls.gov/eag/eag.mn_minneapolis_msa.htm

5
projects. Despite this, Congress approved the Southwest Light Rail Green Line Extension’s Full
Funding Grant Agreement in September.

2020 Elections
The 2020 elections occurred on November 3rd. The President of the United States, all United
States and Minnesota State House of Representatives, all Minnesota State Senators, and
United States Senator Tina Smith were up for election. Party control of any of these executive
and legislative bodies could have affected the Council’s budget, legislative, and operating
environments.

Most elected officials retained their positions in Minnesota, and there was not a change in party
control of either state legislative body. With Joe Biden winning the presidency, there will be a
change in cabinet-level officials and federal agency heads, including those in Housing and
Urban Development, Transportation, and the Environmental Protection Agency. These changes
could affect the Council’s operating and regulatory environments.

State Government – 2021 Legislative Session

The 2021 legislative session will be the second with Council Chair Charlie Zelle. Several issues
that affect the Council could potentially surface during the 2021 Legislative Session including
bonding for transportation and inflow and infiltration activities. In addition, a change in fare
enforcement penalties from a criminal charge to an administrative citation could affect policing
on Metro Transit proof-of-payment transit services.

During a special session, the state bonding bill was passed. The bill contained critical monies for
the B and D arterial bus rapid transit routes; Inflow & Infiltration grants; and Regional Parks &
Trails grants.

Cyber Security
As the Council has become more reliant on technology, we have also become more vulnerable
to cyber-attacks. These threats can impact our ability to operate our major enterprise systems
as well as protect private and financial data. These risks have only increased as Council staff
work offsite due to COVID-19.

Additionally, the Council’s operating divisions increasingly rely on information technology to do

their jobs efficiently, quickly and accurately. It is important for the Council to maintain its
complex information systems and to respond to new technology while protecting itself against
emerging cyber threats.

With the emergence of new technologies, the use of various technology platforms, and the
movement of many applications to the Cloud the need for diverse technology expertise grows
seemingly daily. The competition for employees with required expertise is significant. Given the
role of the Council in operating critical infrastructure such as wastewater and transit systems,
adherence to cybersecurity frameworks such as the National Institute for Standards and
Technology (NIST) is essential.

Collective Bargaining Negotiations

Ten contracts between bargaining units and the Council expire on or before December 31,
2020. There contracts affect units responsible for major service and operations in many parts of
the Council.

6
Risks Specific to Council Operations
Transit
Metro Transit ridership has declined across all modes due to the COVID-19 pandemic. Metro
Transit has reduced services to assist with social distancing efforts, which led to decreased
operational revenue. Revenues from fares and the MetroPass program have also declined and
stayed low as many office workers are working from home.

Transit funding continues to be a challenge without reliable dedicated funding to support

continued baseline service and future service growth needs. Additionally, motor vehicle sales
tax (MVST) funds have fluctuated in recent years and are sensitive to the broader economy.
While the Council received federal CARES Act dollars, staff consider this to be a one-time influx
of funds and not a reliable source of income.

Metro Transit and Metropolitan Transportation Services have faced the brunt of COVID-19
safety issues. The public facing nature of the job increases operators’ health risks.

The Council now has several major capital transit projects underway; each of these projects
carries unique and substantial risk to the Council. 2021 will be a significant year as at least two
of these projects (Southwest Light Rail and Orange Line BRT) are in heavy construction
phases. SWLRT received a full funding grant agreement from the FTA in September, which will
cover the remaining $1 billion in funding.

Metro Mobility and other contracted services are also dealing with reduced ridership. Like Metro
Transit, MTS has seen steep ridership declines due to the pandemic. In an effort to help keep
contractors employed, MTS has authorized contractors to provide grocery delivery service and
requested that they help transport essential workers to their destinations.

Community Development
The Council has a large Section 8 program in addition to owning 150 housing units.
Unfortunately, due to COVID-19, unit inspections have been delayed, and are now being
performed virtually.

Changes in regulations and/or funding from Housing and Urban Development may cause
financial risk within the programs. Due to federal rules and funding formulas, there is a structural
funding deficit. Changes in the economic environment including increased market rents and
COVID-19 have led to an increased need for CD’s housing services.

Environmental Services
Environmental Services (ES) is a leader in the region and the state on water quality issues.
Changes at the national level could result in changes in regulations for clean water. Changes in
state regulations or changes at the PCA or EPA could affect ES and water management in the
region.

COVID-19 presents unique challenges for wastewater operations because of the 24/7/365
nature of the plants. In some cases, operators need to work in close proximity for extended
periods of time. Managing the pandemic effectively is essential to keeping these operations on
track.

7
ES has experienced a number of organizational changes. Two assistant general managers
retired this year. ES has also created a new Workforce Unit, moving it out from its previous
location in Administration.

External Audits or Other Reviews

As a state and federal recipient, the Metropolitan Council is routinely audited by external
offices for compliance across numerous areas. External audits help test controls, identify
areas for improvement, and provide additional audit coverage for the internal audit team. This
section discusses some of the audits that the state government, federal government, and third
parties provide.

State of Minnesota

Minnesota State Auditor

The Council is annually audited by the Minnesota State Auditor. The state auditors test financial
controls, federal programs, and major funds related to financial reporting.

Department of Public Safety State Safety Oversight Audit

The Minnesota Office of State Safety Oversight (OSSO) is auditing several elements of Metro
Transit’s Public Transit Agency Safety Plan (PTASP). OSSO’s audit will cover several elements
of the plan, including hazard identification, event reporting, and emergency response planning.
Auditors were onsite from September 28th to October 2nd. The report will be issued within 90
days of the onsite review.

