Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Internal Audit topic
No spam. Unsubscribe anytime.
City audit finds offboarding gaps — employees retained access for days to months; committee accepts audit and asks for fixes
Summary
A city performance audit found inconsistent offboarding practices, delays in disabling system access (median 15 days after termination in sample), incomplete property-return documentation, and unsecured storage of collected ID badges. The Finance committee accepted and filed the report and asked HR, AIM and emergency preparedness to implement the
The city auditor presented a quick-response audit of offboarding processes for separations and interdepartmental transfers on Oct. 29 and the Finance and Executive Committee voted to accept and file the report.
Brandy Bell, presenting the audit, said the review covered termination and transfer transactions for calendar year 2024 and found the offboarding process is manual and decentralized across agencies. Of a sample of 28 terminated employees, only seven had system access terminated within one day; 21 retained access between 3 and 161 days after termination, with a median of 15 days. The audit also found evidence of active user accounts dating back to 2014 in some city systems and incomplete or missing separation documentation that should reconcile city property returns.
The audit identified nine recommendations to human resources, AIM, and the mayor’s office of emergency preparedness. Those recommendations called for updated offboarding processes, improved notification workflows to promptly revoke system access, standard documentation to track issued equipment, and a requirement that collected ID badges be destroyed rather than stored. The HR commissioner, CIO, and emergency preparedness executive director agreed with the recommendations, the auditor said.
HR told the committee it agreed with the recommendations and plans to implement changes; HR noted other outstanding items (benefits and total-compensation work) that staff are balancing. Following the presentation, the committee moved to accept and file the audit; a motion to accept and file carried.
Why it matters: Incomplete offboarding increases risk from unauthorized access to systems and retention of city property by separated employees. The audit’s recommendations, if implemented, are intended to reduce compliance and security risks.
Next steps: The auditor recommended nine items (detailed in the report) and the relevant departments agreed to implement them. Committee members opened the vote to accept and file the audit on the record; the motion passed and the committee requested follow-up reporting as the agencies implement the changes.
