Plante Moran presented its final entitywide risk assessment to the Palm Coast City Council at a Sept. 23 workshop, outlining top risks and a menu of recommended actions and monitoring steps to help the city allocate resources and reduce operational vulnerabilities. The assessment, commissioned under a master services agreement approved by the council, covers strategic, operational, financial and compliance risks and recommends assigning owners, creating dashboards and embedding risk reporting into quarterly department reports.

The assessment matters because its recommendations affect staffing, capital priorities and how the city tracks and funds maintenance and technology improvements across a growing municipal system. Plante Moran’s report highlights risks that, left unmanaged, could cause service interruptions, reputational damage or extra costs and recommends steps to make risk management a continuing operational function rather than a one‑time exercise.

Plante Moran described the project methodology, having interviewed department directors, conducted risk workshops and developed standardized scoring criteria for inherent and residual risk. “This helps understand how to allocate resources across departments and priorities,” said Brianna Solorio, a Plante Moran manager, summarizing how the report is intended to be used. The firm stressed that scores reflect both impact and likelihood and that residual risk incorporates existing controls.

The firm’s visualization placed 18 identified risks on an impact/likelihood matrix; the five highest priorities were listed as political climate (shifts in policy and leadership that can change funding and momentum), asset management (aging infrastructure and reactive maintenance), public services (meeting resident service expectations), IT security and infrastructure (manual workarounds, business continuity documentation gaps) and reputation (rapid changes in public sentiment). Plante Moran recommended near‑term work in five categories: smoothing political transitions, developing asset management plans for water and wastewater, assessing compensation and performance management to address staffing shortages, optimizing the Munis ERP to reduce manual workarounds, and establishing an internal audit function to conduct independent operational reviews.

Council members asked about comparisons with other Florida municipalities and return on investment for the recommended actions. “We did not see anything … that stood out as particularly alarming or unique relative to other municipalities,” said Matt Boden, the engagement partner, describing Plante Moran’s view that Palm Coast’s risk profile is broadly consistent with peers. Council members and the city manager pressed the consultants on whether specific recommendations required immediate, large expenditures; Plante Moran said the report is a portfolio of possible actions and that the city should prioritize top risks and, if desired, work with the firm to estimate potential ROI for particular mitigations.

City Manager provided procedural context and next steps. “City council does an audit every year, per our guidelines and under state statute,” the City Manager noted during the workshop, adding that the council had asked staff to conduct a risk and efficiency assessment — the work Plante Moran delivered. Staff told the council it plans to add risk‑mitigating activity updates to department quarterly reports and to assign responsibility and timelines for any actions the council elects to pursue.

Council reaction was mixed on cadence: some members said the report revealed no immediate crisis requiring large unbudgeted spending and suggested multi‑year implementation, while others supported creating an internal audit function and doing targeted follow‑ups. The consultants recommended an annual refresh of the assessment and a governance framework that includes risk owners, control owners, a risk management committee and internal audit as a third line of defense.

Next steps described during the workshop included council review of the recommended actions, council direction to staff about which items to pursue, assignment of responsible parties and timelines, and a follow‑up to check implementation. Staff said quarterly reporting could incorporate the status of mitigation actions, and Plante Moran recommended scheduling an annual refresh of the assessment to keep the risk profile current.

The full Plante Moran report was provided to council in the meeting backup materials and will be the basis for any later budget decisions the council makes regarding the recommended activities. The city manager and staff will follow up with members of the public who raised data‑center, forensic‑audit and other concerns during public comment earlier in the session.