Governor Tim Walz’s Blue Ribbon Committee on the Metropolitan Council’s Structure
and Services

Governor Walz has authorized a Blue Ribbon Committee on the Council’s structure and
services. The Committee will review how Council members are selected, its role as an MPO,
and the effectiveness of the delivery of regional transit service. The Committee consists of 15
business and community members. The report will be issued to the Governor by December 31,
2020. 4

Federal Audits

2022 Federal Transit Administration Triennial Review

Every three years, the Federal Transit Administration (FTA) audits the Metropolitan Council with
a focus on its transit operations. The Triennial examines how recipients manage federally
funded programs and meet federal requirements. The Triennial covers 21 areas including Equal
Employment Opportunity, Financial Management, Maintenance, Public Safety, Transit Asset
Management, and Title VI. 5

4
More information can be found on the Metropolitan Council’s website at:
https://metrocouncil.org/Council-Meetings/Committees/Governors-Blue-Ribbon-Committee.aspx
5
More information can be found on the FTA’s website at: https://www.transit.dot.gov/funding/grantee-
resources/triennial-reviews/triennial-reviews

8
In 2020, the FTA cancelled all triennial reviews due to COVID-19. The FTA has informed Audit
that the Council’s next triennial review will be delayed a year to 2022. The Council should begin
to prepare for the triennial review next year.

2021 Metropolitan Planning Organization Certification

Every four years, the Federal Highway Administration (FHWA) and FTA certify Metropolitan
Planning Organizations (MPOs). Federal auditors review the planning process for the
metropolitan area and jointly issue their findings to the Secretary of the Department of
Transportation. 6 The Council is currently undergoing its certification, and Metropolitan
Transportation Services is handling the response.

Internal Revenue Service General Obligations Wastewater Revenue Bond Audit

The Internal Revenue Service (IRS) routinely audits municipal debt issuances to determine
compliance with federal tax requirements. The IRS has selected a wastewater revenue bond for
review. The review is being handled by the Council’s Deputy Chief Financial Officer.

Third-Party Reviews

Aon Audits

The Council contracted with Aon to perform multiple services. The organization conducted two
assessments for the Council in Information Services and Risk Management. Leadership is
currently reviewing these reports.

Citizens League Metro Transit Police Review

The Council is contracting with the Citizens League to review the Metro Transit Police
Department. They will be conducting community surveys and potentially reviewing Policing
practices. The report is expected to come out in quarter 2 of next year.

6
More information can be found on the FTA’s website at: https://www.transit.dot.gov/regulations-and-
guidance/transportation-planning/certification-review.

9
Council Internal Control Environment
A resilient organization establishes and maintains a strong internal control environment. Audit
used the State of Minnesota’s Control Environment Self-Assessment Tool (CESAT) to assess
the Council’s control environment and inform the risk assessment. We based this evaluation
on our own knowledge or the Council, our risk assessment meetings, and feedback from key
senior managers. The CESAT consists of 18 goals and approximately 90 questions on a
range of topics from financial controls, procedural controls, hiring practices, and the culture of
the organization.

Audit reviewed the CESAT twice in 2020 due to the major changes to risk environment
created by the novel coronavirus pandemic (COVID-19) and the killing of George Floyd, as
well as part of our normal assessment process. There are several areas the Council should
review to become more resilient in the face of internal and external pressures as a result of
the pandemic:

1. Ensure that the Council’s 2021 budget and contingency planning account for
uncertainty caused by COVID-19.

2. Continue to update outdated policies and procedures to ensure they align with Thrive
MSP 2040 and adapt to the Council’s changed environment since March.

3. Ensure that staff are cross trained to prevent single points of failure, an unexpected
departure, or the hiring freeze does not end. Ensure that cross-trainings are performed
equitably.

4. Continue to develop strategic planning documents that provide clear goals and
objectives that can be tied directly to key business practices.

5. Ensure the security of systems and provide training to employees on Minnesota

Government Data Practices Act. The Council should work to improve literacy of key
risks related to security of private information, which is critical as many employees
work from home.

Audit will review these areas as it implements the 2021 Audit Plan.

10
2021 AUDIT PLAN
PROJECT NAME
Audit
Council-wide
Metropolitan Council Underutilized Business Program (MCUB)
Contract Management
Contract Negotiation (Non-standard) *
Overtime Management
2022 FTA Triennial Preparation
Communications Consultation

Environmental Services
Clean Water Fund Compliance*
Industrial Pretreatment Incentive Program (IPIP)*

Metro Transit
MTPD Body Camera Implementation and Use
Metro Transit Facility Security
Police Evidence and Asset Inventory
Police Fare Check Practices*
Bus Operator Management
Electric Bus Procurement*
Southwest Light Rail - Civil Construction Contract*
Metro Transit Safety
Police Benchmarking Consultation

Metropolitan Transportation Services

CARES Act Spending by Suburban Transit Providers
MTS Oversight of Subrecipients
Regional Solicitation Project Selection
MnDOT Funding Agreements

Regional Administration
Payment Processing and Collection
Workers’ Compensation Administration
Job Classification Process
Human Resources Hiring and Employment Data
Technology Governance Implementation Review
Technology Asset Inventory*
Logical Access or User Administration*

Special Projects
Internal Audit Strategic Plan*
Audit Manual Updates
Director participation in Incident Command Structure

11
 External Review of Peer Audit Department (reciprocal agreement)
Fraud Awareness Training
Investigative / Fraud Policy and Procedure Updates

*Indicates carryover project from 2020

This plan accounts for approximately 75% of available hours for the Program Evaluation and
Audit staff. The remainder is left open to allow for emergent, unplanned projects that are
requested over the course of the year.

12