The Indianapolis–Marion County Audit Committee approved the minutes of its July meeting and spent most of its Oct. 31 session receiving enterprise risk and cybersecurity briefings.

Chair David Reynolds opened the meeting and confirmed a quorum before members moved and seconded approval of the July minutes; the committee approved the minutes by voice vote.

Why it matters: Committee members were given a year-end risk overview that the Office of Finance and Management's (OFM) risk team and the Information Services Agency (ISA) presented as parts of the city-county's broader risk landscape. The information will feed the office's annual audit planning and help identify operational risks that may require follow-up audits or management action plans.

OFM risk and safety: Wesley Jones, director of the Office of Audit and Performance, summarized OFM's risk priorities for 2025, which the presentation listed as workers' compensation data and reporting, motor vehicle accident tracking, insurance education and business continuity planning. Jones said OFM and partners have been tracking workers' compensation costs and improving data collection and reporting.

Year-to-date workers' compensation payments cited in the presentation were about $5,900,000 for the city and about $582,000 for the county. Jones described a new risk-management platform (Origami Risk) that OFM is using to integrate crash reports, fleet-repair estimates and claims management and said the system provides web and mobile reporting options for staff.

Jones also summarized a Sept. 26 building evacuation drill: 362 people evacuated, the average time to evacuate a floor was 9 minutes and 45 seconds, and the total drill took just under 28 minutes. OFM reported it held six OSHA classes this year (87 total attendees), ran a defensive-driving training completed by 205 employees across agencies and completed seven departmental safety walk-throughs.

Cybersecurity and data: Jones said ISA's phishing-awareness campaign has reduced click rates on simulated phishing tests and that the enterprise is adding multi-factor authentication for more applications, expanding remedial training and implementing data-sensitivity labeling to support email encryption where required. He referenced ISA's work on a forthcoming enterprise data roadmap and said the Office of Audit and Performance participates in ISA's functional groups and cybersecurity committee.

Accessibility reminder: Councilor Michael Paul Hart asked staff to prioritize "508 compliance," referencing federal accessibility obligations for PDFs and online materials for jurisdictions above 50,000 population with a 2026 compliance deadline. Jones acknowledged the item and said he would coordinate with ISA and OFM staff.

Votes at a glance: The only formal action recorded in the meeting minutes was approval of the July meeting minutes. The motion was moved and seconded; the committee approved the minutes by voice vote. The record does not include a roll-call tally.

What's next: Chair Reynolds flagged three proposed 2026 meeting dates (March 13, July 31 and Oct. 30, all Fridays at 9 a.m.) and asked members to raise any scheduling conflicts. Staff said the committee's annual report and the office's updated entity risk assessment will be prepared for the coming year.

Quote: "Seeing as this is our last meeting of the year, you're going to get a lot of OAP FaceTime," Wesley Jones said as he introduced the presentations.

The committee adjourned after recognizing member Tanya Njai for her service.