Assurances made by or about the City's own audit function are logged here on the same terms as any other. The office that verifies others is not exempt from verification.
In the City's formal response to Audit Report A2023-07: formal processes for financial analysis, incentive tracking, deadline management, and closure verification "will be established," with implementation within six months.
What would confirm it
A published follow-up audit re-testing each finding; the revised policy with documented Council approval; populated monitoring records.
19 months past the stated date, no published follow-up located.
FY2025–2026 Annual Audit Plan: 250 hours budgeted, with the qualifier "Dependent on FOAC decision."
The November 30, 2025 quarterly update shows zero hours charged — uniquely among that quarter's engagements, several of which had already begun.
The department's own manual states this review is due every three years; the last one published was in 2022.
Zero hours charged as of the first quarter; no published result as of August 2026.
Stated in the FY2026 First Quarter Plan Update, while the Chief Internal Auditor position was vacant.
What would confirm it
The annual independence confirmation that professional auditing standards require the chief audit executive to deliver, including disclosure of any impairment and the safeguards applied. Not located in the public record.
Delivered September 2025 — two months late. The oversight committee did not take it up until November 14, 2025 — two months after that. The Chief Internal Auditor retired August 1, 2025, between the promised and actual delivery dates.
One concern resolved in the department's favor: an earlier question about whether the final report might understate the maturity gap found in the preliminary does not hold — the final states the identical finding as the preliminary, and is longer and more detailed, not shorter.
The report separately states the department has demonstrated alignment with audit standards "via required peer reviews" — the most recent of which was published in 2022, now outside the three-year cycle the department's own manual describes.
Accurate when made; its evidentiary basis has since aged past the review cycle it depends on.
Implicit in the operation of the City's employee hotline. The consultant found the procedures manual lacks defined anti-retaliation controls — no definitions of retaliation, no training requirements — and no provision for independent or secondary review. One person is solely responsible for receiving and deciding whether to escalate every report.
First scheduling: FY2024–2025 plan, fourth quarter (June–August 2025). Second scheduling: FY2025–2026 plan, second quarter (December 2025–February 2026), with a discretionary condition added that wasn't present the first time.
Not performed in FY2025; zero hours charged as of the FY2026 first quarter; unpublished through May 2026. More than 25 months after the original audit, 17 months past the stated corrective-action deadline.
One self-assessment carried over into FY2026, drawing a small fraction of its budgeted hours; the peer review itself shows zero hours as of the same reporting period. No peer review has been published since 2022.
Made roughly three months before the assessment being discussed was actually complete.
What the assessment was actually scoped to do
Assess the audit department's structure, roles, and practices against professional standards — a capability-maturity review, not a financial audit or a review of transactions. Misuse of funds was never within its scope.
The statement is accurate and answers a question the assessment was never built to ask. Logged not as criticism of the speaker — clarifying "this is about process, not money" is a reasonable thing to say — but because a true, reassuring statement about the wrong scope is exactly the kind of assurance that needs an artifact behind it rather than a speaker.
ONE ENTRY FROM THE SOURCE RECORD — A LOG OF UNANSWERED OUTREACH TO THE CHIEF INTERNAL AUDITOR'S OFFICE — IS HELD OUT OF THIS VERSION PENDING A FORMAL RECORDS REQUEST, AND WILL BE ADDED ONCE THAT RECORD EXISTS.