Committee approves FY 2026–27 internal audit plan; priorities include Green Bank transactions, IT controls and cybersecurity

Jamie Fernandez, director of internal audit, summarized the annual internal audit report for the fiscal year ending 03/31/2026 and presented the FY 2026–27 internal audit plan.

Fernandez outlined proposed work streams that include a deals transaction review for New York Green Bank to assess compliance with operational procedures, an IT general controls audit focused on user access, change management and data protection (expected to be outsourced), a joint cybersecurity/information security audit to evaluate threat prevention and incident response, and an audit of solicitation and non‑competitive procurement. Fernandez also described advisory engagements on collateral management and repayment controls and noted the plan includes a continuous monitoring review of payment transactions required for internal controls certification.

Fernandez told members internal audit had extended an offer to a new internal auditor with an anticipated start date of 05/07/2026 and that the function had no concerns regarding independence or impairment; an external quality assessment is required and will cover audits issued after 03/31/2022. "The director of internal audit will disclose to the audit and finance committee any interference… related to the scope, performance, or communication of internal audit work and results," Fernandez said. Committee members voiced strong support for prioritizing cybersecurity and IT audit work, noting the Green Bank's higher profile and potential cyber risks. The committee moved, seconded and voted 'Aye' to approve the internal audit plan for FY 2026–27.

Next steps: internal audit will begin the planned engagements and update the committee on staffing and outsourcing decisions as they are finalized.